Security protection method and device, electronic equipment and storage medium

Abstract

The application provides a security protection method and device, electronic equipment and storage medium, and relates to the technical field of data processing. The method comprises the following steps: based on an input request, a large language model is controlled to perform layer-by-layer forward calculation, and when the layer-by-layer forward calculation is performed to a target linear output layer, a structured decoy component is generated; the structured decoy component is superimposed on the output of the target linear output layer to obtain a decoy-containing intermediate representation; through a subsequent calculation layer located after the target linear output layer in the large language model, absorption processing is performed on the decoy-containing intermediate representation to obtain an absorbed representation; and based on the absorbed representation, the large language model continues to perform layer-by-layer forward calculation to output a response result corresponding to the input request.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a security protection method, device, electronic device, and storage medium. Background Technology

[0002] With the widespread deployment of large language models, multimodal generative models, and instruction following models, the ability to securely align has gradually become one of their fundamental capabilities. Existing large language models typically employ methods such as supervised fine-tuning, preference optimization, rejection behavior shaping, and secure dataset distillation for secure alignment training. This enables the model to exhibit behaviors such as rejection or secure alternative outputs when faced with high-risk requests that do not conform to the preset security policy.

[0003] However, the aforementioned secure alignment capabilities do not exist internally as discrete rules, but rather are often manifested as internal representations such as intermediate layer residual representations, attention outputs, and directional information of specific projection matrices. With the public disclosure of the weights, structure, and inference chains of large language models, attackers can estimate the rejection direction based on the internal representation differences between harmful and harmless prompt word samples, and then edit the orientation parameters of a small number of linear projection modules carrying that direction. This allows attackers to weaken the model's secure alignment capabilities at a relatively low cost, posing a significant threat to the secure deployment of large language models.

[0004] Therefore, how to improve the inherent resistance of large language models to white-box jailbreak attacks has become an urgent problem to be solved in the industry. Summary of the Invention

[0005] This invention provides a security protection method, device, electronic device, and storage medium to solve the problem of how to improve the inherent resistance of large language models to white-box jailbreak attacks in the prior art.

[0006] This invention provides a security protection method, comprising: Based on the input request, the large language model is controlled to perform layer-by-layer forward computation, and when the layer-by-layer forward computation reaches the target linear output layer, a structured decoy component is generated; wherein, the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy component is generated based on the current hidden state at the target linear output layer and is constrained by a preset low-rank basis matrix; The structured decoy component is superimposed on the output of the target linear output layer to obtain an intermediate representation containing the decoy; The intermediate representation containing the decoy is subjected to absorption processing through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer. Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

[0007] According to a security protection method provided by the present invention, the positional relationship between the target linear output layer and the subsequent computation layer satisfies any one of the following: The target linear output layer is the attention output projection layer of the target layer, and the subsequent computation layer is located in the same layer as the target layer; wherein, the subsequent computation layer includes at least one of an upper projection layer and a gated projection layer; The target linear output layer is a projection layer under the feedforward network of the target layer, and the successor computation layer is located in the layer below the target layer; wherein, the successor computation layer includes at least one of a query projection layer, a key projection layer, and a value projection layer.

[0008] According to a security protection method provided by the present invention, the target linear output layer includes at least two linear projection layers located in different layers of the large language model; The successor computation layer includes at least two successor computation layers, each corresponding to one of the at least two linear projection layers; In this context, the decoy subspaces corresponding to the at least two linear projection layers are non-collinear with each other.

[0009] According to a security protection method provided by the present invention, the generation of structured decoy components includes: Obtain the current hidden state at the target linear output layer, the context features corresponding to the input request, and the current lexical identifier; Based on the current hidden state, the context features, and the current lexical identifier, condition coefficients are determined using a preset condition coefficient generation function; wherein, the condition coefficient generation function is a deterministic mapping function. The structured decoy components are obtained by combining the condition coefficients with the preset low-rank basis matrix.

[0010] According to a security protection method provided by the present invention, the structured decoy component satisfies at least one of the following constraints: Low-rank constraint, which is used to confine the structured decoy component to a subspace with a dimension lower than a preset rank value; The hierarchical constraint is used to ensure that the decoy subspaces corresponding to different layers in the large language model are non-collinear. A constraint is imposed to ensure that the amplitude of the structured decoy component does not exceed a preset amplitude upper limit.

[0011] According to a security protection method provided by the present invention, an absorption process is performed on the intermediate characterization containing the decoy, comprising: The intermediate characterization containing the decoy is subjected to residual superposition and layer normalization to obtain the normalized intermediate state; At the subsequent computation layer, the normalized intermediate state is remapped to obtain the post-absorption representation. The remapping process includes at least one of the following methods: low-rank transformation, conditional gating, residual compensation, and bypass suppression.

[0012] According to a security protection method provided by the present invention, before generating the structured decoy components, the method further includes: Obtain the risk score corresponding to the input request; Based on the risk score, perform at least one of the following modulation operations on the generation process of the structured decoy component: When the risk score is higher than a preset gating threshold, the generation of the structured decoy component is initiated; The condition coefficients in the structured decoy component are weighted and modulated; wherein, when the risk score corresponding to the first input request is greater than the risk score corresponding to the second input request, the weighted and modulated condition coefficient corresponding to the first input request is greater than the weighted and modulated condition coefficient corresponding to the second input request.

[0013] According to a security protection method provided by the present invention, the method further includes: A decoy generation bypass structure is attached to the output path of the target linear output layer of the base model, and an absorption recovery bypass structure is attached to the computation path of the subsequent computation layer of the base model to obtain the model to be trained; wherein, the base model is the original large language model without the decoy generation bypass structure and the absorption recovery bypass structure attached; the decoy generation bypass structure carries the preset low-rank basis matrix and is used to generate the structured decoy components, and the absorption recovery bypass structure is used to perform the absorption processing; Construct a training dataset; wherein the training dataset includes a set of harmless requests and a set of dangerous requests; Based on the training dataset, forward computation is performed on the model to be trained, and the attack observation residuals corresponding to the harmless request set and the dangerous request set are extracted at the target word positions of the model to be trained, respectively, to obtain the observation space separability measurement result. Based on the observation space separability measurement results, a joint optimization target loss is constructed, and based on the joint optimization target loss, joint iterative optimization is performed on the parameters of the decoy generation bypass structure and the parameters of the absorption recovery bypass structure to obtain the trained decoy generation bypass structure and the trained absorption recovery bypass structure. Based on the aforementioned base model, the trained decoy generation bypass structure, and the trained absorption recovery bypass structure, the large language model is obtained. During the joint iterative optimization process, the backbone weights of the basic model remain unchanged.

[0014] According to a security protection method provided by the present invention, the step of constructing a joint optimization target loss based on the separability metric of the observation space includes: Based on the observed spatial separability metric, an anti-estimation loss is constructed; wherein, the anti-estimation loss is used to reduce the stable separability of the dangerous request set and the harmless request set at the target linear output layer; Based on the deviation between the output of the model to be trained and the output of the base model on the harmless request set, a capability retention loss is constructed. Based on the rejection behavior indicators of the model to be trained on the dangerous request set, a safety retention loss is constructed; Based on the impact of the structured decoy component on downstream characterization after processing by the absorption recovery bypass structure, a recovery loss is constructed. The joint optimization objective loss is obtained by performing a weighted fusion of the anti-estimation loss, the capability preservation loss, the safety preservation loss, and the recovery loss.

[0015] According to a security protection method provided by the present invention, the step of constructing an anti-estimation loss based on the observation space separability metric includes: Based on the attack observation residuals of the dangerous request set at the target linear output layer, determine the first type mean and the first type inner covariance matrix; Based on the attack observation residuals of the harmless request set at the target linear output layer, determine the second type mean and the second type inner covariance matrix; Based on the difference between the first class means and the second class means, and the sum of the traces of the first class covariance matrix and the second class covariance matrix, a stable separability measure is determined; wherein, the stable separability measure is directly proportional to the norm of the difference and inversely proportional to the sum of the traces; The anti-estimation loss is constructed based on the stable separability metric.

