Adversarial sample generation method and system based on large model distillation and dynamic confrontation

Abstract

The application discloses an adversarial sample generation method and system based on large model distillation and dynamic confrontation, and relates to the technical field of artificial intelligence. The method comprises the following steps: obtaining a multi-modal original sample and preprocessing, constructing an initial sample library, and presetting a disturbance constraint condition; selecting a pre-trained large model as a teacher model, adopting a fusion technology protection confrontation distillation algorithm to safely migrate confrontation knowledge of the teacher model to a lightweight student model; generating an initial adversarial sample from the teacher model, combining a target test model and a student model to feed back defense and prediction of the adversarial sample, adopting a FAO algorithm to iteratively update an adversarial attack strategy to generate a more optimal adversarial sample, cyclically iterating a dynamic confrontation interaction process until a preset index is met; and screening and secondarily optimizing the iteratively generated adversarial sample to generate and output a final adversarial sample. The application can effectively balance adversarial sample quality, generation efficiency and technical security.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method and system for generating adversarial examples based on large model distillation and dynamic adversarial techniques. Background Technology

[0002] With the widespread application of large-scale artificial intelligence models (such as language models and computer vision models), the demand for robustness and security vulnerability testing of these models is becoming increasingly urgent. Adversarial examples are a key means of verifying the defensive capabilities of large models. Existing methods for generating adversarial examples (such as text and image examples) for large models mostly rely on single-model gradient calculation or static attack strategies, lacking dynamic adversarial mechanisms with large models. This results in weak offensiveness and poor transferability of the generated adversarial examples, making it difficult to adapt to the testing needs of multi-architecture large models. Furthermore, they generally lack core technology protection mechanisms, making algorithms, parameters, and adversarial strategies vulnerable to theft and abuse, thus failing to form effective knowledge protection.

[0003] Model distillation, a core technique for lightweighting large models, distills the knowledge from a complex teacher model into a lightweight student model, thereby reducing model costs. To improve the efficiency of adversarial example generation, some strategies incorporate large model distillation into adversarial example generation. However, this combination only reaches the lightweight adaptation level, simply using the lightweight student model to replace the teacher model for simple inference to reduce the computational cost of generating adversarial examples from input samples. It still lacks dynamic interaction and adversarial interaction between the input samples and the large model, failing to improve the quality (aggressiveness) and cross-model universality (transferability) of generated adversarial examples. Furthermore, existing strategies do not consider controlling core technologies, making adversarial strategy parameters vulnerable to illegal acquisition and tampering, thus failing to meet the technical protection requirements for industrial-grade large model security testing. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an adversarial sample generation method and system based on large model distillation and dynamic adversarial techniques. The method achieves lightweight and efficient computation through large model distillation and designs a three-stage dynamic adversarial and feedback-driven adversarial optimization (FAO) algorithm, significantly improving the offensiveness and transferability of generated adversarial samples. Furthermore, by embedding technical protection constraints during the distillation and adversarial processes, it effectively balances adversarial sample quality, generation efficiency, and technical security, solving the problems of low generation efficiency, poor transferability, insufficient dynamic adversarial capabilities, poor offensiveness, and easy leakage of core technologies associated with traditional methods.

[0005] In a first aspect, the present invention provides a method for generating adversarial samples based on large model distillation and dynamic adversarial techniques.

[0006] An adversarial example generation method based on large model distillation and dynamic adversarial techniques includes: Acquire and preprocess multimodal raw samples, construct an initial sample library, and preset perturbation constraints for adversarial samples; A pre-trained large model is selected as the teacher model. An adversarial distillation algorithm with fusion technology to protect constraints is used to safely transfer the adversarial knowledge of the teacher model to the lightweight student model. Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples, and the defense and prediction feedback of the target test model and student model on the adversarial samples are combined. The FAO algorithm is used to iteratively update the adversarial attack strategy to generate better adversarial samples. The dynamic adversarial interaction process is iterated until the preset indicators are met. The iteratively generated adversarial examples are filtered and optimized a second time to generate and output the final adversarial examples.

[0007] A further technical solution is that the multimodal raw samples include text samples, image samples, and voice samples; The perturbation constraints include perturbation amplitude, semantic preservation degree, and concealment threshold, which are used to constrain sample quality throughout the adversarial sample generation, iterative optimization, and termination judgment processes.

[0008] A further technical solution, the adversarial knowledge distillation process of the teacher-student model, is as follows: A pre-trained large model is selected as the teacher model, and the teacher model is subjected to security preprocessing; the large model includes GPT-4, CLIP, and ResNet50, and the security preprocessing includes backdoor detection and vulnerability repair; An adversarial distillation algorithm is adopted to transfer the adversarial knowledge distillation of the teacher model to the lightweight student model. Adversarial robustness constraints and technical protection constraints are introduced during the distillation process. A total loss function based on ordinary distillation loss, adversarial classification loss, adversarial distillation loss and technical protection constraint loss is constructed to simultaneously realize knowledge transfer and parameter anti-tampering protection during the distillation process. Through iterative training until the total loss is minimized, knowledge distillation is completed, resulting in a lightweight student model that inherits the adversarial performance of the teacher model.

[0009] Further technical solutions involve a three-stage dynamic adversarial interaction between the teacher model, student model, and target test model, including: Attack adversarial initialization phase: Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples using an adversarial attack strategy, and inputs the generated adversarial samples into the target test model and the student model to obtain the adversarial data for the current iteration; Defense-Adversarial Feedback Phase: Structured analysis of adversarial data, extraction of defensive features of the target test model, calculation of prediction difference features between student and teacher models, and joint analysis of original adversarial samples to form adversarial feedback dataset; simultaneously, student model performs backpropagation based on difference features to update its own model parameters. Adversarial Iterative Optimization Phase: The teacher model, based on the adversarial feedback dataset, adopts the feedback-driven adversarial optimization (FAO) algorithm to dynamically adjust the adversarial attack strategy parameters and determine the optimal strategy parameters to guide the generation of adversarial samples in the next iteration; among which, the strategy parameters include perturbation amplitude, perturbation direction, and attack algorithm weights.

[0010] Further technical solutions, including dynamic adjustment of anti-attack strategy parameters, include: The attack success rate is calculated based on adversarial feedback data, and then the perturbation amplitude is dynamically updated by combining the differential feature vectors. The defense features of the target test model are aggregated and normalized by gradient, and then weighted and fused with the original perturbation direction to adaptively correct the perturbation direction. Calculate the attack success rate of each adversarial attack algorithm separately, and renormalize the weights of each adversarial attack algorithm according to the attack success rate percentage. Based on the updated policy parameters, the teacher model generates adversarial examples for the next iteration and performs constrained projection.

