Large model escape detection method based on discrete neuron features and shadow model active trapping

Abstract

This invention discloses a large-model jailbreak detection method based on discrete neuron features and shadow model active trapping, belonging to the field of large-model security. Specifically, it involves: first, constructing a master-slave dual-stream architecture active trapping jailbreak detection system; the traffic distribution module copies the user's input image and text requests into two paths: one path is temporarily stored in the main model's buffer and forcibly blocked; the other path, after image dimension alignment and text segmentation encoding, is transformed into a detection copy input fuse injection module. By matching the fuse, a trapping sequence input shadow model detection module is constructed. This module pre-implants a gradient honeypot, which, under the combined action of the fuse and the gradient honeypot, captures and amplifies malicious features, obtains the activation values ​​of the jailbreak neurons, and outputs them to the security decision module for pre-gating judgment. The main model performs business reasoning and final response based on the interception or allowance command. This invention significantly improves the robustness and security of the large-model system in adversarial environments.

Description

Technical Field

[0001] This invention belongs to the field of large model security, specifically a large model jailbreak detection method based on discrete neuron features and shadow model active trapping. Background Technology

[0002] In recent years, with the rapid development of deep learning, large vision-language models (LVLMs) have made breakthrough progress in multimodal understanding and generation tasks, and have been widely used in key areas such as intelligent assistants, content moderation and autonomous driving.

[0003] However, with the improvement of the capabilities of large models, the security threats they face are becoming increasingly severe, especially in terms of jailbreak attacks: attackers attempt to bypass the model's secure alignment mechanism by carefully constructing malicious text and image inputs, such as embedding malicious text in images or adding adversarial perturbations, inducing the model to output violent, illegal, or unethical content. This attack method is highly covert and has many variations, posing a huge challenge to the secure deployment of large models.

[0004] Currently, defense techniques against large-scale jailbreak attacks are mainly divided into training phase defense and inference phase defense.

[0005] While defenses during the training phase are effective, they are computationally expensive and struggle to defend against new and unknown attacks. Defenses during the inference phase typically include input filtering and output censorship, but they often fall short when faced with complex semantic spoofing and can easily increase system latency.

[0006] Existing technology, from “Sure” to “Sorry”: Detecting Jailbreak in Large Vision Language Model via JailNeurons, proposes a detection technique based on the activation characteristics of neurons within the model. The study found that when large models handle jailbreak attacks, not all neurons participate in the response; instead, specific, sparse, and discretely distributed “jailbreak neurons” are abnormally activated. Based on this finding, this existing technology proposes a passive monitoring mechanism:

[0007] 1. Localization Phase: Through causal inference and mask training, key neurons in each layer that are highly correlated with jailbreak behavior are located without modifying the model parameters.

[0008] 2. Detection Phase: During the model inference process, the activation state of key neurons inside the main model is directly monitored, or the activation values ​​of these neurons are extracted as features to train a lightweight linear classifier to determine whether the current input constitutes a jailbreak attack; once a discretely distributed neuron is detected to be abnormally activated, the system intercepts the output.

[0009] In summary, passive observation and discrimination using existing internal representations of the model can distinguish between benign user requests and malicious jailbreak attacks. This discovery of the discrete distribution characteristics of jailbreak neurons provides a crucial feature map for refined security control of large models. Based on the deterministic distribution of these specific neuron locations within the model, how to evolve from passive monitoring to more targeted proactive defense, and how to further balance security strength and inference performance through system architecture design, has become an important direction for the evolution of this field.

[0010] However, the existing technology based on passive monitoring of neurons within the main model has the following three drawbacks in practical applications:

[0011] 1. When facing weak signals or adaptive attacks, the detection sensitivity is insufficient, resulting in a high risk of false negatives.

[0012] The reason for this shortcoming lies in the fact that existing technologies employ a passive monitoring mechanism, a "wait-and-see" approach. Their effectiveness relies entirely on the attack input naturally and intensely activating specific escape neurons. However, when faced with carefully crafted covert attacks, such as disguising malicious commands within seemingly harmless image noise, or adaptive attacks over-optimized against the detector, the attack signatures are often very weak. Alternatively, attackers may deliberately suppress the activation levels of key neurons through gradient optimization. Because the system lacks a mechanism to actively lower the activation threshold or amplify the attack signal—that is, it lacks a "fuse"—a pre-generated, gradient-optimized, inducing input sequence designed to prematurely induce specific escape neurons within the shadow model into a critical sensitive state—these weak malicious signatures cannot cross the classifier's decision boundary, thus rendering the defense ineffective.

