A risk content identification method based on dynamic prompt word real-time optimization

Abstract

The application relates to the technical field of information security, and discloses a risk content identification method based on dynamic prompt word real-time optimization, which comprises the following steps: obtaining open domain text to be detected; performing semantic analysis processing on the open domain text by a large language model to generate first risk discrimination information; performing entity matching processing on the open domain text in combination with a security knowledge base to generate second risk discrimination information; performing difference detection; when a preset conflict condition is met, determining the corresponding open domain text as a conflict sample record; performing feature extraction processing on the conflict sample record to construct structured feedback data; performing adjustment and update processing on a prompt word template set, and performing incremental update processing on the security knowledge base according to entity feature information in the structured feedback data; and performing risk identification processing on the open domain text again to generate corresponding risk identification result data. The application has the advantages of improving stability and reliability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method for identifying risky content based on real-time optimization of dynamic prompt words. Background Technology

[0002] With the widespread application of generative artificial intelligence technology in text generation, dialogue interaction, and automatic review, the speed of online text content generation and the scale of its dissemination continue to expand. The automatic identification and interception of risky content such as illegal, irregular, fraudulent, violent, drug-related, and terrorist content in open-domain texts has become a crucial technical aspect of information security systems. Existing risk content identification systems typically combine natural language processing models with security knowledge bases to perform semantic analysis and entity matching on the input text to determine risk. However, due to the rapid evolution and deliberate avoidance of risk expressions, existing technologies are gradually revealing their insufficient adaptability in dynamic environments. Specifically, on the one hand, existing systems generally rely on pre-set prompts or fixed analysis instructions to guide large language models in risk judgment. These prompt templates are mainly constructed based on historical samples, and their content and structure are relatively static. When risk subjects use slang or homophones... When expressions are altered through methods such as word splitting and metaphor, the original prompts cannot cover the new semantic forms in a timely manner, easily leading to missed detections or misjudgments. On the other hand, existing security knowledge bases usually exist in the form of sensitive word lists or risk entity databases, and are mainly updated manually or in batches periodically, making it difficult to incorporate newly emerging risk entities or expressions in a timely manner, thus further amplifying the risk of missed detections. In addition, existing systems mostly use probability output and threshold judgment to decide whether to block. This type of probabilistic mechanism is difficult to provide the constraint of complete risk interception in zero-tolerance scenarios such as financial fraud and terrorism. There may still be cases where low-probability but high-harm content is not blocked. Therefore, existing technologies are difficult to continuously adapt to and stably identify dynamically evolving risk content, and are difficult to ensure the accuracy of identification while also taking into account the ability to cover new risk expressions. They are also difficult to provide a risk identification and interception mechanism with complete interception constraints in zero-tolerance security scenarios. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a risk content identification method based on real-time optimization of dynamic prompt words, which has the advantages of improved stability and reliability, and solves the problems mentioned in the background technology.

[0004] To achieve the aforementioned advantages in improving stability and reliability, this invention provides the following technical solution: a risk content identification method based on real-time optimization of dynamic prompt words, comprising the following steps: The open-domain text to be detected is obtained, and semantic analysis is performed on the open-domain text through a large language model to generate the first risk discrimination information. Then, entity matching is performed on the open-domain text in combination with the security knowledge base to generate the second risk discrimination information. Perform difference detection on the first risk discrimination information and the second risk discrimination information, and determine whether the preset conflict conditions are met based on the difference detection results. When the preset conflict conditions are met, the corresponding open domain text is identified as a conflict sample record. Feature extraction processing is performed on conflict sample records to obtain semantic feature information corresponding to semantic analysis processing and entity feature information corresponding to entity matching processing, and structured feedback data is constructed. The prompt word template set is adjusted and updated based on the semantic feature information in the structured feedback data, and the security knowledge base is incrementally updated based on the entity feature information in the structured feedback data. Based on the updated set of prompt word templates and the updated security knowledge base, the open domain text is reprocessed for risk identification, and the corresponding risk identification result data is generated.

[0005] Preferably, the process of generating the first risk discrimination information is as follows: The text to be detected is segmented, encoded, and a text representation vector is generated. Input the text representation vector into the preset large language model inference interface, and call the prompt word template set containing risk category identifiers, analysis instructions and dynamic prompt word templates; The large language model is guided to perform semantic understanding, risk category discrimination, and risk probability calculation by using a set of prompt word templates. The output includes semantic analysis results containing risk category identifiers and risk probability values, serving as the primary risk discrimination information.

