An attacking agent model base station identification method and system

Abstract

The application provides an attack agent model base identification method and system, and relates to the technical field of network security. The method provided by the application comprises the following steps: acquiring a base model and generating a variant to constitute a training model set containing a category label; iteratively optimizing an inner-layer prompt word sequence: inputting the sequence into each model in each round, extracting response features, calculating fitness based on intra-class and inter-class distance, generating a new generation of sequence through genetic operation, and converging to obtain a first prompt word sequence; querying the training set with the sequence, extracting features and category labels to train a classifier; fixing the classifier, continuing the inner-layer optimization from the first sequence as a starting point, and obtaining a second sequence until the outer layer is terminated; inputting the second sequence into a to-be-detected model, extracting features, and determining the category of the to-be-detected model by the classifier. The application improves the problem that the prior art cannot effectively identify attack agent base models modified through fine-tuning or external knowledge base.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for identifying attack agent model bases. Background Technology

[0002] With the rapid development of large language model technology, automated agents based on large language models are becoming increasingly common in the field of network attack and defense. Attack methods, represented by automated penetration testing agents, are on the rise. Compared to traditional manual network attacks, these attacks are characterized by low barriers to entry, low cost, and high concurrency. On the defense side, existing active or passive defense methods heavily rely on threat intelligence. However, attackers typically do not directly use native open-source models. Instead, they construct attack agents by fine-tuning, quantizing, or externally adding knowledge bases to the open-source base large language model, making it difficult for defenders to identify the base model type used by attackers using traditional features such as IP addresses or simple text matching. Therefore, identifying the base model genes of attack agents—that is, the inherent fingerprint of the base model that remains stable despite model fine-tuning or external knowledge base additions—can be used to generate targeted defense strategies and to profile and trace attackers. For example, by associating the identified base model type with its open-source community, download channels, and commonly used modification tools, the attacker's technical resources and capabilities can be inferred. Furthermore, attributing agents involved in multiple attack events to the same base model or family can support the tracing of attack organizations and attack chains.

[0003] Existing technologies mainly fall into two categories: one is white-box detection methods based on model parameters, which require obtaining model weight files and calculating hash values ​​or analyzing parameter distribution characteristics; the other is fingerprinting methods based on black-box queries, which infer model identity by constructing specific input prompts and observing textual features such as perplexity and rejection patterns in the model's output text. However, in practical applications, when the weights or knowledge configuration of the identified model changes, its output behavior shifts accordingly, leading to a significant decrease in the accuracy of existing black-box fingerprinting methods. Furthermore, existing technologies typically treat variant models with changed configurations as independent unknown models, failing to categorize them into the same base model category, thus hindering effective tracing and correlation analysis of the attacker's core toolchain. Therefore, there is an urgent need to develop a solution to address these issues. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for identifying attack agent model bases, which improves the problem that existing technologies cannot effectively identify attack agent base models that have been fine-tuned or modified by external knowledge bases.

[0005] The present invention provides a method and system for identifying attack agent model bases, which adopts the following technical solution:

[0006] Firstly, a method for identifying the base of an attack agent model specifically includes:

[0007] Obtain a base model, generate at least one variant model for each base model, and each base model and its variant model constitute a training model set. The same base model and its variant model belong to the same model category.

[0008] The inner layer iterative optimization is performed, with the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. The response text is input into the encoder with frozen parameters to extract the corresponding first feature vector. The fitness value is calculated based on the intra-class distance between the first feature vectors belonging to the same model category and the inter-class distance between the first feature vectors belonging to different model categories. The current prompt word sequence is subjected to genetic operation based on the fitness value to generate the next generation of prompt word sequence. The iteration is performed until the inner layer termination condition is met to obtain the first prompt word sequence.

[0009] The training model set is queried using the first prompt word sequence, and the second feature vector corresponding to each model is extracted as a training sample. The model category to which each model belongs is used as the training label to train a classifier. The classifier is fixed, and the inner layer iterative optimization is continued with the first prompt word sequence as the initial sequence until the outer layer termination condition is met to obtain the second prompt word sequence.

[0010] The second prompt word sequence is input into the model to be detected to obtain the response text to be detected. The response text to be detected is input into the encoder to extract the third feature vector. The third feature vector is input into the classifier. The model category to which the model to be detected belongs is determined based on the output of the classifier.

[0011] This invention provides a method for identifying attack agent model pedestals. It constructs a training model set containing variant models and pedestal models, and performs cue word evolution based on fitness functions that maximize inter-class distance and minimize intra-class distance. Through a double-layer nested optimization mechanism of inner cue word evolution and outer classifier training, the feature vectors extracted by the encoder stably reflect the architecture and inherent training attributes of the pedestal model itself, effectively removing interference signals introduced by fine-tuning adapters and external knowledge bases. This improves the problem that existing technologies cannot effectively identify attack agent pedestal models modified by fine-tuning or external knowledge bases.