[0013] 2. The defense mechanism is strongly coupled with the main inference process, which leads to increased inference latency and is not only difficult to maintain, but may even affect the general performance of the main model.

[0014] The reason for this drawback is that existing technologies directly monitor the inference path of the main model. In order to obtain the activation state of discrete neurons, the system must attach monitoring hooks and extract high-dimensional intermediate layer features in real time during the forward propagation of the main model. This inevitably increases memory usage and computational overhead, resulting in increased inference latency on the user side.

[0015] Furthermore, since security detection is highly bound to the parameters of the main model, once the main model is fine-tuned or updated to improve business capabilities, the distribution characteristics of its internal neurons will drift, causing the original defense mechanism to completely fail. This necessitates a costly re-localization and retraining process, resulting in a lack of architectural decoupling.

[0016] 3. It lacks the ability to actively interfere with and mislead automated attack algorithms, making it difficult to defend against gradient-based automated search attacks.

[0017] The reason for this shortcoming is that existing technologies only objectively record the internal state of the model, without changing the model's external optimization surface or feature performance. When attackers use automated algorithms to search for jailbreak commands, the algorithms still look for real weaknesses in the actual gradient space, without constructing "false shortcuts" or "gradient honeypots" within the model to lure the attack algorithm astray. Due to the lack of such proactive trapping and adversarial design, the defender is always in a passive defensive position and cannot intercept the attack through inducement in the early stages. Summary of the Invention

[0018] To address the shortcomings of existing jailbreak detection technologies based on internal neuron monitoring, such as low detection sensitivity, high coupling between defense mechanisms and main business logic, and lack of proactive defense capabilities, this invention proposes a large-scale jailbreak detection method based on discrete neuron features and active trapping using a shadow model. By constructing a master-slave separated shadow model architecture and combining it with an active trapping mechanism based on discrete neuron features, this method achieves highly sensitive detection and interception of covert jailbreak attacks while ensuring that the inference performance and versatility of the main model are not compromised. This significantly improves the robustness and security of the large-scale model system in adversarial environments.

[0019] The large-model jailbreak detection method based on discrete neuron features and shadow model active trapping has the following specific steps:

[0020] Step 1: Build an active trapping jailbreak detection system based on a master-slave dual-stream architecture, comprising four core modules;

[0021] The four core modules are: traffic distribution module, fuse injection module, shadow model detection module, and security decision module.

[0022] The traffic distribution module copies the user's input image and text request into two paths: one path is temporarily stored in the buffer in front of the main model and forcibly blocked; the other path is transformed into a detection copy after image dimension alignment and text segmentation encoding.

[0023] Next, the fuse and the detection copy are combined through the fuse injection module to construct a trap sequence input shadow model detection module with inducing properties. Gradient honeypots are pre-implanted at the positions corresponding to discrete escape neurons in this module. The module receives the trap sequence and performs forward inference. Under the combined action of the fuse and gradient honeypot, malicious features are captured and amplified to obtain the activation value of the escape neurons, which is then output to the security decision module.

[0024] Finally, the security decision module performs a pre-gating judgment: if it determines to block, it directly clears the image and text requests temporarily stored in the buffer and returns a rejection response to the user, while the main model remains silent throughout the process; if it determines to allow, it releases the image and text requests temporarily stored in the buffer to the main model, which then performs normal business reasoning and generates the final response.

[0025] Step 2: User initiates image and text input request Upon entering the traffic distribution module, two physically isolated data streams are formed:

[0026] One path serves as the original business request Temporarily suspended in the asynchronous waiting queue of the main model;

[0027] For the other path, the traffic distribution module handles the request. The transformation involves generating a detection copy based on the requirements of the shadow model's input channel. It is then sent to the fuze injection module.