[0016] According to a security protection method provided by the present invention, the method further includes: During the joint iterative optimization process, at least one round of simulated attack operations are embedded in the model to be trained; wherein, the simulated attack operations include performing direction extraction and local parameter editing on the model to be trained; Obtain the amount of security performance degradation of the model to be trained after the simulated attack operation; The decrease in security performance is used as one of the reverse optimization signals and participates in the joint iterative optimization.

[0017] The present invention also provides a safety protection device, comprising: The generation module is used to control the large language model to perform layer-by-layer forward computation based on the input request, and generate structured decoy components when the layer-by-layer forward computation reaches the target linear output layer; wherein, the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix; The overlay module is used to overlay the structured decoy component onto the output of the target linear output layer to obtain an intermediate representation containing the decoy. An absorption module is used to perform absorption processing on the intermediate representation containing the decoy through a subsequent computation layer located after the target linear output layer in the large language model to obtain an absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer; The output module is used to perform layer-by-layer forward computation based on the absorbed representation, and output the response result corresponding to the input request.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the security protection method described above.

[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the security protection method as described above.

[0020] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the security protection method described above.

[0021] This invention provides a security protection method, device, electronic device, and storage medium. By generating structured decoy components at a preset linear projection layer on the residual path of a large language model, based on the current hidden state and constrained by a preset low-rank basis matrix, and superimposing these components onto the output of the target linear output layer, the intermediate representations observed by the attacker at this linear output layer are covered by structured and conditional perturbations. This causes the direction estimated by the attacker based on the differential statistics of harmful and harmless samples to deviate from the direction of the model's actual security decision. Simultaneously, by using a subsequent computation layer located after the target linear output layer to absorb the intermediate representations containing decoys, the contribution of the structured decoy components to downstream representations after propagation through the subsequent computation layer is reduced. This avoids the continuous accumulation and pollution of the model's inference results along the forward path by the decoy components, ensuring that the decoys maintain high visibility on the attacker's observation and editing path and low sensitivity on the model's actual task behavior path. Ultimately, without compromising the response quality of the large language model to normal requests, the resistance of the model to white-box jailbreak attacks is significantly improved. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the security protection method provided by the present invention; Figure 2 This is a schematic diagram comparing the system architecture and underlying mechanism provided by the present invention; Figure 3 A schematic diagram of the safety protection device structure provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0025] It should be noted that the execution subject of the security protection method provided in the embodiments of the present invention can be a hardware entity with data processing capabilities, such as an electronic device, server, controller, security protection device, or inference platform with a large language model, or a software module or a processing unit combining software and hardware running on the aforementioned hardware entity. For ease of explanation, the following description uses an electronic device as the execution subject, but this should not be construed as a limitation on the execution subject of the present invention.

[0026] The following embodiments use a large language model M to be protected as an example to illustrate the process. The large language model M includes multiple transformation layers stacked sequentially, such as 32 transformation layers. Each transformation layer includes an attention sublayer and a feedforward network sublayer. Information is transmitted through structures such as residual connections and layer normalization. The security protection method of this embodiment can be deployed on the inference link of the large language model M.

[0027] Figure 1 This is a flowchart illustrating the security protection method provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: Step 101: Based on the input request, control the large language model to perform layer-by-layer forward computation, and when the layer-by-layer forward computation reaches the target linear output layer, generate structured decoy components.

[0028] Specifically, the electronic device first obtains an input request. This input request can be natural language text entered by the user through a dialog interface, an interface call request from an upstream business system, or a sequence of words formed after preprocessing such as word segmentation and embedding.

[0029] For example, in an exemplary application scenario, an electronic device receives a question text input by a user, converts the question text into a word sequence via a word segmenter, and then passes it to a large language model M.

[0030] The electronic device control language model M performs layer-by-layer forward computation on the input request according to its preset network structure.

[0031] Layer-by-layer forward computation can be understood as embedding the input lexical units layer by layer through each transformation layer in the large language model M. Each transformation layer transforms the intermediate representation of the input based on its internal attention sublayer and feedforward network sublayer, and outputs the corresponding intermediate representation in sequence, until the last layer of the model is reached and logits are output.

[0032] During the layer-by-layer forward computation, when the computation reaches the pre-selected target linear output layer, the electronic device triggers the operation of generating structured decoy components.

[0033] The target linear output layer refers to the preset linear projection layer located on the residual path in the large language model M. It can be the linear output projection layer located before the residual connection in the attention sublayer, or the linear down projection layer located before the residual connection in the feedforward network sublayer. This embodiment does not impose specific restrictions on this.

[0034] For example, in this embodiment, a linear projection layer of the 15th layer in the large language model M can be used as the target linear output layer, and the layer where the target linear output layer is located can be identified as l.

[0035] The structured decoy component is a perturbation vector generated based on the current hidden state at the target's linear output layer and constrained by a preset low-rank basis matrix, denoted as δ_l.

[0036] Here, the current hidden state refers to the feature vector that the target linear output layer is about to output or has just output when the large language model M reaches the target linear output layer, denoted as h_l.

[0037] The pre-defined low-rank basis matrix refers to a matrix whose rank is much lower than the hidden dimension, denoted as U_l. It can be obtained by pre-training or by pre-random initialization and constraint.

[0038] The structured decoy component can be generated by passing the current hidden state h_l through a mapping network to obtain a conditional scalar or conditional vector, and then combining this conditional scalar or conditional vector with a preset low-rank basis matrix U_l to obtain a perturbation vector δ_l with the same dimension as the output dimension of the target linear output layer. The combination operation can include, but is not limited to, matrix multiplication, tensor multiplication, weighted summation, etc.

[0039] It should be noted that, unlike zero-mean random noise, the structured decoy component δ_l is subject to the dual constraints of the current hidden state h_l and the preset low-rank basis matrix U_l, which causes it to exhibit a perturbation pattern related to the hidden state under different input requests, rather than a completely independent and identically distributed random perturbation.

[0040] Step 102: The structured decoy component is superimposed on the output of the target linear output layer to obtain the intermediate representation containing the decoy.

[0041] Specifically, the electronic device adds the structured decoy component δ_l generated in step 101 bit by bit to the original output vector of the target linear output layer, thereby obtaining an intermediate representation containing the decoy component. The superposition method can be a simple element-by-element addition, or an addition after scaling factor adjustment. For example, assuming the original output vector of the target linear output layer is h_l and the structured decoy component is δ_l, the intermediate representation containing the decoy can be expressed as h_l+δ_l or h_l+s·δ_l, where s represents a preset amplitude scaling factor.

[0042] Step 103: In the subsequent computational layer located after the target linear output layer in the large language model, perform absorption processing on the intermediate representation containing the decoy to obtain the absorbed representation.

[0043] Specifically, the intermediate representation containing the decoy continues to propagate forward along the residual path of the large language model M, and is received and participated in the computation by the subsequent computation layer when it reaches the subsequent computation layer.

[0044] The successor computation layer refers to the computation layer in the forward computation path of the large language model M that is located after the target linear output layer and is capable of reading or processing intermediate representations containing decoys. This successor computation layer can be located within the same transformation layer or in several transformation layers after the transformation layer where the target linear output layer is located.

[0045] The electronic device performs absorption processing on the intermediate representation containing the decoy at this subsequent computation layer. The absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model M after this subsequent computation layer.

[0046] More specifically, the absorption process allows the decoy component to remain externally observable at the target linear output layer, but its impact on downstream inference results is significantly weakened.

[0047] The absorption processing can be implemented in ways including but not limited to: performing a transformation on the intermediate representation containing the decoy through a bypass adapter located in the subsequent computation layer to weaken the influence of the decoy component; remapping the intermediate representation containing the decoy through a preset recovery function; and selectively suppressing the decoy component through a gating mechanism.

[0048] Step 104: Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

[0049] Specifically, the electronic device uses the absorbed representation obtained after absorption processing as input to subsequent paths in subsequent computation layers, enabling the large language model M to continue propagating the absorbed representation layer by layer to the model's output according to its original forward computation process, ultimately outputting a response result corresponding to the input request. This response result can be natural language text generated by the model, or a rejection or safe alternative answer that conforms to the semantics of the input request.

