Dual-view input integrity auditing method for large language model document processing

Abstract

The application belongs to the technical field of document processing, and particularly relates to a double-view input integrity auditing method for large language model document processing, which calculates an encrypted digest for the same to-be-processed document, and obtains a native text view and a rendering / OCR visible text view in parallel under fixed parsing, rendering and optical character recognition parameters; while being uniformly normalized, a position mapping between normalized characters and native object positions, page image regions is established; a corresponding relationship is established according to pages and text blocks, and character sequence alignment is performed with the visible text view as a reference, and native text substring corresponding to insertion or replacement operations is extracted as digital side exclusive evidence fragments. The scheme can block machine-readable content lacking page evidence before model calling, and provide replayable and locatable auditing basis.

Description

Technical Field

[0001] This application belongs to the field of document processing technology, specifically relating to a dual-view input integrity auditing method for large language model document processing. Background Technology

[0002] PDF and other complex electronic documents simultaneously contain page description objects, fonts and coordinates, optional content groups, cropping information, a raw text layer, and a renderable page. Human reviewers primarily read based on the rendered page, while document parsers may read transparent text, white text, off-page text, extremely small font sizes, non-drawn text, text with an abnormal reading order, or other machine-readable content lacking page evidence. This difference can not only carry the risk of cue word injection but also keyword stuffing, falsified qualifications or experiences, and manipulated task constraints.

[0003] Existing PDF parsing technologies can select between direct parsing and OCR based on parameters such as text objects, image objects, and whether they contain OCR text or hidden text. For example, publication number CN109271613A discloses a scheme that determines the recognition method based on PDF text object information, and classifies documents containing hidden text or garbled text layers as image documents before applying OCR. The purpose of this type of scheme is mainly to improve document parsing or format conversion results. It typically selects one output from multiple recognition methods, rather than simultaneously preserving the native view and rendered view of the same document, locating differences in fragments, and controlling the input data flow of a large language model accordingly.

[0004] In real-world deployments, OCR can generate issues such as missing characters, changes in reading order, hyphen differences, table rearrangements, and scanning noise. Simply labeling any cross-view difference as an attack can produce false positives; simply deleting hit words may also corrupt legitimate accessibility text or lead to incorrect cleanup. Furthermore, audit results may lack repeatability if thresholds are refitted on every document or adjusted on test data.

[0005] Therefore, the technical problem to be solved is: in the presence of multi-layered document representation, OCR noise and parser differences, how to establish a corresponding relationship between two views that are from the same source, can be located, and can be replayed, how to distinguish and record machine-readable fragments lacking page evidence from ordinary OCR loss, and how to reliably control the data flow into the large language model using audit configurations and quality thresholds frozen before execution. Summary of the Invention

[0006] The purpose of this invention is to provide a dual-view input integrity auditing method for document processing of large language models. This technique does not equate cross-view differences with malicious intent by the submitter, but rather treats these differences as integrity signals in the document input gateway: Under fixed parameters, it obtains both the original textual evidence and the page-visible evidence of the same document, retains the mapping from normalized characters to original coordinates, extracts digital-side proprietary evidence fragments, generates an audit gate using a frozen configuration, and transforms the audit gate into deterministic control over the input data of large language models.

[0007] A dual-view input integrity auditing method for large language model document processing includes the following steps:

[0008] S1. Receive the composite electronic document to be processed. And calculate the byte-level cryptographic digest of the composite electronic document. ; in a pre-fixed set of analytical parameters Rendering parameter set and optical character recognition parameter set Next, native object parsing, page rendering, and optical character recognition are performed on the same composite electronic document to obtain a native text view organized by page. and visible text view ; S2. respectively for and Perform the same text normalization operation to obtain normalized raw text. and normalized visible text and establish from Position mapping from characters in the text to the positions of native text objects And from Character mapping to the position of the page image area ; S3. Establish by page and text block and The corresponding relationship, and execute the execution. Transform into The character sequence alignment, and the insertion operation corresponding to the character sequence alignment. Substrings and their corresponding replacement operations Side substring extraction as digital side proprietary evidence fragments And bind page numbers, text block identifiers, native text object coordinates, corresponding page image regions, context, and optical character recognition confidence to each digital-side proprietary evidence fragment; S4. Calculate the cross-view metric score based on at least one cross-view metric configuration frozen before runtime. The cross-view metric score The threshold for determining the difference between the current state and the state before operation is determined. Comparison to generate a difference audit gate And generate audit evidence records. ;according to and visible text quality parameters determined by optical character recognition confidence. With preset and frozen visible text quality thresholds before running The comparison results are used to control the input state of the large language model according to the following rules. .

[0009] Preferably, when and season ;when and , season In other cases, let ;in, This is a flag indicating whether to enable temporary view visibility processing during the period pending manual review. Indicates that it is enabled. Indicates that it is not enabled; in or Generate a record containing the audit evidence at that time. The manual review task; the difference audit gate is used to control the input data flow of the model and does not directly generate an acceptance or rejection conclusion for the business object corresponding to the composite electronic document.