[0028] During the transformation process, the traffic distribution module performs scaling or normalization preprocessing on the image modality based on the different input resolution or input channel requirements of the shadow model and the main model, and uses the same word segmenter as the main model to process the image and text requests. The text modality is encoded.

[0029] Step 3: The fuze injection module matches the corresponding fuze based on the input type of a physically isolated data stream, and constructs a trap sequence with inducing properties. And send it to the shadow model detection module;

[0030] Specifically:

[0031] First, determine if a fuze matching the input type exists in the pre-set fuze library. If so, use it directly; otherwise, automatically invoke a "globally universal fuze" pre-trained on a massive, general-purpose benign dataset. ”;

[0032] Then, the fuze variables are updated by iteratively solving using the projected gradient descent method. ;

[0033]

[0034] A benign dataset is provided for the offline phase; Represents a single benign sample in a benign dataset; This refers to a specific set of discrete escape neurons in the shadow model detection module. This represents the total number of escaped neurons in the set; For set The index number of a specific escaped neuron in the prison; Indicates the first The activation value of each escaped neuron.

[0035] Finally, the fuse With the detection copy By combining these elements, a trap sequence with inducing properties can be constructed. Its mathematical expression is:

[0036]

[0037] Step 4: Gradient honeypots are pre-implanted at the locations of the discrete escape neurons within the shadow model detection module, and combined with the received trap sequences. Perform forward reasoning and output the activation values ​​of the jailbreak neurons to the security decision module;

[0038] The principle behind gradient honeypot implantation is as follows: During the offline defense fine-tuning phase, a target loss function is introduced to target the preset trap region by modifying the target loss function. The similarity regularization term is applied, and the feature region is applied in the vocabulary output layer of the shadow model detection module. Targeted mapping to a specific hidden trap token;

[0039] The loss function is modified as follows:

[0040]

[0041] in, This represents the standard cross-entropy loss function; This refers generally to the training samples input into the shadow model; Output the actual security label or target; These are the parameters for the shadow model detection module; This represents the mapping function of the shadow model during forward inference; Indicates the shadow model in parameters The feature representation of the output of the corresponding jailbreak neuron layer; The feature vector of the pre-defined trap region; This is the induction coefficient used to control the weight of the similarity regularization term.

[0042] Activation values ​​of escaped neurons The calculation formula is:

[0043]

[0044] In the formula, This represents the weight matrix of the layer containing the escaped neuron; To detect copies Contains hidden malicious features; This represents the bias term of the escaped neuron; This is the preset safety alarm threshold.

[0045] Step 5: The security decision module receives the activation value of the jailbreak neuron, judges the Boolean flag according to the indicator function, and outputs the intercept or allow option to the main model, which then makes the final response.

[0046] Boolean symbol The calculation is as follows:

[0047]

[0048] In the formula, Represents the set collected in real time The maximum value among all transient activation values ​​of escaped neurons.

[0049] The advantages of this invention are:

[0050] 1. Compared to existing technologies that rely on the attack itself to naturally trigger neurons, which are ineffective for weak signals, this invention employs a fuze injection technique. By introducing a decoy fuze, it effectively amplifies the signal in the input space, resulting in extremely high detection sensitivity and a low false negative rate.

[0051] 2. Compared to existing technologies that require attaching monitoring hooks to the main model inference path, which not only increases latency but also tightly couples defense with business operations, this invention adopts a master-slave separated shadow model architecture. It transfers all security detection loads to an independent shadow model, such as dual-stream distribution mechanisms and security decision gating operations. The main model does not need to perform any parameter modifications or additional calculations. It only performs normal inference once after confirming security. This physical isolation ensures that the general inference capability of the main model is not interfered with in any way. Moreover, in interception mode, the main model does not need to participate, which saves the computing resources of the main model. It achieves zero loss in the main model inference.

[0052] 3. Compared to existing technologies that cannot change the optimization surface of the model and are in a passive defensive position, this invention adopts gradient honeypot technology based on discrete distribution characteristics. By implanting virtual traps in the shadow model, the gradient space of the model is artificially distorted. When an attacker uses a gradient-based automated algorithm to search for attack instructions, the algorithm will mistakenly believe that the path to the trap is the shortcut of least resistance. This active inducement mechanism can lock the attacker's optimization process within the pre-set monitoring range of the defender, thereby effectively undermining the effectiveness of automated attack tools and possessing the active inducement capability to counter automated algorithms. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of the large-scale jailbreak detection method based on discrete neuron features and shadow model active trapping, as proposed in this invention.