[0050] In this application, the structured decoy component maintains high visibility at the target linear output layer that the attacker may observe, causing the direction estimated by the attacker based on the differential statistics of harmful and harmless samples to deviate from the direction of the security decision actually carried by the large language model M. At the same time, with the help of the absorption processing of the subsequent computing layer, the influence of the decoy component on the downstream inference results is significantly weakened, and the normal response capability of the large language model M to input requests is maintained. Thus, without significantly impairing the general capability of the large language model M, its inherent resistance to white-box jailbreak attacks is improved.

[0051] Optionally, the positional relationship between the target linear output layer and the subsequent computation layer satisfies any one of the following: The target linear output layer is the attention output projection layer of the target layer, and the subsequent computation layer is located in the same layer as the target layer; wherein, the subsequent computation layer includes at least one of an upper projection layer and a gated projection layer; The target linear output layer is a projection layer under the feedforward network of the target layer, and the successor computation layer is located in the layer below the target layer; wherein, the successor computation layer includes at least one of a query projection layer, a key projection layer, and a value projection layer.

[0052] This embodiment further elaborates on the positional relationship between the target linear output layer and the subsequent computation layer. In the large language model M, each transformation layer typically includes an attention sub-layer and a feedforward network sub-layer. The output of the attention sub-layer typically passes through an attention output projection layer (o_proj), followed by residual connections and layer normalization. The feedforward network sub-layer typically includes an up projection layer (up_proj), a gated projection layer (gate_proj), and a down projection layer (down_proj), where the output of the down projection layer is passed to the next transformation layer after residual connections and layer normalization.

[0053] In one specific implementation, the target linear output layer is the attention output projection layer in a target transformation layer, such as o_proj in the 15th layer of a large language model M. In this case, the subsequent computation layer is located in the same transformation layer as the target transformation layer.

[0054] Specifically, the intermediate representation containing the decoy, after passing through residual connections and layer normalization within the target transformation layer, enters the feedforward network sub-layer of the target transformation layer. In this feedforward network sub-layer, at least one of the upper projection layer and the gated projection layer is configured as a subsequent computation layer to perform the absorption processing of the intermediate representation containing the decoy.

[0055] For example, an absorption path can be configured only on up_proj of the 15th layer of the target transformation layer; an absorption path can be configured only on gate_proj; or an absorption path can be configured on both up_proj and gate_proj. This embodiment does not impose any restrictions on this.

[0056] In another specific implementation, the target linear output layer is a projection layer of the feedforward network in a target transformation layer, such as down_proj of the 15th layer of a large language model M. In this case, the subsequent computation layer is located in the next transformation layer after the target transformation layer.

[0057] Specifically, the intermediate representation containing the decoy is passed to the next transformation layer, such as the attention sublayer of the 16th layer, after being processed by the residual connection and layer normalization of the target transformation layer.

[0058] In the attention sublayer of the next transformation layer, at least one of the query projection layer, the key projection layer, and the value projection layer is configured as a subsequent computation layer to perform absorption processing on the intermediate representation containing the decoy.

[0059] It should be noted that the two implementation methods described above can be deployed independently or selected according to actual protection needs. This embodiment does not impose any restrictions on this.

[0060] By specifically setting the positional relationship between the target linear output layer and the subsequent computation layer in this embodiment, the structured decoy component and the absorption processing can form a short path closed loop in the forward computation path. This facilitates the absorption processing to effectively weaken the decoy component within the shortest possible propagation distance, thereby further reducing the impact of the decoy component on the downstream inference quality of the large language model M.

[0061] Optionally, the target linear output layer includes at least two linear projection layers located in different layers of the large language model; The successor computation layer includes at least two successor computation layers, each corresponding to one of the at least two linear projection layers; In this context, the decoy subspaces corresponding to the at least two linear projection layers are non-collinear with each other.

[0062] This embodiment provides a further detailed explanation of the multi-layered hybrid decoy concealment and protection method. In this embodiment, the target linear output layer includes at least two linear projection layers located in different layers of the large language model M.

[0063] Specifically, electronic devices can simultaneously deploy decoy injection locations on multiple transformation layers of a large language model M. For example, the attention output projection layers of layers 12, 15, and 18 in the large language model M can be selected simultaneously as the target linear output layers; or the feedforward projection layer of layer 10 and the attention output projection layer of layer 16 can be selected simultaneously as the target linear output layers, etc.

[0064] The successor computation layer includes at least two successor computation layers, each corresponding to one of the at least two linear projection layers. That is, each linear projection layer selected as the target linear output layer is configured with one or more successor computation layers.

[0065] For example, if the attention output projection layers of layers 12 and 15 are both selected as target linear output layers, then the up_proj and / or gate_proj of layer 12 are configured as the successor computation layers corresponding to the target linear output layer of layer 12, and the up_proj and / or gate_proj of layer 15 are configured as the successor computation layers corresponding to the target linear output layer of layer 15.

[0066] Furthermore, the decoy subspaces corresponding to the at least two linear projection layers are non-collinear with each other.

[0067] The decoy subspace refers to the subspace spanned by the structured decoy components corresponding to a certain linear projection layer. This subspace can be spanned by the column vectors of the preset low-rank basis matrix corresponding to the linear projection layer.

[0068] The noncollinearity between decoy subspaces can be understood as follows: there is no simple linear integration relationship between the preset low-rank basis matrices corresponding to different linear projection layers, that is, there is no linear transformation that restores multiple low-rank basis matrices to the same stable direction after being linearly merged.

[0069] Noncollinearity between decoy subspaces can be achieved by applying orthogonal constraints, maximizing the included angle constraint, or maximizing the distance constraint between the principal subspaces to different low-rank basis matrices.

[0070] The multi-layered hybrid decoy concealment protection method in this embodiment makes it difficult for attackers to recover a stable attack direction through simple linear integration when attempting to perform weighted local editing on multiple transformation layers simultaneously. This further increases the difficulty for attackers to perform targeted parameter editing and enhances the protection strength against white-box jailbreak attacks.

[0071] Optionally, the generation of structured decoy components includes: Obtain the current hidden state at the target linear output layer, the context features corresponding to the input request, and the current token identifier; Based on the current hidden state, the context features, and the current token identifier, condition coefficients are determined through a preset condition coefficient generation function; wherein, the condition coefficient generation function is a deterministic mapping function. The structured decoy components are obtained by combining the condition coefficients with the preset low-rank basis matrix.

[0072] In this application, for ease of description, the layer identifier of the target linear output layer is denoted as l. The current hidden state refers to the feature vector that the target linear output layer is about to output or has just output when the large language model reaches the target linear output layer, denoted as h_l. The context features refer to the context representation obtained by summarizing several tokens in the input request that are located before the current token. For example, it can be obtained by mean pooling, attention-weighted summarization, or learningable context encoder encoding of the hidden states of historical tokens, denoted as c_l. The current token identifier refers to the identifier information of the token that is currently being generated or processed, which can be the token number, the token embedding index, or the position vector after position encoding, denoted as t_l.

[0073] In this application, the conditional coefficient generating function is a deterministic mapping function. A deterministic mapping function is a function whose output remains consistent for the same input, i.e., without introducing any random sampling process. This function can be implemented by a small neural network consisting of several fully connected layers, activation functions, and normalization layers, or by an analytical expression consisting of several pre-defined nonlinear transformations.

[0074] For example, the conditional coefficient generation function can be expressed as z_l=f(h_l,c_l,t_l), where f is a pre-trained small mapping network, and z_l is the conditional coefficient corresponding to the l-th layer. The conditional coefficients can be in scalar, vector, or matrix form, and this embodiment does not limit their specific form.

[0075] The purpose of using a deterministic mapping function is to ensure that the conditional coefficients can be stably reproduced under the same input conditions, which facilitates repeatable evaluation after deployment and also helps to avoid output instability introduced by random sampling.