[0012] Optionally, the variant model includes a first type of variant model and a second type of variant model; the first type of variant model is generated by adding a low-rank adapter to the attention layer projection matrix of the base model and fine-tuning it using different random seeds and different data subsets; the second type of variant model is generated by combining the base model with vector index libraries constructed from text corpora of different domains, as well as retrieval behaviors generated based on different embedding models and different retrieval parameters.

[0013] Optionally, when the encoder that freezes the response text input parameters extracts the corresponding first feature vector, it includes:

[0014] The response text output by each model is input into the encoder with frozen parameters, and forward propagation is performed to extract the hidden state matrix output by the last layer of the encoder.

[0015] Average pooling is performed on the hidden state vectors corresponding to each token position in the hidden state matrix to obtain a feature vector of fixed dimension.

[0016] Optionally, when calculating the fitness value based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories, the following steps are included:

[0017] Calculate the mean of the feature vectors corresponding to all variant models within each model category, and use it as the class center of that category;

[0018] The intra-class distance is the average of the cosine distances between feature vector pairs corresponding to all different variant combinations within the same model category;

[0019] The inter-class distance is the average of the cosine distances between the class centers corresponding to all different model category combinations;

[0020] The weighted difference between the inter-class distance and the intra-class distance is used as the fitness value.

[0021] Optionally, when performing genetic operations on the current prompt word sequence based on the fitness value to generate the next generation of prompt word sequences, the process includes:

[0022] Each prompt word sequence in the current iteration round is used as an individual in the population; the fitness value of each individual in the population is calculated; a parent individual is selected from the population based on the fitness value; mutation and crossover operations are performed on the parent individuals to generate offspring individuals; the offspring individuals are used as prompt word sequences in the next generation population.

[0023] Optionally, the mutation operation includes: replacing a token in the prompt word sequence corresponding to an individual in the population with another token in the word list with a first preset probability; inserting a token in the prompt word sequence corresponding to an individual in the population with a second preset probability; and deleting a token in the prompt word sequence corresponding to an individual in the population with a third preset probability.

[0024] The crossover operation includes: swapping the positions of the cue word sequences corresponding to two individuals in the population within their respective sequences.

[0025] Optionally, when determining the model category to which the model to be detected belongs based on the output of the classifier, the following steps are included:

[0026] Each third feature vector is input into the classifier to obtain the probability distribution of the model category corresponding to each third feature vector. The probability distribution is voted on, and the model category to which the model to be detected belongs is determined according to the voting results.

[0027] The voting includes hard voting and soft voting; hard voting is to determine the class that appears most frequently in the model categories corresponding to each third feature vector as the judgment result; soft voting is to average the probability distribution of the classifier outputs corresponding to each third feature vector and take the class with the highest average probability as the judgment result.

[0028] Secondly, an attack agent model base identification system specifically includes:

[0029] A variant construction module is used to obtain a base model and generate at least one variant model for each base model. Each base model and its variant model constitute a training model set. The same base model and its variant model belong to the same model category.

[0030] The inner loop module is used to perform inner iterative optimization. Taking the prompt word sequence as the optimization object, in each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. The response text is input into the encoder with frozen parameters to extract the corresponding first feature vector. The fitness value is calculated based on the intra-class distance between the first feature vectors belonging to the same model category and the inter-class distance between the first feature vectors belonging to different model categories. The current prompt word sequence is subjected to genetic operation based on the fitness value to generate the next generation of prompt word sequence. The iteration is executed until the inner termination condition is met to obtain the first prompt word sequence.

[0031] The outer loop module is used to query the training model set with the first prompt word sequence, extract the second feature vector corresponding to each model as training samples, use the model category to which each model belongs as training labels, and train the classifier; fix the classifier, and continue to perform inner iterative optimization with the first prompt word sequence as the initial sequence until the outer termination condition is met to obtain the second prompt word sequence;

[0032] The base recognition module is used to input the second prompt word sequence into the model to be detected, obtain the response text to be detected, input the response text to be detected into the encoder to extract the third feature vector, input the third feature vector into the classifier, and determine the model category to which the model to be detected belongs based on the output of the classifier.

[0033] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0034] 1. The invention constructs multiple fine-tuning variants and retrieval-enhanced generative variants under the same base model during the training phase, and designs a fitness function that includes intra-class distance minimization constraints. This enables the evolutionarily generated prompts to effectively remove interference signals introduced by fine-tuning and external knowledge bases, directly lock the inherent fingerprint features of the base model, and maintain a stable base model recognition capability for agents modified by instruction fine-tuning or retrieval enhancement.

[0035] 2. In the online monitoring phase of this invention, only the optimized prompt word sequence needs to be input into the model to be detected and the output response needs to be obtained. The entire process only relies on the text output of the target model and does not require access to model parameters, gradients or internal representations. The feature encoding adopts a lightweight frozen encoder, combined with a simplified multilayer perceptron classifier for feature space classification, avoiding the serial processing method that relies on large models for semantic reasoning. The computational overhead of a single detection is small, and it supports batch processing and parallel reasoning for multiple models to be detected, meeting the high concurrency requirements in real-time monitoring scenarios.

