An end-side large model security evaluation method based on physical signal disturbance

Abstract

The application discloses an end-side large model safety evaluation method based on physical signal disturbance and belongs to the technical field of system safety and reliability analysis; the method comprises the following steps: step one, acquiring baseline behavior characteristics; step two, performing power disturbance wired injection test; step three, performing electromagnetic radiation wireless injection test; step four, model behavior characteristic extraction; and step five, performing safety evaluation on the end-side large model. The application adopts the above method, overcomes the deficiency that the prior art lacks system analysis on the running safety of the end-side large model under the condition of physical signal disturbance, proposes an end-side large model safety analysis method based on physical signal injection, quantitatively evaluates the safety of the running behavior of the large model by applying controllable physical signal disturbance to the end-side large model, and realizes the analysis on the safety and stability of the end-side large model.

Description

Technical Field

[0001] This invention relates to the field of system safety and reliability analysis technology, and in particular to a large-scale end-side safety assessment method based on physical signal perturbation. Background Technology

[0002] Existing research on large-scale model security primarily focuses on the information domain level, such as hint injection, adversarial examples, and model parameter tampering. Related analytical methods typically assume a stable model operating environment and fail to consider physical layer interference issues that edge devices may face in real-world physical environments. However, in practical applications, edge devices may be subject to physical signal disturbances such as unstable power supply, power noise, and complex electromagnetic radiation. These physical disturbances can affect the computational behavior, timing characteristics, and model execution of the terminal hardware, leading to decreased model inference performance, unstable output, or even abnormal behavior. Therefore, effectively analyzing the performance and output stability of large-scale edge models under physical signal disturbance conditions has become an urgent technical problem to be solved. Summary of the Invention

[0003] The purpose of this invention is to provide a security assessment method for large-scale end-side models based on physical signal perturbation. This method overcomes the shortcomings of existing technologies that lack systematic analysis of the operational security of large-scale end-side models under physical signal perturbation conditions. It proposes a security analysis method for large-scale end-side models based on physical signal injection. By applying controllable physical signal perturbation to the terminal, the operating behavior of the large-scale model is quantitatively evaluated, thereby realizing the analysis of the security and stability of the large-scale end-side model.

[0004] To achieve the above objectives, this invention provides a method for end-side large model security assessment based on physical signal perturbation, comprising the following steps: Step 1: Select the set of test prompt words The large edge model to be analyzed was run multiple times under no injection conditions, performing the same inference task. Performance parameters and output results were collected during the model's operation to form baseline behavioral characteristics. ; Step 2: Perform wired power disturbance injection testing. Inject a power disturbance signal with preset power parameters into the large-scale model at the end through the power supply path. The preset power parameters include disturbance amplitude, disturbance frequency, and disturbance duty cycle. Under the power disturbance conditions, based on the test prompt word set... Run the large-scale end-side model to obtain its performance and output behavior under wired injection conditions, thus forming the model's behavioral characteristics under power supply disturbance conditions. ; Step 3: Conduct electromagnetic radiation wireless injection tests. Electromagnetic interference signals are applied to the large-scale model at the end via spatial radiation. The control parameters of the electromagnetic interference signal include radiation frequency, radiation intensity, modulation method, and interference duty cycle. Under the conditions of the electromagnetic interference signal, based on the test prompt word set... By running a large-scale end-side model, the operational performance and output behavior of the large-scale end-side model under electromagnetic interference conditions are obtained, thus forming the model behavior characteristics under electromagnetic interference conditions. ; Step 4: Model behavior feature extraction. The three model behavior features obtained under baseline conditions, limited physical signal injection conditions, and electromagnetic radiation interference conditions are processed to quantify the differences between the three model behavior features and characterize the differences in the operation of the large end-side model under different operating conditions. Step 5: Conduct a safety assessment of the end-side large model. Compare and analyze the model behavior characteristics under wired physical signal injection conditions and electromagnetic radiation interference conditions with the baseline behavior characteristics. Quantitatively assess the degree of performance degradation and output stability changes of the end-side large model under different injection conditions, and achieve a comprehensive analysis of the safety and stability of the end-side large model.

