A large model-oriented dynamic adversarial defense and traceable content generation method and system

Abstract

This invention relates to a dynamic adversarial defense and traceable content generation method and system for large-scale models. It receives multimodal requests, extracts basic features, and detects them using a first detector. Based on the output results, it performs semantic and structural analysis on the requests to identify attack types and risk levels. It then performs multimodal cleanup and / or causal intervention operations on the request content, or directly inputs the requests into the core large-scale model content generation. During decoding, a modulation signal is generated and superimposed on the model's hidden state to embed an implicit watermark. The generated content undergoes compliance checks, and metadata is associated with it. An attack knowledge graph is analyzed and constructed, and the first detector or core large-scale model is optimized and updated based on the analysis results. The system includes a request access and rapid detection module, an analysis and dynamic cleanup module, a secure generation and implicit watermark embedding module, an output post-processing and metadata association module, and a security intelligence collection and closed-loop evolution module.

Description

Technical Field

[0001] This invention relates to the technical field of electronic digital data processing, and in particular to a method and system for dynamic adversarial defense and traceable content generation for large models. Background Technology

[0002] With the rapid development of deep learning technology, large-scale language models (LLMs) and their multimodal extensions have demonstrated powerful capabilities in numerous fields such as text generation, code writing, and visual understanding, and are gradually becoming core components of artificial intelligence infrastructure. However, the widespread application of large models has also brought severe security challenges, placing higher demands on the security defense system for large models. Current mainstream large model security defense solutions generally suffer from deep-seated bottlenecks in their system architecture, including "static response, capability fragmentation, and conflicting objectives," specifically manifested in the following aspects: First, the static response dilemma: existing defense mechanisms mainly rely on predefined rule bases, fixed threshold anomaly detection, or discriminative models trained based on known attack patterns. These static defense methods are essentially post-event remedial measures, and their effectiveness depends heavily on prior knowledge of the attack samples. However, adversarial attack technologies evolve rapidly. When lacking the ability to learn dynamically and evolve adaptively, the defender is always in a passive position and finds it difficult to cope with zero-day attacks or variant attacks. Second, the current state of capability fragmentation; the security protection of large-scale models involves multiple technical dimensions, including detection, purification, source tracing, and enhancement. However, in existing technologies, these technologies are usually implemented by independent modules or third-party tools, forming security silos. There is a lack of standardized data interfaces and collaboration mechanisms between modules, which not only leads to a bloated system architecture and high operational complexity, but also makes it difficult for threat intelligence to form a closed loop, seriously restricting the improvement of overall defense effectiveness. Third, inherent conflicting goals, including: The contradiction between accuracy and efficiency: High-precision deep detection models can effectively identify complex attacks, but their inference latency is usually as high as hundreds of milliseconds (>500ms), which is difficult to meet the needs of real-time interactive scenarios. On the other hand, lightweight detection models have low latency (<10ms), but their false negative rate increases significantly when faced with cleverly designed adversarial examples, rendering the security defense line ineffective. The trade-off between robustness and accuracy: To enhance the robustness of models against adversarial attacks, existing technologies generally employ adversarial training methods. However, this will simultaneously lead to a 3% to 15% decrease in the model's accuracy on normal data. The impossibility triangle of watermark concealment, robustness, and reversibility: Existing watermarking technologies struggle to simultaneously meet the requirements of watermarks being imperceptible, resistant to modification, and destructively removable.

[0003] In summary, existing large-scale model security defense solutions have fundamental flaws at the system architecture level. There is an urgent need for a new technical solution that can achieve dynamic adversarial defense, capability synergy, and balance multiple objectives to address the increasingly complex security challenges of large-scale models. Summary of the Invention

[0004] This invention solves the problems existing in the prior art and provides a method and system for dynamic adversarial defense and traceable content generation for large models.

[0005] The technical solution adopted in this invention is a method for dynamic adversarial defense and traceable content generation for large models, comprising the following steps: S1 receives the user's multimodal request, extracts basic features, detects them with the first detector, and executes S2 or S3 based on the output results; S2 performs semantic and structural analysis on the request, identifies the attack type and risk level, and performs multimodal cleanup and / or causal intervention operations on the request content based on the analysis results; S3 takes the current request as input to the core big model to generate content. During the decoding process of the content generated by the model, it generates a modulation signal, which is superimposed on the hidden state of the model to embed an implicit watermark. S4 performs compliance checks on the generated content and associates it with metadata containing watermark key digests and traceability information. S5 collects detection logs, attack samples, and cleanup data, analyzes and constructs an attack knowledge graph, and optimizes and updates the first detector or core model based on the analysis results.

