Large model attack method, device, equipment and storage medium

Abstract

The application provides a large model attack method and device, equipment and a storage medium, comprising: determining a sample text; determining a to-be-merged text related to specific content; generating an attack sample according to the sample text and the to-be-merged text; and attacking a target large model using the attack sample to improve the success rate of the attack on the large model and the resistance of the large model to the attack, thereby ensuring the reliability and security of the output of the large model.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and storage medium for large-scale attack. Background Technology

[0002] Large models, in the fields of machine learning and artificial intelligence, refer to machine learning models with a large number of parameters and strong computing power. "Large model jailbreaking" refers to a situation where the output of a large model deviates from its original goals and expectations, generating sensitive, harmful, or misleading content. For example, by constructing specific input prompts to bypass the security defense mechanisms of a large model, it can induce the model to generate unexpected or even harmful content. Therefore, how to prevent large models from generating unexpected or even harmful content is the technical problem that this application aims to solve. Summary of the Invention

[0003] This application provides a method, apparatus, device, and storage medium for attacking large models. By using higher-quality attack samples to attack large models, the success rate of attacks against large models and the resistance of large models to attacks can be improved, thereby ensuring the reliability and security of the output of large models.

[0004] Firstly, a method for attacking large models is provided, including: determining sample text; determining text to be merged involving specific content; generating an attack sample based on the sample text and the text to be merged; and using the attack sample to attack the target large model.

[0005] Secondly, a large model attack device is provided, comprising: a first determining module for determining sample text; a second determining module for determining text to be merged involving specific content; a sample generation module for generating an attack sample based on the sample text and the text to be merged; and an adversarial attack module for attacking the target large model using the attack sample.

[0006] Thirdly, an electronic device is provided, comprising: a processor and a memory for storing a computer program, the processor for calling and running the computer program stored in the memory, and performing the methods as described in the first aspect or its various implementations.

[0007] Fourthly, a computer-readable storage medium is provided for storing a computer program that causes a computer to perform the methods described in the first aspect or its various implementations.

[0008] Fifthly, a computer program product is provided, including computer program instructions that cause a computer to perform the methods as described in the first aspect or its various implementations.

[0009] Sixthly, a computer program is provided that causes a computer to perform the methods described in the first aspect or its various implementations.

[0010] It should be noted that other technical features and effects involved will be described in subsequent embodiments of this application. To avoid repetition, they will not be repeated here. Attached Figure Description

[0011] The accompanying drawings used in the following description of the embodiments will be introduced.

[0012] Figure 1 A flowchart illustrating a large-model attack method provided in this application embodiment;

[0013] Figure 2 A schematic diagram illustrating a large-model attack method provided in an embodiment of this application;

[0014] Figure 3 A schematic diagram of a large-scale attack device 300 provided in an embodiment of this application;

[0015] Figure 4 This is a schematic diagram of the electronic device 400 provided in the embodiments of this application. Detailed Implementation

[0016] The technical solution of this application will now be described with reference to the accompanying drawings in the embodiments of this application.

[0017] It should be noted that the information, data (including, but not limited to, data used for analysis, stored data, and data displayed, such as sample text, text to be merged, dictionary data, and test text) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the sample text involved in this application and the operations performed on the sample text were obtained under full authorization.

[0018] In one embodiment, the technical solution of this application can be used in scenarios where the robustness of a model is evaluated or tested. Specifically, it can be applied to scenarios where large models are attacked, but is not limited thereto.

[0019] In one embodiment, the solution provided in this application can be executed by any electronic device with data processing capabilities. For example, the electronic device can be a server, specifically a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Alternatively, the electronic device can be a terminal device, specifically a tablet computer, laptop computer, or desktop computer. Furthermore, the electronic device can be a combination of a server and a terminal device, wherein the server and terminal device in the combination can communicate wirelessly or via wired means. This application does not impose specific limitations on the electronic device.

[0020] Figure 1 A flowchart illustrating a large-scale attack method provided in this application embodiment, which can be executed by the electronic device described in the above embodiments, such as... Figure 1 As shown, the method includes:

[0021] S110: Determine the sample text;

[0022] S120: Identify the text to be merged that involves specific content;

[0023] S130: Generate an attack sample based on the sample text and the text to be merged;

[0024] S140: Use attack samples to attack the target large model.