[0005] Preferably, the specific process of step one is as follows: Select a set of test prompt words The formula is as follows: ; Obtain baseline behavioral characteristics The process is as follows: Baseline running is performed, which refers to running the test based on a set of test prompts under conditions without physical signal injection. The process of running the large edge model multiple times; baseline behavioral characteristics The formula is as follows: ; In the above formula, The runtime latency feature of the model refers to the time taken by the large model on the edge during an inference task, from the moment the test prompt word is sent into the model to the moment the model completes the generation of the corresponding output text. It is obtained by marking the start and end times of the model inference through control instructions. This represents the features of the candidate output word set. This refers to the output of the end-side large model during the inference process. Each candidate word and its corresponding probability or confidence information are used to characterize the stability of the model output. This represents the generated word sequence features. It refers to the encoded sequence corresponding to the output text generated by the large edge model during the inference process, where each word is represented as a discrete unit of the model's internal representation.

[0006] Preferably, the specific process of the power supply disturbance wired injection test in step two is as follows: Wired power disturbance injection refers to introducing power disturbance signals into the terminal through the terminal power supply path to simulate the physical operating environment under non-ideal power supply conditions, and to run the large-scale terminal model under controlled power disturbance conditions; the power disturbance signal refers to the disturbance component superimposed on the normal power supply signal of the terminal, and its time form formula is as follows: ; In the above formula, This indicates the magnitude of the power supply disturbance signal relative to the normal power supply level, and is controlled by adjusting the amplitude of the injected signal. It represents the variation characteristics of the power supply disturbance signal frequency in the time dimension, which can be a single frequency or a combination of multiple frequencies; The duty cycle of the power disturbance signal describes the proportion of time the power disturbance signal is in an effective injection state within a preset time window. By adjusting the disturbance duty cycle, the power disturbance signal can be injected continuously or intermittently. Describe the variation of power supply disturbance signals in the time domain, including sine waves, square waves, sawtooth waves, triangular waves, or combinations thereof, to simulate different types of power supply noise or power supply fluctuation characteristics. Applying a power disturbance signal Simultaneously, based on the fixed input prompt words selected in step one, the large-scale model on the running end is constructed, and the model's operating performance and output behavior characteristics under power disturbance conditions are collected to form the model behavior characteristics under wired physical signal injection conditions. The formula is as follows: ; When a power supply disturbance signal is applied to the model at the other end, This indicates the runtime latency characteristics of the edge model. This represents the features of the candidate output word set. This represents the features of the generated word sequence.

[0007] Preferably, in step three, an electromagnetic interference signal is applied via spatial radiation to run the large-scale end-side model under controlled electromagnetic interference conditions. Electromagnetic interference testing refers to applying an electromagnetic interference signal to the target terminal via spatial radiation without directly accessing the signal through the terminal's power supply path, to simulate the impact of external physical signals on the terminal's operating state under complex electromagnetic conditions. The electromagnetic interference signal refers to the electromagnetic field disturbance generated in the space surrounding the target terminal by the transmitting device, composed of a high-frequency carrier signal and a baseband disturbance signal. Its time-form formula is as follows: ; in, Used to characterize the field strength level of electromagnetic radiation interference signals at the target terminal, its magnitude can be controlled by adjusting the transmission power or radiation distance; The carrier frequency, which characterizes the high-frequency carrier signal, is used to determine the operating frequency band of electromagnetic radiation interference signals in order to achieve effective electromagnetic coupling to the internal circuits or communication links of the target terminal. Describes the proportion of time within a preset time window during which the electromagnetic radiation interference signal is in an effective radiation state, enabling continuous injection or intermittent injection. Describe the form of baseband disturbance signal in the time domain, including but not limited to sine wave, square wave, sawtooth wave, triangle wave or combination thereof; The method of loading baseband disturbance signals onto a high-frequency carrier includes self-amplitude modulation, frequency modulation, phase modulation, or combinations thereof, in order to control the spectral structure of electromagnetic radiation interference signals; When the electromagnetic radiation interference signal is applied Simultaneously, based on the set of test prompts selected in step one, the large-scale model on the endpoint is run, and the model's operating performance and output behavior characteristics under electromagnetic interference conditions are collected to form the model behavior characteristics under electromagnetic interference conditions. .

