Dynamic suffix lexical element clustering and optimizing method for large language model countermeasure attack

Abstract

The invention discloses a suffix lexical element dynamic clustering and optimization method facing large language model adversarial attack, and relates to the technical field of network security, the method comprises the following steps: constructing a word vector space; calculating a mutual reachable distance between every two word vectors in the word vector space; constructing a hierarchical clustering tree based on all the mutual reachable distances, and adaptively determining an optimal cluster number according to the stability of nodes in the hierarchical clustering tree; based on the optimal cluster number, determining an initial cluster center in a word vector space by adopting an initialization method based on cosine distance; performing clustering optimization by taking the initial cluster center as a starting point to obtain a final semantic cluster set; calculating a comprehensive score of each candidate lexical element in each semantic cluster in the final semantic cluster set; and screening out a preset number of candidate lexical elements from each semantic cluster according to the comprehensive score to form an optimized candidate lexical element group for resisting attacks. According to the method, a high-quality candidate lexical element basis is provided for efficient construction of antagonistic suffixes.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a dynamic clustering and optimization method for suffix morphemes in response to adversarial attacks on large language models. Background Technology

[0002] In the research on the security of large language models, adversarial attacks aim to mislead the model into producing harmful or unsafe outputs by constructing specific suffix inputs. Gradient-based adversarial suffix generation is a typical attack method, the core of which lies in screening candidate lexical sequences from a massive model vocabulary that can maximize the inducement of harmful behavior. How to efficiently and accurately screen lexical sequences from a massive vocabulary that possess both high attack power and semantic appropriateness is a key technical problem for improving the success rate and efficiency of adversarial attacks.

[0003] In existing technologies, cluster analysis is often used as a preprocessing or optimization step for lexical filtering, aiming to group semantically similar candidate lexical units to facilitate subsequent selection. Traditional methods typically apply classic clustering algorithms, such as K-Means based on Euclidean distance or hierarchical clustering, to process word vectors extracted from pre-trained language models, hoping to understand the distribution structure of word vectors through cluster partitioning, and then combine this with gradient information for filtering.

[0004] However, these existing technologies have significant bottlenecks in the candidate lexical selection process. First, the clustering methods are mismatched with the data characteristics. The inherent high-dimensional spherical distribution of pre-trained word vectors is not fully considered. Directly applying Euclidean distance or unoptimized similarity metrics introduces bias due to differences in vector magnitudes, disrupting the geometric representation of semantic similarity and leading to semantically chaotic cluster partitioning. Second, the determination of the number of clusters relies on prior knowledge and experience. Traditional methods require pre-specifying the number of clusters K or relying on manually set distance or similarity thresholds for segmentation, lacking adaptive perception of the inherent structure of the word vector space. This results in unstable clustering results and an inability to effectively distinguish core semantic clusters from noisy discrete points. Third, there are initialization sensitivity and convergence issues. On spherical data, traditional clustering methods are sensitive to initial center selection, easily getting trapped in local optima, and have slow convergence speeds, affecting the efficiency of real-time adversarial attack construction.

[0005] Therefore, existing technologies are insufficient to meet the requirements of efficient and accurate adversarial lexical selection. There is an urgent need for a lexical clustering and optimization method that can adapt to the characteristics of word vector space, accurately determine semantic clusters, and deeply integrate with attack gradient information. Summary of the Invention

[0006] To solve the above-mentioned technical problems, the following technical solution is provided: 1) In a first aspect, the present invention provides a dynamic clustering and optimization method for suffix lexical units in response to adversarial attacks on large language models, the specific technical solution of which is as follows: Obtain a set of candidate lexical units for target prompts in the field of cybersecurity, and obtain the word vector corresponding to each candidate lexical unit in the set through a pre-trained language model; all word vectors together constitute a word vector space; Calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all mutual reachability distances; and adaptively determine the optimal number of clusters based on the stability of nodes in the hierarchical clustering tree. Based on the optimal number of clusters, an initial cluster center is determined in the word vector space using an initialization method based on cosine distance; Clustering optimization is performed starting from the initial cluster centers to obtain the final set of semantic clusters; Calculate the overall score for each candidate lexical unit within each semantic cluster in the final semantic cluster set; Based on the comprehensive score, a predetermined number of candidate lexical units are selected from each semantic cluster to form an optimized candidate lexical unit group for adversarial attacks.

[0007] The beneficial effects of the dynamic clustering and optimization method for suffix morphemes against adversarial attacks on large language models provided by this invention are as follows: By calculating the reachability distances between nodes and constructing a hierarchical clustering tree, the optimal number of clusters is adaptively determined based on node stability, achieving a precise perception of the intrinsic structure of the word vector space and eliminating reliance on manually preset parameters. An initialization method based on cosine distance is used to determine the initial cluster centers, effectively adapting to the high-dimensional spherical distribution characteristics of word vectors and improving the rationality of initialization and the quality of the algorithm's starting point. Clustering optimization is performed starting from these initial cluster centers, resulting in a final semantic cluster set with better semantic cohesion. Based on this, a comprehensive score integrating gradient weights and semantic consistency is calculated, and selection is performed according to the score. The resulting optimized candidate word tuples can more accurately balance attack effectiveness and semantic fluency. The entire process improves adaptability to different data distributions, enhances the stability of clustering results, and provides a high-quality candidate word tuple foundation for efficiently constructing adversarial suffixes.

[0008] Based on the above scheme, the dynamic clustering and optimization method of suffix lemmas for adversarial attacks on large language models of the present invention can be further improved as follows.

[0009] Furthermore, clustering optimization is performed starting from the initial cluster centers to obtain the final set of semantic clusters, including: S40. Assign each word vector in the word vector space to the cluster center with the nearest cosine distance to form a temporary cluster; S41. Normalize the word vectors within each temporary cluster; S42. Calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, and normalize each arithmetic mean vector. Use each normalized vector as the new cluster center of the corresponding temporary cluster. S43. If the change in all cluster centers is less than the preset threshold or the sum of squared errors no longer changes, then end the iteration and use the current temporary cluster as the final semantic cluster set; otherwise, return to S40.

[0010] The beneficial effects of adopting the above-mentioned further scheme are as follows: Cluster optimization is performed through steps of allocation, normalization, updating, and iterative judgment, ensuring that each iteration divides word vectors into the nearest cluster based on cosine distance, and normalization eliminates magnitude interference. Calculating the arithmetic mean of the normalized vectors and normalizing it again to obtain the new cluster centers is mathematically equivalent to minimizing the sum of squared spherical errors, guaranteeing the monotonically convergent nature of the iteration. The final semantic cluster set exhibits higher semantic cohesion and algorithm stability.

[0011] Furthermore, the comprehensive score of each word element within each semantic cluster in the final semantic cluster set is calculated, including: for any semantic cluster in the final semantic cluster set, the comprehensive score of any candidate word element within that semantic cluster is composed of a linear combination of a first scoring term and a second scoring term; the first scoring term is the normalized gradient weight of the candidate word element; the second scoring term is the cosine similarity between the normalized candidate word element and the normalized cluster center of the semantic cluster it belongs to. By traversing each semantic cluster, the comprehensive score of each word element within each semantic cluster is obtained.

[0012] The beneficial effect of adopting the above-mentioned further scheme is that by linearly combining the normalized gradient weights and the normalized cosine similarity to calculate the comprehensive score, it is possible to simultaneously quantify the attack potential and semantic representativeness of a noun. This scoring method overcomes the drawback of semantic abruptness that may result from relying solely on gradient ranking, and achieves a balanced evaluation of the multi-dimensional utility of candidate nouns, providing a unified and comprehensive quantitative basis for subsequent accurate screening.

[0013] Furthermore, for any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors.

[0014] The beneficial effect of adopting the above-mentioned further scheme is that by defining the mutual reachability distance as the maximum value among the core distance and the original distance of each word vector, the distance metric can sensitively reflect local density changes. Larger core distances from low-density regions or noise points are adopted, thereby effectively amplifying the distance interval between regions of different densities and improving the robustness of subsequent hierarchical clustering to noise and its ability to identify real cluster structures.

[0015] 2) Secondly, the present invention also provides a dynamic clustering and optimization system for suffix lexical units in response to adversarial attacks on large language models, the specific technical solution of which is as follows: It includes a word vector space acquisition module, an optimal number of clusters determination module, an initial cluster center determination module, a semantic cluster set acquisition module, a scoring module, and a composition module; The word vector space acquisition module is used to: acquire a set of candidate lexical units for target prompts in the field of cybersecurity, and acquire the word vector corresponding to each candidate lexical unit in the candidate lexical unit set through a pre-trained language model; all word vectors together constitute a word vector space; The optimal cluster number determination module is used to: calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all mutual reachability distances; and adaptively determine the optimal cluster number based on the stability of the nodes in the hierarchical clustering tree. The initial cluster center determination module is used to determine the initial cluster centers in the word vector space based on the optimal number of clusters and an initialization method based on cosine distance. The semantic cluster set acquisition module is used to: perform clustering optimization starting from the initial cluster centers to obtain the final semantic cluster set; The scoring module is used to: calculate the comprehensive score of each candidate lexical unit within each semantic cluster in the final semantic cluster set; The composition module is used to: select a predetermined number of candidate lexical units from each semantic cluster based on the comprehensive score, and construct an optimized candidate lexical unit group for adversarial attacks.