[0006] Preferably, the process of generating the second risk discrimination information is as follows: Based on the first risk discrimination information and text representation vector, as a reference for candidate entity extraction, potential risk keywords identified by the semantic channel are labeled; Candidate entity terms are extracted based on text content and tags, and corresponding entity query vectors are generated. Input the entity query vector into the security knowledge base index module for similarity matching to obtain the matching entities and risk tags; The entity risk assessment result is generated based on the matched entity and risk label, and serves as the second risk assessment information.

[0007] Preferably, the process of performing difference detection on the first risk discrimination information and the second risk discrimination information is as follows: Extract the category identifier and probability value from the first risk assessment information and the second risk assessment information; Construct a risk discrimination difference vector to quantify the deviation between semantic and entity discrimination; Perform a consistency check on the risk discrimination difference vector and output the difference detection results.

[0008] Preferably, the process of determining whether the preset conflict conditions are met based on the difference detection results is as follows: Semantic analysis classification and probability values, as well as entity matching classification and confidence scores, are obtained from the difference detection results. Construct a difference vector between semantic channels and knowledge channels to quantify category inconsistency and probability or confidence bias. The difference vector is compared with the system's preset conflict threshold, including cases where the semantic analysis classification is inconsistent with the entity matching classification, and cases where the deviation between the semantic analysis probability value and the entity matching confidence value is greater than the preset threshold. When a category conflict or a probability or confidence deviation exceeds the limit, the conflict condition is determined to be met, and a conflict trigger signal is generated.

[0009] Preferably, based on the conflict trigger signal, the conflict text is standardized, including text cleaning, word segmentation and vectorization; The standardized text is written to the conflict sample cache, and a unique identifier is assigned to each text. Synchronously associate and store the first risk assessment information, second risk assessment information, conflict trigger timestamp, and difference detection metric of the text to form a complete conflict sample record.

[0010] Preferably, the process of constructing structured feedback data is as follows: Based on the conflict sample text records, semantic vector representations, risk keywords, and intermediate markers for model output are generated from the text. Simultaneously, it identifies entities and their types appearing in the text, matches confidence levels and risk labels, and forms semantic features and entity features; Semantic features and entity features are encapsulated in a unified data structure to form structured feedback data.

[0011] Preferably, the process of adjusting and updating the prompt word template set based on the semantic feature information in the structured feedback data is as follows: Input the semantic feature information from the structured feedback data into the prompt word update module; Based on semantic vector representation, risk keywords, and model output bias, this paper analyzes the constraint bias and insufficient guidance in existing prompt word templates. Based on the analysis results, the constraint terms, guiding terms, and weight parameters in the prompt word template set are dynamically adjusted; Update the adjusted prompt template set to the prompt management module to form the latest version of the prompt template set.

[0012] Preferably, the process of performing incremental update processing on the security knowledge base based on the entity feature information in the structured feedback data is as follows: After forming the latest version of the prompt word template set, the entity feature information in the structured feedback data is input into the entity verification module of the security knowledge base; Perform duplicate checks and validity checks on entity names and types, and filter out valid new entries; The verified entity feature information is written into the security knowledge base index structure to form the security knowledge base after incremental updates.

[0013] Preferably, the process of generating the corresponding risk identification result data is as follows: Semantic analysis of open-domain text is performed based on the latest version of the prompt word template set, and updated semantic analysis results are generated. Based on the security knowledge base after incremental updates, entity matching is performed on open domain texts to generate updated entity matching results. A fusion judgment is performed on the updated semantic analysis results and entity matching results to generate corresponding risk identification result data.

[0014] Compared with existing technologies, this invention provides a risk content identification method based on real-time optimization of dynamic prompt words, which has the following beneficial effects: This invention introduces a conflict sample feedback mechanism based on the difference between semantic discrimination results and entity matching results to construct structured feedback data. Based on this, it performs collaborative adaptive updates to the prompt word template set and the security knowledge base, thus forming a closed-loop optimization process for the risk identification strategy. This allows the risk identification system to continuously absorb information on new risk expressions and newly emerging risk entities without human intervention and promptly reflect it in the analysis strategy and knowledge structure. This improves the coverage of variant expressions such as "slang," "homophonic phrases," "word splitting," and "metaphors," reducing the probability of missed detections and misjudgments. Simultaneously, by performing difference detection and conflict sample triggering on the dual-channel discrimination results of semantic analysis and entity matching, the system can focus on high-risk text samples with high model uncertainty or those not covered by the knowledge base, effectively improving sample utilization efficiency and system learning targeting. Furthermore, by introducing a difference-driven structured feedback and incremental evolution mechanism in the risk identification process, the system's response speed and stability to changes in risk semantics and risk entities are enhanced. This ensures identification accuracy while improving the system's engineering applicability and security reliability in complex open-domain scenarios. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the method of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: Please refer to Figure 1 As shown in the embodiment of the present invention, a risk content identification method based on real-time optimization of dynamic prompt words includes the following steps: S1: Obtain the open-domain text to be detected, perform semantic analysis on the open-domain text using a large language model to generate the first risk discrimination information, and combine the security knowledge base to perform entity matching on the open-domain text to generate the second risk discrimination information.

