Text query result determination method and apparatus, and electronic device

Abstract

The application discloses a kind of text query result determination method, device and electronic equipment.Therein, the method includes: receiving and responding to query request, according to initial query text, determine multiple candidate documents;Determine the target search section and target generation section corresponding to multiple candidate documents;Call the target search function corresponding to the search section, and the target generation function corresponding to the generation section;Determine the abnormal index corresponding to multiple target search sections respectively, and the target score corresponding to multiple target generation sections respectively;From multiple candidate documents, exclude the abnormal search section corresponding to the abnormal index exceeding abnormal threshold, exclude the abnormal generation section corresponding to the target score not reaching threshold, obtain target document;According to target document, determine target query result.The application solves the technical problem that search content is easily tampered maliciously in related art, leading to inaccurate search results.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, and more specifically, to a method, apparatus, and electronic device for determining text query results. Background Technology

[0002] In recent years, Retrieval-Augmented Generation (RAG) technology has effectively alleviated the model illusion problem and expanded the knowledge boundary by combining external knowledge bases with large language models. In real-world production environments, to meet the retrieval needs of vector data on the order of tens of millions or even hundreds of millions, RAG systems commonly employ Approximate Nearest Neighbor (ANN) indexing technology to improve retrieval efficiency. Among them, Hierarchical Navigable SmallWorld (HNSW) indexes have become the mainstream indexing structure due to their excellent retrieval performance and dynamic expansion capabilities. However, during queries, the retrieved content is susceptible to malicious tampering, resulting in inaccurate search results.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, and electronic device for determining text query results, in order to at least solve the technical problem in the related art that the search content is easily maliciously tampered with during the query, resulting in inaccurate search results.

[0005] According to one aspect of the present invention, a method for determining text query results is provided, comprising: receiving a query request, wherein the query request carries initial query text; responding to the query request, determining a plurality of candidate documents based on the initial query text; determining target retrieval segments and target generation segments corresponding to the plurality of candidate documents respectively; invoking a target retrieval function corresponding to the retrieval segment and a target generation function corresponding to the generation segment, wherein the target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items, and the target generation function aims to maximize the generation of expected benchmark answers on multiple surrogate models; determining anomaly indices corresponding to the plurality of target retrieval segments respectively based on the target retrieval function, and determining target scores corresponding to the plurality of target generation segments respectively based on the target generation function; filtering out anomalous retrieval segments whose corresponding anomaly indices exceed anomaly thresholds from the plurality of candidate documents, retaining candidate documents corresponding to normal retrieval segments, and filtering out anomalous generation segments whose corresponding target scores do not reach a threshold, retaining candidate documents corresponding to normal generation segments, thereby obtaining target documents; and determining target query results based on the target documents.

[0006] Optionally, determining the target score corresponding to each of the multiple target generated segments based on the target generation function includes: determining the substring matching degree corresponding to each of the multiple target generated segments based on the target generation function, and determining the semantic similarity corresponding to each of the multiple target generated segments, wherein the substring matching degree represents the degree of matching between the content of the corresponding target generated segment and the content of the benchmark answer, and the semantic similarity represents the degree of semantic similarity between the content of the corresponding target generated segment and the benchmark answer; and determining the target score corresponding to each of the multiple generated segments based on the substring matching degree and the semantic matching degree corresponding to each of the multiple target generated segments.

[0007] Optionally, before retrieving the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment, the method further includes: determining the sample score corresponding to the sample generation segment; if the sample score is lower than a predetermined score, setting a prompt word to rewrite the sample generation segment based on the prompt word, iterating until the corresponding score is greater than the predetermined score, and obtaining the target generation function after setting the prompt word.

[0008] Optionally, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: determining multiple extended query texts based on the initial query text; performing a vector mean calculation operation based on the initial query text and the multiple extended query texts to determine a semantic center vector; determining a semantic center document corresponding to the semantic center vector; and constructing similar items for the semantic center document based on the semantic center document.

[0009] Optionally, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: performing a retrieval operation on multiple extended query texts to obtain multiple retrieval documents; determining a hub document and competing documents from the multiple retrieval documents; and constructing similar items for the hub document and competing documents based on the hub document and the competing documents.

[0010] Optionally, determining the hub document and competing documents from the plurality of search documents further includes: jointly calculating the text ranking score and degree centrality score to determine the search index corresponding to each of the plurality of search documents; and determining the hub document and competing documents from the plurality of search documents based on the corresponding search index.

[0011] Optionally, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: determining, based on the semantic center document, the first cosine similarity between the retrieval segment vector and the semantic center vector, which maximizes the semantic center alignment loss, as the semantic center document similarity term; determining, based on the hub document, the second cosine similarity between the retrieval segment vector and the hub vector, which maximizes the hub vector alignment loss, as the hub document similarity term; and determining, based on the competing documents, the third cosine similarity between the retrieval segment vector and the competing document vector, which minimizes the competing document separation loss, as the competing document similarity term.

[0012] According to one aspect of the present invention, a text query result determination apparatus is provided, comprising: a receiving module, configured to receive a query request, wherein the query request carries initial query text; a first determining module, configured to determine a plurality of candidate documents based on the initial query text in response to the query request; a second determining module, configured to determine a target retrieval segment and a target generation segment corresponding to the plurality of candidate documents respectively; and a retrieval module, configured to retrieve a target retrieval function corresponding to the retrieval segment and a target generation function corresponding to the generation segment, wherein the target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items, and the target generation ... hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similarity items, hub document similar The first module is a target function that aims to maximize the target score of the expected benchmark answer generated on multiple proxy models. The second module is a determination module that determines the anomaly index corresponding to each of the multiple target retrieval segments based on the target retrieval function, and determines the target score corresponding to each of the multiple target generation segments based on the target generation function. The third module is a filtering module that filters out abnormal retrieval segments whose anomaly index exceeds the anomaly threshold from the multiple candidate documents, retains the candidate documents corresponding to the normal retrieval segments, and filters out abnormal generation segments whose target scores do not reach the threshold, retains the candidate documents corresponding to the normal generation segments, thus obtaining the target document. The fourth module is a determination module that determines the target query result based on the target document.

[0013] According to one aspect of the present invention, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the text query result determination method described in any of the preceding embodiments.

[0014] According to one aspect of the present invention, a computer-readable storage medium is provided, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the text query result determination method described in any of the preceding claims.

[0015] In this embodiment of the invention, a query request is received, wherein the query request carries initial query text; in response to the query request, multiple candidate documents are determined based on the initial query text; target retrieval segments and target generation segments corresponding to the multiple candidate documents are determined respectively; a target retrieval function corresponding to the retrieval segment and a target generation function corresponding to the generation segment are invoked, wherein the target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items, and the target generation function aims to maximize the target score of generating the expected benchmark answer on multiple surrogate models; based on the target retrieval function, anomaly indices corresponding to the multiple target retrieval segments are determined respectively, and target scores corresponding to the multiple target generation segments are determined respectively based on the target generation function; from the multiple candidate documents, abnormal retrieval segments whose corresponding anomaly indices exceed anomaly thresholds are filtered out, and candidate documents corresponding to normal retrieval segments are retained; and abnormal generation segments whose corresponding target scores do not reach the thresholds are filtered out, and candidate documents corresponding to normal generation segments are retained, thereby obtaining the target document; and the target query result is determined based on the target document. This paper proposes a method that performs anomaly detection and scoring on candidate documents in both the retrieval and generation segments. By constructing a retrieval function based on semantic center documents, hub documents, and competing documents, abnormal retrieval segments are identified. Furthermore, an abnormal generation segment is verified by constructing a generation function based on a multi-proxy model and benchmark answers. This achieves the goal of filtering abnormal and malicious documents from both the retrieval and generation dimensions, thereby improving the accuracy and security of query results. It also solves the technical problem in related technologies where the retrieved content is easily maliciously tampered with, leading to inaccurate search results. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0017] Figure 1 This is a flowchart of a method for determining text query results according to an embodiment of the present invention;

[0018] Figure 2 A general flowchart provided for optional embodiments of the present invention;

[0019] Figure 3 A schematic diagram of a local high-traffic hub node based on the HNSW index structure is provided as an optional embodiment of the present invention;

[0020] Figure 4 A flowchart of a local high-traffic hub node identification method provided as an optional embodiment of the present invention;

[0021] Figure 5 A schematic diagram of a two-stage abnormal document feature extraction structure provided for an optional embodiment of the present invention;

[0022] Figure 6 This is a structural block diagram of a text query result determination device according to an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] Example 1

[0026] According to an embodiment of the present invention, an embodiment of a method for determining text query results is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] Figure 1 This is a flowchart of a text query result determination method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0028] Step S102: Receive a query request, wherein the query request carries an initial query text;

[0029] A query request refers to an interactive instruction initiated by a user to the system to obtain an answer. For example, a user's action of entering a question on the interface and submitting it can trigger the system to start the retrieval and generation process.

[0030] The initial query text refers to the original question input by the user, such as how to troubleshoot a single-phase grounding fault in a 10kV distribution network, which can serve as the original basis for the system to retrieve, filter, and generate answers.

[0031] In this step, the system receives the query request initiated by the user and extracts the initial query text that the user actually wants to ask.

[0032] This step allows the system to obtain clear user intent, providing a starting point for subsequent document retrieval, anomaly filtering, and answer generation, ensuring that the entire process is based on real needs.

[0033] Step S104: In response to the query request, determine multiple candidate documents based on the initial query text;

[0034] Candidate documents refer to documents in the knowledge base that are semantically related to the initial query text, such as fault manuals, operating procedures, and technical documents, which can serve as the basis for subsequent retrieval segment, generation segment splitting, and anomaly detection.

[0035] In this step, the system searches the knowledge base based on the initial query text to find a batch of relevant candidate documents.

[0036] This step involves identifying potentially useful data and then conducting detailed analysis, ensuring comprehensive information coverage while providing processing targets for subsequent dual-layer defense.

[0037] Step S106: Determine the target retrieval segment and target generation segment corresponding to the multiple candidate documents respectively;

[0038] The target retrieval segment refers to the core text fragments in the candidate document that affect the relevance of the retrieval, such as the document title, keyword segment, and abstract segment, which can determine whether the document is easy to retrieve.

[0039] The target generation segment refers to the core content fragment in the candidate document used to generate the answer, such as step descriptions, principle explanations, and operating procedures, which can directly affect the accuracy and security of the final answer.

[0040] In this step, the system splits each candidate document into two parts: the search segment responsible for being found, and the generation segment responsible for generating the answer.

[0041] This step enables separate detection on the retrieval side and the generation side, making anomaly detection more accurate, preventing both retrieval poisoning and generation misleading, and improving the targeting of defenses.