[0006] Preferably, the first detector is a hybrid structure network trained based on meta-course learning; The hybrid structure network includes a convolutional neural network branch for extracting spatial features of images and a Transformer encoder branch for extracting text sequence features. The features requested by the multimodal requests are extracted by the corresponding branches and then fused and input into the fully connected layer to output anomaly scores. During the course learning phase, training is conducted in stages according to the attack complexity, from easy to difficult, and a foundation is established. In the meta-learning phase, a meta-task containing known and simulated unknown attack types is constructed, and a model-independent meta-learning algorithm is used to optimize the initialization parameters of the first detector.

[0007] Preferably, in the multimodal purification operation of S2, For image modalities, a lightweight diffusion model is activated to perform a preset number of denoising and reconstruction steps; For text modalities, a secure rewriting model based on an encoder-decoder architecture is used to rewrite potentially malicious inputs into secure text that retains the original meaning but eliminates malicious instructions, guided by security constraint vectors.

[0008] Preferably, in the causal intervention operation of S2, a vulnerable attention head mapping table is identified and maintained, which is obtained based on the neuron contribution attribution analysis of historical successful attack samples; For requests deemed high-risk, the output of the corresponding attention head is dynamically suppressed based on the mapping table during core model inference.

[0009] Preferably, in S3, the input request is semantically encoded to obtain a content semantic vector; Extract the model fingerprint vector from the current layer weights of the core large model; Map the external key to a key vector; The content semantic vector, model fingerprint vector, and key vector are fused and then subjected to nonlinear transformation and adaptive scaling to generate a conditional modulation vector.

[0010] Preferably, the hidden state of the Lth layer of the core large model and the conditional modulation vector are input together into the reversible neural network module. The forward transformation of this module outputs the modulated hidden state with embedded implicit watermark for subsequent decoding.

[0011] Preferably, in S5, attack entities and their relationships are extracted from the interception logs and attack payloads through structured parsing and pre-trained language models; attack events are used as central nodes, and associated attack methods, targets, and payload characteristics are used as entities or attributes, stored in a graph database to form a visualized attack evolution graph, which is an attack knowledge graph.

[0012] Preferably, in S5, based on the attack knowledge graph, high-frequency attack patterns and their targeted model functional domains are identified, and a subset of vulnerable parameters in the core large model that are strongly correlated with the functional domain is located. Construct a fine-tuned dataset containing corresponding attack samples and clean samples within the domain; Sparse-oriented adversarial fine-tuning is performed only on the subset of the vulnerable parameters.

[0013] Preferably, in S5, the generated policy update package is digitally signed, and after verifying the legality of the signature and the credibility of the source on the deployment end, the update is gradually pushed out using a canary release strategy; the key system indicators after the update are monitored in real time, and a rollback to the historical version is automatically triggered when the indicators are abnormal.

[0014] A dynamic adversarial defense and traceable content generation system for large-scale models includes: The access request and rapid detection module is used to receive multimodal requests from users, extract basic features, detect them with the first detector, and trigger subsequent processing based on the output results. The analysis and dynamic purification module is used to perform semantic and structural analysis on the request, identify attack types and risk levels, and perform multimodal purification operations and / or causal intervention operations on the request content based on the analysis results. The secure generation and implicit watermark embedding module is used to input the cleaned request or the request that has been quickly detected as secure into the core big model for content generation. During the decoding process of the content generated by the model, a conditional modulation vector is generated, and the conditional modulation vector is reversibly transformed with the hidden state of the Lth layer of the model through the reversible neural network module to embed the implicit watermark. The output post-processing and metadata association module is used to perform compliance checks on the generated content and associate it with generated metadata containing watermark key digests and traceability information. The security intelligence gathering and closed-loop evolution module is used to collect detection logs, attack samples and cleanup data, analyze and build an attack knowledge graph, and optimize and update the first detector or core big model based on the analysis results.

[0015] This invention relates to a dynamic adversarial defense and traceable content generation method and system for large-scale models. It receives multimodal requests from users, extracts basic features, and detects them using a first detector. Based on the output, it performs semantic and structural analysis on the requests to identify attack types and risk levels. According to the analysis results, it performs multimodal cleanup and / or causal intervention operations on the request content, or directly inputs the current request into a core large-scale model for content generation. During the decoding process of the model-generated content, a modulation signal is generated and superimposed on the model's hidden state to embed an implicit watermark. The generated content undergoes compliance checks, and metadata containing watermark key digests and traceability information is generated. Detection logs, attack samples, and cleanup data are collected, analyzed, and an attack knowledge graph is constructed. Based on the analysis results, the first detector or core large-scale model is optimized and updated in a targeted manner. The system includes a request access and rapid detection module, an analysis and dynamic cleanup module, a secure generation and implicit watermark embedding module, an output post-processing and metadata association module, and a security intelligence collection and closed-loop evolution module.

