A logic-coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents

Abstract

This application relates to the field of artificial intelligence security technology, and in particular to a logic coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents. The method includes the following steps: constructing a task intent space from natural language instructions; acquiring historical test information to obtain a policy state representation vector; inputting the policy state representation vector into an adversarial testing policy network, selecting a mutation operator, and calling a large language model for semantic reconstruction to obtain a mutation sample vector; inputting the mutation sample vector into the intelligent agent to obtain the hidden layer activation representation and intermediate inference states of the tested intelligent agent during inference, and calculating the logic branch coverage rate; performing satisfaction verification on the inference trajectory based on preset security compliance conditions, and calculating the manifold distance of the latent variable distribution relative to the security boundary; constructing a multi-objective composite reward function to obtain a reward signal, feeding it back to the adversarial testing policy network, and iteratively generating new mutation samples.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, and in particular to a logic overlay-driven vulnerability detection method for multimodal interaction links of intelligent agents. Background Technology

[0002] With the rapid development of Large Language Models (LLMs), intelligent agent systems built upon them have been widely applied in complex task automation scenarios. However, intelligent agents face significant inherent security risks during long-range reasoning, tool invocation, and autonomous decision-making. Existing technologies mainly include traditional fuzzing, deep learning model testing, and cue word security detection, but these have many problems. For example, traditional fuzzing lacks semantic understanding capabilities, cannot penetrate high-dimensional semantic spaces, coverage metrics cannot reflect the sufficiency of cognitive logic under black-box conditions, lacks the ability to monitor dynamic drift in long-range reasoning, lacks mutation operators targeting agent-specific vulnerabilities, and has low detection efficiency in non-deterministic environments. Therefore, there is an urgent need for an intelligent agent vulnerability detection method that can quantify cognitive logic coverage and guide semantic detection. Summary of the Invention

[0003] This disclosure is provided to briefly introduce the concepts, which will be described in detail in the subsequent Detailed Description section. This disclosure is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] To address the aforementioned issues, this invention provides a logic coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents. By constructing a closed-loop detection mechanism of "modeling-quantification-optimization," it achieves efficient and accurate discovery of deep cognitive logic vulnerabilities in intelligent agents.

[0005] This invention provides a method for detecting logical overlay-driven vulnerabilities in a multimodal interaction link of an intelligent agent, specifically including the following steps:

[0006] Semantic parsing is performed on the input natural language instructions to extract target, constraint and tool call information, construct structured triple vectors, construct task intent space based on the structured triple vectors, and map the task intent space to a discrete finite-state machine (DFSM), wherein the DFSM includes at least multiple state nodes, state transition branches and triggering conditions corresponding to each state transition branch;

[0007] Historical test information is obtained and jointly encoded with the structured triple vector to obtain the policy state representation vector;

[0008] The policy state representation vector is input into an adversarial test policy network constructed based on the Proximal Policy Optimization (PPO) algorithm. The adversarial test policy network selects mutation operators and corresponding perturbation strength parameters from a preset multidimensional semantic mutation operator library. Based on the selected mutation operators and perturbation strength parameters, it calls a large language model to perform semantic reconstruction on the natural language instruction, generates mutation samples, and vectorizes the mutation samples to obtain mutation sample vectors.

[0009] The mutated sample vector is input into the tested agent to obtain the hidden layer activation representation and intermediate inference state of each inference node of the tested agent in real time during the inference process.

[0010] Based on the hidden layer activation representation, the entropy value of the output probability distribution of the current inference node to the candidate state transition branch is calculated. The cognitive state of the inference node is determined according to the entropy value, and the sampling weight of the candidate state transition branch is adjusted.

[0011] Simultaneously, based on the intermediate inference state, an inference trajectory is constructed in chronological order, and the inference trajectory is mapped to the DFSM. Activated state nodes and state transition branches are identified, and the Logic Branch Coverage (LBC) is calculated.

[0012] Obtain the dataset of safe execution trajectories of the agent under normal task execution conditions, vectorize the safe execution trajectories and input them into the Variational Autoencoder (VAE) for training, construct the probability distribution model of the safe execution trajectory in the latent space of the VAE, and construct the safe boundary of the agent in the latent space based on the probability distribution model.

[0013] Based on preset security compliance rules, a linear temporal logic (LTL) formula is constructed to verify the satisfaction of the inference trajectory;

[0014] The inference trajectory is then input into the trained VAE to obtain the corresponding latent variable distribution, and the manifold distance d_m of the latent variable distribution relative to the safety boundary is calculated.

[0015] When the reasoning trajectory does not satisfy the LTL formula and d_m is greater than the preset second threshold, it is determined that the reasoning trajectory has a logical cognitive loophole.

[0016] The probability distribution distance between the inference trajectory and the security boundary is calculated based on the Kullback-Leibler (KL) divergence. The KL divergence, the increment of the LBC relative to historical tests, and the judgment result of the logical cognition vulnerability are used to construct a multi-objective composite reward function to obtain a reward signal R. The reward signal R is fed back to the adversarial testing strategy network to update the mutation operator selection strategy and perturbation strength parameters, and new mutation samples are generated iteratively.

[0017] Furthermore, the formula for calculating the logical branch coverage is as follows:

[0018]

[0019] Where N is the task intent space The total number of semantic primitives deconstructed; Activate the indicator function for the node; Representing the task intent space The activation state of semantic primitive nodes in the middle, where H is the prediction entropy mapped from the activation representation of the hidden layer. It is a dynamic weighting factor based on entropy.