[0042] Step S108: Retrieve the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment. The target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items. The target generation function aims to maximize the target score of generating the expected benchmark answer on multiple proxy models.

[0043] Among them, the target retrieval function refers to the detection function used to calculate the degree of abnormality of the retrieval segment. It uses semantic center document similarity items, hub document similarity items, and competing document similarity items as the judgment criteria, and can quantitatively identify whether the retrieval segment has been abnormally tampered with or poisoned.

[0044] The target generation function refers to the scoring function used to evaluate the quality of the generated segment. It aims to maximize the target score of the expected benchmark answer on multiple surrogate models and can quantitatively judge whether the generated segment is reliable and conforms to the standard answer.

[0045] Among them, the semantic center document refers to the core knowledge base document that is closest to the semantics of the query, and can serve as a benchmark for whether the retrieval segment is normal.

[0046] Among them, hub documents refer to the core documents with the highest traffic and the most representative ones in the search results, which can serve as an important reference for the normality of the search.

[0047] Among them, competing documents refer to documents that are similar in theme to the hub document but different in content, which can help determine whether the search segment is abnormally biased.

[0048] Among them, the proxy model refers to multiple independent models used to assist in verifying the generated segment, which can cross-verify the reliability of the content from multiple perspectives.

[0049] Among them, the expected benchmark answer refers to the pre-determined standard correct answer, which can be used as a reference for the standard answer of the generated segment score.

[0050] Among them, the target score refers to the score of the degree of matching between the generated section and the benchmark answer, which can intuitively determine whether the generated section is usable.

[0051] In this step, the system retrieves pre-trained retrieval and detection functions and scoring functions to prepare for subsequent quantitative judgment.

[0052] This step transforms anomaly detection from subjective experience into a quantifiable and reproducible function computation, ensuring stable, unified, and scalable deployment of detection methods.

[0053] Step S110: Based on the target retrieval function, determine the anomaly index corresponding to each of the multiple target retrieval segments, and based on the target generation function, determine the target score corresponding to each of the multiple target generation segments.

[0054] Among them, the anomaly index refers to the numerical value of the degree of anomaly of the search segment calculated by the target search function. The higher the value, the more likely it is to be poison / abnormal content, which can intuitively distinguish between normal search segments and abnormal search segments.

[0055] In this step, the system uses the target retrieval function to calculate the anomaly index of each document retrieval segment and the target generation function to calculate the target score of each document generation segment.

[0056] This step transforms the abnormality status into comparable numbers, enabling subsequent screening to be performed automatically, without human intervention, and with high efficiency and consistent judgment.

[0057] Step S112: From multiple candidate documents, filter out abnormal retrieval segments whose corresponding abnormality index exceeds the abnormal threshold, retain the candidate documents corresponding to normal retrieval segments, and filter out abnormal generation segments whose corresponding target score does not reach the threshold, retain the candidate documents corresponding to normal generation segments, and obtain the target document.

[0058] Among them, the abnormal threshold refers to the pre-set abnormal index threshold value. If it is exceeded, it is judged as abnormal, which can realize automated and standardized abnormal filtering.

[0059] Among them, abnormal search segments refer to search segments whose abnormality index exceeds the abnormal threshold, which are the parts that have been poisoned or abnormally tampered with.

[0060] The normal search segment refers to the search segment where the anomaly index is within the threshold, and it is considered a safe and reliable search segment.

[0061] Among them, the abnormally generated segment refers to the segment whose target score is not met, and whose content is unreliable or inconsistent with the standard answer.

[0062] Among them, the normally generated segment refers to the segment that meets the target score and whose content is accurate and reliable.

[0063] Among them, the target document refers to the safe and reliable document retained after dual screening of retrieval and generation, which is the high-quality material ultimately used to generate the answer.

[0064] In this step, the system performs two layers of filtering simultaneously, achieving a dual defense in retrieval and generation: preventing abnormal documents from being retrieved and preventing bad content from entering the generation stage, thus avoiding incorrect answers, misleading content, and malicious poisoning from affecting the final result at the source.

[0065] Step S114: Determine the target query results based on the target document.

[0066] The target query result refers to the safe, accurate, and knowledge-based answer that the system ultimately returns to the user, providing reliable information.

[0067] In this step, the system generates the final target query results based on the filtered security target documents.

[0068] This step ensures that the answers users receive come only from safe, normal, and reliable documents, resulting in clean retrieval and reliable generation, significantly improving the system's security and usability.

[0069] As an optional embodiment, determining the target score corresponding to each of the multiple target generated segments based on the target generation function includes: determining the substring matching degree corresponding to each of the multiple target generated segments based on the target generation function, and determining the semantic similarity corresponding to each of the multiple target generated segments, wherein the substring matching degree represents the degree of matching between the content of the corresponding target generated segment and the content of the benchmark answer, and the semantic similarity represents the degree of semantic similarity between the content of the corresponding target generated segment and the benchmark answer; and determining the target score corresponding to each of the multiple generated segments based on the substring matching degree and the semantic matching degree corresponding to each of the multiple target generated segments.

[0070] The substring matching degree refers to the degree of literal overlap between the content of the target generated segment and the key core content of the expected benchmark answer. Specifically, it can be calculated by the substring matching function (Contain). For example, if the benchmark answer contains the core steps of power outage, power testing, and segmented investigation, and the target generated segment contains the complete substring, the substring matching degree is close to 1. If the power testing step is missing, the substring matching degree is greatly reduced. It can quickly verify whether the generated segment contains the key information of the standard answer from the literal level, ensuring that the generated content does not omit the core points.

[0071] Among them, the benchmark answer refers to the standard correct answer determined in advance based on industry norms, professional knowledge bases, and standard manuals. For example, the operation steps specified in the "10kV Distribution Network Fault Troubleshooting Guide" in the power field can serve as a unified and objective reference standard for generation segment verification, avoiding scoring deviations caused by the lack of clear references and ensuring the consistency and standardization of scoring.

[0072] Semantic similarity refers to the degree of similarity between the content of the target generated segment and the benchmark answer at the level of deep semantics and core logic, rather than simple textual overlap. It can be calculated by combining the semantic similarity function (Sim) with cosine similarity. For example, if the target generated segment describes first disconnecting the faulty circuit switch, then checking the circuit for power failure, and gradually investigating the fault point, it is different from the benchmark answer's textual description of power outage, power testing, and segmented investigation, but the semantics are completely consistent. In this case, the semantic similarity is close to 1, which can verify the accuracy of the generated segment from the semantic level, avoid misjudgment caused by relying solely on textual matching, and take into account both the flexibility of expression and the accuracy of content.

[0073] Among them, semantic matching degree refers to the specific quantitative value of semantic similarity. It is one of the core data supports for the calculation of target score. Together with substring matching degree, it forms the basis for the calculation of target score. It can transform deep semantic fit into quantifiable indicators to ensure the scientificity and objectivity of target score.

[0074] In this embodiment, the specific operation process is as follows: First, a preset target generation function is called to calculate the substring matching degree and semantic similarity with the benchmark answer for each target generation segment. The substring matching degree focuses on detecting whether the generated segment contains the key text and core steps of the benchmark answer, while the semantic similarity focuses on detecting whether the generated segment is consistent with the core logic and deeper meaning of the benchmark answer. Subsequently, a weighted summation method can be used (e.g., substring matching degree weight λ=0.6, semantic similarity weight 1-λ=0.4) to combine the two indicators and calculate the target score corresponding to each target generation segment. Taking a power scenario as an example, if the baseline answer is that troubleshooting a single-phase ground fault in a 10kV distribution network requires first shutting down the power and then verifying the voltage, and the fault point is located using a segmented disconnection method, and a target generation segment is a 10kV distribution network ground fault troubleshooting step: shutting down the power and then verifying the voltage, and finding the fault location through segmented disconnection, then its substring matching degree is high (including core substrings such as power outage, voltage verification, and segmented disconnection), and the semantic similarity is close to 1, with a target score of over 0.9; if a target generation segment is a 10kV distribution network ground fault that can be directly detected without shutting down the power, then its substring matching degree is 0 (not including core substrings such as power outage and voltage verification), the semantic similarity is extremely low, and the target score is only around 0.1.

[0075] This approach achieves dual verification of the generated segment, ensuring both literal and semantic aspects. Firstly, it guarantees the generated segment contains the key core content of the benchmark answer, preventing errors due to missing core information. Secondly, it ensures the core logic of the generated segment aligns with the benchmark answer, avoiding misjudgments due to differences in wording. This makes the target score calculation more comprehensive, accurate, and convincing. Simultaneously, the quantified target score provides a clear and unified standard for subsequent screening of abnormal generated segments, enabling automated screening without manual intervention and improving efficiency. Furthermore, this dual verification method effectively identifies two types of abnormal generated segments: those that appear to match in wording but have semantic discrepancies, and those that are semantically consistent but lack key substrings. This significantly improves the accuracy of anomaly detection on the generation side, providing reliable assurance for subsequent target document screening. Ultimately, it prevents abnormal generated segments from affecting the accuracy of the final target query results, solving the problems of single-dimensional verification and high false positive rates in related technologies.

[0076] As an optional embodiment, before retrieving the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment, the method further includes: determining the sample score corresponding to the sample generation segment; if the sample score is lower than a predetermined score, setting prompt words to rewrite the sample generation segment based on the prompt words, iterating until the corresponding score is greater than the predetermined score, and obtaining the target generation function after setting the prompt words.

[0077] Among them, the sample generation segment refers to the example text fragments used to train and optimize the target generation function. It is divided into normal sample generation segment and abnormal sample generation segment. For example, normal samples are descriptions of fault troubleshooting steps that conform to power specifications, while abnormal samples are fault descriptions that have been maliciously tampered with or lack core safety steps. It can provide rich training materials for the target generation function, allowing the function to gradually learn the feature differences between normal and abnormal generation segments and improve the function's recognition ability.

[0078] Among them, the sample score refers to the quality score calculated on the sample generation segment by the initially constructed target generation function. It can intuitively reflect whether the quality of the current sample generation segment meets the preset standard, and at the same time reflect the verification accuracy of the current target generation function, providing clear feedback basis for the iterative optimization of the function.

[0079] The predetermined score refers to the pre-set threshold for the qualified score of the sample generation segment. It is the core standard for judging whether the sample generation segment is qualified and whether the target generation function needs to be further optimized. For example, it can be set to 0.7 (out of 1) in combination with the actual application scenario. If the sample score is ≥0.7, it means that the sample is qualified and the current verification accuracy of the function meets the standard. If the sample score is <0.7, it means that the sample is unqualified and the function needs to be further optimized. It can provide a clear judgment boundary for iterative optimization and ensure that the optimization process proceeds in an orderly manner.

