Rag system robustness evaluation method and system for supply chain large language model

Abstract

This invention provides a robustness evaluation method and system for RAG (Resource Acquisition and Query) systems oriented towards large language models in the supply chain, belonging to the field of data privacy and security technology. This invention leverages the robustness of the legitimate knowledge detection system within the RAG knowledge base, differing from existing evaluation frameworks that focus on retrieval accuracy or efficiency. First, sensitive knowledge is clearly defined, and two types of sensitive knowledge are quantitatively classified to locate knowledge fragments that may cause illusions. Second, controllable suffix optimization is employed to evaluate the robustness and usability of RAG using sensitive knowledge without injecting any data into the knowledge base. This invention aims at evaluation, not attack, thus avoiding the need to modify the knowledge base content and resolving issues such as insufficient permissions. When simulating retrieval offsets, the initial suffix is ​​randomly generated, whereas comparison methods typically generate prefixes from target knowledge; this invention's setting is closer to reality. The use of suffixes in this invention better and more accurately reflects the impact of the knowledge itself.

Description

Technical Field

[0001] This invention relates to the field of data privacy and security technology, specifically to a robustness assessment method and system for RAG systems oriented towards supply chain large language models. Background Technology

[0002] Large Language Models (LLMs), with their powerful reasoning and generation capabilities, are widely used in decision-making scenarios such as supply chain risk warning, demand forecasting, and contract review. They demonstrate strong capabilities in knowledge-driven tasks such as text generation and question answering (e.g., the GPT series), but the illusion problem remains unresolved. To overcome the limitations of LLMs in terms of knowledge timeliness and domain specialization, the "data collaborative computing + RAG + LLM" architecture is becoming a trend.

[0003] Retrieval Augmentation (RAG) systems significantly improve the accuracy of LLM by dynamically integrating external knowledge bases. However, when the knowledge base contains a large number of overlapping topic entries, RAG faces new challenges: external interference or technical malfunctions may cause the system to return highly ranked but unanswerable sensitive knowledge (such as semantically similar but irrelevant knowledge), thus triggering the illusion of LLM generation. This phenomenon reveals the robustness problem of RAG systems: legitimate but sensitive internal knowledge can be incorrectly retrieved due to slight perturbations, threatening system usability.

[0004] Current research on RAG systems primarily focuses on improving retrieval accuracy and efficiency, with evaluation frameworks assessing relevant metrics. This neglects the impact of internal knowledge within the RAG system on its robustness and usability, particularly the potential threat of sensitive knowledge to system stability. Furthermore, existing methods often employ attack tactics when interfering with retrieval (e.g., PoisonedRAG, GGPP), requiring the injection of malicious knowledge into the knowledge base or modification of model parameters. This overlooks the possibility that internal knowledge may also influence the RAG retrieval process and fails to assess the system's robustness. Summary of the Invention

[0005] The purpose of this invention is to provide a robustness evaluation method and system for RAG systems oriented towards large language models in the supply chain, in order to solve at least one of the technical problems existing in the background art. First, sensitive knowledge is clearly defined, and sensitive knowledge within the knowledge base is explicitly defined as either SSIK or SCK, with learnable recognition thresholds provided. Then, in a secure environment without injecting any malicious content, lightweight input perturbations are used to simulate retrieval drift in real-world scenarios, systematically measuring the robustness of the RAG system to these legitimate but high-risk knowledge. Finally, an interpretable list of sensitive fragments and illusion triggering links are output to help developers specifically clean the knowledge base, fine-tune the retrieval tool, or improve prompting strategies.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a robustness evaluation method for RAG systems oriented towards large language models of supply chains, comprising:

[0008] The process involves: performing normal retrieval using the original query; identifying sensitive knowledge in the query list using threshold values; initializing random suffixes as input to the optimizer during the initial optimization; dynamically adjusting the optimization process based on the retrieval ranking of target knowledge and the proportion of similar knowledge; selecting characters for substitution optimization in the optimal optimization direction using gradient information; manually grouping based on relevance; embedding queries and knowledge using an embedding model capable of capturing subtle semantics and calculating semantic similarity; capturing threshold values ​​for classifying SSIK based on semantic similarity; manually grouping based on knowledge context connectivity; classifying SCK using next-sentence prediction scores and semantic mutual information; and determining threshold values.

[0009] The initial optimization query is used for retrieval. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameter to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction.

[0010] After optimization, the suffix with the higher ranking in the retrieval of sensitive knowledge is selected as the final result; the query with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by examining the output of LLM.

[0011] As a further limitation of the first aspect of this invention, for SSIK, semantic similarity is used as the classification criterion. First, query-knowledge pairs in the initial specific dataset are manually grouped according to similarity and relevance. At this point, for a given query, knowledge in the same group is considered SSIK, and knowledge in a different group is considered non-SSIK. A certain number of query statements are randomly selected, and a certain number of SSIK and non-SSIK statements are randomly selected both within and outside the groups. A model capable of capturing subtle semantics is used to calculate the semantic similarity between the query and SSIK and non-SSIK statements respectively. The task is treated as a binary classification task, and the similarity with the highest F1 score is used as the SSIK classification threshold.