[0008] Preferably, in step four, the model's time-running features are processed as follows: Alignment processing for the set of test prompt words For the same prompt word The model's behavioral characteristics under different test conditions are matched to ensure the comparability of subsequent indicators; Model runtime latency characteristics This refers to the time taken from the start of input to the end of model output when given a prompt word, denoted as . 、 、 Operating speed degradation index and The formula is as follows: ; ; and The impact of wired injection and electromagnetic interference on the running speed of the large-scale model at the end side was quantified.

[0009] Preferably, in step four, the features of the candidate output word set are processed as follows: Candidate output word set features The output of the fingertip-side large model in each generation step The formula for the candidate words and their corresponding probabilities is as follows: ; In the above formula, This indicates the number of the input prompt word. Indicates the generation step number. Indicates the first 10 candidate words This represents the corresponding probability or confidence level, using candidate output word stability. Candidate set overlap rate indicates the degree of consistency of the candidate set for the same prompt word under different test conditions. and The formula is as follows: ; ; In the above formula, , , The terms represent the baseline condition, wired injection condition, and electromagnetic interference condition, respectively. Step Candidate word set This indicates the length of the corresponding output sequence. The larger the overlap rate of the candidate set, the more stable the candidate word set is.

[0010] Preferably, in step four, the processing for generating word sequence features is as follows: Generate word sequence features This refers to the semantic vector representation obtained after mapping the model's final output text to the semantic vector space, denoted as . , , The output text is encoded using a pre-defined text vectorization model, which maps the text content into high-dimensional semantic vectors. The stability of the generated word sequence is used to quantify the semantic consistency of the generated sequences under different test conditions, through a similarity function between semantic vectors. and The following formula is used to characterize it: ; ; In the above formula, This represents the similarity function between semantic vectors. The greater the similarity, the more consistent the model's output with the baseline output under physical signal injection conditions is at the semantic level, and the higher the stability of the model output.

[0011] Preferably, in step five, the evaluation process is as follows: For security assessment, a time degradation index is set. Consistency index of candidate set Consistency index with output semantics The behavioral characteristics of the model obtained under physical signal injection conditions are compared and analyzed with the baseline behavioral characteristics to quantify the performance degradation degree and output consistency change of the large-scale end-side model under physical signal perturbation conditions. This analysis is conducted when the runtime degradation index of the large-scale end-side model is... Exceeding the preset range, or inconsistent output of the candidate set. Below the preset range, or inconsistent output semantics. When the value is below the preset range, the operational stability of the large model on the determination side decreases under the corresponding physical signal injection conditions.

[0012] Therefore, the present invention employs the above-mentioned end-side large model security assessment method based on physical signal perturbation, which has the following advantages: In this invention, by introducing a physical signal injection mechanism, the security analysis of the large-scale terminal model is extended from the information domain to the physical domain, realizing a systematic assessment of the unstable factors in the model's operating environment. By quantitatively analyzing the model's operating performance and output behavior, the security and stability of the large-scale terminal model in a real physical environment can be more comprehensively reflected. The method of this invention does not rely on modifications to the model structure or parameters, has good versatility and scalability, and is applicable to different types of terminal terminals and large-scale model systems.

[0013] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0014] Figure 1 This is a flowchart of a large-scale end-side security assessment method based on physical signal perturbation according to the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Specific model specifications need to be selected and determined according to the actual specifications of the device, etc. The specific selection calculation method adopts existing technology in the art, and therefore will not be described in detail.