[0016] Based on the above scheme, the dynamic clustering and optimization system for suffix morphemes for adversarial attacks on large language models of the present invention can be further improved as follows.

[0017] Furthermore, the semantic cluster set acquisition module includes a temporary cluster acquisition module, a normalization module, a cluster center update module, and a judgment module; The temporary cluster acquisition module is used to: assign each word vector in the word vector space to the cluster center with the nearest cosine distance, forming a temporary cluster; The normalization module is used to normalize the word vectors within each temporary cluster; The cluster center update module is used to: calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, normalize each arithmetic mean vector, and use each normalized vector as the new cluster center of the corresponding temporary cluster; The judgment module is used to: end the iteration if the change in all cluster centers is less than the preset threshold or the sum of squared errors no longer changes, and take the current temporary cluster as the final semantic cluster set; otherwise, call the temporary cluster acquisition module, normalization module and cluster center update module again.

[0018] Furthermore, the scoring module is specifically used for: for any semantic cluster in the final semantic cluster set, the comprehensive score of any candidate word element in the semantic cluster is composed of a linear combination of the first scoring term and the second scoring term; the first scoring term is the normalized gradient weight of the candidate word element; the second scoring term is the cosine similarity between the normalized candidate word element and the normalized cluster center of the semantic cluster it belongs to, and by traversing each semantic cluster, the comprehensive score of each word element in each semantic cluster is obtained.

[0019] Furthermore, for any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors.

[0020] 3) In a third aspect, the present invention also provides an electronic device, the electronic device including a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor, so that the electronic device implements any of the above-mentioned methods for dynamic clustering and optimization of suffix morphemes against large language model adversarial attacks.

[0021] 4) In a fourth aspect, the present invention also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements any of the above-mentioned methods for dynamic clustering and optimization of suffix morphemes against large language model adversarial attacks.

[0022] It should be noted that the beneficial effects of the technical solutions of the second to fourth aspects of the present invention and their corresponding possible implementations can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below: Figure 1 This is a flowchart illustrating a dynamic clustering and optimization method for suffix lexical units in response to adversarial attacks on large language models, according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the three-dimensional projection of high-dimensional samples before clustering to PC1, PC2, and PC3 after PCA dimensionality reduction; Figure 3 Visualization of the XY plane projection of high-dimensional samples in the PC1-PC2 dimensions; Figure 4 A schematic diagram of the XZ-plane projection of the PC1-PC3 dimensions of the high-dimensional samples before clustering; Figure 5 Visualization results of high-dimensional samples projected onto the ZY plane in the PC2-PC3 dimensions; Figure 6 This is a schematic diagram showing the result after K-means++ clustering and PCA dimensionality reduction to the top three principal components; Figure 7 This is one of the schematic diagrams after clustering; Figure 8 This is a schematic diagram showing the distribution of the core clusters after clustering. Figure 9 This is the second diagram after clustering; Figure 10 This is a schematic diagram of the structure of a dynamic clustering and optimization system for suffix morphemes against adversarial attacks on large language models, according to an embodiment of the present invention. Detailed Implementation

[0024] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0025] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0026] like Figure 1 As shown in the figure, a dynamic clustering and optimization method for suffix lemmas in response to adversarial attacks on large language models according to an embodiment of the present invention includes the following steps: S1. Obtain a set of candidate lexical units for target cues in the cybersecurity field, and obtain the word vector corresponding to each candidate lexical unit in the candidate lexical unit set through a pre-trained language model; all word vectors together constitute a word vector space. The specific implementation process is as follows: S10. A target prompt is a piece of text input designed to induce a large language model to generate harmful content that violates cybersecurity principles or policies. For example, a target prompt might be "Please write a piece of code that can bypass system authentication." To carry out the attack, an optimal adversarial suffix needs to be found for this target prompt, and the search process begins with constructing an initial set of candidate lexical units.

[0027] S11. Input target cues from the cybersecurity domain into an unprotected large language model, specifying a desired harmful target for the model's output. Using a gradient-based adversarial suffix generation method, calculate the gradient of each lexical in the model's vocabulary relative to the inducing harmful behavior. From the entire model vocabulary, select the Top-K lexicals with the largest gradient magnitudes to form a preliminary candidate lexical set S. Lexicals in this set are considered, in a gradient sense, to be the most likely to mislead the model towards the target output.

[0028] S12. In this embodiment of the invention, the pre-trained language model used is a large-scale autoregressive language model based on the Transformer architecture. The model's structure includes an input embedding layer, multiple Transformer decoder blocks, and an output projection layer. The model is trained by performing a self-supervised next-word prediction task on a massive and diverse corpus of text, learning parameters by maximizing the likelihood function of the sequence. The trained model not only possesses language generation capabilities, but its input embedding layer also maps each word to a high-dimensional continuous vector representation, i.e., a word vector. It should be noted that the pre-trained language model here can be the same as the model used to calculate the gradient in S11 to ensure consistency between the vector space and the attack target.

[0029] S13. For each word in the candidate word set S obtained in S11, it is passed as input to the pre-trained language model. The input embedding layer inside the model performs a lookup operation, mapping each discrete word index to a dense real-valued vector of fixed dimensions. Formally, let the candidate word set S contain K words, denoted as K. Embedding functions of pre-trained language models Each word can be obtained Corresponding word vectors ,Right now: ,in, , The dimension of a word vector is a hyperparameter determined by the architecture of the pre-trained model, such as 512, 1024, or 768. The function represents the process of looking up the embedding matrix stored in the pre-trained language model and learned during training.

[0030] S14, the K word vectors obtained from S13 Together, these points span a set of points in a high-dimensional space. The data structure defined by this set of points is the word vector space Ω. In this space, each point corresponds to a candidate word, and the geometric relationships between points, especially directional similarities, are considered to reflect the semantic connections between corresponding words. The word vector space Ω constitutes the foundational data domain for all subsequent clustering and optimization operations.

[0031] In the field of cybersecurity, the candidate lexical set for target cues refers to a series of pre-prepared or dynamically generated basic language units used in adversarial attacks against large language models to induce the model to produce answers that violate cybersecurity regulations. These basic language units, or lexical units, can be words, subwords, or characters, and originate from the model's vocabulary. The construction of this set typically relies on the model's gradient feedback, selecting lexical units that perform exceptionally well in gradient calculations and are most likely to alter the model's reasoning in a harmful direction. This set serves as the initial input pool for subsequent refined clustering and filtering operations, and its quality directly impacts the effectiveness of the final adversarial attack.

[0032] The word vector space is a multidimensional mathematical space composed of high-dimensional real vectors, where each vector uniquely corresponds to a word in the language. This space is learned through a pre-trained language model, which maps discrete symbols to a continuous distribution representation. In this space, the direction, rather than the length, of the vectors carries the main semantic information; semantically similar words tend to have similar vector directions in the space. In this embodiment of the invention, the word vector space specifically refers to the set of data points consisting of all word vectors extracted from the pre-trained language model that belong to the candidate word set. Subsequent clustering algorithms operate within this space, measuring semantic similarity based on the cosine distance between vectors and grouping them accordingly.

[0033] S2. Calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all mutual reachability distances, and adaptively determine the optimal number of clusters based on the stability of nodes in the hierarchical clustering tree; Specifically, for any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors. S20. Define and compute the core distance of each word vector in the word vector space. Core distance is a density-sensitive concept used to characterize the distribution density of a word vector within its local neighborhood. For a given word vector... Its core distance This ensures that the word vector contains at least [a certain number of words] in its neighborhood. The minimum distance to each of the other word vectors. Parameters It is a predefined minimum number of neighborhood points used to define the density threshold of the "core object". The specific calculation process is as follows: First, for the word vector space... Each word vector in Calculate its relationship with space All other word vectors (in The distance between them. The distance here is the cosine distance. This is to match the spherical distribution characteristics of word vectors. Then, The distances to all other word vectors are sorted in ascending order, resulting in an ordered list of distances. Finally, the nth word vector is taken from this ordered list. These distance values ​​are the word vectors. core distance Mathematically, this can be represented as: Let for arrive Given an ascending sequence of distances to all other points in the interval, then: ,in, Represents the first in the sequence This calculation process means that, in the case of... (The sentence is incomplete and lacks context.) Centered on, with radius Within the spherical neighborhood of , at least there exists Other word vectors.