[0080] The prompt words refer to the instruction text constructed based on the feedback results of the sample scores, which is used to guide the model to rewrite the sample generation segment. The prompt words must clearly include the shortcomings of the sample scores, the core features of the benchmark answer, and the direction and requirements of the rewriting. For example, for abnormal samples with low sample scores (missing the power outage and voltage testing steps), the prompt words can be set to supplement the core safety steps of 10kV distribution network fault diagnosis. It must include the power outage and voltage testing steps, ensure that the content complies with the "10kV Distribution Network Fault Diagnosis Guide", is consistent with the core logic of the benchmark answer, and can accurately guide the direction of sample rewriting, so that the rewritten sample generation segment is more in line with the benchmark answer, and at the same time, it can also enable the target generation function to learn the correct generation segment features.

[0081] In this embodiment, the specific operation process is as follows: First, a sufficient number of normal and abnormal sample generation segments are selected. Using the initially constructed target generation function, the sample score corresponding to each sample generation segment is calculated. Then, the sample scores are judged. If the sample score is higher than or equal to a predetermined score, the sample is considered qualified and does not require rewriting; it can be used as a training sample for the target generation function. If the sample score is lower than the predetermined score, the sample is considered unqualified. Based on the shortcomings of the sample score, targeted prompt words are constructed, and a publicly available large-scale language model is called to rewrite the sample generation segment according to the prompt words. After rewriting, the sample score of the rewritten sample is recalculated, and it is judged again whether the predetermined score has been reached. If not, the prompt words are adjusted, and the rewriting and scoring steps are repeated until the sample score is higher than the predetermined score. Through multiple rounds of such iterative rewriting and scoring verification, the verification logic of the target generation function parameters is gradually optimized, ultimately resulting in a target generation function with satisfactory verification accuracy that can accurately identify abnormal generation segments. Taking a scenario as an example, the initial sample generation segment is a 10kV distribution network grounding fault that can be directly detected by opening the distribution cabinet. The sample score is only 0.2 (it does not include the core steps of power outage and voltage testing, and does not meet the benchmark answer). At this time, prompts are set to supplement the core steps of power outage and voltage testing, clarifying that the main switch must be disconnected and a voltage tester must be used to confirm that there is no power before troubleshooting. The rewritten content must be semantically consistent with the benchmark answer. After rewriting, the sample is that the troubleshooting of a 10kV distribution network grounding fault requires first disconnecting the main switch to cut off the power, then using a voltage tester to confirm that there is no power in the line, and then opening the distribution cabinet to detect the fault point. The recalculated sample score is 0.85, reaching the predetermined score of 0.7, and the iteration of this sample is completed. Through the iteration of multiple sets of similar samples, the verification logic of the target generation function is gradually optimized.

[0082] This approach enables multi-round iterative optimization of the target generation function, allowing the function to gradually learn the core feature differences between normally generated segments and abnormally generated segments. This continuously improves the function's sensitivity and accuracy in detecting abnormally generated segments, avoiding missed or false detections due to insufficient initial validation precision. Simultaneously, guiding sample rewriting with prompts ensures that the rewritten sample generated segments closely match the benchmark answer, providing high-quality training material for the target generation function and further enhancing its generalization ability. This allows it to adapt to different scenarios and expressions requiring segment validation. Furthermore, the iterative optimization process continuously corrects parameter deviations in the target generation function, ensuring stable and accurate calculation of the target score in practical applications. This provides reliable support for subsequent segment selection, thereby improving the stability and reliability of the entire query result determination method and solving the technical problems of insufficient validation precision and inability to accurately identify abnormally generated segments in related technologies.

[0083] As an optional embodiment, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: determining multiple extended query texts based on the initial query text; performing a vector mean calculation operation based on the initial query text and the multiple extended query texts to determine the semantic center vector; determining the semantic center document corresponding to the semantic center vector; and constructing semantic center document similarity items based on the semantic center document.

[0084] Among them, extended query text refers to a set of semantically similar query texts that cover different query perspectives, generated based on the initial query text through search engine APIs, knowledge community platform crawling, semantic expansion algorithms, etc. The number of extended query texts is usually preset to 50. For example, if the initial query text is "How to troubleshoot single-phase grounding faults in 10kV distribution networks", the extended query texts may include "10kV distribution network grounding fault detection steps", "10kV distribution network single-phase grounding fault troubleshooting techniques in mountainous areas", "10kV distribution network grounding fault troubleshooting safety specifications", "distribution network single-phase grounding fault location methods", etc. It can cover different application scenarios and different expressions of the initial query, enrich the semantic scope of the query, and ensure that the subsequent semantic center vector can comprehensively and accurately reflect the user's query intent.

[0085] The vector mean calculation operation can be performed by encoding the initial query text and multiple extended query texts separately using a preset embedding model (such as BGE-M3 or Qwen-Embedding) to obtain a vector representation corresponding to each query text. Then, the arithmetic mean of all vector representations is calculated to obtain a comprehensive vector. This process can fuse the semantic features of multiple query texts to obtain a more representative and stable semantic vector, avoiding the impact of semantic bias of a single query text on the accuracy of subsequent document matching.

[0086] The semantic center vector, obtained through vector mean calculation, is a vector that comprehensively represents the overall semantics of the initial query text and all extended query texts. It is a quantitative representation of the user's query intent. For example, if both the initial query and the extended query revolve around the investigation of 10kV distribution network grounding faults, then the semantic center vector is the core semantic quantification result of this topic. It can serve as the core basis for matching documents in the knowledge base, ensuring that the matched documents are highly consistent with the user's query intent.

[0087] Among them, the semantic center document refers to the document in the knowledge base with the highest cosine similarity to the semantic center vector. It is the core document in the knowledge base that best matches the user's query intent. For example, the "Standardized Troubleshooting Manual for Single-Phase Grounding Faults in 10kV Distribution Network" in the power knowledge base can serve as the core benchmark for subsequent anomaly detection in the retrieval segment, providing entity references for the construction of similar items in the semantic center document and ensuring that anomaly detection has clear standards.

[0088] Among them, the semantic center document similarity term refers to the core term constructed based on the vector features of the semantic center document to calculate the similarity between the retrieval segment and the semantic center document. It is an important component of the target retrieval function and can quantify the similarity between the retrieval segment and the semantic center document, thereby determining whether there are any abnormalities such as semantic deviation or malicious tampering in the retrieval segment.

[0089] In this embodiment, the specific operation process is as follows: First, based on the initial query text input by the user, 50 semantically similar extended query texts are generated through a preset expansion method to ensure that the extended queries can cover different angles and application scenarios of the initial query; then, a preset embedding model is called to encode the initial query text and the 50 extended query texts respectively, converting each query text into a corresponding vector representation; next, the arithmetic mean of all 51 vectors (1 initial query vector and 50 extended query vectors) is calculated to obtain the semantic center vector, which integrates the semantic features of all query texts and can accurately reflect the user's query intent; then, based on the semantic center vector, a similarity retrieval is performed in a vector database using an HNSW index structure to find the document with the highest cosine similarity to the vector and determine it as the semantic center document; finally, based on the vector features of the semantic center document, a semantic center document similarity item is constructed, providing core support for the subsequent retrieval of the target retrieval function and the calculation of the anomaly index. Taking a scenario as an example, the initial query text is "How to troubleshoot single-phase grounding faults in 10kV distribution networks". The expanded query text covers multiple aspects such as fault detection, location, and safety standards. The semantic center vector is obtained by embedding model encoding and vector mean calculation. Then, through HNSW index retrieval, the "Standardized Troubleshooting Manual for Single-Phase Grounding Faults in 10kV Distribution Networks" that best fits the semantics is matched in the knowledge base. This document is used as the semantic center document, and then semantic center document similarity items are constructed.

[0090] This approach firstly enriches the semantic scope of the query by expanding the query text, avoiding subsequent document matching biases caused by the semantic limitations of a single initial query text. Secondly, the semantic center vector calculated using vector mean accurately and comprehensively reflects the user's query intent, ensuring that the semantic center document matched subsequently is the core document in the knowledge base that best meets the user's needs. Finally, the semantic center document similarity items constructed based on the semantic center document provide a clear detection benchmark for the target retrieval function, giving anomaly detection of the retrieval segment a unified and objective reference standard. This effectively determines whether the retrieval segment deviates from the user's query intent or has been maliciously tampered with, improving the accuracy and stability of anomaly detection. Simultaneously, this approach achieves a precise connection from query text to semantic vectors and then to knowledge base documents, building a bridge between the user's query intent and the core content of the knowledge base. This lays a solid foundation for determining subsequent hub documents and competing documents, as well as the application of the target retrieval function, solving the problems of retrieval bias and inaccurate anomaly detection caused by the single semantic meaning of the query and the lack of a clear retrieval benchmark in related technologies.

[0091] As an optional embodiment, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: performing a retrieval operation on multiple extended query texts to obtain multiple retrieval documents; identifying the hub document and competing documents from the multiple retrieval documents; and constructing hub document similar items and competing document similar items based on the hub document and competing documents.

[0092] Among them, the retrieved documents refer to the top 10 documents with the highest semantic similarity to each extended query text after performing a Top-k search (k is preset to 10) in a vector database (associative knowledge base) using the HNSW index structure. A total of 500 retrieved documents (including duplicates) are obtained from 50 extended query texts. These documents are all related to the user's query intent and are the basic materials for filtering hub documents and competing documents. This ensures that the hub documents and competing documents selected later are highly relevant to the user's query topic and provides an effective reference for the detection of anomalies in the retrieval segment.

[0093] Among them, the hub document refers to the core document selected from all the searched documents, which has the highest search index, is the most representative, and has the largest search traffic. It can serve as the core reference for detecting search segment anomalies. Its vector features are an important standard for judging whether the search segment is normal. The higher the similarity between the search segment and the hub document, the more the search segment conforms to normal semantics.

[0094] Among them, competing documents refer to the set of documents selected from all searched documents that are similar in theme to the hub document but have different content and whose search index ranking is second only to the hub document. They are usually the searched documents ranked 2nd to 10th, such as the "Distribution Network Fault Troubleshooting Operation Specifications" compiled by different power companies. They can be used as a comparative reference for detecting anomalies in the search segment. By judging the similarity between the search segment and competing documents, it helps to identify whether the search segment has abnormal bias (such as excessively fitting a non-core document or deviating from the core semantics).