[0016] Example like Figure 1 As shown, this invention provides a method for end-side large model security assessment based on physical signal perturbation, comprising the following steps: Step 1: Select the set of test prompt words The large edge model to be analyzed was run multiple times under no injection conditions, performing the same inference task. Performance parameters and output results were collected during the model's operation to form baseline behavioral characteristics. The specific execution process is as follows: Test prompts The formula is as follows: ; Obtain baseline behavioral characteristics The process is as follows: The large-scale model on the edge performs baseline operation. Baseline operation refers to running the model based on test prompts under conditions without physical signal injection. Multiple runs of the large edge model to determine baseline behavioral characteristics The formula is as follows: ; In the above formula, The runtime latency feature of the model refers to the time taken by the large model on the edge during an inference task, from the moment the test prompt word is sent into the model to the moment the model completes the generation of the corresponding output text. It is obtained by marking the start and end times of the model inference through control instructions. This represents the features of the candidate output word set. This refers to the output of the end-side large model during the inference process. Each candidate word and its corresponding probability or confidence information are used to characterize the stability of the model output. This represents the generated word sequence features. It refers to the encoded sequence corresponding to the output text generated by the large edge model during the inference process, where each word is a discrete unit represented internally by the model.

[0017] Step 2: Perform wired power disturbance injection testing. Inject a power disturbance signal with preset power parameters into the large-scale model at the end through the power supply path. The preset power parameters include disturbance amplitude, disturbance frequency, and disturbance duty cycle. Under the power disturbance conditions, based on the test prompt word set... Run the large-scale end-side model to obtain its performance and output behavior under wired injection conditions, thus forming the model's behavioral characteristics under power supply disturbance conditions. The specific process of the wired power disturbance injection test is as follows: Wired power disturbance injection refers to introducing power disturbance signals into the terminal through the terminal power supply path to simulate the physical operating environment under non-ideal power supply conditions, and to run the large-scale terminal model under controlled power disturbance conditions; the power disturbance signal refers to the disturbance component superimposed on the normal power supply signal of the terminal, and its time form formula is as follows: ; In the above formula, This indicates the magnitude of the power supply disturbance signal relative to the normal power supply level, and is controlled by adjusting the amplitude of the injected signal. It represents the variation characteristics of the power supply disturbance signal frequency in the time dimension, which can be a single frequency or a combination of multiple frequencies; It represents the duty cycle of the power disturbance signal, describing the proportion of time the power disturbance signal is in an effective injection state within a preset time window. By adjusting the disturbance duty cycle, the power disturbance signal can be injected continuously or intermittently. Describe the variation of power supply disturbance signals in the time domain, including sine waves, square waves, sawtooth waves, triangular waves, or combinations thereof, to simulate different types of power supply noise or power supply fluctuation characteristics. Applying a power disturbance signal Simultaneously, based on the fixed input prompt words selected in step one, the large-scale model on the running end is constructed, and the model's operating performance and output behavior characteristics under power disturbance conditions are collected to form the model behavior characteristics under wired physical signal injection conditions. The formula is as follows: ; When a power supply disturbance signal is applied to the model at the other end, This indicates the runtime latency characteristics of the edge model. This represents the features of the candidate output word set. This represents the features of the generated word sequence.

[0018] Step 3: Conduct electromagnetic radiation wireless injection tests. Electromagnetic interference signals are applied to the large-scale model at the end via spatial radiation. The control parameters of the electromagnetic interference signal include radiation frequency, radiation intensity, modulation method, and interference duty cycle. Under the conditions of the electromagnetic interference signal, based on the test prompts... By running a large-scale end-side model, the operational performance and output behavior of the large-scale end-side model under electromagnetic interference conditions are obtained, thus forming the model behavior characteristics under electromagnetic interference conditions. The specific implementation process is as follows: Electromagnetic interference (EMI) testing involves applying electromagnetic interference signals to a target terminal via spatial radiation to simulate the impact of external physical signals on the terminal's operational status under controlled electromagnetic interference conditions. The EMI signal is an electromagnetic field disturbance generated in the space surrounding the target terminal by a transmitting device, consisting of a high-frequency carrier signal and a baseband disturbance signal. Its time-form formula is as follows: ; in, Used to characterize the field strength level of electromagnetic radiation interference signals at the target terminal, its magnitude can be controlled by adjusting the transmission power or radiation distance; The carrier frequency, which characterizes the high-frequency carrier signal, is used to determine the operating frequency band of electromagnetic radiation interference signals in order to achieve effective electromagnetic coupling to the internal circuits or communication links of the target terminal. Describes the proportion of time within a preset time window during which the electromagnetic radiation interference signal is in an effective radiation state, enabling continuous injection or intermittent injection. Describe the form of baseband disturbance signal in the time domain, including but not limited to sine wave, square wave, sawtooth wave, triangle wave or combination thereof; The method of loading baseband disturbance signals onto a high-frequency carrier includes self-amplitude modulation, frequency modulation, phase modulation, or combinations thereof, in order to control the spectral structure of electromagnetic radiation interference signals; Applying electromagnetic radiation interference signals Simultaneously, based on the test prompts selected in step one, the large-scale model on the operating side is run, and the model's operating performance and output behavior characteristics under electromagnetic interference conditions are collected to form the model's behavior characteristics under electromagnetic interference conditions, which are recorded. .