[0034] S21. Calculate the original distance between any two word vectors in the word vector space. This directly measures the semantic difference between two word vectors in the feature space. Here, cosine distance is used as the original distance. For the word vector space... Any two word vectors in and Their cosine distance Defined as Subtract their cosine similarity. Cosine similarity This calculates the degree of closeness between two vectors in terms of direction. The specific formula is as follows: , ,in, Representing vectors and dot product, and Representing vectors respectively and The Euclidean norm. Cosine distance. The range of values ​​is within Between. When two vectors have exactly the same direction, the cosine similarity is... The cosine distance is When the directions are completely opposite, the cosine similarity is: The cosine distance is .

[0035] S22, Mutual reachability distance This is a correction to the original distance, aiming to smooth out the impact of density differences in different regions of the word vector space, thereby more robustly characterizing proximity relationships in the spherical space. By definition, for any two word vectors... and Their mutual reachability distance is core distance , core distance and the original distance between them The maximum value among the three. Expressed mathematically as: This definition ensures that the mutually reachable distance is at least equal to the core distance of the two word vectors with higher density (a higher density point has a smaller core distance). If a word vector... Located in a high-density area ( (small value), while another word vector Located in a low-density area ( (high value), or If a point is itself a noise point (with a large core distance), then the mutual reachability distance between it and other points will be determined by the larger core distance. This artificially increases the distance from a high-density region point to a low-density region point (or noise point), effectively prioritizing regions with similar densities when constructing connectivity relationships, thus enhancing the algorithm's robustness to noise and density changes. In actual computation, the core distance needs to be calculated for all word vectors first, then the original distance for all word vector pairs needs to be calculated in S21, and finally, the mutual reachability distance is calculated for each pair according to this formula, forming a mutual reachability distance matrix, which provides input for subsequent construction of the hierarchical clustering tree.

[0036] The process involves constructing a hierarchical clustering tree based on all mutually reachable distances, and adaptively determining the optimal number of clusters based on the stability of nodes in the hierarchical clustering tree. The specific implementation process is as follows: S23. After obtaining the mutual reachability distance matrix between all word vector pairs in the word vector space, treat each word vector as an independent graph node, and consider the mutual reachability distance as the weight of the edge connecting the nodes. Use a minimum spanning tree algorithm in graph theory, such as Prim's algorithm or Kruskal's algorithm, to construct a tree connecting all nodes. The property of this tree is that it minimizes the sum of the weights (i.e., mutual reachability distances) of all edges in the tree. This minimum spanning tree is the foundational structure for subsequently building a hierarchical clustering tree, which efficiently captures the density-based minimum connectivity cost relationship between data points.

[0037] S24. Starting from the minimum spanning tree, traverse and process the edges in ascending order of their weights (distance between them). Initially, each word vector forms its own independent cluster, which is the leaf node of the hierarchical clustering tree. Then, merge the two clusters connected by the edges in ascending order of edge length. Each merge operation generates a new parent node, which represents the larger cluster composed of all word vectors from the two merged sub-clusters. This merging process continues until all edges have been processed, ultimately forming a root node containing all word vectors in the word vector space. During the merging process, record the edge length used for each merge; this distance value is defined as the threshold for the generation of the parent node produced in this merge. . The larger the value, the greater the mutual reachability barrier that needs to be overcome to merge into a cluster, implying that the separation between clusters may be higher.

[0038] S25. Node stability is used to quantify the persistence or salience of the cluster represented by that node during the merging process. Stability calculation starts from the leaf nodes and traverses upwards to the root node. For a given node... Its stability Defined as the birth threshold of this node itself. The difference between the birth thresholds of all its direct child nodes and the sum of those thresholds, multiplied by the number of word vectors contained in that node. Expressed mathematically as: ,in, Represents a node Stability. It is a node The threshold of mutual reachability when a node is created (i.e., its child nodes are merged). It is a node The set of all direct child nodes. It is a child node Its own birth threshold. It is a node The total number of word vectors contained within. This formula means that the stability of a cluster is proportional to the distance within which it can exist as an independent cluster (…). (Subtract the merging threshold of its subclusters) and its own size.

[0039] S26. To determine the most stable cluster to be retained, a stability selection process is needed, proceeding from the leaf nodes to the root node. Initialize all leaf nodes (individual sample points) to the "selected" state. Then, traverse each internal node from bottom to top. For nodes Compare its own stability The sum of the stability of the selected states of all its child nodes If the node If a node's own stability is greater than the sum of the stability of its child nodes, then the node will be... Mark the node as "selected" and remove the "selected" mark from all its child nodes; otherwise, keep the "selected" status of its child nodes unchanged. It is not selected individually. This selection process continues until the root node.

[0040] S27. After completing the stability selection, the set of word vectors corresponding to all nodes marked as "selected" constitutes the final semantic cluster. These selected nodes are not ancestor or descendant of each other in the hierarchical clustering tree; they represent the naturally existing and most stable clustering structure in the data. The total number of selected nodes is the adaptively determined optimal number of clusters. Meanwhile, word vectors that are not included in any final cluster, or those deemed to have extremely low stability at the lower levels, are filtered out as noise. Thus, by analyzing the stability of nodes in the hierarchical clustering tree, the optimal number of clusters is automatically determined. It also simultaneously completed the denoising process for the word vector space.

[0041] Hierarchical clustering trees are tree-like data structures used to represent nested clustering results of data points at different scales or similarity thresholds. In this tree, leaf nodes correspond to individual data points, the root node represents the entire cluster containing all data points, and each internal node corresponds to a cluster merged at a specific similarity threshold. Edges connect parent and child nodes, representing the relationship of sub-clusters merging to form a parent cluster. The weight or distance value associated with each edge records the condition under which the merge occurred. Hierarchical clustering trees provide a complete clustering view of data from fine-grained to coarse-grained levels, forming the basis for multi-scale clustering analysis.

[0042] In a hierarchical clustering tree, nodes are the basic elements of the tree structure, with each node representing a subset of the word vector space. Leaf nodes represent the smallest unit containing only one word vector. Internal nodes represent a larger set formed by merging the subsets of word vectors represented by their child nodes. Each node typically contains the following information: the set of data points it represents, the distance threshold at the time the node was created, and the calculated stability metric. Nodes are the objects of operation for cluster stability analysis and final cluster extraction.

[0043] Node stability is a quantitative metric used to measure the robustness and durability of the cluster it represents during hierarchical merging. A high stability value for a node means that, over a considerable distance threshold, data points within that node tend to remain together without being split, forming a natural and compact group. Stability calculation comprehensively considers both the cluster's "lifetime" (the distance interval from its formation to its merging) and the cluster size. In the adaptive determination of the optimal number of clusters, by comparing the stability between parent and child nodes, the most significant and stable clustering structure in the data can be automatically identified and selected without pre-setting the number of clusters or manually setting a cutting threshold.

[0044] S3. Based on the optimal number of clusters, an initial cluster center is determined in the word vector space using a cosine distance-based initialization method. The specific implementation process is as follows: S30. The input includes a word vector space Ω, which contains the set of word vectors corresponding to all candidate nouns extracted from the pre-trained language model. ,in, This represents the total number of candidate lexical units. Another key input is the adaptively determined optimal number of clusters. This value is obtained from the aforementioned hierarchical clustering tree stability analysis step. The goal of the initialization process is to select from the word vector space Ω. The word vectors are used as the initial cluster centers for subsequent spherical K-Means clustering iterations, denoted as . .

[0045] S31, from all of the word vector space Ω From a set of word vectors, one word vector is randomly selected using a uniform distribution. Let the selected word vector be... Designate it as the first initial cluster center. Mathematically represented as ,in, From the index set A randomly selected integer. This step provides a starting point for the entire initialization process.

[0046] S32. Assuming that a selection has already been made... There are initial cluster centers, denoted as . ,in, For each word vector in the word vector space Ω It is necessary to calculate its relationship with each currently selected cluster center. Cosine distance between The formula for calculating cosine distance is: ,in, Representing vectors with vector dot product, and Representing vectors respectively sum vector The Euclidean norm for a given word vector. Find out its relationship with all The minimum cosine distance between the centers of the selected clusters is denoted as . : , The value measures the word vector The degree of semantic difference from the currently selected center set; the larger the value, the stronger the semantic difference. The less similar it is to all the selected centers.

