LLM recommendation system double tower comparison purification training method for adversarial robustness

Abstract

The application discloses an LLM recommendation system double-tower contrast purification training method for adversarial robustness, relates to the technical field of data processing, and comprises the following steps: obtaining original text descriptions of articles and adversarial perturbation text descriptions thereof, and inputting the original text descriptions and the adversarial perturbation text descriptions into a clean text coding tower and an adversarial text coding tower which share the same underlying language model encoder respectively, generating clean representation vectors and adversarial representation vectors through respective projection heads; calculating an adversarial invariant contrast loss based on the two types of representations, and calculating a recommendation task loss in combination with a user historical interaction sequence and the clean representation vectors; and finally, performing joint parameter optimization processing according to the adversarial invariant contrast loss and the recommendation task loss. The application solves the technical problem that the LLM recommendation system in the prior art is susceptible to text adversarial perturbation and thus leads to manipulated recommendation results, and achieves the technical effects of enhancing the robustness of the LLM recommendation system against text adversarial attacks and reducing the influence of adversarial perturbation on recommendation results.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a dual-tower contrastive purification training method for adversarial robustness-oriented LLM recommendation systems. Background Technology

[0002] Recommendation systems based on large language models typically input textual information such as product titles, detailed descriptions, and category tags into the language model encoder to obtain semantic representations of items, and then combine this with the user's historical interaction sequence to complete the recommendation ranking. Since item text often directly serves as a crucial semantic source for recommendation decisions, even slight perturbations such as synonym replacement, insertion of irrelevant modifiers, or sentence rewriting by attackers can alter the semantics of the publicly available text descriptions. Even if the text remains semantically unchanged at the human reading level, it can cause the language model to obtain a shifted vector representation, thereby altering the matching relationship between user representations and item representations. This can lead to an abnormal increase in the target item's ranking or a shift in the recommendation list, exposing LLM recommendation systems to the security risk of manipulated recommendation results. Summary of the Invention

[0003] This application provides a dual-tower contrastive cleanup training method for LLM recommender systems with adversarial robustness, which is used to address the technical problem that LLM recommender systems in the prior art are susceptible to text adversarial perturbations, leading to the manipulation of recommendation results.

[0004] In view of the above problems, this application provides a dual-tower contrastive purification training method for LLM recommender systems aimed at adversarial robustness.

[0005] This application provides a dual-tower contrastive cleanup training method for adversarial robustness LLM recommender systems, the method comprising: The process involves: acquiring the original text description of an item and its corresponding adversarial perturbation text description; inputting the original text description and the adversarial perturbation text description into a clean text encoding tower and an adversarial text encoding tower, respectively, sharing the same underlying language model encoder; using a first projection head in the clean text encoding tower to output the encoding of the original text description as a clean representation vector; using a second projection head in the adversarial text encoding tower to map the encoding of the adversarial perturbation text description as an adversarial representation vector; calculating an adversarial invariant contrastive loss based on the clean representation vector and the adversarial representation vector, whereby the distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace is less than the distance between the representation vectors of different items; calculating a recommendation task loss based on the user's historical interaction sequence and the clean representation vector of the item; and jointly optimizing the parameters of the underlying language model encoder, the first projection head, and the second projection head based on the adversarial invariant contrastive loss and the recommendation task loss.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: This application obtains the original text description of an item and its corresponding adversarial perturbation text description; inputs the original text description and the adversarial perturbation text description into a clean text encoding tower and an adversarial text encoding tower sharing the same underlying language model encoder, respectively; through the first projection head in the clean text encoding tower, the encoding output of the underlying language model encoder on the original text description is converted into a clean representation vector; through the second projection head in the adversarial text encoding tower, the encoding output of the underlying language model encoder on the adversarial perturbation text description is mapped into an adversarial representation vector; based on the clean representation vector and the adversarial representation vector, an adversarial invariant contrastive loss is calculated, which is used to constrain the distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace to be less than the distance between the representation vectors of different items; based on the user's historical interaction sequence and the clean representation vector of the item, a recommendation task loss is calculated; and based on the adversarial invariant contrastive loss and the recommendation task loss, the parameters of the underlying language model encoder, the first projection head, and the second projection head are jointly optimized. This invention addresses the technical problem in existing LLM recommendation systems that are susceptible to textual adversarial perturbations, leading to manipulation of recommendation results. By constructing a dual-tower structure with a shared underlying language model encoder and utilizing adversarial invariant contrastive loss to constrain the clean and adversarial representations of the same item to remain close in the semantic subspace, the invention enhances the robustness of the LLM recommendation system against textual adversarial attacks and reduces the impact of adversarial perturbations on recommendation results. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is a schematic diagram of the dual-tower contrastive purification training method for an LLM recommendation system with adversarial robustness provided in an embodiment of this application. Detailed Implementation