[0025] In one embodiment, the sample text can be in any of the following formats, but is not limited to: poetry (specifically, classical poetry, modern poetry, etc.), novels, or essays. That is, the sample text can specifically be a sample poem, a sample novel, or a sample essay, etc.

[0026] In one embodiment, S110 can be achieved by the following steps: determining the sample text:

[0027] S110-1: Generate multiple character sets, each character set including at least one character and / or at least one word.

[0028] For example, the character set can be a character set obtained by mixing characters or phrases from any language or multiple languages. For example, the language can be Chinese or English, etc., and this application does not limit it.

[0029] In addition, the sample text, text to be merged, or attack sample in this application can be text obtained by mixing characters or phrases from any language or multiple languages.

[0030] For example, one can first obtain dictionary data containing multiple characters; then, combine the characters in the dictionary data to obtain multiple character sets. Before combining the characters in the dictionary data, one can first shuffle the characters in the dictionary data according to their order.

[0031] For example, the characters in each character set can be unique, and the number of characters included in each character set can be the same.

[0032] For example, multiple character sets can be obtained by grouping dictionary data according to the character order in the dictionary data, or by randomly selecting characters from the dictionary data and combining them.

[0033] For example, you can first obtain a pre-prepared Chinese character dictionary with 20,000 characters: Dict = {token1, token2, token3, ..., token} m}, where m is the total number of Chinese characters in the dictionary data, and one token corresponds to one Chinese character; then, a random seed can be set to shuffle the Chinese characters in the dictionary data; next, the Chinese characters in the dictionary data can be pre-grouped into multiple character sets according to the principle of grouping 40 characters each: {token1, token2, token3, ..., token...} 40} k k is the group identifier (id), used to identify the character set, and its value range is [1, int(m / 40)], where int represents integer.

[0034] By using the above methods, we can reduce n-gram (word repetition) among data, avoid high repetition rates in the generated sample text, i.e., similar output and formatting issues, and improve the diversity of sample text.

[0035] S110-2: Determine the prompt data corresponding to each of the multiple character sets. The prompt data indicates that the preset content generation model outputs sample text involving the corresponding character set.

[0036] The prompt data can be a prompt, which refers to an instruction or prompt. In the fields of natural language processing and machine learning, a prompt mainly refers to a phrase or question as input to trigger a generative AI model (such as a content generation model in the following content) to produce relevant outputs (such as sample text).

[0037] For example, the content generation rules can be determined first, which are the constraints on the corresponding sample text output by the content generation model. Then, a prompt data generation template can be obtained. Finally, based on the prompt data generation template, multiple character sets can be combined with the content generation rules to obtain multiple prompt data sets. Specifically, the prompt data generation template, each character set, and the content generation rules can be concatenated to obtain multiple prompt data sets.

[0038] For example, assuming the sample text is in the format of a poem, the prompt data generation template could be: "##You are a poet, please help me compose a standard seven-character quatrain using the above Chinese characters. It needs 6 lines. Just output the text; no extra explanations or redundant output are needed!"; the content generation rules could be: "1. Remember not to output pinyin, emoticons, or English. 2. The output should be exactly 6 lines, no more or less! 3. You might add new Chinese characters for better flow, but try to add as few as possible, or make better use of the characters I provide! 4. You can shuffle the order of the specified text to ensure fluency. ##I want to emphasize again that you only need to output the poem, no redundant output, and the result should not contain English / emoticons."; then, the resulting character set {token1, token2, token3, ..., token} would be... 40} k The corresponding prompt data is:

[0039] {token1, token2, token3,…, token 40} k ##You are a poet. Please help me compose a standard seven-character quatrain using the Chinese characters above. It needs to have 6 lines. Just output the text; no extra explanations or redundant output are needed! 1. Remember not to output pinyin, emoticons, or English. 2. The output should be exactly 6 lines, no more or less! 3. You might add new Chinese characters to make the sentences flow better. Please try to add as few characters as possible, or make better use of the characters I provide! 4. You can shuffle the order of the characters I specify to ensure the sentences flow smoothly. ##I want to emphasize again that you only need to output the poem; do not provide redundant output, and the result should not contain English or emoticons. `k` is the group ID, used to identify the character set, with a value range of [1, int(m / 40)].