[0047] S33. In order to prioritize the word vector with the greatest semantic difference from the existing center as the new center, it is necessary to divide each word vector into... Convert this to the probability of being selected. Calculate the vector for each word. Selected as the next center probability Probability and The value is proportional to the square of the value, and this square relationship aims to favor choosing points that are farther away. The specific calculation is as follows: First, calculate all word vectors. Sum of squares: Then, calculate the selection probability for each word vector: .in this way, This constitutes a definition in all Discrete probability distributions on word vectors, where The larger the word vector, the more likely it is to be a word vector that is more likely ... The larger the value, the better. Finally, based on this probability distribution... Using roulette wheel selection or other probability-based sampling methods, a word vector is randomly selected from the word vector space Ω as the first... Initial cluster centers .

[0048] S34. Treat S32 and S33 as a loop. (The last part, "selecting the first...", appears to be a fragment and doesn't translate directly.) individual centers Afterwards, order Next, repeat step S32 (recalculate the minimum cosine distance of all word vectors based on the updated set of selected centers). S33 (recalculate the probability distribution based on the new distance and select the next center). This iterative process continues until a certain number of centers have been selected. Equal to the optimal number of clusters That is, successfully selected Initial cluster centers By using this cosine distance-based weighted probability initialization method, we can ensure that the initial cluster centers are as dispersed as possible in the spherical semantic space of word vectors, covering different semantic regions. This provides a good starting point for subsequent clustering iterations and effectively alleviates the local optima problem that may be caused by traditional random initialization.

[0049] Figures 2 to 5 This paper demonstrates the preliminary partitioning results of word vectors in the dimensionality-reduced feature space after determining the initial cluster centers using a cosine distance-based initialization method (i.e., the K-means++ algorithm). Specifically, high-dimensional word vectors are projected onto a three-dimensional space (PC1, PC2, PC3, which are linear combinations of the original high-dimensional feature vectors, preserving the original variance information of the data to the greatest extent for three-dimensional spatial visualization) through principal component analysis. In the figure, sample points of different colors represent candidate words assigned to different temporary clusters (numbered such as Cluster0, Cluster1, ...), totaling four clusters. The point labeled "Center" (whose coordinates are determined by the initialization algorithm) clearly indicates the initial cluster center position of each temporary cluster determined by the initialization step. Figure 2 This is a schematic diagram of the three-dimensional projection of high-dimensional samples before clustering to PC1, PC2, and PC3 after PCA dimensionality reduction. Figure 2 The plane projection in the figure refers to the planar projection. The cumulative explained variance is 10.11%, and the contributions of each principal component show a decreasing trend. Specifically, PC1=5.86%, PC2=2.30%, and PC3=1.95%. Figure 3 Different colored scatter points correspond to four clusters, Cluster0 to Cluster3, with red stars indicating cluster centers. Spatially, Cluster0 is the largest core cluster, highly clustered in three-dimensional space; Clusters 1, 2, and 3 are distributed around it, forming some spatial separation. Considering the variance contribution, PC3 contributes very little to cluster differentiation, and the three-dimensional cluster separation mainly relies on PC1 and PC2, resulting in limited retention of cluster information under low-dimensional projection. Figure 3 This visualization presents the XY-plane projection of high-dimensional samples in the PC1-PC2 dimension, addressing the technical challenge of representing high-dimensional data cluster structures in a low-dimensional manner. PC1 (explaining 5.86% of the variance) dominates cluster differentiation. The core cluster 0 (blue) is highly clustered in the PC1 [-0.1, 0.1] and PC2 [0, 0.15] intervals, achieving significant spatial separation from clusters 1 (red), 2 (pink), and 3 (cyan). The remaining clusters are distributed in an orderly fashion along the transition region. Compared to the fuzzy cluster structure of high-dimensional data before clustering, this visualization provides an interpretable low-dimensional representation basis for sample classification and feature analysis. Figure 4This is a schematic diagram of the XZ-plane projection of the PC1-PC3 dimensions of the high-dimensional samples. PC1 explains 5.86% of the variance, while PC3 explains only 1.95%. PC3's insufficient discriminative power leads to a significant decrease in cluster separation. Cluster 0 (blue) is highly clustered in the PC1 [-0.1, 0.1] and PC3 [-0.1, 0.1] intervals. Cluster 1 (red) has higher dispersion than the PC1-PC2 projection. Clusters 2 (pink) and 3 (cyan) severely overlap with the core cluster, resulting in blurred boundaries. In summary, PC3 cannot effectively distinguish between clusters; only PC1 retains basic discriminative power. This dimensional combination is insufficient to fully represent the cluster structure. Figure 5 The visualization results of the high-dimensional samples projected onto the ZY plane in the PC2-PC3 dimensions are shown. Although the variance explained by PC3 is only 1.95%, resulting in limited overall cluster separation, the coordinates of each cluster center can still be anchored after clustering. Compared with the defect of unstructured distribution of high-dimensional data before clustering, it achieves a low-dimensional and effective representation of the cluster structure.

[0050] The distribution shows that sample points (i.e., word vectors) belonging to the same temporary cluster exhibit a certain degree of clustering in space. For example, sample points in Cluster0 and Cluster1 are close to each other, and samples within the same cluster have high similarity. At the same time, sample points from different clusters also show a certain degree of distinguishability. It is worth noting that some sample points overlap at the boundary regions of some clusters, which objectively reflects the complex and non-strictly linearly separable natural distribution characteristics of the word vector space itself. This visualization result, from a geometric spatial perspective, confirms that the cosine distance-based initialization method can provide a semantically relatively dispersed and structurally reasonable starting point for subsequent clustering optimization, providing preliminary spatial distribution basis for subsequent analysis of intra-cluster consistency and candidate lexical selection.

[0051] S4. Perform cluster optimization starting from the initial cluster centers to obtain the final semantic cluster set, specifically: S40. Assign each word vector in the word vector space to the cluster center with the nearest cosine distance to form a temporary cluster. Specifically: The input to S40 is a word vector space Ω, containing N word vectors. and the k current cluster centers obtained from the initialization step. The superscript (t) indicates the t-th iteration. For each word vector in the word vector space Ω... It is necessary to calculate its relationship with each current cluster center. The cosine distance between them. The calculation formula is as follows: ,in, Word vectors With cluster center cosine similarity, This represents the dot product of the two. and Let represent their Euclidean norms respectively. After calculation, find the one that makes . The cluster center with the smallest value ,Right now: Then word vectors Assigned to cluster center The temporary cluster it represents After performing the above operations on all N word vectors in the word vector space Ω, the word vectors are divided into k disjoint sets. These sets constitute the k temporary clusters for this iteration, denoted as . Each temporary cluster Includes all data assigned to the cluster center Word vectors.

[0052] S41. Normalize the word vectors within each temporary cluster, specifically: The purpose of S41 is to eliminate the interference of word vector magnitude on clustering metrics, so that subsequent calculations are based entirely on vector direction, thereby adapting to the spherical distribution characteristics of word vectors. For each temporary cluster formed in the above steps... Iterate through all word vectors contained in the cluster. For the cluster... Any word vector within Calculate its normalized vector Normalization involves dividing the original vector by its Euclidean norm to obtain a unit vector of length 1. The specific formula is: ,in, It is word vector The Euclidean norm of the vector, where d is the dimension of the word vector. After this processing, the temporary cluster... All original word vectors Converted into the corresponding set of unit vectors This operation ensures that the next stage of calculations is based on spherical geometry.

[0053] S42. Calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, and normalize each arithmetic mean vector. Use each normalized vector as the new cluster center of the corresponding temporary cluster. Specifically: For each processed temporary cluster Its interior is now a set of unit vectors. ,in It is a cluster The number of word vectors in the dataset. First, calculate the arithmetic mean vector of these unit vectors. : Arithmetic mean vector The calculation is a simple average of the coordinate values ​​across all dimensions. Since the input is a unit vector, its arithmetic mean vector is... The modulus is usually not equal to 1. To make it represent a direction on the sphere (i.e., to become the center of a new unit cluster), it is necessary to... Normalization is performed to obtain new cluster centers. : ,in, It is the arithmetic mean vector The Euclidean norm. After performing the above calculation on all k temporary clusters, we obtain an updated set of new cluster centers with a modulus of 1. This update process is mathematically equivalent to minimizing the sum of squared cosine distances between all word vectors and the centers of their respective clusters.

[0054] S43. If the change in all cluster centers is less than a preset threshold or the sum of squared errors no longer changes, then end the iteration and use the current temporary cluster as the final semantic cluster set; otherwise, return to S40, specifically: After obtaining the new set of cluster centers, it is necessary to evaluate whether the clustering has converged. Two convergence criteria are defined. The first criterion is the change in cluster centers. The cosine or Euclidean distance between the corresponding vectors of the old and new cluster centers is calculated, and the maximum or average value is checked to see if it is less than a preset threshold. For example, calculate the maximum cosine distance of all cluster center variations: The second criterion is that the sum of squared errors no longer changes significantly. (Sum of squared errors) Defined as the sum of the squared cosine distances from all word vectors to the center of their respective clusters. Calculate the current iteration's... and compared with the previous iteration In comparison, if the relative change is less than a very small preset threshold... ,Right now If the rate of change of the sum of squared errors is less than a preset value, then convergence is considered achieved. If any of the above convergence conditions are met, the iteration terminates. At this point, the temporary cluster formed in the last iteration... This results in the final set of semantic clusters. If the convergence condition is not met, the new cluster center will be... As the current cluster center for the next iteration, it returns to S40 to begin a new round of allocation and update loops until convergence.