[0010] Preferably, obtain the native text view. and visible text view The methods include: Get the native text view The function reads PDF text objects according to page numbers, character encoding, text rendering mode, fill color, stroke color, font size, transformation matrix, object bounding box, optional content group state, and content flow order, and saves the text content by page, block, line, and character to form a... and the original position mapping of native objects ; Get the visible text view : Using rendering parameter set Page-by-page rendering Get page image Then use the optical character recognition parameter set right Perform OCR, outputting text, text box coordinates, and confidence score set; map pixel coordinates to a unified normalized page coordinate system according to page width and height. ,form and the original position mapping of the visible side The rendered page image is saved as audit evidence; ; in, Page number, , and These are respectively native parsing operations, page rendering operations, and optical character recognition operations; and The first The page's native and visible text; and They are respectively and The original location mapping; For the first The rendered image of the page; For the first Page OCR text box confidence set and All from the same Obtained independently under the recorded configuration.

[0011] Preferred, for each page and Perform the same normalization function , It sequentially performs UnicodeNFKC, case folding, control character to space mapping, configurable punctuation to space mapping, and consecutive whitespace folding, while returning normalized text and position mapping: ; in, and The first The normalized native text and normalized visible text of the page; and They are respectively and Location mapping; Used to uniformly represent view types; To index characters in normalized text; Identify text blocks; The index range of the original character or object before normalization; This refers to the native object area or the page image area. For a normalized character that is obtained by merging multiple original characters. Preserve the original character index range; for whitespace folding, Save the smallest covered area that is collapsed and left blank.

[0012] Preferably, a correspondence is established between native text blocks and OCR text blocks within the same page, and then character sequence alignment is performed within the corresponding blocks. The block correspondence simultaneously utilizes region overlap, reading order, and character editing similarity, and the cost calculation relationship for block correspondence is as follows: ; Indicates the intersection-union ratio of regions. Edit character similarity. For the intersection and union ratio of regions, The character editing similarity of the corresponding text block, Due to differences in reading order, The cost corresponding to the block; For the first Page native text block The region mapped to a unified page coordinate system; For the first Page OCR text block The region mapped to a unified page coordinate system; For the original text block Normalized values ​​for the read order; For the OCR text block Normalized values ​​for the read order; and Non-negative weights; After adding the virtual empty block, the minimum total cost correspondence is obtained. The original text block corresponding to the virtual empty block indicates that the block has no reliable correspondence on the OCR side, and the entire block is used as candidate digital-side proprietary evidence.

[0013] Preferably, normalizing the visible text block will be performed on the corresponding block. Convert to normalized native text blocks Character sequence alignment is performed, preserving the equal, insert, delete, and replace operations; since the conversion direction is fixed, insert indicates that only... The character that exists on the side, delete means only on the side. The characters existing on the side, replace includes both substrings; digital side proprietary evidence. By insert operation substring and replace operation Composition of lateral substrings; visible lateral-specific evidence Operated by delete substring and replace operation Composed of side substrings; ; For the first Page corresponding native text block and OCR text blocks A set of alignment operations; each operation Including operation type And this operation in and Two sets of half-open index intervals , ; and These are the subsets of operations that generate digital evidence and visible evidence, respectively. and These are collections of fragments extracted from the corresponding views; Each segment through and Binds to page, block, native object location, and page image area, and saves the preceding and following context; For native objects outside the page or with zero area, the corresponding area of ​​the page image can be empty. Simultaneously, the object coordinates and page frame relationships are preserved. Compared to directly concatenating all differing characters into a single string, this preserves fragment boundaries and adjacency relationships, preventing originally scattered legal words from being incorrectly concatenated into risky expressions. Each digital-side proprietary evidence fragment is represented as follows: : ; For the sequence number of the evidence fragment, To generate the alignment operation type for this segment, and The operation is performed in and The index range in; For digital side fragment text, and These are the native object area and the corresponding page image area, respectively. For the context of the fragment, The OCR confidence level corresponding to this segment; For insert operations The interval is empty; for the replace operation, both intervals are not empty.

[0014] Preferably, for the first A cross-view metric, to Indicate its score, This represents the difference threshold corresponding to each metric; scores for similarity metrics below this threshold are considered different. When the corresponding subgate is triggered, the score of the difference metric is higher than [the threshold value]. Triggering the corresponding sub-gate at the time; candidate threshold set It consists of the midpoints and endpoints between the ordered unique values ​​of the development set scores; ; For cross-view metric indexes; In order to make A set of candidate thresholds to obtain the maximum value; For the first A metric in the candidate threshold The accuracy of the balance is as follows; and These are the true positive rate and the false positive rate, respectively. , and Let represent the number of true positive samples, the number of false positive samples, and the number of false negative samples, respectively; when the denominator is 0, let ; like If only one candidate threshold is included, then that candidate threshold is determined as... If there are still more than one candidate threshold to retain, then retain the one that makes the candidate threshold the most suitable. Find the candidate threshold that yields the maximum value; if more than one candidate threshold is still retained, then for the similarity metric, select the candidate threshold with the largest value as the maximum candidate threshold. For the difference measure, the candidate threshold with the smallest value is selected as... ; For each similarity metric, when Seasonal corresponding binary subgate For each difference measure, when season In other cases, let Difference Auditing Gate For all The logic of OR, This indicates that at least one sub-gate is triggered; Cross-view metric configuration, vectorizer, text normalization configuration, and various difference determination thresholds. Visible text quality threshold Parsing parameter sets Rendering parameter set Optical character recognition parameter set Together with the corresponding software version, they constitute the frozen configuration. And calculate the cryptographic digest of the frozen configuration. Running nodes only load signed or encrypted digests and... Matching frozen configuration .