[0020] Furthermore, the multi-objective composite reward function is:

[0021]

[0022] in, These are the dynamically adjustable hyperparameters. The semantic deviation reward is ΔLBC, and the coverage increment reward is ΔLBC. R is the reward signal for determining rewards based on violations;

[0023] The semantic deviation reward The distance between the inference trajectory and the security boundary is determined by the probability distribution.

[0024] The coverage increment reward The LBC is determined by the real-time increment between the LBC of the previous test round;

[0025] The violation identification reward It is determined by the judgment result of the aforementioned logical cognitive vulnerability.

[0026] Furthermore, the step of "determining the cognitive state of the current inference node based on the entropy value and adjusting the sampling weights of the candidate state transition branches" includes:

[0027] When the entropy value of the inference node is greater than a preset first threshold, it is determined that the current inference node is in a state of cognitive ambiguity, and the sampling weight of the candidate state transition branch corresponding to the inference node is increased.

[0028] When the entropy value is not greater than a preset first threshold, the inference node is determined to be in a normal cognitive state, and the sampling weight of the candidate state transition branch is maintained or reduced.

[0029] Furthermore, the preset multidimensional semantic variation operator library includes at least: cognitive constraint-induced operators, complex logical paradox operators, and temporal and environmental evolution operators.

[0030] Furthermore, the historical test information includes state coverage information and historical test feedback information. The state coverage information includes at least: activation information of each semantic state node, triggering information of state transition branches, and corresponding coverage statistics. The historical test feedback information includes at least inference trajectory features generated during historical testing, coverage change information, and anomaly judgment results.

[0031] Furthermore, the phrase "semantically parsing the input natural language instructions and converting them into structured triple vectors containing the target, constraints, and tool calls" includes:

[0032] The natural language instructions are semantically labeled, and the target information, constraint information and tool call information in the instructions are extracted. The target information, constraint information and tool call information are then vectorized and encoded to obtain the corresponding structured triple vector.

[0033] Furthermore, the cognitive constraint-induced operators include at least: role constraint dilution operator, authority instruction masquerading operator, sympathy-induced hijacking operator, and covert multi-step redirection operator;

[0034] The complex logical paradox operators include at least: logical self-consistency provocation operator, recursive logic trap operator, counterfactual premise injection operator, and conditional dependency conflict operator;

[0035] The time-series and environmental evolution operators include at least: time-series recursive reversal operator, environmental feedback spurious pollution operator, long context attention hijacking operator, and multimodal logic mismatch operator; and each operator corresponds to a parameterized perturbation intensity.

[0036] Furthermore, the formula for calculating the manifold operator d_m is:

[0037]

[0038] in, In the high-dimensional decision vector space, f(x) represents the manifold distance between the current inference trajectory point x and the target safe state (or reference point) y; f(x) and f(y) represent the state transition functions. Represents the continuous-time path integral. These are higher-order operator symbols, representing correction factors for the curvature of the decision manifold or the direction of the geodesics. This represents the discretized representation of the distance in actual calculations.

[0039] The logic coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents disclosed in this invention transforms natural language instructions into structured triple vectors by modeling the task intent space. It then introduces manifold evolution dynamics theory to construct semantic security boundaries, enabling quantifiable representation of long-range thought chain reasoning trajectory deviations. Furthermore, by constructing a logic branch coverage (LBC) index, it maps hidden features in the agent's reasoning process to state transition branches of a discrete finite state machine (DFSM), achieving structured coverage analysis of the reasoning path execution. Combined with prediction entropy, it identifies uncertainties in the reasoning process, thereby improving the observability and measurability of the agent's reasoning process in a black-box environment. This represents a paradigm shift from "code path coverage" to "cognitive logic coverage," providing physically meaningful test criteria for agent security assessment. Simultaneously, by constructing a multidimensional semantic mutation operator library and combining it with an adversarial strategy generation mechanism, it generates diverse test samples while maintaining the consistency of task semantic goals. Compared to random mutation methods, this improves the ability to explore complex semantic decision boundaries and abnormal behavior triggering conditions. Furthermore, an adversarial detection engine was developed based on the Proximal Policy Optimization (PPO) algorithm. A multi-objective composite reward function was designed, comprehensively considering feedback logic branch coverage, uncertainty measurement, and anomaly detection results. This dynamically balances the breadth, depth, and accuracy of detection, achieving adaptive optimization of the testing strategy and improving the exploration efficiency in high-dimensional semantic spaces. Through the above technical solutions, this invention achieves structured modeling, observable analysis, and adaptive adversarial testing of the multimodal inference chain of intelligent agents, significantly improving the security assessment capability and vulnerability detection efficiency of complex intelligent agent systems in a black-box environment. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating the logic coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents disclosed in the embodiments of the present invention.

[0041] Figure 2 This is a schematic diagram illustrating the principle of logic branch coverage growth and manifold distortion detection vulnerability disclosed in the embodiments of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0043] like Figure 1 As shown, S1: Semantically parse the natural language instructions input by the user and convert them into structured triple vectors containing objectives, constraints and tool calls. Construct a task intent space and a corresponding finite state machine (DFSM) based on the triple vectors. The DFSM includes at least multiple state nodes, state transition branches and triggering conditions corresponding to each state transition branch.