[0019] Step 4: Model behavior feature extraction. The three model behavior features obtained under baseline conditions, limited physical signal injection conditions, and electromagnetic radiation interference conditions are processed to quantify the differences between the three model behavior features and characterize the differences in the operation of the large end-side model under different conditions. Alignment processing for test prompt words For the same prompt word The model behavior features generated under different test conditions are mapped to ensure the comparability of subsequent indicators and facilitate subsequent comparisons. The model runtime features are processed as follows: model runtime latency features This refers to the time taken from the start of input to the end of model output when given a prompt word, denoted as . 、 、 Operating speed degradation index and The formula is as follows: ; ; and The impact of wired injection and electromagnetic interference on the running speed of the large-scale model at the end side was quantified separately. The processing of the candidate output word set features is as follows: Candidate output word set features The output of the fingertip-side large model in each generation step The formula for the candidate words and their corresponding probabilities is as follows: In the above formula, This indicates the number of the input prompt word. Indicates the generation step number. Indicates the first 10 candidate words This represents the corresponding probability or confidence level, using candidate output word stability. The formula for candidate set overlap rate, which represents the consistency of candidate sets for the same prompt word under different test conditions, is as follows: ; ; In the above formula, , , These represent the baseline condition, wired injection condition, and electromagnetic interference condition, respectively. Step Candidate word set This indicates the length of the corresponding output sequence. A larger value indicates a more stable set of candidate words.

[0020] The processing of generated word sequence features is as follows: Generating word sequence features This refers to the semantic vector representation obtained after mapping the model's final output text to the semantic vector space, denoted as . , , The output text is encoded using a pre-defined text vectorization model, which maps the text content into high-dimensional semantic vectors. The stability of the generated word sequence is used to quantify the semantic consistency of the generated sequences under different test conditions, based on the similarity or distance between semantic vectors. The following formula is used to characterize it: ; ; In the above formula, This represents a similarity function between semantic vectors. The larger the value, the more semantically consistent the model's output under physical signal injection conditions is with the baseline output, and the higher the model's output stability.

[0021] Step 5: Conduct a safety assessment of the large-scale end-side model. Compare and analyze the model's behavioral characteristics under wired physical signal injection conditions and electromagnetic radiation interference conditions with the baseline behavioral characteristics. Quantitatively assess the degree of performance degradation and output stability changes of the large-scale end-side model under different injection conditions, achieving a comprehensive analysis of the safety and stability of the large-scale end-side model. The assessment process is as follows: For security assessment, a time degradation index is set. Consistency index of candidate set Consistency index with output semantics The behavioral characteristics of the model obtained under physical signal injection conditions are compared and analyzed with the baseline behavioral characteristics to quantify the performance degradation degree and output consistency change of the large-scale end-side model under physical signal perturbation conditions. This analysis is conducted when the runtime degradation index of the large-scale end-side model is... Exceeding the preset range, or inconsistent output of the candidate set. Below the preset range, or inconsistent output semantics. When the value is below the preset range, the operational stability of the large model on the determination side decreases under the corresponding physical signal injection conditions.

[0022] Here is a specific experimental example: (I) Deploying the large-scale model and test platform on the device side: In this embodiment, the Qwen2.50.5B model released on the HuggingFace platform is selected as the large-scale model to be tested on the device side. The model parameters are of moderate size, enabling local inference to be completed on resource-constrained device side, making it suitable for device side operation scenarios. It should be noted that this invention does not limit the specific model type; other large models that can run on device side terminals are also applicable to this method. The device side is selected as a smart terminal as the test platform. In this embodiment, a Jetson Nano (8GB) is used as an example. The device side runs a Linux operating system, loads the large-scale model on the device side through a Python inference script, and executes the text generation task.