[0009] This application provides a dual-tower contrastive cleansing training method for LLM recommender systems with adversarial robustness. Addressing the technical problem in existing technologies where LLM recommender systems are susceptible to textual adversarial perturbations leading to manipulated recommendation results, this method constructs a dual-tower structure sharing a low-level language model encoder. It utilizes adversarial-invariant contrastive loss to constrain the clean and adversarial representations of the same item to remain close in the semantic subspace. This enhances the robustness of the LLM recommender system against textual adversarial attacks and reduces the impact of adversarial perturbations on recommendation results.

[0010] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0011] It should be noted that any variation of the terms "comprising" and "having" is intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such processes, methods, products, or devices.

[0012] Examples, such as Figure 1 As shown, this application provides a dual-tower contrastive sanitization training method for adversarial robustness LLM recommender systems, the method comprising: Step S100: Obtain the original text description of the item and the corresponding anti-disturbance text description.

[0013] Furthermore, the method provided in the application embodiments also includes: The adversarial perturbation text description is constructed through an online adversarial sample generation strategy. In each training batch, the original text description is perturbed by a word-level gradient text attack method, and adversarial perturbation text is generated under semantic similarity constraints.

[0014] In this embodiment, the original text description of the item and its corresponding adversarial text description are obtained. For any item i in the item set I, the text fields such as the item's title, category label, keywords, and attribute description are obtained, and the text fields are concatenated to obtain the item's original text description t. i Original text description t i This represents the original semantic information of the item without text perturbation, and is used as input for subsequent clean text encoding.

[0015] Adversarial perturbation text descriptions are constructed using an online adversarial example generation strategy. This strategy involves generating adversarial example descriptions for each training batch, targeting the current model parameters and the original text description t within that batch. i Dynamically generate corresponding text descriptions of the counter-perturbation. For the original text description t of item i within the training batch i A text attack method based on word-level gradients is employed to generate adversarial perturbation text descriptions within the semantic similarity constraint ε. It is represented as: .in, The text description of the adversarial perturbation of item i, t i The original text description of item i. ε represents the candidate text obtained by perturbation of the original text description, and ε represents the perturbation constraint range corresponding to the semantic similarity constraint. Indicates the contrast loss with the invariant effect. Let i be the clean representation vector of item i. This represents the underlying language model encoder. This represents the second projection head in the adversarial text coding tower.

[0016] In each training batch, word-level gradient text attack perturbations are performed on the original text description. Word-level gradient text attack perturbations refer to determining the word-level positions to be perturbed based on the gradient influence of the current model loss on words or tokens in the original text description, and then performing synonym replacement, semantically irrelevant modifier insertion, or sentence structure adjustment at these word-level positions to generate candidate text. In generating candidate text During the process, semantic similarity constraints ε are used to limit the candidate text from being similar to the original text description t. i The semantic offset between them ensures that the candidate texts still semantically correspond to the same item; and among the candidate texts that satisfy the semantic similarity constraint, the adversarial invariant contrastive loss of the current model is selected. The largest text, as the original text description t i Corresponding anti-perturbation text description .