[0036] 3. The accuracy of this invention in identifying base model categories is significantly better than existing methods, providing reliable technical support for attacker profiling and tracing the origins of attack organizations. Attached Figure Description

[0037] Figure 1 A flowchart of an attack agent model base identification method provided in an embodiment of the present invention;

[0038] Figure 2 This is a structural diagram of an attack agent model base identification system provided in an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0040] See Figure 1 This invention provides a method for identifying the base of an attack agent model, comprising the following steps:

[0041] S1. Obtain the base model, generate at least one variant model for each base model, and each base model and its variant model constitute the training model set. The same base model and its variant model belong to the same model category.

[0042] S2. Perform inner-layer iterative optimization, using the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. The response text is input into the encoder with frozen parameters to extract the corresponding first feature vector. The fitness value is calculated based on the intra-class distance between the first feature vectors belonging to the same model category and the inter-class distance between the first feature vectors belonging to different model categories. Genetic operation is performed on the current prompt word sequence based on the fitness value to generate the next generation of prompt word sequence. Iterative execution continues until the inner-layer termination condition is met to obtain the first prompt word sequence.

[0043] S3. Query the training model set using the first prompt word sequence, extract the second feature vector corresponding to each model as training samples, use the model category to which each model belongs as training labels, and train the classifier; fix the classifier, use the first prompt word sequence as the initial sequence to continue to perform inner layer iterative optimization until the outer layer termination condition is met, and obtain the second prompt word sequence;

[0044] S4. Input the second prompt word sequence into the model to be detected, obtain the response text to be detected, input the response text to be detected into the encoder to extract the third feature vector, input the third feature vector into the classifier, and determine the model category to which the model to be detected belongs based on the output of the classifier.

[0045] In some embodiments, in step S1, a base model is obtained, and at least one variant model is generated for each base model. Each base model and its variant models constitute a training model set. When the same base model and its variant models belong to the same model category, the specific process is as follows:

[0046] S11. Obtain N base models, where N is a positive integer greater than or equal to 2. These base models are open-source, commercially viable large language models, and can be Llama series models, Qwen series models, Gemma series models, Mistral series models, and DeepSeek series models. Each base model has a different model architecture and pre-training data distribution, providing a basis for distinguishing objects in subsequent recognition.

[0047] S12. For each base model, generate at least one type-1 variant model using low-rank adapter (LoRA) fine-tuning. The specific process is as follows:

[0048] S121. Obtain a public dialogue dataset, such as UltraChat. Format each multi-turn dialogue in the dataset as a text format "User: ... \n Assistant: ...", and use it as a fine-tuning training sample;

[0049] S122. Select a training subset from the dataset for fine-tuning training. For different Class I variant models of the same base model, use different random seeds and different data subsets for training to ensure that there are differences in data distribution among the Class I variant models. Specifically, select different random seed values ​​from the integer range of 0 to 9999, and randomly select a preset number (e.g., 1000) of continuous dialogue samples from the dataset each time as the training subset;

[0050] S123. Add low-rank adapters to the query projection layer and value projection layer of the attention layer in the base model, setting the rank r=8, scaling factor α=16, and Dropout=0.05. Freeze all original parameters of the base model and train only the parameters of the newly added low-rank adapters; the weights of the base model remain unchanged during training. The number of parameters in the LoRA Class 1 variant model is 0.1% to 0.5% of the number of parameters in the base model.

[0051] S124. After each type 1 variant model is trained, it is saved as an independent model directory and the training metadata of the variant model is recorded. The training metadata includes random seed value, data subset range and hyperparameter configuration.

[0052] Through step S12 above, each base model can generate K1 first-class variant models, where K1 is a positive integer greater than or equal to 1 (e.g., K1=4). The differences between the first-class variant models come from different random seeds (affecting the model initialization order and Dropout randomness) and different subsets of training data (affecting the knowledge content learned by the model), thus simulating model variants under different fine-tuning configurations;

[0053] S13. For each base model, generate at least one second-type variant model using the Retrieval-Augmented Generation (RAG) configuration. The specific process is as follows:

[0054] S131. Select M publicly available text corpora from different domains, where M is a positive integer greater than or equal to 1. These publicly available text corpora can be subsets of Wikipedia, technical documents, and news corpora. For the text corpora of each domain, segment them into text blocks, convert each text block into a vector representation using an embedding model, and construct M independent vector index libraries for each.