[0018] The process of generating the first risk discrimination information in S1 is as follows: The text to be detected is segmented, encoded, and a text representation vector is generated. Standardized preprocessing is performed on the text to be detected, including removing invalid characters, unifying the encoding format, and normalizing full-width and half-width characters. The preprocessed text is then segmented to obtain a sequence of terms or sub-term units. The sequence of terms or sub-term units is then input into a pre-set text encoding model, such as a pre-trained language model based on the Transformer structure, to map the text into a fixed-dimensional continuous vector representation, forming a text representation vector. The text representation vector is used to represent the overall semantic information of the text and serves as the input feature for semantic analysis and risk judgment.

[0019] Input the text representation vector into the preset large language model inference interface, and call the prompt word template set containing risk category identifiers, analysis instructions and dynamic prompt word templates; The generated text representation vector and the corresponding original text input are pre-defined by the large language model inference interface. When called, a set of prompt word templates containing risk category identifiers, analysis instructions, and dynamic prompt word templates are loaded. The prompt word template set predefines the discrimination rules, analysis angles, and output format constraints corresponding to different risk categories. By combining the prompt word templates with the text to be detected to form a standardized inference input, the large language model is controlled to perform risk-related semantic parsing and discrimination processing on the text under a unified analysis framework, thereby ensuring the consistency of analysis logic and the comparability of results between different text samples.

[0020] The large language model is guided to perform semantic understanding, risk category discrimination, and risk probability calculation by using a set of prompt word templates. Under the constraints and guidance of the prompt word template set, the large language model first performs semantic understanding of the text content, extracts semantic clues related to risk, and classifies the text based on a preset risk category system. At the same time, the model calculates the corresponding probability value or confidence score for each risk category based on the internal inference results, which reflects the likelihood that the text belongs to that risk category. The risk probability value can be obtained by normalizing the relative support of the model for each risk category, or estimated based on the statistical distribution of multiple inference results, so as to form a stable risk probability output.

[0021] The output includes semantic analysis results containing risk category identifiers and risk probability values, serving as the primary risk discrimination information. The risk category identifier and corresponding risk probability value output by the large language model are encapsulated according to a preset data format to form a semantic analysis result data structure. The semantic analysis result includes at least: text identifier, predicted risk category, corresponding risk probability value, and model inference timestamp. Finally, the semantic analysis result is output as the first risk discrimination information, which is used to perform difference detection and conflict analysis processing with the second risk discrimination information generated based on the security knowledge base.

[0022] The process of generating the second risk discrimination information in S1 is as follows: Based on the first risk discrimination information and text representation vector, as a reference for candidate entity extraction, potential risk keywords identified by the semantic channel are labeled; The predicted risk category and its corresponding risk probability value contained in the first risk discrimination information are obtained. Combined with the semantic distribution information of the terms reflected in the text representation vector, the relevance between each term or sub-term unit in the text and the risk category is evaluated. The evaluation can be based on the similarity calculation between the semantic vector of the term and the risk category, or based on the term importance weight output by the model. When the relevance of a term to the risk category discrimination is higher than the preset threshold, the term is identified as a potential risk keyword and marked in the text to limit the search scope of candidate entity extraction.

[0023] Candidate entity terms are extracted based on text content and tags, and corresponding entity query vectors are generated. After marking potential risk keywords, the original text is processed by word segmentation, part-of-speech tagging, and entity boundary recognition to obtain the word sequence and its corresponding type in the text. Centered on the potential risk keywords, a set of candidate entity fragments is constructed according to the preset context window size, and fragments that do not contain substantive semantic content are removed. For each candidate entity fragment, an encoding model consistent with the entity vectors in the security knowledge base is used to map it into a continuous vector representation to generate the corresponding entity query vector, which is used to characterize the semantic features of the candidate entity.

[0024] Input the entity query vector into the security knowledge base index module for similarity matching to obtain the matching entities and risk tags; The generated entity query vector is input into the security knowledge base index module. The index module performs a similarity search on the entity query vector and the existing entity vectors in the security knowledge base based on the pre-built vector index structure. The similarity calculation method can be one or more of cosine similarity, Euclidean distance or inner product similarity. When the similarity between the entity query vector and a certain existing entity vector is higher than the preset matching threshold, the existing entity is determined to be a matching entity, and the risk category label and risk level label corresponding to the matching entity are read.