[0055] Figures 6 to 9 The final clustering results, obtained by iterative optimization based on cosine distance starting from the initial cluster centers, are shown. They are also visualized in the three-dimensional feature space and its two-dimensional projection plane, formed by the principal component dimensions (PC1, PC2, PC3) obtained through principal component analysis.

[0056] Specifically, such as Figure 6 As shown, after K-means++ clustering (K=4) and PCA dimensionality reduction to the top three principal components, the cluster separability and identifiability are significantly improved: PC1 (5.86%) and PC2 (2.30%) dominate the cluster division, the core cluster 0 (blue, n=153) achieves significant spatial separation from other clusters with clear boundaries, and the remaining clusters (cluster 1, cluster 2, cluster 3) are orderly distributed in the transition region; the overall high-dimensional data clustering structure is effectively represented in a low-dimensional way, which greatly solves the core problem of fuzzy cluster structure and difficulty in distinguishing clusters before clustering.

[0057] like Figure 7 As shown, compared to the inherent defects of high-dimensional data before clustering, such as "fuzzy cluster structure, indistinguishable boundaries, and no effective cluster distribution," this scheme, through clustering processing, uses PC1 (which explains 5.86% of the variance) as the dominant distinguishing dimension. This results in the core cluster 0 (blue) achieving significant aggregation in the PC1 [-0.1, 0.1] and PC2 [0, 0.15] intervals, spatially separating it from clusters 1 (red, n=21), 2 (pink, n=23), and 3 (cyan, n=59). The remaining clusters form an ordered distribution along the transition zone of the core clusters, effectively completing a low-dimensional interpretable representation of the high-dimensional cluster structure. This visualization result provides a clear technical basis for subsequent sample classification and feature analysis, demonstrating significant practicality and technological advancement.

[0058] like Figure 8 As shown, the core cluster 0 after clustering is highly clustered in the intervals of PC1 [-0.1, 0.1] and PC3 [-0.1, 0.1]. The distribution characteristics of clusters 1, 2, and 3 are clearly distinguishable. Although there is local overlap, the overall distribution forms an ordered cluster distribution. Compared with the problem of the high-dimensional data cluster structure being untraceable before clustering, this projection relies on PC1 to achieve basic differentiation of the core clusters, and completes a low-dimensional and effective characterization of the data structure after clustering.

[0059] like Figure 9 As shown, compared to the inherent defects of high-dimensional data before clustering, such as "completely blurred cluster structure, no effective distribution features, and unidentifiable cluster boundaries under low variance dimension", this scheme, through clustering processing, although PC3 explains only 1.95% of the variance, can still anchor the coordinates of each cluster center. The distribution features of the core cluster 0 (blue) can be effectively identified, and the remaining clusters (cluster 1, cluster 2, cluster 3) form an ordered cluster distribution. This projection relies on the combined contribution of PC2 (2.30%) and PC1 to complete the low-dimensional effective characterization of the cluster structure under low variance dimension, solving the technical defect of unstructured distribution of high-dimensional data under low variance dimension before clustering, and has significant practicality and technological progress.

[0060] and Figures 2 to 5Compared to the initial state, after iterative optimizations (assignment, normalization, update, and convergence determination) from S40 to S43, the clustering of sample points in each semantic cluster is further enhanced. For example, the sample points of Cluster0 (orange) and Cluster1 (blue) are more closely clustered around their final cluster center (not explicitly labeled "Center" in the figure, but representing the position of the normalized cluster center calculated after optimization in the projection space). This intuitively verifies the geometric property that "samples with smaller cosine distances are more concentrated in space," meaning that word vectors with similar semantics have smaller angles (cosine distances) in their normalized vectors in spherical space, and therefore are closer in projection space. Moreover, Figures 6 to 9 The separation effect of each cluster is clearly visible under multiple dimensional projection views, indicating that after clustering optimization by this method, the final semantic cluster set not only has high semantic cohesion within clusters (corresponding to high cosine similarity), but also maintains good semantic distinguishability between clusters. This result directly demonstrates that the iterative strategy of using cosine distance as a similarity measure, combined with normalization processing and spherical arithmetic mean updates, can effectively adapt to the high-dimensional spherical distribution semantic characteristics of word vectors and overcome modulus interference. This visualization result provides a reliable and intuitive spatial structure and semantic association basis for subsequent steps of comprehensive scoring and precise selection of candidate lexical units based on intra-cluster consistency.

[0061] S5. Calculate the comprehensive score of each candidate word element within each semantic cluster in the final semantic cluster set. Specifically, for any semantic cluster in the final semantic cluster set, the comprehensive score of any candidate word element within that semantic cluster is a linear combination of a first scoring term and a second scoring term. The first scoring term is the normalized gradient weight of the candidate word element; the second scoring term is the cosine similarity between the normalized candidate word element and the normalized cluster center of its semantic cluster. This process is repeated for each semantic cluster to obtain the comprehensive score of each word element within each semantic cluster. The specific implementation process is as follows: S50. The input data consists of three parts. The first part is the final set of semantic clusters, denoted as... ,in, The optimal number of clusters is determined adaptively. Each semantic cluster... It contains a set of word vectors. The second part is each semantic cluster. The corresponding normalized cluster centers obtained after clustering iteration convergence The cluster center is a unit vector, obtained by normalizing the arithmetic mean of all normalized word vectors within the cluster, representing the semantic core direction of this semantic cluster on the sphere. The third part is the original candidate lexical information; for each candidate lexical, its original word vector is required. And the original gradient weights of the lexical unit calculated in the gradient-based adversarial suffix generation method. Original gradient weights Reflects the word elements The potential influence on the induced model to produce the target harmful output is typically between zero and some positive number.

[0062] S51. Calculate the first scoring item, i.e., the normalized gradient weight of each candidate word, for any semantic cluster. candidate word groups First, obtain its original gradient weights. To eliminate the dimensional differences in gradient weights among different lexical units and enable them to be linearly combined with cosine similarity on the same scale, the original gradient weights of all candidate lexical units need to be normalized. The normalization process employs a min-max scaling method. Specifically, it involves finding the maximum value among the original gradient weights of all candidate lexical units. and minimum value Then, for lexical units Its normalized gradient weights Calculated using the following formula: ,in, Indicates word elements The corresponding normalized gradient weights. (Symbol) This emphasizes that the scoring item is related to the normalized representation of the lexical units, although the calculation itself only depends on the original gradient values. After this processing, the normalized gradient weights of all lexical units are scaled to an interval... Within the range, a larger numerical value indicates that the term has a relatively greater attack potential in the sense of gradient.

[0063] S52. Calculate the second scoring item, namely the cosine similarity between the normalized candidate lexical and the normalized cluster center of its semantic cluster. For semantic clusters... Candidate word elements First, we need to find the corresponding original word vectors. Normalization is performed to obtain the unit vector. The calculation formula is: At the same time, obtain the semantic cluster. Normalized cluster center unit vector Cosine similarity This calculates the degree of closeness between two unit vectors in direction, using the following formula: ,in, Representing vectors with vector The dot product of the two input vectors. Since both input vectors are unit vectors, their dot product is directly equal to the cosine similarity, which ranges from 1 to 1. In the word vector space, the closer this value is to 1, the stronger the word element. With cluster center The more consistent the semantic direction, the higher the semantic representativeness of the cluster.

[0064] S53. The comprehensive scoring function aims to balance the attack potential of lexical units with their semantic representativeness. (Comprehensive scoring) Normalized gradient weights Similarity to cosine A linear combination of , and introduce coefficients and This is used to adjust the relative importance of the two items. The function form is as follows: ,in, and These are positive weighting coefficients. and The determination of this is modeled as an optimization problem, aiming to optimize the comprehensive score by distinguishing efficient word components. The optimal solution can be found by analyzing historical attack data or specific validation sets. and A typical approach is to establish a feedback loop regarding the attack success rate, or... Considered as about and The optimal value is obtained by solving a system of equations with partial derivatives set to zero. The specific form needs to be set according to the actual optimization objective.

[0065] S54. For each semantic cluster in the final set of semantic clusters Iterate through each candidate lexicon contained in the cluster. For each word element The normalized gradient weights are calculated sequentially in S51. Perform the calculation of its cosine similarity with the cluster center in S52. Then substitute the coefficients determined in S53. and Using formula Calculate the overall score for each lexical unit. Repeat this process until an overall score has been calculated for each candidate lexical unit within each semantic cluster. This completes the calculation of the comprehensive scores for all candidate lemmas. These scores will serve as the direct basis for the next stage of dynamic screening.