[0016] The beneficial effects of this invention are as follows: (1) Through a closed-loop evolution mechanism driven by security intelligence, discrete attack events are transformed into a structured attack knowledge graph. Based on the analysis results, the first detector or core big model is optimized and updated in a targeted manner. It has the ability to perceive in real time, adjust dynamically and continuously enhance itself, thus breaking the dilemma of static defense. According to actual tests, the system's weekly average defense success rate increased from about 60% to stabilize at over 95% within two weeks. The abnormal response rate caused by adversarial attacks decreased by more than 92%, significantly improving the defense effectiveness against new types of attacks. (2) The present invention adopts a cascaded architecture of lightweight feature sentinel and meta-course learning detection core, which ensures detection accuracy while keeping latency at an extremely low level. The former can complete the first round of feature extraction within 5~8ms and only triggers deep analysis for suspicious requests. In the AdvGLUE benchmark test, the system achieved an F1 score of 98.7%, and the latency increase of 95% of normal request processing did not exceed 9ms. It successfully achieved a balance between high-precision detection and real-time response performance, solving the technical problem that it is difficult to achieve both accuracy and efficiency in traditional solutions. (3) Based on attack knowledge graph analysis, the specific layers or parameter subsets that are frequently used by attacks in the model are accurately located, and targeted adversarial fine-tuning is performed only on these vulnerable parameters to avoid performance loss caused by global parameter perturbation. Experiments show that the method improves the robustness of the model by 18% on the ImageNet-C benchmark, while the original ImageNet accuracy does not decrease but increases by 0.8%, achieving simultaneous optimization of robustness enhancement and normal performance improvement for the first time. (4) Apply micro-perturbations related to content semantics, model fingerprint, and external key to the latent variables of the generative model decoder, and realize watermark embedding through the reversible neural network module to satisfy the FID value of the watermark and the original content to be indistinguishable and imperceptible. After JPEG 50 compression, the watermark extraction accuracy is still higher than 99%, which has strong robustness. The licensor can use the inverse key to recover the original content without loss. The PSNR exceeds 50dB, successfully solving the long-standing "impossible triangle" problem of watermark technology. (5) This invention constructs a complete closed-loop evolutionary link. This closed-loop mechanism transforms discrete adversarial attack events into structured knowledge that drives system evolution, enabling security capabilities to possess a continuously self-enhancing lifecycle characteristic. Establishing a closed-loop evolutionary link enables continuous enhancement of security capabilities. Attached Figure Description

[0017] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a flowchart of the first detector trained based on meta-course learning in this invention; Figure 3 This is a schematic diagram of the device structure in this invention; Figure 4This is a full-process timing diagram of the intelligent customer service financial security scenario in this invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This invention relates to a dynamic adversarial defense and traceable content generation method for large models. First, it should be noted that the core large model in this invention can be any generative pre-trained large model based on the Transformer architecture. This embodiment uses a standard Transformer decoder as an example. The method includes the following steps: S1 receives the user's multimodal request, extracts basic features, detects them with the first detector, and executes S2 or S3 based on the output results; S2 performs semantic and structural analysis on the request, identifies the attack type and risk level, and performs multimodal cleanup and / or causal intervention operations on the request content based on the analysis results; S3 takes the current request as input to the core big model to generate content. During the decoding process of the content generated by the model, it generates a modulation signal, which is superimposed on the hidden state of the model to embed an implicit watermark. S4 performs compliance checks on the generated content and associates it with metadata containing watermark key digests and traceability information. S5 collects detection logs, attack samples, and cleanup data, analyzes and constructs an attack knowledge graph, and optimizes and updates the first detector or core model based on the analysis results.

[0020] The above steps will be further explained below with reference to specific embodiments.

[0021] S1 receives the user's multimodal request, extracts basic features, detects them with the first detector, and executes S2 or S3 based on the output results; The request can be plain text, a single image, or a text-image hybrid input. Here, a lightweight feature extraction network (a depthwise separable convolutional network is used in this embodiment) is used to extract basic features from the input, and the time taken is controlled within 3-5ms.