[0012] As a further limitation of the first aspect of the present invention, for SCK, the next sentence prediction score and semantic mutual information are used as the classification basis; firstly, a certain number of query-knowledge pairs are randomly selected from a specific dataset to construct SCK knowledge that accounts for about half of the total knowledge; the NSP score of the query with SCK and non-SCK is calculated using a BERT pre-trained model; the mutual information score of the query with SCK and non-SCK is calculated; the SCK score of the query with SCK and non-SCK is calculated by combining the NSP score and the mutual information score; the task is treated as a binary classification task, and the SCK score with the highest F1 value is found as the SCK classification threshold.

[0013] As a further limitation of the first aspect of the present invention, the initial optimization steps are as follows: The query is input into the RAG system, and a certain amount of knowledge is retrieved normally; the retrieved knowledge is filtered using a found general threshold value to obtain sensitive knowledge; a certain number of meaningless suffixes are randomly initialized and added to the end of the query; the embedding vectors of the query and the retrieved knowledge are calculated using an embedding model; for each target sensitive knowledge, knowledge with a higher retrieval ranking is called "high-ranking knowledge"; the similarity between high-ranking knowledge and the query is calculated, and then the mean similarity is calculated; the similarity between each piece of knowledge and the highest-ranking retrieval result is calculated; knowledge with a similarity difference of less than a certain value from the highest-ranking retrieval knowledge is classified as "same category knowledge," and the number of same category knowledge and its proportion of high-ranking knowledge are calculated; an initial optimization loss is constructed and used to guide suffix optimization; the initial optimization loss function consists of three parts: target knowledge optimization, high-ranking knowledge penalty, and highest-ranking retrieval result penalty; the optimization direction is to maximize the similarity between the modified query and sensitive knowledge, while minimizing the similarity between the query and the top-ranking knowledge and the highest-ranking retrieval result.

[0014] As a further limitation of the first aspect of the present invention, a dynamic optimization coefficient is constructed using the proportion of similar knowledge; the target knowledge optimization parameter and the high-ranking knowledge penalty parameter in the initial loss function are dynamically adjusted by combining the proportion of similar knowledge to high-ranking knowledge with hyperparameters; if there is little similar knowledge in the highest-ranking search result in the search list, the positive optimization direction is enhanced, and vice versa, the penalty for high-ranking knowledge is increased.

[0015] As a further limitation of the first aspect of the present invention, during the optimization process, the gradient of each token in the suffix to be optimized is calculated, and the gradient descent direction is found to sample new tokens from the vocabulary for replacement; the loss of the newly sampled suffix sequence is calculated, and the candidate sequence with the minimum loss is retained in the buffer; after the optimization rounds are completed, the candidate sequence with the minimum loss is read from the buffer as the optimization result; the optimized query is input into RAG, and after normal retrieval, the ranking of the target sensitive knowledge in the retrieval list is checked. If it is not the highest retrieval result, the second optimization in S4 is entered.

[0016] As a further limitation of the first aspect of the present invention, the secondary optimization steps are as follows: input the query obtained in the initial optimization into RAG to obtain the complete retrieval result; construct the secondary optimization loss; wherein, the secondary optimization loss function consists of three parts, namely, target knowledge optimization, high retrieval ranking knowledge penalty and highest ranking retrieval result penalty; the penalty coefficient of each knowledge is dynamically determined according to the ranking of high retrieval ranking knowledge, and the higher the ranking of the knowledge, the greater the penalty coefficient.

[0017] Secondly, this invention provides a robustness evaluation system for RAG systems oriented towards large language models of supply chains, comprising:

[0018] The retrieval module performs normal retrieval using the original query and identifies sensitive knowledge in the query list using threshold values. In the initial optimization, random suffixes are initialized and input into the optimizer. The optimization process is dynamically adjusted based on the retrieval ranking of target knowledge and the proportion of similar knowledge. Gradient information is used to select characters for substitution optimization in the optimal optimization direction. Specifically, based on relevance, the system manually groups queries and knowledge, uses an embedding model capable of capturing subtle semantics to embed them, calculates semantic similarity, and captures threshold values ​​for classifying SSIK based on semantic similarity. Based on knowledge context connectivity, the system manually groups SSIKs and classifies them using next-sentence prediction scores and semantic mutual information to determine threshold values.

[0019] The optimization module is used to perform retrieval using the initial optimized query. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization takes into account the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameters to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction.

[0020] The query module is used to select the suffix with the higher ranking in the target sensitive knowledge retrieval as the final result after optimization; the query combined with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by viewing the output of LLM.

[0021] Thirdly, the present invention provides a non-transitory computer-readable storage medium for storing computer instructions, which, when executed by a processor, implement the robustness evaluation method for RAG systems oriented towards supply chain large language models as described in the first aspect.

[0022] Fourthly, the present invention provides a computer device including a memory and a processor, wherein the processor and the memory communicate with each other, the memory stores program instructions executable by the processor, and the processor invokes the program instructions to execute the robustness evaluation method for RAG system oriented towards supply chain large language model as described in the first aspect.

[0023] Fifthly, the present invention provides an electronic device, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions for implementing the RAG system robustness evaluation method for supply chain large language model as described in the first aspect.

[0024] Terminology Explanation:

[0025] Data Collaborative Computation: A cross-domain data collaboration method based on technologies such as Multi-Party Secure Computation (MPC) and homomorphic encryption, supporting knowledge sharing among supply chain participants without disclosing original data. LLM Model: Large Language Model, an artificial intelligence model with a large number of parameters built from artificial neural networks. RAG System: Retrieval-Augmented Generation, a technical architecture that enhances the generation capabilities of large language models by retrieving external knowledge bases. Sensitive Knowledge: Refers to knowledge fragments in the knowledge base that rank highly in retrieval but do not contain the correct answer. Robustness: Reflects a system's ability to maintain stable operation even when faced with changes in its internal structure or external environment. Illusion: Refers to large model outputs content that is unrealistic or erroneous.