[0055] S132. Select different embedding models and different retrieval parameters. The embedding models can be text-embedding-3-small and bge-large-zh, and the retrieval parameters can be Top-K values, with Top-K values ​​ranging from 3 to 10. Different second-type variant models are configured with different embedding models and different Top-K values ​​to produce diverse retrieval behaviors;

[0056] S133. Combine and configure the base model with the different knowledge bases and different search engines mentioned above to generate multiple sets of second-type variant models. Each set of variant models contains a combination of a base model, a vector index library, and a search engine configuration;

[0057] Through step S13 above, each base model can generate K2 second-type variant models, where K2 is a positive integer greater than or equal to 1 (e.g., K2=4). The differences between the second-type variant models come from different knowledge bases (affecting the retrieved knowledge content) and different retrieval configurations (affecting retrieval behavior and results), thus simulating model variants under different RAG configurations;

[0058] S14. The training model set is composed of each base model and all its corresponding variant models (including the first and second type variant models). The same base model and all its variant models belong to the same model category, with the base model's identifier serving as the category label. Let the number of variant models for each base model be K (K = K1 + K2). The training model set contains N base models and N×K variant models, totaling N×(K+1) models. Each model is used in a black-box manner for subsequent steps; that is, the output response text is only obtained through input prompts, without accessing the model's internal parameters, gradients, or hidden states.

[0059] In some embodiments, inner-layer iterative optimization is performed in step S2, using the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. When the response text is input into the encoder with frozen parameters and the corresponding first feature vector is extracted, the specific process is as follows:

[0060] S211. Initialize a population consisting of M prompt word sequences, where M is a positive integer greater than 1. Each prompt word sequence is a variable-length token sequence P=[t_1,t_2,...,t_L], where L is the sequence length, ranging from 10 to 100 tokens. Each token comes from the vocabulary of the target base model. The population initialization employs a hybrid initialization strategy: 50% of the prompt word sequences are sampled from natural language templates, including but not limited to phrases such as "Please answer the following question:...", "The following is a text:...", "Please generate a reply based on the following:..."; the remaining 50% of the prompt word sequences are completely random token sequences, i.e., tokens are uniformly and randomly sampled from the vocabulary and filled to a random length. This hybrid initialization strategy ensures that the initial population possesses both semantic rationality and diversity, providing ample exploration space for subsequent evolutionary search.

[0061] S212. In the current iteration round, each prompt word sequence in the population is input into each model in the training model set, and the response text output by each model is obtained. Assume the training model set contains N base models and K variant models corresponding to each base model, for a total of N×(K+1) models. For a prompt word sequence in the current iteration round, it is input into these N×(K+1) models respectively, obtaining N×(K+1) response texts;

[0062] S213. Input all the response texts obtained in S212 into a parameter-frozen encoder to extract the first feature vector corresponding to each response text. The specific process is as follows:

[0063] S2131. Input the response text into the encoder, perform forward propagation calculation, and extract the hidden state matrix output by the last Transformer module of the encoder. The encoder can adopt the GPT-2-NEO model, with a hidden layer dimension d=768;

[0064] S2132. Perform average pooling on the hidden state vectors corresponding to all token positions in the hidden state matrix to obtain the fixed-dimensional feature vectors corresponding to the response text.

[0065] Through the above operations, all model response texts corresponding to each prompt word sequence are converted into N×(K+1) d-dimensional first feature vectors, forming the feature representation set of the current prompt word sequence in this iteration round. The encoder parameters remain frozen throughout the entire inner layer iterative optimization process and are not updated. The reason for choosing a parameter-frozen encoder instead of a trainable learnable encoder is to avoid the encoder itself overfitting to the training distribution and to ensure the generality and generalization ability of feature extraction.

[0066] In some embodiments, the specific process for calculating the fitness value in step S2 based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories is as follows:

[0067] S221. Let P be the prompt word sequence in the current iteration. For this prompt word sequence, the response text output by each model in the training model set is extracted by the encoder to obtain the corresponding first feature vector set. Where i∈[1,N] represents the base model index, and j∈[1,K] represents the variant model index under this base model. This represents the feature vector corresponding to the j-th variant response text of the i-th base model under the current prompt word P;

[0068] S222. Inter-class distance measures the degree of feature separation between different base model categories. A higher value indicates that the features of different base models are more dispersed in space. The inter-class distance is calculated as follows: for all possible combinations of two different base model categories, calculate the cosine distance between their class centers, and then average the results for all combinations to obtain the inter-class distance. All formulas are as follows:

[0069] ,

[0070] in, This represents the feature mean of all K variants of the i-th pedestal model, i.e., the "class center" vector of that category; represents the feature mean (class center) of all variants of the i'th pedestal model; The calculation is for the class centers of the two base models. and The cosine distance between them;

[0071] S223. Intra-class distance measures the degree of feature dispersion among different variant models within the same base model category. A smaller value indicates greater clustering of different variants of the same base model in the feature space. The intra-class distance is calculated as follows: For each base model category, calculate the cosine distance between the feature vectors corresponding to all different variant combinations within that category. Then, take the average over all categories and all combinations to obtain the intra-class distance, Intra_Dist, using the following formula:

[0072] ,

[0073] in, This represents the feature vector of the j-th variant of the i-th pedestal model; This represents the feature vector of the j'th variant of the i-th pedestal model; This represents the cosine similarity between two variant feature vectors; This represents the cosine distance between two different variant eigenvectors under the same base.