[0015] Preferably, the visible text quality parameter q is calculated according to the following formula: ; Total number of pages For the first Number of OCR text blocks per page For the first Page 1 One OCR text block, The number of characters in this text block. The OCR confidence score for this text block; When the denominator is 0, let ;Preset and freeze the visible text quality threshold before running For judgment only Whether it can be used as a reliable visible view is different from the difference threshold used to determine whether the difference between two views is abnormal. ; when If necessary, the process will proceed to manual review or review by the second OCR stack.

[0016] Preferred, with This indicates the input state for entering the target large language model, in order to Indicates whether to enable temporary visible view processing during the period pending manual review; Indicates that it is enabled. This indicates that the quality gate, difference gate, and model input control are not enabled. The statuses are as follows: ; This indicates that the native text view is allowed. This indicates that the visible text view will only be used as temporary input for the large language model during manual review. This indicates that the model call is blocked with empty input; when Even if the risk expression does not match, It must not enter the target large language model; when At that time, the output of the large language model must be marked as "temporary result awaiting manual review"; or A review task is generated in real time.

[0017] Preferred audit evidence records: ; For input and configuration of evidence sets, This is the location to save the original document. It is a set of evidence of dual views and differences. For measuring and processing state evidence sets; This is a neutral document identifier. To render the collection of images on the page, For cross-view metric result vectors, This is a threshold vector for determining the difference that corresponds one-to-one with each metric. Measure the number of cross-views. To handle software version collections, For audit time, Currently in manual review status. Freeze the configuration; This indicates that the data is processed according to the preset field order, character encoding, and data type rules. Perform deterministic, unambiguous serialization; Represents a cryptographic hash function. This is a summary of evidence.

[0018] Compared with the prior art, the beneficial effects of this application are as follows: Using the rendering result of the same document with fixed parameters as the anchor point of page evidence, it is possible to discover situations where machine-readable content lacks page support before calling the large language model; During the normalization process, the mapping from characters to native objects and page image regions is preserved, and the characters are aligned with the corresponding page blocks. This allows the differences to be located back to specific pages, objects, and image regions, avoiding the output of only the unverifiable whole-article similarity. It simultaneously preserves insert, replace, and visible-side proprietary evidence, covering multiple types of differences such as hidden insertions, replacements, abnormal reading order, and OCR loss, and facilitates manual differentiation of attacks, accessible text, and author tool artifacts; Once the difference metrics, vectorizers, and thresholds are determined on the development set, they are frozen and recorded along with the software version and configuration summary to improve the consistency of repeated audits across time and nodes. By binding the original text summary, page, dual view, mapping, difference fragments and gating status as evidence records, it can support audit playback, dispute resolution and version tracking; The language model input control adopts a three-state input (D, V, or empty) to prevent accidental approval when OCR quality is insufficient, and to avoid directly generating business rejection results based on differences, thereby reducing the risk of hidden text affecting the model from the data flow level. Attached Figure Description

[0019] Figure 1 This is a flowchart of the rendering anchored dual-view input integrity auditing method according to an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating page block correspondence, position mapping, and difference fragment extraction in an embodiment of the present invention; Figure 3 This is a state diagram of the quality gate, difference gate, and model input control in an embodiment of the present invention; Figure 4This is a diagram showing the relationship between system modules and audit evidence records in an embodiment of the present invention. Detailed Implementation

[0020] The present invention will be further described below with reference to the accompanying drawings and embodiments. These embodiments are illustrative of the invention and not intended to limit its scope. Unless the context otherwise requires, the native text view D represents machine-readable text read by a document parser, and the visible text view V represents text obtained from a page rendered with fixed parameters via OCR; "visible" is relative to the recorded renderer and rendering parameters and does not imply absolute human visual visibility.

[0021] Native TextView This represents machine-readable text read by a document parser; the visible text view is shown. This represents the text obtained from a page rendered with fixed parameters via OCR. and They represent and Text processed by the same normalization function. "Visible" is relative to the recorded renderer and rendering parameters, and does not represent an absolute conclusion of human visual visibility.

[0022] The full text uses the following conventions for punctuation: uppercase. , Always indicates two text views; the tilde indicates normalized text. , , Always represent three types of parameter sets; , Always represents the normalized position mapping; and They represent the first The scores of cross-view metrics and their corresponding difference judgment thresholds; and These represent the visible text quality parameter and the visible text quality threshold, respectively. , and These represent the difference audit gate, temporary processing flag, and model input status, respectively. All other local variables are defined after the first occurrence of the formula.

[0023] A dual-view input integrity auditing method for large language model document processing includes the following steps:

[0024] S1. Receive the composite electronic document to be processed. And calculate the byte-level cryptographic digest of the composite electronic document. ; in a pre-fixed set of analytical parameters Rendering parameter set and optical character recognition parameter set Next, native object parsing, page rendering, and optical character recognition are performed on the same composite electronic document to obtain a native text view organized by page. and visible text view .