[0040] In the above content, by adding constraints to the generated results, i.e., sample text, in the prompt data, the controllability of the model results, i.e., the obtained sample text, can be improved to make it meet expectations. For example, it can ensure that the generated sample poems have a low repetition rate and have a certain coherence and meaning.

[0041] S110-3: Based on multiple prompts, obtain sample text through a content generation model.

[0042] For example, multiple prompts can be input into the content generation model to obtain sample text corresponding to each prompt. The content generation model can generate one sample text based on one prompt, or it can generate multiple different sample texts based on one prompt.

[0043] For example, before S110-3, a content generation model can be determined from multiple preset initial content generation models, specifically including the following steps: obtaining multiple test prompt data, which are used to instruct the multiple preset initial content generation models to output test text involving the corresponding test character set; obtaining the test text corresponding to each of the multiple initial content generation models based on the multiple test prompt data; and determining the content generation model from the multiple initial content generation models based on the multiple test texts.

[0044] The test prompt data is similar to the above prompt data, the test character set is similar to the above character set, and the test text is similar to the sample text. Their corresponding content and effects can be referenced from each other. To avoid duplication, this application will not elaborate on this.

[0045] For example, multiple preset initial content generation models may include at least two of the following, but are not limited to: ChatGPT (specifically, it may include: 3.5-turbo, gpt-3, gpt-4, gpt-4o-mini), Tongyi Qianwen (specifically, it may include: qwen-14b-chat, qwen-turbo, qwen-max, qwen2-72b-instruct), and Zhipu AI (specifically, it may include: ChatGLM3, ChatGLM4).

[0046] For example, the above method of determining a content generation model from multiple initial content generation models based on multiple test texts includes: determining the content generation model based on the degree of conformity between the multiple test texts and the constraint rules of the corresponding initial content generation model outputting the corresponding test text in the corresponding test prompt data, and / or the attack success rate of the multiple test texts on the target large model (specifically, test attack samples can be obtained from the test texts and the text to be merged, and the test attack samples can be used to attack the target large model to obtain the attack success rate).

[0047] Specifically, the test text can be compared with each item in the corresponding constraint rule to check whether the test text conforms to each item in the constraint rule. If it conforms, the corresponding value is set to 1; if it does not conform, the corresponding value is set to 0. Finally, the values ​​corresponding to each item are weighted and summed to obtain the conformity value.

[0048] Attack success rate can be determined based on the detection and filtering performance of the target large model on test attack samples. It is an indicator used to measure the ability of test text to bypass the target large model's detection, reflecting the proportion of test text that successfully conveys specific content (explained later) without being recognized and filtered by the target large model. For example, the attack success rate can be determined as the ratio of the number of test texts that successfully bypass the target large model's detection to the total number of test texts.

[0049] The content generation model can be selected from multiple initial content generation models based on its highest compliance score and / or attack success rate. Alternatively, a weighted sum of the highest compliance score and attack success rate can be taken, and the model with the highest weighted sum can be selected as the content generation model.

[0050] As described above, automatically generated sample text can be obtained by requesting the Application Programming Interface (API) of the content generation model. Furthermore, the results of different models can be compared through ablation experiments, and the model with better performance can be selected to request the generated sample text, ensuring high output quality in large-scale generation tasks.

[0051] The following is a description of the text to be merged:

[0052] In one embodiment, the specific content may refer to sensitive, discordant, or unhealthy content. The text to be merged involving specific content may refer to texts containing that specific content.

[0053] For example, an initial text set can be obtained first, which includes multiple initial texts involving specific content; then, for any target initial text among the multiple initial texts, a preset character is used to replace the corresponding character or the character adjacent to the corresponding character in the target initial text, and / or, the position of the character or word in the target initial text is modified (specifically, the positions of at least two characters or words in the target initial text can be swapped) to obtain the text to be merged; wherein, the pronunciation similarity between the preset character and the corresponding character in the target initial text is greater than a first threshold or the character shape similarity is greater than a second threshold.