[0074] S224. Calculate the fitness value of the current prompt word sequence P by weighting and combining the inter-class distance and intra-class distance mentioned above. The formula used is as follows:

[0075] ,

[0076] in, This represents the preset weighting coefficients used to adjust the system's preference for "distinguishing between different pedestal models" and "tolerating differences between different variants under the same pedestal." A higher fitness value indicates that the cue word sequence is more effective in stimulating the genetic characteristics of each pedestal model, as the inter-class distance is larger and the intra-class distance is smaller.

[0077] In some embodiments, when performing genetic operations on the current prompt word sequence based on the fitness value in step S2 to generate the next generation of prompt word sequences, and iterating until the inner termination condition is met to obtain the first prompt word sequence, the specific process is as follows:

[0078] S231. In the current population, sort the M individuals in the population in descending order according to the fitness values ​​calculated in step S224. Adopt an elite retention strategy, directly retaining the top-5 individuals with the highest fitness values ​​to the next generation to ensure that the optimal solution is not lost. For the remaining offspring individuals, a tournament selection strategy is used to generate parents: each time, three individuals are randomly selected from the current population, and the individual with the highest fitness value is chosen as the parent. This process is repeated until a sufficient number of parents are selected.

[0079] S232. Perform a crossover operation on the parent individuals with a crossover probability p_c (e.g., 0.5). Specifically, randomly select two parent cue word sequences P_A and P_B, and randomly select a crossover point in each sequence. Swap the segment of P_A before the crossover point with the segment of P_B ​​before the crossover point to generate two child cue word sequences. This crossover operation allows for the recombination of segments from different high-quality cue word sequences, which helps in exploring better cue word combinations.

[0080] S233. Perform a mutation operation on the offspring individuals with a mutation probability p_m (e.g., a value of 0.3). Mutation operations include the following three methods:

[0081] 1) Randomly select a position in the prompt word sequence with a first preset probability (e.g., 60%), and replace the token at that position with another token in the vocabulary. Preferably, the semantic nearest neighbor of the token to be replaced can be calculated using the word embedding layer of the encoder itself, and one of the k nearest neighbor tokens with a cosine similarity greater than a threshold can be randomly selected for replacement to ensure that the mutated prompt word sequence maintains semantic coherence;

[0082] 2) Randomly select a position in the prompt word sequence with a second preset probability (e.g., 20%), and insert a new token at that position. The new token is randomly sampled from the word list.

[0083] 3) Randomly select a position in the prompt word sequence with a third preset probability (e.g., 20%), delete the token at that position, and ensure that the length of the sequence after deletion is not lower than the preset minimum length threshold;

[0084] S234. Merge the elite individuals retained in step S231, the offspring individuals generated by crossover in step S232, and the offspring individuals generated by mutation in step S233 to form the next generation population, with the population size remaining unchanged at M individuals.

[0085] S235. Repeat steps S212 to S234 until the preset inner-layer termination condition is met. Stop the iteration and output the prompt word sequence with the highest fitness value in the current population as the first prompt word sequence. The inner-layer termination condition is achieved when either of the following conditions is met: the number of iteration rounds reaches the preset maximum number of iteration rounds T_inner (e.g., T_inner = 50 rounds); or the highest fitness value in the population has not improved in multiple consecutive iteration rounds, that is, the improvement of the fitness value is lower than the preset threshold.

[0086] In some embodiments, in step S3, the training model set is queried using the first prompt word sequence, the second feature vector corresponding to each model is extracted as a training sample, and the model category to which each model belongs is used as the training label to train the classifier; the classifier is fixed, and inner-layer iterative optimization is continued with the first prompt word sequence as the initial sequence until the outer-layer termination condition is met. When the second prompt word sequence is obtained, the specific process is as follows:

[0087] S31. Input the first prompt word sequence obtained after the inner layer iterative optimization terminates into each model in the training model set, and obtain the response text output by each model. The first prompt word sequence contains at least one prompt word. Input each prompt word in the sequence into each model in the training model set to obtain the corresponding response text. Input each response text into the encoder, and extract the second feature vector corresponding to each response text according to the same feature extraction method as in step S213. For each model in the training model set, use its second feature vector under all prompt words as a set of feature representations of the model, and use the base model category identifier to which the model belongs as the training label of the set of feature vectors to construct the training dataset D_train={(x_m,y_i)}, where x_m is the feature vector of the m-th prompt word sequence for model i, and y_i is the base model ID label;

[0088] S32. Divide the training dataset according to the dimension of the variant models to ensure that variant models in the validation set do not appear in the training set, in order to test the generalization ability of the classifier. Specifically, for each variant model under each base model category, randomly divide it into training set variants and validation set variants according to a preset ratio (e.g., 80%:20%). Assign feature vector samples corresponding to all models belonging to the training set variants to the training data subset, and assign feature vector samples corresponding to all models belonging to the validation set variants to the validation data subset.