[0011] A further technical solution is that the termination condition for the dynamic adversarial interaction process is: the attack success rate and migration success rate are both greater than or equal to the set threshold, or the preset maximum number of iterations is reached; and the technical protection verification is passed.

[0012] Further technical solutions include providing full-process technical protection for the large-scale adversarial generation process and core technologies, including: Access Control: Construct a multi-role permission management system and adopt a role-based access control mechanism to implement fine-grained allocation and control of permissions; Operation traceability: All operations are logged in their entirety to trace the personnel, time, and content of each operation. Anti-tampering protection: The core algorithm code, model parameters, and adversarial strategies are digitally signed. If tampering occurs, an early warning is immediately triggered, and the original data is automatically restored.

[0013] Secondly, the present invention provides an adversarial sample generation system based on large model distillation and dynamic adversarial methods.

[0014] An adversarial sample generation system based on large model distillation and dynamic adversarial methods includes: The sample initialization module is used to acquire and preprocess multimodal raw samples, build an initial sample library, and preset perturbation constraints for adversarial samples. The large model distillation module is used to select a pre-trained large model as the teacher model. It employs an adversarial distillation algorithm with fusion technology to protect constraints and safely transfer the adversarial knowledge of the teacher model to the lightweight student model. The dynamic adversarial interaction module is used to generate initial adversarial samples by the teacher model based on the initial sample library and perturbation constraints. It combines the defense and prediction feedback of the target test model and the student model on the adversarial samples, and uses the FAO algorithm to iteratively update the adversarial attack strategy to generate better adversarial samples. The dynamic adversarial interaction process is iterated until the preset indicators are met. The sample iteration optimization module is used to filter and perform secondary optimization on the adversarial samples generated in the iteration. The results output module generates and outputs the final adversarial examples.

[0015] Thirdly, the present invention also provides an electronic device, comprising: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the above-described adversarial sample generation method based on large model distillation and dynamic adversarial methods.

[0016] Fourthly, the present invention also provides a computer-readable storage medium storing executable instructions for causing a processor to execute the executable instructions to implement the above-described adversarial sample generation method based on large model distillation and dynamic adversarial methods.

[0017] The above one or more technical solutions have the following beneficial effects: This invention provides a method and system for generating adversarial samples based on large-model distillation and dynamic adversarial processes. It focuses on the design of dynamic adversarial processes between large models and the core technology protection mechanism: lightweight and efficient computation is achieved through large-model distillation; the aggressiveness and portability of adversarial samples are significantly improved through a three-stage dynamic adversarial process and feedback-driven adversarial optimization algorithm. Specifically, it focuses on optimizing the dynamic adversarial process of large models, constructing a bidirectional closed-loop adversarial mechanism between the distilled model and the target test model; and achieving dynamic iterative optimization of adversarial samples through a three-stage progressive adversarial process. This solves the problems of insufficient aggressiveness, poor portability, and low generation efficiency of traditional adversarial samples. The generated adversarial samples are adaptable to large models with multiple architectures, meeting the requirements of industrial-grade robustness testing. Simultaneously, technical protection constraints are embedded in the distillation and adversarial processes, strengthening the technical protection design and constructing a full-process technical protection system of "access control - operation traceability - anti-tampering protection." This provides comprehensive protection for core algorithms, model parameters, adversarial strategies, adversarial samples, and adversarial process logs, effectively preventing technology leakage, tampering, and abuse, safeguarding the intellectual property rights of the adversarial sample generation technology, and filling the gap in existing technology regarding technical protection. This invention deeply integrates large-scale model distillation technology with dynamic adversarial processes and technical protection mechanisms. It reduces the computational cost of generating adversarial examples and improves generation efficiency through model distillation, while ensuring the security of core technologies through technical protection mechanisms. This achieves the dual goals of efficient generation and security protection, and is suitable for the actual needs of large-scale artificial intelligence model security testing.

[0018] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0020] Figure 1 This is a flowchart of the adversarial sample generation method based on large model distillation and dynamic adversarial methods in an embodiment of the present invention; Figure 2 This is a schematic diagram of the three-stage process of bidirectional dynamic adversarial interaction in a large model according to an embodiment of the present invention; Figure 3 This is an overall architecture diagram of the adversarial sample generation system based on large model distillation and dynamic adversarial methods in an embodiment of the present invention; Figure 4 This is a schematic diagram of the internal structure and parameter control of the large-scale distillation module in an embodiment of the present invention; Figure 5 This is a core functional architecture diagram of the technical protection module in an embodiment of the present invention. Detailed Implementation

[0021] It should be noted that the following detailed descriptions are exemplary and are intended only to describe specific embodiments and to provide further explanation of the invention, and are not intended to limit the scope of exemplary embodiments of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0022] Example 1 As pointed out in the background section, the current combination of large model distillation technology and adversarial example generation strategies is only at the level of lightweight adaptation. The generation of adversarial examples still relies on single model gradient calculation or static attack strategies. It merely uses a lightweight student model to replace the teacher model for simple inference during the generation process to reduce the computational cost of adversarial example generation. It does not deeply integrate the distillation process with the dynamic adversarial process of large models, and cannot optimize the quality of adversarial examples through bidirectional adversarial interaction between the distilled model and the target test model. At the same time, there is no corresponding protection mechanism designed for the core technology of adversarial example generation. The core algorithms, model parameters and adversarial strategies lack access control and are easily obtained and tampered with, making it difficult to meet the technical protection requirements of industrial-grade large model security testing. In addition, most existing adversarial example generation systems are open-ended and lack closed-loop control for technical protection. They cannot achieve controllable adversarial process, protected core technologies, and traceable sample application. This makes the core technologies easy to copy and the adversarial example generation logic easy to crack. This not only affects the intellectual property protection of the technological achievements, but may also lead to the malicious use of adversarial examples and cause security risks to large models.

[0023] To address the aforementioned issues, this embodiment provides an adversarial sample generation method based on large-model distillation and dynamic adversarial mechanisms. It focuses on the design of dynamic adversarial processes between large models and the protection mechanisms for core technologies. Applicable to scenarios such as robustness testing of large AI (Artificial Intelligence) models, security vulnerability detection, and model defense capability verification, it solves the technical problems of low efficiency, poor attack power, poor transferability, easy theft of core technologies, and lack of controllability in the adversarial process of traditional adversarial sample generation. It achieves the dual goals of core knowledge transfer, efficient sample generation, and controllable technical security, and is suitable for robustness testing and security assessment of multimodal large models. The adversarial sample generation method proposed in this embodiment, such as... Figure 1 As shown, it includes the following steps: Step S1: Obtain multimodal raw samples and preprocess them to build an initial sample library and preset perturbation constraints for adversarial samples. Step S2: Select a pre-trained large model as the teacher model, and use the adversarial distillation algorithm with fusion technology to protect constraints, so as to safely transfer the adversarial knowledge of the teacher model to the lightweight student model. Step S3: Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples, and combines the defense and prediction feedback of the target test model and student model on the adversarial samples. The FAO algorithm is used to iteratively update the adversarial attack strategy to generate better adversarial samples. The dynamic adversarial interaction process is iterated repeatedly until the preset indicators are met. Step S4: Filter and perform secondary optimization on the adversarial examples generated in the iteration; Step S5: Generate and output the final adversarial sample.