[0054] Figure 2 This is a flowchart of the large-scale jailbreak detection method based on discrete neuron features and shadow model active trapping according to the present invention; Detailed Implementation

[0055] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are merely some, not all, embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort should fall within the scope of protection of the present invention.

[0056] The technical problem to be solved by this invention:

[0057] (1) Solving the problem of insufficient sensitivity of passive detection:

[0058] Existing technologies rely on the attack itself to trigger the jailbreak neurons, which can easily lead to missed detections for weak or disguised attack signals, such as concealed noise interference. This invention uses a "fuze" mechanism to artificially lower the detection threshold, thereby amplifying and capturing signals with weak malicious characteristics.

[0059] (2) Solve the problem of performance loss of the main model caused by the defense mechanism:

[0060] Existing technologies that attach monitoring or perform security fine-tuning to the main model lead to increased inference latency and reduced general-purpose capabilities. This invention achieves physical isolation through a "shadow model" architecture, ensuring that the main model maintains high performance and zero loss.

[0061] (3) Addressing the problem of weak resistance to automated search attacks:

[0062] Existing technologies cannot alter the optimization surface of the model. This invention constructs a "gradient honeypot" to actively induce attack algorithms to converge to virtual traps, thereby reversing the initiative in defense.

[0063] This invention, based on discrete distribution characteristics, explores a defense scheme combining a shadow detection architecture and active trapping logic. Specifically, it is a large-scale jailbreak detection method based on discrete neuron characteristics and active trapping using a shadow model; such as... Figure 1 and Figure 2 As shown, the specific steps are as follows:

[0064] Step 1: Build an active trapping jailbreak detection system based on a master-slave dual-stream architecture, comprising four core modules;

[0065] The four core modules are: traffic distribution module, fuse injection module, shadow model detection module, and security decision module.

[0066] (1) Traffic distribution module: used to receive users' text and image input requests and copy and distribute them.

[0067] (2) Fuze Injection Module: This module stores a library of trap fuses pre-generated using a gradient optimization algorithm. Its function is to attach specific fuses before the detection request. The mechanism of this module is to artificially lower the activation threshold of the escape neurons in subsequent detection by using fuses, and to significantly amplify the originally weak malicious feature signals through the principle of signal superposition.

[0068] (3) Shadow Model Detection Module: This module deploys a lightweight shadow model that runs parallel to the main model. The shadow model has been specially parameterized, and gradient honeypots have been implanted at the locations of the discrete escape neurons. This module uses gradient honeypots to construct virtual optimization shortcuts, inducing the automated attack algorithm to converge preferentially to the preset trap region. It is responsible for calculating and outputting the activation values ​​of the escape neurons in real time.

[0069] (4) Security Decision Module: Used to receive the detection results of the shadow model. If the activation value exceeds the security threshold, it is determined to be jailbroken, and an interception command is sent to the traffic distribution module, directly returning a rejection response; if it does not exceed the threshold, a release command is sent, releasing the original request in the buffer to the main model for inference.

[0070] The traffic distribution module copies the user's input image and text request into two paths: one path is temporarily stored in the buffer in front of the main model and forcibly blocked; the other path is transformed into a detection copy after image dimension alignment and text tokenizer encoding.

[0071] Next, the fuse and the detection copy are combined through the fuse injection module to construct a trap sequence input shadow model detection module with inducing properties. Gradient honeypots are pre-implanted at the positions corresponding to discrete escape neurons in this module. The module receives the trap sequence and performs forward inference. Under the combined action of the fuse and gradient honeypot, malicious features are captured and amplified to obtain the activation value of the escape neurons, which is then output to the security decision module.

[0072] Finally, the security decision module performs a pre-gating judgment: if it determines to block, it directly clears the image and text requests temporarily stored in the buffer and returns a rejection response to the user, while the main model remains silent throughout the process; if it determines to allow, it releases the image and text requests temporarily stored in the buffer to the main model, which then performs normal business reasoning and generates the final response.

