An application construction system and method based on a large language model

Abstract

The application discloses a kind of application construction system and method based on large language model, belong to large language model application construction technical field, by constructing scene semantic association model, similar semantics but the field pair of different execution consequences, instruction pair and tool pair are identified, semantic conflict boundary set is generated, and path level constraint graph and permission sandbox model are constructed based on the semantic conflict boundary set;Further through counterfactual disturbance generates multiple branch verification set, calculates semantic boundary locking coefficient, parameter landing point offset and authorized closed loop completeness, locates risk trigger node, and carries out reverse correction to path constraint and isolation boundary;Through the above technical scheme, high-risk execution action can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, so as to improve the security, stability and controllability of large language model application.

Description

Technical Field

[0001] This invention relates to the field of large language model application construction technology, specifically to an application construction system and method based on a large language model. Background Technology

[0002] Existing large language models are typically constructed using a combination of prompt words, knowledge bases, and toolchains in low-probability, niche scenarios such as financial follow-up registration, hospital re-examination registration, and correction of abnormal government documents. However, when users use abbreviations, pronouns, correction statements, or omissions in cross-turn dialogues, the application is prone to hidden coupling between field inheritance, tool routing, and permission judgment. This can lead to mis-calling issues with "low semantic bias and high execution risk" only in rare branches. For example, "correction on behalf of" may be misjudged as "submitted by the person himself" and trigger irreversible writing. Existing technologies focus more on answer generation optimization and lack construction-stage delimitation, isolation, and verification mechanisms for such fine-grained execution risks. Summary of the Invention

[0003] The purpose of this invention is to provide an application construction system and method based on a large language model to address the shortcomings of the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: an application construction method based on a large language model, comprising: Acquire business corpus, tool descriptions, field rules, and permission rules in the target application scenario; extract the relationships between user intent, field semantics, tool actions, and permission conditions; and construct a scenario semantic association model G. Based on G, identify field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences, and generate a semantic conflict boundary set B to represent confusing boundaries; Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, construct a path-level constraint graph R; Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established; Based on the counterfactual perturbation samples injected by B into W, including abbreviation replacement, reference inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated; Using A to drive W, the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ of each branch are calculated respectively, and the risk triggering node Q is determined based on the joint mismatch results of η, β, and γ. Based on the reverse correction of path constraints in R and isolation boundaries in W according to Q, high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and the output target is the large language model application.

[0005] Preferably, constructing a scene semantic association model G includes the following steps: Obtain business corpus, tool description text, field rule text, and permission rule text from the target application scenario, and perform hierarchical segmentation on the business corpus, tool description text, field rule text, and permission rule text to obtain a set of semantic fragments; Perform terminology normalization, role labeling, and action labeling on the semantic fragment set, and extract user intent items, field semantic items, tool action items, and permission condition items to form a multi-class semantic tuple set; Based on the set of multiple semantic tuples, a directed association edge is established between user intent items and field semantic items, tool action items and permission condition items by adopting cross-sentence reference backfilling and rule trigger chain tracing methods, thus obtaining an initial association network; The initial association network is subjected to conflict boundary weighting and path closure correction to generate a scene semantic association model G that includes semantic triggering relationships, parameter passing relationships, and permission dependency relationships.

[0006] Preferably, the method of identifying semantically similar but differently executed field pairs, instruction pairs, and tool pairs based on G includes the following steps: Candidate association pairs of shared field semantic items, shared trigger paths, and shared permission entry points are extracted from the scene semantic association model to form candidate field pairs, candidate instruction pairs, and candidate tool pairs; Semantic adjacency calculation and execution consequence difference calculation are performed on candidate field pairs, candidate instruction pairs, and candidate tool pairs respectively, and conflict candidate pairs with semantic adjacency higher than the semantic adjacency threshold and execution consequence difference higher than the execution consequence difference threshold are filtered out. Based on the bifurcation positions of conflict candidate pairs in parameter passing relationships, permission dependency relationships, and tool invocation results, mark the corresponding boundary trigger points and boundary blocking points, and generate a boundary feature chain; Based on the boundary feature chain, the conflict candidate pairs are aggregated and encoded to form the semantic conflict boundary set B.

[0007] Preferably, the field delivery path and tool call path associated with high-risk actions are filtered according to B, including the following steps: Extract boundary units with boundary risk values ​​higher than the boundary risk value threshold from the semantic conflict boundary set, and locate the candidate field transmission path and candidate tool call path associated with high-risk execution actions based on the boundary trigger point, boundary blocking point and applicable tool range corresponding to each boundary unit; Path traversal analysis and node dependency backtracking are performed on the candidate field transmission paths and candidate tool call paths respectively to identify field nodes, permission nodes and tool nodes in each path and generate a path constraint skeleton chain. Based on the path constraint skeleton chain, establish the sequential constraint relationship, mutual exclusion constraint relationship and prerequisite satisfaction relationship between field nodes, permission nodes and tool nodes to form an initial path-level constraint graph. Boundary blocking point closure correction and abnormal cross-edge removal are performed on the initial path-level constraint graph to obtain a path-level constraint graph R used to limit the triggering range of high-risk execution actions.

[0008] Preferably, a three-layer mutually isolated permission sandbox model W is established, including the following steps: Based on the sequential constraints, mutual exclusion constraints, and prerequisite satisfaction relationships corresponding to high-risk execution actions in the path-level constraint diagram, the semantic triggering nodes located at the beginning of the path, the field passing nodes located in the middle of the path, and the permission verification nodes located at the end of the path are extracted and mapped to the semantic judgment layer, parameter mapping layer, and execution authorization layer, respectively. Based on the semantic determination layer, parameter mapping layer, and execution authorization layer, independent input boundaries, independent output boundaries, and cross-layer transfer whitelists are defined respectively, forming a unidirectional restricted data transfer relationship between layers; The inter-layer unidirectional restricted data transmission relationship is subjected to blocking point injection and mutual exclusion path closure processing, so that the semantic judgment layer only outputs judgment labels, the parameter mapping layer only receives judgment labels and generates target parameter sets, and the execution authorization layer only generates execution permission results based on the target parameter sets and permission conditions. Based on the three-layer node relationship after blocking point injection and mutual exclusion path closure, a three-layer mutually isolated permission sandbox model W is constructed to limit the triggering conditions of high-risk execution actions.

[0009] Preferably, the method for obtaining the semantic boundary locking coefficient η includes the following steps: Based on the decision label sequence, field node sequence and permission node sequence corresponding to each branch in the multi-branch verification set, a branch hyperbolic semantic trajectory is constructed, and the target hyperbolic boundary trajectory is generated according to the center path of each boundary unit in the semantic conflict boundary set. The branch hyperbolic semantic trajectory and the target hyperbolic boundary trajectory are mapped to a preset hyperbolic manifold space, the hyperbolic geodesic distance between them is calculated, and the hyperbolic boundary drift is obtained by combining the curvature offset value of the branch trajectory in the neighborhood of the boundary trigger point. The hyperbolic boundary drift is normalized by performing interval normalization to obtain the normalized hyperbolic boundary drift. The semantic boundary locking coefficient η of each branch is calculated based on the fact that the semantic boundary locking coefficient is equal to 1 minus the normalized hyperbolic boundary drift.

[0010] Preferably, determining the risk trigger node Q based on the joint mismatch results of η, β, and γ includes the following steps: Obtain the semantic boundary locking coefficient, parameter landing point offset, and authorization loop integrity corresponding to each branch, and construct a joint feature sequence consistent with the node order in the path-level constraint graph; Based on the joint feature sequence, the mismatch propagation value and mismatch aggregation value of each node are calculated, and candidate abnormal nodes that simultaneously meet the following conditions are selected: the semantic boundary locking coefficient is lower than the first threshold, the parameter landing point offset is higher than the second threshold, or the authorized closed loop integrity is lower than the third threshold. Perform forward path penetration analysis and backward causal backtracking analysis on the candidate abnormal nodes to identify the key fork nodes where the joint mismatch is first formed and can be propagated to high-risk execution actions; The critical fork node is marked as risk trigger node Q.

[0011] Preferably, the reverse correction of path constraints in R and isolation boundaries in W based on Q includes the following steps: Based on the hierarchical position of the risk triggering node in the path-level constraint graph, the mismatch propagation value, and the mismatch aggregation value, the corresponding abnormal propagation edge, abnormal cross-layer edge, and missing blocking edge are located, and a reverse correction index chain is generated. Based on the reverse correction index chain, sequential constraint reinforcement, mutual exclusion constraint rewriting, and pre-satisfied edge insertion are performed on the path-level constraint graph to obtain the corrected path-level constraint graph. Based on the modified path-level constraint graph, the permission sandbox model is subjected to isolation boundary shrinkage, cross-layer whitelist pruning, and blocking point relocation processing to form a modified permission sandbox model. The operation of the modified permission sandbox model is re-driven by a multi-branch verification set. When a high-risk execution action is executed, the target large language model application is output only when the semantic judgment result, the target parameter set, and the execution permission result all meet the preset consistency conditions.

[0012] This invention also provides an application building system based on a large language model, comprising: Semantic modeling module: Acquire business corpus, tool descriptions, field rules and permission rules in the target application scenario, extract the relationship between user intent, field semantics, tool actions and permission conditions, and construct a scenario semantic association model G; Boundary identification module: Based on G, identify field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences, and generate a semantic conflict boundary set B to represent confusing boundaries; Path constraint construction module: Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, construct a path-level constraint graph R; Permission Sandbox Construction Module: Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established; Perturbation generation module: Based on B injecting counterfactual perturbation samples into W, such as abbreviation replacement, reference inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated; Mismatch detection module: A drives W to run, calculates the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ for each branch, and determines the risk trigger node Q based on the joint mismatch results of η, β, and γ; Constraint Correction and Application Generation Module: Based on Q, reverse correct the path constraints in R and the isolation boundaries in W until high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and output the target large language model application.

[0013] The technical effects and advantages provided by the present invention in the above technical solution are as follows: 1. This invention constructs a scene semantic association model, a semantic conflict boundary set, and a path-level constraint graph. This allows for a structured and unified expression of the scattered prompt word configurations, tool invocation rules, and permission control rules in traditional large language model application construction. Furthermore, it establishes a permission sandbox model through a layered isolation approach involving a semantic judgment layer, a parameter mapping layer, and an execution authorization layer. This enables explicit modeling and constraint of semantic confusion boundaries and high-risk execution paths during the construction phase. Compared to existing technologies that rely solely on prompt word optimization or runtime verification, this invention can identify potential conflict paths with similar semantics but different execution consequences before application generation. Through path-level constraints, it achieves end-to-end limitation on field transmission, tool invocation, and permission dependencies, effectively avoiding hidden mis-invocation problems caused by cross-round referencing, abbreviation replacement, or changes in expression order. This significantly improves the semantic stability and execution determinism of large language model applications in complex scenarios.

[0014] 2. This invention constructs a multi-branch verification set and introduces three types of feature parameters: semantic boundary locking coefficient, parameter landing point offset, and authorization loop integrity. It performs counterfactual perturbation verification on the permission sandbox model and locates risk triggering nodes based on joint mismatch results. This allows for reverse correction of the path-level constraint graph and isolation boundaries, achieving closed-loop optimization of the construction process. This technical solution can expose high-risk execution paths in rare and exhaustive boundary scenarios and eliminate potential vulnerabilities through an automated correction mechanism. High-risk execution actions are only triggered when semantic judgment, parameter mapping, and execution authorization simultaneously meet the conditions, significantly reducing the probability of accidental writes, unauthorized calls, and irreversible operations. This improves the security, controllability, and engineering feasibility of large language models applied in real-world business systems. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0016] Figure 1 This is a flowchart of the method of the present invention.

[0017] Figure 2 This is a flowchart of the system modules of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1, please refer to Figure 1 As shown in this embodiment, an application construction method based on a large language model includes: Obtain business corpus, tool descriptions, field rules, and permission rules for the target application scenario, extract the relationships between user intent, field semantics, tool actions, and permission conditions, and construct a scenario semantic association model G.

[0020] In this embodiment, the business corpus, tool description text, field rule text, and permission rule text of the target application scenario are first obtained. The business corpus consists of 12,684 anonymized dialogue records from the hospital's online outpatient system over the past six months, including patient-initiated dialogues, customer service supplementary inquiries, system form backfill records, and manual correction records. The tool description text includes interface descriptions for seven types of business tools: identity verification tools, follow-up appointment tools, examination result supplementation tools, contact information update tools, patient switching tools, authorization relationship verification tools, and medical record writing tools, totaling 41 interface documents. The field rule text includes field names, field types, nullable constraints, inheritance constraints, overriding constraints, and mutual exclusion relationships, totaling 183 rules. The permission rule text includes conditions for self-processing, conditions for guardian-assisted processing, conditions for authorization relationship establishment, doctor assistant writeable range, and secondary verification rules for high-risk fields, totaling 96 rules.