[0023] (II) Baseline Test Setup. Under conditions without physical signal injection, a fixed set of input prompts is selected for baseline testing. These prompts cover typical application scenarios such as everyday Q&A and professional domain descriptions. The number of prompts is fixed, for example, 10, to ensure consistency of input under different test conditions. The large-scale edge model is run multiple times under baseline conditions. The runtime from input prompts to output completion during model inference is collected, and the candidate output word set and final output text generated by the model are recorded to construct baseline behavioral features.

[0024] (III) Wired Physical Signal Injection Test. In the wired physical signal injection test, a high-frequency power supply disturbance signal is superimposed on the power supply line of the Jetson Nano device to simulate an unstable power supply or power supply noise environment. The controllable parameters of the power supply disturbance signal include: disturbance frequency. Scanning was performed in the range of 10MHz to 3GHz; perturbation amplitude The voltage variation range is 0V to 5% of the rated voltage to prevent damage to the hardware from excessive voltage; disturbance duty cycle. The range is 1% to 100%, simulating either pulsed or continuous injection; waveform Selected from sine waves, square waves, sawtooth waves, or combinations thereof.

[0025] While applying the aforementioned power supply disturbance signal, a large-scale end-side model was run based on the same set of input prompts, and the model's behavior under different combinations of disturbance parameters was recorded. Test results show that under a 360MHz disturbance frequency, an amplitude greater than 0.47V, a 10% duty cycle, and a sinusoidal signal injection, the model's running time significantly increased compared to the baseline conditions, from an average of 5.36 seconds to 7.02 seconds. This indicates that physical disturbances on the power supply side have an observable impact on the operation of the large-scale end-side model.

[0026] (iv) Electromagnetic Radiation Interference Test. In the electromagnetic radiation interference test, a non-contact physical signal injection method is used to inject the Jetson Nano device via spatial radiation. The electromagnetic radiation interference signal consists of a high-frequency carrier signal and a baseband disturbance signal. Its parameters include: carrier frequency... Scanning was performed in the range of 500MHz to 3GHz; perturbation amplitude The variation range is -20dBm to 20dBm to prevent excessive voltage from damaging the hardware; perturbation duty cycle The range is 1% to 100%, simulating either pulsed or continuous injection; waveform Selected from sine waves, square waves, sawtooth waves, or combinations thereof; modulation method Amplitude modulation is used.

[0027] The large-scale model was run on the end-side under electromagnetic interference conditions, and the model inference process was monitored. The test results show that under the combined conditions of 973MHz carrier frequency and 20dBm radiation intensity, the model inference speed is significantly slower, and the semantic similarity of the output results in some tests is significantly reduced compared with the baseline conditions, reflecting the impact of electromagnetic interference on the operational stability of the large-scale model on the end-side.

[0028] Therefore, this invention employs a security assessment method for large-scale edge models based on physical signal perturbation. By introducing a physical signal injection mechanism, the security analysis of large-scale edge models is extended from the information domain to the physical domain, enabling a systematic assessment of unstable factors in the model's operating environment. Through quantitative analysis of model performance and output behavior, the security and stability of large-scale edge models in real physical environments can be more comprehensively reflected. This invention's method does not rely on modifications to the model structure or parameters, possesses good versatility and scalability, and is applicable to different types of edge terminals and large-scale model systems.