[0026] The beneficial effects of this invention are as follows: It leverages the robustness of the legitimate knowledge detection system within the RAG knowledge base, differing from existing evaluation frameworks that focus on retrieval accuracy or efficiency. First, it clearly defines sensitive knowledge and quantitatively classifies two types of sensitive knowledge, enabling the identification of knowledge fragments that may cause hallucinations. Second, it employs controllable suffix optimization, evaluating the robustness and usability of RAG using sensitive knowledge without injecting any data into the knowledge base. This invention aims at evaluation, not attack, thus eliminating the need to modify the knowledge base content and avoiding issues such as insufficient permissions. When simulating retrieval offsets, the initial suffix is ​​randomly generated, whereas comparison methods typically generate prefixes from target knowledge; this invention's setting is closer to reality. Furthermore, existing methods using prefixes directly affect query semantics, interfering with normal retrieval and failing to accurately reflect the impact of the knowledge itself; this invention uses suffixes, better addressing the aforementioned problems.

[0027] The advantages of additional aspects of the invention will be set forth more clearly in the following description or will be learned by practice of the invention. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a functional principle block diagram of the RAG system robustness evaluation model for supply chain large language model as described in an embodiment of the present invention.

[0030] Figure 2 This is a flowchart of the robustness evaluation method for RAG system based on a large language model of the supply chain, as described in an embodiment of the present invention. Detailed Implementation

[0031] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0032] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0033] It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as here.

[0034] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, and / or groups thereof.

[0035] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0036] To facilitate understanding of the present invention, the present invention will be further explained and described below with reference to the accompanying drawings and specific embodiments. However, the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0037] Those skilled in the art should understand that the accompanying drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily essential for implementing the present invention.

[0038] In privacy-preserving supply chain data collaborative computing scenarios, "data collaborative computing + RAG retrieval + large model decision-making" has become the mainstream technical architecture for cross-domain intelligent decision-making. The bottom layer achieves secure fusion of multi-source data through technologies such as multi-party secure computation (MPC) and homomorphic encryption; the middle layer utilizes the RAG system to retrieve decision-making basis from the collaborative knowledge base; and the top layer relies on large language models (LLM) for complex decisions such as risk warning, supply and demand forecasting, and logistics optimization. However, this architecture has a critical security gap: existing research focuses on ensuring the privacy and security of the data collaborative computing layer (such as encryption protocol design and secure computing component construction) and the security of the large model layer itself (such as model robustness and output alignment), but neglects the reliability risks of the RAG connection layer. When data collaborative computing integrates heterogeneous knowledge from multiple parties into a unified knowledge base, it inevitably introduces a large number of knowledge entries with overlapping topics, heterogeneous formats, and semantically similar but actually unrelated information. While these knowledge entries may be correctly distinguished in normal plaintext retrieval, in cross-domain query scenarios, they are easily misranked by RAG due to slight perturbations (such as differences in query expression or protocol noise), and then passed to LLM to generate illusionary decisions. This knowledge is strongly correlated with the correct answer, ranks highly in the search list but does not contain the correct answer. If it is passed to LLM as a search result, it may generate hallucinatory content. This invention defines this type of knowledge as sensitive knowledge. This invention aims to establish a quantitative evaluation framework to analyze the impact mechanism of sensitive knowledge on the reliability of RAG. This invention can effectively identify and classify sensitive knowledge within RAG that may affect the system, and can also detect the robustness and usability of the RAG system. First, this invention establishes a sensitive knowledge classification standard based on semantic similarity, mutual information and other technologies, and quantitatively classifies two types of sensitive knowledge: Semantically Similar but Irrelevant Knowledge (SSIK) and Simulated Contextual Knowledge (SCK). This framework can quantitatively distinguish between these two types of sensitive knowledge and normal knowledge. Second, in order to explore the impact of sensitive knowledge on the usability and robustness of the RAG system, this invention effectively simulates the situation of retrieval errors by adding and optimizing controllable query suffixes. Specifically, this invention systematically evaluates the ability of RAG components to resist sensitive knowledge without compromising the privacy protection mechanism of collaborative data computing or injecting any malicious data. It quantifies the threat level of their robustness defects to the security of large model decision-making and ultimately outputs an interpretable list of sensitive knowledge and illusion triggering links, providing RAG layer security authentication capabilities for supply chain data collaborative computing platforms.

[0039] Example 1

[0040] In this embodiment 1, a robustness evaluation system for a RAG system oriented towards a large language model for supply chains is first provided, including: a retrieval module, used for normal retrieval using the original query, and using threshold values ​​to determine sensitive knowledge in the query list; in the initial optimization, initializing random suffixes and inputting them into the optimizer; dynamically adjusting the optimization process by combining the retrieval ranking of target knowledge and the similarity knowledge ratio parameter; using gradient information to select characters for substitution optimization in the optimal optimization direction; wherein, based on relevance, the query and knowledge are manually grouped, and an embedding model capable of capturing subtle semantics is used to embed the query and knowledge, and semantic similarity is calculated, and a threshold value for classifying SSIK is captured based on semantic similarity; based on knowledge context connectivity, the SCK is manually grouped, and the next sentence prediction score and semantic mutual information are used to classify SCK and determine the threshold value. An optimization module is used for retrieval using the initial optimized query, and if the target knowledge is not ranked highest, a second optimization is performed; the second optimization comprehensively considers the ranking of knowledge with a higher retrieval ranking than the target knowledge, dynamically adjusts the penalty parameter to guide the optimization process; and uses gradient information to select characters for substitution optimization in the optimal optimization direction. The query module is used to select the suffix with the higher ranking in the target sensitive knowledge retrieval as the final result after optimization; the query combined with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by viewing the output of LLM.