[0076] Specifically, the electronic device combines the condition coefficient z_l with the preset low-rank basis matrix U_l of the l-th layer to obtain the structured decoy component δ_l, which can be expressed as: δ_l=U_l·z_l(h_l,c_l,t_l); Where U_l is the basis matrix of the decoy subspace of the l-th layer, z_l(·) is the condition coefficient generating function of the l-th layer, and δ_l is the structured decoy component injected into the output of the target linear output layer of the l-th layer.

[0077] The combined operations can include, but are not limited to, matrix multiplication and weighted summation. The rank of the pre-defined low-rank basis matrix U_l is much smaller than the dimension of the target linear output layer's output vector, thus ensuring that the structured decoy components are confined to a low-dimensional subspace.

[0078] By specifying the structured decoy component generation process in this embodiment, the structured decoy component can be strongly correlated with the current context, current token, and current hidden state of the input request. This avoids the decoy component exhibiting zero-mean, isotropic random perturbations, thereby effectively suppressing the possibility of the attacker canceling out the decoy component by averaging the sample mean statistics, and improving the stability of the decoy component's interference with the attack direction estimation logic.

[0079] Optionally, the structured decoy component satisfies at least one of the following constraints: Low-rank constraint, which is used to confine the structured decoy component to a subspace with a dimension lower than a preset rank value; The hierarchical constraint is used to ensure that the decoy subspaces corresponding to different layers in the large language model are non-collinear. A constraint is imposed to ensure that the amplitude of the structured decoy component does not exceed a preset amplitude upper limit.

[0080] This embodiment further details the constraints satisfied by the structured decoy component. The structured decoy component δ_l can satisfy at least one of the following constraints.

[0081] Low-rank constraint. The low-rank constraint is used to confine the structured decoy components to a subspace with a dimension lower than a preset rank value.

[0082] Specifically, the rank of the preset low-rank basis matrix U_l of the l-th layer is preset to r, where r is much smaller than the dimension d of the output vector of the target linear output layer. For example, r can be set to 4, 8, 16, 32, etc., and d can be set to 4096 or higher. By imposing a rank constraint on U_l, the structured decoy component δ_l always lies in the r-dimensional subspace spanned by U_l. The implementation of the low-rank constraint can include imposing constraints such as singular value truncation, singular value penalty, or explicit low-rank decomposition on U_l during the training phase.

[0083] Hierarchical constraints. Hierarchical constraints are used to ensure that the decoy subspaces corresponding to different layers in a large language model are non-collinear.

[0084] Specifically, for the target linear output layers deployed on different transformation layers, their respective preset low-rank basis matrices U_{l1}, U_{l2}, ..., U_{l...} are... kNon-collinear constraints are applied between layers. These non-collinear constraints can be achieved by introducing inter-layer orthogonality penalties, inter-layer angle penalties, or inter-layer principal subspace distance penalties during the training phase.

[0085] Constraints. Constraints are used to ensure that the amplitude of the structured decoy component δ_l does not exceed a preset amplitude upper limit.

[0086] Specifically, an upper bound constraint can be imposed on the norm (e.g., L2 norm) of the structured decoy component δ_l, for example, requiring ‖δ_l‖2≤ε_δ, where ε_δ is a preset upper bound on the amplitude. The implementation of this constraint can include: norm truncation of δ_l, applying a saturated activation function to the conditional coefficient z_l, or constraining the spectral norm of a preset low-rank basis matrix U_l.

[0087] By setting specific constraints for the structured decoy components in this embodiment, it is possible to ensure that the structured decoy components have sufficient interference capability against the attack observation path, while avoiding damage to the model's generality caused by excessively large decoy component amplitudes or excessively wide subspaces, thereby achieving a better balance between protection effectiveness and model performance.

[0088] Optionally, an absorption process is performed on the intermediate characterization containing the decoy, including: The intermediate characterization containing the decoy is subjected to residual superposition and layer normalization to obtain the normalized intermediate state; At the subsequent computation layer, the normalized intermediate state is remapped to obtain the post-absorption representation. The remapping process includes at least one of the following methods: low-rank transformation, conditional gating, residual compensation, and bypass suppression.

[0089] In this application, the electronic device first performs residual superposition on the intermediate representation h_l+δ_l containing the decoy according to the original network structure of the large language model M. That is, it adds the intermediate representation containing the decoy to the residual input of the sublayer containing the target linear output layer element by element to obtain the residual superposition result.

[0090] Subsequently, layer normalization is performed on the residual superposition result. Layer normalization can be implemented using the existing normalization module in the large language model M, such as LayerNorm or RMSNorm; this embodiment does not impose any restrictions on this. The feature vector obtained after layer normalization is the normalized intermediate state.

[0091] Specifically, the electronic device deploys a remapping module at the subsequent computing layer to perform remapping processing on the normalized intermediate states. The remapping processing can include at least one of the following methods: The low-rank transformation involves applying a low-rank matrix to the normalized intermediate state, significantly weakening the component related to the structured decoy component δ_l in its impact on the downstream representation after passing through subsequent computation layers. This low-rank transformation can be implemented using a pre-trained low-rank adapter.

[0092] Conditional gating involves generating a gating signal through a gating network to apply gating suppression to the portion of the normalized intermediate state that is related to the structured decoy component δ_l. The gating signal can be calculated based on the normalized intermediate state itself or based on additional conditional inputs.

[0093] Residual compensation involves generating a compensation vector corresponding to the structured decoy component δ_l through a compensation network, and then superimposing this compensation vector onto the normalized intermediate state to weaken its contribution to the downstream representation.

[0094] Bypass suppression involves processing the normalized intermediate state through a bypass branch. The output of the bypass branch is then fused with the normalized intermediate state before being passed to the main path of the subsequent computation layer.

[0095] It should be noted that the goal of the above remapping process is not to perform precise component-by-component cancellation of the structured decoy components, but to make the normalized intermediate state containing the structured decoy components have an impact on the downstream representation that is close to that of the case without the decoy components after passing through the subsequent computation layer.

[0096] By setting the specific process of absorption processing in this embodiment, the structured decoy component maintains high visibility at the target linear output layer observed by the attacker, but its contribution to downstream representation after subsequent computation layers is effectively suppressed, further ensuring the response quality of the large language model M to normal input requests.

[0097] Optionally, before generating the structured decoy components, the method further includes: Obtain the risk score corresponding to the input request; Based on the risk score, perform at least one of the following modulation operations on the generation process of the structured decoy component: When the risk score is higher than a preset gating threshold, the generation of the structured decoy component is initiated; The condition coefficients in the structured decoy component are weighted and modulated; wherein, when the risk score corresponding to the first input request is greater than the risk score corresponding to the second input request, the weighted and modulated condition coefficient corresponding to the first input request is greater than the weighted and modulated condition coefficient corresponding to the second input request.

[0098] In this application, firstly, a risk score corresponding to the input request is obtained. The risk score, denoted as r, is a quantitative assessment of the potential risk level of the content contained in the input request. Methods for obtaining the risk score may include, but are not limited to: risk probabilities obtained by classifying the input request using a pre-trained risk classifier; risk levels obtained through keyword matching and rule-based judgment; and risk scores obtained by extracting risk-related activation values ​​from several layers of a large language model M using pre-set internal representation probes.

[0099] For example, an electronic device can use a lightweight text classifier to score the input request, obtaining a risk score r between 0 and 1.

[0100] Subsequently, the electronic device performs at least one of the following modulation operations on the generation process of the structured decoy component based on the risk score.

[0101] When the risk score exceeds a preset gating threshold, the generation of structured decoy components is initiated. Specifically, the electronic device pre-sets a gating threshold τ. When the risk score r exceeds this threshold τ, the electronic device initiates the generation process of the structured decoy component δ_l; when the risk score r does not exceed the threshold τ, the electronic device does not initiate the generation process of the structured decoy component, and the large language model M continues to perform forward computation according to the original path. This approach is suitable for deployment scenarios where decoy protection is only enabled for high-risk requests, while the original response path of the model is fully preserved for ordinary requests.