[0054] For example, before replacing the corresponding characters or adjacent characters in the target initial text with preset characters to obtain the text to be merged, the order of multiple initial texts in the initial text set can be shuffled. This not only ensures the quality and fidelity of the initial text, but also improves the randomness and robustness of the data.

[0055] The above embodiments can increase the diversity and complexity of the text to be merged, making it more difficult to be automatically identified or parsed without changing the main meaning of the text to be merged, thereby improving the obfuscation level of the text to be merged and improving the robustness of the attack sample and the success rate of the attack.

[0056] The following is an introduction to the attack samples:

[0057] In one embodiment, an attack sample can be generated from the sample text and the text to be merged in at least one of the following ways, but is not limited to:

[0058] Method 1: Use each character in the text to be merged to replace the character at the first specific position in the sample text.

[0059] Method 2 involves adding each character from the text to be merged to a corresponding second specific position in the sample text to obtain the attack sample. This can be done by directly adding each character from the text to be merged to the corresponding second specific position in the sample text (without changing the original characters in the sample text), or by overlaying each character from the text to be merged to the corresponding second specific position in the sample text (overwriting the original characters in the sample text).

[0060] The first specific position or the second specific position can be the position corresponding to the first character (word or phrase) or the last character (word or phrase) of each sentence or paragraph in the sample text, that is, the beginning of a sentence, the end of a sentence, the beginning of a paragraph, or the end of a paragraph. This application does not limit the first specific position or the second specific position.

[0061] For example, assuming the sample text is a sample poem, each character in the text to be merged can be used to replace the first or last character of each line in the sample poem to obtain an attack sample based on the acrostic poem type or the hidden-tail poem type; or, each character in the text to be merged can be added to the first character before or the last character after each line in the sample poem to obtain an attack sample based on the acrostic poem type or the hidden-tail poem type.

[0062] For example, taking the language as Chinese and the sample text in a poetic format as an example, in conjunction with the above embodiments, such as... Figure 2 As shown, the electronic device can first acquire a Chinese dictionary and shuffle the characters in the dictionary sequentially; then, it can segment the shuffled characters in the dictionary into groups of 40 characters each, resulting in multiple character sets, among which... Figure 2 The characters in the character set are merely illustrative; then, prompt data can be constructed based on the character set; and the prompt data can be input into the content generation model to obtain ancient poems, i.e., multiple sample poems. For example, sample poems include... Figure 2 As shown. Next, the text to be merged containing specific content can be obtained, such as... Figure 2 The acrostic list is shown in the image, and multiple acrostic texts are broken up. Then, the first character of each line in the sample poem can be replaced with the corresponding acrostic text to obtain the attack sample.

[0063] In the above embodiments, specific content (e.g., specific attack information used to attack the target large model) can be cleverly hidden in the sample text to generate high-quality, highly concealed attack samples. This avoids being captured by the content security detection mechanism of the target large model, thus improving the effectiveness of counter-attacks. Specifically, the attack information can be hidden in the text beneath the surface form of poetry through a "hidden head replacement" or "hidden tail replacement" strategy. The generated acrostic poems or acrostic poems are highly concealed, can circumvent defense models, and improve the attack effectiveness and success rate.

[0064] In one embodiment, the target large model can be any of the following large models, but not limited to: SHieldLM large model, ChatGPT (e.g., 3.5-turbo, gpt-3, gpt-4, gpt-4o-mini), Tongyi Qianwen (e.g., qwen-14b-chat, qwen-turbo, qwen-max, qwen2-72b-instruct), Zhipu AI (e.g., ChatGLM3, ChatGLM4), Claude, Gemini.