[0017] Step S200: Input the original text description and the adversarial perturbation text description into the clean text encoding tower and the adversarial text encoding tower, which share the same underlying language model encoder, respectively.

[0018] In this embodiment, the original text description of the item is used as clean text input and fed into the clean text encoding tower; the adversarial perturbation text description corresponding to the original text description is used as adversarial text input and fed into the adversarial text encoding tower. The clean text encoding tower is used to process the original semantic text that has not been perturbed, and the adversarial text encoding tower is used to process the perturbed semantic text generated under semantic similarity constraints.

[0019] The clean text coding tower and the adversarial text coding tower share the same underlying language model encoder, which is used to perform contextual semantic encoding on the input text. By sharing the same underlying language model encoder, the original text description and the adversarial perturbation text description are processed in the same linguistic semantic encoding space, ensuring that the underlying semantic encoding of the two types of text has a consistent parameter basis and avoiding semantic space shifts caused by using different encoders.

[0020] Step S300: The encoding output of the original text description by the underlying language model encoder is a clean representation vector through the first projection head in the clean text encoding tower.

[0021] In this embodiment of the application, the original text description t of item i is... i After inputting the clean text encoding tower, the underlying language model encoder shared within the clean text encoding tower first processes the original text description t. i Text semantic encoding is performed. The underlying language model encoder is based on a pre-trained language model, whose parameters are denoted as θ. enc This is used to perform contextual semantic modeling on item text sequences and output the corresponding encoding results. The encoding results are the semantic hidden states of the original text description in the underlying language model encoder, such as the hidden state corresponding to the [CLS] position, with a dimension of d. model .

[0022] After obtaining the encoded output of the underlying language model encoder for the original text description, this encoded output is input into the first projection head in the clean text encoding tower. The first projection head is an independent projection head set on the clean text path, and its parameter is denoted as θ. clean , used to convert the output of the underlying language model encoder into d model The dimensional encoding result is mapped to a low-dimensional semantic subspace to obtain a clean representation vector z. i The low-dimensional semantic subspace is the representation space used for subsequent adversarial invariant contrastive loss calculation and recommendation task loss calculation. It enables the semantic information corresponding to the original text description to participate in model training in vector form. Its mapping process is represented as follows: Among them, t i The original text description of item i. This represents the encoded output of the underlying language model encoder for the original text description. This represents the first projection head in the clean text encoding tower. Indicates the parameters of the first projection head. This represents the clean representation vector output by the first projection head. Thus, by inputting the original text description into the underlying language model encoder for semantic encoding, and then performing low-dimensional semantic mapping on the encoded output by the first projection head, the clean representation vector corresponding to the original text description of the item is obtained.

[0023] Step S400: The encoding output of the underlying language model encoder for the adversarial perturbation text description is mapped to an adversarial representation vector through the second projection head in the adversarial text encoding tower.

[0024] In this embodiment of the application, the text description of the anti-perturbation of item i is... After inputting the adversarial text coding tower, the underlying language model encoder shared within the adversarial text coding tower first describes the adversarial perturbation text. Perform text semantic encoding. The parameters of the underlying language model encoder are denoted as θ. enc， Its parameters are the same as those of the underlying language model encoder in the clean text coding tower, used to ensure that the adversarial text description and the original text description are represented in the same underlying semantic coding space; the encoded output is the hidden state obtained after the adversarial text description is processed by the underlying language model encoder, for example, the hidden state corresponding to the [CLS] position, with a dimension of d. model .