[0025] Entity risk assessment results are generated based on the matched entities and risk labels, serving as the second risk assessment information; Based on the obtained matching entities and their corresponding risk category labels, risk aggregation processing is performed on the candidate entities. When there are multiple matching entities, the final risk category and its corresponding risk weight are determined according to the preset risk level priority rules or weight accumulation rules. The determined risk category, risk level and its associated matching entity identifier are encapsulated to form the entity risk discrimination result. The entity risk discrimination result is output as the second risk discrimination information for difference detection and conflict analysis processing with the first risk discrimination information.

[0026] S2: Perform difference detection on the first risk discrimination information and the second risk discrimination information, and determine whether the preset conflict conditions are met based on the difference detection results. When the preset conflict conditions are met, the corresponding open domain text is identified as a conflict sample record.

[0027] The process of performing difference detection between the first risk discrimination information and the second risk discrimination information in S2 is as follows: Extract the category identifier and probability value from the first risk assessment information and the second risk assessment information; The risk category identifier and its corresponding risk probability value are read from the first risk discrimination information obtained through semantic analysis. At the same time, the risk category identifier and its corresponding confidence or weight value are read from the second risk discrimination information obtained through entity matching. The category identifiers are uniformly mapped to the preset risk category coding space, and the probability values ​​or confidence values ​​from different sources are subjected to scale normalization processing to make the risk discrimination results from the semantic channel and the entity channel comparable. After processing, a standardized discrimination data pair containing "semantic risk category code - semantic risk probability value" and "entity risk category code - entity risk confidence value" is formed as the input for difference quantification processing.

[0028] Construct a risk discrimination difference vector to quantify the deviation between semantic and entity discrimination; Based on standardized discriminant data pairs, a risk discriminant difference vector is constructed. The difference vector includes at least a category consistency difference component and a probability difference component. The category consistency difference component is used to characterize whether the risk categories output by the semantic channel and the entity channel are consistent. The probability difference component is used to characterize the numerical deviation between the corresponding probability values ​​or confidence values ​​of the two channels. The category consistency difference component can be represented by a binary encoding method to indicate whether they are consistent. The probability difference component can be calculated by using absolute difference, relative difference, or weighted difference, thereby uniformly mapping the deviations of different dimensions into a structured difference vector representation.

[0029] Perform a consistency check on the risk discrimination difference vector and output the difference detection results; The constructed risk discrimination difference vector is input into the consistency judgment module. The difference vector is evaluated according to the preset consistency rules or threshold conditions. The consistency rules may include whether the category consistency component meets the consistency requirements and whether the probability difference component is lower than the preset allowable deviation threshold. When the difference vector meets the consistency rules, the "discrimination consistent" result is output. When the difference vector does not meet the consistency rules, the "difference exists" result is output. The corresponding difference type and difference magnitude are recorded to form the difference detection result, which is used for conflict condition judgment and processing.

[0030] The process in S2 to determine whether the preset conflict conditions are met based on the difference detection results is as follows: Semantic analysis classification and probability values, as well as entity matching classification and confidence scores, are obtained from the difference detection results. The risk category identifier and corresponding risk probability value output from the semantic channel are read from the difference detection results. At the same time, the risk category identifier and corresponding confidence value output from the knowledge channel are read. A unified encoding mapping process is performed on the category identifier, and numerical normalization processing is performed on the probability value and confidence value, so that the discrimination results from different sources are in a unified dimension space, forming a standardized conflict judgment input data structure containing "semantic category code, semantic probability value, entity category code, and entity confidence value".

[0031] Construct a difference vector between semantic channels and knowledge channels to quantify category inconsistency and probability or confidence bias. Based on the standardized conflict judgment input data structure, a difference vector is constructed to distinguish between the semantic channel and the knowledge channel. The difference vector includes at least a category difference component and a numerical difference component. The category difference component is used to indicate whether the semantic channel judgment category and the knowledge channel judgment category are consistent. The numerical difference component is used to indicate the degree of deviation between the semantic probability value and the entity confidence value. The category difference component uses a binary or multi-value encoding method to represent whether they are consistent and the difference type. The numerical difference component is calculated using an absolute difference or relative difference method, thereby unifying the conflict information of different dimensions into a structured difference vector.

