A safety benchmark evaluation system for interpretable artificial intelligence models

Abstract

This invention relates to the field of artificial intelligence security testing technology, specifically disclosing an interpretable artificial intelligence model security benchmark evaluation system, including an interpretable evaluation engine. The interpretable evaluation engine is communicatively connected to the following modules: a topology boundary construction module, used to integrate node security analysis and spectral clustering algorithms to reconstruct the high-dimensional abstract data within the artificial intelligence model under test into a perceptible graph structure, constructing the global topology structure of the model's decision boundary. This invention, by integrating node security analysis and spectral clustering algorithms, reconstructs the high-dimensional abstract features within the model into a perceptible weighted topology graph. Utilizing spectral embedding and adaptive segmentation techniques, it accurately identifies loosely clustered and vaguely defined sensitive regions in the feature space, overcoming the limitations of traditional methods that rely on a single gradient direction leading to local perception. This achieves accurate modeling of the global structure of the model's decision boundary and systematic delineation of vulnerable node candidate domains.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security testing technology, and in particular to a security benchmark evaluation system for interpretable artificial intelligence models. Background Technology

[0002] With the advancement of technologies such as deep learning and natural language processing, AI models are being applied more and more deeply in fields such as finance, healthcare, and security. However, the security issues of AI models are also becoming increasingly prominent, including potential threats such as data leakage, adversarial attacks, and model tampering. Therefore, establishing unified security benchmark evaluation standards has become an important means to ensure the reliability and security of AI technology.

[0003] For example, a method for evaluating the security benchmark of an artificial intelligence model, published in Chinese Patent Publication No. CN120296733A, greatly reduces the manual time cost of generating adversarial examples by using a dynamic adversarial example generation mechanism, avoids the possibility of the evaluated model obtaining adversarial examples, and ensures the security and reliability of the evaluation results.

[0004] Existing technologies for benchmarking the security of AI models suffer from a lack of global awareness due to the reliance of attack paths on a single gradient direction. This results in generated adversarial examples failing to fully detect vulnerable regions in the model's feature space. Furthermore, existing methods cannot dynamically optimize attack paths for identified vulnerable regions, making it difficult to minimize perturbation while maintaining attack strength. Consequently, the final evaluation results only present a superficial score, making it difficult to establish a causal relationship between vulnerable nodes and model security fluctuations. This lack of interpretable guidance on the root causes of model security defects addresses the aforementioned problems. To resolve these issues, we propose an interpretable AI model security benchmarking system. Summary of the Invention

[0005] To overcome the shortcomings of the prior art, the present invention provides a safety benchmark evaluation system for interpretable artificial intelligence models, which can effectively solve the problems involved in the prior art.

[0006] The objective of this invention can be achieved through the following technical solution: This invention provides a safety benchmark evaluation system for interpretable artificial intelligence models, including an interpretable evaluation engine, wherein the interpretable evaluation engine is communicatively connected to the following modules:

[0007] The topology boundary construction module is used to integrate node security analysis and spectral clustering algorithms to reconstruct the high-dimensional abstract data inside the AI ​​model under test into a perceptible graph structure, construct the global topology structure of the model decision boundary, and locate the candidate domain of vulnerable nodes in the feature space, thereby realizing the visualization modeling of the high-dimensional feature space and improving the globality of vulnerable area location.

[0008] The vulnerable node localization module, based on the constructed global topology, combines local topology density and decision boundary distance to calculate the safety factor of each node, quantify the sensitivity of nodes to minor perturbations, establish a preliminary ranking of vulnerabilities, and use heuristic rules to identify the set of minimal nodes that contribute the most to the perturbation of model output, i.e., the key vulnerable nodes that determine the lower limit of model safety, quantify the vulnerability of nodes, and accurately anchor the core nodes that affect model safety.

[0009] The dynamic path optimization module combines particle swarm optimization and gradient guidance mechanisms to dynamically search for the optimal attack path within the candidate domain of identified vulnerable nodes, generating adversarial samples with minimal perturbation, achieving global and local collaborative optimization, and improving the efficiency and concealment of adversarial sample generation.

[0010] The causal effect inference module is used to employ causal inference techniques to remove the interference of irrelevant variables, quantitatively calculate the net effect of a specific vulnerable node being attacked on the final security performance index of the model, establish causal relationships rather than correlational relationships, remove the interference of confusing factors, and establish the causal relationship between node perturbation and model failure.

[0011] The explanation tree construction module is used to input the inference results of causal effects into the decision tree algorithm, generate an explanation tree of the contribution of vulnerable nodes to the fluctuation of model security, show the root path of security defects in the AI ​​model under test, visualize the transmission path of security defects, and provide traceable explanatory evidence.

[0012] Preferably, the topology boundary construction module includes a feature node mapping unit and a spectral clustering partitioning unit;

[0013] The feature node mapping unit, based on node security analysis, maps the feature vectors of the AI ​​model under test to independent nodes in a graph structure, calculates the association strength between nodes as edge weights, and transforms them into a computable weighted topology graph, thus transforming abstract features into a computable graph structure and providing a structured basis for subsequent analysis.

[0014] The spectral clustering partitioning unit is used to cut and divide the generated weighted topology map using the spectral clustering algorithm, identify sensitive areas that are loosely clustered and have blurred boundaries in the feature space, delineate candidate domains of vulnerable nodes that are susceptible to attack, automatically identify areas with blurred boundaries, and narrow the search range of vulnerable nodes.

[0015] Preferably, the feature node mapping unit performs the following steps:

[0016] The activation vectors of the AI ​​model under test in the high-level hidden layer are obtained. The feature dimensions that contribute to the decision boundary are extracted through node security analysis. These features are discretized into independent nodes in the graph structure, and a global topological structure prototype of the model decision boundary is constructed. High-contribution features are effectively screened, and an interpretable graph structure foundation is built.

[0017] Based on the co-occurrence frequency and directional consistency of feature vectors in the sample space, the cosine similarity and mutual information entropy between nodes are calculated. The quantified association strength is mapped to the edge weights of the connecting nodes in the topological graph, so that the topological relationship of the decision boundary can be numerically represented, realizing the quantitative expression of feature association and enhancing the computability of topological relationship.

[0018] A graph attention mechanism is used to dynamically calibrate the initial edge weights, strengthen the structural associations between vulnerable features, reconstruct the original high-dimensional feature space into a low-dimensional computable weighted topological graph, complete the accurate modeling of the global topological structure of the decision boundary, improve the connection weights of vulnerable features, and achieve accurate mapping from high-dimensional to low-dimensional.