[0025] After obtaining the encoded output of the underlying language model encoder for the adversarial perturbation text description, this encoded output is input into the second projection head in the adversarial text coding tower. The second projection head is an independent projection head set on the adversarial text path, and its parameters are denoted as follows: , used to convert the output of the underlying language model encoder into d model The 3D encoding result is mapped to a low-dimensional semantic subspace to obtain the adversarial representation vector. Adversarial representation vector This represents the semantic vector representation of an item under adversarial text perturbation, used for subsequent adversarial-invariant contrastive constraints with the clean representation vector of the same item. The mapping process of the adversarial representation vector is represented as follows: .in, The text description representing the anti-perturbation of item i. This represents the encoded output of the underlying language model encoder for adversarial perturbation text description. This indicates the second projection head in the adversarial text coding tower. Indicates the parameters of the second projection head. This represents the adversarial representation vector output by the second projection head. Thus, through the steps of semantic encoding using the underlying language model encoder shared with the adversarial perturbation text description input, and low-dimensional semantic mapping of the encoded output by the second projection head, the adversarial representation vector corresponding to the adversarial perturbation text description of the item is obtained.

[0026] Step S500: Calculate the adversarial invariant contrastive loss based on the clean representation vector and the adversarial representation vector. The adversarial invariant contrastive loss is used to constrain the distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace to be less than the distance between the representation vectors of different items.

[0027] Furthermore, in the method provided in the application embodiments, the adversarial invariance contrast loss is calculated as follows: ;in, Characterizing cosine similarity, This is the temperature coefficient hyperparameter. To determine the number of items in a training batch, Represents any single item within a batch. Characteristic of items A clean representation vector. For items Adversarial representation vector, thing The adversarial representation vector.

[0028] In this embodiment, when calculating the adversarial invariant contrastive loss based on the clean representation vector and the adversarial representation vector, clean representation vectors corresponding to N items are obtained within the training batch. and adversarial representation vector Among them, the clean representation vector The vector obtained by processing the original text description of item i using a clean text encoding tower is the adversarial representation vector. The vector is obtained by processing the adversarial perturbation text description of the same item i using an adversarial text coding tower. For any item i within the batch, and As a pair of representations corresponding to the same item, Adversarial representation vectors of items within a batch Perform a similarity comparison.

[0029] Contrast loss with invariance The distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace is less than the distance between the representation vectors of different items. The calculation method is as follows: Where sim represents cosine similarity, used to calculate the degree of similarity between two representation vectors; τ is a preset temperature coefficient hyperparameter; N is the number of items in the training batch; and i represents any item in the batch. A clean representation vector representing item i; Let i be the adversarial representation vector of item i; Let be the adversarial representation vector of item j.

[0030] In the above calculation process, the clean representation vector of item i is calculated first. Its corresponding adversarial representation vector The cosine similarity of item i is calculated, and the exponent is taken after adjusting for the temperature coefficient τ as the numerator; then the clean representation vector of item i is calculated. Adversarial representation vectors of each item in the training batch The cosine similarity is calculated, and after adjustment for the temperature coefficient τ, the exponential sum is used as the denominator. Then, the logarithm of the ratio of the numerator to the denominator is taken, and the summation and averaging are performed on N items within the training batch to obtain the adversarial invariant contrast loss. The calculation of the adversarial invariant contrast loss is completed.

[0031] Step S600: Calculate the recommendation task loss based on the user's historical interaction sequence and the clean representation vector of the item.

[0032] Furthermore, the method provided in the application embodiments also includes: The user's historical interaction sequence generates a user representation vector through a sequence encoder, and the recommendation score is constructed by the inner product of the user representation vector and the clean representation vector.

[0033] Furthermore, in the method provided in the application embodiments, the recommendation task loss is constructed using a ranking learning method based on positive and negative sample pairs, as follows: ;in, Representing users, For positive sample items, For negative sample items, This is the Sigmoid function.

[0034] In this embodiment, when calculating the recommendation task loss based on the user's historical interaction sequence and the clean representation vector of the items, the user's historical interaction sequence is obtained. The user's historical interaction sequence is a sequence of interactive items formed by the user in chronological order, used to represent the user's historical behavioral preferences. The user's historical interaction sequence is input into a sequence encoder, which encodes the interaction order relationship and behavioral dependency relationship in the user's historical interaction sequence to obtain the user representation vector. Where u represents the user, This represents the user representation vector corresponding to user u.