[0066] S6. Based on the comprehensive score, a predetermined number of candidate lexical units are selected from each semantic cluster to form an optimized candidate lexical unit group for adversarial attacks. The specific implementation process is as follows: S60. Before starting the screening process, two key operational parameters need to be clarified. The first parameter is the predetermined quantity, denoted as... It specifies the number of candidate lemmas to be selected from each final semantic cluster. The first parameter can be a fixed positive integer, such as 1, 2, or 3, or a variable that adjusts dynamically based on the cluster size. However, to ensure consistency, this embodiment uses a fixed value. The second parameter is the filtering strategy. This method uses a descending order strategy based on a comprehensive score, that is, it prioritizes selecting candidate words with the highest comprehensive score. This strategy directly utilizes the comprehensive score function. The quantified lexical comprehensive utility is used to select the best.

[0067] S61. For the final set of semantic clusters Each semantic cluster in Obtain all candidate lexical units within the cluster and their corresponding comprehensive scores. Then, these candidate morphemes are ranked according to their comprehensive scores. The values ​​are sorted from largest to smallest. The sorting operation can use standard sorting algorithms, such as quicksort or mergesort, to output an ordered list of candidate terms. List The first element in the sequence has the highest overall score, and the last element has the lowest overall score. This ranking process ensures that within each semantic cluster, tokens are assigned a clear priority based on a balance between their attack effectiveness and semantic representativeness.

[0068] S62. For each ordered list obtained in S61 Starting from the beginning of the list, extract the first few elements sequentially. There are candidate lexical units. Mathematically, if the list... Include Each word element, and Then the selected subset for: ,in, It is a list The highest overall score in the top Each word element. If a certain semantic cluster Number of lexical units included Less than the expected quantity Then all lexical units within that cluster are selected, i.e. This step ensures that the most representative high-potential lexical units from each semantic cluster are contributed to the final candidate pool.

[0069] S63, Remove all from S62 Lexical subsets selected from semantic clusters Perform a union operation to merge the results into a single, unified set. This unified set serves as the optimized candidate word tuples for adversarial attacks. Formal representation: Optimize candidate word tuples It contains elite word units selected through comprehensive scoring from different semantic clusters. Its total size does not exceed [a certain value]. Since each semantic cluster represents an independent semantic direction in the word vector space, this selection method ensures coverage of semantic diversity in the optimized candidate word tuples, while each selected word tuple also has high attack potential in its respective semantic direction.

[0070] S64. Merge the resulting optimized candidate word tuples. The output is in a structured data format, such as a list or array. This tuple will serve as direct input to the next stage of the adversarial suffix generation process. In the next iteration of the gradient-based adversarial suffix generation method, the attack algorithm will search and combine lexical units from this optimized, smaller but higher-quality candidate tuple to construct or update adversarial suffixes, thereby more efficiently inducing large language models to produce targeted harmful outputs. In this way, this method tightly integrates cluster analysis with dynamic optimization, forming a complete technical process from a massive vocabulary to a precise attack lexical set.

[0071] Optionally, the above technical solution also includes: S70. Obtain optimized candidate word tuples for adversarial attacks. The subsequent application aims to use this word tuple to iteratively construct or optimize an adversarial suffix to successfully induce a large language model to generate harmful output in response to a pre-defined target prompt. The initial adversarial suffix is ​​set to a tuple composed of... A sequence consisting of blank or randomly initialized words is denoted as . superscript Indicates the initialization state. This is a fixed length for the adversarial suffix. Simultaneously, the total number of iterations for the attack is defined as... And the number of positions in each iteration where the suffix sequence is planned to be modified. ( Define the loss function. Used to quantify current adversarial suffixes The difference between the output generated by the induced large language model and the desired harmful target output is analyzed; a smaller loss value indicates a more successful attack. This step prepares the initial state and key control parameters for the entire attack process.

[0072] S71, in each iteration ( from arrive In ), perform the following operations to update the adversarial suffix. First, it will splice in the current adversarial suffix. The complete target cue is input into the large language model to be attacked. Secondly, the loss function is calculated using the model's automatic differentiation function. Compared to adversarial suffixes Each word position ( The gradient of ). Third, based on the gradient magnitude or other heuristics, from Select from the positions The locations to be modified are denoted as a set of location indices. Fourth, for each selected location to be modified... Instead of searching for replacement tuples from the entire massive model vocabulary, the search scope is limited to optimizing candidate tuples. Inside. For Each candidate word in Perform a temporary replacement: Middle position Replace the word with Forming a temporary suffix Fifth, all of them Input the large language model sequentially to quickly calculate or estimate the loss value after replacement. Sixth, for position Choose a loss function The candidate word whose value is reduced the most or reaches the minimum. As the best replacement candidate at this position in this iteration, This step utilizes optimized candidate word tuples. As a high-quality, small-scale search space, it greatly improves the efficiency of finding effective replacement words.

[0073] S72, Complete for all Selected positions from optimized candidate word tuples Select the best replacement candidate Next, it's necessary to evaluate whether to adopt these replacements to update the adversarial suffix. One strategy is to evaluate them one by one: sort them by the magnitude of the loss reduction brought by the replacements, try applying each best replacement candidate to the corresponding position in turn, and recalculate the loss for the entire suffix. The replacement is only confirmed if the loss has indeed decreased. Another strategy is to evaluate in batches: apply all replacements simultaneously. The best replacement candidates are selected to form a completely new candidate suffix. Then calculate its loss. .like Then accept this batch update, making Otherwise, reject this complete replacement and maintain... And may trigger an attack on Alternatively, adjustments to the chosen strategy may be made. This step ensures that the updates to the adversarial suffix always move in a direction that reduces the loss function, thereby steadily approaching the attack target.

[0074] S73. After each iteration, it is necessary to determine whether the attack process has reached convergence. Set convergence conditions, such as: 1. Loss function. The value is below a preset success threshold. This indicates that current adversarial suffixes can effectively induce the model to produce target-harmful outputs; secondly, multiple consecutive iterations (e.g.) In the next iteration, the loss function value no longer decreases or decreases by a factor less than a minimum. Third, the preset maximum number of iterations has been reached. The iteration loop terminates once any convergence condition is met. Finally, the adversarial suffix obtained from the last update is... This serves as the final output of the attack. (This is the adversarial suffix.) That is, by incorporating optimized candidate word tuples The adversarial input obtained through the iterative optimization process is tailored to the target prompt. Users can input this into a large language model for validation, testing its actual effectiveness in inducing harmful outputs.

[0075] The method of this invention is an integrated adversarial suffix lexical optimization method that combines "automatic cluster determination, adaptive denoising clustering, and dynamic optimization." The process involves automatically determining the optimal number of clusters through hierarchical clustering while simultaneously removing noise points. Then, a normalized K-Means++ algorithm based on cosine distance is used to perform accurate clustering with the determined number of clusters. Finally, dynamic filtering and optimization of lexical units are achieved based on gradient information and semantic distance weights. Specifically, this includes: 1) Word vector space preprocessing and automatic cluster number determination: Specifically, the input data is a target cues in the cybersecurity field, obtained through gradient feedback from a large language model, consisting of a set S of Top-K negative gradient candidate nouns and their corresponding word vector space Ω. The word vector space Ω contains the word vectors extracted from each candidate noun in set S using a pre-trained language model. To adapt to the varying distribution density of word vector data in spherical space, an improved distance metric needs to be calculated. For any two word vectors in the word vector space Ω... and The reachability distance between them Defined as: ,in, Word vectors and The distance between the two reachable distances; and Word vectors and The core distance is the minimum distance that ensures a word vector contains at least MinPts other word vectors in its neighborhood, where MinPts is a preset parameter for the number of neighborhood points. The original distance between two points is represented by cosine distance. This mutual reachability metric smooths out local density differences and more robustly characterizes proximity relationships in spherical space. Based on the calculated mutual reachability distances between all word vector pairs, a minimum spanning tree is constructed, which is further used to form a hierarchical clustering tree. In this tree, leaf nodes are single word vectors, internal nodes represent merged clusters, and the birth distance threshold for each node is the mutual reachability distance of its corresponding edge at the time of creation. After forming the hierarchical clustering tree, the candidate clusters represented by all nodes need to be evaluated. This is achieved by quantifying the stability of each node. A node stability The calculation formula is: ,in, Represents a node Stability; It is a node The threshold for the distance from birth; It is a node The set of all direct child nodes; It is a child node Its own birth threshold; It is a node The total number of word vectors contained within. By comparing the stability of a node itself with the sum of the stability of its child nodes from the bottom up, significantly stable nodes are selected as the final semantic clusters, while nodes not included in any stable cluster are considered noise and filtered out. This adaptively determines the final number of clusters. .