[0041] In this embodiment, the robustness evaluation method for a RAG system oriented towards a large language model for the supply chain is implemented using the above-described system. This includes: performing normal retrieval using the original query; determining sensitive knowledge in the query list using threshold values; initializing random suffixes and inputting them into the optimizer during the initial optimization; dynamically adjusting the optimization process by combining the retrieval ranking of target knowledge and the proportion of similar knowledge parameters; selecting characters for substitution optimization in the optimal optimization direction using gradient information; wherein, based on relevance, manual grouping is performed; embedding queries and knowledge using an embedding model capable of capturing subtle semantics is used; semantic similarity is calculated; and a threshold value for classifying SSIK is captured based on semantic similarity; and based on knowledge context connectivity... Manual grouping is used to classify SCKs using next-sentence prediction scores and semantic mutual information to determine threshold values. Initial optimization queries are used for retrieval; if the target knowledge does not rank highest, secondary optimization is performed. Secondary optimization comprehensively considers the ranking of knowledge retrieved that ranks higher than the target knowledge, dynamically adjusting penalty parameters to guide the optimization process. Gradient information is used to select characters for substitution optimization in the optimal optimization direction. After optimization, the suffix with the highest ranking in the target sensitive knowledge retrieval is selected as the final result. The query combined with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM. The impact of sensitive knowledge and RAG robustness on the system is determined by examining the LLM output.

[0042] For SSIK, semantic similarity is used as the classification criterion. First, query-knowledge pairs in the initial specific dataset are manually grouped based on similarity and relevance. At this point, for a given query, knowledge in the same group is considered SSIK, and knowledge in different groups is considered non-SSIK. A certain number of query statements are randomly selected, and a certain number of SSIK and non-SSIK pairs are randomly selected both within and outside the groups. A model capable of capturing subtle semantics is used to calculate the semantic similarity between the query and both SSIK and non-SSIK pairs. The task is then treated as a binary classification task, and the similarity with the highest F1 score is used as the SSIK classification threshold.

[0043] For SCK, the next-sentence prediction score and semantic mutual information are used as classification criteria. First, a certain number of query-knowledge pairs are randomly selected from a specific dataset to construct SCK knowledge, which accounts for about half of the total knowledge. The NSP score between the query and SCK and non-SCK is calculated using a BERT pre-trained model. The mutual information score between the query and SCK and non-SCK is calculated. The SCK score between the query and SCK and non-SCK is calculated by combining the NSP score and the mutual information score. The task is treated as a binary classification task, and the SCK score with the highest F1 value is used as the SCK classification threshold.

[0044] The initial optimization steps are as follows: Input the query into the RAG system to retrieve a certain amount of knowledge; filter the retrieved knowledge using the found general threshold value to obtain sensitive knowledge; randomly initialize a certain number of meaningless suffixes with tokens and add them to the end of the query; calculate the embedding vectors of the query and retrieved knowledge using an embedding model; for each target sensitive knowledge, knowledge with a higher retrieval ranking than it is called "high-ranking knowledge"; calculate the similarity between high-ranking knowledge and the query, and then calculate the mean similarity; calculate the similarity between each piece of knowledge and the highest-ranking retrieval result; classify knowledge with a similarity difference of less than a certain value from the highest-ranking retrieval knowledge as "same category knowledge", and calculate the number of same category knowledge and its proportion of high-ranking knowledge; construct the initial optimization loss and use it to guide suffix optimization; the initial optimization loss function consists of three parts: target knowledge optimization, high-ranking knowledge penalty, and highest-ranking retrieval result penalty; the optimization direction is to maximize the similarity between the modified query and sensitive knowledge, while minimizing the similarity between the query and the top-ranking knowledge and the highest-ranking retrieval result. A dynamic optimization coefficient is constructed using the proportion of similar knowledge. The optimization parameters for target knowledge and the penalty parameters for high-ranking knowledge in the initial loss function are dynamically adjusted based on the proportion of similar knowledge among high-ranking search knowledge, combined with hyperparameters. If there is little similar knowledge in the highest-ranking search result in the search list, the positive optimization direction is strengthened; conversely, the penalty for high-ranking search knowledge is increased. During optimization, the gradient of each token in the suffix to be optimized is calculated, and a gradient descent direction is found to sample new tokens from the vocabulary for replacement. The loss of the newly sampled suffix sequence is calculated, and the candidate sequence with the minimum loss is retained in the buffer. After the optimization rounds are completed, the candidate sequence with the minimum loss is read from the buffer as the optimization result. The optimized query is input into RAG, and after a normal search, the ranking of the target sensitive knowledge in the search list is checked. If it is not the highest-ranking search result, the second optimization in S4 is performed.