[0035] After obtaining the user representation vector Then, based on the user representation vector p u With the clean representation vector of the item Construct recommendation scores. Recommendation scores are constructed using the inner product of user representation vectors and clean representation vectors, represented as follows: in, This represents user u's recommendation rating for item i. User representation vector transpose, Let i be the clean representation vector of item i. This represents the inner product between the user representation vector and the clean representation vector.

[0036] The recommendation task loss is constructed using a ranking learning approach based on positive and negative sample pairs. For user u, items that the user has interacted with are considered positive sample items. Non-interacting items obtained through negative sampling will be used as negative sample items. Calculate the positive sample items for user u respectively. Recommended rating and user u for negative sample items Recommended rating And construct the recommendation task loss based on the score difference between the two. Where u represents the user, For positive sample items, For negative sample items, This is the Sigmoid function.

[0037] Through the above steps, a user representation vector is obtained from the user's historical interaction sequence via a sequence encoder. , by user representation vector With the clean representation vector of the item The inner product is used to calculate the recommendation score, and the recommendation task loss is calculated based on the difference between the recommendation scores of positive sample items and negative sample items, so that the recommendation score of positive sample items is higher than that of negative sample items, thus completing the calculation of the recommendation task loss.

[0038] Step S700: Based on the adversarial invariant contrastive loss and the recommendation task loss, jointly optimize the parameters of the underlying language model encoder, the first projection head, and the second projection head.

[0039] Furthermore, in the method provided in the application embodiments, the joint optimization processing of the parameters of the underlying language model encoder, the first projection head, and the second projection head based on the adversarial invariant contrastive loss and the recommendation task loss further includes: The joint optimization process is constructed using a total loss function, which also includes a projection consistency regularization loss term. This term constrains the consistency of the batch-level data distribution output by the clean text coding tower and the adversarial text coding tower. The total loss function is: ;in, For the recommended task loss, To counteract the loss of invariant contrast, The loss is for the projection consistency regularization term. and To balance the hyperparameters.

[0040] In this embodiment, when jointly optimizing the parameters of the underlying language model encoder, the first projection head, and the second projection head based on adversarial invariant contrastive loss and recommendation task loss, adversarial invariant contrastive loss is used. And recommended task loss As a component of the joint training objective, a projection consistency regularization term is introduced as a loss term. Together, they construct the total loss function. The projection consistency regularization loss is used to constrain the consistency of the batch-level data distribution output by the clean text coding tower and the adversarial text coding tower, so that the set of clean representation vectors output by the first projection head and the set of adversarial representation vectors output by the second projection head remain close in batch-level distribution.

[0041] The projection consistency regularization loss is calculated as follows: within the same training batch, the clean representation vector output by the first projection head is Softmax normalized to obtain the batch-level distribution vector output by the clean text coding tower; the adversarial representation vector output by the second projection head is Softmax normalized to obtain the batch-level distribution vector output by the adversarial text coding tower; then, KL divergence is used to calculate the difference between the two batch-level distribution vectors to obtain the projection consistency regularization loss. The KL divergence is used to measure the degree of inconsistency between two distributions. The smaller the value, the more consistent the batch-level data distribution of the clean text coding tower and the adversarial text coding tower outputs.

[0042] Joint optimization is constructed using a total loss function, which is: .in, For the recommended task loss, To counteract the loss of invariant contrast, The loss is for the projection consistency regularization term. and To balance the hyperparameters. Used to adjust the weight of the adversarial invariant contrastive loss in the total loss function, balancing hyperparameters. Used to adjust the weight of the projection consistency regularization loss in the total loss function.

[0043] Based on the total loss function Backpropagation is performed to calculate the parameter gradients of the underlying language model encoder, the first projector head, and the second projector head, respectively, and the corresponding parameters are updated according to the parameter gradients. Thus, the underlying language model encoder, the first projector head, and the second projector head are updated synchronously under the same total loss function constraint, completing the joint parameter optimization process.