[0076] 2) Spherical K-Means++ exact clustering, specifically, to obtain the optimal number of clusters. Then, it is necessary to determine in the word vector space Ω Initial cluster centers are selected. The initialization process uses the K-Means method based on cosine distance. First, a word vector is randomly and uniformly selected as the first initial cluster center. For the selection of each subsequent center, probability sampling is used, where the probability of a word vector being selected is proportional to the square of its minimum cosine distance to the set of selected centers. This allows the algorithm to prioritize sampling regions with the greatest semantic difference from existing centers, ensuring that the initial centers are as dispersed as possible on the semantic sphere. An iterative algorithm based on cosine distance is used for clustering until the change in cluster centers is less than a preset threshold or the sum of squared errors no longer changes. The iterative process includes three stages. ① Assignment stage: For each word vector in the word vector space Ω... Calculate its relationship with all current cluster centers. cosine distance And assign it to the nearest cluster, forming ① Temporary clusters. ② Normalization: Normalize all original word vectors within each temporary cluster by dividing each word vector by its magnitude to convert it into a unit vector. This operation eliminates the interference of the magnitude on the distance metric, ensuring that clustering is based entirely on the direction of the word vectors. ③ Update phase: Calculate the arithmetic mean vector of the normalized vectors within each temporary cluster, and then re-normalize this mean vector to obtain new cluster centers. This step is mathematically equivalent to minimizing the sum of squared errors on a sphere, and guarantees that the sum of squared errors monotonically decreases in each iteration; its convergence can be proven.

[0077] 3) Comprehensive lexical selection based on gradient and distance weights: Specifically, to select the best lexical units from the clustering results, a comprehensive score needs to be calculated for each lexical unit. The score comprehensively considers two characteristics: ① High attack effectiveness: The lexical unit should have a strong ability to mislead large language models. This characteristic is achieved through the normalized gradient weights of the lexical units. Conduct quantitative evaluation. It is to use word elements The values ​​obtained by min-max normalization of the original gradient weights. ② High semantic representativeness: Lexical units should highly match the semantic core of their candidate clusters. This attribute is achieved using the normalized cosine similarity between the lexical unit and the cluster center. Quantitative evaluation will be conducted. Among them, It is word vector Normalized unit vector, It is a semantic cluster The normalized cluster centers. Higher cosine similarity indicates better representativeness. A single gradient ranking may introduce semantically abrupt lexical units; therefore, a linear combination of the two quantitative evaluations is used. For any semantic cluster... Lexical elements in Its candidate ranking quantitative evaluation index The mathematical expression is: ,in, and It is a positive weighting coefficient used to balance the importance of attack effectiveness and semantic representativeness. and Determining the optimal solution for a bivariate function is a problem of finding the optimal solution. This can be achieved by analyzing historical attack data to find the coefficients that maximize the overall attack effectiveness. Specifically, this can be done by analyzing data containing... and This is accomplished by taking the partial derivatives of the objective function and solving the system of equations. In each semantic cluster... Within, all morphemes are ranked according to their overall score. The lexical units are sorted in descending order. Then, the top N lexical units from each cluster are selected to form the final optimized candidate lexical units. This step achieves precise construction of candidate lexical units for the next stage of adversarial attacks, ensuring that the selected lexical units have both high attack potential and good semantic consistency.

[0078] In this invention, ① to address the issues of spherical distribution of word vectors and noise interference, a density-sensitive mutually reachable distance is innovatively introduced to replace the original cosine distance. Mutual reachable distance The calculation formula is: ,in As the core distance, The original cosine distance is used. This distance metric effectively smooths out local density differences. Based on this, a hierarchical clustering tree is constructed based on mutual reachability distances, and the lifecycle stability of the potential cluster represented by each node is quantified. Node stability Through formula Calculation, where For nodes The birth distance threshold, For its set of child nodes, The threshold for the birth of child nodes. This represents the number of word vectors contained in a node. Based on the stability distribution, significantly stable nodes are automatically selected as the final semantic clusters, while noise points not included in any stable clusters are simultaneously removed, thus achieving cluster number... The method achieves adaptive determination and precise denoising of the word vector space. It eliminates the need for manually pre-setting the number of clusters or distance thresholds, overcoming the shortcomings of traditional methods that rely on empirical parameters. ② To address the lack of rigor in spherical data clustering, a spherically adapted K-Means++ initialization and normalization iterative update mechanism is proposed. In the initialization phase, probability sampling is performed based on cosine distance to maximize the dispersion of initial cluster centers on the semantic sphere. The iterative optimization phase includes three steps: allocation, normalization, and update. The allocation step assigns each word vector to the cluster center with the nearest cosine distance; the normalization step normalizes all original word vectors within each temporary cluster, converting them into unit vectors to eliminate modulus interference; the update step calculates the arithmetic mean vector of the normalized vectors within each cluster and re-normalizes this mean vector to obtain the new cluster center. This update process is mathematically rigorously equivalent to minimizing the sum of squared cosine distances on the sphere, i.e., the sum of squared errors (SSE). This ensures that the sum of squared errors (SSE) monotonically decreases with each iteration, and the convergence of the algorithm is provable, thus obtaining semantically highly cohesive clustering results. ③ Construct a comprehensive scoring function This is to quantify the attack effectiveness and semantic representativeness of balanced lexical units. In the formula, Semantic clusters Chinese word elements Overall score; It is a word element The normalized gradient weights are used to quantify their attack effectiveness; It is a normalized vector of lexical units With the normalized cluster center of the semantic cluster The cosine similarity between them is used to quantify their semantic representativeness; and These are weighting coefficients used to adjust the relative importance of the two attributes. Based on this comprehensive score, in each semantic cluster... The algorithm sorts all lexical units in descending order and selects the Top-N lexical units. This dynamic selection strategy enables the precise and efficient selection of the optimal subset that combines high attack power and high semantic fluency from a massive pool of candidate lexical units, forming a complete technical process from feature analysis to attack construction.

[0079] Compared to existing technologies, this invention, through the above-mentioned innovative design, achieves a systematic improvement in adversarial lexical screening tasks, specifically: 1) By employing density-adaptive mutual reachability distance Replace the original cosine distance and combine it with the stability of hierarchical clustering tree nodes. The quantization method realizes the cluster number The method adaptively determines and simultaneously filters noise points. This process requires no manual pre-setting of cluster numbers or empirical thresholds, enabling the method to adapt to word vector spaces under different target cues. The changes in data distribution enhance overall robustness. After precise clustering using the spherical K-Means++ algorithm based on cosine distance, the final semantic cluster set shows improved semantic cohesion. Semantic cohesion refers to the degree to which lexical units within the same cluster are highly similar in direction in the vector space. This clustering algorithm has a provable convergence guarantee, ensuring the stability and reproducibility of the clustering results under different operating conditions.

[0080] 2) In benchmark tests involving adversarial attacks on large language models, the optimized candidate word tuples selected by this method... The constructed adversarial suffix achieves a higher success rate in inducing the model to produce target harmful outputs compared to traditional methods that rely solely on raw gradient ranking. Attack success rate refers to the proportion of times the model successfully outputs pre-defined harmful content across multiple adversarial attack attempts. Furthermore, this improvement is attributed to the integration of normalized gradient weights. Similarity to cosine The comprehensive scoring model, while achieving a similar attack success rate to traditional methods, effectively reduces the range of candidate terms requiring in-depth evaluation. This reduced selection range improves search efficiency during the attack construction phase. This is achieved by adjusting the comprehensive scoring function. Weighting coefficients in and It can flexibly balance the attack strength of generated prompts with the fluency of text, adapting to the needs of different security testing scenarios.

[0081] 3) This invention provides a complete end-to-end automated workflow, from the original large-scale vocabulary to optimized candidate word tuples. The end-to-end automated workflow refers to the automatic execution of the entire process from input target prompts, including candidate word tuple acquisition, word vector extraction, adaptive clustering, comprehensive scoring, to final selection output, without manual segmentation intervention. This workflow significantly reduces the technical threshold and operational optimization costs for adversarial word selection on large language models. The core technical framework upon which this method relies includes density-sensitive hierarchical clustering, spherical data-optimized clustering iteration, and a multi-dimensional feature fusion optimization model, possessing strong versatility. This framework can be seamlessly extended to other natural language processing or artificial intelligence security tasks, especially those applications that require discovering fine semantic structures or selecting key feature units from high-dimensional embedding spaces.

[0082] In the above embodiments, although the steps are numbered S1, S2, etc., they are only specific embodiments given by the present invention. Those skilled in the art can adjust the execution order of S1, S2, etc. according to the actual situation. The scheme after adjusting the order is also within the protection scope of the present invention. It can be understood that in some embodiments, some or all of the above embodiments may be included.