[0021] After obtaining the above data, the business corpus, tool description text, field rule text, and permission rule text were segmented hierarchically to obtain a set of semantic fragments. Specifically, the business corpus was segmented into three levels: "conversation level - round level - sentence element level"; the tool description text was segmented into five categories: "tool name - input parameters - preconditions - execution result - error code"; the field rule text was segmented into "field definition - field source - field constraint"; and the permission rule text was segmented into "role - condition - allowed action - prohibited action". After segmentation, 89,216 semantic fragments were obtained from the business corpus, 1,327 from the tool description text, 614 from the field rule text, and 403 from the permission rule text, which were then merged to form a set of semantic fragments. To avoid subsequent ambiguity, this embodiment standardizes the time expressions, personnel titles, patient titles, and business action titles in the semantic fragment set. For example, "my dad," "father," and "elderly person" are uniformly mapped to candidate patient title categories, and "add the examination form," "add the test results," and "transfer the report" are uniformly mapped to the candidate set of examination result supplementation actions.

[0022] After obtaining the semantic fragment set, terminology normalization, role labeling, and action labeling are performed on the semantic fragment set to extract user intent items, field semantic items, tool action items, and permission condition items, forming a multi-class semantic tuple set. Specifically, terminology normalization is performed using a "domain dictionary matching + adjacent round correction rule" approach. The domain dictionary pre-contains 836 hospital follow-up visit-specific terms and 32 correction rules. Role labeling is used to identify the speaker and involved objects in the current semantic fragment. Role labels include at least the patient, family representative, triage nurse, doctor's assistant, and system confirmation item. Action labeling is used to identify the business action corresponding to the current semantic fragment. Action labels include at least initiating a follow-up visit appointment, canceling a follow-up visit appointment, supplementing examination results, updating contact information, switching patients, and writing medical record fields. Through the above processing, 21,564 user intent items, 17,893 field semantic items, 9,042 tool action items, and 4,867 permission condition items are extracted from the semantic fragment set and formed into a multi-class semantic tuple set according to a unified structure. In the aforementioned collection of semantic tuples, each tuple contains a fragment identifier, source text type, standard terminology, role label, action label, time location, and confidence value. For example, in the dialogue "Help my dad get yesterday's blood test results, not for registration," the following can be extracted: user intent item "to process supplementary test results," field semantic items "patient identifier," "report date," and "report type," tool action item "test result supplementation tool," and permission condition item "a guardianship or authorization relationship must exist."

[0023] After obtaining a set of multiple semantic tuples, a directed association edge is established between user intent items and field semantic items, tool action items, and permission condition items using cross-sentence reference backfilling and rule trigger chain tracing methods, resulting in an initial association network. Specifically, cross-sentence reference backfilling is used to solve the association breakage problem caused by subject omission, object replacement, and correction interruptions in cross-round expressions. This embodiment sets three types of backfilling rules: the first type is the patient object backfilling rule, when the current round contains pronouns such as "he," "elderly," or "that report," the field semantic items that have appeared most recently in the previous two rounds and satisfy role consistency are retrieved first; the second type is the action correction rule, when the current round contains correction trigger words such as "not... but...", "change to...", or "I just said it wrong," the candidate tool action item that was not completed in the previous round is discarded, and the new user intent item is marked as high priority; the third type is the time inheritance rule, when the current round does not give a date but the previous round has clearly stated a time expression such as "yesterday" or "last Friday," the corresponding time field is backfilled into the current field semantic item. Rule trigger chain tracing is used to recover the execution path from the field rule text and permission rule text. For example, if the user intent item is "to supplement the examination result on behalf of someone else", then according to the rule trigger chain, it sequentially associates "patient identifier field semantic item - authorization relationship verification tool action item - examination result supplementation tool action item - medical record writing tool action item - self-processing or guardianship authorization permission condition item". An initial association network is constructed in this way. The nodes in the initial association network include user intent item nodes, field semantic item nodes, tool action item nodes, and permission condition item nodes, and the edge types include semantic trigger edges, parameter passing edges, pre-verification edges, and permission dependency edges. In this embodiment, the initial association network contains a total of 53,366 nodes and 147,208 edges.

[0024] After obtaining the initial association network, conflict boundary weighting and path closure correction are applied to the initial association network to generate a scenario semantic association model that includes semantic triggering relationships, parameter passing relationships, and permission dependency relationships. Specifically, conflict boundary weighting is used to handle node relationships that are "semantically similar but have different execution consequences." For example, "record examination results" and "initiate follow-up appointment" may both contain neighboring words such as "tomorrow," "follow-up appointment," and "report" in some business corpora, but their tool action items and permission conditions are significantly different. Therefore, a conflict boundary weight is set between the two. As another example, "submit by myself" and "submit on behalf of someone else" may both involve semantic items in the patient identification field. However, in the permission rule text, the former can directly call the medical record writing tool, while the latter must first meet the authorization relationship verification conditions. Therefore, a conflict boundary weight is also set for them. In the specific implementation, for any two user intent item nodes, the conflict boundary weight is calculated based on the proportion of shared field semantic items, the proportion of shared tool action items, the difference in permission conditions, and the frequency of historical misjudgments. When the conflict boundary weight is greater than a preset threshold of 0.62, the two are marked as a strong conflict pair, and isolation constraints are added to their outgoing edges. Path closure correction is used to correct broken links and skipping levels in the initial association network. For example, if there is a direct association of "user intent item → medical record writing tool action item" in a certain path, but the "authorization relationship verification tool action item" or the corresponding permission condition item is missing, then the path is considered not closed, and intermediate nodes and edge relationships need to be supplemented according to the field rule text and permission rule text. If it is found that the parameter passing edge directly passes the "agent identifier field semantic item" to the "patient identifier field semantic item", then the parameter passing edge is removed according to the field source constraint and an explicit verification node is added. After conflict boundary weighting and path closure correction, the final scene semantic association model G is generated.

[0025] Based on G, which identifies semantically similar field pairs, instruction pairs, and tool pairs that have different execution consequences, a semantic conflict boundary set B is generated to represent confusing boundaries.

[0026] In this embodiment, the semantic conflict boundary set is constructed using an existing scene semantic association model. The scene semantic association model consists of a node set and an association edge set. The node set includes at least user intent item nodes, field semantic item nodes, tool action item nodes, and permission condition item nodes; the association edge set includes at least semantic trigger edges, parameter passing edges, and permission dependency edges. Each node has a node type, standard terminology, source location, context identifier, and risk weight; each association edge has an edge type, direction, confidence level, and path level. The scene semantic association model can be stored using a directed graph data structure, specifically represented as a set of triples: "starting node—association type—target node," with numerical attributes appended to each triple to support subsequent calculations.

[0027] Candidate association pairs of shared field semantic items, shared trigger paths, and shared permission entry points are extracted from the scene semantic association model to form candidate field pairs, candidate instruction pairs, and candidate tool pairs. In specific implementation, all field semantic item nodes, all user intent item nodes, and all tool action item nodes are first extracted from the scene semantic association model, and then paired to form an initial pairing set. For any two field semantic item nodes, if they are both connected to the same user intent item node in the scene semantic association model, or if they can both reach the same tool action item node through parameter passing edges, then they are marked as a candidate field pair. For any two user intent item nodes, if they both point to the same field semantic item node, or if they can both reach the same tool action item node along semantic trigger edges, then they are marked as a candidate instruction pair. For any two tool action item nodes, if they have the same input field semantic item, the same permission condition item, or are triggered by the same user expression in historical business corpus, then they are marked as a candidate tool pair. To avoid excessively large pairings, this embodiment sets the minimum number of sharing conditions to 2. That is, only when two nodes satisfy at least two of the three conditions—"shared field semantic items, shared trigger paths, and shared permission entry points"—will they enter the candidate association pair set. This process eliminates a large number of irrelevant node combinations, retaining only candidate field pairs, candidate instruction pairs, and candidate tool pairs with genuine potential for confusion, thus providing the input basis for the next step.

[0028] Semantic adjacency and execution consequence difference are calculated for candidate field pairs, candidate instruction pairs, and candidate tool pairs, respectively. Conflicting candidate pairs with both semantic adjacency and execution consequence difference exceeding a preset threshold are filtered out. Semantic adjacency characterizes the closeness of two candidate objects at the semantic expression level, while execution consequence difference characterizes the difference between two candidate objects at the actual business execution level. Both are defined using a computable method.

[0029] The semantic adjacency calculation process is as follows: First, a semantic feature vector is constructed for each field semantic item node, user intent item node, and tool action item node. The semantic feature vector is obtained by concatenating three parts. The first part is the standard term vector, which is mapped to a 128-dimensional real number vector using a pre-trained Chinese domain semantic representation model; the second part is the context co-occurrence vector, which is constructed as a 20-dimensional statistical vector based on the top 20 terms that co-occur most frequently with the node in the business corpus; the third part is the path semantic vector, which is constructed as a 16-dimensional structural vector based on the node type distribution that the node can reach two layers forward and two layers backward in the scene semantic association model. Finally, each node forms a 164-dimensional semantic feature vector. For any candidate association pair, its semantic adjacency is calculated using the cosine similarity function, defined as: Semantic adjacency = dot product of the two semantic feature vectors ÷ product of the magnitudes of the two semantic feature vectors.

[0030] In this embodiment, the semantic adjacency threshold is set to 0.78. This threshold is determined by manually labeling 300 pairs of "semantically similar" and 300 pairs of "semantically dissimilar" samples from historical business corpora, calculating the semantic adjacency of each pair, and then taking the boundary value that maximizes the distinguishability between the two types of samples as the preset threshold.

[0031] The calculation process for the execution consequence difference is as follows: First, define the execution consequence feature vector. The execution consequence feature vector consists of four parts: tool call result, field writing target, permission condition level, and reversibility flag. The tool call result uses one-hot encoding to represent the tool action item category; the field writing target uses field semantic item identifier encoding to represent the final writing position; the permission condition level uses integer values ​​to represent the required permission depth, where direct submission by the user is recorded as 1, submission after authorization relationship verification is recorded as 2, and submission after manual review is recorded as 3; the reversibility flag is used to indicate whether the action will produce an irreversible result, with reversible recorded as 0 and irreversible recorded as 1. Based on the above features, the execution consequence difference between any two candidate association pairs is calculated using a weighted distance function, defined as: Execution consequence difference = 0.35 × tool call result difference value + 0.30 × field writing target difference value + 0.20 × permission condition level difference value + 0.15 × reversibility difference value. In this embodiment, the differences in tool call results, field writing targets, and reversibility are obtained by marking dissimilarity as 1 and similarity as 0. The differences in permission condition levels are normalized by dividing the absolute value of the difference between the two levels by the maximum level number, 3. In this embodiment, the execution consequence difference threshold is set to 0.55. Only when a candidate field pair, candidate instruction pair, or candidate tool pair simultaneously satisfies a semantic adjacency greater than or equal to 0.78 and an execution consequence difference greater than or equal to 0.55 is it retained as a conflict candidate pair. Through this dual-threshold screening, it can be ensured that the retained objects simultaneously meet the two conditions of "easily confused in expression" and "significantly different execution consequences," thus effectively distinguishing them from ordinary synonym substitution relationships.

[0032] Based on the bifurcation positions of conflict candidate pairs in parameter passing relationships, permission dependencies, and tool invocation results, corresponding boundary trigger points and boundary blocking points are marked, generating boundary feature chains. The core of this step is to identify the key node positions where conflict candidate pairs transform from "semantic similarity" to "execution differentiation." In specific implementation, for each conflict candidate pair, two optimal execution paths corresponding to that conflict candidate pair are extracted from the scene semantic association model. The optimal execution path refers to the directed path with the highest confidence, starting from the user intent item node, passing through the field semantic item node and the permission condition item node, and finally reaching the tool action item node. Subsequently, the two optimal execution paths are compared layer by layer, including the field semantic items, parameter passing edges, permission dependency edges, and the final tool action item in the path. The position where the first difference appears is defined as the boundary trigger point, that is, the starting position where the user expression enters the confusion boundary and may cause differentiation; the position where the first occurrence requires additional constraints to restore the correct path is defined as the boundary blocking point, that is, the necessary control position to prevent the continued propagation of erroneous execution.

[0033] For example, in a hospital follow-up visit registration scenario, the conflict candidate instruction pair "Record Supplement Examination Results" and "Initiate Follow-up Visit Appointment" may have completely identical paths before the semantic item "Report Date" field, but are subsequently connected to "Examination Result Supplement Tool Action Item" and "Follow-up Visit Appointment Tool Action Item" respectively. In this case, the location of "Report Type Identification Result" can be marked as a boundary trigger point. If one path requires passing through the permission condition item "Authorization Relationship Established," while the other path does not, the location of "Authorization Relationship Established" can be marked as a boundary blocking point. Based on the boundary trigger points and boundary blocking points corresponding to a conflict candidate pair, the node type, node identifier, edge type, fork direction, confidence difference, and risk level are recorded in path order to form a boundary feature chain. The boundary feature chain is not a simple text label, but a structured chain data with sequential relationships and numerical attributes. Its purpose is to preserve the formation process and control position of the conflict boundary.