[0044] Furthermore, the method provided in the application embodiments also includes: Optimize only during the initial stage of the preset training. To ensure the stability of the representation space, it is linearly increased after the initial pre-set training phase. This is to jointly optimize the recommendation task loss and the adversarial invariant contrast loss.

[0045] Furthermore, the method provided in the application embodiments also includes: Fixed in 50% of the training rounds , The training time was fixed at 0.05, and backpropagation was performed using the Adam optimizer. The learning rate was set to... It decays by 0.5 times every 30 epochs.

[0046] In this embodiment, during the initial pre-set training phase, only the loss of the recommendation task is optimized. To ensure the stability of the representation space, the initial training phase is pre-trained, typically the first 10% of training iterations. In this phase, the primary optimization target is the recommendation matching relationship between user historical interaction sequences and clean item representation vectors. This allows the clean representation vectors to first form a stable semantic foundation for recommendations, avoiding adversarial invariant contrastive loss. Premature intervention can cause fluctuations in the performance of a product.

[0047] After the initial training phase, the balancing hyperparameter α is linearly increased. α represents the adversarial invariant contrastive loss in the total loss function. The corresponding weight parameters are used to control the degree to which the adversarial invariant contrastive loss affects parameter updates. Specifically, after the initial training phase, α is gradually increased linearly from a small value to 1.0, causing the model to shift from relying solely on the recommendation task loss. The training state gradually transitions to the recommended task loss. Compared with the invariant resistance, the loss Jointly optimized training state.

[0048] In the last 50% of training rounds, α was fixed at 1.0 to maintain adversarial invariance and contrast loss. In subsequent training phases, stable weights are maintained to continuously constrain the relationship between the clean representation vector and the adversarial representation vector of the same item. The balancing hyperparameter β is fixed at 0.05 throughout training to control the projection consistency regularization loss. The weights in the total loss function ensure that the batch-level data distribution of the clean text coding tower and the adversarial text coding tower outputs are consistent.

[0049] During parameter updates, the total loss function is backpropagated through the Adam optimizer to update the parameters of the underlying language model encoder, first projector head, and second projector head. The learning rate is set to... It employs a periodic decay strategy, reducing the learning rate to 0.5 times its original value every 30 epochs. Therefore, by pre-setting the initial training phase to only optimize... The training scheduling method is preset to linearly increase α after the initial training phase, fix α=1.0 for 50% of the training rounds, and fix β=0.05 throughout the training process, thereby achieving stable joint optimization of recommended task loss and adversarial invariant contrastive loss.

[0050] Furthermore, the method provided in the application embodiments also includes: Both the first projection head and the second projection head adopt a multilayer perceptron structure containing two fully connected layers, and a nonlinear activation function and a normalization layer are set between the two fully connected layers to perform nonlinear semantic compression mapping on the output of the underlying language model encoder.

[0051] In this embodiment, both the first projection head and the second projection head employ a multilayer perceptron structure containing two fully connected layers. Specifically, after the underlying language model encoder outputs the text encoding result, the text encoding result is input into the first projection head and the second projection head, respectively. The text encoding result output by the underlying language model encoder is a high-dimensional semantic encoding, such as the hidden state corresponding to the position ([CLS]), whose dimension is d. model The first and second projection heads are used to map the high-dimensional semantic code to a low-dimensional semantic subspace to obtain a clean representation vector and an adversarial representation vector for subsequent loss calculation.

[0052] The first projection head is positioned in the clean text encoding tower and is used to perform nonlinear semantic compression mapping on the output of the underlying language model encoder corresponding to the original text description. The second projection head is positioned in the adversarial text encoding tower and is used to perform nonlinear semantic compression mapping on the output of the underlying language model encoder corresponding to the adversarial perturbation text description. Nonlinear semantic compression mapping refers to converting the high-dimensional encoding result of the underlying language model encoder output into a low-dimensional representation vector through a multilayer perceptron structure, and enhancing the representation mapping capability through nonlinear transformation.