[0029] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for end-side large-scale model security assessment based on physical signal perturbation, characterized in that: Includes the following steps: Step 1: Select the set of test prompt words The large edge model to be analyzed was run multiple times under no injection conditions, performing the same inference task. Performance parameters and output results were collected during the model's operation to form baseline behavioral characteristics. ; Step 2: Perform wired power disturbance injection testing. Inject a power disturbance signal with preset power parameters into the large-scale model at the end through the power supply path. The preset power parameters include disturbance amplitude, disturbance frequency, and disturbance duty cycle. Under the power disturbance conditions, based on the test prompt word set... Run the large-scale end-side model to obtain its performance and output behavior under wired injection conditions, thus forming the model's behavioral characteristics under power supply disturbance conditions. ; Step 3: Conduct electromagnetic radiation wireless injection tests. Electromagnetic interference signals are applied to the large-scale model at the end via spatial radiation. The control parameters of the electromagnetic interference signal include radiation frequency, radiation intensity, modulation method, and interference duty cycle. Under the conditions of the electromagnetic interference signal, based on the test prompt word set... By running a large-scale end-side model, the operational performance and output behavior of the large-scale end-side model under electromagnetic interference conditions are obtained, thus forming the model behavior characteristics under electromagnetic interference conditions. ; Step 4: Model behavior feature extraction. The three model behavior features obtained under baseline conditions, limited physical signal injection conditions, and electromagnetic radiation interference conditions are processed to quantify the differences between the three model behavior features and characterize the differences in the operation of the large end-side model under different operating conditions. Step 5: Conduct a safety assessment of the end-side large model. Compare and analyze the model behavior characteristics under wired physical signal injection conditions and electromagnetic radiation interference conditions with the baseline behavior characteristics. Quantitatively assess the degree of performance degradation and output stability changes of the end-side large model under different injection conditions, and achieve a comprehensive analysis of the safety and stability of the end-side large model.

2. The end-side large model security assessment method based on physical signal perturbation according to claim 1, characterized in that: The specific process of step one is as follows: Select a set of test prompt words The formula is as follows: ； Obtain baseline behavioral characteristics The process is as follows: Baseline running is performed, which refers to running the test based on a set of test prompts under conditions without physical signal injection. The process of running the large edge model multiple times; Baseline behavioral characteristics The formula is as follows: ； In the above formula, The runtime latency feature of the model refers to the time taken by the large model on the edge during an inference task, from the moment the test prompt word is sent into the model to the moment the model completes the generation of the corresponding output text. It is obtained by marking the start and end times of the model inference through control instructions. This represents the features of the candidate output word set. This refers to the output of the end-side large model during the inference process. Each candidate word and its corresponding probability or confidence information are used to characterize the stability of the model output. This represents the generated word sequence features. It refers to the encoded sequence corresponding to the output text generated by the large edge model during the inference process, where each word is represented as a discrete unit of the model's internal representation.

3. The end-side large model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step two, the specific process of the wired power disturbance injection test is as follows: Wired power disturbance injection refers to introducing power disturbance signals into the terminal through the terminal power supply path to simulate the physical operating environment under non-ideal power supply conditions, and to run the large-scale terminal model under controlled power disturbance conditions; the power disturbance signal refers to the disturbance component superimposed on the normal power supply signal of the terminal, and its time form formula is as follows: ； In the above formula, This indicates the magnitude of the power supply disturbance signal relative to the normal power supply level, and is controlled by adjusting the amplitude of the injected signal. It represents the variation characteristics of the power supply disturbance signal frequency in the time dimension, which can be a single frequency or a combination of multiple frequencies; The duty cycle of the power disturbance signal describes the proportion of time the power disturbance signal is in an effective injection state within a preset time window. By adjusting the disturbance duty cycle, the power disturbance signal can be injected continuously or intermittently. Describe the variation of power supply disturbance signals in the time domain, including sine waves, square waves, sawtooth waves, triangular waves, or combinations thereof, to simulate different types of power supply noise or power supply fluctuation characteristics. Applying a power disturbance signal Simultaneously, based on the fixed input prompt words selected in step one, the large-scale model on the running end is constructed, and the model's operating performance and output behavior characteristics under power disturbance conditions are collected to form the model behavior characteristics under wired physical signal injection conditions. The formula is as follows: ； When a power supply disturbance signal is applied to the model at the other end, This indicates the runtime latency characteristics of the edge model. This represents the features of the candidate output word set. This represents the features of the generated word sequence.