[0019] Preferably, the spectral clustering partitioning unit performs the following steps:

[0020] Based on the weighted topology graph generated by the feature node mapping unit, a Laplacian matrix is ​​constructed and its eigenvectors are calculated. The graph nodes are projected into a low-dimensional space through spectral embedding to preserve global structural information. The high-dimensional graph structure is losslessly compressed to a low-dimensional space, providing a data foundation with structural fidelity for subsequent clustering.

[0021] The K-means clustering algorithm is used to iteratively divide the node vectors after spectral embedding. The optimal number of clusters is automatically determined based on the silhouette coefficient and modularity. Sensitive regions with blurred boundaries and sparse inter-class connections are cut out. The algorithm adaptively identifies the boundaries of vulnerable regions in the topology graph, avoiding the subjective bias of manually setting the number of clusters.

[0022] Calculate the node density distribution and cross-boundary connection ratio in each sensitive area, delineate the node set with low local clustering and close to the decision boundary as the candidate domain of vulnerable nodes, accurately screen the node set located near the decision boundary and with a fragile structure, and narrow the attack surface to high-risk areas.

[0023] Preferably, the vulnerable node location module performs the following steps:

[0024] Based on the global topology, the local topological density of each node is extracted, and the Euclidean distance to the nearest decision boundary is calculated. The two are then fused to construct a joint distribution function of the node safety coefficient, completing the preliminary ranking of vulnerability. This effectively integrates structural density and boundary proximity to achieve a quantitative ranking of node vulnerability.

[0025] Based on the initial ranking, heuristic rules are introduced to iteratively screen the candidate domain of vulnerable nodes using the minimum correlation maximum redundancy criterion. Redundant nodes with similar safety coefficients are eliminated, and a subset of features that significantly contribute to the perturbation of the model output is retained. Redundant nodes are eliminated while ensuring the contribution, thereby improving the compactness of key feature screening.

[0026] A boundary approximation verification mechanism is applied to the retained feature subset. By injecting a small amount of perturbation, the marginal contribution of each node to the decision bias is tested. Finally, the key vulnerable nodes that constitute the safety lower bound of the model are anchored. The safety lower bound nodes are accurately locked through the marginal contribution verification, which enhances the pertinence and reliability of the evaluation.

[0027] Preferably, the dynamic path optimization module includes a particle swarm perturbation generation unit and a gradient-guided optimization unit;

[0028] The particle swarm perturbation generation unit is used to model the generation process of adversarial examples as the optimization process of the particle swarm in the candidate domain of vulnerable nodes in the particle swarm algorithm. Each particle represents a perturbation path. The global optimal attack direction is explored through group cooperation, and candidate attack paths are selected. The diversity of path exploration is enhanced by searching for the global optimal attack direction through swarm intelligence.

[0029] The gradient-guided optimization unit, based on the gradient-guided mechanism, applies gradient constraints to the candidate attack paths selected by the particle swarm. While ensuring the success rate of the attack, it gradually reduces redundant perturbations through a backtracking mechanism to generate adversarial samples that target key vulnerable nodes with minimal perturbation. This minimizes the perturbation amplitude while ensuring the success rate of the attack, thereby improving the concealment of the adversarial samples.

[0030] Preferably, the particle swarm perturbation generation unit performs the following steps:

[0031] The subspace formed by key vulnerable nodes is defined as the optimization boundary. The position and velocity vectors of the particle swarm are initialized. Each particle represents a candidate perturbation path starting from the original sample, ensuring that the search space focuses on the feature dimension with the greatest security threat and improving optimization efficiency.

[0032] The fitness function is defined as a weighted combination of attack success rate and perturbation magnitude, which guides the particle swarm to iteratively update its velocity and position in the vulnerable node subspace, and searches for the globally optimal direction that crosses the decision boundary, thereby achieving a dynamic balance between perturbation magnitude and success rate while ensuring the effectiveness of the attack.

[0033] By recording the individual optimal and global optimal paths through a population collaboration mechanism, multiple candidate attack paths with fast convergence speed and successful crossing of the decision boundary are selected, avoiding getting trapped in local optima and providing a diverse and high-quality path foundation for subsequent refined optimization.

[0034] Preferably, the gradient-guided optimization unit performs the following steps:

[0035] The gradient matrix of the loss function relative to the input features is calculated for the candidate attack paths selected by particle swarm optimization. The gradient direction is used as a constraint for path optimization. Perturbation dimensions that are irrelevant to vulnerable nodes are eliminated to ensure that the perturbation only acts on the key features that have the greatest influence on the decision boundary.

[0036] A backtracking pruning mechanism is established based on gradient constraints. The redundant step size is reduced layer by layer from the end of the perturbation, and the minimal perturbation component that maintains the success rate of the attack is retained. The perturbation amplitude is compressed to the minimum while keeping the attack effective.

[0037] The candidate attack paths after pruning are verified by boundary convergence. Adversarial examples are generated that minimize the perturbation amplitude in the vulnerable node subspace and the attack path crosses the decision boundary, thus achieving accurate generation of adversarial examples and optimal control of perturbation amplitude.

[0038] Preferably, the causal effect inference module performs the following steps:

[0039] The state of perturbation applied to key vulnerable nodes is defined as a binary intervention variable, and the classification boundary offset of the model output is defined as the outcome variable. A structured causal model is constructed based on graph structure and feature dependency to accurately characterize the causal path between node perturbation and model response, laying an interpretable foundation for effect estimation.

[0040] The backdoor adjustment criterion is used to identify and control confounding variables. The treatment group and the control group are constructed by inverse probability weighted matching. The interference of model architecture and input distribution on effect estimation is eliminated, and confounding bias is effectively removed to ensure the attribution purity and credibility of nodal perturbation effects.

[0041] The average processing effect of perturbations on critical vulnerable nodes on model security indicators is calculated, the net change in classification boundary shift after a specific node is attacked is quantified, causal effect values ​​are established, and the quantitative ranking of node vulnerability is achieved, which intuitively reflects the critical impact of each node on model security.