[0024] The following content will provide a more detailed introduction to the adversarial sample generation method based on large model distillation and dynamic adversarial approaches.

[0025] Step S1 performs sample initialization, which specifically includes: First, acquiring multimodal raw samples, including but not limited to text, images, and speech. Taking the generation of adversarial samples for a large language model as an example, acquiring speech samples (which can be converted into text using speech recognition technology), text samples, etc., suitable for the input of the large model. By performing subsequent processing on several raw samples, adversarial samples suitable for the input of the large model are generated to test the robustness of the large model and uncover security vulnerabilities. Next, the raw samples are preprocessed with normalization, data augmentation, noise filtering, semantic verification, etc., to generate a standardized initial sample library. At the same time, perturbation constraints for adversarial samples are set, including: perturbation amplitude, semantic preservation degree, and stealth threshold, which are used to constrain sample quality throughout the subsequent adversarial sample generation, iterative optimization, and termination judgment to ensure the practicality and stealth of adversarial samples.

[0026] Preferably, the initial sample library is stored to prevent the leakage of original samples and constraint parameters, thus providing a secure data foundation for subsequent adversarial processes.

[0027] Step S2 performs adversarial knowledge distillation of the large model, which serves as the basic supporting operation for adversarial example generation. This includes teacher model construction, student model distillation, and distillation security and parameter control processing, specifically as follows: Step S2.1: Select a pre-trained large model (such as GPT-4, CLIP, ResNet50, etc.) as the basic teacher model, and perform security preprocessing on the large model (such as backdoor detection, vulnerability repair, etc.) to eliminate the security risks of the teacher model itself and ensure the robustness of the teacher model.

[0028] Step S2.2: Construct a lightweight student model and perform knowledge distillation using an adversarial distillation algorithm with fusion technology protection constraints. This includes: using an adversarial distillation algorithm to transfer and migrate the adversarial knowledge containing robust knowledge, decision boundary information, and adversarial attack experience from the teacher model to the lightweight student model. During the distillation process, adversarial robust constraints and technology protection constraints are added to ensure that the student model can inherit the adversarial performance of the teacher model while reducing the number of parameters and computational costs.

[0029] In this embodiment, the adversarial distillation algorithm employs an improved algorithm that integrates technical protection constraints. It introduces corresponding constraints during the distillation process, namely, constructing a total loss function based on ordinary distillation loss, adversarial classification loss, adversarial distillation loss, and technical protection constraint loss. This function is used to simultaneously achieve knowledge transfer and parameter tamper-proof protection during the distillation process. The total loss function of this distillation can be expressed as: ; in, Corresponding adversarial classification loss, Corresponding to the distillation loss, Corresponding to the losses in ordinary distillation, Corresponding technical protection constraints loss; The weighting coefficients for each loss term can be determined through validation set tuning.

[0030] Furthermore, the formulas for calculating each loss are as follows: ; ; ; ; In the above formula, Adversarial examples generated for the teacher model. For the corresponding original sample, For the true labels of the samples, For the model parameters to be protected, These are reference parameters corresponding to the authorized distillation stage. To detect parameter tampering threshold, The total number of categories, For the true classification labels of the samples, This is the generated sample after adding perturbation. For distillation temperature parameters, and These are the output probability distributions of the teacher model and the student model, respectively.

[0031] Step S2.3: Through iterative training until the total loss is minimized, knowledge distillation is completed, resulting in a lightweight student model that inherits the adversarial performance of the teacher model.

[0032] As one implementation method, simultaneous distillation safety and parameter control processing is performed, including: The distillation process is monitored in real time, and access control is implemented for core parameters in the distillation process (such as distillation temperature, weighting coefficients, and loss function parameters). The distillation process logs are stored in a standardized manner and operations are traced. The core parameters of the distillation teacher model and the distillation student model are stored in isolation and access is controlled, and only authorized modules can call and access them to prevent the model parameters from being illegally stolen and tampered with.

[0033] Step S3 is the dynamic adversarial interaction process of the large model. As a core step, it focuses on the design and control of the two-way dynamic adversarial process of the large model, realizing a closed-loop adversarial process between the distillation teacher model, the distillation student model, and the target test large model. This adversarial process can be divided into three progressive adversarial stages to ensure the controllability of the adversarial process and the gradual optimization of the adversarial sample quality, such as... Figure 2 As shown, it includes: Phase 1 (Attack Adversarial Initialization): Based on the initial sample library and perturbation constraints, the teacher model distills adversarial attack strategies using algorithms such as PGD (Projected Gradient Descent), FGSM (Fast Gradient Sign Method), and TextFooler (a text-oriented adversarial attack algorithm). These strategies generate initial adversarial samples whose perturbations satisfy the constraints set during sample initialization. The initial adversarial samples are then input into the target test model. Upon receiving the initial adversarial samples, the target model activates its own defense mechanisms, performing perturbation detection, feature suppression, and confidence reestimation on the input, and then acquires and outputs the target model's defense response data. This includes the target model's prediction results, gradient information, and defense response. At the same time, the initial adversarial sample is input into the distilled student model to obtain the student model's prediction results and the difference data between the student model and the teacher model's predictions. These are then combined to form the first set (i.e., the current iteration) of adversarial data. The second stage (defense adversarial feedback): The target test model, based on the first set of adversarial data, extracts and transmits defense feedback information through structured parsing; the student model, based on the difference in predictions between itself and the teacher model, adjusts model parameters through backpropagation to optimize the adversarial sample recognition ability and generate model optimization feedback; the dynamic adversarial interaction module integrates the two types of feedback information and, together with the original adversarial samples, forms an adversarial feedback dataset.

[0034] Specifically, the second phase includes the following steps: Step S3.1, Adversarial Data Reception and Parsing: Receive adversarial data output from the target test large model and the distilled student model, and extract the target model's defense response data. Student model prediction output data Teacher model reference output data (This data can be cached or retrieved synchronously).

[0035] Step S3.2, Defense Behavior Analysis and Feature Extraction: The defense response data of the target model is analyzed in a structured manner to extract defense features such as perturbation detection markers, confidence changes, gradient norm changes, and defense strategy type labels, thus constructing a defense feature vector. .