[0025] Step S101: The document input gateway receives the composite electronic document F, saves the original bytes, and records the original document's save location. The gateway generates a neutral identifier unrelated to business tags and calculates h(F) using SHA-256 or an equivalent cryptographic hash function. In the isolated environment, the gateway verifies file type, page limit, and parsing resource limit to prevent abnormal parser consumption from affecting subsequent auditing.

[0026] Step S102: Load the parsing parameter set before the audit begins Rendering parameter set and optical character recognition parameter set . It should at least include the parser and version, object property output, and read order configuration; It should include at least the renderer and version, DPI, color space, page frame, rotation, anti-aliasing, and font alternative configurations; It should at least include the optical character recognition engine and version, language configuration, orientation detection, and text box confidence output configuration. Each audit should record the actual parameters and software version used.

[0027] Step S103: Read the PDF text objects, character encoding, text rendering mode, fill color, stroke color, font size, transformation matrix, object bounding box, optional content group status, and content flow order according to page number. Save the text content by page, block, line, and character to form... and the original position mapping of native objects Even if a text object does not produce visible pixels, the object and its coordinates are preserved.

[0028] Step S104: Use Page-by-page rendering Get page image Then use right Perform OCR and output the text, text box coordinates, and confidence score set. Map pixel coordinates to a unified normalized page coordinate system according to page width and height. ,form and the original position mapping of the visible side The rendered page image is saved as audit evidence.

[0029] ; in, Page number; , and These are respectively native parsing operations, page rendering operations, and optical character recognition operations; and The first The page's native and visible text; and They are respectively and The original location mapping; For the first The rendered image of the page; For the first Page OCR text box confidence set. and All from the same Obtained independently under a recorded configuration, its differences can be traced back to the same input byte, rather than from version differences between two source documents.

[0030] S2. respectively for and Perform the same text normalization operation to obtain normalized raw text. and normalized visible text and establish from Position mapping from characters in the text to the positions of native text objects And from Character mapping to the position of the page image area .

[0031] For each page and Execute the same normalization function . It performs UnicodeNFKC, case folding, control character-to-space mapping, configurable punctuation-to-space mapping, and consecutive whitespace folding in sequence. Unlike normal normalization, which only returns a string, It also returns the normalized text and its position mapping.

[0032] ; in, and The first The normalized native text and normalized visible text of the page; and They are respectively and Location mapping; Used to uniformly represent view types; To index characters in normalized text; Identify text blocks; The index range of the original character or object before normalization; This refers to either the native object region or the page image region. This is relevant when a normalized character is obtained by merging multiple original characters. Preserve the original character index range; for whitespace folding, Preserve the minimum covered area of ​​the collapsed whitespace. Thus, any normalized discrepancies can be reflected back to the original text and the page.

[0033] S3. Establish by page and text block and The corresponding relationship, and execute the execution. Transform into The character sequence alignment, and the insertion operation corresponding to the character sequence alignment. Substrings and their corresponding replacement operations Side substring extraction as digital side proprietary evidence fragments It also binds page numbers, text block identifiers, native text object coordinates, corresponding page image regions, context, and optical character recognition confidence scores to each digital-side proprietary evidence fragment.

[0034] like Figure 2 As shown, the system first establishes a correspondence between native text blocks and OCR text blocks within the same page, and then performs character sequence alignment within the corresponding blocks. Block alignment utilizes region overlap, reading order, and character editing similarity simultaneously to avoid large-scale misalignment caused by double columns, tables, or headers and footers after the entire page is stitched together.

[0035] See the relationship between page block correspondence, position mapping, and difference fragment extraction. Figure 2 .

[0036] ; For the intersection and union ratio of regions, The character editing similarity of the corresponding text block, Due to differences in reading order, The cost corresponding to the block; For the first Page native text block The region mapped to a unified page coordinate system; For the first Page OCR text block The region mapped to a unified page coordinate system; For the original text block Normalized values ​​for the read order; For the OCR text block Normalized values ​​for the read order; , and The weights are non-negative. The system can use the Hungarian algorithm, minimum cost flow, or equivalent allocation algorithm to find the minimum total cost correspondence after adding the virtual empty block; since the original text block corresponding to the virtual empty block has no reliable correspondence on the OCR side, the entire block can be used as candidate digital-side proprietary evidence.

[0037] Performing the normalization of the visible text block on the corresponding block will normalize the visible text block. Convert to normalized native text blocks Character sequence alignment is performed, preserving the equal, insert, delete, and replace operations. Since the transformation direction is fixed, insert indicates that only... The character that exists on the side, delete means only on the side. The characters existing on the side are replaced by including both substrings. Digital side-specific evidence. By insert operation substring and replace operation Composition of lateral substrings; visible lateral-specific evidence Operated by delete substring and replace operation Composed of side substrings.

[0038] ; For the first Page corresponding block A set of alignment operations; each operation Including operation type And this operation in and Two sets of half-open index intervals , ; and These are the subsets of operations that generate digital evidence and visible evidence, respectively. and These are collections of fragments extracted from the corresponding views.