[0102] The condition coefficients in the structured decoy component are weighted and modulated so that the condition coefficients corresponding to input requests with higher risk scores are greater than those corresponding to input requests with lower risk scores.

[0103] Specifically, the electronic device uses the risk score r as a weighting coefficient to perform weighted modulation on the condition coefficients. For example, it can use the method z_l'=g(r)·z_l, where g(·) is a monotonically increasing function, z_l is the original condition coefficient, and z_l' is the weighted modulation condition coefficient.

[0104] In this application, the first input request and the second input request refer to any two input requests. The terms "first" and "second" are used only to distinguish different input requests and are not used to limit the order, importance, or number of input requests.

[0105] Since g(·) is a monotonically increasing function, for any two input requests, if the risk score corresponding to the first input request is greater than the risk score corresponding to the second input request, the weighted modulated conditional coefficient z_l' corresponding to the first input request is greater than the weighted modulated conditional coefficient z_l' corresponding to the second input request. That is, the weighted modulated conditional coefficient increases as the risk score increases.

[0106] After weighted modulation, the structured decoy component can be expressed as δ_l=U_l·z_l'. This approach is suitable for deployment scenarios where it is desirable to always maintain the decoy's protective mechanism but dynamically adjust the decoy's strength according to the risk level.

[0107] By setting the conditional modulation of the structured decoy component generation process in this embodiment, the decoy protection mechanism can adaptively start / stop or adjust its intensity according to the risk level of the input request, further reducing the potential impact of the decoy component on the response quality of low-risk ordinary requests, while maintaining sufficient protection strength under high-risk requests.

[0108] Optionally, the method further includes: A decoy generation bypass structure is attached to the output path of the target linear output layer of the base model, and an absorption recovery bypass structure is attached to the computation path of the subsequent computation layer of the base model to obtain the model to be trained; wherein, the base model is the original large language model without the decoy generation bypass structure and the absorption recovery bypass structure attached; the decoy generation bypass structure carries the preset low-rank basis matrix and is used to generate the structured decoy components, and the absorption recovery bypass structure is used to perform the absorption processing; Construct a training dataset; wherein the training dataset includes a set of harmless requests and a set of dangerous requests; Based on the training dataset, forward computation is performed on the model to be trained, and the attack observation residuals corresponding to the harmless request set and the dangerous request set are extracted at the target token position of the model to be trained, respectively, to obtain the observation space separability measurement result. Based on the observation space separability measurement results, a joint optimization target loss is constructed, and based on the joint optimization target loss, joint iterative optimization is performed on the parameters of the decoy generation bypass structure and the parameters of the absorption recovery bypass structure to obtain the trained decoy generation bypass structure and the trained absorption recovery bypass structure. Based on the aforementioned base model, the trained decoy generation bypass structure, and the trained absorption recovery bypass structure, the large language model is obtained. During the joint iterative optimization process, the backbone weights of the basic model remain unchanged.

[0109] In this application, the base model refers to the original large language model that has not yet been constructed and trained by the security protection method of this embodiment, such as a publicly available open-source large language model M0.

[0110] A decoy generation bypass structure refers to a small network module that is mounted as a bypass outside the main path of the base model and is used to generate structured decoy components δ_l. This decoy generation bypass structure carries a pre-set low-rank basis matrix U_l and is used to read the current hidden state h_l at the target linear output layer to generate the structured decoy component δ_l. The decoy generation bypass structure can consist of one or more fully connected layers plus a low-rank basis matrix to store parameters.

[0111] An absorption recovery bypass structure refers to a small network module that is mounted as a bypass outside the subsequent computational layer of the base model and is used to perform absorption processing on intermediate representations containing decoys. This absorption recovery bypass structure can be composed of structures such as low-rank adapters, gated networks, or compensation networks.

[0112] The electronic device integrates the decoy generation bypass structure and the absorption recovery bypass structure into the base model in a mounted manner to form a model to be trained.

[0113] The mounting method refers to the decoy generation bypass structure and the absorption recovery bypass structure being added to the basic model and working in parallel with the basic model, without modifying the backbone weights of the basic model itself.

[0114] The training dataset includes a harmless request set and a dangerous request set. The harmless request set includes normal input request samples that do not trigger a security rejection, such as input text in scenarios like regular question answering, knowledge retrieval, writing assistance, and code generation. The dangerous request set includes input request samples that will trigger a security rejection.

[0115] In some implementations, the training dataset may further include secure alternative response data, normal task capability maintenance data, and attack simulation sample data to enhance training effectiveness.

[0116] In this application, the electronic device inputs samples from the harmless request set and the dangerous request set into the model to be trained, and the model to be trained performs forward computation.

[0117] During the forward computation, the electronic device extracts the residual vector at the target linear output layer at the target token position of each sample (e.g., the first token position in the generation phase), which serves as the attack observation residual. The attack observation residual refers to the intermediate representation vector obtained from within the model from the perspective of the attacker.

[0118] Electronic devices calculate the separability measure of the observation space based on the attack observation residuals corresponding to the harmless request set and the dangerous request set. The separability measure quantifies the degree to which the two types of requests are separable in the attack observation space; a larger value indicates that the two types of requests are easier for the attacker to distinguish, and a smaller value indicates that they are more difficult for the attacker to distinguish. The calculation method for the separability measure can include, but is not limited to, measures such as the norm of the inter-class mean difference, and a combined measure of the inter-class mean difference and the intra-class covariance.

[0119] Electronic devices construct a joint optimization objective loss based on the separability measure of the observation space. The joint optimization objective loss can include a weighted combination of multiple loss terms.

[0120] The electronic device employs gradient backpropagation to jointly iteratively optimize the parameters of the decoy generation bypass structure and the absorption recovery bypass structure.

[0121] In each iteration, the electronic device calculates the gradient of the joint optimization objective loss with respect to each parameter and updates the parameters using a preset optimization algorithm (such as Adam, SGD, etc.). Iterative optimization continues until the joint optimization objective loss converges or the preset maximum number of iterations is reached.

[0122] It should be noted that the backbone weights of the base model remain unchanged during the joint iterative optimization process. That is, during backpropagation, the electronic device only calculates and updates the gradients of the parameters for the decoy generation bypass structure and the absorption recovery bypass structure, while masking or freezing the gradients of the backbone weights of the base model. This training method allows the security protection method of this embodiment to be deployed on existing large language models in a plug-and-play manner without requiring re-pre-training of the base model.

[0123] The electronic device integrates the trained decoy generation bypass structure and absorption recovery bypass structure with the base model to form a large language model with security protection capabilities.

[0124] Through the specific settings of the large language model construction and training process in this embodiment, the basic model can be safely reinforced by means of bypass mounting and parameter freezing, avoiding modification of the backbone weights of the basic model, thereby preserving the original general capabilities of the basic model. At the same time, through joint optimization training, the decoy generation bypass structure and the absorption recovery bypass structure work together to achieve the dual goals of high decoy visibility and recoverable behavior.

[0125] Optionally, constructing the joint optimization objective loss based on the separability measure of the observation space includes: Based on the observed spatial separability metric, an anti-estimation loss is constructed; wherein, the anti-estimation loss is used to reduce the stable separability of the dangerous request set and the harmless request set at the target linear output layer; Based on the deviation between the output of the model to be trained and the output of the base model on the harmless request set, a capability retention loss is constructed. Based on the rejection behavior indicators of the model to be trained on the dangerous request set, a safety retention loss is constructed; Based on the impact of the structured decoy component on downstream characterization after processing by the absorption recovery bypass structure, a recovery loss is constructed. The joint optimization objective loss is obtained by performing a weighted fusion of the anti-estimation loss, the capability preservation loss, the safety preservation loss, and the recovery loss.

[0126] In this application, the anti-estimation loss is used to reduce the stable separability of the dangerous request set and the harmless request set at the target linear output layer.

[0127] Specifically, the electronic device uses the measurement of the separability of the observation space as the core input to resist the estimation loss, and converts it into a loss value through a monotonically increasing mapping function.