[0022] The first detector is a hybrid structure network trained based on meta-curriculum learning; The hybrid structure network includes a convolutional neural network branch for extracting spatial features of images and a Transformer encoder branch for extracting text sequence features. The features requested by the multimodal requests are extracted by the corresponding branches and then fused and input into the fully connected layer to output anomaly scores. Specifically, the convolutional neural network branch uses a 4-layer convolutional neural network to extract image spatial features and finally outputs an image feature vector; the Transformer encoder branch uses a 3-layer Transformer encoder to extract text sequence features and finally outputs a text feature vector; for multimodal requests, the image feature vector and the text feature vector are concatenated to obtain the fused feature; for single-modal requests, only the features of the corresponding branch are used, the fused feature is input to the fully connected layer, and the anomaly score vector is output. The L2 norm of the anomaly score vector is calculated and compared with a preset threshold θ. In this embodiment, θ is set to 0.15. If the L2 norm of the anomaly score is lower than the threshold θ, the request is determined to be safe, and the process jumps directly to step S3; otherwise, the request is determined to be suspicious, and the process enters the deep analysis process S2. Correspondingly, in actual deployment, the preset threshold θ can be dynamically configured according to factors such as the security level requirements of the business scenario, the frequency of historical attacks, or the user's trust level. For example, the threshold can be lowered in high-security scenarios such as finance to improve the detection rate, and the threshold can be appropriately raised in low-sensitivity scenarios such as dialogue to reduce false alarms. At the same time, global control can be intervened. Specifically, based on the attack trends fed back by the security intelligence center, θ is automatically adaptively adjusted. For example, when a new type of attack is detected, the threshold is automatically lowered by 10% to increase sensitivity, and when the false alarm rate increases, the threshold is automatically adjusted back to the equilibrium point.

[0023] During the course learning phase, training is conducted in stages according to the attack complexity, from easy to difficult, and a foundation is established. In the meta-learning phase, a meta-task containing known and simulated unknown attack types is constructed, and a model-independent meta-learning algorithm is used to optimize the initialization parameters of the first detector.

[0024] In this invention, "meta-curriculum learning" is an organic combination of two training strategies, "meta-learning" and "curriculum learning," and is a hybrid method for training the first detector.

[0025] Specifically, the course learning phase is divided into stages based on the complexity of the attacks, from easy to difficult, progressing from significant perturbations to subtle semantic attacks, gradually improving the detector's discriminative stability and establishing a robust foundation. Each stage involves training with a mix of normal samples and corresponding attack samples; that is, in this stage, when training the detector, it is first taught to recognize simple attacks with obvious perturbations (such as pixel noise), and then it learns complex attacks at the semantic level (such as text rewriting). The meta-learning stage employs the Model-Independent Meta-Learning (MAML) algorithm for training, aiming to optimize the detector's initialization parameters so that it can quickly adapt to new attack tasks with small sample sizes. During the process, a large number of "meta-tasks" containing known attacks and simulated unknown attacks are constructed for training, allowing the detector to find a "good initialization position." In this way, when encountering a completely new and never-before-seen attack type, the detector only needs a very small number of samples (e.g., 10-20) and a small amount of gradient updates to quickly learn to recognize this new attack.

[0026] During the meta-learning training phase, a large number of "attack detection tasks" (meta-task construction) are constructed, each task simulating the distribution of a type of attack. The construction method is as follows: Sample a batch of data from a clean dataset; Use a specific attack algorithm (such as FGSM, PGD, TextFooler) to generate adversarial examples as positive examples; Mix a large number of normal samples as negative examples.

[0027] To simulate unknown attacks, several attack types are retained during training and not used in the construction of the meta-task. Instead, they are used to verify the generalization and rapid adaptation capabilities of the meta-learner. During online deployment, when the system detects a small number of samples (e.g., 10-20) that are suspected of being new attacks, they are used as the support set to initiate a rapid adaptation process. The backbone network of the detector (CNN and Transformer branches) is fixed, and only the classification head (fully connected layer) is updated with a small number of gradients (e.g., 5 steps). The adapted detector is immediately evaluated on a small validation set (composed of recent normal samples and known attack samples). If its detection accuracy for new attacks is significantly improved (e.g., from <50% to >85%), and the false positive rate for known attacks and normal samples remains stable, then the adaptation is considered successful. The system records the adapted parameters, evaluation results, and the sample features that triggered the adaptation and feeds them back to the security intelligence center for subsequent analysis and strategy optimization, forming a closed-loop evolution of detection capabilities.

[0028] The “rapid adaptation mechanism” is a natural extension of the “meta-curriculum learning” training method in the online deployment phase; this mechanism reflects the detector’s real-time adaptive capability in response to unknown attacks.