[0039] Each segment through and It binds to the page, block, native object location, and page image area, and saves the preceding and following context. For native objects outside the page or with zero area, the corresponding area of ​​the page image can be empty, while saving the object coordinates and page frame relationship. Compared to directly concatenating all differing characters into a single string, this embodiment preserves fragment boundaries and adjacency relationships, preventing originally scattered legal words from being incorrectly concatenated into risky expressions. The structure of the digital-side proprietary evidence fragment is as follows: ; For the sequence number of the evidence fragment, To generate the alignment operation type for this segment, and The operation is performed in and The index range in; For digital side fragment text, and These are the native object area and the corresponding page image area, respectively. For the context of the fragment, This represents the OCR confidence score corresponding to the segment. For the insert operation, The interval is empty; for the replace operation, both intervals are not empty.

[0040] S4. Calculate the cross-view metric score based on at least one cross-view metric configuration frozen before runtime. The cross-view metric score The threshold for determining the difference between the current state and the state before operation is determined. Comparison to generate a difference audit gate And generate audit evidence records. ;according to and the visible text quality parameters determined by the optical character recognition confidence level. With preset and frozen visible text quality thresholds before running The comparison results control the input state of the large language model. .

[0041] Calculate cross-view metrics for each page, each corresponding block, and the entire document. Cross-view metrics are signals of document representation integrity, not a determination of the submitter's intent, and can be one or more of the following metrics.

[0042] ; in, and These represent the normalized raw text and normalized visible text obtained by concatenating pages and blocks in a deterministic order, respectively. Levenshtein distance; For text characters Metagram set, using Instead of using To avoid conflict with the audit gate Confusion; Represents any text The number of characters; and They are respectively and Character-level TF-IDF vectors, This represents the transpose of a vector. Let represent the L2 norm. If and If all are empty, then it is agreed that... , If only one side is empty, then it is agreed that... , If any TF-IDF vector is the zero vector, then it is agreed that... A preferred embodiment uses 3 to 5 characters. Metagrammar, Sublinear word frequency Smoothing inverse document frequency And L2 normalization, where, For characters Metagrammatical features Features In the development documentation The count in, For the number of development documents, For inclusion features The number of development documents. The vectorizer only fits once on the family of development documents and freezes.

[0043] For the A cross-view metric, to Indicate its score, This represents the difference threshold corresponding to this metric. A similarity metric score below a certain threshold indicates a difference in the perceived difference. When the corresponding subgate is triggered, the score of the difference metric is higher than [the threshold value]. The corresponding subgate is triggered at the specified time. Each threshold is determined using only the development set, which is separated from the test set by base document family; candidate threshold set. It consists of the midpoints and endpoints between the ordered unique values ​​of the development set score.

[0044] ; For cross-view metric indexes; In order to make A set of candidate thresholds to obtain the maximum value; For the first A metric in the candidate threshold The accuracy of the balance is as follows; and These are the true positive rate and the false positive rate, respectively. , and Let represent the number of true positive samples, the number of false positive samples, and the number of false negative samples, respectively; when the denominator is 0, let .

[0045] like If only one candidate threshold is included, then that candidate threshold is determined as... If there are still more than one candidate threshold to retain, then retain the one that makes the candidate threshold the most suitable. Find the candidate threshold that yields the maximum value; if more than one candidate threshold is still retained, then for the similarity metric, select the candidate threshold with the largest value as the maximum candidate threshold. For the difference measure, the candidate threshold with the smallest value is selected as... .

[0046] For each similarity metric, when Seasonal corresponding binary subgate For each difference measure, when season In other cases, let Difference Auditing Gate For all The logic of OR, This indicates that at least one sub-gate is triggered.

[0047] Cross-view metric configuration, vectorizer, text normalization configuration, and various difference determination thresholds. Visible text quality threshold Parsing parameter sets Rendering parameter set Optical character recognition parameter set Together with the corresponding software version, they constitute the frozen configuration. And calculate the cryptographic digest of the frozen configuration. Running nodes only load signed or encrypted digests and... Matching frozen configuration .

[0048] Visible text quality parameters The confidence score can be determined by a combination of text box confidence, page text coverage, character count anomalies, language coverage, and orientation recognition results. The following is an example of the average confidence score weighted by the number of characters in the OCR text box.

[0049] ; Total number of pages For the first Number of OCR text blocks per page For the first Page 1 One OCR text block, The number of characters in this text block. Set the OCR confidence score for this text block. Let the denominator be 0. The visible text quality threshold is preset and frozen before execution. For judgment only Whether it can be used as a reliable visible view is different from the difference threshold used to determine whether the difference between two views is abnormal. .when In such cases, the system does not interpret "no difference found" as safe, but instead transfers the case to manual review or review by the second OCR stack.

[0050] Figure 3 This illustrates the mapping from audit results to the model input data stream. The system uses... This indicates the input state for entering the target large language model, in order to Indicates whether to enable temporary visible view processing during the period pending manual review; Indicates that it is enabled. This indicates that it is not enabled. The system only... , and Time As a temporary input to the same large language model, there is no additional "temporary model".