[0073] Step 2: User initiates image and text input request Upon entering the traffic distribution module, in order to achieve physical isolation between the defense mechanism and business logic, this module copies the input requests, forming two physically isolated data streams:

[0074] One path serves as the original business request It is temporarily stored in the asynchronous waiting queue (buffer) of the main model and suspended, waiting for subsequent safety instructions;

[0075] For the other path, the traffic distribution module handles the request. The transformation involves generating a detection copy based on the requirements of the shadow model's input channel. It is then sent to the fuze injection module.

[0076] During the transformation process, the traffic distribution module performs scaling or normalization preprocessing on the image modality based on the different input resolution or input channel requirements of the shadow model and the main model. Since the shadow model is set as a lightweight homologous replacement of the main model (e.g., a knowledge distillation version or a small parameter version of the same series of the main model to ensure that the two have high adversarial transferability in the feature space), the traffic distribution module uses the same tokenizer as the main model to process the image and text requests. The text modality is encoded.

[0077] Step 3: The fuze injection module matches the corresponding fuze based on the input type of a physically isolated data stream, and constructs a trap sequence with inducing properties. And send it to the shadow model detection module;

[0078] Specifically:

[0079] First, search the pre-built fuze library for adversarial prefix fuzes that match the input type. If so, use it directly; otherwise, trigger the fallback strategy and automatically call a "globally universal fuse" that has been pre-trained on a massive general benign dataset. This ensures that the testing process is not interrupted.

[0080] Primer ) is a special token sequence or vector generated through offline inverse gradient optimization. Its special feature is that it is an activation catalyst specifically generated for discrete escape neurons inside the shadow model.

[0081] Then, the maximum value of a specific set of escaped neurons in the shadow model is maximized through iterative solution using the projective gradient descent (PGD) method. The average activation value is used to update the fuze variable. ;

[0082]

[0083] A benign dataset is provided for the offline phase; Represents a single benign sample in a benign dataset; This refers to a specific set of discrete escape neurons in the shadow model detection module. This represents the optimal fuze variable obtained after iterative updating and optimization using the projective gradient descent method. Describes the variable that maximizes the internal expected value. ; Represents the mathematical expectation; This represents the total number of escaped neurons in the set; For set The index number of a specific escaped neuron in the prison; Indicates the first The activation value of each escaped neuron.

[0084] Finally, the fuse With the detection copy By combining these elements, a trap sequence with inducing properties can be constructed. Its mathematical expression is:

[0085]

[0086] In the formula, This indicates a trap sequence with inducing properties; Represents the selected fuse sequence or vector; This represents the detection copy generated in step two; This represents a sequence concatenation operation at the discrete token level or a vector superposition operation at the embedding level.

[0087] The mechanism of the fuse is to artificially raise the baseline activation level of specific escaped neurons within the sub-model, thereby enabling them to process benign inputs. It is currently in a critically sensitive state of "sub-activation". This state can be represented as:

[0088]

[0089] in, The mapping function representing the shadow model. The preset safety alarm threshold, This is a preset safety margin (a very small positive number). Through this warm-up mechanism, the shadow model is placed in a state of high alert, extremely sensitive to malicious features.

[0090] Step 4: Gradient honeypots are pre-implanted at the locations of the discrete escape neurons within the shadow model detection module, and combined with the received trap sequences. Perform forward reasoning and output the activation values ​​of the jailbreak neurons to the security decision module;

[0091] The shadow model is a lightweight model decoupled from the main model architecture. Gradient honeypots are pre-implanted at the locations of discrete escape neurons using parameter editing techniques.

[0092] The principle behind gradient honeypot implantation is as follows: During the offline defense fine-tuning phase of the shadow model, the target loss function is modified to introduce a loss function targeting a pre-defined trap region in addition to the normal cross-entropy loss. The similarity regularization term is applied, and the feature region is applied in the vocabulary output layer of the shadow model detection module. Targeted mapping to a specific hidden trap token;

[0093] The loss function is modified as follows:

[0094]

[0095] in, This represents the overall loss function corrected after introducing gradient honeypots; This represents the standard cross-entropy loss function; This refers generally to the training samples input into the shadow model; Output the actual security label or target; These are the parameters for the shadow model detection module; This represents the mapping function of the shadow model during forward inference; A similarity metric function to activate the feature space; Indicates the shadow model in parameters The feature representation of the output of the corresponding jailbreak neuron layer; The feature vector of the pre-defined trap region; This is the induction coefficient used to control the weight of the similarity regularization term.