[0095] In this embodiment, the operation process is illustrated by the following example: First, a Top-10 search operation is performed on each of the 50 extended query texts. Each extended query retrieves 10 documents with the highest semantic similarity, resulting in a total of 500 retrieved documents (including duplicates). Then, all retrieved documents are deduplicated to obtain a unique set of retrieved documents. Next, the retrieval index of each unique retrieved document is calculated (weighted by the text ranking score and degree centrality score). Based on the retrieval index, documents are sorted from high to low. The document with the highest retrieval index is identified as the hub document, and documents ranked 2nd to 10th are identified as competing documents, forming a set of competing documents. Finally, based on the vector features of the hub document and the vector features of the competing document set, hub document similarity items and competing document similarity items are constructed, which, together with the previously constructed semantic central document similarity items, constitute the core components of the target retrieval function. For example, 50 extended query texts yielded 500 power operation and maintenance related documents. After deduplication, 80 unique documents were obtained. After calculating the retrieval index of each document, the "General Outline for Distribution Network Fault Handling" was identified as the hub document, and the other 9 different versions of fault investigation specifications were identified as competing documents. Then, corresponding similar items were constructed for each document.

[0096] This method selects pivot documents, which are the most core and representative documents in the search results. These documents provide a core reference for anomaly detection in search segments, ensuring that the semantics of the search segments align with the user's core query intent. Selected competing documents serve as comparative references, helping to identify any abnormal biases in the search segments and preventing them from excessively adhering to non-core documents or deviating from the core semantics. This achieves the construction of a dual detection benchmark of core and comparative references. Simultaneously, the similarity items constructed based on these two types of documents enrich the detection dimensions of the target retrieval function, allowing it to comprehensively detect anomalies in search segments from three perspectives: alignment with the semantic center, alignment with the pivot document, and separation from competing documents. This significantly improves the comprehensiveness and accuracy of anomaly detection. Furthermore, the search documents all originate from knowledge base content relevant to the user's query, ensuring that pivot documents, competing documents, and the user's query intent are highly relevant. This avoids detection bias caused by deviations between the reference documents and the query topic, providing a high-quality reference for subsequent anomaly index calculations and thus enhancing the reliability of the entire query result determination method.

[0097] As an optional embodiment, identifying hub documents and competing documents from multiple search documents further includes: jointly calculating text ranking scores and degree centrality scores to determine search indices corresponding to the multiple search documents respectively; and identifying hub documents and competing documents from the multiple search documents based on the corresponding search indices.

[0098] The text ranking score refers to the score calculated using a reciprocal ranking weighting method based on the ranking of the retrieved document in each Top-k search result. For example, if a document ranks first in the search results of a certain extended query, it will have a higher ranking score, while if it ranks tenth, it will have a lower ranking score. It can reflect the priority and relevance of the document in a single search. The higher the ranking score, the higher the semantic similarity between the document and the corresponding extended query, and the more attention it receives from the search system.

[0099] The degree centrality score is calculated based on the proportion of times a document is retrieved by different extended queries. For example, if a document is retrieved by 30 out of 50 extended queries, its degree centrality score is higher than that of a document retrieved by only 10 extended queries. It can reflect the industry representativeness and coverage of the document. The higher the degree centrality score, the stronger the document's universality and representativeness, and the better it can be used as a core reference for detecting anomalies in the retrieval segment.

[0100] The retrieval index is a comprehensive quantitative indicator obtained by weighting and summing the text ranking score and degree centrality score. It can objectively and comprehensively measure the coreness and representativeness of the retrieved documents, avoid the screening bias caused by a single indicator, and provide a clear quantitative basis for the screening of hub documents and competing documents.

[0101] In this embodiment, the operation process is illustrated by the following example: First, for each unique search document, its text ranking score and degree centrality score are calculated. The text ranking score is calculated as the inverse weighted average of all search results containing the document; the higher the ranking, the higher the score. The degree centrality score is calculated by dividing the number of extended queries retrieved for the document by the total number of extended queries (50), and the higher the percentage, the higher the score. Subsequently, the text ranking score and degree centrality score are weighted and summed according to preset weights (α=0.6, β=0.4) to obtain the search index corresponding to each search document. Finally, all search documents are sorted from high to low according to their search indices. The document with the highest search index is identified as the hub document, and the documents ranked 2nd to 10th in search index are identified as competing documents, thus completing the selection of hub documents and competing documents. For example, a document ranks in the top 3 in multiple searches, with a text ranking score of 0.85. It is also retrieved by 40 extended queries, with a degree centrality score of 0.8. Its retrieval index = 0.6 × 0.85 + 0.4 × 0.8 = 0.83, ranking first and thus identified as a hub document. Another document has a text ranking score of 0.7, is retrieved by 30 extended queries, has a degree centrality score of 0.6, and its retrieval index = 0.6 × 0.7 + 0.4 × 0.6 = 0.66, ranking third and thus identified as a competing document.

[0102] This method employs both text ranking score and degree centrality score as dual indicators to jointly calculate the retrieval index. It comprehensively and objectively measures the core nature and representativeness of retrieved documents, avoiding the misselection of hub documents due to relying solely on text ranking score (which may result in documents with high ranking in a single search but poor general applicability) and the misselection of documents with high search frequency but low ranking and poor relevance due to relying solely on degree centrality score. This ensures that the selected hub documents truly possess core representativeness and strong general applicability, while the selected competing documents are effectively comparable, sharing similar themes with reasonable differences from the hub documents. Furthermore, the retrieval index calculation formula is clear and the weights are fixed, enabling a quantitative determination of the core nature of retrieved documents. This ensures the screening process is reproducible and scalable, avoiding the subjectivity and errors of manual screening. In addition, the hub and competing documents selected through this method provide high-quality references for subsequent similarity item construction, ensuring the anomaly detection accuracy of the target retrieval function and thus improving the reliability of anomaly detection on the entire retrieval side. This solves the problems of vague, subjective, and inaccurate selection criteria for hub and competing documents in related technologies.

[0103] As an optional embodiment, before invoking the target retrieval function corresponding to the retrieval segment, the method further includes: determining, based on the semantic center document, the first cosine similarity between the retrieval segment vector and the semantic center vector, which maximizes the semantic center alignment loss, as a semantic center document similarity term; determining, based on the hub document, the second cosine similarity between the retrieval segment vector and the hub vector, which maximizes the hub vector alignment loss, as a hub document similarity term; and determining, based on the competing documents, the third cosine similarity between the retrieval segment vector and the competing document vector, which minimizes the competing document separation loss, as a competing document similarity term.

[0104] The semantic center alignment loss refers to the loss term in the target retrieval function used to maximize the similarity between the retrieval segment vector and the semantic center vector. Its core function is to guide the retrieval segment to align with the semantic center vector, ensuring that the semantics of the retrieval segment aligns with the overall meaning of the user query. Figure 1 To avoid the retrieved segment deviating from the core semantics, a weight can be set for it. The weight ω can be preset to 0.5, which can balance the influence of this loss term with other loss terms and ensure the comprehensiveness of anomaly detection.

[0105] Among them, the retrieval segment vector refers to the vector representation obtained by encoding the target retrieval segment through a preset embedding model (such as BGE-M3). It can quantitatively represent the semantic features of the target retrieval segment, transform the text-based retrieval segment into a computable vector, provide a basis for subsequent similarity calculation, ensure that anomaly detection can be achieved through quantification, and improve the accuracy and efficiency of detection.

[0106] The semantic center vector, which is a vector that comprehensively represents the overall semantics of the initial query text and all extended query texts, is a quantitative representation of the user's query intent. It can serve as the core benchmark for semantic alignment of the retrieval segment, ensuring that the semantics of the retrieval segment matches the user's query intent and preventing the retrieval segment from deviating from the core topic after being maliciously tampered with.

[0107] Among them, the first cosine similarity refers to the cosine similarity value between the retrieval segment vector and the semantic center vector, with a value range of [-1, 1]. The closer the value is to 1, the higher the semantic similarity between the retrieval segment and the semantic center, and the more normal the retrieval segment is. The closer the value is to -1, the greater the semantic deviation between the retrieval segment and the semantic center, and the more likely it is an abnormal retrieval segment. It can quantify the fit between the retrieval segment and the standard semantics, and provide quantitative support for the semantic center document similarity items.

[0108] Among them, the hub vector alignment loss refers to the loss term in the target retrieval function used to maximize the similarity between the retrieval segment vector and the hub vector. Its core function is to guide the retrieval segment to align with the hub document vector, ensuring that the semantics of the retrieval segment is consistent with the core document in the knowledge base, and avoiding the retrieval segment from deviating from the core standard. A weight can be set for it, which can be 0.4, to balance with the semantic center alignment loss and the competing document separation loss, ensuring the targeting of anomaly detection.

[0109] Among them, the hub vector refers to the vector representation obtained by encoding the hub document through a preset embedding model. It is a quantitative representation of the semantic features of the hub document and can serve as a benchmark for core alignment of the retrieval segment, ensuring that the semantics of the retrieval segment are consistent with the core content in the knowledge base and preventing the retrieval segment from deviating from the core standard after being maliciously tampered with.

[0110] The second cosine similarity refers to the cosine similarity value between the retrieval segment vector and the hub vector, with a value range of [-1, 1]. The closer the value is to 1, the higher the semantic similarity between the retrieval segment and the hub document, and the more normal the retrieval segment is. The closer the value is to -1, the greater the semantic deviation between the retrieval segment and the hub document, and the more likely it is to be an abnormal retrieval segment. It can quantify the fit between the retrieval segment and the core document, and provide quantitative support for the similarity items of the hub document.

[0111] Among them, the competitive document separation loss refers to the loss term in the target retrieval function used to minimize the similarity between the retrieval segment vector and the competitive document vector. Its core function is to guide the separation of the retrieval segment and the competitive document vector, avoiding the retrieval segment from excessively fitting the competitive document and deviating from the core semantics. At the same time, it can also identify abnormal retrieval segments that have been maliciously tampered with and deliberately fitted to a certain competitive document. A weight can be set for it, and its weight can be preset to 0.3 to balance the optimization direction of the overall loss function.

[0112] Among them, the competitive document vector refers to the vector representation obtained by encoding each competitive document in the competitive document set through a preset embedding model. It is a quantitative representation of the semantic features of the competitive documents and can serve as a benchmark for distinguishing the differences between search segments, helping to determine whether there is any abnormal bias in the search segment.

[0113] Among them, the third cosine similarity refers to the cosine similarity value between the retrieval segment vector and each competing document vector, with a value range of [-1, 1]. The closer the value is to -1, the greater the semantic difference between the retrieval segment and the competing document, and the more normal the retrieval segment is; the closer the value is to 1, the higher the semantic similarity between the retrieval segment and the competing document, and the more likely it is to be an abnormal retrieval segment. It can quantify the difference between the retrieval segment and the competing document, and provide quantitative support for the similarity items of competing documents.

