An anti-AI pollution multi-modal retrieval information filtering method and system

Abstract

The present application relates to the technical field of retrieval information filtering, and particularly relates to a multi-modal retrieval information filtering method and system for preventing AI pollution, which comprises the following steps: performing multi-modal coding on news text samples to obtain embedding vectors, calculating batch semantic centroid vectors and maintaining historical sequences; calculating a drift direction vector, a drift consistency score and a cumulative drift displacement based on the historical sequences, and triggering a time domain drift alarm based on double thresholds; recording query vectors and retrieval result vectors in multi-hop reasoning retrieval, calculating a jump level deviation angle, a deviation change rate and normalizing; calculating a drift projection value, and weighting and summing three indexes to obtain a cross-dimension pollution confidence score; when the score exceeds a threshold, backtracking to determine a starting batch, marking and isolating pollution candidate samples, and re-searching and outputting a filtering result. The present application effectively identifies and removes AI pollution attacks through cross-dimension collaborative detection and drift contribution degree tracing and isolation, thereby ensuring the security of the retrieval system.

Description

Technical Field

[0001] This invention relates to the field of information retrieval filtering technology, specifically to a multimodal information retrieval filtering method and system that prevents AI contamination. Background Technology

[0002] With the explosive growth of internet information, multimodal retrieval systems have been widely used in scenarios such as news recommendation and intelligent question answering. These systems typically use deep learning models to map multimodal data, such as text and images, into a unified embedding space, achieving cross-modal information retrieval through vector similarity calculation. To adapt to the need for real-time data updates, multimodal retrieval systems often employ an incremental batch update mechanism, periodically encoding newly collected news and image samples and adding them to the corpus. However, this open update model provides an opportunity for malicious attackers: by injecting carefully constructed "contaminated samples" (such as adversarial image-text pairs containing hidden semantic biases) into the update batches, attackers can gradually contaminate the semantic distribution of the corpus, thereby inducing the retrieval system to return pre-set malicious results. Such AI contamination attacks are highly covert and persistent. A single contaminated sample may not violate any explicit security rules, but the cumulative effect of a large number of contaminated samples can cause a systematic shift in the system's semantic centroid, ultimately compromising the accuracy and reliability of the retrieval results.

[0003] Existing defense techniques against retrieval systems mainly focus on query-time filtering or post-attempt result reordering, such as removing low-quality search results based on anomaly scores and using adversarial training to enhance model robustness. However, these methods all have significant limitations: anomaly detection based on distance thresholds struggles to distinguish between semantic evolution caused by normal hot events and directional drift caused by malicious contamination; single-dimensional detection metrics are prone to false positives or false negatives; more importantly, existing methods generally lack the ability to model the "continuous accumulation and multi-hop propagation" characteristics of contamination attacks, making it impossible to trace the initial batch of contamination and accurately locate suspicious samples in the early stages of an attack. Especially in multimodal scenarios, contamination signals from text and image modalities are often coupled, making traditional single-modal detection methods even more difficult to handle.

[0004] Therefore, there is an urgent need for a method and system that can collaboratively detect AI contamination attacks across time and space domains, accurately locate the initial batch of contaminated samples, and achieve refined isolation and filtering, so as to overcome the shortcomings of existing technologies in terms of detection accuracy, traceability and multimodal adaptability, and ensure the safe and stable operation of the multimodal retrieval system. Summary of the Invention

[0005] In view of the above-mentioned shortcomings of the existing technology, the present invention provides a multimodal retrieval information filtering method and system to prevent AI pollution, which can effectively solve the problems mentioned in the existing technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution: This invention provides a multimodal retrieval information filtering method to prevent AI pollution, the steps of which include: S100. Perform multimodal encoding on each news image and text sample in the current update batch to obtain multimodal embedding vectors respectively. Take the arithmetic mean of all multimodal embedding vectors in the current update batch as the semantic centroid vector of the current batch and append it to the historical centroid vector sequence. S200: Calculate the drift direction vector for each batch based on the historical centroid vector sequence; within a preset time window, calculate the drift consistency score based on the mean cosine similarity between the drift direction vector of each historical batch and the drift direction vector of the current batch, and sum all drift direction vectors within the window to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement; when the drift consistency score exceeds a first preset threshold and the cumulative drift displacement exceeds a second preset threshold, trigger a time-domain drift alarm; S300. During the multi-hop reasoning retrieval process, the original query vector and the hop-level retrieval result vector of each hop are recorded; the hop-level deviation angle of each hop is obtained by inverse calculation of the cosine of the angle between each hop-level retrieval result vector and the original query vector; the deviation change rate is obtained by the difference between the hop-level deviation angles of adjacent hops; and the deviation change rate is normalized based on the historical normal query records to obtain the normalized deviation change rate. S400. Divide the inner product of each skip-level retrieval result vector and the cumulative drift vector by the product of their moduli to obtain the drift projection value; and sum the drift consistency score, the normalized deviation rate of change, and the drift projection value according to preset weights to obtain the cross-dimensional contamination confidence score. S500. When the cross-dimensional contamination confidence score exceeds the third preset threshold, backtrack batch by batch in the historical centroid vector sequence, and determine the next batch of the batch whose drift consistency score first falls below the first preset threshold as the starting batch; mark the news image and text samples within the range from the starting batch to the current updated batch as contamination candidate samples, and isolate them from the news multimodal corpus; re-execute multi-hop inference retrieval with the isolated news multimodal corpus and output the filtering results.