4. The end-side large-scale model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step three, electromagnetic interference signals are applied via spatial radiation to run the large-scale end-side model under controlled electromagnetic interference conditions. Electromagnetic interference testing refers to applying electromagnetic interference signals to the target terminal via spatial radiation without directly accessing the signal through the terminal's power supply path. This simulates the impact of external physical signals on the terminal's operating state under complex electromagnetic conditions. The electromagnetic interference signal refers to the electromagnetic field disturbance generated in the space surrounding the target terminal by the transmitting device, composed of a high-frequency carrier signal and a baseband disturbance signal. Its time-form formula is as follows: ； in, Used to characterize the field strength level of electromagnetic radiation interference signals at the target terminal, its magnitude can be controlled by adjusting the transmission power or radiation distance; The carrier frequency, which characterizes the high-frequency carrier signal, is used to determine the operating frequency band of electromagnetic radiation interference signals in order to achieve effective electromagnetic coupling to the internal circuits or communication links of the target terminal. Describes the proportion of time within a preset time window during which the electromagnetic radiation interference signal is in an effective radiation state, enabling continuous injection or intermittent injection. Describe the form of baseband disturbance signal in the time domain, including but not limited to sine wave, square wave, sawtooth wave, triangle wave or combination thereof; The method of loading baseband disturbance signals onto a high-frequency carrier includes self-amplitude modulation, frequency modulation, phase modulation, or combinations thereof, in order to control the spectral structure of electromagnetic radiation interference signals; When the electromagnetic radiation interference signal is applied Simultaneously, based on the set of test prompts selected in step one, the large-scale model on the endpoint is run, and the model's operating performance and output behavior characteristics under electromagnetic interference conditions are collected to form the model behavior characteristics under electromagnetic interference conditions. .

5. The end-side large-scale model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step four, the model's time-based runtime features are processed as follows: Alignment processing for the set of test prompt words For the same prompt word The model's behavioral characteristics under different test conditions are matched to ensure the comparability of subsequent indicators; Model runtime latency characteristics This refers to the time taken from the start of input to the end of model output when given a prompt word, denoted as . 、 、 Operating speed degradation index and The formula is as follows: ； ； and The impact of wired injection and electromagnetic interference on the running speed of the large-scale model at the end side was quantified.

6. The end-side large model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step four, the features of the candidate output word set are processed as follows: Candidate output word set features The output of the fingertip-side large model in each generation step The formula for the candidate words and their corresponding probabilities is as follows: ； In the above formula, This indicates the number of the input prompt word. Indicates the generation step number. Indicates the first 10 candidate words This represents the corresponding probability or confidence level, using candidate output word stability. Candidate set overlap rate indicates the degree of consistency of the candidate set for the same prompt word under different test conditions. and The formula is as follows: ； ； In the above formula, , , The terms represent the baseline condition, wired injection condition, and electromagnetic interference condition, respectively. Step Candidate word set This indicates the length of the corresponding output sequence. The larger the overlap rate of the candidate set, the more stable the candidate word set is.

7. The end-side large model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step four, the processing for generating word sequence features is as follows: Generate word sequence features This refers to the semantic vector representation obtained after mapping the model's final output text to the semantic vector space, denoted as . , , The output text is encoded using a pre-defined text vectorization model, which maps the text content into high-dimensional semantic vectors. The stability of the generated word sequence is used to quantify the semantic consistency of the generated sequences under different test conditions, through a similarity function between semantic vectors. and The following formula is used to characterize it: ； In the above formula, This represents the similarity function between semantic vectors. The greater the similarity, the more consistent the model's output with the baseline output under physical signal injection conditions is at the semantic level, and the higher the stability of the model output.

8. The end-side large-scale model security assessment method based on physical signal perturbation according to claim 1, characterized in that: In step five, the evaluation process is as follows: For security assessment, a time degradation index is set. Consistency index of candidate set Consistency index with output semantics The behavioral characteristics of the model obtained under physical signal injection conditions are compared and analyzed with the baseline behavioral characteristics to quantify the performance degradation degree and output consistency change of the large-scale end-side model under physical signal perturbation conditions. This analysis is conducted when the runtime degradation index of the large-scale end-side model is... Exceeding the preset range, or inconsistent output of the candidate set. Below the preset range, or inconsistent output semantics. When the value is below the preset range, the operational stability of the large model on the determination side decreases under the corresponding physical signal injection conditions.

Images