[0128] For example, electronic devices can directly use the separability measure of the observation space as the robust estimation loss, or they can use the separability measure after performing a logarithmic transformation, square transformation, or other monotonic transformation as the robust estimation loss. The robust estimation loss is denoted as L_anti.

[0129] The electronic device inputs samples from the harmless request set into the model to be trained and the base model respectively, and obtains the output of the model to be trained and the output of the base model respectively.

[0130] The output can be the logits of the last layer of the model, the probability distribution, or the hidden states of a certain layer. The electronic device calculates the deviation between the two, such as KL divergence, cross-entropy, mean squared error, or L1 norm, and uses this deviation as the capability preservation loss.

[0131] Capability preservation loss is used to constrain the response of the model being trained to harmless requests to remain close to the response of the base model to harmless requests, thereby protecting the general capabilities of large language models. Capability preservation loss is denoted as L_preserve.

[0132] The electronic device inputs samples from a set of dangerous requests into the model to be trained, and obtains the model's response to the dangerous requests. The electronic device then calculates a refusal behavior index based on this response.

[0133] Rejection behavior metrics may include, but are not limited to: the predicted probability of the rejection token, the matching degree of the rejection template, and the rejection probability output by the preset rejection discriminator.

[0134] Electronic devices construct a safety maintenance loss based on the refusal behavior index to ensure that the training model's ability to refuse dangerous requests does not decrease.

[0135] For example, the safety-holding loss can be expressed as the negative log-likelihood of the predicted probability of the rejected token. The safety-holding loss is denoted as L_safety.

[0136] The electronic device calculates downstream key representations in two scenarios: one is the downstream key representation obtained by the training model after processing the intermediate representation containing the decoy through an absorption recovery bypass structure; the other is the downstream key representation obtained by the training model without injecting structured decoy components. The electronic device constructs a recovery loss based on the difference between the two, which can be expressed as: L_recovery=Σ_l‖g_l(h_l+δ_l)-g_l(h_l)‖ 2 ; Where l represents the layer identifier of the target linear output layer, g_l(·) represents the key mapping or downstream state extraction function corresponding to the absorption recovery bypass structure after the l-th target linear output layer, h_l represents the current hidden state at the l-th target linear output layer, and δ_l represents the structured decoy component corresponding to the l-th layer.

[0137] When the target linear output layer includes only a single linear projection layer, the summation sign can be omitted, and only the single term of the corresponding layer is retained; when the target linear output layer includes multiple linear projection layers of different layers, the recovery errors of each corresponding layer are summed to form the total recovery loss.

[0138] The recovery loss is used to constrain the downstream key characterization after the injection of structured decoy components, and the downstream key characterization after absorption recovery bypass structure treatment remains close to that without the injection of structured decoy components.

[0139] The electronic device performs a weighted sum of the four types of losses according to preset weighting coefficients to obtain the joint optimization objective loss. For example, the joint optimization objective loss can be expressed as: L_total=α·L_anti+β·L_preserve+γ·L_safety+η·L_recovery; Among them, α, β, γ, and η are preset weighting coefficients that can be adjusted according to specific application scenarios and protection requirements.

[0140] In some implementations, the weight coefficients can also be dynamically adjusted, for example, adaptively adjusted according to the training rounds or loss convergence.

[0141] Furthermore, in some other implementations, the joint optimization objective loss may further include a structural constraint loss term L_struct for constraining the low-rank property of the structured decoy components, the upper limit of amplitude, and the sparsity of the absorption recovery bypass structure. In this case, the joint optimization objective loss can be expressed as: L_total=α·L_anti+β·L_preserve+γ·L_safety+η·L_recovery+λ·L_struct; Where λ is the corresponding weighting coefficient.

[0142] By setting the joint optimization target loss in this embodiment, the decoy generation bypass structure and the absorption recovery bypass structure can be jointly optimized under multi-objective cooperative constraints, so that the decoy component's ability to interfere with the attack observation path, its ability to maintain normal tasks, its ability to maintain safety for dangerous tasks, and its ability to absorb downstream representations can be balanced.

[0143] Optionally, constructing an anti-estimation loss based on the separability measure of the observation space includes: Based on the attack observation residuals of the dangerous request set at the target linear output layer, determine the first type mean and the first type inner covariance matrix; Based on the attack observation residuals of the harmless request set at the target linear output layer, determine the second type mean and the second type inner covariance matrix; Based on the difference between the first class means and the second class means, and the sum of the traces of the first class covariance matrix and the second class covariance matrix, a stable separability measure is determined; wherein, the stable separability measure is directly proportional to the norm of the difference and inversely proportional to the sum of the traces; The anti-estimation loss is constructed based on the stable separability metric.

[0144] In this application, the electronic device inputs all samples from the dangerous request set into the model to be trained, and extracts the attack observation residual corresponding to each sample at the target linear output layer to obtain a set of dangerous request attack observation residual vectors.

[0145] The electronic device calculates the mean of this set of vectors to obtain the first-class mean, denoted as μ_bad^l; and calculates the within-class covariance matrix of this set of vectors to obtain the first-class within-class covariance matrix, denoted as Σ_bad^l; where the superscript l represents the layer identifier of the target linear output layer. The within-class covariance matrix can be calculated using the sample covariance matrix method.

[0146] More specifically, all samples from the harmless request set are input into the model to be trained, and the attack observation residual corresponding to each sample is extracted at the target linear output layer to obtain a set of harmless request attack observation residual vectors.

[0147] The electronic device calculates the mean of the set of vectors to obtain the second-class mean, denoted as μ_good^l; and calculates the in-class covariance matrix of the set of vectors to obtain the second-class in-class covariance matrix, denoted as Σ_good^l.

[0148] The measure of stable separability is proportional to the norm of the differences and inversely proportional to the sum of the traces. Specifically, the electronic device first calculates the difference vector μ_bad^l-μ_good^l between the first-class mean μ_bad^l and the second-class mean μ_good^l, and then calculates the norm of this difference vector, such as the square of the L2 norm.

[0149] The electronic device further calculates the sum of the traces of the first type of internal covariance matrix Σ_bad^l and the second type of internal covariance matrix Σ_good^l, denoted as tr(Σ_bad^l+Σ_good^l).

[0150] The electronic device constructs a stable separability metric J_l for the l-th layer based on the above two quantities, which can be expressed as: J_l=‖μ_bad^l-μ_good^l‖ 2 / (tr(Σ_bad^l+Σ_good^l)+ε); Where μ_bad^l is the mean of the attack observation residual of dangerous request samples at the target linear output layer of layer l, μ_good^l is the mean of the attack observation residual of harmless request samples at the target linear output layer of layer l, Σ_bad^l and Σ_good^l are the corresponding intra-class covariance matrices, ε is a preset numerical stability term used to avoid numerical instability caused by zero or too small denominators, and tr(·) represents the trace operation of the matrix.

[0151] Electronic devices can directly use the stable separability metric J_l as the anti-estimation loss L_anti, or they can use J_l after a monotonic transformation as L_anti. In the case where the target linear output layer includes multiple linear projection layers of different layers, the anti-estimation loss can also be a weighted sum of the stable separability metrics of each layer, for example, L_anti=Σ_lω_l·J_l, where ω_l is the weight coefficient corresponding to the l-th layer.

[0152] During the optimization process, the electronic device minimizes the anti-estimation loss, which is equivalent to minimizing the stable separability metric J_l. That is, it simultaneously reduces the difference between inter-class means and increases the sum of within-class covariance traces, thereby reducing the quality of the attacker's estimation of the stable direction under limited sample conditions.

[0153] By implementing specific settings to counteract estimation loss in this embodiment, compared to a scheme that only minimizes the difference in mean between classes, this embodiment can more comprehensively reduce the separability of the two types of requests in the attack observation space, preventing attackers from restoring a stable direction by increasing the sample size or improving statistical robustness, thereby enhancing the ability to resist estimation attacks against white-box jailbreak attacks.