[0042] Preferably, the interpretation tree construction module performs the following steps:

[0043] The causal effect values ​​of each key vulnerable node are collected from the causal effect inference module. The local density and boundary distance attributes of the nodes in the topology are integrated to construct a training dataset with node features as input and model failure status as label. The model failure status is used as the target variable. The causal effect and topology attributes are integrated to improve the accuracy of the training data in representing security defects.

[0044] The classification and regression tree algorithm is used to recursively divide the training dataset into two parts. The optimal splitting node features are selected based on the criterion of maximizing the decrease of the Gini coefficient. The contribution explanation tree is composed of vulnerable nodes and has a hierarchical binary tree structure. The splitting nodes are optimized by the Gini coefficient to ensure that the explanation tree structure is compact and highly discriminative.

[0045] Extract the complete splitting path of the contribution explanation tree from the root node to the leaf node, analyze the conditional dependencies between key vulnerable nodes, and visualize the causal root path of the model's security defects from the initial perturbation to the final failure. Present the causal transmission chain with path visualization to enhance the traceability and interpretability of the model's security defects.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1. This interpretability-based artificial intelligence model security benchmark evaluation system integrates node security analysis and spectral clustering algorithms to reconstruct the high-dimensional abstract features inside the model into a perceptible weighted topology graph. By utilizing spectral embedding and adaptive cutting techniques, it accurately identifies loosely clustered and vaguely defined sensitive regions in the feature space. This overcomes the limitations of traditional methods that rely on a single gradient direction, resulting in local perception, and achieves accurate modeling of the global structure of the model's decision boundary and systematic delineation of candidate domains for vulnerable nodes.

[0048] 2. This interpretation-based artificial intelligence model security benchmark evaluation system combines particle swarm optimization and gradient guidance mechanism to perform global optimization in the subspace composed of key vulnerable nodes. Through group collaboration and backtracking pruning strategy, it dynamically searches for the optimal attack path and gradually reduces redundant perturbations while ensuring the success rate of the attack. This solves the technical problem that existing methods cannot balance attack strength and perturbation amplitude, and generates adversarial samples with strong targeting and minimal perturbation amplitude.

[0049] 3. This interpretability-based artificial intelligence model security benchmark evaluation system introduces a structured causal model and a backdoor adjustment criterion. By using inverse probability weighted matching to remove the interference of confounding variables, it quantitatively calculates the net effect of perturbations of key vulnerable nodes on the model security index. This elevates the surface score presented in traditional evaluations to a clear causal effect value, achieving a qualitative change from correlation analysis to causal inference, and providing a scientific basis for identifying the root causes of model security defects. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the workflow of a safety benchmark evaluation system for interpretable artificial intelligence models according to the present invention;

[0051] Figure 2 This is a schematic diagram of the structural configuration of a safety benchmark evaluation system for interpretable artificial intelligence models according to the present invention. Detailed Implementation

[0052] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0053] Example 1, please refer to Figure 1 , Figure 2 This invention provides a technical solution: a safety benchmark evaluation system for interpretable artificial intelligence models, including an interpretable evaluation engine, which has the following communication connections:

[0054] The topology boundary construction module is used to integrate node security analysis and spectral clustering algorithms to reconstruct the high-dimensional abstract data inside the AI ​​model under test into a perceptible graph structure, construct the global topology structure of the model decision boundary, and locate the candidate domain of vulnerable nodes in the feature space, realize the visualization modeling of the high-dimensional feature space, and improve the globality of vulnerable area location. The topology boundary construction module includes a feature node mapping unit and a spectral clustering partitioning unit.

[0055] The feature node mapping unit, based on node security analysis, maps the feature vectors of the AI ​​model under test to independent nodes in a graph structure, calculates the association strength between nodes as edge weights, and transforms them into a computable weighted topological graph. This transforms abstract features into a computable graph structure, providing a structured foundation for subsequent analysis. It obtains the activation vectors of the AI ​​model under test in high-level hidden layers, extracts feature dimensions that contribute discriminatively to the decision boundary through node security analysis, discretizes them into independent nodes in the graph structure, constructs a preliminary global topological structure of the model's decision boundary, effectively filters high-contribution features, and builds an interpretable graph structure. Based on the co-occurrence frequency and directional consistency of feature vectors in the sample space, the cosine similarity and mutual information entropy between nodes are calculated. The quantified association strength is mapped to the edge weights of the connecting nodes in the topological graph, so that the topological relationship of the decision boundary can be numerically represented, realizing the quantitative expression of feature association and enhancing the computability of topological relationship. The graph attention mechanism is used to dynamically calibrate the initial edge weights, strengthen the structural association between vulnerable features, reconstruct the original high-dimensional feature space into a low-dimensional computable weighted topological graph, complete the accurate modeling of the global topological structure of the decision boundary, improve the connection weight of vulnerable features, and realize the accurate mapping from high dimension to low dimension.

[0056] It should be noted that a gradient-based node security analysis method is used to calculate the contribution of each feature dimension to the classification loss. The top 30% to 50% of feature dimensions by contribution are selected as key nodes. Specifically, 500 to 1000 samples are randomly selected from the validation dataset for forward propagation. After a specified fully connected or convolutional layer, activation vectors with dimensions of 512 or 1024 are collected. The mean gradient of each feature dimension relative to the cross-entropy loss function is calculated. Feature dimensions with an absolute gradient value higher than the overall mean by more than 0.5 standard deviations are selected for discretization, mapping them to independent nodes in a graph structure. For convolutional neural networks, the feature map output from the last pooling layer is selected, with each channel... As a feature node; for the Transformer architecture, the feature dimension output by each attention head in the penultimate layer is selected as the node. Based on this, an initial set of graph structures containing N nodes is constructed, with the number of nodes controlled within the range of 200 to 500. This ensures that key decision information is retained while reducing subsequent computational complexity, forming a preliminary global topological structure of the model decision boundary. For the constructed graph node set, 2000 to 3000 samples are selected from the test dataset for multiple forward propagations. The activation value change pattern of each pair of feature nodes on different samples is statistically analyzed. First, the cosine similarity between the activation vectors of node i and node j on the sample batch is calculated, and a similarity threshold of 0.6 or higher is considered as a similarity of 0.6 or higher. To achieve consistency, the mutual information entropy between the two is calculated. A constant-width discretization method is used to divide continuous activation values ​​into 10 to 15 intervals. Joint and marginal probabilities are calculated based on the sample distribution to obtain the mutual information value. Cosine similarity and normalized mutual information entropy are weighted and fused, with weight coefficients set to 0.4 and 0.6 respectively, to obtain the initial association strength value. Node pairs with an association strength below 0.2 are not connected, while those above 0.8 are strongly connected. The intermediate values ​​are determined by a linear mapping to determine the edge weights, thus transforming the topological relationship of the decision boundary between feature nodes into specific numerical edge weights in the adjacency matrix. To strengthen the structural association between fragile features and achieve dimensionality reduction, a two-layer graph attention network is constructed, with the input being... The node feature matrix X has dimensions N×F, where F represents a 64- or 128-dimensional node embedding. The adjacency matrix A is sparsified using the nearest neighbor s method based on the edge weights calculated in the previous step, with s set to 10 to 15, retaining the strongest neighbor nodes for each node. The graph attention layer employs a multi-head attention mechanism, with 4 to 8 attention heads. Each head independently calculates the attention coefficients between nodes and performs a non-linear transformation using the LeakyReLU activation function, with a negative slope set to 0.2. The outputs of the multi-head attention are concatenated or averaged to obtain a calibrated new edge weight matrix. This process is iterated 2 to 3 times, increasing the connection weights between fragile feature nodes by 15% to 25% and suppressing the weights of redundant connections to 0.Below 1, the final output is a low-dimensional weighted topological graph with 150 to 300 nodes and 2000 to 5000 edges, completing the accurate modeling from the original high-dimensional feature space to a computable graph structure;