[0034] The conflict candidate pairs are aggregated and encoded based on the boundary feature chains to form a semantic conflict boundary set representing confusing boundaries. Specifically, each boundary feature chain is first encoded with a fixed length. The encoded content includes at least the conflict candidate pair type, semantic adjacency value, execution consequence difference value, boundary trigger point location code, boundary blocking point location code, path hierarchy length, and risk level sequence. The conflict candidate pair type uses three types of encoding, corresponding to candidate field pairs, candidate instruction pairs, and candidate tool pairs, respectively. The boundary trigger point location code and boundary blocking point location code are represented by a combination of "node type number + path hierarchy number." The risk level sequence is arranged from front to back according to the risk weight of each differing node on the path. Subsequently, the encoded boundary feature chains are clustered and merged according to the conflict candidate pair type, boundary trigger point node type, and boundary blocking point node type. The clustering method uses a hierarchical clustering algorithm, and the distance function is a weighted Euclidean distance function with weights of 0.30 for semantic adjacency, 0.35 for execution consequence difference, 0.20 for boundary trigger point similarity, and 0.15 for boundary blocking point similarity. When the clustering distance between two boundary feature chains is less than 0.25, they are merged into the same semantic conflict boundary cluster. Each semantic conflict boundary cluster corresponds to a boundary unit in the semantic conflict boundary set, and each boundary unit is assigned a unique boundary identifier, boundary type, applicable field range, applicable instruction range, applicable tool range, and boundary risk value. The boundary risk value is obtained by weighting the average execution consequence difference of all boundary feature chains in the boundary unit with the historical misjudgment frequency, and is used for subsequent path-level constraint graph construction and high-risk action identification.

[0035] Through the above steps, the resulting semantic conflict boundary set does not perform a general classification of similar expressions, but rather provides a structured representation of objects that are "semantically similar, have distinct execution consequences, and have clear forking points in specific paths." This semantic conflict boundary set can precisely identify which field pairs, instruction pairs, and tool pairs belong to highly obfuscated objects, where the obfuscation occurs, and where constraints must be applied to prevent erroneous execution. Therefore, it can provide direct input for subsequent screening of field transmission paths and tool invocation paths for high-risk execution actions.

[0036] Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, a path-level constraint graph R is constructed.

[0037] In this embodiment, the input for constructing the path-level constraint graph is a semantic conflict boundary set. This semantic conflict boundary set consists of multiple boundary units, each of which includes at least a unique boundary identifier, boundary type, applicable field range, applicable instruction range, applicable tool range, boundary trigger point, boundary blocking point, and boundary risk value. The boundary risk value is a real number between 0 and 1, representing the degree of risk of a boundary unit triggering erroneous execution in historical business corpora. In this embodiment, the boundary risk value is calculated as follows: First, the average difference in execution consequences for the conflict candidate pairs corresponding to the boundary unit is calculated; second, the frequency of false triggers for the boundary unit in historical desensitized business corpora is calculated, and the false trigger frequency is divided by the total number of relevant samples to obtain the false trigger ratio; finally, the final value is obtained according to the formula: "Boundary Risk Value = 0.60 × Average Difference in Execution Consequences + 0.40 × False Trigger Ratio". This calculation method is used because the difference in execution consequences reflects the severity of erroneous execution, and the false trigger ratio reflects the probability of erroneous execution; both together determine the strength of the boundary unit's influence on high-risk execution actions.

[0038] Boundary units with boundary risk values ​​exceeding a preset threshold are extracted from the semantic conflict boundary set. Based on the boundary trigger point, boundary blocking point, and applicable tool range corresponding to each boundary unit, candidate field transmission paths and candidate tool invocation paths associated with high-risk actions are located. In practice, all boundary units in the semantic conflict boundary set are traversed, and the boundary risk value of each boundary unit is read. In this embodiment, the boundary risk value threshold is set to 0.58. This threshold is determined as follows: 600 manually verified high-risk error samples and 600 low-risk samples are selected from historical business corpora, mapped to their corresponding boundary units, and the boundary risk value is calculated. The threshold is then chosen as the position that achieves a better balance between the recall rate of high-risk sample identification and the false recognition rate of low-risk sample identification. Any boundary unit with a boundary risk value greater than or equal to 0.58 is considered a high-risk boundary unit.

[0039] After identifying high-risk boundary units, relevant paths are backtracked and located in the scene semantic association model based on the boundary trigger point, boundary blocking point, and applicable tool scope of each high-risk boundary unit. Specifically, starting from the node corresponding to the boundary trigger point and ending at the tool action item node within the applicable tool scope, all directed paths satisfying directional consistency are searched in the scene semantic association model. Then, using the node corresponding to the boundary blocking point as the constraint check position, it is determined whether the above directed paths pass through a valid blocking position. If a path can reach the tool action item node corresponding to a high-risk execution action from the boundary trigger point, and involves continuous parameter passing between field semantic item nodes during the arrival process, then this path is recorded as a candidate field passing path; if a path mainly involves multiple tool action item nodes connected sequentially according to their call order, then this path is recorded as a candidate tool call path. Here, high-risk execution actions refer to tool action items that could cause irreversible field writing, unauthorized submission, external business status changes, or high-privilege data overwriting. For example, in a hospital follow-up registration scenario, "medical record writing" is a high-risk execution action; in a government affairs supplementary registration scenario, "formally submitting a correction application" is a high-risk execution action. Through the above processing, the risk boundaries of the semantic conflict boundary set can be specifically projected onto the actual business execution path, and the candidate field transmission path and candidate tool call path that are truly related to the high-risk execution action can be obtained.

[0040] Path traversal analysis and node dependency backtracking are performed on candidate field propagation paths and candidate tool call paths to identify necessary field nodes, necessary permission nodes, and necessary tool nodes in each path, generating a path constraint skeleton chain. The purpose of this step is to extract the essential core node sequence from a large number of candidate paths, providing the backbone structure for the subsequent construction of the path-level constraint graph.

[0041] Path traversal analysis involves scanning the node sequence of a candidate path layer by layer to identify whether the path completely traverses the semantic conflict boundary and enters the high-risk execution action area. In practice, for each candidate field transmission path and candidate tool call path, nodes are arranged in hierarchical order, and the node type, node identifier, inbound edge type, and outbound edge type of each layer are recorded. Then, the path is checked to see if it simultaneously meets the following three conditions: 1. The path contains at least one boundary trigger point; 2. The path endpoint is a tool action item node corresponding to a high-risk execution action; 3. The path contains at least one permission condition item node or field semantic item node as an intermediate control node. If all three conditions are met, the path is considered a valid traversal path. If not, it is removed from the candidate path set because although the path is related to the high-risk boundary, it is insufficient to directly support the arrival of the high-risk execution action.

[0042] Node dependency backtracking, based on a valid traversal path, traces back to identify which nodes are prerequisites for subsequent nodes. Specifically, it starts with the tool action node corresponding to a high-risk action and traverses backward along the path. If the entry condition of the current node is explicitly stated as "must exist" or "must be satisfied" in the field rule text, permission rule text, or tool description text, then the preceding node of that current node is marked as a necessary node. Necessary nodes are divided into three categories: The first category is necessary field nodes, which are nodes where a valid parameter input cannot be formed without the semantic item node, such as "patient identifier," "report date," and "report type." The second category is necessary permission nodes, which are nodes where a valid authorization determination cannot be made without the permission condition node, such as "personal processing established," "authorization relationship established," and "manual review passed." The third category is necessary tool nodes, which are nodes where path verification or state transition cannot be completed without the tool action node, such as "identity verification tool action" and "authorization relationship verification tool action." After completing the node dependency backtracking, the necessary field nodes, necessary permission nodes, and necessary tool nodes in each valid traversal path are concatenated in the original path order to form a path constraint skeleton chain. The path constraint skeleton chain is an ordered chain structure, where each node is accompanied by a node type, node level, and necessity source. The necessity source indicates whether the node is identified as a necessary node based on field rule text, permission rule text, or tool description text.

[0043] Based on the path constraint skeleton chain, establish the sequence constraints, mutual exclusion constraints, and prerequisite satisfaction relationships between field nodes, permission nodes, and tool nodes to form an initial path-level constraint graph. This step is used to expand the linear path constraint skeleton chain into a graph structure representation with multiple constraint relationships.

[0044] In this embodiment, the path-level constraint graph is represented by a directed attribute graph structure. The nodes in the graph include only three types: field nodes, permission nodes, and tool nodes. Field nodes correspond to field semantic item nodes, permission nodes correspond to permission condition item nodes, and tool nodes correspond to tool action item nodes. The edges in the graph are divided into three types: sequential constraint edges, mutually exclusive constraint edges, and prerequisite satisfaction edges. Sequential constraint edges indicate that the preceding node must be satisfied or executed before the following node; mutually exclusive constraint edges indicate that two nodes cannot appear simultaneously in the same legal execution path; prerequisite satisfaction edges indicate that the validity of the following node is a necessary condition for the validity of the current node.

[0045] In the specific construction process, each path constraint skeleton chain is traversed first. For two adjacent nodes in the chain, if the input of the latter node depends on the output of the former node, an order constraint edge is added between them; if two nodes are defined as incompatible in the field rule text or permission rule text, for example, "Personal processing established" and "Agent authorization established" cannot be used as the final permission basis for the same business at the same time, a mutual exclusion constraint edge is added between them; if a tool node can only enter the callable state after a permission node has passed its judgment, a prerequisite satisfaction edge is added between the permission node and the tool node. After traversing all path constraint skeleton chains, an initial path-level constraint graph can be formed.

[0046] To ensure the computability of the initial path-level constraint graph, each edge is configured with constraint attributes. The attributes of sequential constraint edges include the minimum level difference and a skip-allow flag; the attributes of mutually exclusive constraint edges include the mutual exclusion strength value; and the attributes of prerequisite-satisfied edges include the satisfaction condition number. The minimum level difference represents the minimum distance between two nodes in a legal path, the skip-allow flag indicates whether intermediate nodes can be omitted in special cases, the mutual exclusion strength value ranges from 0 to 1, and the satisfaction condition number corresponds to a clause in the specific field rule text or permission rule text. The initial path-level constraint graph formed in this way not only preserves the main order of high-risk paths but also makes the mutually exclusive relationships and prerequisite conditions, originally scattered throughout the business rules, explicit.

[0047] Finally, the step of "performing boundary blocking point closure correction and abnormal cross-edge removal on the initial path-level constraint graph to obtain a path-level constraint graph used to limit the triggering range of high-risk execution actions" is performed. The purpose of this step is to repair any control gaps and illegal shortcuts that may exist in the initial path-level constraint graph, so that the final path-level constraint graph can truly limit the triggering range of high-risk execution actions.

[0048] Boundary blocking point closure correction refers to checking whether each path leading to a high-risk execution action passes through the boundary blocking point specified by the corresponding high-risk boundary unit. In practice, all reachable paths in the initial path-level constraint graph that terminate at the high-risk execution action tool node are used as objects, and the boundary blocking points of the relevant boundary units in the semantic conflict boundary set are checked. If it is found that a reachable path, after passing the boundary trigger point, does not pass through the corresponding boundary blocking point but can still reach the high-risk execution action tool node, it indicates that the path has a blocking gap. Closure correction is then required: on the one hand, permission nodes or field nodes corresponding to the boundary blocking points are added to the path; on the other hand, a prerequisite fulfillment edge is added between the added node and the subsequent tool node, ensuring that the high-risk execution action can only be triggered after the boundary blocking point is established. After this processing, the paths that previously had control gaps are closed again.

[0049] Abnormal cross-connection edge removal refers to deleting edges that do not conform to business rules but may create "cross-level jumps" in the graph structure. In practice, all edges in the initial path-level constraint graph are traversed, and any edge meeting any of the following conditions is considered an abnormal cross-connection edge: 1. The edge directly connects a field node after the boundary trigger point to a high-risk execution action tool node, skipping necessary permission nodes; 2. The edge connects two field nodes that do not have a direct transitive relationship in the field rule text; 3. The edge connects two tool nodes that do not have a preceding / following call dependency in the tool description text; 4. The edge causes the path level difference to exceed a preset threshold of 3, and there is no allowed skip flag. Abnormal cross-connections are directly deleted from the initial path-level constraint graph. If deletion causes a break in a legitimate path, edges are re-added according to the path constraint skeleton chain, but only edges conforming to the field rule text, permission rule text, and tool description text are allowed to be added.