[0032] The difference vector is compared with the system's preset conflict threshold, including cases where the semantic analysis classification is inconsistent with the entity matching classification, and cases where the deviation between the semantic analysis probability value and the entity matching confidence value is greater than the preset threshold. The constructed difference vector is input into the conflict judgment module and compared with the system's preset conflict threshold set. The conflict threshold set includes a category conflict threshold and a numerical deviation threshold. The category conflict threshold is used to limit whether different categories are allowed to coexist, and the numerical deviation threshold is used to limit the maximum allowable deviation between the probability value and the confidence value. When the category difference component exceeds the category conflict threshold or the numerical difference component exceeds the numerical deviation threshold, it is determined that the current difference state exceeds the system's allowable range.

[0033] When a category conflict or a probability or confidence deviation exceeds the limit, the conflict condition is determined to be met, and a conflict trigger signal is generated. When the detected categorical or numerical difference components exceed the corresponding threshold, the conflict determination module generates a conflict trigger signal and records the conflict trigger signal, along with the corresponding text identifier and difference vector, in the conflict sample cache for conflict sample recording and feedback update processing. When none of the difference components exceed the threshold, it is determined that the conflict condition is not met, and no conflict trigger signal is generated.

[0034] The process of identifying the corresponding open-domain text as a conflict sample record in S2 is as follows: Based on the conflict trigger signal, the conflict text is standardized, including text cleaning, word segmentation and vectorization; After the conflict detection module generates a conflict trigger signal, it reads the corresponding open-domain text as the conflict text input and performs standardization preprocessing operations on the conflict text. The standardization process includes cleaning up invalid characters, abnormal symbols and format marks in the text, performing word segmentation or sub-word segmentation on the text, and inputting the processed term sequence into a preset text encoding model to generate the corresponding text vector representation. This ensures that the conflict text meets the unified specifications in terms of format, structure and semantic representation, making it easy to store, retrieve and process for feedback learning.

[0035] The standardized text is written to the conflict sample cache, and a unique identifier is assigned to each text. After standardization, the conflict texts and their corresponding text vectors are written into the conflict sample cache. The sample management module assigns a unique identifier to each conflict text. The unique identifier can be generated using an encoding method based on timestamps and random numbers, or using a global unique identifier generation algorithm. It is used to distinguish different conflict samples. The unique identifier and the corresponding conflict text form a one-to-one correspondence and serve as the index basis for the construction of structured feedback data and model update processing. Synchronously associate and store the first risk judgment information, the second risk judgment information, the conflict trigger timestamp, and the difference detection metric value of the text to form a complete conflict sample record; While writing the conflicting text to the cache, the system simultaneously associates and stores the corresponding first risk assessment information, second risk assessment information, conflict trigger timestamp, and difference detection metric. The information is then encapsulated according to a preset field structure to form a complete conflict sample record. The conflict sample record includes at least the following fields: text identifier, text content, semantic risk category and probability value, entity risk category and confidence value, difference type, and difference magnitude. The conflict sample record is stored as structured data in the conflict sample cache for use in the construction of structured feedback data and the updating of prompt words and security knowledge base.

[0036] S3: Perform feature extraction processing on the conflict sample records to obtain semantic feature information corresponding to semantic analysis processing and entity feature information corresponding to entity matching processing, and construct structured feedback data.

[0037] The process of constructing structured feedback data in S3 is as follows: Based on the conflict sample text records, semantic vector representations, risk keywords, and intermediate markers for model output are generated from the text. The text content in the conflict sample record is read and input into a preset text encoding model to generate a corresponding semantic vector representation. At the same time, keyword extraction processing is performed on the text to identify keywords or key phrases that may correspond to risk semantics. In addition, intermediate labeling information output by the large language model during semantic analysis is obtained from the first risk discrimination information, including risk category identifiers, risk probability values, and model discrimination confidence, etc., to obtain semantic vectors, risk keywords, and model intermediate labeling information that reflect the semantic features of the text, which are used to characterize the semantic channel's understanding of the conflict sample.

[0038] Simultaneously, it identifies entities and their types appearing in the text, matches confidence levels and risk labels, and forms semantic features and entity features; Simultaneously, entity recognition processing is performed on the conflict sample text to identify entity terms and corresponding entity types from the text, and to obtain the matching confidence and risk labels output during the entity matching process. Entity recognition can be achieved based on rules, models, or a combination of both. Entity types include at least person names, organizations, account identifiers, tool names, transaction identifiers, or other risk-related entity types. Entity features are constructed based on the identified entities, entity types, matching confidence, and risk labels to characterize the judgment result of the knowledge channel on the conflict sample.