[0036] Specifically, the target model's defense response data includes prediction results, gradient information, and defense response, which can be represented as: The data is then parsed and its features extracted; specifically, the target model's defense response log is segmented into fields to identify whether disturbance detection has been triggered. Disturbance detection marker Read the target category confidence score before and after defense, i.e. and And calculate the change in confidence level. Extract the gradient vectors before and after defense, i.e. and And calculate the gradient norm change. The defense strategy type label is obtained by mapping the triggered rule or module number. ,Right now The above process can be represented as: ; ; ; ; Finally, the defense feature vector is obtained. .

[0037] Step S3.3, Calculation of student model difference: Based on the prediction outputs of the student model and the teacher model, calculate the difference in prediction distribution. (i.e., KL divergence), differences in intermediate feature layers and the differences in the embedding of classification results To form a differential feature vector , can be represented as: .

[0038] Specifically, during the calculation process, the teacher model and student model are first obtained in adversarial examples. Predicted probability distribution on Then extract the feature vector of the intermediate layer between the two. and the semantic embedding corresponding to the classification results Based on this, the KL divergence, intermediate feature layer difference, and classification result embedding difference (i.e., embedding distance) are calculated respectively, and can be expressed as: ; ; .

[0039] Step S3.4, Student Model Adaptive Update: The student model is distilled and updated by performing backpropagation based on the above differential features to update the student model parameters. The loss function formula is as follows: ; In the above formula, Let the adversarial recognition loss of the student model on the current adversarial example be taken as the adversarial example classification cross-entropy. This represents the difference between the output distributions of the student model and the teacher model. and Dynamic weights; For student model parameters; This is the learning rate.

[0040] Step S3.5, Feedback Fusion and Dataset Construction: This involves combining the defense feature vectors... , differential feature vector and original adversarial samples To integrate and construct adversarial feedback data units This is used to compile the adversarial feedback dataset corresponding to the k-th iteration. The adversarial feedback data unit can be represented as: The adversarial feedback dataset can be represented as: , Indicates the iteration round, Indicates the first iteration in this round. Each feedback sample number.

[0041] The third stage (adversarial iterative optimization): The adversarial feedback dataset is input into the distillation teacher model. Based on the feedback dataset, the teacher model uses the Feedback Driven Adversarial Optimization (FAO) algorithm to dynamically optimize the adversarial attack strategy parameters (including adjusting the perturbation amplitude, perturbation direction, attack algorithm weights, etc.) to determine the optimal strategy parameters to guide the generation of adversarial samples in the next iteration. The teacher model then generates the iterative adversarial samples.

[0042] Specifically, read the feedback dataset from the cache. The input is the distillation teacher model, which calculates the attack success rate and transfer success rate. Specifically, it calculates the sample-level attack effect for the i-th feedback sample in the feedback dataset. The overall attack success rate was obtained through statistics. and migration success rate , can be represented as: ; ; ; In the above formula, Indicates the first Whether the attack on the target test model by the feedback sample was successful. Indicates the first Whether the attack on the student model using a single feedback sample was successful. For the first Local attack effectiveness of individual samples and To evaluate weights and ; This represents the overall attack success rate for the current iteration batch. The migration success rate for the current iteration batch. This represents the number of feedback samples in the current iteration batch.

[0043] The above method yields sample-level attack effects (or local attack effects). It can identify the samples that are most or least sensitive to the current attack strategy, which can be used for fine-grained updates of the perturbation magnitude, perturbation direction, and attack algorithm weights; combined with the overall attack success rate. With migration success rate It can perform a global performance evaluation of the current adversarial strategy and determine whether to continue iteratively executing the dynamic adversarial interaction process.

[0044] The three stages described above are iterated and repeated until the attack success rate and migration success rate of the adversarial sample reach preset thresholds (e.g., attack success rate ≥ 90% and migration success rate ≥ 85%), or the number of adversarial iterations reaches a preset upper limit, at which point the adversarial process stops. Preferably, all logs and data from the entire adversarial process are stored in a standardized manner to ensure that the adversarial strategy is not leaked.

[0045] Furthermore, to achieve adaptive optimization and closed-loop iterative control of the adversarial strategy, a feedback-driven adversarial strategy optimization algorithm is introduced in this stage. This algorithm uses an adversarial feedback dataset. Using this as input, we jointly model and analyze the defensive behavior characteristics of the target test model and the predictive difference characteristics of the distilled student model, dynamically adjusting key parameters during the adversarial attack process, including: dynamically adjusting attack strategy parameters based on feedback data, including the perturbation amplitude. Update, perturbation direction Adjustment and attack algorithm selection of weights The update is as follows: Combined with defensive feature vectors The perturbation detection information, confidence changes, and gradient features are used to guide the adaptive correction of the perturbation direction. The formula for adjusting the perturbation direction is as follows: ; In the above formula, The direction of the disturbance in the current round. This represents the feedback gradient constructed based on defensive features. and For directional fusion weights, To accommodate the adjusted perturbation direction in the next round.

[0046] Based on differential feature vectors The model's cognitive bias information is used to dynamically adjust the perturbation amplitude during the adversarial example generation process. The formula for updating this perturbation amplitude is as follows: ; In the above formula, 、 and They come from the differential feature vectors respectively It is used to characterize the cognitive bias between the student model and the teacher model. When the difference increases, the perturbation amplitude increases accordingly to improve the effectiveness and transferability of the next round of attacks. and They represent the first Wheel and First The amplitude of the wheel's disturbance, This is the adjustment coefficient.

[0047] Furthermore, the algorithm updates the selection weights of each attack algorithm based on the performance of different adversarial attack methods on the current feedback data, achieving multi-strategy fusion and optimal attack path selection. The formula for updating the attack algorithm selection weights is as follows: ; In the above formula, Indicates the first The success rate of the attack algorithm on the current feedback batch. This represents the number of candidate attack algorithms.

[0048] Through the above process, the FAO algorithm can generate an adaptive adversarial strategy against the target model's defense mechanism and output the updated perturbation magnitude. Disturbance direction and attack method weight distribution This algorithm is used to guide the generation of new adversarial examples. By introducing this algorithm, the adversarial process is transformed from a static attack into a dynamic policy evolution process driven by feedback, thereby effectively improving the success rate of adversarial attacks and cross-model transferability, while ensuring the stability and controllability of the adversarial process.

[0049] Based on this, the teacher model generates a new round of adversarial examples using the updated parameters. And ensure that the constraints are met. The formula for generating the new round of adversarial examples is: ; In the above formula, The original input sample, For the first Adversarial examples generated in rounds, This indicates the selected adversarial attack generation function.

[0050] Finally, determine whether the termination condition is met to ensure... And migration success rate Termination time, or number of iterations If the iteration terminates, it will terminate; otherwise, it will return to the first phase and continue iterating.