[0053] Both the first and second projection heads include two fully connected layers, with a non-linear activation function and a normalization layer placed between them. The fully connected layers perform vector dimension transformation and feature combination, the non-linear activation function introduces non-linear mapping capabilities, and the normalization layer stabilizes the intermediate feature distribution and improves training stability. The normalization layer can use BatchNorm, and the non-linear activation function can use ReLU. Therefore, the output d of the underlying language model encoder... model After being processed by two fully connected layers, a normalization layer, and a non-linear activation function, the dimensional encoding result is mapped to a dimension of d. z The representation vector.

[0054] In the clean text coding tower, the first projection head processes the encoded output of the underlying language model encoder regarding the original text description to obtain a clean representation vector. In the adversarial text coding tower, the second projection head processes the encoded output of the underlying language model encoder regarding the adversarial perturbation text description to obtain an adversarial representation vector. The first and second projection heads have the same structure but independent parameters, enabling the clean text path and the adversarial text path to have mapping capabilities adapted to their own input features, while avoiding the optimization noise generated by the adversarial perturbation text description from directly affecting the projection parameters of the clean text path. Through the above processing, a nonlinear semantic compression mapping of the output of the underlying language model encoder is completed.

[0055] Furthermore, the method provided in the application embodiments also includes: Before calculating the adversarial invariant contrastive loss based on the clean representation vector and the adversarial representation vector, L2 normalization is performed on the clean representation vector and the adversarial representation vector.

[0056] In this embodiment, after the first projection head outputs a clean representation vector and the second projection head outputs an adversarial representation vector, the clean representation vector and the adversarial representation vector are respectively normalized in terms of vector magnitude to convert them into unit norm form. L2 normalization refers to dividing the representation vector by its L2 norm to eliminate similarity calculation bias caused by differences in magnitude between different representation vectors.

[0057] L2 normalization is expressed as .in, Let i be the clean representation vector of item i. This represents the adversarial representation vector of item i. Denotes the L2 norm of a clean representation vector. This represents the L2 norm of the adversarial representation vector.

[0058] The L2 normalization process described above ensures that the clean representation vector and the adversarial representation vector have a unified vector scale before entering the adversarial invariant contrastive loss calculation. Subsequently, when calculating cosine similarity, the similarity relationship between the clean representation vector and the adversarial representation vector is mainly determined by the vector direction, thus providing normalized input for the subsequent cosine similarity-based adversarial invariant contrastive loss calculation.

[0059] In summary, the embodiments of this application have at least the following technical effects: This application obtains the original text description of an item and its corresponding adversarial perturbation text description; inputs the original text description and the adversarial perturbation text description into a clean text encoding tower and an adversarial text encoding tower sharing the same underlying language model encoder, respectively; through the first projection head in the clean text encoding tower, the encoding output of the underlying language model encoder on the original text description is converted into a clean representation vector; through the second projection head in the adversarial text encoding tower, the encoding output of the underlying language model encoder on the adversarial perturbation text description is mapped into an adversarial representation vector; based on the clean representation vector and the adversarial representation vector, an adversarial invariant contrastive loss is calculated, which is used to constrain the distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace to be less than the distance between the representation vectors of different items; based on the user's historical interaction sequence and the clean representation vector of the item, a recommendation task loss is calculated; and based on the adversarial invariant contrastive loss and the recommendation task loss, the parameters of the underlying language model encoder, the first projection head, and the second projection head are jointly optimized. This invention addresses the technical problem in existing LLM recommendation systems that are susceptible to textual adversarial perturbations, leading to manipulation of recommendation results. By constructing a dual-tower structure with a shared underlying language model encoder and utilizing adversarial invariant contrastive loss to constrain the clean and adversarial representations of the same item to remain close in the semantic subspace, the invention enhances the robustness of the LLM recommendation system against textual adversarial attacks and reduces the impact of adversarial perturbations on recommendation results.