[0044] In one embodiment of the present invention, the input natural language instructions are subjected to structured semantic parsing and task intent modeling to construct a task intent space and discrete finite state machine model that can be used for subsequent reasoning path analysis.

[0045] Specifically, the system acquires natural language commands input by the user and performs semantic parsing on these commands to extract semantic elements related to task execution. These semantic elements include at least target information, execution constraint information, and tool invocation information. The target information characterizes the core task semantics that the user expects the agent to complete; the constraint information characterizes the safety rules, logical restrictions, or resource limitations that must be met during task execution; and the tool invocation information characterizes the types of external tools or interfaces that the agent can invoke during task execution. Based on the extracted target information, constraint information, and tool invocation information, the system performs structured encoding to form a triplet semantic representation vector g. i :

[0046] g i =(G i C i T i )

[0047] Among them, g i Let G represent the triple vector corresponding to the i-th semantic state. i The target vector represents the target semantics of task execution; C i T represents a constraint vector, used to characterize the rules or restrictions that must be met during task execution; i This represents a tool invocation vector, used to characterize the external tools or resources that an agent can invoke during execution.

[0048] A task intent space is constructed based on the aforementioned triple vectors to uniformly represent the semantic states involved by the agent during task execution and the state transition relationships between them. The task intent space is represented as follows:

[0049] G cog = (V, E)

[0050] in Represents the task intent space, V={g1,g2,…,g n} represents the set of semantic state nodes composed of the triple vectors, and E represents the set of state transition relations, which is used to characterize the reasoning path or dependency relationship between each semantic state.

[0051] Based on this, the task intent space is mapped to a discrete finite state machine to characterize the state evolution process during the execution of a task by an intelligent agent. This can include: multiple state nodes to represent different task execution stages or semantic intent states; multiple state transition branches to represent the transition paths between different states; and triggering conditions corresponding to each state transition branch to trigger state transitions based on semantic changes in input instructions, tool invocation behavior, or constraint satisfaction.

[0052] Furthermore, the state evolution process of the DFSM is formally modeled, and a semantic state vector S is defined in the task intent space. t , used to characterize the reasoning state of the agent at time t, and satisfying S t ∈V, and define the state transition function f:

[0053] S t+1 =f(S t G cog )

[0054] Wherein, the state transition function f is based on the current task intent space. and the semantic state vector S at the current moment t As input, output the semantic state vector S for the next time step. t+1The state transition function is used to characterize the state evolution process of the agent during reasoning. By iteratively calculating the state transition function, a state transition trajectory is obtained, which is formed by multiple semantic state vectors sequentially over time. This trajectory characterizes the agent's reasoning path during task execution, achieving formal modeling of the agent's long-range reasoning process. A Transformer is used to extract features from the agent's contextual information, historical memory information, and tool call states, resulting in a high-dimensional heterogeneous feature representation. Principal Component Analysis (PCA) and an autoencoder are then used for joint dimensionality reduction and nonlinear representation learning, mapping these high-dimensional heterogeneous features to a unified low-dimensional decision vector space. In this decision vector space, the agent's global state information at time t is uniformly encoded and mapped into a state vector, representing the agent's dynamic changes during task execution as a continuous trajectory motion in space.

[0055] In the embodiments described in this invention, the semantic parsing method can be implemented using semantic role labeling (SRL), ontology modeling, or other semantic understanding methods; the state transition function f can be implemented based on a rule matching mechanism or a learning policy model.

[0056] This step transforms natural language instructions into a state machine model with clear structural constraints, providing a formalized basis for task intent representation in subsequent adversarial testing and vulnerability detection based on turntable path analysis.

[0057] S2: Obtain historical test information and encode it with the triplet vector to obtain a policy state representation vector; input the policy state representation vector into an adversarial test policy network constructed based on the near-end policy optimization (PPO) algorithm; the adversarial test policy network selects mutation operators and corresponding perturbation strength parameters from a preset multidimensional semantic mutation operator library; based on the selected mutation operators and perturbation strength parameters, it calls a large language model to perform semantic reconstruction on the natural language instructions to generate mutation samples; and it vectorizes and encodes the mutation samples to obtain a mutation sample vector.

[0058] In one embodiment of the present invention, the historical test information is used to characterize the behavioral features and coverage of the tested intelligent agent during the historical test process, and serves as important input information for the generation of subsequent adversarial test strategies.

[0059] As an example, the historical test information may include state coverage information and historical test feedback information. The state coverage information characterizes the extent to which test samples explore the task intention space in the current test round. Specifically, by mapping the inference trajectory generated during the current test to a pre-constructed discrete finite state machine, activated semantic state nodes and triggered state transition branches are identified to obtain state coverage information and corresponding coverage statistics. These coverage statistics quantify node coverage, branch coverage, and their distribution. The historical test feedback information characterizes the reasoning behavior and abnormal performance of the tested agent during historical tests. It may include: inference trajectory features generated during historical tests, coverage change information between different test rounds, abnormal judgment results based on preset security compliance requirements or security boundaries, and reward signals. The inference trajectory features can be obtained by vectorizing the intermediate state sequence during the inference process.