[0154] Optionally, the method further includes: During the joint iterative optimization process, at least one round of simulated attack operations are embedded in the model to be trained; wherein, the simulated attack operations include performing direction extraction and local parameter editing on the model to be trained; Obtain the amount of security performance degradation of the model to be trained after the simulated attack operation; The decrease in security performance is used as one of the reverse optimization signals and participates in the joint iterative optimization.

[0155] In one or more iterations of joint iterative optimization, the electronic device simulates the attack process of an attacker. First, it performs direction extraction. The electronic device samples a set of dangerous request samples and a set of harmless request samples from the training dataset, inputting them respectively into the model to be trained. At the target token location, it extracts the attack observation residuals corresponding to the two types of samples, and obtains the direction estimation result based on differential statistics (e.g., the inter-class mean difference μ_bad^l - μ_good^l). This direction estimation result simulates the attack direction estimated by the attacker under white-box conditions.

[0156] Next, local parameter editing is performed. Based on the orientation estimation results, the electronic device performs orientation parameter editing on the target linear output layer in the model to be trained.

[0157] For example, electronic devices can perform operations such as projection reduction or low-rank update on the weight matrix of the target linear output layer along the subspace corresponding to the direction estimation result. For example, projection reduction of the form W'=W-α·W·v·v^T can be performed on the weight matrix W along the estimation direction v to obtain a copy of the model to be trained after simulated attack editing, where α is the editing intensity coefficient.

[0158] Specifically, the electronic device evaluates the security performance of the model to be trained before the simulated attack and the security performance of the model copy to be trained after the simulated attack. Security performance can be evaluated using metrics such as rejection rate, accuracy of secure tasks, and rejection rate of risky tasks. The electronic device calculates the decrease between the two evaluations as the security performance degradation.

[0159] Specifically, electronic devices incorporate the degradation of security performance into the joint optimization objective loss as an additional loss item, or as a weighted adjustment signal for existing loss items.

[0160] During backpropagation, the electronic device guides the parameter update direction of the decoy's generation of bypass structures and absorption of recovery bypass structures by minimizing the security performance degradation, so that the trained model can better resist simulated attack operations.

[0161] This embodiment embeds simulated attack operations into the joint iterative optimization process, enabling the protection training target to be optimized directly against the real process of white-box model editing attacks. As a result, the large language model obtained has a stronger targeted protection capability against actual white-box jailbreak attacks.

[0162] In one alternative embodiment, Figure 2 This is a schematic diagram comparing the system architecture and underlying mechanism provided by the present invention, as shown below. Figure 2 As shown, Figure 2 The left side illustrates the attack mechanism of existing white-box jailbreak attacks. Figure 2 The right side of the diagram illustrates the endogenous defense mechanism provided by an embodiment of the present invention.

[0163] like Figure 2 As shown on the left, the attack flow of existing white-box jailbreak attacks includes: the attacker inputs harmful and harmless prompt samples into the large language model to be attacked, and extracts the hidden states corresponding to each transformation layer through forward propagation; performs differential dimensionality reduction analysis based on the differences between the two types of hidden states, and extracts vulnerable basis vectors representing the internal security constraints of the model through methods such as singular value decomposition; then performs projection reduction weight editing on the key linear projection modules in the model (such as the attention output projection layer o_proj) along the vulnerable basis vectors, so that the components in the original weight matrix along the direction of the vulnerable basis vector are eliminated or significantly weakened; finally, the security alignment constraints inside the large language model are physically erased, and the model no longer triggers the rejection behavior and outputs harmful content when faced with harmful prompts.

[0164] like Figure 2 As shown on the right, the processing flow of the endogenous defense mechanism provided by this embodiment of the invention includes: the large language model performs conventional layer-by-layer forward computation on the input request; when the layer-by-layer forward computation reaches the target linear output layer (e.g., the attention output projection layer o_proj), the electronic device triggers the generation of structured decoy components by internal control and injects them into the output of the target linear output layer to obtain the decoy-containing intermediate representation; the decoy-containing intermediate representation continues to feedforward to the subsequent computation layer (e.g., up_proj and / or gate_proj) on the input side of the same layer MLP, and the subsequent computation layer performs absorption processing on the decoy-containing intermediate representation, so that the contribution of the structured decoy components to the downstream representation is reversed and canceled out; thereby, the internal representation of the large language model is realigned to a state close to that before the injection of decoy components, so that the defense is effective and lossless.

[0165] It should be noted that, as Figure 2 As shown in the protective fog box on the right, when the attacker imitates... Figure 2 When the attack process on the left performs hidden layer difference capture and direction extraction on the large language model provided in this embodiment of the invention, since the structured decoy component has been injected into the output of the target linear output layer, the hidden layer map observed by the attacker is contaminated by the decoy component, causing the wrong direction extracted by the attacker to deviate from the true direction of the security decision actually carried by the large language model. The parameter editing implemented by the attacker based on the wrong direction naturally fails due to deviation from the original vulnerability.

[0166] Depend on Figure 2 As can be seen from the comparison on the left and right sides, the embodiments of the present invention actively inject structured decoy components into the target linear output layer that is the focus of the attacker's observation and editing, and perform cooperative absorption processing on the decoy components in the subsequent computation layer of the same layer. This causes the attack direction estimated by the attacker based on the contaminated hidden layer map to deviate from the true direction, and the physical failure of the orientation parameter editing. At the same time, the decoy components are effectively canceled before reaching the downstream inference path. Thus, without significantly impairing the general capabilities of the large language model, the model's inherent resistance to white-box jailbreak attacks is improved.

[0167] The safety protection device provided by the present invention is described below. The safety protection device described below can be referred to in correspondence with the safety protection method described above.

[0168] Figure 3 A schematic diagram of the safety protection device provided by the present invention is shown below. Figure 3 As shown, it includes: The generation module 310 is used to control the large language model to perform layer-by-layer forward computation based on the input request, and generate structured decoy components when the layer-by-layer forward computation reaches the target linear output layer; wherein, the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix; The superposition module 320 is used to superimpose the structured decoy component onto the output of the target linear output layer to obtain an intermediate representation containing the decoy; The absorption module 330 is used to perform absorption processing on the intermediate representation containing the decoy through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer; The output module 340 is used to continue performing layer-by-layer forward computation based on the absorbed representation, and output the response result corresponding to the input request.

[0169] In this application, by generating structured decoy components based on the current hidden state and under the constraint of a preset low-rank basis matrix at a preset linear projection layer on the residual path of the large language model, and superimposing them on the output of the target linear output layer, the intermediate representations observed by the attacker at the linear output layer are covered by structured and conditional perturbations. This causes the direction estimated by the attacker based on the differential statistics of harmful and harmless samples to deviate from the direction of the model's actual security decision, and physically disables the local low-rank editing performed on the target linear output layer based on this direction. At the same time, by using the subsequent computation layer located after the target linear output layer to perform absorption processing on the intermediate representations containing decoys, the contribution of the structured decoy components to the downstream representations after propagation through the subsequent computation layer is reduced. This avoids the continuous accumulation and pollution of the model's inference results along the forward path by the decoy components, so that the decoys maintain high visibility on the attacker's observation and editing path and low sensitivity on the model's actual task behavior path. Ultimately, without compromising the response quality of the large language model to normal requests, the resistance of the model to white-box jailbreak attacks is significantly improved.