[0051] By introducing the aforementioned FAO algorithm, a shift from adversarial generation based on fixed policies to adaptive policy evolution based on feedback can be achieved, enabling the adversarial process to have stronger environmental awareness and policy optimization capabilities, thereby effectively improving the success rate of adversarial attacks and cross-model transfer performance.

[0052] As one implementation method, the above-mentioned adversarial iteration process adopts a secure interaction mechanism. All data transmission between the distillation model and the target test model is subject to permission verification, and an adversarial strategy hiding mechanism is set to prevent the leakage of the core parameters and iteration logic of the attack algorithm. In addition to meeting the attack success rate and migration success rate thresholds, the adversarial termination condition also requires passing the technical protection verification (core parameters are not leaked, not tampered with, etc.).

[0053] Step S4 performs sample iterative optimization, which involves screening and optimizing the output iterative adversarial samples to remove invalid samples that have excessive perturbation, semantic distortion, or insufficient attack power. Based on the optimization feedback from the distilled student model and the defense feedback from the target test model, the effective samples are subjected to secondary perturbation optimization to improve the transferability of adversarial samples (adapting to large models of the same type but different architectures). The optimized effective adversarial samples are classified and stored, and information such as the generation parameters and attack effects of the associated samples are included to facilitate traceability and control.

[0054] Step S5 outputs the final generated results, which are the optimized adversarial samples classified by type and attack level, generating an adversarial sample report (including sample quantity, attack success rate, migration test results, perturbation parameters, etc.); it provides an authorized export interface, which can only authorize users to export adversarial samples and reports, and the entire export process is logged; it also outputs adversarial process logs and model parameter configurations to facilitate system debugging and technical traceability.

[0055] As one implementation method, the method proposed in this embodiment also includes a technical protection step. This step, as the security core of the system, can achieve full-process protection of the large-scale model adversarial process and core technologies, specifically including: (1) Access Control: A role-based access control (RBAC) mechanism is adopted to implement fine-grained allocation and control of permissions. Specifically, a multi-role permission management system (administrator, operator, and viewer) is constructed, and different operation permissions are assigned. Only administrators can configure system parameters and view core algorithm and model parameters, operators can perform adversarial sample generation and iterative optimization operations, and viewers can only view adversarial sample reports to prevent unauthorized access.

[0056] (2) Operation traceability: All operations (sample import, distillation training, adversarial process, sample export, parameter adjustment) are recorded in a full log to trace the operators, operation time and operation content of each operation, which facilitates technical audit and security investigation.

[0057] (3) Anti-tampering protection: The core algorithm code, model parameters and adversarial strategies are digitally signed. If tampering occurs, an early warning will be triggered immediately and the original data will be automatically restored to ensure the integrity and security of the core technology.

[0058] The following specific examples further illustrate this solution in detail, focusing on the specific implementation of the large-scale dynamic adversarial process and technical protection mechanism.

[0059] Example 1: Adversarial sample generation and technical protection applicable to large text-based models.

[0060] Robustness testing of large text-based models (such as BERT-base, GPT-3.5, etc.) focuses on optimizing the dynamic adversarial process and protecting core technologies. The specific implementation process includes: S1. Sample Initialization: Obtain the IMDB (Internet Movie Database) movie review public dataset as the original sample set, containing 5000 normal text samples and 500 abnormal text samples; preprocess the original samples (word segmentation, stop word removal, normalization, semantic verification), and set perturbation constraints: the perturbation amplitude does not exceed 5% (the proportion of modification of a single text character), and the semantic preservation degree is not less than 90% (verified by cosine similarity); standardize and store the preprocessed samples to generate an initial sample library, which is stored in the database and can only be called by the sample initialization module.

[0061] S2, large-scale distillation, including: Teacher model construction: GPT-3.5 was selected as the basic teacher model. Backdoor detection algorithms (such as NeuralCleanse) were used to eliminate backdoor vulnerabilities in the model, repair adversarial vulnerabilities, and complete the security preprocessing of the teacher model. Student Model Distillation: Distil BERT (a lightweight distilled version of BERT) was selected as the student model. An improved adversarial distillation algorithm was used, with the distillation temperature T=10 and weight coefficients set accordingly. , , , Technical safeguards are incorporated into the distillation process to ensure that distillation knowledge is not leaked. Distillation safety and parameter control: Real-time monitoring of distillation loss value, stopping distillation when the loss value fluctuation does not exceed 0.01; Access control for core parameters of teacher and student models, generating parameter files that can only be accessed by the dynamic adversarial interaction module; Standardized storage of distillation process logs for easy traceability.

[0062] S3, Large-Scale Two-Way Dynamic Adversarial Model (Three-Phase Closed Loop): Phase 1 (Attack Adversarial Initialization): The Distillation Teacher Model (GPT-3.5) calls the TextFooler adversarial attack algorithm to generate initial adversarial samples based on the initial sample library (perturbation is achieved through synonym replacement and word order adjustment); the initial adversarial samples are input into the target test model (BERT-base) to obtain the target model's prediction accuracy (initially 65%), gradient information and defense response, and simultaneously input into the Distillation Student Model (DistilBERT) to obtain prediction difference data, thus forming the first set of adversarial data.

[0063] The second stage (defense-adversarial feedback): Based on the first set of adversarial data, the target test model identifies perturbation features (synonym substitution, word order adjustment), activates the input perturbation detection mechanism, adjusts the model's attention weights, generates defense feedback information, and transmits it; the distillation student model, based on the prediction difference, adjusts parameters through backpropagation to optimize the recognition accuracy (improving to 82%), and generates model optimization feedback; the dynamic adversarial interaction module integrates the two types of feedback information to form an adversarial feedback dataset.

[0064] Specifically, for text-based samples, the second stage of data processing includes: S3.2.1, Adversarial Data Input and Preprocessing: Inputting and preprocessing the adversarial dataset generated in the first stage. The target test model and student model are input, and the input text H is segmented and embedded. The dataset is defined as follows: ; In the above formula, This represents the adversarial dataset generated in the first phase. For adversarial examples, Output for the target model. Output for the student model.

[0065] The text embedding encoding formula is: ; In the above formula, This represents a word embedding or subword embedding encoding function, where H represents adversarial text. The corresponding embedding representation matrix.

[0066] S3.2.2, Disturbance Feature Recognition: Constructing a Disturbance Detection Function Disturbance detection is performed.

[0067] In text-based data processing, this embodiment designs perturbation detection including synonym substitution detection and word order perturbation detection. The perturbation detection function formula is as follows: ; In the above formula, For adversarial examples The disturbance detection results This indicates a synonym substitution perturbation feature. It indicates the characteristics of word order perturbation.