[0114] In this embodiment, the specific operation process is as follows: First, a preset embedding model is invoked to encode the semantic center document, hub document, and each competing document, respectively, to obtain the corresponding semantic center vector, hub vector, and competing document vector; simultaneously, each target retrieval segment is encoded to obtain a retrieval segment vector; then, based on the semantic center alignment loss, the first cosine similarity between the retrieval segment vector and the semantic center vector is calculated, and this similarity is determined as the semantic center document similarity item, used to measure the degree of fit between the retrieval segment and the user's overall query intent; based on the hub vector alignment loss, the second cosine similarity between the retrieval segment vector and the hub vector is calculated, and this similarity is determined as the hub document similarity item, used to measure the degree of fit between the retrieval segment and the core documents of the knowledge base; based on the competing document separation loss, the third cosine similarity between the retrieval segment vector and each competing document vector is calculated, and the average value is taken as the competing document similarity item, used to measure the degree of difference between the retrieval segment and the competing documents; finally, these three types of similarity items are integrated to construct a complete target retrieval function, providing core support for the subsequent calculation of the anomaly index. For example, a normal search segment indicates a 10kV distribution network grounding fault requiring power outage and testing. Its first cosine similarity to the semantic center vector is 0.92, its second cosine similarity to the hub vector is 0.88, and its average third cosine similarity to competing document vectors is 0.25. All three types of similarity meet the normal standard. An abnormal search segment, however, indicates a 10kV distribution network grounding fault that can be directly detected. Its first cosine similarity is 0.15, its second cosine similarity is 0.12, and its average third cosine similarity is 0.86, significantly deviating from the normal standard and thus classified as abnormal.

[0115] This approach transforms the construction of three types of similar items into quantifiable vector similarity calculations, enabling the target retrieval function to possess triple detection capabilities: alignment with the semantic center, alignment with the hub document, and separation from competing documents. This allows for comprehensive and accurate identification of abnormal retrieval segments from multiple dimensions. Specifically, the first cosine similarity ensures that the retrieval segment aligns with the user's query intent, avoiding deviation from the core topic; the second cosine similarity ensures that the retrieval segment aligns with the core documents of the knowledge base, avoiding deviation from industry standards; and the third cosine similarity ensures that the retrieval segment does not abnormally favor competing documents, preventing malicious modification that could mislead search results. Furthermore, by setting the weights of the loss terms, the influence of the three detection dimensions is balanced, ensuring that anomaly detection is both comprehensive and targeted. This effectively identifies various types of abnormal retrieval segments, including those maliciously modified, semantically deviated, and abnormally biased, improving the accuracy and robustness of anomaly detection on the retrieval side. Furthermore, this quantitative construction method transforms anomaly detection from subjective judgment to objective calculation, ensuring that the detection process is reproducible and scalable, avoiding errors caused by human intervention, and providing a reliable quantitative basis for subsequent anomaly index calculation and anomaly retrieval segment screening. This solves the technical problems of difficult quantitative identification of retrieval segment anomalies, low detection accuracy, and high false negative and false positive rates in related technologies.

[0116] Based on the above embodiments and optional embodiments, an optional implementation method is provided, which is described in detail below.

[0117] In related technologies, security research on existing RAG systems mainly focuses on traditional vector retrieval systems. Trigger-based backdoor attacks protect the generated output by embedding specific trigger words or phrases in documents, activating malicious content when a user query contains these triggers. This method relies on a pre-set trigger mechanism to detect backdoors during the training or update phase, but its limitation lies in the strong assumptions about queries: the defense system needs to know the potential query distribution in advance, otherwise the trigger rate is low and easily detected.

[0118] Gradient and feedback-driven attacks exploit white-box access to proxy models, iteratively optimizing the embedding vectors of anomalous documents through gradient descent or black-box feedback to prioritize their appearance in retrieval. While these methods can effectively improve retrieval success rates, they require the defense system to access internal components such as the embedding model or retrieval engine, which is impractical in commercial RAG systems. Furthermore, these attacks often optimize only for a single query, ignoring generalizability unrelated to specific queries.

[0119] Heuristic content manipulation attacks employ rules-based approaches, such as keyword repetition or semantic similarity adjustments, to manually improve a document's search relevance. This method requires no model access and is suitable for some black-box scenarios, but the optimization process relies on human experience, making it inefficient and difficult to quantify. Furthermore, it ignores the high-density region preference and hub node characteristics of HNSW, making it difficult to pinpoint high-traffic paths for anomalous documents, resulting in a significant decrease in defense effectiveness across large-scale knowledge bases.

[0120] These defense techniques do not fully consider the special properties of graph index structures such as HNSW. Therefore, there is an urgent need for a defense method specifically designed for HNSW index structures to protect such RAG systems from security threats, provide reliable security protection for RAG systems, and promote the development of defense technologies.

[0121] In view of this, an optional embodiment of the present invention provides an anomaly detection and defense method for RAG systems with HNSW index structures. This method addresses the problems of existing defense methods, such as difficulty in successfully retrieving vector libraries using graph index structures, low defense success rates, and poor adaptability to actual deployment. It better reveals the security vulnerabilities faced by RAG systems using HNSW index structures. The method is described below:

[0122] S1. Query Expansion and Semantic Center Refinement: This involves refining the initial target query... Multiple semantically related queries are obtained through search engine APIs or knowledge community platforms to construct an extended query cluster. The semantic center vector is obtained by calculating the mean value of the extended query cluster vectors. .

[0123] S2. Identification of Locally High-Traffic Hub Nodes: A RAG simulation system is constructed using a proxy embedding model E, a knowledge base D, and a vector database R. Retrieval is performed on each question in the extended query cluster, and abnormal patterns in Top-k documents are monitored. By jointly calculating ranking scores and degree centrality scores, locally high-traffic hub nodes located in semantically high-density areas are identified as key protection targets. .

[0124] S3. Initial Exception Document Generation: Based on Hub Node Based on the system's expected correct answer benchmark, prompt words are used to guide the construction of anomaly document feature models using public LLM. .

[0125] S4. Two-stage anomaly feature extraction: The document is divided into a retrieval segment and a generation segment. The retrieval segment adopts an improved HotFlip gradient-guided token replacement algorithm, with semantic center anomaly alignment detection, hub vector anomaly alignment detection, and competing document anomaly separation detection as joint defense targets. Anomaly features are learned in the retrieval segment to establish a defense feature library. The generation segment adopts an iterative rewriting strategy based on scoring feedback. The poisoning effect is comprehensively evaluated based on substring matching and semantic similarity calculation. Anomaly document features are tested on multiple proxy models to establish a multi-layer defense detection mechanism.

[0126] S5. Defense Effectiveness Evaluation: Design a defense effectiveness evaluation mechanism to quantify the effectiveness and generalization ability of the method. Specifically, perform a retrieval on queries in the extended query cluster, and calculate the defense success rate (RSR) as the proportion of abnormal documents successfully intercepted by the system in the top-k results; check whether the system has successfully defended against the influence of abnormal documents and maintained the correctness of the generated answers, and calculate the generation success rate (GSR); calculate the product of RSR and GSR as the end-to-end success rate (ASR); stop when the defense success rate RSR ≥ 90%, the generation protection rate GSR ≥ 80%, or the training count reaches the upper limit, and output a complete abnormal document feature library and defense model. .

[0127] Furthermore, S1 proposes a semantic center condensation mechanism based on the mean of query cluster vectors, targeting the initial target query. (Similar to the initial query text mentioned above), 50 extended queries were obtained through the following channels to form an extended query cluster. (Similar to the above extended query text):

[0128] Obtain relevant queries through search engines such as Google, Bing, and Baidu, or through web search APIs;

[0129] We crawled relevant question titles from knowledge communities and Q&A platforms such as Quora, Reddit, Zhihu, and Baidu Knows.

[0130] Extended queries encompass various query intents, including precise expressions, everyday expressions, extended topics, comparative queries, and application scenarios. They can capture the overall semantic distribution of query clusters and represent typical user query intents within that topic. The semantic center vector is calculated based on the extended query clusters using the following method (similar to the above, calculating the mean vector based on the initial query text and multiple extended query texts to determine the semantic center vector; then determining the semantic center document corresponding to the semantic center vector):

[0131]

[0132] in, To expand the number of queries in a query cluster, For query The vector representation of .

[0133] Preferably, the proxy model in S2 is configured as follows:

[0134] Proxy embedding model E: Select BGE-M3, Qwen-Embedding, or other open source embedding models;

[0135] Proxy knowledge base K: Constructs corresponding datasets from domestic and international open knowledge platforms such as Wikipedia, Reddit, and Baidu Encyclopedia.

[0136] Proxy vector database D: Select a vector database using HNSW index structure such as FAISS or Elasticsearch, with index parameter M=32 and efConstruction=200.

[0137] Furthermore, one of the core innovations of this invention is the proposed method for identifying local high-traffic hub nodes based on joint scores in S2. This invention focuses on local high-traffic nodes, performing a top-k search (k=10 in this invention) on the proxy knowledge base for each query in the extended query cluster, obtaining 50 sets of document search results. Based on the search results, a hub score is calculated for each document.

[0138] The document score is calculated in the same way as the text ranking score mentioned above:

[0139]

[0140] Among them, ranking score The inverse ranking weighting method is used to reflect the ranking quality of documents under different queries:

[0141]

[0142] Degree centrality score This reflects how many different queries a document is retrieved in, demonstrating the breadth of semantic coverage (similar to the degree centrality score above):

[0143]

[0144] in, To retrieve the query set for document d, For document In the query The ranking position within. Parameters , is the weighting coefficient between the ranking score and the degree centrality score, where The calculation results are sorted in descending order, and the top-1 document with the highest score is selected as the hub node. Simultaneously, it records the document vector sets ranked 2nd to 10th by score. For subsequent optimization.

[0145] Preferably, a prompting engineering-guided large model is used to assist in the generation of the initial exception document. The LLM rewriting prompt word template in S3 is as follows:

[0146] You are a document rewriting expert. Please rewrite the following source document:

[0147] [Source Document]

[0148] {d_hub content}

[0149] [Rewriting Requirements]

[0150] 1. Replace the factual statements about "{subject}" in the document with the following:

[0151] "{f'_target}"

[0152] 2. Maintain the original document's writing style, tone, and paragraph structure.

[0153] 3. Ensure the replaced content blends seamlessly into the context and maintains logical coherence.

[0154] 4. Avoid adding obvious seams.

[0155] 5. Maintain the professionalism and credibility of the documents.

[0156] Output

[0157] Please output the complete rewritten document directly, without adding any explanations.