[0057] The spectral clustering partitioning unit is used to cut and divide the generated weighted topology graph using the spectral clustering algorithm. It identifies loosely clustered and vaguely defined sensitive regions in the feature space, delineates vulnerable node candidate domains, automatically identifies vaguely defined regions, and narrows the search range for vulnerable nodes. Based on the weighted topology graph generated by the feature node mapping unit, it constructs the Laplacian matrix and calculates its eigenvectors. Through spectral embedding, it projects graph nodes into a low-dimensional space to preserve global structural information, losslessly compressing the high-dimensional graph structure to a low-dimensional space. This provides a structurally accurate data foundation for subsequent clustering. The node vectors after spectral embedding are iteratively divided using the K-means clustering algorithm. The optimal number of clusters is automatically determined based on the silhouette coefficient and modularity. Sensitive regions with blurred boundaries and sparse inter-class connections are cut out. The algorithm adaptively identifies the boundaries of vulnerable regions in the topology graph, avoiding the subjective bias of manually setting the number of clusters. The node density distribution and cross-boundary connection ratio are calculated in each sensitive region. The set of nodes with low local clustering and close to the decision boundary is delineated as the candidate domain of vulnerable nodes. The set of nodes located near the decision boundary and with a fragile structure is accurately selected, narrowing the attack surface to high-risk areas.

[0058] It should be noted that a standardized Laplacian matrix is ​​used, and eigenvalue decomposition is performed on the constructed Laplacian matrix to extract the eigenvectors corresponding to the first 16 smallest non-zero eigenvalues. Each node is thus mapped to a 16-dimensional spectral embedding vector. By preserving the global structural information of the graph, the node relationships in the original high-dimensional space are transformed into coordinate representations in a low-dimensional Euclidean space, ensuring that nodes that are closely connected in the original space remain adjacent in the spectral embedding space. The search range of the K-means clustering algorithm for the number of clusters k is set to 3 to 15. For each candidate k value, K-means clustering is performed 10 times to avoid local optima. The result with the minimum inertia is selected as the partitioning scheme for that k value. The silhouette coefficient and modularity of each partition are calculated. The silhouette coefficient threshold is set to above 0.35, and the modularity threshold is set to above 0.3. The optimal number of clusters is selected by combining the two indicators, and the nodes in the feature space are automatically identified. Sensitive regions with sparse point connections and blurred inter-class boundaries are segmented into multiple feature node subspaces with tightly packed internal structures and loose external connections. Vulnerability assessments are performed within each sensitive region to delineate candidate domains for vulnerable nodes. For each clustering region, the local topological density of each node within the region is calculated, which is the local average connection weight centered on the node and within a radius containing 15 nearest neighbor nodes. Simultaneously, the proportion of cross-regional connection edges of each node to its total number of connections is counted. Nodes with a local topological density lower than 0.7 times the region average and nodes with a cross-boundary connection ratio higher than 0.4 are marked as nodes with suspected vulnerability. Combining these two indicators, the top 30% of nodes in each region are selected to form an initial candidate set. After deduplication, a final candidate domain of vulnerable nodes containing 80 to 150 nodes is formed. This set represents high-risk nodes in the feature space with low clustering and proximity to the decision boundary.

[0059] The vulnerable node localization module, based on the constructed global topology, calculates the safety factor of each node by combining local topological density and distance to the decision boundary, quantifies the sensitivity of nodes to minor perturbations, establishes a preliminary vulnerability ranking, and uses heuristic rules to identify the set of minimal nodes that contribute the most to model output perturbations—these are the key vulnerable nodes that determine the lower limit of model safety. It quantifies node vulnerability, accurately anchors the core nodes affecting model safety, extracts the local topological density of each node based on the global topology, and calculates its Euclidean distance to the nearest decision boundary. These two factors are then fused to construct a joint distribution function of node safety factors, completing the preliminary vulnerability ranking and effectively integrating the results. By using density and boundary proximity, we achieve quantitative ranking of node vulnerability. Based on the initial ranking, we introduce heuristic rules and iteratively screen the candidate domain of vulnerable nodes using the minimum correlation maximum redundancy criterion. Redundant nodes with similar safety coefficients are eliminated, and feature subsets that significantly contribute to the perturbation of model output are retained. Redundant nodes are eliminated while ensuring contribution, improving the compactness of key feature screening. A boundary approximation verification mechanism is applied to the retained feature subset. By injecting a small perturbation, we test the marginal contribution of each node to the decision shift. Finally, we anchor the key vulnerable nodes that constitute the lower safety limit of the model. By verifying the marginal contribution, we accurately lock the nodes of the lower safety limit, enhancing the relevance and reliability of the evaluation.