[0068] The formula for synonym replacement detection is: ; In the above formula, For synonym replacement detection values, The number of words being compared. For indicator functions, For the original word vectors, For the replaced word vectors, This is the similarity threshold.

[0069] The formula for detecting word order perturbation is: ; In the above formula, This is the value for detecting word order perturbation. This represents the edit distance function. To counter the text, This is the original text.

[0070] S3.2.3, Perturbation Detection Mechanism Trigger: Re-weighting is performed on the Transformer's attention score, and a threshold is set. When the disturbance detection trigger condition is met This triggers the defense mechanism and adjusts the attention weight. Adjustments will be made.

[0071] The formula for adjusting attention weights is as follows: ; In the above formula, The original attention matrix, To adjust the attention matrix, This represents element-wise multiplication. This is the attention inhibition coefficient. This is the output of the disturbance detection function.

[0072] S3.2.4 Generating Defense Feedback Information: Based on the adjusted model output and attention distribution, construct defense feedback information containing the predicted probability distribution and defense response strength. The defense feedback data is defined as follows: ; In the above formula, Indicates whether disturbance detection is triggered. This indicates the change in confidence level of the target category before and after the defense. This represents the norm of gradient change before and after defense. Indicates the defense strategy type label, The attention matrix is ​​reweighted. Predict the probability distribution for the target model. For defensive response strength.

[0073] S3.2.5 Student Model Optimization (Based on Prediction Difference): Based on the prediction difference between the target model and the student model. Construct the loss function The student model parameters are then updated via backpropagation. The prediction difference formula is defined as follows: ; In the above formula, The predicted probability distribution output by the target model. The predicted probability distribution output by the student model. This represents the KL divergence, which measures the degree of difference between two predicted distributions.

[0074] The loss function formula is: ; In the above formula, The total optimization loss of the student model, To predict the difference loss, To combat sample classification loss, The weights are used for classification loss.

[0075] The parameter update formula is: ; In the above formula, For student model parameters, For learning rate, For loss function For parameters The gradient.

[0076] The output formula is defined as: ; In the above formula, Optimize feedback information for student models. To complete one backpropagation update of the student model parameters, This represents the prediction discrepancy loss for the current sample.

[0077] S3.2.6 Feedback Fusion: The defensive feedback information from the target model and the optimization feedback information from the student model are weighted and fused to form a unified adversarial feedback dataset. The formula for integrating the two types of feedback is as follows: ; In the above formula, For the unified feedback representation after integration, For the target model's defense feedback information, Optimize feedback information for student models. and To merge weights, and .

[0078] In other words, after completing the adversarial feedback dataset After fusion and construction, to achieve effective transmission and utilization of feedback information to attack strategy parameters, a multi-source feedback-driven adversarial strategy optimization algorithm is further introduced during the dynamic adversarial interaction process. This algorithm uses the adversarial feedback dataset... As input, comprehensively utilize defense response strength Disturbance detection features and model prediction discrepancies The attack strategy parameters are dynamically optimized, thereby enabling the strategy evolution driven by feedback in the adversarial process.

[0079] Specifically, the algorithm first performs structured parsing on the feedback data to extract key feature information; then, based on the perturbation detection results and defense response strength, it constructs a perturbation impact scoring function to evaluate the perturbation effectiveness of the current adversarial example; on this basis, it separately evaluates the synonym substitution strength parameter. and word order perturbation amplitude parameters Adaptive updates are performed; simultaneously, attention change information A' is used to guide and correct the perturbation direction; finally, the updated attack strategy parameters are constrained and projected to ensure that they meet the preset perturbation range, thereby outputting the optimal strategy parameters to guide the generation of adversarial samples in the next stage.

[0080] The third stage (adversarial iterative optimization): The adversarial feedback dataset is input into the distilled teacher model. The teacher model optimizes the attack strategy (increasing the diversity of synonym replacements and adjusting the magnitude of word order perturbations) to generate iterative adversarial samples. The above three stages are repeated. After 10 iterations, the adversarial sample attack success rate reaches 92%, the transfer success rate reaches 88%, and the technical protection verification passes (parameters are not leaked or tampered with), at which point the adversarial process stops. The adversarial process log is stored systematically throughout, recording the attack parameters and feedback information for each iteration. The data processing in this stage is as follows: S3.3.1 Feedback Data Input: Input the adversarial feedback dataset into the distillation teacher model and analyze the defensive response strength within it. Changes in attention And model error information. The data input formula is: .

[0081] S3.3.2 Attack strategy parameter update: Dynamically adjust attack strategy parameters based on defense feedback information. This includes the synonym substitution strength in the next iteration (i.e., t+1). and the magnitude of word order perturbation .

[0082] The attack strategy parameters are defined by the following formula: ; The formula for the synonym perturbation parameter update rule is: ; The formula for updating the word order perturbation parameters is: ; In the above formula, , To iteratively update the coefficients, For the target model on the sample The strength of the defense response, This represents the numerical value for word order perturbation detection.

[0083] S3.3.3 Generating Iterative Adversarial Examples: Based on the updated attack strategy parameters, the improved adversarial attack algorithm is invoked to generate new adversarial examples. including synonym expansion and word order perturbation .

[0084] The formula for generating iterative adversarial examples is as follows: ; The extended definition formula for synonyms is: ; The definition formula for word order perturbation is: ; In the above formula, The TextFooler attack generation function generates adversarial examples based on the strategy. The word vector similarity threshold. This represents the set of candidate synonyms that meet the similarity criteria. This represents the word vector corresponding to the original word. This represents the word vector corresponding to the candidate replacement word. Here is a function to shuffle the word order of text, where k is the shuffling ratio of sentence characters / vocabularies. This refers to the text after word order perturbation.

[0085] S3.3.4, Migration Attack Optimization: Output based on the target model With student model output Difference as the optimization objective The generated adversarial examples are then further screened and optimized. The optimization objective formula is: .

[0086] S3.3.5 Iteration Control and Termination Conditions: After each iteration, the attack success rate and migration success rate are calculated and compared with preset thresholds. The iteration process terminates when a condition is met or the maximum number of iterations is reached. The stopping condition is: attack success rate... migration success rate Maximum number of iterations .

[0087] S3.3.6 Result Output and Log Recording: Output the final generated adversarial sample. The attack parameters and feedback information for each iteration are recorded and stored. The logging formula is as follows: .

[0088] S4. Sample Iteration and Optimization: Select 3800 effective adversarial samples with an attack success rate of ≥90% and semantic preservation of ≥90%. Perform secondary perturbation optimization based on feedback information to improve transferability. Classify and store effective samples according to attack level, and associate them with generation parameters and attack effect information for easy traceability.