[0096] Activation values ​​of escaped neurons The calculation formula is:

[0097]

[0098] In the formula, This represents the mutation activation value generated by the escaped neurons when malicious features are included; Represents the nonlinear activation function (such as ReLU or GELU) inside the shadow model. This represents the weight matrix of the layer containing the escaped neuron; For injection fuse; To detect copies Contains hidden malicious features; This represents the bias term of the escaped neuron; This is the preset safety alarm threshold.

[0099] The shadow model optimized by this loss function has its high-dimensional parameter surface distorted, artificially constructing a false local optimum. When the automated white-box attack algorithm calculates the adversarial gradient... When searching for model vulnerabilities, the gradient vector is forcibly pulled and pointed to the trap region, which is the optimization shortcut built for it.

[0100] How to determine the input during real-time inference? Whether it contains malicious features and the form of its reasoning result are as follows:

[0101] When input Contains hidden malicious features (i.e., carrying an offensive intent) in the fuse The activation value of the escaped neurons is increased by the superposition of the base level boosting effect (bias amplification) and the characteristic resonance induced by the gradient honeypot. The internal nonlinear activation function (such as ReLU or GELU) exhibits an exponential nonlinear surge, thus exceeding the safety threshold:

[0102] The mathematical principle behind this process utilizes the property of a sharp increase in the derivative of a nonlinear activation function near the critical point, thereby enabling the transformation of an originally weak attack signal (i.e., without a fuse) into a signal that is actually weak. The missed alarms are significantly amplified into accurate alarm signals.

[0103] fuse The superposition effect manifests as a bias amplification mechanism, artificially raising the baseline activation level of the escaped neurons within the shadow model to a critical state close to the safety threshold. Under this catalysis, even disguised, covert attacks with extremely subtle features (whose own activation features are very weak), when their weak features are combined with the fuse and input into the model, will cross a sudden point of sharp increase in derivative when passing through the nonlinear activation function inside the neuron, thus generating an exponential nonlinear surge response and breaking through the safety threshold. This allows the defense system to evolve from passive perception to active detection, significantly reducing the false negative rate when facing high-level disguised attacks.

[0104] Step 5: The security decision module receives the activation value of the jailbreak neuron, judges the Boolean flag according to the indicator function, and outputs the intercept or allow option to the main model, which then makes the final response.

[0105] The security decision module collects the set of all discrete escape neurons in a specified level in real time. The instantaneous activation tensor;

[0106] The specified level is a pre-determined set of key layers based on a top-to-bottom equally spaced sampling strategy (e.g., extracting layers 1, 5, 9, 13, etc. of the model) to ensure coverage of multi-dimensional features from shallow lexical semantics to deep security intent.

[0107] This module receives the activation state output by the shadow model as input and performs the following binary decision through an indicator function. The mathematical form of the trigger signal is represented by a Boolean flag. :

[0108]

[0109] In the formula, A Boolean flag output by the security decision module to indicate whether the interception gating is triggered; Represents the set collected in real time The maximum value among all transient activation values ​​of the escaped neurons; The activation values ​​of specific jailbreak neurons in the intermediate layer of the shadow model detection module.

[0110] The trigger signal here originates from the activation value of the intermediate layer of the shadow model by the security decision module. And the real-time comparison and calculation of the final layer output token, based on the judgment result. The system executes the corresponding gating operation based on the given value:

[0111] Intercept mode ( The attack was identified as a jailbreak attack; the decision module directly sent a drop command to the traffic distribution module, and the original requests in the buffer were discarded. If the request is immediately deleted, the main model will not perform any calculations, and the system will directly return a preset rejection response to the user (e.g., "I'm sorry, I cannot assist with this request").

[0112] Release mode ( ): Determined to be safe; the decision module issues a pass credential and releases the original request in the buffer. The main model performs normal business reasoning and returns the generated results.