[0060] It should be noted that, based on the fragile node candidate domain delineated by spectral clustering partitioning units, the local topological density of each node is extracted from the global topological structure. Specifically, taking the target node as the center, the average shortest path length between it and its 15 neighboring nodes is calculated using the Dijkstra algorithm, and then mapped to a density value after inverse transformation. Simultaneously, the Euclidean distance from the node embedding vector to the nearest decision boundary is calculated. This decision boundary is obtained by a support vector machine classifier performing binary classification fitting on the node embedding space, with the boundary position taken at the classification hyperplane. After normalizing the local topological density and the boundary distance, the following is adopted. A joint distribution function of node safety factors is constructed using geometric weighted fusion, where the density term has a weight of 0.6 and the distance term has a weight of 0.4. The safety factor ranges from 0 to 1, with lower values ​​indicating higher vulnerability. Based on this, a preliminary vulnerability ranking of all nodes in the candidate domain is completed. Building upon this preliminary ranking, the minimum correlation maximum redundancy criterion is introduced for feature selection, using mutual information as a correlation metric. The target number of nodes to be retained is set to half of the top 40% of nodes in the preliminary ranking. During the iteration process, the node with the lowest safety factor is first selected and added to the retention set, followed by the calculation of the remaining nodes in the candidate domain. The average mutual information value between the node and the retained nodes is used to remove redundant nodes with an average mutual information value higher than 0.7. Simultaneously, the mutual information contribution between each node and the model output classification boundary offset is evaluated, retaining only the top 60% of nodes by contribution. This iterative process continues until the size of the retained set meets a preset target or no nodes can be removed. Finally, a feature subset that significantly contributes to the model output perturbation and has low redundancy is selected. A boundary approximation verification mechanism is applied to the selected feature subset. 500 samples are randomly selected from the test set, and for each sample belonging to the feature subset... The target node is injected with incremental micro-perturbations ranging from 0.01 to 0.05. The perturbation direction is determined based on the node gradient sign. A binary search method is used to approximate the decision boundary sample by sample. The minimum perturbation amplitude that causes the model classification decision to shift during the perturbation process is recorded as a marginal contribution metric. Nodes with a marginal contribution lower than 0.6 times the overall mean are removed. The final set of nodes is the key vulnerable nodes that constitute the lower limit of the model's safety. The number of anchor nodes is controlled within the range of 25 to 50 to ensure that subsequent evaluations focus on the feature dimensions with the greatest safety threat.

[0061] The dynamic path optimization module combines particle swarm optimization and gradient guidance mechanisms to dynamically search for the optimal attack path within the candidate domain of identified vulnerable nodes, generating adversarial samples with minimal perturbation, achieving global and local collaborative optimization, and improving the efficiency and concealment of adversarial sample generation.

[0062] The causal effect inference module is used to employ causal inference techniques to remove the interference of irrelevant variables, quantitatively calculate the net effect of a specific vulnerable node being attacked on the final security performance index of the model, establish causal relationships rather than correlational relationships, remove the interference of confusing factors, and establish the causal relationship between node perturbation and model failure.

[0063] The explanation tree construction module is used to input the inference results of causal effects into the decision tree algorithm, generate an explanation tree of the contribution of vulnerable nodes to the fluctuation of model security, show the root path of security defects in the AI ​​model under test, visualize the transmission path of security defects, and provide traceable explanatory evidence.

[0064] Example 2, as Figure 1 , Figure 2 As shown, based on Embodiment 1, the present invention provides a technical solution: the dynamic path optimization module includes a particle swarm perturbation generation unit and a gradient-guided optimization unit;

[0065] The particle swarm perturbation generation unit is used to model the generation process of adversarial examples as an optimization process of the particle swarm in the candidate domain of vulnerable nodes. Each particle represents a perturbation path. Through group collaboration, the unit explores the globally optimal attack direction and selects candidate attack paths. By searching for the globally optimal attack direction through swarm intelligence, the diversity of path exploration is enhanced. The subspace composed of key vulnerable nodes is defined as the optimization boundary. The position and velocity vectors of the particle swarm are initialized. Each particle represents a candidate perturbation path starting from the original sample, ensuring that the search space focuses on the feature dimension with the greatest security threat and improving optimization efficiency. The fitness function is defined as a weighted combination of attack success rate and perturbation amplitude, guiding the particle swarm to iteratively update velocity and position in the vulnerable node subspace and search for the globally optimal direction that crosses the decision boundary. Under the premise of ensuring the effectiveness of the attack, a dynamic balance between perturbation amplitude and success rate is achieved. Through the population collaboration mechanism, the unit records the individual optimal and globally optimal paths, selects multiple candidate attack paths with fast convergence speed and successful crossing of the decision boundary, avoids getting trapped in local optima, and provides a diverse and high-quality path foundation for subsequent fine optimization.

[0066] It should be noted that the subspace formed by the key vulnerable nodes anchored by the vulnerable node localization module is defined as the optimization boundary. In specific implementation, the dimension of this subspace corresponds to the feature dimensions of 25 to 50 key nodes. The initial particle swarm size is 30 to 50 particles. The position vector of each particle represents an initial perturbation offset applied to the vulnerable node subspace starting from the original clean sample. The initial values ​​of each dimension of the position are randomly generated in the range of [-0.05, 0.05]; the initial value of the velocity vector is randomly generated in the range of [-0.01, 0.01], which is used to control the step size and direction of the perturbation update to ensure that the search process starts in the vicinity of the key nodes. A fitness function is defined to quantify the merits of each candidate perturbation path. This function is designed as a weighted combination of attack success rate and perturbation amplitude: the attack success rate term adopts a step function, which takes a value of 1 when the perturbed sample successfully crosses the model decision boundary and causes a classification error, otherwise... The perturbation amplitude term is calculated as the ratio of the L2 perturbation norm corresponding to the current path to the maximum allowable perturbation limit of 0.3. The two are fused through weighting coefficients, where the attack success rate weight is set to 0.7 and the perturbation amplitude weight is set to 0.3, aiming to guide the particle swarm to prioritize attack effectiveness while minimizing perturbation. The search for the global optimal direction is achieved through a population cooperation mechanism. In each iteration, the individual historical optimal position of each particle is updated based on the current fitness value, and the global optimal position of the entire population is updated synchronously. The inertia weight adopts a linear decreasing strategy, decreasing from the initial value of 0.9 to 0.4, in order to balance global exploration and local development capabilities. The learning factors c1 and c2 are both set to 1.5. The iteration termination condition is set to reach the maximum number of iterations of 100 or the global optimal fitness value remains unchanged for 15 consecutive iterations. Finally, 3 to 5 candidate attack paths with fast convergence speed and successful crossing of the decision boundary are selected.