[0089] S33. Construct a multilayer perceptron classifier with an input layer dimension of d, consistent with the dimension of the encoder's output feature vector (e.g., d=768). The classifier consists of an input layer, a first hidden layer, a second hidden layer, and an output layer. The first hidden layer has a dimension of 512, followed by a ReLU activation function and a Dropout layer (with a preset Dropout rate of 0.3); the second hidden layer has a dimension of 256, also followed by a ReLU activation function and a Dropout layer (with a preset Dropout rate of 0.3); the output layer has a dimension of N, consistent with the total number of base model categories, followed by a Softmax activation function, outputting the probability distribution of each base model category.

[0090] S34. Use the cross-entropy loss function as the training objective, update the parameters using the Adam optimizer, and set the learning rate to 1×10. -4The weight decay coefficient is 1×10 -5 The batch size is 32. A subset of training data is input into the classifier in batches for forward and backward propagation, and training is iterated until a preset number of training epochs (e.g., 50 epochs) is reached. After each training epoch, a subset of validation data is input into the classifier for evaluation, and the validation set accuracy is monitored to determine whether the training has converged.

[0091] S35. After the classifier training is complete, all classifier parameters are fixed and will not be updated in subsequent optimization processes. Using the first prompt word sequence as the initial population, the inner iterative optimization process is re-executed. The fitness function in the outer iterative optimization remains consistent with the fitness function in the inner iterative optimization, i.e., it is still based on inter-class distance and intra-class distance to calculate the fitness value, as shown in S221 to S224. In each round of optimization, the current prompt word sequence is input into each model in the training model set, the encoder extracts the first feature vector, and the weighted difference between inter-class distance and intra-class distance is calculated as the fitness value. Genetic operations are then performed to generate the next generation of prompt word sequences. The mechanism of the outer optimization is as follows: the classifier provides a fixed evaluation perspective. As the prompt words continue to be optimized, the continuous improvement of inter-class distance and intra-class distance further strengthens the class separability of the feature space, making the classification boundary of the classifier in this feature space clearer and more stable.

[0092] S36. Repeat the optimization iteration until the preset outer termination condition is met. Stop the iteration and output the prompt word sequence with the highest fitness value in the current population as the second prompt word sequence. The outer termination condition is achieved when any of the following conditions are met: the number of iteration rounds reaches the preset maximum number of outer iteration rounds T_outer (e.g., T_outer = 30 rounds); or the highest fitness value in the population does not improve in multiple consecutive outer iteration rounds, i.e., the improvement in fitness value is lower than the preset threshold; or the classification accuracy of the classifier on the validation set no longer increases in multiple consecutive outer iteration rounds.

[0093] S37. The first prompt word sequence is the optimization result obtained after the inner layer iteration optimization terminates, and the second prompt word sequence is the further optimization result obtained after continuing to perform outer layer iteration optimization with the first prompt word sequence as the initial sequence. The second prompt word sequence inherits the excellent features of the first prompt word sequence and continues to evolve under the supervision of a fixed classifier, so that the classification performance of the feature vector extracted based on the second prompt word sequence on the classifier is better than that of the feature vector extracted based on the first prompt word sequence.

[0094] In some embodiments, in step S4, when the second prompt word sequence is input into the model to be detected to obtain the response text to be detected, the response text to be detected is input into the encoder to extract the third feature vector, the third feature vector is input into the classifier, and the model category to which the model to be detected belongs is determined based on the output of the classifier, the specific process is as follows:

[0095] S41. The second prompt word sequence obtained after the outer layer iterative optimization terminates is used as the query input for the detection phase. The second prompt word sequence contains at least one prompt word. Let the second prompt word sequence contain M' prompt words, where M' is a positive integer greater than or equal to 1. In practical applications, M' can be set to an integer between 5 and 10 to achieve a stable recognition accuracy.

[0096] S42. Input each prompt word in the second prompt word sequence into the detection model and obtain the corresponding output response text of the detection model under each prompt word;

[0097] S43. Input each of the response texts to be detected obtained in S42 into the encoder, and extract the third feature vector corresponding to each response text. The specific process is the same as the feature extraction method in step S213:

[0098] S431. Input the response text to be detected into the encoder, perform forward propagation, and extract the hidden state matrix output by the last Transformer module of the encoder. , where L is the token length of the response text R, and d is the hidden layer dimension of the encoder (768 dimensions).

[0099] S432. Perform average pooling on the hidden state vectors corresponding to all token positions in the hidden state matrix H to obtain the third feature vector corresponding to the response text. Perform the above operation on all M' response texts to be detected to obtain M' third feature vectors. The encoder maintains the same parameter freeze state during the detection phase as it did during the training phase, without making any updates.