[0060] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0061] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A dual-tower contrastive cleanup training method for LLM recommender systems with adversarial robustness, characterized in that, The method includes: Obtain the original text description of the item and the corresponding text description of the counter-perturbation; The original text description and the adversarial perturbation text description are respectively input into the clean text encoding tower and the adversarial text encoding tower, which share the same underlying language model encoder. The first projection head in the clean text encoding tower encodes the original text description as a clean representation vector through the encoding output of the underlying language model encoder. The second projection head in the adversarial text coding tower maps the encoded output of the underlying language model encoder for the adversarial perturbation text description into an adversarial representation vector. Based on the clean representation vector and the adversarial representation vector, the adversarial invariant contrastive loss is calculated. The adversarial invariant contrastive loss is used to constrain the distance between the clean representation vector and the adversarial representation vector of the same item in the semantic subspace to be less than the distance between the representation vectors of different items. The recommendation task loss is calculated based on the user's historical interaction sequence and the clean representation vector of the item. Based on the adversarial invariant contrastive loss and the recommendation task loss, the parameters of the underlying language model encoder, the first projection head, and the second projection head are jointly optimized.

2. The dual-tower contrastive purification training method for LLM recommendation systems with adversarial robustness as described in claim 1, characterized in that, The adversarial perturbation text description is constructed through an online adversarial sample generation strategy. In each training batch, the original text description is perturbed by a word-level gradient text attack method, and adversarial perturbation text is generated under semantic similarity constraints.

3. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 1, characterized in that... The adversarial invariant contrastive loss is calculated as follows: ； in, Characterizing cosine similarity, This is the temperature coefficient hyperparameter. To determine the number of items in a training batch, Represents any single item within a batch. Characteristic of items A clean representation vector. For items Adversarial representation vector, thing The adversarial representation vector.

4. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 1, characterized in that, Based on the adversarial invariant contrastive loss and recommendation task loss, the joint optimization of the parameters of the underlying language model encoder, the first projection head, and the second projection head also includes: The joint optimization process is constructed using a total loss function, which also includes a projection consistency regularization loss term. This term constrains the consistency of the batch-level data distribution output by the clean text coding tower and the adversarial text coding tower. The total loss function is: ； in, For the recommended task loss, To counteract the loss of invariant contrast, The loss is for the projection consistency regularization term. and To balance the hyperparameters.

5. The dual-tower contrastive purification training method for LLM recommendation systems with adversarial robustness as described in claim 4, characterized in that, Optimize only during the initial stage of the preset training. To ensure the stability of the representation space, it is linearly increased after the initial pre-set training phase. This is to jointly optimize the recommendation task loss and the adversarial invariant contrast loss.

6. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 5, characterized in that... Fixed in 50% of the training rounds , The training time was fixed at 0.05, and backpropagation was performed using the Adam optimizer. The learning rate was set to... It decays by 0.5 times every 30 epochs.

7. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 1, characterized in that, Both the first projection head and the second projection head adopt a multilayer perceptron structure containing two fully connected layers, and a nonlinear activation function and a normalization layer are set between the two fully connected layers to perform nonlinear semantic compression mapping on the output of the underlying language model encoder.

8. The dual-tower contrastive purification training method for LLM recommendation systems with adversarial robustness as described in claim 1, characterized in that, The user's historical interaction sequence generates a user representation vector through a sequence encoder, and the recommendation score is constructed by the inner product of the user representation vector and the clean representation vector.

9. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 8, characterized in that, The loss for the recommendation task is constructed using a ranking learning approach based on positive and negative sample pairs, as follows: ； in, Representing users, For positive sample items, For negative sample items, This is the Sigmoid function.

10. The dual-tower contrastive purification training method for LLM recommender systems with adversarial robustness as described in claim 1, characterized in that, Before calculating the adversarial invariant contrastive loss based on the clean representation vector and the adversarial representation vector, L2 normalization is performed on the clean representation vector and the adversarial representation vector.

Images