[0067] The gradient-guided optimization unit, based on the gradient guidance mechanism, applies gradient constraints to the candidate attack paths selected by the particle swarm optimization. While ensuring the success rate of the attack, it gradually reduces redundant perturbations through a backtracking mechanism to generate adversarial samples that target key vulnerable nodes with minimal perturbation. This minimizes the perturbation amplitude while ensuring the success rate of the attack, thus improving the stealth of the adversarial samples. The unit calculates the gradient matrix of the loss function relative to the input features for the candidate attack paths selected by the particle swarm optimization. The gradient direction is used as a constraint condition for path optimization, eliminating perturbation dimensions that are irrelevant to vulnerable nodes. This ensures that the perturbation only acts on the key features that have the greatest influence on the decision boundary. A backtracking pruning mechanism is established based on the gradient constraints. The redundant step size is reduced layer by layer from the perturbation endpoint, retaining the minimal perturbation component that maintains the success rate of the attack. The perturbation amplitude is compressed to the minimum while maintaining the effectiveness of the attack. The pruned candidate attack paths are verified by boundary convergence. This generates adversarial samples with minimal perturbation amplitude in the vulnerable node subspace and attack paths that cross the decision boundary, achieving accurate generation of adversarial samples and optimal control of perturbation amplitude.

[0068] It should be noted that for the 3 to 5 candidate attack paths selected by particle swarm optimization, the gradient matrix of the cross-entropy loss function relative to the input features is calculated for each path. During gradient calculation, 200 samples are randomly selected from the test set for batch forward and backward propagation. The absolute values ​​of the gradients for each sample are taken and then averaged to obtain the average gradient contribution value for each feature dimension. A gradient threshold of 0.3 times the mean of the principal gradient is set. Feature dimensions below this threshold are considered perturbation dimensions unrelated to vulnerable nodes and are removed. Simultaneously, based on the sign of the gradient direction, perturbation components consistent with the gradient direction of vulnerable nodes are retained to ensure that the remaining perturbations only affect key feature dimensions that significantly impact the model's decision boundary. After removing irrelevant dimensions using gradient constraints, a step-size optimization process based on a backtracking pruning mechanism is established. Starting from the perturbation endpoint of each candidate attack path, the process backtracks layer by layer to the original sample point, with each layer using a pruning step size of 10% of the current perturbation amplitude to gradually remove redundant perturbations. For each pruning step, forward propagation is immediately performed to verify the attack success rate. If the attack remains successful, the pruning continues to the next level. If the attack fails, the pruning process reverts to the previous valid state and terminates the pruning of the current path. This process uses a binary search method to accelerate convergence, ensuring that the L2 perturbation norm of each path is minimized while maintaining attack success. The final retained perturbation component is the set of minimal perturbations that maintain attack success. Based on the minimal perturbations obtained from pruning, a step size decay factor of 0.5 is used for boundary fine-tuning, gradually approaching the classification hyperplane along the gradient direction until the sample is within the decision boundary within ±0.01 tolerance. If multiple candidate attack paths pass the verification, the path with the smallest L2 perturbation norm is selected as the optimal attack path and applied to the original clean sample to generate the final adversarial sample. This adversarial sample minimizes the perturbation amplitude in a subspace consisting of 25 to 50 key vulnerable nodes, and the attack path clearly crosses the decision boundary.

[0069] The causal effect inference module performs the following steps: defining the state of perturbation of key vulnerable nodes as a binary intervention variable, defining the classification boundary offset of the model output as an outcome variable, constructing a structured causal model based on graph structure and feature dependency, accurately characterizing the causal path between node perturbation and model response, laying an interpretable foundation for effect estimation, identifying and controlling confounding variables using the backdoor adjustment criterion, constructing treatment and control groups through inverse probability weighted matching, removing the interfering influence of model architecture and input distribution on effect estimation, effectively eliminating confounding bias, ensuring the attribution purity and credibility of node perturbation effects, calculating the average treatment effect of key vulnerable node perturbation on model security indicators, quantifying the net change in classification boundary offset after a specific node is attacked, establishing causal effect values, realizing the quantitative ranking of node vulnerability, and intuitively reflecting the degree of critical impact of each node on model security;

[0070] It should be noted that each node in the set of key vulnerable nodes anchored by the vulnerable node localization module is defined as a binary intervention variable, and the node perturbation application state is denoted as... Where 1 represents applying the optimal perturbation generated by the dynamic path optimization module to the feature dimension of the node, and 0 represents keeping the original activation value unchanged; the outcome variable is defined as the model classification boundary offset, specifically calculated as the normalized value of the difference in classification confidence of the model on the validation set before and after the perturbation. A structured causal model is constructed based on the graph topology and the conditional dependencies between nodes. A directed acyclic graph is used to describe the causal path between the intervention variable and the outcome variable. At the same time, the model architecture depth and the distribution characteristics of the input samples are included as background variables to form a complete causal graph structure. The backdoor adjustment criterion is used to identify the set of nodes in the structured causal model that satisfy the backdoor criterion as a confounding variable, including the local density value of the sample in the original feature space, the betweenness centrality of the node in the topology, and the average activation value of the intermediate layer of the model. The inverse probability weighted matching method is used to construct the treatment group and the control group: the treatment group consists of samples with node perturbation applied, and the control group consists of homologous samples without perturbation applied. 1:1 nearest neighbor matching is performed based on the propensity score. The matching tolerance was set to 0.02 to ensure that the two groups of samples were balanced in the distribution of confounding variables. The matching process effectively removed the interference of model architecture differences and input distribution bias on the effect estimation, so that the attribution of the perturbation effect could focus on the target node itself. On the matched sample set, the average treatment effect of the perturbation of key vulnerable nodes on the model security index was calculated. The model security index was defined as a joint function of the classification boundary offset and the perturbation magnitude. The boundary offset was quantified by the change in cross-entropy loss, and the perturbation magnitude was normalized by the L2 norm. For each key vulnerable node, the mean difference of the security index between the treatment group and the control group was calculated. The confidence interval was estimated by 200 Bootstrap resampling. Insignificant nodes whose confidence intervals crossed zero were removed. The final output causal effect value was presented in the form of standardized effect size. The larger the value, the more significant the net impact of the node perturbation on the model security. The net change in classification boundary offset after a specific vulnerable node was attacked was quantified.