[0100] S44. Input each of the third feature vectors obtained in step S43 into the trained classifier to obtain the probability distribution of the base model category corresponding to each third feature vector. For the m-th third feature vector, the classifier outputs its probability distribution p_m=[p_m(1),p_m(2),...,p_m(N)] across N base model categories, where p_m(i) represents the probability that the feature vector belongs to the i-th base model category. A voting mechanism is used to aggregate the M' classification results, and the base model category to which the model to be detected belongs is determined based on the aggregation result. The voting mechanism includes two methods: hard voting and soft voting.

[0101] 1) Hard voting method: For the m-th third feature vector, the category corresponding to the highest probability in its probability distribution is taken as the single voting result of the prompt word. The category that appears most frequently in the voting results of the M' prompt words is taken as the final judgment result. If there are multiple ties, one of the categories can be randomly selected or the category with the highest total probability can be selected as the final result.

[0102] 2) Soft voting method: Take the average probability distribution of the probability distributions corresponding to all M' third feature vectors. The category with the highest average probability is used as the final judgment result. The soft voting method utilizes the probability confidence information of each prompt word classification result, exhibiting more stable discrimination performance when category boundaries are ambiguous.

[0103] In some preferred embodiments, a rejection threshold θ is also set in the soft voting method. The average probability distribution is calculated. The highest probability value in _max. If If the maximum value (_max) is lower than a preset threshold θ, the model to be detected is determined to be an unknown base model category, meaning it does not belong to any of the N base model categories included in the training model set, and a specific category determination result is refused. The value of the rejection threshold θ is determined according to the security requirements of the actual application scenario, and the value ranges from 0.3 to 0.6, preferably θ=0.4. The rejection mechanism can effectively avoid misclassifying unknown models into known categories under low confidence conditions, improve the reliability of the detection system, and has practical value for dealing with attack agents from unknown sources in actual deployments.

[0104] S45. Output the final determined base model category as the detection result. This detection result can be used for subsequent attacker profiling and source tracing analysis. For example, by associating the identified base model type with information such as the open-source community, download channels, and commonly used modification tools of the base model, the attacker's technical resources and capability level can be inferred; or the base model categories identified in multiple attack events can be compared and correlated. If the agents in multiple attack events are identified as the same base model category, it can be inferred that they may come from the same attack group or use the same set of tools.

[0105] See Figure 2 This invention provides an attack agent model base identification system, comprising the following steps:

[0106] Variant construction module 100 is used to obtain base models, generate at least one variant model for each base model, and each base model and its variant model constitute a training model set. The same base model and its variant model belong to the same model category.

[0107] The inner loop module 200 is used to perform inner loop iterative optimization. It takes the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. The response text is input into the encoder with frozen parameters to extract the corresponding first feature vector. The fitness value is calculated based on the intra-class distance between the first feature vectors belonging to the same model category and the inter-class distance between the first feature vectors belonging to different model categories. The genetic operation is performed on the current prompt word sequence based on the fitness value to generate the next generation of prompt word sequence. The iteration is executed until the inner loop termination condition is met to obtain the first prompt word sequence.

[0108] The outer loop module 300 is used to query the training model set with the first prompt word sequence, extract the second feature vector corresponding to each model as training samples, use the model category to which each model belongs as training labels, and train the classifier; fix the classifier, and continue to perform inner iterative optimization with the first prompt word sequence as the initial sequence until the outer termination condition is met to obtain the second prompt word sequence;

[0109] The base recognition module 400 is used to input the second prompt word sequence into the model to be detected, obtain the response text to be detected, input the response text to be detected into the encoder to extract the third feature vector, input the third feature vector into the classifier, and determine the model category to which the model to be detected belongs based on the output of the classifier.

[0110] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for identifying the base of an attack agent model, characterized in that, include: A base model is obtained, and at least one variant model is generated for each base model. Each base model and its variant model constitute a training model set. The same base model and its variant model belong to the same model category. The variant models include a first type of variant model and a second type of variant model. The first type of variant model is generated by adding a low-rank adapter to the attention layer projection matrix of the base model and fine-tuning it using different random seeds and different data subsets. The second type of variant model is generated by combining the base model with vector index libraries constructed from text corpora of different domains, as well as retrieval behaviors generated based on different embedding models and different retrieval parameters. The inner-layer iterative optimization is performed, using the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. The response text is then input into the encoder with frozen parameters to extract the corresponding first feature vector. The fitness value is calculated based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories. Genetic operations are performed on the current prompt word sequence based on the fitness value to generate the next generation of prompt word sequences. This process is iterated until the inner-layer termination condition is met to obtain the first prompt word sequence. The calculation of the fitness value based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories includes: calculating the intra-class distance between each first feature vector belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories. The mean of the feature vectors corresponding to all variant models within a model category is used as the class center of that category; the intra-class distance is the average of the cosine distances between feature vector pairs corresponding to all different variant combinations within the same model category; the inter-class distance is the average of the cosine distances between the class centers corresponding to all different model category combinations; the weighted difference between the inter-class distance and the intra-class distance is used as the fitness value; when performing genetic operations on the current prompt word sequence to generate the next generation of prompt word sequences based on the fitness value, the process includes: using each prompt word sequence in the current iteration round as an individual in the population; calculating the fitness value of each individual in the population; selecting parent individuals from the population based on the fitness value; performing mutation and crossover operations on the parent individuals to generate offspring individuals; and using the offspring individuals as prompt word sequences in the next generation population. The training model set is queried using the first prompt word sequence, and the second feature vector corresponding to each model is extracted as a training sample. The model category to which each model belongs is used as the training label to train a classifier. The classifier is fixed, and the inner layer iterative optimization is continued with the first prompt word sequence as the initial sequence until the outer layer termination condition is met to obtain the second prompt word sequence. The second prompt word sequence is input into the model to be detected to obtain the response text to be detected. The response text to be detected is input into the encoder to extract the third feature vector. The third feature vector is input into the classifier. The model category to which the model to be detected belongs is determined based on the output of the classifier.