[0060] Based on the DFSM, the state coverage information obtained in the current test round includes at least: activation information of each semantic state node, triggering information of state transition branches, and corresponding coverage statistics, which are used to characterize the degree of exploration of the task intent space by the current test sample; the historical test feedback information may include inference trajectory features, coverage change information, and anomaly judgment results generated during the historical test process.

[0061] The state coverage information and the historical test feedback information are structured and stored, and then jointly encoded with the structured triple vector corresponding to the current input instruction obtained in the preceding steps to construct the state input of the adversarial testing strategy network. This input guides subsequent test samples to be generated in areas with insufficient coverage or potential risks. The joint encoding can employ conventional encoding methods such as vector concatenation to represent information from different sources in a unified vector space. It should be noted that the strategy state representation vector is generated based on feedback information from at least one historical test round, representing the overall state of the current adversarial testing environment. After each test round, the strategy state representation vector is updated based on the latest obtained state coverage information and test feedback results, enabling dynamic adjustment of subsequent test strategies.

[0062] The policy state representation vector is input into an adversarial test policy network constructed based on a near-end policy optimization algorithm. The policy network selects mutation operators and corresponding perturbation strength parameters from a preset multidimensional semantic mutation operator library. The multidimensional semantic mutation operator library is used to describe different types of semantic perturbation methods, including but not limited to role remapping, constraint weakening, tool replacement, and context extension.

[0063] After obtaining the selected mutation operator and perturbation strength parameters, the original natural language instructions are semantically reconstructed by calling a Large Language Model (LLM) to generate mutated samples. Specifically, the LLM adjusts the target expression, constraints, or tool invocation methods in the original natural language instructions according to the semantic transformation rules defined by the selected mutation operator and the corresponding perturbation strength parameters, generating adversarial test samples with differentiated semantic features, i.e., mutated samples. The generated mutated samples are then vectorized to obtain the corresponding mutated sample representation vector.

[0064] This step enables the adaptive generation of diverse semantic variant samples based on reinforcement learning strategies within the DFSM-constrained task intent space, providing effective input data support for subsequent logical branch coverage analysis and vulnerability detection.

[0065] S3: Input the mutated sample vector into the tested agent, and obtain the hidden layer activation representation and intermediate inference state of each inference node of the tested agent in real time during the inference process; based on the hidden layer activation representation, calculate the output probability distribution entropy value of the current inference node to the candidate state transition branch, determine the cognitive state of the inference node according to the entropy value, and adjust the sampling weight of the candidate state transition branch; at the same time, based on the intermediate inference state, construct the inference trajectory in chronological order, map the inference trajectory to the DFSM, identify the activated state nodes and state transition branches, and calculate the logical branch coverage.

[0066] In one embodiment of the present invention, the vectorized and encoded variant sample representation vector is input to the tested intelligent agent. During the execution of the reasoning task, each reasoning stage is monitored in real time to obtain the hidden layer activation representation and intermediate reasoning state data of the corresponding reasoning node, and to complete uncertainty assessment and logical branch coverage analysis.

[0067] As an example, the hidden layer activation representation is used to characterize the internal semantic representation distribution of the agent at the current inference node, and the intermediate inference state is used to record the context information and state transition of each stage in the inference process.

[0068] Based on the hidden layer activation representation, the output probability distribution of the current inference node on the candidate state transition branch is calculated, and the corresponding prediction entropy value H is obtained, which characterizes the decision uncertainty of the inference node. According to the comparison structure between the entropy value and a preset first threshold, the cognitive state of the current inference node is determined, and the sampling weight of the candidate state branch is adjusted accordingly. Adaptive adjustments are made to enhance the ability to explore regions with high uncertainty.

[0069] Based on the intermediate inference state, the semantic representations corresponding to each inference step are extracted in chronological order, and a complete inference trajectory is constructed. Semantic mapping is performed on each inference step in the inference trajectory, and it is matched to the set of semantic state nodes in the task intent space constructed in step S1 to obtain the corresponding state transition path. Based on the state transition path, the activated state nodes and triggered state transition branches in the DFSM are identified. On this basis, the coverage of each node and branch is statistically analyzed, and the LBC is calculated to quantify the degree of exploration or traversal of the task intent space by the current test sample.

[0070] After each test round, the activation information of the state nodes, the triggering information of the state transition branches, and the corresponding coverage statistics obtained in this test round are used as historical test state coverage information and sent back to step S2 to update the policy state representation vector, thereby realizing iterative optimization of the adversarial testing process.

[0071] S4: Obtain a dataset of safe execution trajectories of the agent under normal task execution conditions, vectorize the safe execution trajectories and input them into a variational autoencoder (VAE) for training, construct a probability distribution model of the safe execution trajectory in the latent space of the VAE, and construct the safe boundary of the agent in the latent space based on the probability distribution model.

[0072] In one embodiment of the present invention, the reasoning characteristics of the tested intelligent agent under normal task execution conditions are modeled, and a safe boundary of the latent space for anomaly detection is constructed based on the Dynamic Manifold Evolution Theory (DMET).