[0029] S2 performs deep semantic and structural analysis on the request, identifies the attack type and risk level, and performs multimodal cleanup and / or causal intervention operations on the request content based on the analysis results; For requests entering the S2 deep analysis process, they are first sent to the deep analysis module for semantic and structural analysis. In this embodiment, a small Transformer encoder (6 layers, 512 hidden dimensions) is used for analysis, outputting the attack type (such as FGSM, PGD, TextFooler, etc.) and risk level (low, medium, high). This process takes about 20-50ms. Based on the analysis results, multimodal sanitization and / or causal intervention operations are performed on the request content. In the multimodal purification operation of S2 For image modalities, a lightweight diffusion model is initiated to perform a preset number of denoising and reconstruction steps. This embodiment adopts a depthwise separable convolutional U-Net architecture (with 1 / 4 the number of parameters of the standard U-Net) and uses the DDIM (Denoising Diffusion Implicit Models) sampling algorithm. High-quality reconstruction can be obtained in only 3-5 steps. This process can effectively project adversarial examples back to a clean data manifold, making the structural similarity (SSIM) between the cleaned (reconstructed) image and the original image greater than 0.98. For the text modality, a secure rewriting model based on an encoder-decoder (BART-large) architecture is used. Guided by (learnable) security constraint vectors, potentially malicious inputs are rewritten into secure text that retains the original meaning but eliminates malicious instructions. Specifically, the security constraint vectors are initialized through learnable "security hints" embeddings and optimized during training. Parallel corpora (malicious hints and secure responses) are used for training. The training objective is to minimize the negative log-likelihood of the secure responses, while maximizing the semantic difference between malicious instructions and generated content through an additional discriminator loss. This model can effectively eliminate malicious instructions and generate secure text content while preserving the user's original intent.

[0030] In the causal intervention operation of S2, a vulnerable attention head mapping table is identified and maintained, which is obtained based on the neuron contribution attribution analysis of historical successful attack samples; In practical applications, the system periodically (e.g., daily) performs neuron activation attribution analysis on all successful attacks (i.e., requests that bypassed initial detection and resulted in harmful output) within the past 24 hours. Specifically, it employs the integrated gradient method to calculate the contribution of the output of each attention head in each layer of the core model to the final harmful decision. It accumulates the contributions of all successful attack samples, sorts each attention head, and marks the top k attention heads with the highest contributions (e.g., k=5) as "vulnerable attention heads," forming a vulnerable attention head mapping table.

[0031] For requests deemed high-risk, during core model inference, the output of the corresponding attention head is dynamically suppressed according to the mapping table. Specifically, the system loads the current vulnerable attention head mapping table in real time. When the model propagates forward to the layer and head recorded in the table, the output weight matrix Attention_Output of that attention head is replaced with β*Attention_Output+(1-β)*Baseline_Vector, where β is a decay factor, which is 0.1 in this embodiment. Baseline_Vector is a learnable baseline vector used to retain basic information flow while suppressing abnormal patterns. It is dynamically adjusted as the model and attack patterns change, thereby dynamically suppressing the output of the "vulnerable attention head" marked by the attack attribution analysis, avoiding performance collapse of the model on normal tasks due to simply and crudely "cutting off" the attention head.

[0032] S3 takes the current request as input to the core big model to generate content. During the decoding process of the content generated by the model, it generates a modulation signal, which is superimposed on the hidden state of the model to embed an implicit watermark. In S3, "current request" refers to a request that has been cleansed by S2 or a security request that jumps directly from S1. In S3, the input request is semantically encoded to obtain a semantic content vector; Extract the model fingerprint vector from the current layer weights of the core large model; Map the external key to a key vector; The content semantic vector, model fingerprint vector, and key vector are fused and then subjected to nonlinear transformation and adaptive scaling to generate a conditional modulation vector.

[0033] The hidden state of the Lth layer of the core large model and the conditional modulation vector are input into the reversible neural network module. The forward transformation of this module outputs the modulated hidden state with embedded implicit watermark, which is used for subsequent decoding.