[0051] See quality gate, difference gate, and model input control status. Figure 3 .

[0052] ; This indicates that the native text view is allowed. This indicates that the visible text view will only be used as temporary input for the large language model during manual review. This indicates that the model call will be blocked with empty input. When Even if the risk expression does not match, It must not enter the target large language model; when At this time, the model output must be marked as "provisional result pending manual review". The system in or The system generates review tasks and displays the original page and highlights the differences to the reviewer. Context, metric scores, corresponding discrepancy thresholds, and software version. Discrepancy audit gates must not directly trigger rejection of candidates, applications, contracts, bids, or other business partners.

[0053] like Figure 4 As shown, the evidence recording module binds the inputs, parameters, intermediate results, and processing status of the audit process into audit evidence records E.

[0054] See the system modules and audit evidence record relationship. Figure 4 .

[0055] ; in, For input and configuration of evidence sets, This specifies the location to save the original document. It is a set of evidence of dual views and differences. For measuring and processing state evidence sets; This is a neutral document identifier. To render the collection of images on the page, For cross-view metric result vectors, This is a threshold vector for determining the difference that corresponds one-to-one with each metric. Measure the number of cross-views. To handle software version collections, For audit time, Currently in manual review status. Freeze the configuration; This indicates that the data is processed according to the preset field order, character encoding, and data type rules. Perform deterministic, unambiguous serialization; Represents a cryptographic hash function. This is a summary of evidence. Regarding... Use the organization's private key to generate a digital signature, or Write to append-only logs, WORM storage, or other tamper-proof logging systems. When saving, access controls, retention periods, and anonymization policies should be set according to personal information and business compliance requirements.

[0056] Experimental verification: To illustrate the feasibility of the solution, the modified experimental design from the paper is used as the data basis for the preferred embodiment. The following results only demonstrate the separability and transferability of the current generator, template, parser, renderer, and OCR stack, and do not constitute a general performance commitment for all real documents, languages, layouts, or attack methods.

[0057] As shown in Table 1, the experiment used 20 basic resume families to generate 20 secure PDFs and 960 manipulation configurations, for a total of 980 PDFs. Manipulation covered four types of content, two locations, and four delivery mechanisms: PDF text rendering mode 3, 1-point white text, 8-point text outside the page, and 0.1-point black text at the page edge. The development and test sets were completely separated by basic resume family.

[0058] Table 1 Data Partitioning and Configuration .

[0059] Recall and confidence intervals were calculated based on basic resume family clustering for 320 attack configurations without rewritten payloads. The results are shown in Table 2 below. The false positive rate for the controlled security set was 0, but this is not equivalent to the false positive rate for genuine benign documents.

[0060] Table 2 shows no test results on the rewritten load. .

[0061] To examine template migration, the same freeze threshold was applied to 50 older, benign procedural PDFs. The results showed significant differences in migration across different metrics:

[0062] Table 3 Migration False Positives on Older Benign Documents .

[0063] Table 3 shows that Jaccard achieved 100% recall on controlled data but all false positives on older benign documents, and TF-IDF also showed 20% false positives. Therefore, this invention does not declare any single rule as universally optimal, but requires frozen configuration, quality gates, evidence retention and manual review to work together.

[0064] As shown in Table 4, in the page visibility verification, 720 attack PDFs in the three categories of Mode 3, white, and off-page were completely identical to their corresponding secure PDFs in terms of pixels. The 240 PDFs with extremely small font sizes all passed the preset near-invisible proxy threshold, with the largest observed pixel change ratio being 0.00001525 and the largest normalized mean absolute pixel difference being 0.0000007309. For the current 960 manipulation configurations, the OCR visible text was completely equal to the OCR text of the corresponding secure PDF, i.e., 960 / 960. This result verifies that the hidden channel was removed by the visible view reconstruction, but it does not mean that the OCR can recover all legitimate content.

[0065] Table 4 Page Visibility and Visible View Reconstruction Verification .

[0066] Anomaly and degradation handling:

[0067] Purely scanned PDFs or those without native text layers: Mark them as single-view documents and do not allow them to pass directly just because ΔD is empty; they can proceed to the OCR content security check and manual sampling process.

[0068] Insufficient OCR language or font coverage: If If this is not done, the model call will be blocked or a second OCR stack will be used for verification, preventing low-quality OCR from being processed. As a safety baseline.

[0069] For two-column layouts, tables, and headers / footers: prioritize page block correspondence; overall page similarity is only used as a supplementary score.

[0070] Accessible text or legitimate hidden layers: Preserve ΔD, object attributes, and page areas, allowing human reviewers to recover legitimate content based on context; the system does not presume malicious intent.

[0071] Parser, renderer, or OCR version upgrade: Treat as a frozen configuration. If changes occur, recalibration should be performed on the representative benign set and manipulation configuration, while retaining the summaries of the old and new versions.

[0072] Model call failed or review incomplete: The original document and audit evidence record E remain unchanged, and the original evidence is not overwritten by the provisional results awaiting manual review.