[0045] In the secondary optimization, the query obtained in the primary optimization is input into RAG to obtain the complete search results; the secondary optimization loss is constructed; the secondary optimization loss function consists of three parts, namely target knowledge optimization, high search ranking knowledge penalty and highest ranking search result penalty; the penalty coefficient of each knowledge is dynamically determined according to the ranking of high search ranking knowledge, and the higher the ranking of the knowledge, the greater the penalty coefficient.

[0046] Example 2

[0047] like Figure 1 , Figure 2 As shown in this embodiment, a robustness evaluation method for RAG systems oriented towards large language models of supply chains is provided, including the following steps:

[0048] S1: In the SSIK (Sensitive Knowledge Inquiry) classification stage, data is first manually grouped based on relevance. An embedding model capable of capturing subtle semantics is then used to embed the query and knowledge, and semantic similarity is calculated. A threshold value for SSIK classification is then captured based on this semantic similarity.

[0049] S2: In the sensitive knowledge (SCK) classification stage, SCKs are manually grouped based on knowledge context connectivity. Next-sentence prediction scores and semantic mutual information are used to classify SCKs and determine threshold values.

[0050] S3: Perform normal retrieval using the original query, and identify sensitive knowledge from the query list using threshold values. In the initial optimization, initialize random suffixes and input them into the optimizer. Dynamically adjust the optimization process based on parameters such as the retrieval ranking of target knowledge and the proportion of similar knowledge. Utilize gradient information to select characters for substitution optimization in the optimal optimization direction.

[0051] S4: Initial optimization is performed using the query. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge items with higher rankings than the target knowledge, dynamically adjusting the penalty parameters to guide the optimization process. Gradient information is used to select characters for substitution optimization in the optimal optimization direction.

[0052] S5: After optimization, select the suffix with the higher ranking in the retrieval of sensitive knowledge as the final result. Input the query with the suffix into the RAG, and input the retrieved knowledge and query together into the LLM. Determine the impact of sensitive knowledge and RAG robustness on the system by examining the LLM output.

[0053] In step S1, during the sensitive knowledge classification stage, a general threshold value is first found from a specific dataset to classify sensitive knowledge. The specific steps for SSIK classification are as follows:

[0054] S11: For SSIK, semantic similarity is used as the classification criterion. First, query-knowledge pairs in the initial specific dataset are manually grouped according to similarity and relevance. At this point, for a given query, knowledge in the same group is considered SSIK, and knowledge in a different group is considered non-SSIK.

[0055] S12: Randomly select a certain number of query statements, and randomly select a certain number of SSIK and non-SSIK statements within and outside the group;

[0056] S13: Use a model that can capture subtle semantics to calculate the semantic similarity between the query and SSIK and non-SSIK queries respectively;

[0057] In this embodiment, the preferred model for extracting text features is the all-MiniLM-L6-v1 model. This model is a well-known model in the prior art. It is a pre-trained Transformer language model based on deep self-attention distillation technology. This model contains a multi-layer self-attention mechanism network, which compresses large pre-trained language models (such as BERT) into smaller models through knowledge distillation, achieving lightweighting while maintaining cross-task processing capabilities.

[0058] Calculate semantic similarity: After inputting the query statement and the knowledge fragment into the above embedding model to obtain feature vectors, the semantic similarity between the two vectors is quantified by calculating the normalized inner product (i.e., cosine similarity).

[0059]

[0060] This represents the cosine similarity score between the query vector and the retrieved knowledge vector, which measures the degree of semantic similarity. : Represents the query embedding vector obtained after the input query has been processed by the feature extraction model. : Represents the knowledge embedding vector obtained after the retrieved knowledge fragments have been processed by the same feature extraction model. : represents the dot product, which is the sum of the products of the corresponding dimensions of two vectors. : These represent the L2 norm (magnitude) of the vector, respectively.

[0061] S14: Treat the task as a binary classification task and find the similarity with the highest F1 score as the SSIK classification threshold.

[0062] The specific steps for SCK classification are as follows:

[0063] S21: For SCK, the next sentence prediction score and semantic mutual information are used as classification criteria. First, a certain number of query-knowledge pairs are randomly selected from a specific dataset to construct SCK knowledge that accounts for about half of the total knowledge (either by manually selecting SCK or by modifying non-SCK to SCK).

[0064] S22: Calculate the NSP score for queries and non-SCK queries using a BERT pre-trained model;

[0065] In this embodiment, the NSP score is calculated using the existing BERT pre-trained language model. NSP is one of the core tasks of the BERT model during the pre-training phase, specifically used to determine whether two text sequences are semantically and logically continuous. The BERT model can directly call functions to calculate the NSP score.

[0066] The given query and the knowledge fragment to be tested are concatenated into a format conforming to the BERT model input specification (e.g., [CLS] q [SEP] t [SEP]), and then input into the pre-trained BERT model. The model extracts the binary classification probability value corresponding to the [CLS] label in the output, denoted as NSP(q,t). This value is distributed between 0 and 1. The closer it is to 1, the higher the probability that the model determines that the knowledge fragment t is a natural continuation of the query q$, that is, the stronger the contextual coherence between the two.

[0067] S23: Calculate the mutual information score between the query and SCK and non-SCK queries;

[0068] Mutual information is used to measure the degree of information dependency between a query and the knowledge fragment being tested. In this embodiment, mutual information is calculated in two parts: posterior mutual information. and prior mutual information Calculate posterior mutual information. For a query q, a reference answer a that meets the requirements of the correct answer, and a knowledge fragment t to be tested, the latent space representation is extracted using the encoder as an intermediate variable to calculate the mutual information between the answer a and the knowledge fragment t given the query q.