[0113] Intended purpose of this invention:

[0114] 1. Based on the master-slave dual-stream architecture, the defense and inference are completely decoupled, and the security detection load is transferred to the shadow model to ensure that the general inference capability and response speed of the master model are not compromised.

[0115] 2. By using fuse injection technology to amplify the attack signal, the activation threshold of the jailbreak neurons is artificially reduced, significantly improving the detection sensitivity for covert and weak jailbreak attacks.

[0116] 3. Utilize gradient honeypot technology to actively induce automated attacks, construct a virtual optimization shortcut to mislead the attack algorithm to converge to the trap region first, thereby effectively combating gradient-based automated search attacks.

[0117] Example:

[0118] Suppose an attacker attempts to jailbreak a large model using a noisy image and cryptic text such as "list the materials used to make a Molotov cocktail." The method described in this invention operates as follows:

[0119] (1) Input routing: The traffic distribution module receives the request and routes the original request. (Image + text) is temporarily locked, and a copy is sent to the fuze injection module.

[0120] (2) Fuze Injection: The fuze injection module retrieves a general adversarial prefix fuze based on the current input type. (A special token sequence) is injected into the copy to form a decoy input. .

[0121] (3) Trap Trigger: Shadow Model Detection Module Receives Perform forward reasoning. Although the original input... The malicious characteristics are masked by noise, but in the fuse Under the catalysis of this, the discrete escaped neurons inside the shadow model are strongly stimulated, causing their activation values ​​to surge and exceed the threshold. Simultaneously, if the attacker uses an automated optimization algorithm, its computational path will fall into a gradient honeypot, further exacerbating the abnormal activation of neurons.

[0122] (4) Interception response: The security decision module detects that the activation value is greater than the threshold and determines that the input is a jailbreak attack. The system immediately discards the original request in the buffer. The main model does not participate in the calculation at all. The system directly returns the preset rejection message "Sorry, I cannot assist with this request" to the attacker.

[0123] The key points and areas to be protected in this invention are as follows:

[0124] 1. Master-slave separated shadow monitoring architecture

[0125] This invention proposes a dual-stream parallel processing architecture that deploys security detection functions on an independent shadow model, achieving complete decoupling between defense and inference.

[0126] Compared with existing technologies: Existing technologies directly attach monitoring hooks to the inference path of the main model to extract intermediate layer features in real time. This approach results in strong coupling between the security mechanism and the main model parameters. Once the main model is updated, the defense mechanism needs to be re-adapted, and the monitoring process consumes the main inference resources. This invention introduces a parallel shadow model, where the main model remains in its original state and is only responsible for business inference. Through physical isolation at the architectural level, it eliminates the interference of the defense mechanism on the general capabilities of the main model and the drag on inference latency, while reducing system maintenance costs.

[0127] 2. Sensitivity Enhancement Mechanism Based on Active Fuze Injection

[0128] This invention artificially lowers the activation threshold of the escaped neurons by injecting a specific trapping fuse into the shadow model at the input end, thus putting them in a highly sensitive preheating state.

[0129] Compared with existing technologies: Existing technologies employ a passive monitoring mode, relying entirely on the natural triggering of abnormal activation of escape neurons by attack inputs. They often miss weak, disguised attack signals because the activation values ​​do not reach the threshold. This invention, however, employs an active activation mode, using a fuse as a catalyst to amplify potential weak malicious features in the input within a shadow model. This transforms passive waiting into active preheating, allowing even concealed attacks to trigger significant neuronal responses under the cumulative effect of the fuse, greatly improving detection sensitivity.

[0130] 3. Gradient honeypot construction based on discrete distribution characteristics

[0131] Based on the discrete distribution characteristics of escaped neurons, this invention implants virtual traps at the corresponding positions of the shadow model, constructs a false path with the least resistance, and induces the automated attack algorithm to converge to the traps preferentially.

[0132] Compared to existing technologies: Existing technologies merely objectively record the internal state of the model under attack, unable to alter the model's optimization surface; attackers are still searching for real vulnerabilities. This invention, however, edits specific parameter regions of the shadow model, artificially creating fake vulnerabilities easily searchable by gradient algorithms. Therefore, this invention possesses the proactive capability to counter automated search attacks, guiding the attacker's optimization process to a pre-defined monitoring area, thus achieving preemptive interception.