[0065] Understandably, in the field of content security, to do a good job of defense, one must first do a good job of attack. By attacking the defense model, such as the target large model, one can find the model boundary problems and thus quickly fix the defense weaknesses. Therefore, this application can provide the target large model with a large number of dialogue samples involving specific content, i.e., attack samples. Specifically, it uses the problem of the defense model falling into hallucination after fine-tuning as the attack entry point, and uses vertical category problems not covered by the training set of the defense model as attack samples. Relying on the information difference between the defense model and another trusted large model training dataset, it automatically constructs attack texts that seem normal but contain hidden attack information, i.e., specific content, such as acrostic poems, to achieve the effect of "unpredictable", thereby ensuring a high success rate of the attack. By using the attack samples to attack the target model, the discrimination ability of the target large model is improved.

[0066] It should be noted that all the above technical solutions can be combined in any way to form optional embodiments of this application, and will not be described in detail here.

[0067] Figure 3 A schematic diagram of a large-scale attack device 300 provided in an embodiment of this application is shown below. Figure 3As shown, the device 300 includes: a first determining module 301, a second determining module 302, a sample generation module 303, an adversarial attack module 304, a first scattering module 305, a first acquisition module 306, a second acquisition module 307, a third determining module 308, and a second scattering module 309.

[0068] In one embodiment, a first determining module 301 is used to determine sample text; a second determining module 302 is used to determine text to be merged that involves specific content; a sample generation module 303 is used to generate an attack sample based on the sample text and the text to be merged; and an adversarial attack module 304 is used to attack the target large model using the attack sample.

[0069] For example, the first determining module 301 is specifically used to: generate multiple character sets, the character sets including at least one character and / or at least one word; determine prompt data corresponding to each of the multiple character sets, the prompt data indicating that a preset content generation model outputs sample text involving the corresponding character set; and obtain the sample text through the content generation model based on the multiple prompt data.

[0070] For example, the first determining module 301 is specifically used to: obtain dictionary data containing multiple characters; combine the characters in the dictionary data to obtain multiple character sets.

[0071] For example, the first shuffling module 305 is used to shuffle the characters in the dictionary data in sequence.

[0072] For example, the first determining module 301 is specifically used to: determine the content generation rule, which is a constraint rule for the corresponding sample text output by the content generation model; obtain the prompt data generation template; and based on the prompt data generation template, combine multiple character sets with the content generation rule respectively to obtain multiple prompt data.

[0073] For example, the first acquisition module 306 is used to acquire multiple test prompt data, which are used to instruct multiple preset initial content generation models to output test text involving the corresponding test character set; the second acquisition module 307 is used to obtain the test text corresponding to each of the multiple initial content generation models according to the multiple test prompt data; the third determination module 308 is used to determine the content generation model from the multiple initial content generation models according to the multiple test texts.

[0074] For example, the third determining module 308 is specifically used to determine the content generation model from multiple initial content generation models based on the degree of conformity between the multiple test texts and the constraint rules of the corresponding initial content generation model outputting the corresponding test texts in the corresponding test prompt data, and / or the attack success rate of the multiple test texts against the target large model.

[0075] For example, the second determining module 302 is specifically used to obtain an initial text set, which includes multiple initial texts involving specific content; for any target initial text among the multiple initial texts, a preset character is used to replace the corresponding character or the character adjacent to the corresponding character in the target initial text, and / or, the position of the character or word in the target initial text is modified to obtain the text to be merged; wherein, the pronunciation similarity between the preset character and the corresponding character in the target initial text is greater than a first threshold or the character shape similarity is greater than a second threshold.

[0076] For example, the second scattering module 309 is used to scatter the order of multiple initial texts in the initial text set.

[0077] For example, the sample generation module 303 is specifically used to replace the word at a first specific position in the sample text with each word in the text to be merged, and / or to add each word in the text to be merged to a second specific position in the sample text to obtain the attack sample.

[0078] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, further details will not be provided here. Specifically, Figure 3 The apparatus 300 shown can execute the above method embodiments, and the foregoing and other operations and / or functions of each module in the apparatus 300 are respectively for implementing the corresponding processes in the above method. For the sake of brevity, they will not be described in detail here.

[0079] The apparatus 300 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly embodied as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above-described model training method or image recognition method embodiments.