2. The method as described in claim 1, characterized in that, When the encoder that freezes the response text input parameters extracts the corresponding first feature vector, it includes: The response text output by each model is input into the encoder with frozen parameters, and forward propagation is performed to extract the hidden state matrix output by the last layer of the encoder. Average pooling is performed on the hidden state vectors corresponding to each token position in the hidden state matrix to obtain a feature vector of fixed dimension.

3. The method as described in claim 1, characterized in that, The mutation operation includes: replacing one token in the prompt word sequence corresponding to an individual in the population with another token in the word list with a first preset probability; inserting a token in the prompt word sequence corresponding to an individual in the population with a second preset probability; and deleting one token in the prompt word sequence corresponding to an individual in the population with a third preset probability. The crossover operation includes: swapping the positions of the cue word sequences corresponding to two individuals in the population within their respective sequences.

4. The method as described in claim 1, characterized in that, When determining the model category to which the model to be detected belongs based on the output of the classifier, the following steps are included: Each third feature vector is input into the classifier to obtain the probability distribution of the model category corresponding to each third feature vector. The probability distribution is voted on, and the model category to which the model to be detected belongs is determined according to the voting results. The voting includes hard voting and soft voting; hard voting is to determine the class that appears most frequently in the model categories corresponding to each third feature vector as the judgment result; soft voting is to average the probability distribution of the classifier outputs corresponding to each third feature vector and take the class with the highest average probability as the judgment result.

5. A system for identifying attack agent model bases, characterized in that, include: A variant construction module is used to obtain a base model and generate at least one variant model for each base model. Each base model and its variant model constitute a training model set. The same base model and its variant model belong to the same model category. The variant models include a first type of variant model and a second type of variant model. The first type of variant model is generated by adding a low-rank adapter to the attention layer projection matrix of the base model and fine-tuning it using different random seeds and different data subsets. The second type of variant model is generated by combining the base model with vector index libraries constructed from text corpora of different domains, as well as retrieval behaviors generated based on different embedding models and different retrieval parameters. The inner loop module performs inner iterative optimization, using the prompt word sequence as the optimization object. In each iteration, the current prompt word sequence is input into each model in the training model set to obtain the response text output by each model. This response text is then input into the encoder with frozen parameters to extract the corresponding first feature vector. Fitness values ​​are calculated based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories. Genetic operations are then performed on the current prompt word sequence based on the fitness values ​​to generate the next generation of prompt word sequences. This iterative process continues until the inner termination condition is met, resulting in the first prompt word sequence. Specifically, when calculating the fitness value based on the intra-class distance between first feature vectors belonging to the same model category and the inter-class distance between first feature vectors belonging to different model categories, the module includes... The process includes: calculating the mean of the feature vectors corresponding to all variant models within each model category, which is used as the class center of that category; the intra-class distance is the average of the cosine distances between feature vector pairs corresponding to all different variant combinations within the same model category; the inter-class distance is the average of the cosine distances between the class centers corresponding to all different model category combinations; using the weighted difference between the inter-class distance and the intra-class distance as the fitness value; and performing genetic operations on the current prompt word sequence based on the fitness value to generate the next generation of prompt word sequences, including: using each prompt word sequence in the current iteration round as an individual in the population; calculating the fitness value of each individual in the population; selecting parent individuals from the population based on the fitness value; performing mutation and crossover operations on the parent individuals to generate offspring individuals; and using the offspring individuals as prompt word sequences in the next generation population. The outer loop module is used to query the training model set with the first prompt word sequence, extract the second feature vector corresponding to each model as training samples, use the model category to which each model belongs as training labels, and train the classifier; fix the classifier, and continue to perform inner iterative optimization with the first prompt word sequence as the initial sequence until the outer termination condition is met to obtain the second prompt word sequence; The base recognition module is used to input the second prompt word sequence into the model to be detected, obtain the response text to be detected, input the response text to be detected into the encoder to extract the third feature vector, input the third feature vector into the classifier, and determine the model category to which the model to be detected belongs based on the output of the classifier.

Images