[0050] After boundary blocking point closure correction and abnormal cross-edge removal, the final path-level constraint graph is obtained. The path-level constraint graph has the following characteristics: First, all paths that can reach high-risk execution actions must pass through a sequence of valid field nodes, permission nodes, and tool nodes; Second, all abnormal paths that are unrelated to high-risk execution actions or would cause over-level triggering are deleted; Third, boundary trigger points and boundary blocking points identified by the semantic conflict boundary set are explicitly projected into the path structure, thereby strictly limiting the triggerable range of high-risk execution actions.

[0051] For example, in a hospital follow-up visit registration scenario, if a user requests "help my dad add yesterday's report to his medical record," the path-level constraint graph will stipulate that a valid path must sequentially pass through the "Patient Identifier" field node, the "Authorization Relationship Established" permission node, the "Report Date" field node, the "Report Type" field node, the "Examination Result Supplement Tool" node, and the "Medical Record Writing Tool" node. If the "Authorization Relationship Established" permission node is missing, the high-risk execution action "Medical Record Writing Tool" node cannot be triggered because the prerequisite edge is not met. Furthermore, if a path attempts to jump directly from the "Patient Identifier" field node to the "Medical Record Writing Tool" node, this connection will be judged as an abnormal cross-edge and removed.

[0052] Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established.

[0053] In this embodiment, the object for constructing the permission sandbox model originates from the aforementioned path-level constraint graph. The path-level constraint graph is a directed graph with attributes. Nodes in the graph include field nodes, permission nodes, and tool nodes, and edges include sequence constraint edges, mutual exclusion constraint edges, and prerequisite satisfaction edges. Each node has at least a node identifier, node type, path level, risk weight, and necessity source; each edge has at least an edge type, direction, level difference, mutual exclusion strength value, or satisfaction condition number. High-risk execution actions refer to tool nodes in the path-level constraint graph that could cause irreversible writes, unauthorized submissions, state changes, or coverage of highly sensitive fields. In the hospital follow-up registration scenario, the medical record writing action can be considered a high-risk execution action; in the government abnormal document correction scenario, the formal submission of a correction application can be considered a high-risk execution action. To avoid high-risk execution actions being triggered due to semantic misjudgment, parameter crosstalk, or missing permissions, this embodiment splits the prerequisite path of high-risk execution actions into three isolated processing layers, and constructs the permission sandbox model accordingly.

[0054] First, the process involves extracting semantic trigger nodes at the beginning of the path, field transmission nodes in the middle of the path, and permission verification nodes at the end of the path, based on the sequential constraints, mutual exclusion constraints, and prerequisite fulfillment relationships corresponding to high-risk execution actions in the path-level constraint graph. These nodes are then mapped to the semantic decision layer, parameter mapping layer, and execution authorization layer, respectively. In practice, this is done by first extracting all legally reachable paths from the path-level constraint graph that terminate at a specific high-risk execution action tool node, and then sorting the nodes in the path from beginning to end according to the path hierarchy. After sorting, nodes that meet the following conditions are assigned to different layers.

[0055] For the semantic determination layer, nodes located at the beginning of the path are included, which are used to determine the business intent and semantic boundary landing point. Specifically, these include field nodes directly related to user input, intent triggering-related nodes, and preceding nodes adjacent to the boundary trigger point. The determination principle is: if a node is located before entering a high-risk execution path, and the output of this node is mainly used to determine "what kind of business intent or business branch the current expression belongs to", then this node is defined as a semantic trigger node and mapped to the semantic determination layer.

[0056] The parameter mapping layer includes nodes located in the middle of the path that are responsible for field reception, field correction, field alignment, and parameter passing. The determination principle is as follows: if a node does not directly decide whether to authorize, but determines the target field content and parameter combination for ultimately passing in a high-risk execution action, then that node is defined as a field passing node and mapped to the parameter mapping layer.

[0057] For the execution authorization layer, the nodes included are the permission nodes and authorization-related tool nodes located at the end of the path that determine whether to allow high-risk execution actions. The determination principle is: if the output of a node directly determines whether to allow a high-risk execution action, or provides the final legal basis for a high-risk execution action, then that node is defined as a permission verification node and mapped to the execution authorization layer.

[0058] For example, in a hospital follow-up registration scenario, for the high-risk execution action of the "medical record writing tool node," its preceding legitimate path might include: "user expression parsing node—intention field node—patient identifier field node—report date field node—report type field node—authorization relationship establishment permission node—examination result supplementation tool node—medical record writing tool node." Among these, the "intention field node" and its adjacent boundary trigger node are mapped to the semantic determination layer; the "patient identifier field node, report date field node, and report type field node" are mapped to the parameter mapping layer; and the "authorization relationship establishment permission node" and the "examination result supplementation tool node" are mapped to the execution authorization layer. After this step, each high-risk execution action is broken down into a semantic determination layer, a parameter mapping layer, and an execution authorization layer with a hierarchical relationship.

[0059] Secondly, based on the semantic determination layer, parameter mapping layer, and execution authorization layer, independent input boundaries, independent output boundaries, and cross-layer transfer whitelists are defined respectively, forming a unidirectional restricted data transfer relationship between layers. Here, the independent input boundary refers to the range of data types and sources that a layer is allowed to receive. The independent output boundary refers to the format and range of data results that a layer is allowed to output. The cross-layer transfer whitelist is a list of data items that are allowed to be passed from one layer to the next.

[0060] In this embodiment, the independent input boundary of the semantic decision layer is limited to the original user input text, the confirmed inheritable context fragments in the historical dialogue, and the values ​​of the preceding field nodes related to the boundary trigger point in the path-level constraint graph; the independent output boundary of the semantic decision layer is limited to the decision label set, which includes intent category labels, object attribution labels, and semantic conflict boundary numbers, and is not allowed to output any parameter values ​​that can be directly written into the business field.

[0061] The independent input boundary of the parameter mapping layer is limited to the judgment label output by the semantic judgment layer, and the original values ​​of field nodes that can be referenced as confirmed by the path-level constraint graph; the independent output boundary of the parameter mapping layer is limited to the target parameter set, which includes the target field identifier, field value, field source, field coverage method and field confidence, and is not allowed to output execution license related results.

[0062] The independent input boundary of the execution authorization layer is limited to the target parameter set output by the parameter mapping layer and the corresponding permission node value in the path-level constraint graph; the independent output boundary of the execution authorization layer is limited to the execution permission result, which includes at least the permission status, permission basis node, permission level and rejection reason, and reverse modification of the judgment label or target parameter set is not allowed.

[0063] To ensure that inter-layer data transfer is unidirectional and restricted, this embodiment establishes a cross-layer transfer whitelist. Specifically, the cross-layer transfer whitelist from the semantic determination layer to the parameter mapping layer only includes the intent category label, object attribution label, and semantic conflict boundary number; the cross-layer transfer whitelist from the parameter mapping layer to the execution authorization layer only includes the target field identifier, field value, field source, and field confidence level. The execution authorization layer does not return business parameters that can participate in recalculation to the previous layer, but only allows the output of execution authorization results for the final decision-making reference. Through the above method, a unidirectional and restricted data transfer relationship is formed between the semantic determination layer, the parameter mapping layer, and the execution authorization layer.

[0064] Next, blocking point injection and mutual exclusion path closure are performed on the unidirectional restricted data transmission relationship between layers. This ensures that the semantic decision layer only outputs decision labels, the parameter mapping layer only receives decision labels and generates target parameter sets, and the execution authorization layer only generates execution permission results based on the target parameter sets and permission conditions. This step is used to further cut off potential cross-layer crosstalk and over-level triggering channels.

[0065] In this context, blocking point injection refers to inserting explicit verification nodes between layers to verify whether the output of the previous layer meets the conditions for entering the next layer. Specifically, a judgment label verification node is inserted between the semantic judgment layer and the parameter mapping layer. This node checks whether the judgment labels output by the semantic judgment layer are complete and contain valid intent category labels, object attribution labels, and semantic conflict boundary numbers; if any one of these is missing, entry into the parameter mapping layer is not allowed. A target parameter set verification node is inserted between the parameter mapping layer and the execution authorization layer. This node checks whether the target parameter set contains all necessary fields required for high-risk execution actions, whether the field sources fall within the allowed node range of the path-level constraint graph, and whether the field confidence score is higher than a preset threshold of 0.72. The field confidence threshold of 0.72 is determined by statistically analyzing the distribution of samples deemed "credible field mapping" in historical manual verification and selecting a lower limit that covers at least 85.00% of credible samples as the threshold. If the target parameter set fails the target parameter set verification node, the execution authorization layer cannot accept the target parameter set.

[0066] Mutually exclusive path closure refers to closing cross-layer channels that should not exist simultaneously, based on mutually exclusive constraint edges in the path-level constraint graph. In specific implementation, if the intent category label output by the semantic decision layer points to "Personal Processing," then the permission node path related to "Authorization Established on Behalf of Another" is closed; if the intent category label output by the semantic decision layer points to "Examination Result Supplement," then the parameter mapping path and tool path related to "Follow-up Appointment" are closed. The closure is not merely marked, but rather invalid inter-layer mapping relationships are directly deleted when constructing the inter-layer relationship table, preventing mutually exclusive paths from being reconnected in subsequent processing. After blocking point injection and mutually exclusive path closure, the semantic decision layer can only output decision labels, the parameter mapping layer can only generate target parameter sets based on decision labels, and the execution authorization layer can only generate execution permission results based on the target parameter sets and permission condition items, thus achieving separation of responsibilities across the three layers.

[0067] Finally, based on the three-layer node relationships after blocking point injection and mutual exclusion path closure, a three-layer mutually isolated permission sandbox model is constructed to limit the triggering conditions of high-risk execution actions. In specific implementation, the semantic judgment layer, parameter mapping layer, and execution authorization layer are represented as three independent directed subgraphs.

[0068] The nodes in the semantic decision layer subgraph include semantic trigger nodes, boundary trigger related nodes, and decision label verification nodes. Edges are only allowed to represent semantic classification and label generation relationships. The nodes in the parameter mapping layer subgraph include field passing nodes, field correction nodes, field overwrite determination nodes, and target parameter set verification nodes. Edges are only allowed to represent field values, field alignment, and parameter assembly relationships. The nodes in the execution authorization layer subgraph include permission verification nodes, authorization-related tool nodes, and execution license result nodes. Edges are only allowed to represent permission verification and license generation relationships.

[0069] The three layers of mutual isolation mean the following: First, no node in any layer can directly access the original node value in a non-adjacent layer; second, the output of any layer must pass through the corresponding verification node before entering the next layer; third, the permission result of the execution authorization layer cannot rewrite the target parameter set in the parameter mapping layer, nor can it rewrite the judgment label in the semantic judgment layer. To achieve this, this embodiment establishes independent node identifier spaces and edge constraint tables for each of the three subgraphs, and uses a cross-layer whitelist as the sole basis for legal connections. Only when the output content of the upper layer is in the whitelist and passes the corresponding verification node is a legal cross-layer edge established between the two layers. Finally, the three independent subgraphs and the legal cross-layer edges are combined to form a permission sandbox model.

[0070] In a hospital follow-up appointment registration scenario, if a user inputs "Help my dad add yesterday's blood test results to his medical record," the semantic judgment layer first outputs a "test result supplementation" intent category label, a "family member acting on behalf of" object attribution label, and the corresponding semantic conflict boundary number. After receiving these judgment labels, the parameter mapping layer generates a target parameter set containing "patient identifier, report date, report type, and report value." After receiving the target parameter set, the execution authorization layer combines it with the "authorization relationship established" permission condition to generate an execution permission result. If the "authorization relationship established" condition is missing, even with a complete target parameter set, the high-risk execution action of writing the medical record will still not receive permission. Conversely, if the semantic judgment layer misjudges the input as "follow-up appointment," the mutual exclusion path closure process has already closed the "test result supplementation" related path, and neither the parameter mapping layer nor the execution authorization layer will generate a legitimate path to writing the medical record.

[0071] Based on counterfactual perturbation samples injected into W by B, including abbreviation replacement, referential inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated.

[0072] In this embodiment, the purpose of constructing the multi-branch verification set is to verify the stability of the permission sandbox model during its construction phase. The permission sandbox model has been hierarchically isolated based on a path-level constraint graph. Internally, it includes a semantic decision layer, a parameter mapping layer, and an execution authorization layer. The semantic decision layer outputs decision labels, the parameter mapping layer generates a target parameter set based on the decision labels, and the execution authorization layer generates an execution permission result based on the target parameter set and permission conditions. To verify whether the permission sandbox model can maintain stable decision labels, convergent target parameter sets, and controlled execution permission results under complex dialogue perturbations, this embodiment introduces counterfactual perturbation samples. Counterfactual perturbation samples refer to test samples constructed by changing the user's terminology, citation relationships, sentence order, and correction methods, without altering the essence of the original business objective or changing the local expression within a controllable range. These samples create multiple test samples that, while exhibiting "expression changes, but with traceable boundaries," are constructed by altering the user's terminology, citation relationships, sentence order, and correction methods. These samples are not random rewrites of text but are constructed by strictly relying on boundary units within a semantic conflict boundary set, thus focusing on the boundary positions most prone to misjudgment and false triggering.