[0089] S5. Output Results: Generate an adversarial sample report, including information such as the number of samples, attack success rate, and migration test results; through the authorized export interface, only administrators and authorized operators can export samples and reports, and the export process is logged (exporter, time, and content); at the same time, output distillation model parameters and adversarial process logs for system debugging.

[0090] S6. Technical protection and full-process control, including: (1) Access control: Set up three roles: administrator, operator and viewer. Administrators can configure parameters and view core algorithms and parameters. Operators can perform generation and optimization operations. Viewers can only view adversarial sample reports. (2) Operation traceability: All operations (sample import, distillation, adjuvant, export) are recorded in logs. The logs are stored in a standardized manner and can be retrieved by time and operator. (3) Anti-tampering protection: The core algorithm code and model parameters adopt an integrity verification mechanism. Once tampering is detected, an early warning is immediately triggered and the original data is restored.

[0091] Example 2: Adversarial sample generation and technical protection applicable to large image models.

[0092] The difference between this example and Example 1 lies in the robustness test for adapting to large image-based models. The specific adaptation of the dynamic adversarial process and technical protection mechanism is as follows: First, sample initialization: the existing CIFAR-10 image dataset is obtained as the original sample set, and preprocessing includes size normalization, grayscale conversion, and noise filtering. The perturbation constraint is that the pixel perturbation amplitude does not exceed 2 pixels and the image semantic preservation is not less than 85%. The original samples and the initial sample library are stored in a standardized manner.

[0093] Secondly, large model distillation: ResNet50 is selected as the teacher model and MobileNetV3 as the student model. Image feature distillation constraints are added during the distillation process to improve the student model's ability to extract image features. The model parameters are subject to access control, and the distillation logs are stored in a standardized manner.

[0094] Then, dynamic adversarial interaction: the initial adversarial samples are generated using two adversarial attack algorithms, FGSM and PGD, and the target test model is VGG16; during the adversarial process, high-frequency disturbance abnormal regions in the image are identified through frequency domain analysis, and the disturbance strategy is dynamically optimized. All data transmission and storage are subject to access control; the adversarial termination conditions are attack success rate ≥91%, migration success rate ≥86%, and technical protection verification passed, with 8 iterations.

[0095] Finally, technical protection adaptation: In view of the special characteristics of image samples, the perturbation features of image adversarial samples are hidden to prevent the attack strategy from being cracked; during the sample iterative optimization process, the Feature Pyramid Network (FPN) is used to extract image features, compare the differences between the original image and the adversarial sample, screen the effective samples and store them in a standardized manner; when exporting image adversarial samples, a source watermark is added to prevent sample leakage and abuse.

[0096] The method proposed in this embodiment can effectively generate adversarial examples adapted to large image models. At the same time, through a sound technical protection mechanism, it ensures that the core technology is not leaked, thus meeting the technical requirements for robustness testing of large image models and the requirements for intellectual property protection.

[0097] Example 2 This embodiment provides an adversarial sample generation system based on large model distillation and dynamic adversarial techniques, such as... Figure 3 As shown, the system includes: The sample initialization module is used to acquire and preprocess multimodal raw samples, build an initial sample library, and preset perturbation constraints for adversarial samples. The large model distillation module is used to select a pre-trained large model as the teacher model. It employs an adversarial distillation algorithm with fusion technology to protect constraints and safely transfer the adversarial knowledge of the teacher model to the lightweight student model. The dynamic adversarial interaction module is used to generate initial adversarial samples by the teacher model based on the initial sample library and perturbation constraints. It combines the defense and prediction feedback of the target test model and the student model on the adversarial samples, and uses the FAO algorithm to iteratively update the adversarial attack strategy to generate better adversarial samples. The dynamic adversarial interaction process is iterated until the preset indicators are met. The sample iteration optimization module is used to filter and perform secondary optimization on the adversarial samples generated in the iteration. The results output module generates and outputs the final adversarial examples.

[0098] As one implementation method, a technical protection module is also included, used to provide technical protection for the entire process of large-model adversarial generation and core technologies. This module includes: Access Control Unit: Construct a multi-role permission management system and adopt a role-based access control mechanism to implement fine-grained allocation and control of permissions; Operation traceability unit: All operations are logged in their entirety to trace the operator, time, and content of each operation. Anti-tampering protection unit: Digitally signs the core algorithm code, model parameters, and adversarial strategies. If tampering occurs, an early warning is immediately triggered, and the original data is automatically restored.

[0099] The adversarial sample generation system proposed in this embodiment includes a sample initialization module, a large model distillation module, a dynamic adversarial interaction module, a sample iterative optimization module, a result output module, and a technical protection module. For example... Figure 3 As shown, the system adopts a layered architecture, divided from top to bottom into a data layer, a core module layer, a technical protection layer, and an output layer. The data layer contains the original sample set and the initial sample library, and points to the sample initialization module of the core module layer through a data channel. The core module layer consists of the sample initialization module, the large model distillation module, the dynamic adversarial interaction module, the sample iterative optimization module, and the result output module. The technical protection layer surrounds the core module layer and annotates the technical protection throughout the entire process. The result output module points to the output layer through an authorized interface. The output layer contains an adversarial sample library, adversarial sample reports, and operation logs.

[0100] like Figure 4 As shown, the large-scale model distillation module comprises four sub-units: a teacher model construction unit, a student model distillation unit, a distillation safety unit, and a parameter control unit, used to construct safe and controllable distillation teacher and student models; the dynamic adversarial interaction module is used to realize bidirectional dynamic adversarial interaction between the distillation model and the target test large-scale model; as shown... Figure 5 As shown, the technical protection module includes three core functional units: access control unit, operation traceability unit, and anti-tampering protection unit. These units are used to control and trace the system's core technologies and data throughout the entire process. The modules work together to efficiently generate adversarial samples, iteratively optimize them, and securely protect the core technologies.

[0101] This embodiment constructs an end-to-end closed-loop system, which can automate the entire process from sample initialization to distillation training to dynamic adversarial training, iterative optimization, output control, and technical protection without manual intervention. At the same time, the operation traceability mechanism facilitates technical auditing and security checks, thereby improving the practicality and security of the system.

[0102] Example 3 This embodiment provides an electronic device, including: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the method provided in this embodiment.

[0103] Example 4 This embodiment also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, will cause the processor to execute the method described above in this embodiment.