[0073] Specifically, a dataset of safe execution trajectories of an intelligent agent under normal task execution conditions is obtained. Each trajectory in the dataset represents a state transition sequence composed of multiple semantic state vectors arranged in chronological order, i.e., a state transition trajectory. These state transition trajectories are vectorized and encoded, mapping them to high-dimensional feature vectors, which serve as input data for a variational autoencoder (VAE). The VAE model is trained by minimizing reconstruction error and KL divergence to learn the behavioral distribution characteristics of normal execution trajectories in the latent space. Specifically, the VAE maps the input high-dimensional feature vectors to the latent variable distribution in the latent space through the encoder, and then reconstructs the trajectory based on the latent variable distribution through the decoder, obtaining a latent space probability distribution model representing normal reasoning behavior. Through training the VAE, it learns the distribution characteristics of normal execution trajectories in the latent space, achieving the formation of continuous and structurally smooth low-dimensional manifold trajectories in the latent space. The safe execution trajectory dataset can originate from historical real business interaction data, manually constructed compliant task sample execution results, or standard reasoning path data that has been verified to meet preset security rules.

[0074] The trained VAE is then applied to the secure execution trajectory dataset. Diffusion Geometry (DG) modeling is performed on the representation of the secure execution trajectory data in the latent space to extract the geometric structure of the low-dimensional manifold trajectory. Based on the geometric structure, the manifold boundary (MB), i.e. the security boundary, is defined to characterize the distribution range of the agent's reasoning trajectory under normal semantics and cognitive logic.

[0075] Furthermore, the security boundary can be determined by setting a probability density threshold for the distribution of latent variables in the latent space or based on the reconstruction error range. In subsequent testing, the inference trajectory is mapped to the latent space, and by judging its positional relationship and deviation from the security boundary, the abnormal inference behavior and cognitive logic vulnerabilities can be identified and judged.

[0076] The above method enables the distribution modeling of the normal behavior pattern of the intelligent agent, providing a basis for subsequent detection of logical cognitive anomalies based on the deviation level of the latent space. It is also organically combined with the reasoning trajectory and coverage information obtained in step S3 to improve the accuracy and robustness of vulnerability detection.

[0077] S5: Construct a linear time-series logic formula based on preset security compliance rules, and perform satisfaction verification on the inference trajectory; input the inference trajectory into the trained VAE to obtain the corresponding latent variable distribution, and calculate the manifold distance d_m of the latent variable distribution relative to the security boundary; when the inference trajectory does not satisfy the LTL formula and d_m is greater than the preset second threshold, it is determined that the inference trajectory has a logical cognition vulnerability.

[0078] In one embodiment of this invention, based on the constraint information extracted in step S1 and combined with pre-defined security compliance rules, the task constraints corresponding to natural language instructions are formally modeled and transformed into LTL formulas. The LTL formulas are used to formally model the temporal constraint relationships and security constraint components in the agent's reasoning process, representing the logical consistency requirements and secure execution rules that should be met during reasoning. Specifically, the logical failure modes shown in Table 1 are converted into corresponding LTL constraint violation conditions. When the reasoning trajectory violates the temporal logical constraints or security constraints defined by the LTL formula during state transition, a logical failure is determined to be triggered, thereby realizing the formal expression and computational determination of potential threatening behaviors under complex semantic conditions. The LTL formulas can be constructed using conventional methods such as rule mapping or automatic generation methods based on semantic parsing.

[0079] Table 1: Five Novel Cognitive Logic Vulnerabilities in Intelligent Systems

[0080]

[0081] Furthermore, based on the LTL formula, the satisfaction verification of each inference step in the intermediate inference state sequence is performed to determine whether the inference process violates the task constraints or security rules. Simultaneously, the inference trajectory constructed in step S3 is input into the VAE trained in step S4 to obtain the corresponding latent variable distribution. Based on the latent variable distribution, its deviation from the security boundary is calculated, i.e., the manifold operator d_m in integral form is calculated, and deviation quantification is performed by accumulating the path integral of the state deviation norm during the inference process. When the inference trajectory violates the LTL formula and its latent variable distribution deviation d_m from the security boundary exceeds a preset second threshold, it is determined that the inference trajectory has a logical cognitive vulnerability.

[0082] The steps combine rule-based formal verification with an anomaly detection mechanism based on data distribution to achieve a two-dimensional, joint judgment of the agent's reasoning behavior, thereby improving the accuracy and stability of vulnerability detection and providing a reliable basis for subsequent policy optimization based on reinforcement learning.

[0083] S6: Calculate the probability distribution distance between the inference trajectory and the security boundary based on KL divergence, and construct a multi-objective composite reward function together with the KL divergence, the increment of the LBC relative to historical tests, and the judgment result of the logical cognition vulnerability to obtain the reward signal R. Feed the reward signal R back to the adversarial testing strategy network to update the mutation operator selection strategy and perturbation strength parameters, and iteratively generate new mutation samples.

[0084] In one embodiment of the present invention, based on the latent variable distribution of the inference trajectory and the safety boundary obtained in step S4, the probability distribution distance of the latent variable distribution relative to the safety boundary is calculated. Specifically, the probability distribution distance is measured by KL divergence and is used to characterize the degree of anomalousness of the current inference trajectory relative to the safety trajectory distribution.

[0085] Based on the KL divergence, combined with the LBC increment in the current test round relative to the previous round obtained in step S3, and the judgment result of logical cognitive vulnerabilities obtained in step S5, a multi-objective reward signal R is constructed. The reward signal R is used to comprehensively reflect the performance of the test sample in multiple dimensions such as coverage exploration capability, semantic anomaly degree, and security violation degree.