[0158] Furthermore, in S4 of the present invention, an abnormal feature extraction strategy that separates the retrieval segment and the generation segment is adopted, and optimizations are performed for the retrieval protection and generation protection targets respectively.

[0159] Preferably, the retrieval segment optimization employs an improved HotFlip gradient-guided token replacement method, performing white-box optimization on the proxy embedding model. The semantic center alignment loss is defined to maximize the cosine similarity between the retrieval segment vector and the semantic center vector, ensuring that anomalous documents can respond to diverse query expressions. The hub vector alignment loss maximizes the cosine similarity between the retrieval segment vector and the hub vector, ensuring that anomalous documents are close to hub nodes in the HNSW graph and are accessed with high probability due to retrieval path dependencies. The competing document separation loss minimizes the cosine similarity between the retrieval segment vector and the competing document vector, ensuring that anomalous documents outperform other candidate documents in the similarity ranking. Competing documents are the set of documents recorded in S2. Optimize by removing abnormal documents from the set. Define the objective function for optimizing the search segment as (same as the objective retrieval function corresponding to the search segment mentioned above):

[0160]

[0161] Where parameters sim(·,·) represents cosine similarity. This represents the adversarial optimization objective function for the retrieval segment used to guide token replacement and feature learning. This indicates that the current search segment is processed through a proxy model. The encoded vector representation, This represents the semantic center vector condensed from the query clusters of the expanded query. Represents the hub document vector. This represents the vector representation of the competing document set. Represents a collection of competing documents Competing documents within the search. The specific optimization steps for the search segment are as follows:

[0162] S4.1 Initialize the detection model, extract the retrieval segment of the document to be detected as a fixed-length token sequence, and calculate the loss function with respect to the embedding vector of each token in the current retrieval segment and the joint gradient;

[0163] S4.2 For each token position i∈[1,m], sort according to gradient score and filter the top-m positions;

[0164] S4.3 Calculate the score of all candidate token replacements and select the top-k optimal replacements.

[0165] S4.4 records the identified replacement patterns and updates the defense feature library, iterating until the defense feature library is perfected.

[0166] Furthermore, the generation segment optimization employs an iterative rewriting strategy based on scoring feedback, performing black-box optimization on the proxy LLM. A generation optimization objective is defined, maximizing the comprehensive score for generating the expected correct answer across multiple proxy LLMs. The generation segment optimization objective in S4 is (same as the objective generation function corresponding to the generation segment mentioned above):

[0167]

[0168] Where Score(·) is defined as:

[0169]

[0170] in These are the weighting coefficients. The `Contain(·)` function checks whether the generated answer contains the key content of the target answer, while the `Sim(·)` function evaluates the semantic similarity between the generated answer and the target answer. This indicates a pre-determined target answer for the current query. This represents the answer text generated by the proxy LLM given the RAG context. This represents the average output deviation target based on the extended query cluster and the multi-agent LLM. This indicates that the m-th agent LLM generates the answer based on query q and the context. This indicates the search segment for abnormal documents. This indicates the section where the abnormal document was generated. The specific steps are as follows:

[0171] S4.5 constructs RAG hints, concatenating the retrieved and generated segments as context, and inputting M proxy LLMs;

[0172] S4.6 For each query in the extended query cluster, calculate the output bias score (·) of the proxy LLM under the interference of anomalous documents;

[0173] S4.7 Identify defensive weaknesses based on deviation score feedback and update defense strategy parameters.

[0174] S4.8 iterates through S4.5-S4.7 until the defense system can reliably identify abnormal documents or reaches the maximum number of training iterations.

[0175] Preferably, step S5 of this invention includes a defense effectiveness evaluation mechanism to quantify the effectiveness and generalization ability of the method. Specifically, for queries in the extended query cluster, a retrieval is performed, and the proportion of abnormal documents successfully intercepted by the system in the top-k results is used as the defense success rate (RSR), i.e., RSR = (number of queries that retrieved abnormal documents / total number of queries) × 100%; for queries that retrieved abnormal documents, a RAG prompt input proxy LLM is constructed to check whether the system has successfully defended against the influence of abnormal documents and maintained the correctness of the generated answer, and the generation success rate (GSR) is calculated, i.e., GSR = (number of queries that output the expected correct answer / number of queries that retrieved abnormal documents) × 100%; the product of RSR and GSR is calculated as the end-to-end detection success rate (ASR), i.e., ASR = RSR × GSR; when the defense success rate RSR ≥ 90%, the generation protection rate GSR ≥ 80%, or the training times reach the upper limit, the process stops, and a complete abnormal document feature library and defense model are output. .

[0176] Specifically, an embodiment of an anomaly detection defense method for a retrieval enhancement generation (RAG) system oriented towards a hierarchical navigable small-world (HNSW) index structure is provided.

[0177] Defense system initialization and proxy model configuration include data preprocessing (such as document chunking and embedding caching) and multi-model compatibility. HNSW parameter extension explanation: M=32 ensures balanced layer connectivity, efConstruction=200 improves construction accuracy, and the expected correct answer is expanded to include supporting pseudo-facts (such as "based on the latest research") to improve detection accuracy.

[0178] Specific implementation methods are as follows:

[0179] def load_and_chunk_docs(source, num_docs):

[0180] # Defense System: Actual data loading, expanded into blocks of 512 tokens each.

[0181] raw_docs = [{'id': i, 'content': f"Nutrition doc {i} long text"} fori in range(num_docs)]

[0182] chunked = []

[0183] for doc in raw_docs:

[0184] chunks = [doc['content'][j:j+512] for j in range(0, len(doc['content']), 512)] # Defensive chunking

[0185] chunked.extend([{'id': doc['id'], 'chunk': chunk} for chunk inchunks])

[0186] return chunked

[0187] Figure 2 The overall flowchart provided for an optional embodiment of the present invention illustrates the complete defense process from initial query to final defense strategy generation. Figure 2 As shown, the overall process of this invention includes steps such as query expansion, hub node identification, initial abnormal document generation, two-stage abnormal feature extraction, and defense effect evaluation, ensuring the systematicness and efficiency of the defense method.

[0188] S1 proposes a semantic center condensation mechanism based on the mean of query cluster vectors, which is used for the initial target query. The extended query cluster consists of 50 results obtained through the following channels. :

[0189] Obtain relevant queries through search engines such as Google, Bing, and Baidu, or through web search APIs;

[0190] We crawled relevant question titles from knowledge communities and Q&A platforms such as Quora, Reddit, Zhihu, and Baidu Knows.

[0191] Extended queries encompass various query intents, including precise expressions, everyday expressions, extended topics, comparative queries, and application scenarios. They can capture the overall semantic distribution of query clusters and represent typical user query intents within that topic. The semantic center vector is calculated based on the extended query clusters using the following method:

[0192]

[0193] in, To expand the number of queries in a query cluster, For query The vector representation of . The specific implementation is as follows:

[0194] import requests # Simulate API extension

[0195] def expand_queries(q0, num_queries=50):

[0196] # Expanding channels: Asynchronous API calls

[0197] sources = ['Google', 'Baidu', 'Zhihu', 'Quora']

[0198] expanded = [q0]

[0199] for source in sources:

[0200] # Pseudo API: Actually using requests.get('api_url?q='+q0)

[0201] related = [f"related query {i} for {source}" for i in range(10)] # Defense acquisition

[0202] # Defensive Semantic Filtering

[0203] related_emb = embed_model.encode(related)

[0204] q0_emb = embed_model.encode([q0])

[0205] sims = np.dot(related_emb, q0_emb.T).flatten()

[0206] filtered = [related[i] for i in range(len(related)) if sims[i] > 0.7]

[0207] expanded.extend(filtered)

[0208] return expanded[:num_queries] # Dynamically adjust size

[0209] Q_expanded = expand_queries(q0, 50) # Example: ["How much protein is contained in 100 grams of eggs", ...]

[0210] # Calculate semantic center (extended weighted average)

[0211] query_embeddings = embed_model.encode(Q_expanded)

[0212] weights = np.ones(len(Q_expanded)) # Simulated frequency weights

[0213] semantic_center = np.average(query_embeddings, axis=0, weights=weights)

[0214] Preferably, the proxy model in S2 is configured as follows:

[0215] Proxy embedding model E: Select BGE-M3, Qwen-Embedding, or other open source embedding models;

[0216] Proxy knowledge base K: Constructs corresponding datasets from domestic and international open knowledge platforms such as Wikipedia, Reddit, and Baidu Encyclopedia.

[0217] Proxy vector database D: Select a vector database using HNSW index structure such as FAISS or Elasticsearch, with index parameter M=32 and efConstruction=200.

[0218] Furthermore, one of the core innovations of this invention is the proposed method for identifying local high-flow hub nodes based on joint scores in S2. Figure 3 The schematic diagram of a local high-traffic hub node based on the HNSW index structure, provided as an optional embodiment of the present invention, illustrates the process by which multiple queries converge along the retrieval path to the same high-frequency document node in the HNSW graph structure. For example... Figure 3 As shown, in the HNSW index structure, the retrieval paths of multiple queries converge to a local high-traffic hub node. This identification method ensures the accurate location of the hub node through joint score calculation. Figure 4 The flowchart of a local high-traffic hub node identification method provided as an optional embodiment of the present invention illustrates the hub node document selection process and the retention of competing documents for defense verification. Figure 4 The process described herein focuses on local high-traffic nodes. For each query in the extended query cluster, a top-k search is performed on the proxy knowledge base (k=10 in this invention), yielding 50 sets of document search results. Based on the search results, a hub score is calculated for each document. The document score is calculated as follows:

[0219]

[0220] Among them, ranking score The inverse ranking weighting method is used to reflect the ranking quality of documents under different queries:

[0221]

[0222] Degree centrality score This reflects how many different queries a document is retrieved in, demonstrating the breadth of semantic coverage.