[0069]

[0070] z represents the latent spatial feature representation extracted by the encoder from the corresponding variables, and is used as intermediate information to measure mutual information. : Represents the distribution of latent variables given a query q and the knowledge to be tested t. : Represents the distribution of latent variables given a query q and a reference answer a. E: Represents the expected value.

[0071]

[0072] : Represents the prior distribution of latent variables only given the query q.

[0073] S24: Combine the NSP score and mutual information score to calculate the SCK score for the query and for both SCK and non-SCK queries;

[0074] The NSP score is linearly combined with the mutual information score. The NSP probability is used as a weighting factor here:

[0075]

[0076] S25: Treat the task as a binary classification task and find the SCK score with the highest F1 value as the SCK classification threshold.

[0077] During the RAG robustness testing phase, controllable query suffixes were added to influence RAG search results, examining the impact of RAG robustness and sensitive knowledge on the system. The specific optimization process is divided into initial optimization and secondary optimization, with the initial optimization steps as follows:

[0078] S31: Input the query into the RAG system, and a certain amount of knowledge is retrieved normally. Use the found general threshold value to filter the retrieved knowledge to obtain sensitive knowledge;

[0079] S32: Randomly initialize a certain number of meaningless suffixes for tokens and append them to the query;

[0080] S33: Calculate the query using the embedded model The embedding vector of the retrieved knowledge. For each piece of target-sensitive knowledge. Knowledge with a higher search ranking than a search term is called "high-search-ranking knowledge," that is... Calculate the similarity between the highest-ranking search terms and the query, and then calculate the mean similarity. Calculate the similarity between each piece of knowledge and the highest-ranking search result. Similarity is calculated. Knowledge with a similarity difference of less than a certain value from the highest-ranking retrieved knowledge is categorized as "same category knowledge," and the number of such same category knowledge is calculated as its proportion of the highest-ranking retrieved knowledge. ;

[0081] S34: Construct the initial optimization loss function and use it to guide suffix optimization. The initial optimization loss function consists of three parts: target knowledge optimization, high-ranking knowledge penalty, and highest-ranking search result penalty. The optimization direction is to maximize the similarity between the modified query and sensitive knowledge, while minimizing the similarity between the query and top-ranking knowledge and the highest-ranking search result.

[0082]

[0083] in, , and The value of the adaptive parameter is determined by S35. (x, y) is a function that calculates the similarity between the vectors x and y.

[0084] S35: Construct dynamic optimization coefficients using the proportion of similar knowledge. Utilize the proportion of similar knowledge among high-ranking search results, and dynamically adjust the target knowledge optimization parameters and high-ranking search knowledge penalty parameters in the initial loss function based on hyperparameters. If there is little similar knowledge in the highest-ranking search result in the search list, the positive optimization direction is strengthened; conversely, the penalty for high-ranking search knowledge is increased. The formula is as follows:

[0085]

[0086]

[0087] in, , and This is a hyperparameter.

[0088] S36: During optimization, the gradient of each token in the suffix to be optimized is calculated, and a gradient descent direction is found to sample new tokens from the vocabulary for replacement. The loss of the newly sampled suffix sequence is calculated, and the candidate sequence with the minimum loss is kept in the buffer. After the optimization rounds are completed, the candidate sequence with the minimum loss is read from the buffer as the optimization result.

[0089] S37: Input the optimized query into RAG, perform a normal search, and check the ranking of the target sensitive knowledge in the search list. If it is not the highest search result, proceed to the second optimization in S4.

[0090] The initial optimization should have largely achieved the goal of improving the ranking of search results for target-sensitive knowledge. If the target knowledge is still not the final search result, a second optimization will be used to penalize knowledge that still ranks higher than the target knowledge. The steps for the second optimization are as follows:

[0091] S41: Input the query obtained in the initial optimization of S3 into RAG to obtain the complete search results.

[0092] S42: Construct the quadratic optimization loss function. The quadratic optimization loss function consists of three parts: target knowledge optimization, high-ranking knowledge penalty, and highest-ranking search result penalty. The penalty coefficient for each piece of knowledge is dynamically determined based on its ranking; the higher the ranking of the knowledge, the larger the penalty coefficient.

[0093] The formula is as follows:

[0094]

[0095]

[0096] in, It is knowledge for each high search ranking The corresponding penalty weight, This represents the normalized similarity between knowledge and the query. This is the attenuation coefficient, typically 0.5, used to balance the penalty intensity for different knowledge in the ranking. As a stable term, it is generally set to , This indicates the rank of i in the search list. Other parameter settings are the same as in S35.

[0097] S43: After determining the loss function, the optimization method is the same as in S36.

[0098] S44: Input the second-optimized query into RAG, perform a normal search, and check the ranking of the target sensitive knowledge in the search list. Select the suffix with the higher ranking of target sensitive knowledge in both the initial and second-optimization analyses as the final result.

[0099] After obtaining the optimized query, input the LLM function to check the output. The process is as follows:

[0100] S51: Set the following instruction for the LLM: "Please answer the relevant questions based on the retrieved knowledge. If you cannot determine the answer, please output 'I don't know'."

[0101] S52: Optimize the query input into RAG for retrieval, and input the retrieval results and query together into LLM.