[0080] Figure 4 This is a schematic diagram of an electronic device 400 provided in an embodiment of this application.

[0081] like Figure 4 As shown, the electronic device 400 may include:

[0082] The system includes a memory 410 and a processor 420. The memory 410 stores computer programs and transfers the program code to the processor 420. In other words, the processor 420 can retrieve and run the computer program from the memory 410 to implement the methods described in the embodiments of this application.

[0083] For example, the processor 420 can be used to execute the above-described method embodiments according to instructions in the computer program.

[0084] In some embodiments of this application, the processor 420 may include, but is not limited to:

[0085] General-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0086] In some embodiments of this application, the memory 410 includes, but is not limited to:

[0087] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0088] In some embodiments of this application, the computer program may be divided into one or more modules, which are stored in the memory 410 and executed by the processor 420 to perform the method provided in this application. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device.

[0089] like Figure 4 As shown, the electronic device may also include:

[0090] Transceiver 430, which can be connected to processor 420 or memory 410.

[0091] The processor 420 can control the transceiver 430 to communicate with other devices; specifically, it can send information or data to other devices or receive information or data sent by other devices. The transceiver 430 may include a transmitter and a receiver. The transceiver 430 may further include antennas, and the number of antennas may be one or more.

[0092] It should be understood that the various components in the electronic device are connected through a bus system, which includes a data bus, a power bus, a control bus, and a status signal bus.

[0093] This application also provides a computer storage medium storing a computer program thereon, which, when executed by a computer, enables the computer to perform the methods of the above-described method embodiments. Alternatively, embodiments of this application also provide a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods of the above-described method embodiments.

[0094] When implemented using software, it can be implemented entirely or partially as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, the computer can perform all or part of the corresponding processes in the methods of the embodiments of this application, producing the functions achievable by the methods of the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0095] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems, apparatuses, or modules may be electrical, mechanical, or other forms.

[0097] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. For example, the functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

Claims

1. A method for attacking large models, characterized in that, include: Determine the sample text; Identify the text to be merged that contains specific content; Based on the sample text and the text to be merged, an attack sample is generated; The attack sample was used to attack the target large model.

2. The method according to claim 1, characterized in that, The determination of the sample text includes: Generate multiple character sets, wherein the character sets include at least one character and / or at least one word; Determine the prompt data corresponding to each of the multiple character sets, wherein the prompt data instructs a preset content generation model to output sample text involving the corresponding character set; Based on the multiple prompts, the sample text is obtained through the content generation model.

3. The method according to claim 2, characterized in that, The generation of multiple character sets includes: Retrieve dictionary data containing multiple characters; The characters in the dictionary data are combined to obtain the multiple character sets.

4. The method according to claim 3, characterized in that, Before combining the characters in the dictionary data to obtain the multiple character sets, the method further includes: The characters in the dictionary data are then shuffled sequentially.

5. The method according to claim 2, characterized in that, The step of determining the prompt data corresponding to each of the plurality of character sets includes: Determine the content generation rules, which are the constraint rules for the corresponding sample text output by the content generation model; Get the prompt data and generate a template; Based on the prompt data generation template, the multiple character sets are combined with the content generation rules to obtain multiple prompt data sets.

6. The method according to claim 2, characterized in that, Before obtaining the sample text based on the content generation model using the multiple prompt data, the method further includes: Acquire multiple test prompt data, which are used to instruct multiple preset initial content generation models to output test text involving the corresponding test character set; Based on the multiple test prompt data, the test text corresponding to each of the multiple initial content generation models is obtained through the multiple initial content generation models respectively; The content generation model is determined from the plurality of initial content generation models based on the plurality of test texts.

7. A large-scale attack device, characterized in that, include: The first determining module is used to determine the sample text; The second determination module is used to determine the text to be merged that involves specific content; The sample generation module is used to generate an attack sample based on the sample text and the text to be merged; The adversarial attack module is used to attack the target large model using the attack sample.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-6.

10. A computer program product containing instructions, characterized in that, When the computer program product is run on an electronic device, the electronic device causes the electronic device to perform the method according to any one of claims 1-6.

Images