[0071] The explanation tree construction module performs the following steps: It collects the causal effect values ​​of each key vulnerable node output by the causal effect inference module, integrates the local density and boundary distance attributes of the nodes in the topology, constructs a training dataset with node features as input and model failure state as label, uses model failure as the target variable, integrates causal effects with topological attributes to improve the accuracy of the training data in representing security defects, uses a classification regression tree algorithm to recursively split the training dataset into two parts, selects the optimal splitting node features based on maximizing the decrease of the Gini coefficient, generates a contribution explanation tree composed of vulnerable nodes, the contribution explanation tree is a hierarchical binary tree structure, optimizes the splitting nodes through the Gini coefficient to ensure the explanation tree structure is compact and highly discriminative, extracts the complete splitting path from the root node to the leaf node of the contribution explanation tree, analyzes the conditional dependencies between key vulnerable nodes, and visualizes the causal root path of the model security defect from the initial perturbation to the final failure, presenting the causal transmission chain through path visualization to enhance the traceability and interpretability of the model security defect.

[0072] It should be noted that the causal effect value adopts the standardized effect size form. The local density is the value obtained by reciprocal transformation of the mean of the shortest path lengths between a node and its 15 neighboring nodes calculated by the Dijkstra algorithm. The boundary distance is the Euclidean distance from the node's embedding vector to the classification hyperplane of the support vector machine. The model failure state is binarized and labeled according to whether the classification boundary offset exceeds a preset threshold. The offset threshold is set to a change in cross-entropy loss greater than 0.15. The training dataset size corresponds to 25 to 50 key vulnerable nodes. Each node sample contains a three-dimensional feature vector and a corresponding failure label. The classification regression tree algorithm sets the minimum number of leaf node samples to 2 and the maximum tree depth to 5 layers to prevent overfitting and ensure the readability of the interpretation tree. During the recursive splitting process, each internal node is split into two based on the feature dimension with the largest decrease in Gini coefficient in the current dataset and its splitting threshold, until the base of all leaf nodes is reached. When the Nielsen coefficient is below 0.1 or reaches the depth limit, the final contribution explanation tree is a hierarchical binary tree structure. The root node corresponds to the vulnerable node with the greatest global impact, the internal nodes reflect the secondary vulnerable nodes under conditional dependencies, and the leaf nodes label the model failure probability distribution under that branch path. Each split path consists of a series of node features and their split thresholds. The path length is controlled between 2 and 4 nodes to ensure the simplicity and interpretability of the causal chain. A tree structure diagram is generated through visualization tools. The root node displays the identifier of the vulnerable node with the highest causal effect value and its split threshold. The conditional splitting rules of subsequent nodes under the constraints of the parent node are displayed layer by layer. The leaf nodes at the end of the path display the conditional probability of model failure under that combination of conditions. This fully presents the causal transmission chain from the application of the initial perturbation to the manifestation of the model safety defect, providing a traceable explanatory basis for locating the root cause of the model safety defect.

[0073] The following section details the workflow of this interpretable artificial intelligence model safety benchmark evaluation system.

[0074] First, the feature node mapping unit in the topology boundary construction module performs gradient contribution analysis on the activation vectors of the high-level hidden layer of the model under test, selects key feature dimensions and maps them to graph nodes, calculates edge weights by combining cosine similarity and mutual information entropy, and then reconstructs a low-dimensional weighted topology graph through graph attention network calibration. Subsequently, the spectral clustering partitioning unit performs spectral embedding and adaptive K-means cutting on the topology graph to identify sensitive regions with sparse connections and blurred boundaries, and delineates candidate domains of vulnerable nodes.

[0075] The vulnerable node localization module extracts the local topological density and decision boundary distance of each node based on the candidate domain, integrates and constructs a security coefficient and completes the vulnerability ranking. After screening redundant nodes by the minimum correlation maximum redundancy criterion, the module anchors the key vulnerable nodes by boundary approximation verification. The dynamic path optimization module uses the key node subspace as the optimization boundary, initializes the particle swarm to search for the optimal perturbation direction, and after screening candidate attack paths, removes irrelevant dimensions by gradient constraints and reduces redundant perturbations by combining the backtracking pruning mechanism to generate adversarial samples with minimal perturbation.

[0076] The causal effect inference module uses node perturbations as intervention variables to construct a structured causal model. It employs backdoor adjustment and inverse probability weighted matching to remove the influence of confounding variables, calculates the average treatment effect, and quantifies the net impact of node perturbations on the model's safety indicators. The explanation tree construction module uses causal effect values, local density, and boundary distance as features, and model failure states as labels. It uses a classification regression tree algorithm to generate contribution explanation trees. Through the splitting path from the root node to the leaf node, it fully presents the causal chain from vulnerable node perturbations to model safety defects, achieving interpretability and traceability of the evaluation results.

[0077] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An explainability-based artificial intelligence model security benchmarking system comprising an explainable benchmarking engine, characterized in that, The interpretable evaluation engine communication connection includes the following modules: The topology boundary construction module is used to integrate node security analysis and spectral clustering algorithms to reconstruct the high-dimensional abstract data inside the AI ​​model under test into a perceptible graph structure, construct the global topology structure of the model decision boundary, and locate the candidate domain of vulnerable nodes in the feature space. The vulnerable node localization module, based on the constructed global topology, combines local topology density and decision boundary distance to calculate the safety factor of each node, quantify the sensitivity of nodes to minor perturbations, establish a preliminary ranking of vulnerabilities, and use heuristic rules to identify the set of minimal nodes that contribute the most to the perturbation of the model output, i.e., the key vulnerable nodes that determine the lower limit of the model's safety. The dynamic path optimization module combines particle swarm optimization and gradient guidance mechanisms to dynamically search for the optimal attack path within the candidate domain of identified vulnerable nodes, generating adversarial samples with minimal perturbation. The causal effect inference module is used to employ causal inference techniques to remove the interference of irrelevant variables, quantitatively calculate the net effect of a specific vulnerable node being attacked on the final security performance index of the model, and establish causal relationships rather than correlational relationships. The explanation tree building module is used to input the inference results of causal effects into the decision tree algorithm to generate an explanation tree of the contribution of vulnerable nodes to the fluctuation of model security, showing the root path of the security defects of the AI ​​model under test.