[0170] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, communications interface 420, and memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a security protection method, which includes: controlling a large language model to perform layer-by-layer forward computation based on an input request, and generating structured decoy components when the layer-by-layer forward computation reaches the target linear output layer; wherein the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix; The structured decoy component is superimposed on the output of the target linear output layer to obtain an intermediate representation containing the decoy; The intermediate representation containing the decoy is subjected to absorption processing through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer. Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

[0171] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security protection methods provided by the above methods. The method includes: controlling a large language model to perform layer-by-layer forward computation based on an input request, and generating structured decoy components when the layer-by-layer forward computation reaches the target linear output layer; wherein the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix. The structured decoy component is superimposed on the output of the target linear output layer to obtain an intermediate representation containing the decoy; The intermediate representation containing the decoy is subjected to absorption processing through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer. Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

[0173] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the security protection methods provided by the above methods. The method includes: controlling a large language model to perform layer-by-layer forward computation based on an input request, and generating structured decoy components when the layer-by-layer forward computation reaches a target linear output layer; wherein the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix. The structured decoy component is superimposed on the output of the target linear output layer to obtain an intermediate representation containing the decoy; The intermediate representation containing the decoy is subjected to absorption processing through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer. Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security protection method, characterized in that, include: Based on the input request, the large language model is controlled to perform layer-by-layer forward computation, and when the layer-by-layer forward computation reaches the target linear output layer, a structured decoy component is generated; wherein, the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy component is generated based on the current hidden state at the target linear output layer and is constrained by a preset low-rank basis matrix; The structured decoy component is superimposed on the output of the target linear output layer to obtain an intermediate representation containing the decoy; The intermediate representation containing the decoy is subjected to absorption processing through the subsequent computation layer located after the target linear output layer in the large language model to obtain the absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer. Based on the absorbed representation, the large language model continues to perform layer-by-layer forward computation and outputs the response result corresponding to the input request.

2. The security protection method according to claim 1, characterized in that, The positional relationship between the target linear output layer and the subsequent computation layer satisfies any one of the following: The target linear output layer is the attention output projection layer of the target layer, and the subsequent computation layer is located in the same layer as the target layer; wherein, the subsequent computation layer includes at least one of an upper projection layer and a gated projection layer; The target linear output layer is a projection layer under the feedforward network of the target layer, and the successor computation layer is located in the layer below the target layer; wherein, the successor computation layer includes at least one of a query projection layer, a key projection layer, and a value projection layer.

3. The security protection method according to claim 1, characterized in that, The target linear output layer includes at least two linear projection layers located in different layers of the large language model; The successor computation layer includes at least two successor computation layers, each corresponding to one of the at least two linear projection layers; In this context, the decoy subspaces corresponding to the at least two linear projection layers are non-collinear with each other.

4. The security protection method according to claim 1, characterized in that, The generation of structured decoy components includes: Obtain the current hidden state at the target linear output layer, the context features corresponding to the input request, and the current lexical identifier; Based on the current hidden state, the context features, and the current lexical identifier, condition coefficients are determined using a preset condition coefficient generation function; wherein, the condition coefficient generation function is a deterministic mapping function. The structured decoy components are obtained by combining the condition coefficients with the preset low-rank basis matrix.

5. The safety protection method according to claim 4, characterized in that, The structured decoy components satisfy at least one of the following constraints: Low-rank constraint, which is used to confine the structured decoy component to a subspace with a dimension lower than a preset rank value; The hierarchical constraint is used to ensure that the decoy subspaces corresponding to different layers in the large language model are non-collinear. A constraint is imposed to ensure that the amplitude of the structured decoy component does not exceed a preset amplitude upper limit.

6. The security protection method according to claim 1, characterized in that, The intermediate characterization containing the decoy is subjected to an absorption process, including: The intermediate characterization containing the decoy is subjected to residual superposition and layer normalization to obtain the normalized intermediate state; At the subsequent computation layer, the normalized intermediate state is remapped to obtain the post-absorption representation. The remapping process includes at least one of the following methods: low-rank transformation, conditional gating, residual compensation, and bypass suppression.

7. The safety protection method according to claim 4, characterized in that, Before generating the structured decoy components, the method further includes: Obtain the risk score corresponding to the input request; Based on the risk score, perform at least one of the following modulation operations on the generation process of the structured decoy component: When the risk score is higher than a preset gating threshold, the generation of the structured decoy component is initiated; The condition coefficients in the structured decoy component are weighted and modulated; wherein, when the risk score corresponding to the first input request is greater than the risk score corresponding to the second input request, the weighted and modulated condition coefficient corresponding to the first input request is greater than the weighted and modulated condition coefficient corresponding to the second input request.

8. The security protection method according to claim 1, characterized in that, The method further includes: A decoy generation bypass structure is attached to the output path of the target linear output layer of the base model, and an absorption recovery bypass structure is attached to the computation path of the subsequent computation layer of the base model to obtain the model to be trained; wherein, the base model is the original large language model without the decoy generation bypass structure and the absorption recovery bypass structure attached; the decoy generation bypass structure carries the preset low-rank basis matrix and is used to generate the structured decoy components, and the absorption recovery bypass structure is used to perform the absorption processing; Construct a training dataset; wherein the training dataset includes a set of harmless requests and a set of dangerous requests; Based on the training dataset, forward computation is performed on the model to be trained, and the attack observation residuals corresponding to the harmless request set and the dangerous request set are extracted at the target word positions of the model to be trained, respectively, to obtain the observation space separability measurement result. Based on the observation space separability measurement results, a joint optimization target loss is constructed, and based on the joint optimization target loss, joint iterative optimization is performed on the parameters of the decoy generation bypass structure and the parameters of the absorption recovery bypass structure to obtain the trained decoy generation bypass structure and the trained absorption recovery bypass structure. Based on the aforementioned base model, the trained decoy generation bypass structure, and the trained absorption recovery bypass structure, the large language model is obtained. During the joint iterative optimization process, the core weights of the basic model remain unchanged.

9. The security protection method according to claim 8, characterized in that, The construction of the joint optimization objective loss based on the separability measure of the observation space includes: Based on the observed spatial separability metric, an anti-estimation loss is constructed; wherein, the anti-estimation loss is used to reduce the stable separability of the dangerous request set and the harmless request set at the target linear output layer; Based on the deviation between the output of the model to be trained and the output of the base model on the harmless request set, a capability retention loss is constructed. Based on the rejection behavior indicators of the model to be trained on the dangerous request set, a safety retention loss is constructed; Based on the impact of the structured decoy component on downstream characterization after processing by the absorption recovery bypass structure, a recovery loss is constructed. The joint optimization objective loss is obtained by performing a weighted fusion of the anti-estimation loss, the capability preservation loss, the safety preservation loss, and the recovery loss.

10. The security protection method according to claim 9, characterized in that, The construction of robust estimation loss based on the separability measure of the observation space includes: Based on the attack observation residuals of the dangerous request set at the target linear output layer, determine the first type mean and the first type inner covariance matrix; Based on the attack observation residuals of the harmless request set at the target linear output layer, determine the second type mean and the second type inner covariance matrix; Based on the difference between the first class means and the second class means, and the sum of the traces of the first class covariance matrix and the second class covariance matrix, a stable separability measure is determined; wherein, the stable separability measure is directly proportional to the norm of the difference and inversely proportional to the sum of the traces; The anti-estimation loss is constructed based on the stable separability metric.

11. The security protection method according to claim 8, characterized in that, The method further includes: During the joint iterative optimization process, at least one round of simulated attack operations are embedded in the model to be trained; wherein, the simulated attack operations include performing direction extraction and local parameter editing on the model to be trained; Obtain the amount of security performance degradation of the model to be trained after the simulated attack operation; The decrease in security performance is used as one of the reverse optimization signals and participates in the joint iterative optimization.

12. A safety protection device, characterized in that, include: The generation module is used to control the large language model to perform layer-by-layer forward computation based on the input request, and generate structured decoy components when the layer-by-layer forward computation reaches the target linear output layer; wherein, the target linear output layer is a preset linear projection layer located on the residual path in the large language model; the structured decoy components are generated based on the current hidden state at the target linear output layer and are constrained by a preset low-rank basis matrix; The overlay module is used to overlay the structured decoy component onto the output of the target linear output layer to obtain an intermediate representation containing the decoy. An absorption module is used to perform absorption processing on the intermediate representation containing the decoy through a subsequent computation layer located after the target linear output layer in the large language model to obtain an absorbed representation; wherein, the absorption processing is used to reduce the contribution of the structured decoy component to the downstream representation of the large language model after passing through the subsequent computation layer; The output module is used to perform layer-by-layer forward computation based on the absorbed representation, and output the response result corresponding to the input request.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the security protection method as described in any one of claims 1 to 11.

14. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the security protection method as described in any one of claims 1 to 11.

Images