[0073] In this embodiment, the injection objects of the permission sandbox model are first defined. The injection objects refer to the input and intermediate positions that are allowed to be affected by counterfactual perturbation samples. Specifically, there are three types of positions: the first type is the input position of the semantic decision layer, i.e., the original user input text and its historical dialogue context; the second type is the boundary position between the semantic decision layer and the parameter mapping layer, i.e., the candidate semantic path before the formation of the decision label; and the third type is the preceding field reference position of the parameter mapping layer, i.e., the field receiving node before the formation of the final target parameter set. The execution authorization layer is not a direct object of rewriting counterfactual perturbation samples, but only a verification object after receiving the perturbation propagation result. The reason for this setting is that the execution authorization layer should maintain the rule determinism of the permission condition items and should not create false samples by artificially rewriting the authorization rules. Instead, it should observe whether the authorization result undergoes undue changes through upstream expression perturbation.

[0074] Before generating counterfactual perturbation samples, injectable boundary units need to be extracted from the semantic conflict boundary set. Specifically, all boundary units in the semantic conflict boundary set are traversed, and the boundary type, boundary trigger point, boundary blocking point, applicable field range, applicable instruction range, applicable tool range, and boundary risk value of each boundary unit are read. Boundary units with a boundary risk value higher than a preset threshold of 0.58 are prioritized as injection sources for counterfactual perturbation samples; boundary units with a boundary risk value lower than 0.58 but higher than 0.42 are used as supplementary injection sources. The reason for setting two threshold levels is that boundary units higher than 0.58 usually correspond to the core conflict positions of high-risk execution actions, while boundary units between 0.42 and 0.58 often correspond to marginal confusion positions, which can be used to verify the robustness of the permission sandbox model to moderate-intensity perturbations. For each injectable boundary unit, its boundary feature chain is also read. The boundary feature chain records the order, type, path level, and risk level of the difference nodes from the boundary trigger point to the boundary blocking point of that boundary unit. The construction of all subsequent perturbation samples is based on the boundary feature chain.

[0075] In this embodiment, the injection of counterfactual perturbation samples—including abbreviation replacement, referential inheritance, sequence reversal, and corrective interruption—into the permission sandbox model based on the semantic conflict boundary set does not directly apply these four types of perturbations to the entire business corpus. Instead, it first forms original benchmark samples, which are then subjected to targeted transformations. The original benchmark samples are derived from real dialogue fragments in the anonymized business corpus that have been manually verified. Each original benchmark sample contains at least the input text sequence, standard business intent, legal field values, the judgment labels to be achieved, the target parameter set to be generated, and the final execution permission result. To ensure the comparability of subsequent perturbations, this embodiment requires that each original benchmark sample undergo at least one manual annotation and verification, and that a complete legally reachable path exists in the path-level constraint graph.

[0076] The specific process for constructing counterfactual perturbation samples for abbreviation replacement is as follows. First, candidate replacement words are identified from the original baseline samples. Candidate replacement words are mainly located in the positions of organization names, business action names, field titles, personnel relationship titles, and document names in user expressions. Then, based on the applicable field range and applicable instruction range in the semantic conflict boundary set, boundary units related to the word position are searched. If the standard term corresponding to the word position has a high-frequency abbreviation in the historical business corpus, its abbreviation candidate set is extracted from the domain terminology lexicon. The domain terminology lexicon is constructed as follows: after segmenting the desensitized business corpus, the co-occurrence relationship between the standard term and its variant expressions is statistically analyzed, and then the one-to-one or one-to-many correspondence between the abbreviation and the standard term is confirmed by manual verification. For example, in the hospital follow-up registration scenario, "blood routine report" may have multiple abbreviation candidates such as "blood routine", "laboratory report", and "report form"; "examination result supplementation" may have abbreviation candidates such as "supplementary report", "supplementary result", and "supplement into". For each candidate replacement word position, this embodiment uses a restricted replacement function to generate abbreviation replacement samples. The restricted replacement function is defined as follows: while maintaining the standard business intent of the original benchmark sample, the standard term is replaced with an item from the abbreviation candidate set, requiring that the semantic adjacency after replacement is not less than 0.78, and the replacement position must not cross the boundary blocking point. The semantic adjacency is still calculated using the aforementioned cosine similarity function. The abbreviation replacement samples generated in this way can simulate the judgment perturbation caused by real users using abbreviations in spoken expression.

[0077] The specific process for constructing counterfactual perturbation samples for referential inheritance is as follows. Referential inheritance refers to the user not directly providing the object name, field name, or business object in the current round, but instead using pronouns such as "he," "that report," "the last one," "this one," or "the previous information," which the model then resolves based on the historical context. In implementation, explicit object terms and explicit field terms are first identified from the multi-turn dialogue sequence of the original baseline sample. Then, based on the cross-sentence association edges in the scene semantic association model and the order constraint relationships in the path-level constraint graph, it is determined which terms can be replaced by pronouns. Next, the original baseline sample is processed by substitution, that is, the explicit object terms in the current round are replaced with pronouns, while retaining traceable object information from previous rounds. To ensure that this replacement is a controlled perturbation, inheritance reachability also needs to be calculated. Inheritance reachability is used to characterize whether a pronoun can be uniquely mapped back to the original object within the historical dialogue window. The calculation method is as follows: Looking back no more than three rounds from the current round, count the number of candidate objects that satisfy the criteria of consistent role, consistent time, and consistent path. If the number of unique candidate objects is 1, the inheritance reachability is recorded as 1; if the number of candidate objects is greater than 1, the inheritance reachability is calculated by dividing 1 by the number of candidate objects. This embodiment requires that the inheritance reachability of the referential inheritance position used to form the counterfactual perturbation sample should be no less than 0.50, thereby ensuring that the sample is not a completely unsolvable ambiguous expression, but rather an inheritance expression with analyzable boundaries. The referential inheritance sample formed after the above processing can be used to verify whether the semantic judgment layer incorrectly changes the judgment label when involved in historical context, or whether the parameter mapping layer incorrectly maps the pronoun to a non-target field.

[0078] The specific process for constructing counterfactual perturbation samples with reversed order is as follows. Reversal of order refers to adjusting the sequence of multiple semantic fragments in a user's expression without changing the original business objective, thereby simulating the non-standard narrative style in real dialogue, such as "stating supplementary conditions first, then the main business action" or "giving time first, then the object." In practice, the current round input text of the original baseline sample is first segmented into semantic fragments. The segmentation criteria include action phrase boundaries, time phrase boundaries, object phrase boundaries, and constraint phrase boundaries. Then, based on the node order of the corresponding legal paths in the path-level constraint graph, it is identified which semantic fragments belong to a relationship where "the order of expression is variable but the logical dependency remains unchanged." For example, "Help my dad add yesterday's blood test results to his medical record" and "Yesterday's blood test results, help my dad add them to his medical record" are logically equivalent, but the order of expression is different. For these types of semantic fragments, a local permutation algorithm can be used to generate reversed order samples. The specific steps of the local substitution algorithm are as follows: Maintaining the core action phrases, perform pairwise swaps or insertions between object phrases, time phrases, and constraint phrases, and recalculate the semantic adjacency between the substituted text and the original baseline sample. Only when the semantic adjacency after substitution is not less than 0.75, and can still be mapped back to the same standard business intent in the scene semantic association model, is the substitution result retained as an inverted order sample. This method allows us to examine whether the semantic determination layer overly relies on a fixed word order, and whether the parameter mapping layer changes the field continuation result due to changes in field order.

[0079] The specific process for constructing counterfactual perturbation samples for correcting interruptions is as follows. Correcting interruptions refers to a user initially providing an expression, which is then immediately negated, corrected, or rewritten in the same or next round. Examples include "It's not registration, it's a supplementary report," "It's not me, I'm handling it for my dad," and "I misspoke earlier, it's from yesterday, not today." Such expressions are particularly prone to crossing semantic conflict boundaries and are a significant source of high-risk, accidental triggering of actions. In implementation, target segments that can be locally corrected are first identified from the original baseline samples. Target segments typically include business action words, object words, time words, and field values. Then, a correction trigger word is introduced for each target segment, forming a three-part structure: "original expression segment + correction trigger word + corrected expression segment." The correction trigger words are taken from a manually compiled correction trigger word list, which consists of frequently occurring expressions from historical business corpora such as "not…is…," "change to…," "misspoke…," and "the previous one is incorrect," containing a total of 47 standard correction patterns. After constructing the correcting interruption samples, path redirection verification is also required. The purpose of path redirection verification is to confirm whether the corrected expression fragment should cover the semantic path corresponding to the original expression fragment. Specifically, the corrected interjection sample is input into the scene semantic association model, and candidate paths are mapped to the original and corrected expression fragments respectively. Then, the corrected expression fragment is assigned a higher path priority based on the position of the correction trigger word. If, after priority adjustment, the high-confidence path redirects to the path corresponding to the corrected expression fragment, the sample is considered valid. This process can realistically simulate whether the permission sandbox model can correctly invalidate old judgment labels and old target parameter sets when a user corrects the aforementioned content in multiple rounds of dialogue.

[0080] After generating the four types of counterfactual perturbation samples, a multi-branch verification set needs to be constructed based on the permission sandbox model. A multi-branch verification set refers to a set of multiple verification branches generated around the same original baseline sample, each with different perturbation types and intensities. In practice, at least four primary branches are constructed around each original baseline sample, corresponding to abbreviation substitution branches, referential inheritance branches, sequence reversal branches, and correction of interruptions branches. Under each primary branch, secondary branches are further divided based on the number of perturbation locations and the boundary risk value. If the perturbation acts on only one boundary trigger point, it is recorded as a single-point perturbation branch; if the perturbation acts near both the boundary trigger point and the boundary blocking point, it is recorded as a two-point perturbation branch. If the boundary risk value is between 0.58 and 0.75, it is recorded as a medium-risk branch; if the boundary risk value is higher than 0.75, it is recorded as a high-risk branch. Thus, each original baseline sample can generate a multi-branch verification set defined by the perturbation type, the number of perturbation points, and the risk level.

[0081] To ensure the comparability of the multi-branch validation set, this embodiment uniformly records the following information for each validation branch: original benchmark sample identifier, perturbation type, perturbation location, corresponding boundary unit identifier, input text before perturbation, input text after perturbation, expected judgment label, expected target parameter set, expected execution permission result, and branch risk level. Only when all this information is completely recorded is the branch formally included in the multi-branch validation set. Through this structured storage method, subsequent runtime of the driving permission sandbox model allows for branch-by-branch comparison of output changes in the semantic judgment layer, parameter mapping layer, and execution authorization layer.

[0082] For example, in a hospital follow-up registration scenario, the original baseline sample is "Help my dad add yesterday's blood test results to his medical record." Based on abbreviation substitution, it can generate "Help my dad add yesterday's lab report to his medical record"; based on referential inheritance, it can generate "Add yesterday's results to his medical record" given in the previous round; based on reversing the order, it can generate "Yesterday's blood test results, help my dad add them to his medical record"; based on correcting interruptions, it can generate "It's not registration, it's helping my dad add yesterday's blood test results to his medical record." Although these samples differ in expression, the expected judgment label should all point to "examination result supplementation," the expected target parameter set should maintain consistency in "patient identifier, report date, report type, and report value," and the execution authorization layer should only output the allowed execution permission result when the "authorization relationship is established." If the permission sandbox model misjudges it as "follow-up appointment" in any branch, or generates the allowed execution permission result without proper authorization, it indicates that there is still a risky path that can be exploited at the boundary position corresponding to that branch.

[0083] Using A to drive W, the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ of each branch are calculated respectively, and the risk triggering node Q is determined based on the joint mismatch results of η, β, and γ.

[0084] In this embodiment, the verification object is the previously constructed permission sandbox model. The permission sandbox model consists of a semantic judgment layer, a parameter mapping layer, and an execution authorization layer. The semantic judgment layer outputs a judgment label, the parameter mapping layer outputs a target parameter set, and the execution authorization layer outputs the execution permission result. The multi-branch verification set consists of multiple verification branches formed by replacing abbreviations, inheriting pronouns, reversing order, and correcting interruptions from the original benchmark sample. Each verification branch records the input text before perturbation, the input text after perturbation, the corresponding boundary unit identifier, the expected judgment label, the expected target parameter set, and the expected execution permission result. To identify the key locations where high-risk execution actions are mistakenly triggered from each verification branch, this embodiment constructs the semantic boundary locking coefficient, parameter landing point offset, and authorization closure integrity from three directions: semantic boundary stability, parameter transfer stability, and authorization closure stability. Furthermore, joint mismatch analysis is performed on these three feature parameters to determine the risk triggering node.