[0083] like Figure 10 As shown in the figure, a dynamic clustering and optimization system for suffix lexical units for adversarial attacks on large language models according to an embodiment of the present invention includes a word vector space acquisition module 201, an optimal number of clusters determination module 202, an initial cluster center determination module 203, a semantic cluster set acquisition module 204, a scoring module 205, and a composition module 206. The word vector space acquisition module 201 is used to: acquire a set of candidate word units for target prompts in the field of network security, and acquire the word vector corresponding to each candidate word unit in the candidate word unit set through a pre-trained language model; all word vectors together constitute a word vector space; The optimal cluster number determination module 202 is used to: calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all mutual reachability distances; and adaptively determine the optimal cluster number based on the stability of the nodes in the hierarchical clustering tree. The initial cluster center determination module 203 is used to: determine the initial cluster centers in the word vector space based on the optimal number of clusters and using an initialization method based on cosine distance; The semantic cluster set acquisition module 204 is used to: perform clustering optimization starting from the initial cluster center to obtain the final semantic cluster set; The scoring module 205 is used to: calculate the comprehensive score of each candidate lexical unit within each semantic cluster in the final semantic cluster set; The constitutive module 206 is used to: select a predetermined number of candidate lexical units from each semantic cluster based on the comprehensive score, and constitut an optimized candidate lexical unit group for adversarial attacks.

[0084] Optionally, in the above technical solution, the semantic cluster set acquisition module 204 includes a temporary cluster acquisition module, a normalization module, a cluster center update module, and a judgment module; The temporary cluster acquisition module is used to: assign each word vector in the word vector space to the cluster center with the nearest cosine distance, forming a temporary cluster; The normalization module is used to normalize the word vectors within each temporary cluster; The cluster center update module is used to: calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, normalize each arithmetic mean vector, and use each normalized vector as the new cluster center of the corresponding temporary cluster; The judgment module is used to: end the iteration if the change in all cluster centers is less than the preset threshold or the sum of squared errors no longer changes, and take the current temporary cluster as the final semantic cluster set; otherwise, call the temporary cluster acquisition module, normalization module and cluster center update module again.

[0085] Optionally, in the above technical solution, the scoring module 205 is specifically used to: for any semantic cluster in the final semantic cluster set, the comprehensive score of any candidate word in the semantic cluster is composed of a linear combination of the first scoring term and the second scoring term; the first scoring term is the normalized gradient weight of the candidate word; the second scoring term is the cosine similarity between the normalized candidate word and the normalized cluster center of the semantic cluster, and traverse each semantic cluster to obtain the comprehensive score of each word in each semantic cluster.

[0086] Furthermore, for any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors.

[0087] It should be noted that the beneficial effects of the dynamic clustering and optimization system 200 for suffix morphemes against adversarial attacks on large language models provided in the above embodiments are the same as those of the dynamic clustering and optimization method for suffix morphemes against adversarial attacks on large language models, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0088] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned methods for dynamic clustering and optimization of suffix morphemes against large language model adversarial attacks.

[0089] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned methods for dynamic clustering and optimization of suffix morphemes against adversarial attacks on large language models.

[0090] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0091] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A dynamic clustering and optimization method for suffix lemmas against adversarial attacks on large language models, characterized in that, include: Obtain a set of candidate lexical units for target prompts in the field of cybersecurity, and obtain the word vector corresponding to each candidate lexical unit in the set through a pre-trained language model; All word vectors together constitute a word vector space; Calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all the mutual reachability distances, and adaptively determine the optimal number of clusters according to the stability of the nodes in the hierarchical clustering tree; Based on the optimal number of clusters, the initial cluster centers are determined in the word vector space using an initialization method based on cosine distance; Clustering optimization is performed starting from the initial cluster centers to obtain the final semantic cluster set; Calculate the comprehensive score of each candidate lexical unit within each semantic cluster in the final semantic cluster set; Based on the comprehensive score, a predetermined number of candidate lexical units are selected from each semantic cluster to form an optimized candidate lexical unit group for adversarial attacks.

2. The method for dynamic clustering and optimization of suffix lemmas for adversarial attacks on large language models according to claim 1, characterized in that, Clustering optimization is performed starting from the initial cluster centers to obtain the final semantic cluster set, including: S40. Assign each word vector in the word vector space to the cluster center with the nearest cosine distance to form a temporary cluster; S41. Normalize the word vectors within each temporary cluster; S42. Calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, and normalize each arithmetic mean vector, using each normalized vector as the new cluster center of the corresponding temporary cluster. S43. If the change in all cluster centers is less than the preset threshold or the sum of squared errors no longer changes, then end the iteration and use the current temporary cluster as the final semantic cluster set; otherwise, return to S40.

3. The method for dynamic clustering and optimization of suffix lemmas for adversarial attacks on large language models according to claim 1, characterized in that, The calculation of the comprehensive score for each word element within each semantic cluster in the final semantic cluster set includes: For any semantic cluster in the final set of semantic clusters, the comprehensive score of any candidate word in the semantic cluster is composed of a linear combination of a first scoring term and a second scoring term; the first scoring term is the normalized gradient weight of the candidate word; the second scoring term is the cosine similarity between the normalized candidate word and the normalized cluster center of the semantic cluster. By traversing each semantic cluster, the comprehensive score of each word in each semantic cluster is obtained.

4. A method for dynamic clustering and optimization of suffix lemmas for adversarial attacks on large language models according to any one of claims 1 to 3, characterized in that, For any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors.

5. A dynamic clustering and optimization system for suffix lemmas against adversarial attacks on large language models, characterized in that, It includes a word vector space acquisition module, an optimal number of clusters determination module, an initial cluster center determination module, a semantic cluster set acquisition module, a scoring module, and a composition module; The word vector space acquisition module is used to: acquire a set of candidate word elements for target prompts in the field of network security, and acquire the word vector corresponding to each candidate word element in the set of candidate word elements through a pre-trained language model; all word vectors together constitute a word vector space; The optimal cluster number determination module is used to: calculate the mutual reachability distance between every two word vectors in the word vector space; construct a hierarchical clustering tree based on all the mutual reachability distances; and adaptively determine the optimal cluster number according to the stability of the nodes in the hierarchical clustering tree. The initial cluster center determination module is used to: determine the initial cluster centers in the word vector space based on the optimal number of clusters using an initialization method based on cosine distance; The semantic cluster set acquisition module is used to: perform clustering optimization starting from the initial cluster center to obtain the final semantic cluster set; The scoring module is used to: calculate the comprehensive score of each candidate word element within each semantic cluster in the final semantic cluster set; The constitutive module is used to: select a predetermined number of candidate lexical units from each semantic cluster based on the comprehensive score, and form an optimized candidate lexical unit group for adversarial attacks.

6. A dynamic clustering and optimization system for suffix lemmas against adversarial attacks on large language models, as described in claim 5, is characterized in that... The semantic cluster set acquisition module includes a temporary cluster acquisition module, a normalization module, a cluster center update module, and a judgment module; The temporary cluster acquisition module is used to: assign each word vector in the word vector space to the cluster center with the nearest cosine distance to form a temporary cluster; The normalization module is used to: normalize the word vectors within each temporary cluster; The cluster center update module is used to: calculate the arithmetic mean vector of the normalized word vectors within each temporary cluster, normalize each arithmetic mean vector, and use each normalized vector as the new cluster center of the corresponding temporary cluster. The judgment module is used to: end the iteration if the change in all cluster centers is less than a preset threshold or the sum of squared errors no longer changes, and take the current temporary cluster as the final semantic cluster set; Otherwise, the temporary cluster acquisition module, the normalization module, and the cluster center update module are invoked again.

7. A dynamic clustering and optimization system for suffix lemmas against adversarial attacks on large language models according to claim 6, characterized in that, The scoring module is specifically used for: For any semantic cluster in the final set of semantic clusters, the comprehensive score of any candidate word in the semantic cluster is composed of a linear combination of a first scoring term and a second scoring term; the first scoring term is the normalized gradient weight of the candidate word; the second scoring term is the cosine similarity between the normalized candidate word and the normalized cluster center of the semantic cluster. By traversing each semantic cluster, the comprehensive score of each word in each semantic cluster is obtained.

8. A dynamic clustering and optimization system for suffix lemmas against adversarial attacks on large language models, as described in any one of claims 5 to 7, characterized in that, For any two word vectors in the word vector space, the mutual reachability distance between the two word vectors is defined as the maximum value among the core distance between the two word vectors and the original distance between the two word vectors.

9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the dynamic clustering and optimization method for suffix morphemes against adversarial attacks on large language models as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the dynamic clustering and optimization method for suffix morphemes against adversarial attacks on large language models as described in any one of claims 1 to 4.

Images