[0039] Semantic features and entity features are encapsulated in a unified data structure to form structured feedback data; The semantic features, consisting of semantic vectors, risk keywords, and model intermediate tags, are encapsulated with the entity features, consisting of entity terms, entity types, matching confidence scores, and risk labels, according to a unified data field structure to form structured feedback data. The structured feedback data includes at least the following fields: text identifier, semantic vector, risk keywords, semantic risk category and probability value, entity name, entity type, entity risk label, and matching confidence score. Through unified structure encapsulation, the semantic features and entity features can be used as unified inputs for prompt word template adjustment and incremental update processing of the security knowledge base.

[0040] S4: Based on the semantic feature information in the structured feedback data, perform adjustment and update processing on the prompt word template set, and perform incremental update processing on the security knowledge base according to the entity feature information in the structured feedback data.

[0041] The process of adjusting and updating the prompt word template set based on the semantic feature information in the structured feedback data in S4 is as follows: Input the semantic feature information from the structured feedback data into the prompt word update module; The semantic feature information corresponding to each feedback record is read from the structured feedback data storage area, including the text semantic vector, risk keyword list and model output deviation marker. These are then packaged into prompt word update input samples according to the preset field format. The semantic vector is used to represent the overall semantic distribution of the text, the risk keywords are used to represent the specific risk concerns, and the model output deviation marker is used to represent the deviation between the model judgment result and the entity channel judgment result under the guidance of the current prompt word. The input samples are batched or input in real time into the prompt word update processing flow for template adjustment analysis.

[0042] Based on semantic vector representation, risk keywords, and model output bias, this paper analyzes the constraint bias and insufficient guidance in existing prompt word templates. By comparing the semantic vector with the semantic vectors of correctly identified historical samples, it is determined whether the current prompt word has insufficient guidance in a specific semantic region. The frequency of risk keywords in conflict samples and their coverage relationship with constraint or example items in the current prompt word are statistically analyzed to identify risk expression patterns that are not covered or insufficiently covered by the prompt word. At the same time, based on the deviation label of the model output, the types of scenarios in which the model makes erroneous or unstable judgments under the constraints of the current prompt word are analyzed. Based on the analysis results, the problematic items in the prompt word template, such as missing constraints, weak constraints, unclear guidance, or unreasonable weight configuration, are located.

[0043] Based on the analysis results, the constraint terms, guiding terms, and weight parameters in the prompt word template set are dynamically adjusted; For identified problem items, template adjustment operations are performed, including adding constraint statements or classification prompts corresponding to high-frequency risk keywords to the prompt word template, semantically strengthening or refining ambiguous or insufficiently guided descriptive statements, such as adding clear risk judgment criteria, supplementing example expressions or counterexamples, and adjusting the weight parameters corresponding to different constraint or guidance items in the prompt word template according to the direction and magnitude of the model output deviation, so that the model is more inclined to execute conservative or enhanced discrimination strategies in risk-related semantic regions. The adjustment process can be carried out using a rule-driven approach or a parameter correction method based on historical effect statistics.

[0044] Update the revised prompt template set to the prompt management module to form the latest version of the prompt template set; After adjusting the constraints, guidance items, and weight parameters of the prompt word template set, the prompt word update module performs format and integrity checks on each adjusted prompt word template to ensure that the template structure meets the system's preset field specifications and calling specifications. After the checks pass, all adjusted prompt word templates are encapsulated according to a unified data structure to construct a new prompt word template set object. A unique version number is assigned to this prompt word template set object, a corresponding effective time identifier and applicable scope identifier are generated, and it is registered as the current valid version. At the same time, the status of the original version is marked as a historical version. The prompt word template set of the current valid version is written to the valid template storage area of ​​the prompt word management module, and a version index relationship is established. During the text risk identification process, before performing risk identification, the semantic analysis module first reads the corresponding prompt word template set from the prompt word management module according to the "current valid version" identifier and loads it into the semantic analysis processing flow as the basis for the currently used prompt word constraints and guidance. This enables the system to form the latest version of the prompt word template set both logically and in terms of data, and realizes the continuous updating and controlled evolution of prompt word templates.

[0045] The process of incrementally updating the security knowledge base based on entity feature information in the structured feedback data in S4 is as follows: After forming the latest version of the prompt word template set, the entity feature information in the structured feedback data is input into the entity verification module of the security knowledge base; After the prompt word template set is updated and forms the current valid version, entity feature information fields are extracted from the structured feedback data, including entity name, entity type, risk label, matching confidence and entity context fragments. The entity feature information is then input as the entity to be verified into the entity verification module of the security knowledge base. The entity verification module performs standardization processing on the input entity, including unified character encoding, removal of noise symbols, standardization of capitalization and normalization of synonym expressions, and temporarily stores the processed entity feature information in the entity queue to be verified for validity and repeatability verification.