[0086] In one embodiment provided by the present invention, the reward signal R can be represented as:

[0087]

[0088] in, For semantic deviation rewards, To cover incremental rewards, To determine rewards in violation of regulations, These are the dynamically adjustable hyperparameters.

[0089] The reward signal R is fed back to the adversarial testing network constructed based on the PPO algorithm in step S2 to adaptively update the mutation operator selection strategy and perturbation strength parameters. Specifically, the adversarial testing strategy network updates the policy function according to the reward signal R, increasing the probability distribution weights of selecting mutation operators that can trigger high logical branch coverage, high risk exposure probability, and potential abnormal inference paths during subsequent decision-making processes.

[0090] In subsequent test rounds, mutated samples are regenerated based on the updated adversarial testing strategy network, i.e., steps S2 to S6 are repeated, thus forming a closed-loop iterative process of "sample generation, execution feedback, anomaly detection, and strategy optimization," enabling continuous exploration and discovery of agent vulnerabilities. By unifying logic coverage analysis, formal verification, and latent space anomaly detection results into a reinforcement learning optimization framework, the adversarial testing strategy can adaptively focus on high-risk paths, thereby significantly improving the efficiency and accuracy of vulnerability detection.

[0091] The vulnerability detection method provided by this invention enhances the ability to target and induce deep logic vulnerabilities by combining a semantic mutation strategy based on a large language model, and achieves quantitative evaluation of cognitive decision-making logic by combining logical branch coverage. Simultaneously, by constructing a latent space security boundary, it transforms inference trajectory deviation into measurable distributional deviation, thereby improving the accuracy and reliability of agent security assessment in complex interaction scenarios. Furthermore, it utilizes a multi-objective composite reward mechanism based on PPO, integrating KL divergence, coverage increment, and vulnerability determination results to achieve synergistic optimization of detection breadth, depth, and accuracy, thus significantly improving the overall accuracy and robustness of security assessment.

[0092] In the embodiments provided by this invention, the calculation formula for LBC is:

[0093]

[0094] A coverage evaluation metric, LBC, adapted to cognitive logic, is established to quantify the sufficiency of testing in a black-box environment. LBC monitors the hidden layer activation representation in real time and maps it to a prediction entropy value H. This LBC is used to characterize the uncertainty distribution during the agent system's re-decision process, thereby identifying ambiguous and sensitive regions in the decision-making logic and establishing the correspondence between the hidden layer's micro-states and macro-logical branches. Here, N represents the task intent space. The total number of semantic primitives deconstructed ActivatedNodes is the node activation indicator function. i Representing the task intent space The activation state of semantic primitive nodes is used as input to the indicator function to determine whether the corresponding semantic primitive node is triggered or traversed in the current inference trajectory, thereby characterizing the coverage of preset logical nodes in the task intent space by the agent's inference trajectory. By statistically analyzing and measuring the traversal degree of each semantic primitive node, a quantitative assessment of test sufficiency is achieved, thus solving the problem of difficulty in quantifying test coverage depth in a black-box environment. It is a dynamic weighting factor based on entropy. When the predicted entropy H suddenly increases or becomes high, it indicates that the agent is in a state of high uncertainty or cognitive ambiguity. At this time, the corresponding branch weight increases accordingly to guide the detection process to focus on exploration and in-depth mining in the high uncertainty region.

[0095] In one embodiment provided by the present invention, the multi-objective composite reward function is:

[0096]

[0097] in, These are the dynamically adjustable hyperparameters. For semantic deviation rewards, To cover incremental rewards, R is the reward signal for determining the reward based on violations.

[0098] The multi-objective composite reward function is used to constrain and guide policy updates during reinforcement learning, and includes at least the following three sub-reward items:

[0099] The semantic deviation reward The distance between the probability distribution of the inference trajectory and the safety boundary is determined and used to characterize the distribution difference between the current inference trajectory and the baseline safety boundary. KL divergence is used to measure the probability distribution distance between the two to guide the detection process to extend to unexpected decision branches, thereby improving the coverage of abnormal paths.

[0100] The coverage increment reward The LBC is determined by the real-time increment of the previous test. The real-time increment of the LBC of the current reasoning trajectory and the LBC of the previous test is used as a reward signal to characterize the change in the activation degree of uncovered semantic nodes in the cognitive graph. By maximizing the activation coverage of unreached nodes, the exploration of logical branch boundaries in the high-dimensional semantic space is realized, thereby improving the ability to mine deep reasoning paths.

[0101] The violation identification reward The result of the judgment of the aforementioned cognitive vulnerability is used to judge the current sample based on whether the reasoning trajectory triggers a preset security boundary, and to assign a corresponding reward weight when a risk is triggered, so as to enhance the ability to identify logical drift paths, thereby increasing the feedback strength to real vulnerability samples. Specifically, when a cognitive logic vulnerability is triggered, the following will be used: To assign high weights, the settings can be adjusted according to the testing environment. =1, to significantly enhance the algorithm's ability to identify logical drift paths, ensuring that reinforcement learning can accurately pinpoint real logical vulnerabilities.

[0102] In step S3, "determining the cognitive state of the current inference node based on the entropy value and adjusting the sampling weight of the candidate state transition branch" includes: when the entropy value of the inference node is greater than a preset first threshold, determining that the current inference node is in a state of cognitive ambiguity and increasing the sampling weight of the candidate state transition branch corresponding to the inference node; when the entropy value is not greater than the preset first threshold, determining that the inference node is in a state of normal cognition and maintaining or reducing the sampling weight of the candidate state transition branch.