[0034] During the decoding process of the model-generated content, when the calculation reaches the preset L-th layer (in this embodiment, the 10th layer of the Transformer decoder is selected), a watermark embedding operation is performed. By reading the hidden state z_L of this layer, a modulation signal Δz is dynamically generated based on the content semantics, model fingerprint, and external key. Specifically, a lightweight text encoder (such as a distilled version of Sentence-BERT) is used to encode the input request c into a content semantic vector E(c). The model fingerprint vector W_s is extracted from the current layer weights of the core large model, and the 128-bit external key K is mapped into a key vector. After fusing the three, a nonlinear transformation is performed, and adaptive scaling is applied using the standard deviation σ(z_L) of the feature dimension of z_L to obtain the modulation signal Δz, which satisfies the following conditions. Δz = α * σ(z_L) * tanh(MLP(concat[E(c), W_s, K])) Finally, Δz is superimposed on z_L to obtain z'_L = z_L + Δz, thus embedding an implicit watermark. The modulated z'_L replaces the original z_L in subsequent decoding until the final content is generated.

[0035] The watermark embedding process is implemented by a reversible neural network (INN) module, which consists of multiple stacked coupling layers to ensure that the entire embedding transformation is bijective. The licensor holds the inverse key K_inv and can run the inverse transformation of this module to accurately recover the original hidden variables from the watermarked content or intermediate hidden states. For the generated watermarked content, the licensor extracts the watermarked hidden states from the watermarked content, uses the inverse key K_inv to run the inverse transformation of the INN module, accurately recovers the original hidden states, and then decodes the watermark-free version that is bit identical to the original content. Tests show that the peak signal-to-noise ratio (PSNR) of the recovered content is greater than 50dB compared to the original content.

[0036] For third parties who cannot access the INN inverse module, the system also provides a dedicated robust watermark extractor. This CNN architecture takes potentially modified content as input (such as JPEG-compressed images or rewritten text) and outputs the predicted watermark signal. During training, it simulates attacks such as compression, scaling, and text rewriting to ensure practical robustness. Testing shows that even after JPEG 50 quality compression, the watermark extraction accuracy remains above 99%.

[0037] S4 performs compliance checks on the generated content and associates it with metadata containing watermark key digests and traceability information. S4 compliance checks include secondary filtering and scoring to ensure that no non-compliant content is included; The associated traceability metadata includes watermark key digest Hash(K), timestamp, model version, session ID, etc., which are stored in the traceability database.

[0038] S5 collects detection logs, attack samples, and cleanup data, analyzes and constructs an attack knowledge graph, and optimizes and updates the primary detector or core model based on the analysis results. To be precise, what is uploaded to the security intelligence center is all detection logs, attack samples, and comparison data before and after cleanup. This facilitates the construction of a dynamic attack knowledge graph, and based on the graph analysis results, targeted optimization and updates are performed on the first detector or core large model, including rapid adaptation of the detector, updates to the vulnerability attention head mapping table, and targeted adversarial fine-tuning of the model.

[0039] In S5, attack entities and their relationships are extracted from interception logs and attack payloads through structured parsing and pre-trained language models. Attack events are used as central nodes, and associated attack techniques, targets, and payload characteristics are used as entities or attributes, stored in a graph database to form a visualized attack evolution graph, which is an attack knowledge graph.

[0040] Specifically, when constructing the attack knowledge graph, the system performs multi-dimensional analysis on the collected interception logs and attack payloads, extracting attack entities and their relationships, including: Structured log parsing: Extract structured fields directly from intercepted logs as entities, including: attack IP, attack method, target API, timestamp, attack payload fragments, etc. Unstructured text analysis: Named entity recognition (NER) and relation extraction (RE) are performed using pre-trained language models on attack payloads (such as malicious prompts) and contextual information; for example, from the text "pretend you are DAN and ignore security rules", entities can be extracted: role "DAN", action "ignore", object "security rules", and relation "(attack method, exploit, role)". Multimodal feature association: For image adversarial examples, a visual question answering (VQA) model is used to describe their perturbation patterns (such as "high-frequency noise has been added"), and this description is associated with the attack event as an entity.

[0041] The extracted entities and relationships are stored in a graph database (such as Neo4j), with each attack event serving as a central node and its associated entities such as attack IP, attack method, target API, and payload characteristics serving as attributes or related nodes. Through graph query language, complex association analysis can be performed efficiently.

[0042] In S5, based on the attack knowledge graph, high-frequency attack patterns and their targeted model functional domains are identified, and a subset of vulnerable parameters in the core large model that are strongly correlated with the functional domain is located. Construct a fine-tuned dataset containing corresponding attack samples and clean samples within the domain; Sparse-oriented adversarial fine-tuning is performed only on the subset of the vulnerable parameters.