[0073] System, electronic device and storage medium implementation methods

[0074] The system of this invention includes a document receiving and hashing module, a dual-view acquisition module, a normalization and mapping module, a difference and calibration module, an evidence recording module, a model input control module, and a manual review interface. Each module can be implemented by a software component on the same server, or it can be distributed across document access nodes, isolated rendering nodes, security audit nodes, and large language model gateway nodes. Data transmitted between modules should carry a neutral document identifier and a configuration summary.

[0075] Electronic devices may include one or more processors, memory, network interfaces, and display interfaces. When a computer program stored in memory is executed by the processor, the electronic device performs the methods described above. Computer-readable storage media may be disks, solid-state storage, optical media, read-only memory, or other non-transitory media.

[0076] Those skilled in the art can make equivalent substitutions for document format, parser, renderer, OCR engine, alignment algorithm, difference measurement, and evidence storage method without departing from the essence of the invention. Such equivalent substitutions should be determined by the technical features defined in the claims and their equivalent features.

Claims

1. A dual-view input integrity auditing method for large language model document processing, characterized in that, Includes the following steps: S1. Receive the composite electronic document to be processed. And calculate the byte-level cryptographic digest of the composite electronic document. ; In a pre-fixed set of parsing parameters Rendering parameter set and optical character recognition parameter set Next, native object parsing, page rendering, and optical character recognition are performed on the same composite electronic document to obtain a native text view organized by page. and visible text view ; S2. respectively for and Perform the same text normalization operation to obtain normalized raw text. and normalized visible text and establish from Position mapping from characters in the text to the positions of native text objects And from Character mapping to the position of the page image area ; S3. Establish by page and text block and The corresponding relationship, and execute the execution. Transform into The character sequence alignment, and the insertion operation corresponding to the character sequence alignment. Substrings and their corresponding replacement operations Side substring extraction as digital side proprietary evidence fragments And bind page numbers, text block identifiers, native text object coordinates, corresponding page image regions, context, and optical character recognition confidence to each digital-side proprietary evidence fragment; S4. Calculate the cross-view metric score based on at least one cross-view metric configuration frozen before runtime. The cross-view metric score The threshold for determining the difference between the current state and the state before operation is determined. Comparison to generate a difference audit gate And generate audit evidence records. ;according to and visible text quality parameters determined by optical character recognition confidence. With preset and frozen visible text quality thresholds before running The comparison results are used to control the input state of the large language model according to the following rules. .

2. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, when and season ;when and , season In other cases, let ;in, This is a flag indicating whether to enable temporary view visibility processing during the period pending manual review. Indicates that it is enabled. Indicates that it is not enabled; in or Generate a record containing the audit evidence at that time. The manual review task; the difference audit gate is used to control the input data flow of the model and does not directly generate an acceptance or rejection conclusion for the business object corresponding to the composite electronic document.

3. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, Get the native text view and visible text view The methods include: Get the native text view The function reads PDF text objects according to page numbers, character encoding, text rendering mode, fill color, stroke color, font size, transformation matrix, object bounding box, optional content group state, and content flow order, and saves the text content by page, block, line, and character to form a... and the original position mapping of native objects ; Get the visible text view : Using rendering parameter set Page-by-page rendering Get page image Then use the optical character recognition parameter set right Perform OCR, outputting text, text box coordinates, and confidence score set; map pixel coordinates to a unified normalized page coordinate system according to page width and height. ,form and the original position mapping of the visible side The rendered page image is saved as audit evidence; ； in, Page number, , and These are respectively native parsing operations, page rendering operations, and optical character recognition operations; and The first The page's native and visible text; and They are respectively and The original location mapping; For the first The rendered image of the page; For the first Page OCR text box confidence set and All from the same Obtained independently under the recorded configuration.

4. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, For each page and Perform the same normalization function , It sequentially performs UnicodeNFKC, case folding, control character to space mapping, configurable punctuation to space mapping, and consecutive whitespace folding, while returning normalized text and position mapping: ； in, and The first The normalized native text and normalized visible text of the page; and They are respectively and Location mapping; Used to uniformly represent view types; To index characters in normalized text; Identify text blocks; The index range of the original character or object before normalization; This refers to the native object area or the page image area. For a normalized character that is obtained by merging multiple original characters. Preserve the original character index range; for whitespace folding, Save the smallest covered area that is collapsed and left blank.

5. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, A correspondence is established between native text blocks and OCR text blocks on the same page, and then character sequence alignment is performed within the corresponding blocks. The block correspondence simultaneously uses region overlap, reading order, and character editing similarity. The cost calculation relationship for block correspondence is as follows: ； Indicates the intersection-union ratio of regions. Edit character similarity. For the intersection and union ratio of regions, The character editing similarity of the corresponding text block, Due to differences in reading order, The cost corresponding to the block; For the first Page native text block The region mapped to a unified page coordinate system; For the first Page OCR text block The region mapped to a unified page coordinate system; For the original text block Normalized values ​​for the read order; For the OCR text block Normalized values ​​for the read order; and Non-negative weights; After adding the virtual empty block, the minimum total cost correspondence is obtained. The original text block corresponding to the virtual empty block indicates that the block has no reliable correspondence on the OCR side, and the entire block is used as candidate digital-side proprietary evidence.