[0103] In one embodiment of the present invention, the preset first threshold is used to distinguish between the high uncertainty state and the stable decision state of the inference node, and its specific value can be determined based on the entropy distribution in historical inference data. Statistical analysis can be performed on the entropy values ​​of the inference node under normal task execution conditions, and the linear combination of its mean and standard deviation, or a preset quantile can be used as the preset first threshold, to achieve adaptive determination of cognitive ambiguity states.

[0104] The pre-defined multidimensional semantic variation operator library includes at least cognitive constraint-induced operators, complex logical paradox operators, and temporal and environmental evolution operators.

[0105] The cognitive constraint-induced operators include at least: role constraint dilution operator, authority instruction disguise operator, sympathy-induced hijacking operator, and hidden multi-step redirection operator; the complex logic paradox operators include at least: logical self-consistency provocation operator, recursive logic trap operator, counterfactual premise injection operator, and conditional dependency conflict operator; the temporal and environmental evolution operators include at least: temporal recursion reversal operator, environmental feedback false pollution operator, long context attention hijacking operator, and multimodal logic mismatch operator; and each operator corresponds to a parameterized perturbation intensity.

[0106] In one embodiment of this invention, a multi-dimensional semantic mutation operator library driven by a Mentor-LLM (Mentor-LLM) is constructed to address at least five novel cognitive logic vulnerabilities, as shown in Table 1: intent hijacking, role conflict, recursive logic collapse, logical loop failure, and cross-modal semantic mismatch. The operator library contains at least three operator types: cognitive constraint induction, complex logical paradox, and temporal and environmental evolution. Each operator type corresponds to multiple operators, as shown in Table 2, and each operator corresponds to a parameterized perturbation intensity.

[0107] Table 2: 12 semantic mutation operators

[0108]

[0109] By establishing the aforementioned operator library, a precise logical mapping from tool mutation to vulnerability mechanisms is achieved. By utilizing a large language model to execute these operators, precise perturbations are applied at high-entropy decision-making critical points while maintaining the core semantic framework of the original task intent, inducing the agent to exhibit premature logical deviations. For example, role-related operators trigger role conflicts through vector space weight perturbations, while logic-related operators induce logical collapse or loop failure by disrupting the consistency of long-range reasoning. This operator library, customized based on vulnerability mechanisms, ensures that the PPO reinforcement learning engine possesses clear vulnerability targeting when exploring high-dimensional semantic spaces, effectively solving the problem of low detection efficiency caused by blind mutation in black-box testing.

[0110] The step S1, "semantically parsing the input natural language instructions and converting them into structured triple vectors containing objectives, constraints, and tool calls," includes: semantically labeling the natural language instructions, extracting the objective information, constraint information, and tool call information from the instructions, and vectorizing the objective information, constraint information, and tool call information to obtain the corresponding structured triple vectors.

[0111] The formula for calculating the manifold operator d_m is:

[0112]

[0113] in, denoted as the manifold distance between the current inference trajectory point x and the target safe state (or reference point) y in the high-dimensional decision vector space; f(x) and f(y) represent state transition functions used to map semantic states to coordinate vectors in the decision space; It represents the continuous-time path integral, which indicates that the manifold distance is not a simple straight-line distance between two points, but rather the accumulation of trajectory weights during the agent's long-range thought chain reasoning process; It is a higher-order operator symbol that represents a correction factor for the curvature of the decision manifold or the direction of the geodesic, ensuring that the distance calculation conforms to the nonlinear characteristics of the safety boundary; This represents the discretized representation of the distance in actual calculations.

[0114] like Figure 2 As shown, in the task intent space, when a specific logical branch is activated and accompanied by a manifold distortion peak, it is determined to be a trigger of a cognitive logic vulnerability.

[0115] The method disclosed in this invention can utilize an audit agent independent of the tested intelligent agent to achieve non-intrusive security monitoring and compliance determination of the agent's inference process. The audit agent is logically or physically decoupled from the tested intelligent agent, does not participate in the agent's forward inference computation, and only acquires intermediate state information during model operation through bypass data acquisition. The hidden layer activation representation and Logits probability distribution sequence during the large language model inference process are acquired through bypass monitoring, and corresponding inference trajectory data is constructed. This inference trajectory is mapped to a preset security semantic state space, constructing a structured decision graph. The logical branch coverage rate of the current inference path in the security state tree is calculated to assess the semantic deviation of the current inference process from the original task instruction. When the logical branch coverage rate is lower than a preset threshold, it is determined that the current inference process has potential semantic drift or security risks, and information feedback is provided to enable the intelligent agent to adaptively update, thus achieving full-link bypass security auditing of the intelligent agent's operation process.