[0085] First, based on the decision label sequence, field node sequence and permission node sequence corresponding to each branch in the multi-branch verification set, a branch hyperbolic semantic trajectory is constructed, and the target hyperbolic boundary trajectory is generated according to the center path of each boundary unit in the semantic conflict boundary set.

[0086] In this embodiment, each verification branch, after running through the permission sandbox model, generates a corresponding decision label sequence, field node sequence, and permission node sequence. The decision label sequence refers to the sequence of intent category labels, object attribution labels, and semantic conflict boundary numbers output by the semantic decision layer in chronological order; the field node sequence refers to the sequence of field nodes accessed and confirmed by the parameter mapping layer in mapping order; and the permission node sequence refers to the sequence of permission nodes reached by the execution authorization layer in decision order. To uniformly represent the semantic evolution process of the branch across the three layers, this embodiment concatenates the above three sequences into a branch semantic path, and then constructs a branch hyperbolic semantic trajectory based on the hierarchical relationship, node type, and boundary position of each node in the path.

[0087] The branch-hyperbolic semantic trajectory is not a simple sequence of nodes, but a continuous trajectory representation after embedding the node sequence into a predefined hyperbolic manifold space. The hyperbolic manifold space is constructed using a hyperbolic parabolic sphere model with a curvature constant of -1. During construction, an initial Euclidean feature vector is first generated for each type of node. This Euclidean feature vector is obtained by concatenating node type encoding, node hierarchy encoding, node risk weight, node confidence, and node adjacency structure encoding, resulting in a total dimension of 64. Then, the 64-dimensional Euclidean feature vector is mapped to the hyperbolic manifold space using a hyperbolic exponential mapping function to obtain the corresponding hyperbolic node coordinates. Finally, the coordinates of each hyperbolic node are connected in the order of the decision label sequence, field node sequence, and permission node sequence to form the branch-hyperbolic semantic trajectory.

[0088] Simultaneously, the target hyperbolic boundary trajectory is generated based on the central paths of each boundary unit in the semantic conflict boundary set. The central path of a boundary unit refers to the node path within the same boundary unit where historical legitimate samples, traversing the path-level constraint graph, have the highest frequency of occurrence, the lowest average risk, and a complete authorization closure when reaching the target high-risk execution action. The generation method is as follows: first, all paths are counted in the set of legitimate samples corresponding to the boundary unit, and then sorted according to their frequency of occurrence; if multiple paths have similar frequencies, the path containing boundary blocking points and consistent execution permission results is preferentially selected as the central path. The target hyperbolic boundary trajectory is generated by applying the same mapping method as the branch hyperbolic semantic trajectory to each node in the central path.

[0089] Secondly, the branch hyperbolic semantic trajectory and the target hyperbolic boundary trajectory are mapped to a preset hyperbolic manifold space, the hyperbolic geodesic distance between them is calculated, and the hyperbolic boundary drift is obtained by combining the curvature offset value of the branch trajectory in the neighborhood of the boundary trigger point.

[0090] Since the hyperbolic node coordinates were constructed in the previous step, this step is mainly used to measure and verify the degree of deviation between the branch and the target boundary. The hyperbolic geodesic distance is calculated using the geodesic distance function under the hyperbolic parabolic sphere model. Specifically, nodes aligned with the target hyperbolic boundary trajectory in the branch's hyperbolic semantic trajectory are paired point-by-point, and the hyperbolic distance between each pair of nodes is calculated. The weighted average of all paired node hyperbolic distances is then taken as the base distance between trajectories. The weights in the weighted average are determined by both the node hierarchy weight and the node risk weight. The weight of nodes within two layers of the boundary trigger point is set to 0.30, the weight of nodes within two layers of the boundary blocking point is set to 0.35, and the total weight of the remaining nodes is set to 0.35. This weight allocation is used because the boundary trigger point determines whether semantic offset begins to form, and the boundary blocking point determines whether the offset will continue to propagate to high-risk execution actions.

[0091] To further reflect the degree of local boundary deformation, this embodiment introduces a curvature offset value. The curvature offset value measures the local bending change of the branch hyperbolic semantic trajectory within the neighborhood of the boundary trigger point, essentially examining whether the branch suddenly deviates from the correct path near the boundary trigger point. Specifically, a local trajectory window is formed by taking one node forward and two nodes backward from the boundary trigger point as the center. Discrete curvature values ​​are calculated for the coordinates of three consecutive hyperbolic nodes within the local trajectory window, and then subtracted from the discrete curvature value of the target hyperbolic boundary trajectory in the corresponding window to obtain the curvature offset value. The discrete curvature value is calculated as the normalized result of the angle between the tangent vectors of two adjacent hyperbolic segments. If the branch trajectory shows a significant turn near the boundary trigger point, while the target hyperbolic boundary trajectory remains smooth, the curvature offset value increases.

[0092] After obtaining the base distance and curvature offset values, a weighted synthesis function is used to calculate the hyperbolic boundary drift, defined as: Hyperbolic Boundary Drift = 0.65 × Normalized Hyperbolic Geodesic Distance + 0.35 × Normalized Curvature Offset. The normalized hyperbolic geodesic distance is linearly scaled based on the minimum and maximum distances in the training samples, and the normalized curvature offset is linearly scaled based on the intervals obtained from statistical analysis of historical valid and unlocked samples. Weights of 0.65 and 0.35 are used because the overall trajectory deviation reflects whether the global semantics are still bounded more effectively than local curvature changes.

[0093] Next, let's explain the process of "performing interval normalization on the hyperbolic boundary drift to obtain the normalized hyperbolic boundary drift." Because the trajectory length and node distribution differ across different boundary units and business scenarios, directly using the original hyperbolic boundary drift would result in incomparability between branches. Therefore, interval normalization is necessary. Specifically, for each boundary unit, the distribution of hyperbolic boundary drift corresponding to historical valid samples and historical lost-lock samples is pre-calculated, and the 5th and 95th percentile values ​​are recorded respectively, serving as the lower and upper normalization bounds for that boundary unit. Then, the hyperbolic boundary drift of the current branch is substituted into the linear interval normalization function: Normalized hyperbolic boundary drift = (Current hyperbolic boundary drift minus the lower normalization bound) ÷ (Upper normalization bound minus the lower normalization bound). When the calculated result is less than 0, it is truncated to 0; when the calculated result is greater than 1, it is truncated to 1. The 5th and 95th percentile values, instead of the minimum and maximum values, are used to reduce the impact of extreme outliers on the interval boundaries. After this processing, the drift results under different boundary units are uniformly compressed into the range of 0 to 1, which facilitates subsequent calculation of the semantic boundary locking coefficient.

[0094] Next, the explanation of "calculating the semantic boundary locking coefficient of each branch based on the semantic boundary locking coefficient being equal to 1 minus the normalized hyperbolic boundary drift" is provided. The semantic boundary locking coefficient is used to characterize whether a certain verification branch remains stably bound within the target semantic conflict boundary after perturbation. The specific calculation method is: semantic boundary locking coefficient = 1 minus the normalized hyperbolic boundary drift.

[0095] When the semantic boundary locking coefficient is close to 1, it means that the current branch is highly consistent with the target hyperbolic boundary trajectory, and the output of the semantic decision layer is still stably locked inside the legal boundary; when the semantic boundary locking coefficient is close to 0, it means that the current branch has deviated significantly from the legal boundary trajectory and there is a high probability of crossing the wrong boundary.

[0096] In this embodiment, the first threshold for the semantic boundary locking coefficient is set to 0.62. This threshold is obtained as follows: 1200 manually labeled verification branches are extracted from hospital follow-up registration scenarios and government abnormal document correction scenarios, of which 600 are stable branches and 600 are unlocked branches. The semantic boundary locking coefficient is calculated for each branch, and the segmentation point that maximizes the recognition accuracy of the two types of samples is taken as the first threshold. Therefore, if the semantic boundary locking coefficient of a certain branch is lower than 0.62, it is considered that the branch has shown a boundary unlocking trend at the semantic decision layer.

[0097] In this embodiment, the parameter landing point offset and authorization loop integrity are also obtained from the permission sandbox model execution results in a similar manner. The parameter landing point offset is used to measure the degree of offset of the target parameter set relative to the legal field landing point in the path-level constraint graph. The value ranges from 0 to 1. The larger the value, the more likely the parameter is to fall into the wrong field or the unauthorized field. The authorization loop integrity is used to measure whether the execution authorization layer has completely passed through the necessary permission nodes and necessary tool nodes. The value ranges from 0 to 1. The smaller the value, the greater the possibility that high-risk execution actions are triggered prematurely when there is no complete authorization path.

[0098] Among them, parameter landing point offset refers to the degree of offset of the actual mapping landing point of each parameter in the target parameter set relative to the preset legal field landing point in the path-level constraint diagram after the parameter mapping layer generates the target parameter set according to the judgment label. It is obtained by comparing the differences between the actual parameter landing point path and the legal field landing point path in terms of field node position, hierarchical position and field belonging range, and is used to characterize whether the parameter has misaligned mapping, cross-field mapping or unauthorized mapping. The value range of parameter landing point offset is 0 to 1. The closer the value is to 0, the more consistent the target parameter set is with the legal field landing point. The closer the value is to 1, the more likely the target parameter set is to fall into the wrong field or unauthorized field.

[0099] The completeness of the authorization loop refers to the degree to which the necessary permission nodes and necessary tool nodes corresponding to high-risk execution actions are met in the path-level constraint graph during the generation of execution license results by the execution authorization layer. It is obtained by comparing the consistency between the actual authorization path and the preset complete authorization path in terms of node coverage, prerequisite satisfaction, and sequential closure. It is used to characterize whether a high-risk execution action is legally triggered after passing through all necessary permission nodes and necessary tool nodes. The value of the completeness of the authorization loop ranges from 0 to 1. The closer the value is to 1, the closer the actual authorization path is to the preset complete authorization path. The closer the value is to 0, the more likely the high-risk execution action is to be triggered prematurely in the absence of a complete authorization loop.

[0100] The semantic boundary locking coefficient, parameter landing point offset, and authorization loop integrity of each branch are obtained, and a joint feature sequence consistent with the node order in the path-level constraint graph is constructed.

[0101] Since anomalies in a single branch are not necessarily concentrated at a single node, it is necessary to expand the three feature parameters along the path nodes to form an analyzable joint feature sequence. In specific implementation, the legal path from the semantic decision layer to the execution authorization layer in the path-level constraint graph is used as the baseline path. Field nodes, permission nodes, and tool nodes along this path are traversed in node order. For each node, the local values ​​of the semantic boundary locking coefficient, parameter landing point offset, and authorization closure integrity of the corresponding branch during operation are read. The local value refers to the contribution of the node to the overall parameter value within its window range, obtained through window weighting decomposition. Then, the three local values ​​of the same node are concatenated in a fixed order to form a node joint feature term. All node joint feature terms are then arranged in path order to form a joint feature sequence. This sequence is essentially a ternary vector sequence expanded along the nodes, capable of simultaneously reflecting the propagation of semantic boundary changes, parameter mapping deviations, and authorization closure gaps along the entire path.

[0102] Based on the joint feature sequence, the mismatch propagation value and mismatch aggregation value of each node are calculated, and candidate abnormal nodes that simultaneously meet the following conditions are selected: the semantic boundary locking coefficient is lower than the first threshold, the parameter landing point offset is higher than the second threshold, or the authorized closed loop integrity is lower than the third threshold.

[0103] The mismatch propagation value is used to characterize whether an anomaly at a certain node will continue to amplify along subsequent paths, while the mismatch clustering value is used to characterize whether multiple anomaly features cluster at the same node or adjacent nodes.

[0104] Specifically, for any node in the path, the instantaneous mismatch value of the node is first calculated. The instantaneous mismatch value of the node is obtained using the following rules: if the semantic boundary locking coefficient is lower than the first threshold, the semantic mismatch component is recorded as 1 minus the semantic boundary locking coefficient; if the parameter landing point offset is higher than the second threshold, the parameter mismatch component is recorded as the parameter landing point offset minus the second threshold; if the authorized loop integrity is lower than the third threshold, the authorized mismatch component is recorded as the third threshold minus the authorized loop integrity; then, the node instantaneous mismatch value is obtained by weighted summation with weights of 0.40, 0.35, and 0.25.

[0105] Based on the immediate mismatch value of a node, the impact of subsequent nodes on the current node is accumulated along the path to obtain the mismatch propagation value. The calculation method is as follows: the mismatch propagation value of the current node equals the immediate mismatch value of the current node plus the cumulative value of the immediate mismatch values ​​of subsequent nodes, decreasing by a hierarchical attenuation factor, where the hierarchical attenuation factor is set to 0.80. The hierarchical attenuation factor is used to reflect that the further away from the current node the subsequent anomaly is, the weaker its explanatory power for the current node as the initial source of mismatch.