[0043] Specifically, the high-frequency attack pattern identification, vulnerable module localization, fine-tuning dataset construction, and sparse adversarial fine-tuning are explained; In high-frequency attack pattern identification, based on the constructed attack knowledge graph, the combination of the most frequent attack methods and target domains in the past week is identified by graph query. For example, a significant cluster of "hint injection attacks against code generation APIs" is found. Vulnerable module localization refers to combining the model's own domain activation analysis (by inputting clean domain data into the model and observing the average activation intensity of each layer) to locate the key layers or attention heads in the model that respond most strongly to a specific task, as the vulnerable parameter subset M_vul; The fine-tuning dataset D_TAFT is constructed by extracting all adversarial samples belonging to the attack cluster from the knowledge base as positive examples and sampling clean data from the corresponding domain as negative examples. In the sparsity adversarial fine-tuning, parameter freezing is first performed, locking all weights in the core model except for those corresponding to M_vul, while only unlocking the parameters in M_vul; the total loss is then designed. L = L_task + λ * L_adv; Where L_task is the original task loss of the model on clean data, L_adv is the adversarial training loss (such as using PGD to generate adversarial examples and minimizing their loss), and λ is the balance coefficient. Use D_TAFT for 3-5 rounds of fine-tuning, evaluate on the retained validation set, ensuring a significant improvement in robustness in the attacked domain, while the performance degradation in other unrelated domains does not exceed 0.5%. After successful validation, update the parameters corresponding to M_vul and deploy online.

[0044] In S5, the generated policy update package is digitally signed. After verifying the legality of the signature and the credibility of the source on the deployment side, the update is gradually pushed out using a canary release strategy. The system's key indicators after the update are monitored in real time, and a rollback to the historical version is automatically triggered when the indicators are abnormal.

[0045] Specifically, the hot update mechanism in this invention includes: Digital signatures and version control: All policy update packages, including detection model parameters, purification rules, and vulnerable header mapping tables, are digitally signed with the developer's private key before release; the deployment end verifies the signature with the corresponding public key before receiving and applying the update to ensure that the source is trustworthy and has not been tampered with. At the same time, strict version number management is adopted to support quick rollback to any historical stable version. Sandbox Validation and Canary Release: Before a major update is fully rolled out, it is first tested in a sandbox isolated from the production environment using the latest attack sample library. After the test is passed, a canary release strategy is adopted to first push it to a small portion of traffic (such as 5%) to observe the effect. After confirming that there are no problems, the scope is gradually expanded. Anomaly monitoring and automatic rollback: The system continuously monitors key metrics after updates, such as detection rate, false alarm rate, and service latency. If a metric shows significant anomalies, such as a false alarm rate soaring above a threshold, the system automatically triggers a rollback mechanism to restore to the previous version and issues an alert.

[0046] This invention also relates to a dynamic adversarial defense and traceable content generation system for large models, comprising: The access request and rapid detection module is used to receive multimodal requests from users, extract basic features and detect them with the first detector, and trigger subsequent processing based on the output results; specifically, the first detector outputs an anomaly score based on the basic features. If the anomaly score is lower than a preset threshold, the security generation module is triggered; otherwise, the analysis and dynamic purification module is triggered. The analysis and dynamic purification module is used to perform semantic and structural analysis on the request, identify attack types and risk levels, and perform multimodal purification operations and / or causal intervention operations on the request content based on the analysis results. The secure generation and implicit watermark embedding module is used to input the cleaned request or the request that has been quickly detected as secure into the core big model for content generation. During the decoding process of the content generated by the model (based on content semantics, model fingerprint and external key dynamics), a conditional modulation vector is generated. The conditional modulation vector is then reversibly transformed with the hidden state of the Lth layer of the model through the reversible neural network module to embed the implicit watermark. The output post-processing and metadata association module is used to perform compliance checks on the generated content and associate it with generated metadata containing watermark key digests and traceability information. The security intelligence gathering and closed-loop evolution module is used to collect detection logs, attack samples and cleanup data, analyze and build an attack knowledge graph, and optimize and update the first detector or core big model based on the analysis results.

[0047] The modules communicate with each other through real-time data streams and control streams, forming a complete closed loop to achieve collaborative work between dynamic countermeasures and defense and the generation of traceable content.

[0048] like Figure 4 As shown, a complete case study of a smart customer service financial security scenario involving attack, defense, tracing, and evolution is presented, demonstrating the working sequence of the method and device of this invention in actual business.