[0104] The steps and methods involved in Embodiments 2 to 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0105] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0106] The above description is only a preferred embodiment of the present invention. Although the specific implementation of the present invention has been described in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative effort are still within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples based on large model distillation and dynamic adversarial techniques, characterized in that, include: The process involves acquiring and preprocessing multimodal raw samples to construct an initial sample library, and pre-setting perturbation constraints for adversarial samples. The multimodal raw samples include text samples, image samples, and speech samples. The perturbation constraints include perturbation amplitude, semantic preservation degree, and concealment threshold, which are used to constrain sample quality throughout the adversarial sample generation, iterative optimization, and termination judgment. A pre-trained large model is selected as the teacher model. An adversarial distillation algorithm with fusion technology to protect constraints is used to safely transfer the adversarial knowledge of the teacher model to the lightweight student model. Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples. Combining the defense and prediction feedback of the target test model and the student model on these adversarial samples, the FAO algorithm is used to iteratively update the adversarial attack strategy to generate better adversarial samples. This dynamic adversarial interaction process is iterated repeatedly until preset indicators are met. The teacher model, student model, and target test model perform a three-stage dynamic adversarial interaction, including: Attack adversarial initialization phase: Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples using an adversarial attack strategy, and inputs the generated adversarial samples into the target test model and the student model to obtain the adversarial data for the current iteration; Defense-Adversarial Feedback Phase: Structured analysis of adversarial data, extraction of defensive features of the target test model, calculation of prediction difference features between student and teacher models, and joint analysis of original adversarial samples to form adversarial feedback dataset; simultaneously, student model performs backpropagation based on difference features to update its own model parameters. Adversarial Iterative Optimization Phase: The teacher model, based on the adversarial feedback dataset, adopts the feedback-driven adversarial optimization (FAO) algorithm to dynamically adjust the adversarial attack strategy parameters and determine the optimal strategy parameters to guide the generation of adversarial samples in the next iteration; among which, the strategy parameters include perturbation amplitude, perturbation direction, and attack algorithm weights; The iteratively generated adversarial examples are filtered and optimized a second time to generate and output the final adversarial examples.

2. The adversarial example generation method based on large model distillation and dynamic adversarial methods as described in claim 1, characterized in that, The adversarial knowledge distillation process in the teacher-student model is as follows: A pre-trained large model is selected as the teacher model, and the teacher model is subjected to security preprocessing; the large model includes GPT-4, CLIP, and ResNet50, and the security preprocessing includes backdoor detection and vulnerability repair; An adversarial distillation algorithm is adopted to transfer the adversarial knowledge distillation of the teacher model to the lightweight student model. Adversarial robustness constraints and technical protection constraints are introduced during the distillation process. A total loss function based on ordinary distillation loss, adversarial classification loss, adversarial distillation loss and technical protection constraint loss is constructed to simultaneously realize knowledge transfer and parameter anti-tampering protection during the distillation process. Through iterative training until the total loss is minimized, knowledge distillation is completed, resulting in a lightweight student model that inherits the adversarial performance of the teacher model.

3. The adversarial example generation method based on large model distillation and dynamic adversarial methods as described in claim 1, characterized in that, Dynamic adjustment of counter-attack strategy parameters, including: The attack success rate is calculated based on adversarial feedback data, and then the perturbation amplitude is dynamically updated by combining the differential feature vectors. The defense features of the target test model are aggregated and normalized by gradient, and then weighted and fused with the original perturbation direction to adaptively correct the perturbation direction. Calculate the attack success rate of each adversarial attack algorithm separately, and renormalize the weights of each adversarial attack algorithm according to the attack success rate percentage. Based on the updated policy parameters, the teacher model generates adversarial examples for the next iteration and performs constrained projection.

4. The adversarial example generation method based on large model distillation and dynamic adversarial methods as described in claim 1, characterized in that, The termination condition for the dynamic adversarial interaction process is: the attack success rate and migration success rate are both greater than or equal to the set threshold, and the technical protection verification is passed; or the preset maximum number of iterations is reached.

5. The adversarial sample generation method based on large model distillation and dynamic adversarial methods as described in claim 1, characterized in that, Implement technical protection for the entire process and core technologies of large-scale adversarial generation, including: Access Control: Construct a multi-role permission management system and adopt a role-based access control mechanism to implement fine-grained allocation and control of permissions; Operation traceability: All operations are logged in their entirety to trace the personnel, time, and content of each operation. Anti-tampering protection: The core algorithm code, model parameters, and adversarial strategies are digitally signed. If tampering occurs, an early warning is immediately triggered, and the original data is automatically restored.

6. An adversarial sample generation system based on large model distillation and dynamic adversarial methods, characterized in that, include: The sample initialization module is used to acquire and preprocess multimodal raw samples, build an initial sample library, and preset perturbation constraints for adversarial samples. The multimodal raw samples include text samples, image samples, and speech samples. The perturbation constraints include perturbation amplitude, semantic preservation degree, and concealment threshold, which are used to constrain sample quality throughout the adversarial sample generation, iterative optimization, and termination judgment. The large model distillation module is used to select a pre-trained large model as the teacher model. It employs an adversarial distillation algorithm with fusion technology to protect constraints and safely transfer the adversarial knowledge of the teacher model to the lightweight student model. The dynamic adversarial interaction module is used to generate initial adversarial samples by the teacher model based on an initial sample library and perturbation constraints. It then combines the defense and prediction feedback of the target test model and the student model on these adversarial samples, using the FAO algorithm to iteratively update the adversarial attack strategy to generate better adversarial samples. This dynamic adversarial interaction process iterates until preset indicators are met. The dynamic adversarial interaction between the teacher model, student model, and target test model involves three stages, including: Attack adversarial initialization phase: Based on the initial sample library and perturbation constraints, the teacher model generates initial adversarial samples using an adversarial attack strategy, and inputs the generated adversarial samples into the target test model and the student model to obtain the adversarial data for the current iteration; Defense-Adversarial Feedback Phase: Structured analysis of adversarial data, extraction of defensive features of the target test model, calculation of prediction difference features between student and teacher models, and joint analysis of original adversarial samples to form adversarial feedback dataset; simultaneously, student model performs backpropagation based on difference features to update its own model parameters. Adversarial Iterative Optimization Phase: The teacher model, based on the adversarial feedback dataset, adopts the feedback-driven adversarial optimization (FAO) algorithm to dynamically adjust the adversarial attack strategy parameters and determine the optimal strategy parameters to guide the generation of adversarial samples in the next iteration; among which, the strategy parameters include perturbation amplitude, perturbation direction, and attack algorithm weights; The sample iteration optimization module is used to filter and perform secondary optimization on the adversarial samples generated in the iteration. The results output module generates and outputs the final adversarial examples.

7. An electronic device, characterized in that, include: Memory, used to store executable instructions; The processor, when executing executable instructions stored in the memory, implements the adversarial sample generation method based on large model distillation and dynamic adversarial methods as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The device stores executable instructions that, when executed by a processor, implement the adversarial sample generation method based on large model distillation and dynamic adversarial processing as described in any one of claims 1-5.

Images