[0106] The mismatch cluster value is obtained through sliding window statistics. Specifically, with the current node as the center, the number of times the semantic mismatch component, parameter mismatch component, and authorization mismatch component simultaneously exceed the threshold is counted in a local window of one node before and after the current node, and then normalized according to the window size to obtain the mismatch cluster value. If the current node and its neighboring nodes continuously show multiple features exceeding the threshold, the mismatch cluster value is relatively high.

[0107] In this embodiment, any node that meets the following criteria is selected as a candidate abnormal node: the semantic boundary locking coefficient is lower than the first threshold, the parameter landing point offset is higher than the second threshold, or the authorized closed loop integrity is lower than the third threshold, and its mismatch propagation value is greater than 0.45 or mismatch aggregation value is greater than 0.50.

[0108] Subsequently, an explanation was given regarding "performing forward path penetration analysis and backward causal backtracking analysis on candidate abnormal nodes to identify the key fork nodes where joint mismatch first forms and can be propagated to high-risk execution actions".

[0109] Forward path penetration analysis is used to determine whether a candidate anomalous node has the ability to propagate joint mismatches to high-risk execution actions. In practice, starting from the candidate anomalous node, all reachable paths are traversed backward along the path-level constraint graph. It checks whether there is at least one legal or quasi-legal path from that node that can reach the high-risk execution action tool node. Simultaneously, during the traversal, it is determined whether mutually exclusive constraint edges in subsequent paths have been closed and whether prerequisite satisfied edges may still hold. If, without violating the basic path direction, the anomalous impact can continue to penetrate to the high-risk execution action, then the candidate anomalous node passes the forward path penetration analysis.

[0110] Backward causal backtracking analysis is used to confirm whether the candidate anomaly node is the location where the joint mismatch first forms, rather than a passive continuation of an anomaly from an earlier node. In practice, the preceding nodes in the backward tracing path from the candidate anomaly node are compared one by one: the instantaneous mismatch value, mismatch propagation value, and mismatch aggregation value of each preceding node. If an earlier node is found to simultaneously possess a threshold-exceeding anomaly that can explain the current node's anomaly, then the current candidate anomaly node is not considered the first-forming node. If the current node is the first instance of multi-feature joint mismatch during the backward search along the path and can explain the subsequent anomaly propagation, then this node is identified as a critical bifurcation node. A critical bifurcation node is defined as a node where at least two of the following features begin to couple: semantic boundary locking instability, parameter landing point shift, or authorization loop defect, and this coupling state can propagate along the subsequent path to nodes performing high-risk actions.

[0111] Mark the critical fork node as a risk trigger node Q. Once the critical fork node is identified, mark it as a risk trigger node. The risk trigger node records at least the following information in its data structure: node identifier, node type, level, boundary unit identifier, local value of semantic boundary locking coefficient, local value of parameter landing point offset, local value of authorized closed loop integrity, mismatch propagation value, mismatch aggregation value, and corresponding high-risk execution action identifier.

[0112] In a hospital follow-up registration scenario, for example, if the input of a certain verification branch is "not for registration, but to help my dad add yesterday's information to the medical record," if the semantic judgment layer experiences object reference drift at "yesterday's information," causing the semantic boundary locking coefficient to drop to 0.55, and the parameter mapping layer incorrectly inherits "that" to the non-target report field, causing the parameter landing point offset to rise to 0.48, although the subsequent execution authorization layer still performs authorization relationship verification, the authorization closed loop integrity is only 0.66. After path analysis, it may be found that the "report object confirmation field node" is the key fork node that forms the first joint mismatch and can be passed to the "medical record writing tool node." Therefore, the "report object confirmation field node" is marked as a risk trigger node.

[0113] For example, in the scenario of correcting abnormal government documents, if a user enters "I made a mistake earlier, it's not about supplementing materials, it's about directly correcting the main information", and if the semantic judgment layer fails to correctly abolish the old intent tag, resulting in a mixed path between the subsequent parameter mapping layer and the execution authorization layer, then the "intent redirection node after the correction trigger word" may be marked as a risk trigger node.

[0114] Based on the reverse correction of path constraints in R and isolation boundaries in W according to Q, high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and the output target is the large language model application.

[0115] In this embodiment, firstly, based on the hierarchical position of the risk triggering node in the path-level constraint graph, the mismatch propagation value, and the mismatch aggregation value, the corresponding abnormal propagation edge, abnormal cross-layer edge, and missing blocking edge are located, and a reverse correction index chain is generated.

[0116] In practice, the process begins by using the risk-triggered node as the core and extracting local subgraphs within three layers before and after the node in the path-level constraint graph, forming the local path region to be corrected. Then, edge attribute verification is performed on all edges within the local path region to be corrected. If an edge causes a parameter to deviate from its legal field landing point and continues to propagate to subsequent nodes, that edge is identified as an abnormal propagation edge. If an edge directly crosses the predetermined boundary between the semantic judgment layer, parameter mapping layer, and execution authorization layer, causing a cross-layer connection not permitted by the legal whitelist, that edge is identified as an abnormal cross-layer edge. If, according to the corresponding boundary unit and the legal center path of the path-level constraint graph, a necessary blocking position should have a preceding satisfying edge or permission node connection, but this is missing in the current graph, the missing edge corresponding to that position is identified as a missing blocking edge.

[0117] To ensure the computability of the identification results, this embodiment defines an edge anomaly function. The edge anomaly function consists of four parts: the difference in the layer where the edge is located, the contribution rate of the mismatch propagation value associated with the edge, the contribution rate of the mismatch aggregation value associated with the edge, and whether it violates the cross-layer propagation whitelist. If the edge anomaly function value is greater than a preset threshold of 0.57, it is preferentially listed as an edge to be corrected. This threshold is obtained through backtracking statistics of edges in historical anomaly branches.

[0118] After identifying abnormal transmission edges, abnormal cross-layer edges, and missing blocking edges, the causal relationships between these edges and risk trigger nodes are linked along the path direction to form a reverse correction index chain. This reverse correction index chain is not a regular list, but an ordered chain structure, which includes at least the risk trigger node identifier, associated abnormal edge type, abnormal edge location, impact level, target correction direction, and expected closure node. The "reverse" meaning is that this index chain points backward from the high-risk action to the upstream mismatch location that caused the action to be abnormally reachable, thus providing a clear entry point for subsequent corrections. For example, in a hospital follow-up registration scenario, if the "report object confirmation field node" is a risk trigger node, and it is found that it directly connects to the medical record writing tool node without passing through the "authorization relationship establishment permission node," then this direct connection edge is identified as an abnormal cross-layer edge. The corresponding "authorization relationship establishment permission node" connection that should be added is identified as a missing blocking edge and written into the reverse correction index chain along with the risk trigger node.

[0119] Secondly, based on the reverse correction index chain, the path-level constraint graph is processed by sequential constraint reinforcement, mutual exclusion constraint rewriting, and pre-satisfied edge insertion to obtain a corrected path-level constraint graph. Sequential constraint reinforcement is used to solve the problem that although necessary nodes exist in the path, their order is too loose, allowing abnormal paths to bypass restrictions by swapping node order. In specific implementation, all abnormal propagation edges and missing blocking edges are traversed along the reverse correction index chain to find their predecessor and successor nodes in the legal center path, and strict sequential constraint edges are rewritten in the corrected graph. For example, if the "object ownership confirmation field node" must be satisfied before the "target field mapping node", but the existing graph only provides weak sequential constraints, it is rewritten as an irreversible sequential constraint during correction, that is, the latter is prohibited from being activated before the former is completed.

[0120] Mutual exclusion constraint redrawing is used to address issues such as insufficient coverage of existing mutual exclusion constraints or overly coarse mutual exclusion boundaries. In practice, based on the semantic conflict boundary range of the boundary unit to which the risk-triggered node belongs, the nodes and paths that should be mutually exclusive are re-identified. For example, the "Personal Processing Path" and the "Agency Authorization Path" cannot coexist before the medical record writing action, and the "Examination Result Supplement Path" and the "Follow-up Appointment Path" cannot overlap and accept the same report field during the field mapping stage. After redrawing the mutual exclusion constraint edges for these paths, a mutual exclusion strength value must be written for each mutual exclusion constraint edge. The mutual exclusion strength value is calculated jointly based on the confusion frequency of the two paths in historical abnormal samples and the difference in execution consequences, with a value ranging from 0 to 1.

[0121] The pre-satisfaction edge insertion process is used to restore the authorization and verification loop that should have existed but was missing. In specific implementation, if a missing blocking edge exists in the reverse correction index chain, a pre-satisfaction edge between the necessary permission node and the subsequent tool node, or a pre-satisfaction edge between the necessary field node and the parameter mapping node, is inserted at that blocking position. For example, for the "medical record writing tool node," if the pre-satisfaction edge of "authorization relationship established permission node → medical record writing tool node" is missing, this edge is directly inserted, and its satisfaction condition number is written as the clause number in the corresponding permission rule text.

[0122] After completing the above three processes, a modified path-level constraint graph is obtained. Compared with the original path-level constraint graph, the modified path-level constraint graph not only removes abnormal reachable paths, but also strengthens the necessary order, mutual exclusion boundaries, and authorization closure requirements before high-risk execution actions in terms of structure. Therefore, it can more strictly limit the triggering path of high-risk execution actions.

[0123] Next, based on the revised path-level constraint graph, the permission sandbox model is subjected to isolation boundary shrinkage, cross-layer whitelist pruning, and blocking point relocation processing to form a revised permission sandbox model.

[0124] Because the path-level constraint graph has been modified, the three-layer isolation boundary in the permission sandbox model also needs to be updated synchronously; otherwise, the old cross-layer channels or excessively wide data transmission range may still be retained.

[0125] Specifically, boundary contraction refers to narrowing the allowed shared boundary range between the semantic decision layer, parameter mapping layer, and execution authorization layer. In practice, the set of legal nodes for each layer is recalculated based on the revised path-level constraint graph. Any node no longer located on a legal path is removed from the boundary region of its corresponding layer. Any boundary connection points near risk-triggered nodes that have been confirmed to induce joint mismatch are narrowed by one layer's distance to prevent the boundary from being too close to high-risk nodes. In this way, the boundaries between the three layers are made closer to the legal central path, rather than broadly covering multiple possible paths.

[0126] Cross-layer propagation whitelist pruning refers to re-defining the data items allowed for cross-layer propagation based on the revised path-level constraint graph. In practice, all retained legal cross-layer connections in the revised path-level constraint graph are read. If a data item, although previously in the whitelist, depends on a path deemed abnormal, it is removed from the whitelist. For example, if an object ownership tag previously directly influenced simplified permission decisions in the execution authorization layer, but after revision, that channel is identified as an out-of-level channel, then the object ownership tag is no longer allowed to directly enter the execution authorization layer; it must first be transformed into an object identifier field in the target parameter set through the parameter mapping layer.

[0127] Interception point relocation refers to the process of rearranging the decision label verification nodes, target parameter set verification nodes, and execution permission verification positions in the original permission sandbox model to new critical closure positions based on the newly added or moved preceding satisfying edges in the modified path-level constraint graph. In practice, if the modified path-level constraint graph moves a necessary permission node forward, the corresponding interception point is also moved forward synchronously to ensure that abnormal paths are truncated at an earlier stage. If a field node has been identified as a new risk trigger node, an interception point must be set immediately after it to verify whether the target parameter set still meets the legal field landing point constraints.

[0128] After isolation boundary contraction, cross-layer whitelist pruning, and blocking point relocation, a modified permission sandbox model is formed. Compared with the original permission sandbox model, the modified permission sandbox model has more convergent data transmission between the semantic judgment layer, parameter mapping layer, and execution authorization layer, more controllable cross-layer paths, and makes it more difficult for abnormal paths to penetrate through old boundary vulnerabilities to reach high-risk execution actions.

[0129] Then, the multi-branch verification set is used to re-drive the operation of the modified permission sandbox model. When a high-risk execution action is executed, the target large language model application is output only when the semantic judgment result, the target parameter set, and the execution permission result all meet the preset consistency conditions.

[0130] After obtaining the modified permission sandbox model, it is necessary to re-verify it using a multi-branch verification set to confirm whether the aforementioned modifications have truly eliminated the abnormal propagation caused by risk triggering nodes. In specific implementation, following the original verification order, each verification branch in the multi-branch verification set is re-input into the modified permission sandbox model, and the semantic judgment results output by the semantic judgment layer, the target parameter set output by the parameter mapping layer, and the execution permission results output by the execution authorization layer are recorded respectively.

[0131] This embodiment sets preset consistency conditions to determine whether a high-risk execution action can only be triggered when all three layers are simultaneously met. The preset consistency conditions include three items: The first is a semantic judgment consistency condition, meaning the semantic judgment result must be consistent with the expected judgment label corresponding to the verification branch, and its semantic boundary locking coefficient must not be lower than a first threshold; the second is a parameter mapping consistency condition, meaning the identifiers, source of field values, and field landing paths of each target field in the target parameter set must be consistent with the legal field landing points in the corrected path-level constraint graph, and the parameter landing point offset must not be higher than a second threshold; the third is an execution authorization consistency condition, meaning the execution authorization result must be based on complete coverage of necessary permission nodes and necessary tool nodes, and the authorization closed-loop integrity must not be lower than a third threshold. Only when all three consistency conditions are met simultaneously is a high-risk execution action allowed to be triggered under this verification branch.