[0223]

[0224] in To retrieve the query set for document d, For document In the query The ranking position within. Parameters The calculation results are sorted in descending order, and the top-1 document with the highest score is selected as the hub node. Simultaneously, it records the document vector sets ranked 2nd to 10th by score. This is for subsequent optimization. The specific implementation method is as follows:

[0225] # Batch retrieval (parallel defense)

[0226] query_embs = embed_model.encode(Q_expanded) # torch.tensor forparallel

[0227] distances, indices = index.search(query_embs, k=10) # Batch top-10

[0228] retrieved_docs = [[knowledge_base[idx] for idx in ind if idx >= 0]for ind in indices]

[0229] def compute_hub_score(retrieved_docs, alpha=0.6, beta=0.4):

[0230] doc_freq = {}

[0231] doc_ranks = {}

[0232] for i, docs in enumerate(retrieved_docs):

[0233] for rank, doc in enumerate(docs):

[0234] doc_id = doc['id']

[0235] doc_freq[doc_id] = doc_freq.get(doc_id, 0) + 1

[0236] doc_ranks[doc_id] = doc_ranks.get(doc_id, []) + [1 / (rank + 1)]

[0237] scores = {}

[0238] for doc_id in doc_freq:

[0239] S_rank = np.mean(doc_ranks.get(doc_id, [0]))

[0240] S_degree = doc_freq[doc_id] / len(Q_expanded)

[0241] S_hub = alpha S_rank + beta S_degree

[0242] scores[doc_id] = S_hub

[0243] sorted_scores = sorted(scores.items(), key=lambda x: x[1], reverse=True)

[0244] # Defense post - processing filtering

[0245] hub_emb = embed_model.encode([knowledge_base[sorted_scores[0][0]]['chunk']])[0]

[0246] filtered = [score for score in sorted_scores if np.dot(embed_model.encode([knowledge_base[score[0]]['chunk']])[0], hub_emb) > 0.8]

[0247] return filtered

[0248] hub_scores = compute_hub_score(retrieved_docs)

[0249] hub_node = knowledge_base[hub_scores[0][0]] # Top-1

[0250] comp_docs = [knowledge_base[score[0]] for score in hub_scores[1:10]]

[0251] `comp_embeddings = np.mean(embed_model.encode([doc['chunk'] for doc incomp_docs]), axis=0)` # Defensive mean representation

[0252] hub_embedding = embed_model.encode([hub_node['chunk']])[0]

[0253] Preferably, a prompting engineering-guided large model is used to assist in the generation of the initial abnormal document. The defense system provides the expected correct answer and uses the hub document d_hub as a semantic and stylistic reference. The generated document maintains consistency with the hub document in terms of text structure, tone, and topic relevance. The abnormal document feature model d_adv^((0)) is constructed by guiding the public LLM through prompt words. The LLM rewrites the prompt word template in S3 as follows:

[0254] You are a document rewriting expert. Please rewrite the following source document:

[0255] [Source Document]

[0256] {d_hub content}

[0257] [Rewriting Requirements]

[0258] 1. Replace the factual statements about "{subject}" in the document with the following:

[0259] "{f'_target}"

[0260] 2. Maintain the original document's writing style, tone, and paragraph structure.

[0261] 3. Ensure the replaced content blends seamlessly into the context and maintains logical coherence.

[0262] 4. Avoid adding obvious seams.

[0263] 5. Maintain the professionalism and credibility of the documents.

[0264] Output

[0265] Please output the complete rewritten document directly, without adding any explanations.

[0266] Furthermore, in S4 of this invention, an anomaly feature extraction strategy that separates the retrieval segment and the generation segment is adopted, and optimizations are performed for the retrieval protection and generation protection targets respectively. Figure 5 This is a schematic diagram of a two-stage abnormal document feature extraction structure provided as an optional embodiment of the present invention, illustrating the verification process of the retrieval segment and the generation segment. For example... Figure 5 As shown.

[0267] Preferably, the retrieval segment optimization employs an improved HotFlip gradient-guided token replacement method, performing white-box optimization on the proxy embedding model. The semantic center alignment loss is defined as maximizing the cosine similarity between the retrieval segment vector and the semantic center vector, ensuring that anomalous documents can respond to diverse query expressions. The hub vector alignment loss maximizes the cosine similarity between the retrieval segment vector and the hub vector, ensuring that anomalous documents are close to hub nodes in the HNSW graph and are accessed with high probability due to retrieval path dependencies. The competing document separation loss minimizes the cosine similarity between the retrieval segment vector and the competing document vector, ensuring that anomalous documents outperform other candidate documents in similarity ranking. Competing documents are the document set D_comp recorded in S2; during optimization, anomalous documents are moved away from this set. The objective function for retrieval segment optimization is defined as:

[0268]

[0269] Where parameters sim(·,·) represents cosine similarity. The specific optimization steps for the retrieval segment are as follows:

[0270] S4.1 Initialize the detection model, extract the retrieval segment of the document to be detected as a fixed-length token sequence, and calculate the loss function with respect to the embedding vector of each token in the current retrieval segment and the joint gradient;

[0271] S4.2 For each token position i∈[1,m], sort according to gradient score and select the top-m positions;

[0272] S4.3 Calculate the score of all candidate token replacements and select the top-k optimal replacements.

[0273] S4.4 records the identified replacement patterns and updates the defense feature library, iterating until the defense feature library is perfected.

[0274] # Retrieval segment optimization (extended HotFlip)

[0275] def hotflip_optimize(retrieval_part, semantic_center, hub_embedding,comp_embeddings, lambda1=0.4, lambda2=0.4, lambda3=0.2, max_iter=20):

[0276] tokens = tokenizer(retrieval_part, return_tensors="pt")['input_ids'][0][:512] # Fixed m=512

[0277] for iter in range(max_iter):

[0278] # S4.1 Calculate embeddings and joint gradients

[0279] `emb = embed_model.encode(tokenizer.decode(tokens))` # Assuming `embed_model` supports gradients.

[0280] with torch.enable_grad():

[0281] v = torch.tensor(emb, requires_grad=True)

[0282] loss = -lambda1 torch.cosine_similarity(v, torch.tensor(semantic_center)) \

[0283] -lambda2 torch.cosine_similarity(v, torch.tensor(hub_embedding)) \

[0284] +lambda3 torch.mean(torch.cosine_similarity(v.unsqueeze(0),torch.tensor(comp_embeddings)))

[0285] loss.backward()

[0286] grad = v.grad

[0287] grad = torch.clamp(grad, -1.0, 1.0) # Defend against gradient clipping

[0288] # S4.2 Filter the top-m positions

[0289] grad_scores = torch.norm(grad, dim=-1)

[0290] top_m_pos = torch.topk(grad_scores, 20).indices

[0291] # S4.3 Calculate candidate replacements (simplified: random top-k)

[0292] candidates = torch.randint(0, tokenizer.vocab_size, (len(top_m_pos),50)) # top-k=50

[0293] # S4.4 Perform the best replacement and evaluate

[0294] best_loss = float('inf')

[0295] for pos, cands in zip(top_m_pos, candidates):

[0296] for cand in cands:

[0297] new_tokens = tokens.clone()

[0298] new_tokens[pos] = cand

[0299] new_emb = embed_model.encode(tokenizer.decode(new_tokens))

[0300] new_loss = -lambda1 np.dot(new_emb, semantic_center) / (np.linalg.norm(new_emb) np.linalg.norm(semantic_center) - ... # Similar calculations

[0301] if new_loss < best_loss:

[0302] best_loss = new_loss

[0303] tokens = new_tokens

[0304] if abs(best_loss - prev_loss) < 0.01: # Convergence threshold

[0305] break

[0306] prev_loss = best_loss

[0307] return tokenizer.decode(tokens)

[0308] detected_retrieval = hotflip_optimize(retrieval_part, semantic_center, hub_embedding, comp_embeddings)

[0309] Furthermore, the generation segment optimization employs an iterative rewriting strategy based on scoring feedback, performing black-box optimization on the proxy LLM. A generation optimization objective is defined, maximizing the comprehensive score for generating the expected correct answer across multiple proxy LLMs. The generation segment optimization objective in S4 is:

[0310]

[0311] Where Score(·) is defined as:

[0312]

[0313] in The `Contain(·)` function checks whether the generated answer contains the key content of the target answer, and the `Sim(·)` function evaluates the semantic similarity between the generated answer and the target answer. The specific steps are as follows:

[0314] S4.5 constructs RAG hints, concatenating the retrieved and generated segments as context, and inputting M proxy LLMs;

[0315] S4.6 For each query in the extended query cluster, calculate the output bias score (·) of the proxy LLM under the interference of anomalous documents;

[0316] S4.7 Identify defensive weaknesses based on deviation score feedback and update defense strategy parameters.

[0317] S4.8 iterates through S4.5-S4.7 until the defense system can reliably identify abnormal documents or reaches the maximum number of training iterations.

[0318] # Generation segment anomaly detection (defense score feedback)

[0319] def score_generation(generated, A_target, alpha=0.5, beta=0.5):

[0320] # Contain: Substring matching

[0321] contain = 1 if A_target in generated else 0

[0322] # Sim: Semantic similarity

[0323] emb_g = embed_model.encode([generated])

[0324] emb_t = embed_model.encode([A_target])

[0325] sim = np.dot(emb_g, emb_t.T).flatten()[0]

[0326] return alpha contain + beta sim

[0327] def iterative_rewrite(generation_part, detected_retrieval, Q_expanded, A_target, M=3, thresh=0.85, max_iter=15):

[0328] for iter in range(max_iter):

[0329] scores = []

[0330] for q in Q_expanded:

[0331] # S4.5 Constructing RAG hints

[0332] context = detected_retrieval + generation_part

[0333] prompt = f"Based on context: {context}, answer: {q}"

[0334] gens = []

[0335] for _ in range(M): # Multi-agent LLM

[0336] outputs=llm_model.generate(tokenizer(prompt, return_tensors="pt")['input_ids'], max_length=200)

[0337] gens.append(tokenizer.decode(outputs[0]))

[0338] # S4.6 Calculate the average score

[0339] query_scores = [score_generation(gen, A_target) for gen in gens]

[0340] scores.append(np.mean(query_scores))

[0341] avg_score = np.mean(scores)

[0342] if avg_score > thresh:

[0343] break

[0344] # S4.7 Rewritten (Based on Feedback)

[0345] feedback = f"Current score {avg_score}, weakness: low similarity, rewrite to improve inclusion of {A_target}"

[0346] rewrite_prompt = f"Based on feedback: {feedback}, rewrite the generation part: {generation_part}"

[0347] outputs = llm_model.generate(tokenizer(rewrite_prompt, return_tensors="pt")['input_ids'], max_length=400)

[0348] generation_part = tokenizer.decode(outputs[0])

[0349] return generation_part

[0350] defense_trained_generation = iterative_rewrite(generation_part,detected_retrieval, Q_expanded, A_target)

[0351] Preferably, step S5 of this invention designs a defense effectiveness evaluation mechanism to quantify the effectiveness, generalization ability, and stealth of the method. Specifically, for queries in the extended query cluster, a retrieval is performed, and the proportion of abnormal documents successfully intercepted by the system in the top-k results is used as the defense success rate (RSR), i.e., RSR = (number of queries that retrieved abnormal documents / total number of queries) × 100%; for queries that retrieved abnormal documents, a RAG prompt input proxy LLM is constructed to check whether the system has successfully defended against the influence of abnormal documents, maintaining the correctness of the generated answer, and the generation success rate (GSR) is calculated, i.e., GSR = (number of queries that output the expected correct answer / number of queries that retrieved abnormal documents) × 100%; the product of RSR and GSR is calculated as the end-to-end success rate (ASR), i.e., ASR = RSR × GSR; the process stops when RSR ≥ 90%, RSR ≥ 80%, or the upper limit of the number of iterations, and a complete abnormal document feature library and defense model are output. .