Claims

1. A large-scale jailbreak detection method based on discrete neuron features and shadow model active trapping, characterized in that, Includes the following steps: First, we built an active trapping jailbreak detection system based on a master-slave dual-stream architecture, which includes four core modules; The four core modules are: traffic distribution module, fuse injection module, shadow model detection module, and security decision module; Then, the traffic distribution module copies the user's input image and text request into two paths: one path is temporarily stored in the buffer in front of the main model and forcibly blocked; the other path is transformed into a detection copy after image dimension alignment and text segmentation encoding. Next, the fuse injection module matches the fuse and the detection copy to form a trap sequence input shadow model detection module with inducing properties. The module pre-implants gradient honeypots at the positions corresponding to discrete escape neurons, receives the trap sequence for forward reasoning, and captures and amplifies malicious features under the combined action of the fuse and gradient honeypots to obtain the activation value of the escape neurons and output it to the security decision module. Finally, the security decision module performs a pre-gating judgment: if the judgment is to block, it directly clears the image and text requests temporarily stored in the buffer and returns a rejection response to the user, while the main model remains silent throughout the process; If the request is approved, the image and text requests temporarily stored in the buffer are released to the main model, which then performs normal business reasoning and generates the final response.

2. The method as described in claim 1, characterized in that, The traffic distribution module will receive the input image and text requests. This creates two physically isolated data streams: One path serves as the original business request Temporarily suspended in the asynchronous waiting queue of the main model; For the other path, the traffic distribution module handles the request. The transformation involves generating a detection copy based on the requirements of the shadow model's input channel. It is then sent to the fuze injection module.

3. The method as described in claim 2, characterized in that, During the conversion process, the traffic distribution module performs scaling or normalization preprocessing on the image modality based on the different input resolution or input channel requirements of the shadow model detection module and the main model, and uses the same word segmenter as the main model to process the image and text requests. The text modality is encoded.

4. The method as described in claim 2, characterized in that, The specific working process of the fuze injection module is as follows: First, determine if a fuze matching the input type exists in the pre-set fuze library. If so, use it directly; otherwise, automatically invoke a "globally universal fuze" pre-trained on a massive, general-purpose benign dataset. ”; Then, the fuze variables are updated by iteratively solving using the projected gradient descent method. ; A benign dataset is provided for the offline phase; Represents a single benign sample in a benign dataset; This refers to a specific set of discrete escape neurons in the shadow model detection module. This represents the total number of escaped neurons in the set; Indicates the first The activation values ​​of the escaped neurons; Finally, the fuse With the detection copy By combining these elements, a trap sequence with inducing properties can be constructed. Its mathematical expression is: This represents a sequence concatenation operation at the discrete token level or a vector superposition operation at the embedding level.

5. The method as described in claim 4, characterized in that, The principle behind embedding gradient honeypots within the shadow model detection module is as follows: During the offline defense fine-tuning phase, a target loss function is introduced to address the preset trap area by modifying the target loss function. The similarity regularization term is applied, and the feature region is applied in the vocabulary output layer of the shadow model detection module. Targeted mapping to a specific hidden trap token; The loss function is modified as follows: in, This represents the standard cross-entropy loss function; Generally refers to the training samples input into the shadow model; Output the actual security label or target; These are the parameters for the shadow model detection module; This represents the mapping function of the shadow model detection module during forward inference; A similarity metric function to activate the feature space; Indicates the shadow model in parameters The feature representation of the output of the corresponding jailbreak neuron layer; The feature vector of the pre-defined trap region; This is the induction coefficient used to control the weight of the similarity regularization term; Activation values ​​of escaped neurons The calculation formula is: In the formula, This represents the non-linear activation function within the shadow model detection module; This represents the weight matrix of the layer containing the escaped neuron; To detect copies Contains hidden malicious features; This represents the bias term of the escaped neuron; This is the preset safety alarm threshold.

6. The method as described in claim 4, characterized in that, The security decision module determines the Boolean flag based on the indication function and outputs the option to intercept or allow to the main model. The calculation is as follows: In the formula, Represents the set collected in real time The maximum value among all transient activation values ​​of escaped neurons.

Images