[0132] To quantify the verification results, this embodiment defines a triggering consistency function. The triggering consistency function takes a binary value: 1 when all three conditions—semantic judgment consistency, parameter mapping consistency, and execution authorization consistency—are met; otherwise, it takes a value of 0. For all verification branches associated with the same high-risk execution action, the pass rate of the triggering consistency function is calculated. If this pass rate reaches a preset threshold of 0.95 or higher, and there are no unauthorized triggering samples in all high-risk branches, the modified permission sandbox model is considered to have reached a release-ready state. The threshold of 0.95 is determined using historical pre-release verification data to ensure model stability in most perturbation scenarios while reserving space for subsequent iterations on a very small number of uncovered boundaries.

[0133] When the modified permission sandbox model meets the above conditions, the target large language model application is generated based on its final retained semantic judgment layer, parameter mapping layer, and execution authorization layer configuration. The target large language model application refers to an application entity that has completed prompt flow orchestration, field mapping rule solidification, tool call order solidification, and permission boundary solidification, and can be directly deployed and run in the target business scenario. Its output includes at least the modified prompt template, valid field mapping table, tool call whitelist, permission verification path, and corresponding exception blocking rules.

[0134] For example, in a hospital follow-up registration scenario, the original permission sandbox model might allow the expression "help my dad add yesterday's information to his medical record" to continue reaching the medical record writing tool node even when the object ownership is not fully clear. After backtracking the risk trigger node, the "report object confirmation field node" was identified as the risk trigger node, and further abnormal cross-layer edges were found, such as "object ownership labels directly crossing layers to enter the execution authorization layer" and blocking edges where the "authorization relationship establishment permission node" is missing. After strengthening the sequence constraints, rewriting the mutual exclusion constraints, and adding the pre-satisfied edges, the revised path-level constraint graph requires that all proxy data entry paths must first pass through object ownership confirmation, then target parameter set verification, and finally the authorization relationship establishment permission node before reaching the medical record writing tool node. Subsequently, the revised permission sandbox model removed the whitelist channel where object ownership labels directly enter the execution authorization layer and moved the blocking point forward to after the object ownership confirmation field node. After reusing the multi-branch validation set, any branch with unclear object ownership, offset parameter landing points, or incomplete authorization loop will fail to trigger the medical record writing tool node; only branches with clear object ownership, a valid target parameter set, and a valid authorization relationship can generate an allowed execution license result. At this point, the target large language model application can be output.

[0135] Example 2, please refer to Figure 2 As shown in this embodiment, an application construction system based on a large language model includes: Semantic modeling module: Acquire business corpus, tool descriptions, field rules and permission rules in the target application scenario, extract the relationship between user intent, field semantics, tool actions and permission conditions, and construct a scenario semantic association model G; Boundary identification module: Based on G, identify field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences, and generate a semantic conflict boundary set B to represent confusing boundaries; Path constraint construction module: Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, construct a path-level constraint graph R; Permission Sandbox Construction Module: Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established; Perturbation generation module: Based on B injecting counterfactual perturbation samples into W, such as abbreviation replacement, reference inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated; Mismatch detection module: A drives W to run, calculates the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ for each branch, and determines the risk trigger node Q based on the joint mismatch results of η, β, and γ; Constraint Correction and Application Generation Module: Based on Q, reverse correct the path constraints in R and the isolation boundaries in W until high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and output the target large language model application.

[0136] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An application construction method based on a large language model, characterized in that: include: Acquire business corpus, tool descriptions, field rules, and permission rules in the target application scenario; extract the relationships between user intent, field semantics, tool actions, and permission conditions; and construct a scenario semantic association model G. Based on G, identify field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences, and generate a semantic conflict boundary set B to represent confusing boundaries; Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, construct a path-level constraint graph R; Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established; Based on the counterfactual perturbation samples injected by B into W, including abbreviation replacement, reference inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated; Using A to drive W, the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ of each branch are calculated respectively, and the risk triggering node Q is determined based on the joint mismatch results of η, β, and γ. Based on the reverse correction of path constraints in R and isolation boundaries in W according to Q, high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and the output target is the large language model application.

2. The application construction method based on a large language model according to claim 1, characterized in that: Constructing a scene semantic association model G includes the following steps: Obtain business corpus, tool description text, field rule text, and permission rule text from the target application scenario, and perform hierarchical segmentation on the business corpus, tool description text, field rule text, and permission rule text to obtain a set of semantic fragments; Perform terminology normalization, role labeling, and action labeling on the semantic fragment set, and extract user intent items, field semantic items, tool action items, and permission condition items to form a multi-class semantic tuple set; Based on the set of multiple semantic tuples, a directed association edge is established between user intent items and field semantic items, tool action items and permission condition items by adopting cross-sentence reference backfilling and rule trigger chain tracing methods, thus obtaining an initial association network; The initial association network is subjected to conflict boundary weighting and path closure correction to generate a scene semantic association model G that includes semantic triggering relationships, parameter passing relationships, and permission dependency relationships.

3. The application construction method based on a large language model according to claim 1, characterized in that: Based on G, the identification of field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences includes the following steps: Candidate association pairs of shared field semantic items, shared trigger paths, and shared permission entry points are extracted from the scene semantic association model to form candidate field pairs, candidate instruction pairs, and candidate tool pairs; Semantic adjacency calculation and execution consequence difference calculation are performed on candidate field pairs, candidate instruction pairs, and candidate tool pairs respectively, and conflict candidate pairs with semantic adjacency higher than the semantic adjacency threshold and execution consequence difference higher than the execution consequence difference threshold are filtered out. Based on the bifurcation positions of conflict candidate pairs in parameter passing relationships, permission dependency relationships, and tool invocation results, mark the corresponding boundary trigger points and boundary blocking points, and generate a boundary feature chain; Based on the boundary feature chain, the conflict candidate pairs are aggregated and encoded to form the semantic conflict boundary set B.

4. The application construction method based on a large language model according to claim 3, characterized in that: Based on the B filter, the field delivery path and tool call path associated with high-risk actions are determined, including the following steps: Extract boundary units with boundary risk values ​​higher than the boundary risk value threshold from the semantic conflict boundary set, and locate the candidate field transmission path and candidate tool call path associated with high-risk execution actions based on the boundary trigger point, boundary blocking point and applicable tool range corresponding to each boundary unit; Path traversal analysis and node dependency backtracking are performed on the candidate field transmission paths and candidate tool call paths respectively to identify field nodes, permission nodes and tool nodes in each path and generate a path constraint skeleton chain. Based on the path constraint skeleton chain, establish the sequential constraint relationship, mutual exclusion constraint relationship and prerequisite satisfaction relationship between field nodes, permission nodes and tool nodes to form an initial path-level constraint graph. Boundary blocking point closure correction and abnormal cross-edge removal are performed on the initial path-level constraint graph to obtain a path-level constraint graph R used to limit the triggering range of high-risk execution actions.

5. The application construction method based on a large language model according to claim 1, characterized in that: Establish a three-tiered, mutually isolated permission sandbox model W, including the following steps: Based on the sequential constraints, mutual exclusion constraints, and prerequisite satisfaction relationships corresponding to high-risk execution actions in the path-level constraint diagram, the semantic triggering nodes located at the beginning of the path, the field passing nodes located in the middle of the path, and the permission verification nodes located at the end of the path are extracted and mapped to the semantic judgment layer, parameter mapping layer, and execution authorization layer, respectively. Based on the semantic determination layer, parameter mapping layer, and execution authorization layer, independent input boundaries, independent output boundaries, and cross-layer transfer whitelists are defined respectively, forming a unidirectional restricted data transfer relationship between layers; The inter-layer unidirectional restricted data transmission relationship is subjected to blocking point injection and mutual exclusion path closure processing, so that the semantic judgment layer only outputs judgment labels, the parameter mapping layer only receives judgment labels and generates target parameter sets, and the execution authorization layer only generates execution permission results based on the target parameter sets and permission conditions. Based on the three-layer node relationship after blocking point injection and mutual exclusion path closure, a three-layer mutually isolated permission sandbox model W is constructed to limit the triggering conditions of high-risk execution actions.

6. The application construction method based on a large language model according to claim 1, characterized in that: The method for obtaining the semantic boundary locking coefficient η includes the following steps: Based on the decision label sequence, field node sequence and permission node sequence corresponding to each branch in the multi-branch verification set, a branch hyperbolic semantic trajectory is constructed, and the target hyperbolic boundary trajectory is generated according to the center path of each boundary unit in the semantic conflict boundary set. The branch hyperbolic semantic trajectory and the target hyperbolic boundary trajectory are mapped to a preset hyperbolic manifold space, the hyperbolic geodesic distance between them is calculated, and the hyperbolic boundary drift is obtained by combining the curvature offset value of the branch trajectory in the neighborhood of the boundary trigger point. The hyperbolic boundary drift is normalized by performing interval normalization to obtain the normalized hyperbolic boundary drift. The semantic boundary locking coefficient η of each branch is calculated based on the fact that the semantic boundary locking coefficient is equal to 1 minus the normalized hyperbolic boundary drift.

7. The application construction method based on a large language model according to claim 6, characterized in that: The risk triggering node Q is determined based on the joint mismatch results of η, β, and γ, including the following steps: Obtain the semantic boundary locking coefficient, parameter landing point offset, and authorization loop integrity corresponding to each branch, and construct a joint feature sequence consistent with the node order in the path-level constraint graph; Based on the joint feature sequence, the mismatch propagation value and mismatch aggregation value of each node are calculated, and candidate abnormal nodes that simultaneously meet the following conditions are selected: the semantic boundary locking coefficient is lower than the first threshold, the parameter landing point offset is higher than the second threshold, or the authorized closed loop integrity is lower than the third threshold. Perform forward path penetration analysis and backward causal backtracking analysis on the candidate abnormal nodes to identify the key fork nodes where the joint mismatch is first formed and can be propagated to high-risk execution actions; The critical fork node is marked as risk trigger node Q.

8. The application construction method based on a large language model according to claim 1, characterized in that: Based on the reverse correction of path constraints in R and isolation boundaries in W according to Q, the following steps are included: Based on the hierarchical position of the risk triggering node in the path-level constraint graph, the mismatch propagation value, and the mismatch aggregation value, the corresponding abnormal propagation edge, abnormal cross-layer edge, and missing blocking edge are located, and a reverse correction index chain is generated. Based on the reverse correction index chain, sequential constraint reinforcement, mutual exclusion constraint rewriting, and pre-satisfied edge insertion are performed on the path-level constraint graph to obtain the corrected path-level constraint graph. Based on the modified path-level constraint graph, the permission sandbox model is subjected to isolation boundary shrinkage, cross-layer whitelist pruning, and blocking point relocation processing to form a modified permission sandbox model. The operation of the modified permission sandbox model is re-driven by a multi-branch verification set. When a high-risk execution action is executed, the target large language model application is output only when the semantic judgment result, the target parameter set, and the execution permission result all meet the preset consistency conditions.

9. An application construction system based on a large language model, used to implement the application construction method based on a large language model as described in any one of claims 1-8, characterized in that: include: Semantic modeling module: Acquire business corpus, tool descriptions, field rules and permission rules in the target application scenario, extract the relationship between user intent, field semantics, tool actions and permission conditions, and construct a scenario semantic association model G; Boundary identification module: Based on G, identify field pairs, instruction pairs, and tool pairs that are semantically similar but have different execution consequences, and generate a semantic conflict boundary set B to represent confusing boundaries; Path constraint construction module: Based on the field transmission paths and tool call paths associated with high-risk execution actions filtered by B, construct a path-level constraint graph R; Permission Sandbox Construction Module: Based on R, each high-risk execution action is broken down into a semantic judgment layer, a parameter mapping layer, and an execution authorization layer, and a three-layer mutually isolated permission sandbox model W is established; Perturbation generation module: Based on B injecting counterfactual perturbation samples into W, such as abbreviation replacement, reference inheritance, order reversal, and correction of interruptions, a multi-branch verification set A is generated; Mismatch detection module: A drives W to run, calculates the semantic boundary locking coefficient η, parameter landing point offset β, and authorized closed loop integrity γ for each branch, and determines the risk trigger node Q based on the joint mismatch results of η, β, and γ; Constraint Correction and Application Generation Module: Based on Q, reverse correct the path constraints in R and the isolation boundaries in W until high-risk execution actions can only be triggered when semantic determination, parameter mapping and execution authorization are satisfied simultaneously, and output the target large language model application.

Images