[0116] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A logic coverage-driven vulnerability detection method for multimodal interaction links of intelligent agents, characterized in that, include: Semantic parsing is performed on the input natural language instructions to extract target, constraint and tool call information, construct structured triple vectors, construct task intent space based on the structured triple vectors, and map the task intent space to a discrete finite state machine, wherein the discrete finite state machine includes at least multiple state nodes, state transition branches and triggering conditions corresponding to each state transition branch; Historical test information is obtained and jointly encoded with the structured triple vector to obtain the policy state representation vector; The policy state representation vector is input into the adversarial test policy network constructed based on the near-end policy optimization algorithm. The adversarial test policy network selects mutation operators and corresponding perturbation strength parameters from a preset multi-dimensional semantic mutation operator library. Based on the selected mutation operators and perturbation strength parameters, it calls a large language model to perform semantic reconstruction on the natural language instruction, generates mutation samples, and vectorizes the mutation samples to obtain mutation sample vectors. The mutated sample vector is input into the tested agent to obtain the hidden layer activation representation and intermediate inference state of each inference node of the tested agent in real time during the inference process. Based on the hidden layer activation representation, the entropy value of the output probability distribution of the current inference node to the candidate state transition branch is calculated. The cognitive state of the inference node is determined according to the entropy value, and the sampling weight of the candidate state transition branch is adjusted. Simultaneously, based on the intermediate inference state, an inference trajectory is constructed in chronological order, and the inference trajectory is mapped to the discrete finite state machine. Activated state nodes and state transition branches are identified, and the logical branch coverage rate is calculated. Obtain a dataset of safe execution trajectories of the agent under normal task execution conditions, vectorize the safe execution trajectories and input them into a variational autoencoder for training, construct a probability distribution model of the safe execution trajectories in the latent space of the variational autoencoder, and construct the safe boundary of the agent in the latent space based on the probability distribution model. A linear time-series logic formula is constructed based on preset security and compliance rules, and the satisfaction verification of the inference trajectory is performed. The inference trajectory is then input into the trained variational autoencoder to obtain the corresponding latent variable distribution, and the manifold distance of the latent variable distribution relative to the safety boundary is calculated. When the reasoning trajectory does not satisfy the linear temporal logic formula and the manifold distance is greater than the preset second threshold, it is determined that the reasoning trajectory has a logical cognitive loophole. The probability distribution distance between the inference trajectory and the security boundary is calculated based on the Kullback-Leibler (KL) divergence. A multi-objective composite reward function is constructed based on the KL divergence, the increment of the logic branch coverage relative to historical tests, and the judgment result of the logic cognitive vulnerability. The reward signal is then fed back to the adversarial testing strategy network to update the mutation operator selection strategy and perturbation strength parameters, and new mutation samples are generated iteratively.

2. The method of claim 1, wherein, The formula for calculating the logical branch coverage (LBC) is as follows: ; where N is the task intent space total number of deconstructed semantic primitives; is the node activation indicator function; represents the task intent space activation status of semantic primitive nodes in the task intent space, H is the predicted entropy mapped by the hidden layer activation representation, is the entropy-based dynamic weight factor.

3. The method of claim 2, wherein, The multi-objective composite reward function is as follows: ;in, These are the dynamically adjustable hyperparameters. For semantic deviation rewards, To cover incremental rewards, R is the reward signal for determining rewards based on violations; The semantic deviation reward The distance between the inference trajectory and the security boundary is determined by the probability distribution. The coverage increment reward is determined by the real-time increment of the LBC from the LBC of the previous round of testing; The violation discrimination reward Is determined by the result of the logical cognitive vulnerability determination.

4. The method according to claim 2 or 3, characterized in that, The historical test information includes status coverage information and historical test feedback information, wherein... The state coverage information includes at least: activation information of each semantic state node, triggering information of state transition branches, and corresponding coverage statistics. The historical test feedback information includes at least the inference trajectory features, coverage change information, and anomaly detection results generated during the historical test process.

5. The method of claim 4, wherein, The pre-defined multidimensional semantic variation operator library includes at least: cognitive constraint-induced operators, complex logical paradox operators, and temporal and environmental evolution operators.

6. The method of claim 5, wherein, The phrase "semantically parsing the input natural language instructions and converting them into structured triple vectors containing the target, constraints, and tool calls" includes: The natural language instructions are semantically labeled, and the target information, constraint information and tool call information in the instructions are extracted. The target information, constraint information and tool call information are then vectorized and encoded to obtain the corresponding structured triple vector.

7. The method according to claim 6, characterized in that, The cognitive constraint-induced operators include at least: role constraint dilution operator, authority instruction disguise operator, sympathy-induced hijacking operator, and covert multi-step redirection operator; The complex logical paradox operators include at least: logical self-consistency provocation operator, recursive logic trap operator, counterfactual premise injection operator, and conditional dependency conflict operator; The time-series and environmental evolution operators include at least: time-series recursive reversal operator, environmental feedback spurious pollution operator, long context attention hijacking operator, and multimodal logic mismatch operator; and each operator corresponds to a parameterized perturbation intensity.

8. The method of claim 7, wherein, The calculation formula for the manifold operator is: ;in, In the high-dimensional decision vector space, f(x) represents the manifold distance between the current inference trajectory point x and the target safe state (or reference point) y; f(x) and f(y) represent the state transition functions. This represents the discretized representation of the distance in actual calculations.

9. The method of claim 8, wherein, The phrase "determining the cognitive state of the current inference node based on the entropy value and adjusting the sampling weights of the candidate state transition branches" includes: When the entropy value of the inference node is greater than a preset first threshold, it is determined that the current inference node is in a state of cognitive ambiguity, and the sampling weight of the candidate state transition branch corresponding to the inference node is increased. When the entropy value is not greater than a preset first threshold, the inference node is determined to be in a normal cognitive state, and the sampling weight of the candidate state transition branch is maintained or reduced.

Images