6. The dual-view input integrity auditing method for large language model document processing according to claim 4, characterized in that, Performing the normalization of the visible text block on the corresponding block will normalize the visible text block. Convert to normalized native text blocks Character sequence alignment is performed, preserving the equal, insert, delete, and replace operations; since the conversion direction is fixed, insert indicates that only... The character that exists on the side, delete means only on the side. The characters existing on the side, replace includes both substrings; digital side proprietary evidence. By insert operation substring and replace operation Composition of lateral substrings; visible lateral-specific evidence Operated by delete substring and replace operation Composed of side substrings; ； For the first Page corresponding native text block and OCR text blocks A set of alignment operations; each operation Including operation type And this operation in and Two sets of half-open index intervals , ; and These are the subsets of operations that generate digital evidence and visible evidence, respectively. and These are collections of fragments extracted from the corresponding views; Each segment through and Binds to page, block, native object location, and page image area, and saves the preceding and following context; For native objects outside the page or with zero area, the corresponding area of ​​the page image can be empty. Simultaneously, the object coordinates and page frame relationships are preserved. Compared to directly concatenating all differing characters into a single string, this preserves fragment boundaries and adjacency relationships, preventing originally scattered legal words from being incorrectly concatenated into risky expressions. Each digital-side proprietary evidence fragment is represented as follows: : ； For the sequence number of the evidence fragment, To generate the alignment operation type for this segment, and The operation is performed in and The index range in; For digital side fragment text, and These are the native object area and the corresponding page image area, respectively. For the context of the fragment, The OCR confidence level corresponding to this segment; For insert operations The interval is empty; for the replace operation, both intervals are not empty.

7. The dual-view input integrity auditing method for large language model document processing according to claim 4, characterized in that, For the A cross-view metric, to Indicate its score, This represents the difference threshold corresponding to each metric; scores for similarity metrics below this threshold are considered different. When the corresponding subgate is triggered, the score of the difference metric is higher than [the threshold value]. The corresponding sub-gate is triggered at the time; Candidate threshold set It consists of the midpoints and endpoints between the ordered unique values ​​of the development set scores; ； For cross-view metric indexes; In order to make A set of candidate thresholds to obtain the maximum value; For the first A metric in the candidate threshold The accuracy of the balance is as follows; and These are the true positive rate and the false positive rate, respectively. , and These represent the number of true positive samples, the number of false positive samples, and the number of false negative samples, respectively. When the denominator is 0, let ; like If only one candidate threshold is included, then that candidate threshold is determined as... If there are still more than one candidate threshold to retain, then retain the one that makes the candidate threshold the most suitable. Find the candidate threshold that yields the maximum value; if more than one candidate threshold is still retained, then for the similarity metric, select the candidate threshold with the largest value as the maximum candidate threshold. For the difference measure, the candidate threshold with the smallest value is selected as... ; For each similarity metric, when Seasonal corresponding binary subgate ; For each difference measure, when season In other cases, let Difference Auditing Gate For all The logic of OR, This indicates that at least one sub-gate is triggered; Cross-view metric configuration, vectorizer, text normalization configuration, and various difference determination thresholds. Visible text quality threshold Parsing parameter sets Rendering parameter set Optical character recognition parameter set Together with the corresponding software version, they constitute the frozen configuration. And calculate the cryptographic digest of the frozen configuration. Running nodes only load signed or encrypted digests and... Matching frozen configuration .

8. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, The visible text quality parameter q is calculated according to the following formula: ； Total number of pages For the first Number of OCR text blocks per page For the first Page 1 One OCR text block, The number of characters in this text block. The OCR confidence score for this text block; When the denominator is 0, let ; Preset and freeze visible text quality thresholds before running For judgment only Whether it can be used as a reliable visible view is different from the difference threshold used to determine whether the difference between two views is abnormal. ; when If necessary, the process will proceed to manual review or review by the second OCR stack.

9. The dual-view input integrity auditing method for large language model document processing according to claim 1, characterized in that, by This indicates the input state for entering the target large language model, in order to Indicates whether to enable temporary visible view processing during the period pending manual review; Indicates that it is enabled. This indicates that the quality gate, difference gate, and model input control are not enabled. The statuses are as follows: ； This indicates that the native text view is allowed. This indicates that the visible text view will only be used as temporary input for the large language model during manual review. This indicates that the model call will be blocked with empty input; when Even if the risk expression does not match, It must not enter the target large language model; when At that time, the output of the large language model must be marked as "temporary result awaiting manual review"; or A review task is generated in real time.

10. The dual-view input integrity auditing method for large language model document processing according to claim 2, characterized in that, Audit evidence record: ； For input and configuration of evidence sets, This is the location to save the original document. It is a set of evidence of dual views and differences. For measuring and processing state evidence sets; This is a neutral document identifier. To render the collection of images on the page, For cross-view metric result vectors, This is a threshold vector for determining the difference that corresponds one-to-one with each metric. Measure the number of cross-views. To handle software version collections, For audit time, Currently in manual review status. Freeze the configuration; This indicates that the data is processed according to the preset field order, character encoding, and data type rules. Perform deterministic, unambiguous serialization; Represents a cryptographic hash function. This is a summary of evidence.

Images