[0049] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0050] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0051] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0052] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0053] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0054] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for dynamic adversarial defense and traceable content generation for large-scale models, characterized in that: Includes the following steps: S1 receives the user's multimodal request, extracts basic features, detects them with the first detector, and executes S2 or S3 based on the output results; S2 performs semantic and structural analysis on the request, identifies the attack type and risk level, and performs multimodal cleanup and / or causal intervention operations on the request content based on the analysis results; S3 inputs the current request into the core big model to generate content. During the decoding process of the content generated by the model, a modulation signal is generated and superimposed on the hidden state of the model to embed an implicit watermark. S4 performs compliance checks on the generated content and associates it with metadata containing watermark key digests and traceability information. S5 collects detection logs, attack samples, and cleanup data, analyzes and constructs an attack knowledge graph, and optimizes and updates the first detector or core model based on the analysis results.

2. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: The first detector is a hybrid structure network trained based on meta-curriculum learning; The hybrid structure network includes a convolutional neural network branch for extracting spatial features of images and a Transformer encoder branch for extracting text sequence features. The features requested by the multimodal requests are extracted by the corresponding branches and then fused and input into the fully connected layer to output anomaly scores. During the course learning phase, training is conducted in stages according to the attack complexity, from easy to difficult, and a foundation is established. In the meta-learning phase, a meta-task containing known and simulated unknown attack types is constructed, and a model-independent meta-learning algorithm is used to optimize the initialization parameters of the first detector.

3. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In the multimodal purification operation of S2 For image modalities, a lightweight diffusion model is activated to perform a preset number of denoising and reconstruction steps; For text modalities, a secure rewriting model based on an encoder-decoder architecture is used to rewrite potentially malicious inputs into secure text that retains the original meaning but eliminates malicious instructions, guided by security constraint vectors.

4. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In the causal intervention operation of S2, a vulnerable attention head mapping table is identified and maintained, which is obtained based on the neuron contribution attribution analysis of historical successful attack samples; For requests deemed high-risk, the output of the corresponding attention head is dynamically suppressed based on the mapping table during core model inference.

5. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In S3, the input request is semantically encoded to obtain a semantic content vector; Extract the model fingerprint vector from the current layer weights of the core large model; Map the external key to a key vector; The content semantic vector, model fingerprint vector, and key vector are fused and then subjected to nonlinear transformation and adaptive scaling to generate a conditional modulation vector.

6. The method for dynamic adversarial defense and traceable content generation for large models according to claim 5, characterized in that: The hidden state of the Lth layer of the core large model and the conditional modulation vector are input into the reversible neural network module. The forward transformation of this module outputs the modulated hidden state with embedded implicit watermark, which is used for subsequent decoding.

7. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In S5, attack entities and their relationships are extracted from interception logs and attack payloads through structured parsing and pre-trained language models. Attack events are used as central nodes, and associated attack techniques, targets, and payload characteristics are used as entities or attributes, stored in a graph database to form a visualized attack evolution graph, which is an attack knowledge graph.

8. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In S5, based on the attack knowledge graph, high-frequency attack patterns and their targeted model functional domains are identified, and a subset of vulnerable parameters in the core large model that are strongly correlated with the functional domain is located. Construct a fine-tuned dataset containing corresponding attack samples and clean samples within the domain; Sparse-oriented adversarial fine-tuning is performed only on the subset of the vulnerable parameters.

9. The method for dynamic adversarial defense and traceable content generation for large models according to claim 1, characterized in that: In S5, the generated policy update package is digitally signed. After verifying the legality of the signature and the credibility of the source on the deployment side, the update is gradually pushed out using a canary release strategy. The system's key indicators after the update are monitored in real time, and a rollback to the historical version is automatically triggered when the indicators are abnormal.

10. A dynamic adversarial defense and traceable content generation system for large-scale models, characterized in that: include: The access request and rapid detection module is used to receive multimodal requests from users, extract basic features, detect them with the first detector, and trigger subsequent processing based on the output results. The analysis and dynamic purification module is used to perform semantic and structural analysis on the request, identify attack types and risk levels, and perform multimodal purification operations and / or causal intervention operations on the request content based on the analysis results. The secure generation and implicit watermark embedding module is used to input the cleaned request or the request that has been quickly detected as secure into the core big model for content generation. During the decoding process of the content generated by the model, a conditional modulation vector is generated, and the conditional modulation vector is reversibly transformed with the hidden state of the Lth layer of the model through the reversible neural network module to embed the implicit watermark. The output post-processing and metadata association module is used to perform compliance checks on the generated content and associate it with generated metadata containing watermark key digests and traceability information. The security intelligence gathering and closed-loop evolution module is used to collect detection logs, attack samples and cleanup data, analyze and build an attack knowledge graph, and optimize and update the first detector or core big model based on the analysis results.

Images