[0046] Perform duplicate checks and validity checks on entity names and types, and filter out valid new entries; The entity verification module is based on the existing entity index structure in the security knowledge base. It performs similarity comparison and hash index matching on the name and type of the entity to be verified to detect whether there are completely duplicate entities or highly similar entities. At the same time, it combines the frequency of entity occurrence, contextual semantic consistency and risk label stability to comprehensively evaluate the validity of the entity, removes low-confidence, noisy or semantically unstable entities, and retains only the valid entity feature information that meets the new conditions to form the set of entities to be updated.

[0047] The verified entity feature information is written into the security knowledge base index structure to form the security knowledge base after incremental updates. The entity names, types, risk tags, and their vector representations from the entity set to be updated are written into the entity storage area of ​​the security knowledge base. The entity inverted index, vector index, and entity-risk tag association table are updated synchronously. At the same time, a unique entity identifier is assigned to each new entity, and the entity source, update timestamp, and corresponding conflict sample identifier are recorded for traceability and version rollback. After the writing and index update are completed, an updated knowledge base version snapshot containing the new entity content is generated, and this version snapshot is registered as the currently effective security knowledge base version, thus forming the security knowledge base after the incremental update. During entity matching and risk identification, the effective version of the security knowledge base is called to achieve continuous incremental expansion of the risk entity set.

[0048] S5: Re-execute risk identification processing on open domain text based on the updated prompt word template set and the updated security knowledge base, and generate corresponding risk identification result data.

[0049] The process of generating the corresponding risk identification result data in S5 is as follows: Semantic analysis of open-domain text is performed based on the latest version of the prompt word template set, and updated semantic analysis results are generated. The system reads the set of prompt word templates currently marked as active from the latest version of the prompt word management module, selects the corresponding prompt word template instance based on the language type, text length, and business scenario of the open domain text to be detected, and then combines the open domain text with the selected prompt word template to construct a model input request. The system calls the large language model through the large language model inference interface to perform semantic understanding and risk discrimination processing, and outputs a semantic analysis result containing risk category identifier, risk probability value, and corresponding explanation information. This semantic analysis result is stored in the intermediate result cache as the updated semantic analysis result and is associated with the original text identifier for use in fusion judgment calls.

[0050] Based on the security knowledge base after incremental updates, entity matching is performed on open domain texts to generate updated entity matching results. The entity index structure, including the entity inverted index, entity vector index, and entity-risk label association table, is loaded from the security knowledge base after the incremental update. Entity extraction and vectorization are performed on the open-domain text to generate entity query vectors. These entity query vectors are then input into the entity vector index to perform similarity matching, obtaining matching entities and their corresponding risk labels and matching confidence scores. Simultaneously, the explicit entity terms in the text are checked for rule matching using the inverted index. Finally, the vector matching results and rule matching results are combined to generate entity matching results containing entity name, entity type, risk label, and confidence score. This entity matching result is then stored as the updated entity matching result.

[0051] Perform a fusion judgment on the updated semantic analysis results and entity matching results to generate corresponding risk identification result data; The system reads the updated semantic analysis results and the updated entity matching results, performs consistency analysis and priority ranking on the risk categories in the two types of results, selects or merges risk categories according to the fusion strategy configured in the business scenario, calculates the comprehensive risk score by combining the semantic analysis probability value and the entity matching confidence score, or executes mandatory interception marking on zero-tolerance risk categories according to preset rules, and finally generates risk identification result data containing risk category identifiers, comprehensive risk scores, interception decision identifiers and corresponding explanations.

[0052] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0053] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for identifying risky content based on real-time optimization of dynamic prompt words, characterized in that, Includes the following steps: The open-domain text to be detected is obtained, and semantic analysis is performed on the open-domain text through a large language model to generate the first risk discrimination information. Then, entity matching is performed on the open-domain text in combination with the security knowledge base to generate the second risk discrimination information. Perform difference detection on the first risk discrimination information and the second risk discrimination information, and determine whether the preset conflict conditions are met based on the difference detection results. When the preset conflict conditions are met, the corresponding open domain text is identified as a conflict sample record. Feature extraction processing is performed on conflict sample records to obtain semantic feature information corresponding to semantic analysis processing and entity feature information corresponding to entity matching processing, and structured feedback data is constructed. The prompt word template set is adjusted and updated based on the semantic feature information in the structured feedback data, and the security knowledge base is incrementally updated based on the entity feature information in the structured feedback data. Based on the updated set of prompt word templates and the updated security knowledge base, the open domain text is reprocessed for risk identification, and the corresponding risk identification result data is generated.

2. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 1, characterized in that, The process of generating the first risk assessment information is as follows: The text to be detected is segmented, encoded, and a text representation vector is generated. Input the text representation vector into the preset large language model inference interface, and call the prompt word template set containing risk category identifiers, analysis instructions and dynamic prompt word templates; The large language model is guided to perform semantic understanding, risk category discrimination, and risk probability calculation by using a set of prompt word templates. The output includes semantic analysis results containing risk category identifiers and risk probability values, serving as the primary risk discrimination information.

3. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 2, characterized in that, The process of generating the second risk discrimination information is as follows: Based on the first risk discrimination information and text representation vector, as a reference for candidate entity extraction, potential risk keywords identified by the semantic channel are labeled; Candidate entity terms are extracted based on text content and tags, and corresponding entity query vectors are generated. Input the entity query vector into the security knowledge base index module for similarity matching to obtain the matching entities and risk tags; The entity risk assessment result is generated based on the matched entity and risk label, and serves as the second risk assessment information.

4. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 3, characterized in that, The process of performing difference detection between the first risk assessment information and the second risk assessment information is as follows: Extract the category identifier and probability value from the first risk assessment information and the second risk assessment information; Construct a risk discrimination difference vector to quantify the deviation between semantic and entity discrimination; Perform a consistency check on the risk discrimination difference vector and output the difference detection results.

5. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 4, characterized in that, The process of determining whether the preset conflict conditions are met based on the difference detection results is as follows: Semantic analysis classification and probability values, as well as entity matching classification and confidence scores, are obtained from the difference detection results. Construct a difference vector between semantic channels and knowledge channels to quantify category inconsistency and probability or confidence bias. The difference vector is compared with the system's preset conflict threshold, including cases where the semantic analysis classification is inconsistent with the entity matching classification, and cases where the deviation between the semantic analysis probability value and the entity matching confidence value is greater than the preset threshold. When a category conflict or a probability or confidence deviation exceeds the limit, the conflict condition is determined to be met, and a conflict trigger signal is generated.

6. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 5, characterized in that, The process of identifying the corresponding open-domain text as a conflict sample record is as follows: Based on the conflict trigger signal, the conflict text is standardized, including text cleaning, word segmentation and vectorization; The standardized text is written to the conflict sample cache, and a unique identifier is assigned to each text. Synchronously associate and store the first risk assessment information, second risk assessment information, conflict trigger timestamp, and difference detection metric of the text to form a complete conflict sample record.

7. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 6, characterized in that, The process of constructing structured feedback data is as follows: Based on the conflict sample text records, semantic vector representations, risk keywords, and intermediate markers for model output are generated from the text. Simultaneously, it identifies entities and their types appearing in the text, matches confidence levels and risk labels, and forms semantic features and entity features; Semantic features and entity features are encapsulated in a unified data structure to form structured feedback data.

8. The risk content identification method based on real-time optimization of dynamic prompt words according to claim 7, characterized in that, The process of adjusting and updating the prompt word template set based on the semantic feature information in the structured feedback data is as follows: Input the semantic feature information from the structured feedback data into the prompt word update module; Based on semantic vector representation, risk keywords, and model output bias, this paper analyzes the constraint bias and insufficient guidance in existing prompt word templates. Based on the analysis results, the constraint terms, guiding terms, and weight parameters in the prompt word template set are dynamically adjusted; Update the adjusted prompt template set to the prompt management module to form the latest version of the prompt template set.

9. A risk content identification method based on real-time optimization of dynamic prompt words according to claim 8, characterized in that, The process of incrementally updating the security knowledge base based on entity feature information in the structured feedback data is as follows: After forming the latest version of the prompt word template set, the entity feature information in the structured feedback data is input into the entity verification module of the security knowledge base; Perform duplicate checks and validity checks on entity names and types, and filter out valid new entries; The verified entity feature information is written into the security knowledge base index structure to form the security knowledge base after incremental updates.

10. A risk content identification method based on real-time optimization of dynamic prompt words according to claim 9, characterized in that, The process of generating the corresponding risk identification result data is as follows: Semantic analysis of open-domain text is performed based on the latest version of the prompt word template set, and updated semantic analysis results are generated. Based on the security knowledge base after incremental updates, entity matching is performed on open domain texts to generate updated entity matching results. A fusion judgment is performed on the updated semantic analysis results and entity matching results to generate corresponding risk identification result data.

Images