2. The system for benchmarking the security of artificial intelligence models based on interpretability according to claim 1, characterized in that: The topology boundary construction module includes a feature node mapping unit and a spectral clustering partitioning unit; The feature node mapping unit, based on node security analysis, maps the feature vectors of the AI ​​model under test to independent nodes in the graph structure, calculates the association strength between nodes as edge weights, and transforms it into a computable weighted topology graph. The spectral clustering partitioning unit is used to cut and divide the generated weighted topology map using the spectral clustering algorithm, identify sensitive areas that are loosely clustered and have blurred boundaries in the feature space, and delineate candidate domains of vulnerable nodes that are susceptible to attack.

3. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 2, characterized in that: The feature node mapping unit performs the following steps: The activation vectors of the AI ​​model under test in the high-level hidden layer are obtained. The feature dimensions that contribute to the decision boundary are extracted through node security analysis. These features are discretized into independent nodes in the graph structure to construct the global topological structure prototype of the model's decision boundary. Based on the co-occurrence frequency and directional consistency of feature vectors in the sample space, the cosine similarity and mutual information entropy between nodes are calculated, and the quantized association strength is mapped to the edge weights connecting nodes in the topological graph. A graph attention mechanism is used to dynamically calibrate the initial edge weights, strengthen the structural correlation between fragile features, reconstruct the original high-dimensional feature space into a low-dimensional computable weighted topological graph, and complete the accurate modeling of the global topological structure of the decision boundary.

4. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 2, characterized in that: The spectral clustering partitioning unit performs the following steps: Based on the weighted topological graph generated by the feature node mapping unit, a Laplacian matrix is ​​constructed and its eigenvectors are calculated. The graph nodes are then projected into a low-dimensional space through spectral embedding to preserve global structural information. The K-means clustering algorithm is used to iteratively divide the node vectors after spectral embedding. The optimal number of clusters is automatically determined based on the silhouette coefficient and modularity, and sensitive regions with blurred boundaries and sparse inter-class connections are cut out. Calculate the node density distribution and cross-boundary connection ratio in each sensitive area, and delineate the set of nodes with low local clustering and close to the decision boundary as the candidate domain of vulnerable nodes.

5. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 2, characterized in that: The vulnerable node localization module performs the following steps: Based on the global topology, the local topological density of each node is extracted, and the Euclidean distance to the nearest decision boundary is calculated. The two are then fused to construct a joint distribution function of the node security coefficient, thus completing the preliminary ranking of vulnerabilities. Based on the initial ranking, heuristic rules are introduced to iteratively screen the candidate domain of vulnerable nodes using the minimum correlation maximum redundancy criterion, eliminating redundant nodes with similar safety coefficients and retaining the feature subset that significantly contributes to the perturbation of the model output. A boundary approximation verification mechanism is applied to the retained feature subset. By injecting a small amount of perturbation, the marginal contribution of each node to the decision bias is tested, and finally the key vulnerable nodes that constitute the safety lower bound of the model are anchored.

6. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 5, characterized in that: The dynamic path optimization module includes a particle swarm perturbation generation unit and a gradient-guided optimization unit. The particle swarm perturbation generation unit is used to model the generation process of adversarial examples as the optimization process of the particle swarm in the candidate domain of vulnerable nodes in the particle swarm algorithm. Each particle represents a perturbation path. Through group cooperation, the globally optimal attack direction is explored and candidate attack paths are selected. The gradient-guided optimization unit, based on the gradient guidance mechanism, applies gradient constraints to the candidate attack paths selected by the particle swarm. Under the premise of ensuring the success rate of the attack, it gradually reduces redundant perturbations through the backtracking mechanism to generate adversarial samples that target key vulnerable nodes with minimal perturbation.

7. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 6, characterized in that: The particle swarm perturbation generation unit performs the following steps: The subspace formed by the key vulnerable nodes is defined as the optimization boundary. The position and velocity vectors of the particle swarm are initialized, and each particle represents a candidate perturbation path starting from the original sample. The fitness function is defined as a weighted combination of attack success rate and perturbation magnitude, which guides the particle swarm to iteratively update its velocity and position in the vulnerable node subspace and search for the globally optimal direction that crosses the decision boundary. By recording the optimal individual and global paths through a population collaboration mechanism, multiple candidate attack paths with fast convergence speed and successful crossing of the decision boundary are selected.

8. The safety benchmark evaluation system for interpretable artificial intelligence models according to claim 6, characterized in that: The gradient-guided optimization unit performs the following steps: The gradient matrix of the loss function relative to the input features is calculated for the candidate attack paths selected by particle swarm optimization. The gradient direction is used as a constraint for path optimization, and perturbation dimensions that are irrelevant to vulnerable nodes are eliminated. A backtracking pruning mechanism is established based on gradient constraints to reduce redundant step sizes layer by layer from the endpoint of the perturbation, while retaining the minimal perturbation component that maintains the success rate of the attack. The pruned candidate attack paths are verified by boundary convergence, generating adversarial samples that minimize perturbation amplitude within the vulnerable node subspace and whose attack paths cross the decision boundary.

9. A safety benchmark evaluation system for interpretable artificial intelligence models according to claim 6, characterized in that: The causal effect inference module performs the following steps: The state of perturbation applied to key vulnerable nodes is defined as a binary intervention variable, and the classification boundary offset of the model output is defined as the outcome variable. A structured causal model is constructed based on graph structure and feature dependency. The backdoor adjustment criterion was used to identify and control confounding variables. The treatment and control groups were constructed by inverse probability weighted matching to remove the confounding effects of model architecture and input distribution on effect estimation. Calculate the average processing effect of perturbations on critical vulnerable nodes on the model's security indicators, quantify the net change in the classification boundary shift after a specific node is attacked, and establish the causal effect value.

10. A safety benchmark evaluation system for interpretable artificial intelligence models according to claim 9, characterized in that: The interpretation tree construction module performs the following steps: The causal effect values ​​of each key vulnerable node are collected from the causal effect inference module. The local density and boundary distance attributes of the nodes in the topology are integrated to construct a training dataset with node features as input and model failure state as label, and whether the model fails is used as the target variable. The classification and regression tree algorithm is used to recursively divide the training dataset into two parts. The optimal splitting node features are selected based on the criterion of maximizing the decrease of the Gini coefficient. The contribution explanation tree is composed of vulnerable nodes and has a hierarchical binary tree structure. Extract the complete splitting path of the contribution explanation tree from the root node to the leaf node, analyze the conditional dependencies between key vulnerable nodes, and visualize the causal root path of the model's security defects from the initial perturbation to the final failure.

Images