[0352] def evaluate_attack(suspicious_doc, Q_expanded, index, knowledge_base, llm_model, tokenizer, A_target, k=10, rsr_thresh=0.9, gsr_thresh=0.8):

[0353] # Add test exception documentation to the index (for verifying defense capabilities)

[0354] suspicious_emb = embed_model.encode([suspicious_doc])

[0355] defense_test_index = index # Copy or add

[0356] defense_test_index.add(suspicious_emb)

[0357] rsr_count = 0

[0358] gsr_count = 0

[0359] for q in Q_expanded:

[0360] q_emb = embed_model.encode([q])

[0361] _, inds = temp_index.search(q_emb, k)

[0362] if len(knowledge_base) in inds[0]: # Assume the abnormal document ID is len(kb)

[0363] rsr_count += 1

[0364] # Check generation

[0365] context = suspicious_doc

[0366] prompt = f"Based on context: {context}, answer: {q}"

[0367] output = llm_model.generate(tokenizer(prompt, return_tensors="pt")['input_ids'], max_length=200)

[0368] gen = tokenizer.decode(output[0])

[0369] if A_target in gen: # Check the defense effectiveness

[0370] gsr_count += 1

[0371] rsr = rsr_count / len(Q_expanded)

[0372] gsr = gsr_count / rsr_count if rsr_count > 0 else 0

[0373] asr = rsr gsr

[0374] # Defense accuracy: Similarity to the hub

[0375] hub_sim = np.dot(poison_emb[0], hub_embedding) / (np.linalg.norm(poison_emb[0]) np.linalg.norm(hub_embedding))

[0376] if hub_sim < 0.9:

[0377] print("Insufficient detection accuracy, continue training")

[0378] return rsr, gsr, asr

[0379] The above optional implementation methods can achieve at least the following beneficial effects:

[0380] (1) Accurate anomaly semantic recognition capability: Through query expansion and semantic center condensation mechanism, this invention can accurately identify the query semantic center in the vector space that may be used by abnormal documents, and cope with the diversity of query expression. Compared with single query detection, the defense coverage capability is significantly improved.

[0381] (2) Efficient identification of key protection nodes: By combining the ranking score and degree centrality score, this invention can accurately locate the local high-traffic hub nodes in the HNSW index that need to be protected, and achieve precise protection of the retrieval path. Compared with the global protection strategy, the protection efficiency of key nodes is significantly improved.

[0382] (3) Dual-layer defense collaborative mechanism: Through the segmented abnormal feature extraction mechanism, the present invention simultaneously achieves retrieval protection and generation protection, and the defense success rate reaches more than 85% on multiple datasets, which is significantly higher than the existing single-layer defense method.

[0383] (4) Strong adaptability to actual deployment: By training on the proxy model and utilizing semantic density invariance to achieve defense migration, the present invention remains effective under black-box settings, providing a reliable real-time protection tool for actual RAG systems.

[0384] (5) Practical value of security protection: This invention systematically reveals for the first time the security vulnerability of the HNSW index structure when facing suspicious document detection, provides a complete security protection solution for the RAG system, and promotes the secure application of search enhancement generation technology.

[0385] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0386] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0387] Example 2

[0388] According to embodiments of the present invention, an apparatus for implementing the above-described method for determining text query results is also provided. Figure 6 This is a structural block diagram of a text query result determination device according to an embodiment of the present invention, such as... Figure 6 As shown, the device includes: a receiving module 602, a first determining module 604, a second determining module 606, a retrieving module 608, a third determining module 610, a screening module 612, and a fourth determining module 614. The device will be described in detail below.

[0389] A receiving module 602 is used to receive a query request, wherein the query request carries an initial query text; a first determining module 604, connected to the receiving module 602, is used to determine multiple candidate documents based on the initial query text in response to the query request; a second determining module 606, connected to the first determining module 604, is used to determine the target retrieval segment and the target generation segment corresponding to the multiple candidate documents respectively; a retrieval module 608, connected to the second determining module 606, is used to retrieve the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment, wherein the target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items, and the target generation function maximizes generation on multiple proxy models. The target score of the expected benchmark answer is the target; the third determining module 610, connected to the above-mentioned retrieval module 608, is used to determine the abnormal index corresponding to multiple target retrieval segments according to the target retrieval function, and to determine the target score corresponding to multiple target generation segments according to the target generation function; the filtering module 612, connected to the above-mentioned third determining module 610, is used to filter out abnormal retrieval segments whose corresponding abnormal index exceeds the abnormal threshold from multiple candidate documents, retain the candidate documents corresponding to normal retrieval segments, and filter out abnormal generation segments whose corresponding target scores do not reach the threshold, retain the candidate documents corresponding to normal generation segments, and obtain the target document; the fourth determining module 614, connected to the above-mentioned filtering module 612, is used to determine the target query result based on the target document.

[0390] It should be noted that the above-mentioned receiving module 602, first determining module 604, second determining module 606, retrieval module 608, third determining module 610, filtering module 612 and fourth determining module 614 correspond to steps S102 to S114 in the method for determining the query results of the implemented text. The multiple modules and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiment 1.

[0391] Example 3

[0392] According to another aspect of the present invention, an electronic device is also provided, comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to execute the instructions to implement the text query result determination method of any of the above embodiments.

[0393] Example 4

[0394] According to another aspect of the present invention, a computer-readable storage medium is also provided, which, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the text query result determination method described above.

[0395] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0396] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0397] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0398] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0399] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0400] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0401] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for determining text query results, characterized in that, include: Receive a query request, wherein the query request carries an initial query text; In response to the query request, multiple candidate documents are determined based on the initial query text; Determine the target retrieval segment and target generation segment corresponding to the plurality of candidate documents respectively; The target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment are invoked. The target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items. The target generation function aims to maximize the target score of generating the expected benchmark answer on multiple proxy models. Based on the target retrieval function, anomaly indices corresponding to multiple target retrieval segments are determined, and based on the target generation function, target scores corresponding to multiple target generation segments are determined. From the multiple candidate documents, abnormal retrieval segments whose corresponding abnormality index exceeds the abnormal threshold are filtered out, and candidate documents corresponding to normal retrieval segments are retained. Abnormal generation segments whose corresponding target scores do not reach the threshold are filtered out, and candidate documents corresponding to normal generation segments are retained to obtain the target document. Based on the target document, determine the target query results.

2. The method according to claim 1, characterized in that, Based on the target generation function, determine the target scores corresponding to the multiple target generation segments, including: Based on the target generation function, the substring matching degree corresponding to multiple target generation segments is determined, and the semantic similarity corresponding to multiple target generation segments is determined. The substring matching degree represents the degree of matching between the content of the corresponding target generation segment and the content of the benchmark answer, and the semantic similarity represents the degree of semantic similarity between the content of the corresponding target generation segment and the benchmark answer. Based on the substring matching degree and semantic matching degree corresponding to the multiple target generated segments, the target scores corresponding to the multiple generated segments are determined.

3. The method according to claim 1, characterized in that, Before retrieving the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment, the process also includes: Determine the sample score corresponding to the sample generation segment; If the sample score is lower than the predetermined score, a prompt word is set to rewrite the sample generation segment based on the prompt word. This process is iterated until the corresponding score is greater than the predetermined score, thus obtaining the target generation function after setting the prompt word.

4. The method according to claim 1, characterized in that, Before invoking the target retrieval function corresponding to the retrieval segment, the following steps are also included: Based on the initial query text, multiple extended query texts are determined; Based on the initial query text and the multiple extended query texts, perform a vector mean calculation operation to determine the semantic center vector; Determine the semantic center document corresponding to the semantic center vector; Based on the semantic center document, construct the semantic center document similarity items.

5. The method according to claim 1, characterized in that, Before invoking the target retrieval function corresponding to the retrieval segment, the following steps are also included: Perform a search operation on multiple extended query texts to obtain multiple search documents; The hub document and competing documents are identified from the plurality of retrieved documents; Based on the hub document and the competing documents, construct similar items for the hub document and similar items for the competing documents.

6. The method according to claim 5, characterized in that, Identifying the hub document and competing documents from the plurality of retrieved documents also includes: The text ranking score and degree centrality score are jointly calculated to determine the retrieval index corresponding to each of the multiple retrieved documents; Based on the corresponding retrieval index, hub documents and competing documents are identified from the multiple retrieval documents.

7. The method according to any one of claims 1 to 6, characterized in that, Before invoking the target retrieval function corresponding to the retrieval segment, the following steps are also included: Based on the semantic center document, the semantic center alignment loss is determined to maximize the first cosine similarity between the retrieved segment vector and the semantic center vector, which is the semantic center document similarity term; Based on the hub document, the hub vector alignment loss is determined by maximizing the second cosine similarity between the retrieved segment vector and the hub vector, which is the hub document similarity term; Based on the competing documents, the third cosine similarity between the retrieval segment vector that minimizes the separation loss of the competing documents and the competing document vector is determined as the competing document similarity term.

8. A device for determining text query results, characterized in that, include: A receiving module is used to receive a query request, wherein the query request carries an initial query text; The first determining module is used to determine multiple candidate documents based on the initial query text in response to the query request. The second determining module is used to determine the target retrieval segment and the target generation segment corresponding to the plurality of candidate documents respectively; The retrieval module is used to retrieve the target retrieval function corresponding to the retrieval segment and the target generation function corresponding to the generation segment. The target retrieval function includes semantic center document similarity items, hub document similarity items, and competing document similarity items. The target generation function aims to maximize the target score of generating the expected benchmark answer on multiple proxy models. The third determining module is used to determine the anomaly index corresponding to each of the multiple target retrieval segments based on the target retrieval function, and to determine the target score corresponding to each of the multiple target generation segments based on the target generation function. The filtering module is used to filter out abnormal retrieval segments whose corresponding abnormality index exceeds the abnormal threshold from the multiple candidate documents, retain the candidate documents corresponding to normal retrieval segments, and filter out abnormal generation segments whose corresponding target score does not reach the threshold, retain the candidate documents corresponding to normal generation segments, so as to obtain the target document. The fourth determination module is used to determine the target query results based on the target document.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method for determining the query results of text as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the text query result determination method as described in any one of claims 1 to 7.

Images