[0102] S53: Examine the LLM's output. If it explicitly answers the query question, and the answer is incorrect or meaningless, then the LLM is considered to have output illusory content. In this case, it is believed that sensitive knowledge has negatively impacted the LLM, and the RAG's invulnerability has caused the system to malfunction.

[0103] Example 3

[0104] This embodiment 3 provides a non-transitory computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, they implement the robustness evaluation method for the RAG system oriented towards a large language model of the supply chain, as described above. The method includes:

[0105] The process involves: performing normal retrieval using the original query; identifying sensitive knowledge in the query list using threshold values; initializing random suffixes as input to the optimizer during the initial optimization; dynamically adjusting the optimization process based on the retrieval ranking of target knowledge and the proportion of similar knowledge; selecting characters for substitution optimization in the optimal optimization direction using gradient information; manually grouping based on relevance; embedding queries and knowledge using an embedding model capable of capturing subtle semantics and calculating semantic similarity; capturing threshold values ​​for classifying SSIK based on semantic similarity; manually grouping based on knowledge context connectivity; classifying SCK using next-sentence prediction scores and semantic mutual information; and determining threshold values.

[0106] The initial optimization query is used for retrieval. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameter to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction.

[0107] After optimization, the suffix with the higher ranking in the retrieval of sensitive knowledge is selected as the final result; the query with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by examining the output of LLM.

[0108] Example 4

[0109] This embodiment 4 provides a computer device, including a memory and a processor, wherein the processor and the memory communicate with each other, and the memory stores program instructions that can be executed by the processor. The processor calls the program instructions to execute the robustness evaluation method for RAG systems oriented towards large language models of supply chains as described above. The method includes:

[0110] The process involves: performing normal retrieval using the original query; identifying sensitive knowledge in the query list using threshold values; initializing random suffixes as input to the optimizer during the initial optimization; dynamically adjusting the optimization process based on the retrieval ranking of target knowledge and the proportion of similar knowledge; selecting characters for substitution optimization in the optimal optimization direction using gradient information; manually grouping based on relevance; embedding queries and knowledge using an embedding model capable of capturing subtle semantics and calculating semantic similarity; capturing threshold values ​​for classifying SSIK based on semantic similarity; manually grouping based on knowledge context connectivity; classifying SCK using next-sentence prediction scores and semantic mutual information; and determining threshold values.

[0111] The initial optimization query is used for retrieval. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameter to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction.

[0112] After optimization, the suffix with the higher ranking in the retrieval of sensitive knowledge is selected as the final result; the query with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by examining the output of LLM.

[0113] Example 5

[0114] This embodiment 5 provides an electronic device, including: a processor, a memory, and a computer program; wherein, the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions implementing the robustness evaluation method for the RAG system oriented towards the large language model of the supply chain as described above. The method includes:

[0115] The process involves: performing normal retrieval using the original query; identifying sensitive knowledge in the query list using threshold values; initializing random suffixes as input to the optimizer during the initial optimization; dynamically adjusting the optimization process based on the retrieval ranking of target knowledge and the proportion of similar knowledge; selecting characters for substitution optimization in the optimal optimization direction using gradient information; manually grouping based on relevance; embedding queries and knowledge using an embedding model capable of capturing subtle semantics and calculating semantic similarity; capturing threshold values ​​for classifying SSIK based on semantic similarity; manually grouping based on knowledge context connectivity; classifying SCK using next-sentence prediction scores and semantic mutual information; and determining threshold values.

[0116] The initial optimization query is used for retrieval. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameter to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction.

[0117] After optimization, the suffix with the higher ranking in the retrieval of sensitive knowledge is selected as the final result; the query with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by examining the output of LLM.

[0118] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment, whereby a series of operational steps are performed to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solutions disclosed in the present invention, various modifications or variations that can be made by those skilled in the art without creative effort should be included within the scope of protection of the present invention.

Claims

1. A robustness evaluation method for RAG systems oriented towards large language models of supply chains, characterized in that, include: Perform normal retrieval using the original query, and use threshold values ​​to identify sensitive knowledge in the query list; In the initial optimization, a random suffix is ​​initialized and input into the optimizer; The process involves dynamically adjusting and optimizing the search ranking of target knowledge and the proportion of similar knowledge parameters. Gradient information is used to select characters for substitution optimization in the optimal optimization direction; among them, manual grouping is performed based on relevance, and the query and knowledge are embedded using an embedding model that can capture subtle semantics, and semantic similarity is calculated. Threshold values ​​for classifying SSIK are captured based on semantic similarity; manual grouping is performed based on knowledge context connectivity, and SCK is classified using the next sentence prediction score and semantic mutual information to determine the threshold value. The initial optimization query is used for retrieval. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization comprehensively considers the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameter to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction. After optimization, the suffix with the higher ranking in the retrieval of sensitive knowledge is selected as the final result; the query with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by examining the output of LLM.

2. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 1, characterized in that, For SSIK, semantic similarity is used as the classification criterion. First, query-knowledge pairs in the initial specific dataset are manually grouped based on similarity and relevance. At this point, for a given query, knowledge in the same group is considered SSIK, and knowledge in a different group is considered non-SSIK. A certain number of query statements are randomly selected, and a certain number of SSIK and non-SSIK statements are randomly selected both within and outside the groups. A model capable of capturing subtle semantics is used to calculate the semantic similarity between the query and SSIK and non-SSIK statements respectively. The task is treated as a binary classification task, and the similarity with the highest F1 score is used as the SSIK classification threshold.

3. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 1, characterized in that, For SCK, the next-sentence prediction score and semantic mutual information are used as classification criteria. First, a certain number of query-knowledge pairs are randomly selected from a specific dataset to construct SCK knowledge, which accounts for about half of the total knowledge. The NSP score between the query and SCK and non-SCK is calculated using a BERT pre-trained model. The mutual information score between the query and SCK and non-SCK is calculated. The SCK score between the query and SCK and non-SCK is calculated by combining the NSP score and the mutual information score. The task is treated as a binary classification task, and the SCK score with the highest F1 value is used as the SCK classification threshold.

4. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 1, characterized in that, The initial optimization steps are as follows: Input the query into the RAG system and retrieve a certain amount of knowledge normally; use the found general threshold value to filter the retrieved knowledge to obtain sensitive knowledge; randomly initialize a certain number of meaningless suffixes for tokens and add them to the end of the query. The embedding vectors of query and retrieval knowledge are calculated using the embedding model; For each piece of target-sensitive knowledge, knowledge with a higher search ranking than it is called "high search ranking knowledge"; Calculate the similarity between high-ranking search knowledge and the query, and then calculate the mean similarity. Calculate the similarity between each piece of knowledge and the highest-ranking search result; Knowledge with a similarity difference of less than a certain value from the highest-ranking searched knowledge is classified as "same category knowledge," and the number of same category knowledge and its proportion of the highest-ranking searched knowledge are calculated. The initial optimization loss is constructed and used to guide suffix optimization. The initial optimization loss function consists of three parts: target knowledge optimization, high retrieval ranking knowledge penalty, and highest ranking retrieval result penalty. The optimization direction is to maximize the similarity between the modified query and sensitive knowledge, while minimizing the similarity between the query and the top-ranked knowledge and the highest search result.

5. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 4, characterized in that, in, Dynamic optimization coefficients are constructed using the proportion of similar knowledge; the proportion of similar knowledge in high-ranking search knowledge is used to dynamically adjust the target knowledge optimization parameters and high-ranking search knowledge penalty parameters in the initial loss function in combination with hyperparameters; if there is little similar knowledge in the highest-ranking search result in the search list, the positive optimization direction is strengthened, and vice versa, the penalty for high-ranking search knowledge is increased.

6. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 5, characterized in that, During the optimization process, the gradient of each token in the suffix to be optimized is calculated, and the gradient descent direction is found to sample new tokens from the vocabulary for replacement. The loss of the newly sampled suffix sequence is calculated, and the candidate sequence with the minimum loss is kept in the buffer. After the optimization rounds are completed, the candidate sequence with the minimum loss is read from the buffer as the optimization result. The optimized query is input into RAG, and after normal retrieval, the ranking of the target sensitive knowledge in the retrieval list is checked. If it is not the highest retrieval result, the second optimization in S4 is entered.

7. The robustness evaluation method for RAG systems oriented towards large language models of supply chains according to claim 1, characterized in that, The secondary optimization steps are as follows: Input the query obtained in the initial optimization into RAG to obtain the complete search results; Construct a quadratic optimization loss function; the quadratic optimization loss function consists of three parts, namely, target knowledge optimization, high retrieval ranking knowledge penalty, and highest ranking retrieval result penalty; The penalty coefficient for each piece of knowledge is dynamically determined based on its high search ranking; the higher the ranking of a piece of knowledge, the greater the penalty coefficient.

8. A robustness evaluation system for RAG systems oriented towards large language models of supply chains, characterized in that, include: The retrieval module is used to perform normal retrieval using the original query, and to identify sensitive knowledge in the query list using threshold values. In the initial optimization, a random suffix is ​​initialized and input into the optimizer; The process involves dynamically adjusting and optimizing the search ranking of target knowledge and the proportion of similar knowledge parameters. Gradient information is used to select characters for substitution optimization in the optimal optimization direction; among them, manual grouping is performed based on relevance, and the query and knowledge are embedded using an embedding model that can capture subtle semantics, and semantic similarity is calculated. Threshold values ​​for classifying SSIK are captured based on semantic similarity; manual grouping is performed based on knowledge context connectivity, and SCK is classified using the next sentence prediction score and semantic mutual information to determine the threshold value. The optimization module is used to perform retrieval using the initial optimized query. If the target knowledge is not ranked highest, a second optimization is performed. The second optimization takes into account the ranking of knowledge that ranks higher than the target knowledge and dynamically adjusts the penalty parameters to guide the optimization process. Gradient information is used to select characters for substitution optimization in the best optimization direction. The query module is used to select the suffix with the higher ranking in the target sensitive knowledge retrieval as the final result after optimization; the query combined with the suffix is ​​input into RAG, and the retrieved knowledge and query are input into LLM; the impact of sensitive knowledge and RAG robustness on the system is determined by viewing the output of LLM.

9. A computer device, characterized in that, The system includes a memory and a processor, which communicate with each other. The memory stores program instructions that can be executed by the processor, and the processor invokes the program instructions to execute the robustness evaluation method for RAG systems oriented towards supply chain large language models as described in any one of claims 1-7.

10. An electronic device, characterized in that, include: The electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions that implement the robustness evaluation method for RAG systems oriented towards supply chain large language models as described in any one of claims 1-7.

Images