[0007] Furthermore, the steps of calculating the drift direction vector for each batch based on the historical centroid vector sequence and calculating the drift consistency score based on the mean cosine similarity include: The difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence is used as the drift direction vector of each batch; within the preset time window, the arithmetic mean of the cosine similarity between the drift direction vector of each historical batch and the drift direction vector of the current batch is taken to obtain the drift consistency score; the drift consistency score The calculation formula is as follows: ; in, The number of batches within the preset time window; This represents the drift direction vector of the current nth batch; Let be the drift direction vector of the i-th historical batch within the window; and These are the magnitudes of the corresponding vectors; when the magnitude of any drift direction vector is zero, the cosine similarity of the corresponding item takes the preset zero offset default value and does not participate in the amplification calculation of drift consistency.

[0008] Furthermore, the step of normalizing the deviation change rate based on historical normal query records to obtain the normalized deviation change rate includes: The historical mean and standard deviation of the deviation change rate for each jump are extracted from historical normal query records. The deviation change rate for each jump is then subtracted from the historical mean of the corresponding jump and divided by the historical standard deviation of the corresponding jump to eliminate natural deviation differences between different query types, thus obtaining the normalized deviation change rate. The calculation formula is: ; in, Let be the normalized deviation rate of change for the k-th jump; Let be the rate of change of deviation for the k-th jump; This represents the historical average of the deviation rate of the k-th jump position extracted from historical normal query records. The standard deviation of the deviation rate of the k-th jump position is extracted from the historical normal query records. When the number of historical normal query records for a certain jump position is less than the preset minimum sample size, the independent statistical value of that jump position is replaced by the statistical mean and standard deviation of all jump positions within the preset time window for normalization processing.

[0009] Furthermore, the step of weighting and summing the drift consistency score, the normalized deviation rate of change, and the drift projection value according to preset weights to obtain the contamination confidence score for each skipped dimension includes: The cross-dimensional contamination confidence score for each jump is obtained by multiplying the drift consistency score, the normalized deviation rate of change, and the drift projection value by their respective preset weights and then summing them. The sum of the three preset weights is one. The cross-dimensional contamination confidence score can exceed the third preset threshold only when all three factors—the drift consistency score, the normalized deviation rate of change, and the drift projection value—reach a high value, thus eliminating misjudgments caused by any single-dimensional anomaly. The calculation formula is: ; in, The drift projection value of the k-th hop is derived from the calculation step of dividing the inner product of the retrieval result vector of each hop level and the cumulative drift vector by the product of their modulo values. , and For preset weights and satisfying .

[0010] Furthermore, the step of performing multimodal encoding on each news image and text sample in the current update batch to obtain the multimodal embedding vector of each sample includes: The textual content of each news image sample in the current update batch is encoded to obtain a text modality embedding vector; the news image content of each news image sample is encoded to obtain an image modality embedding vector; the text modality embedding vector and the image modality embedding vector are weighted and fused according to a preset modality weight to obtain a multimodal embedding vector for each news image sample.

[0011] Furthermore, the step of isolating the contaminated candidate samples from the news multimodal corpus also includes: For each contaminated candidate sample within the range from the initial batch to the current update batch, calculate the reduction in the cumulative drift displacement after removing the contaminated candidate sample, and record the reduction as the drift contribution of the contaminated candidate sample; sort the contaminated candidate samples from high to low according to the drift contribution, and prioritize the isolation of contaminated candidate samples whose drift contribution exceeds the preset contribution threshold from the news multimodal corpus; for contaminated candidate samples whose drift contribution does not exceed the preset contribution threshold, reduce their retrieval weight to the preset minimum weight value and mark them as awaiting manual review.

[0012] Furthermore, after re-performing multi-hop inference retrieval on the news multimodal corpus following the contaminated candidate samples, the method further includes: recalculating the historical centroid vector sequence and the drift direction vector of each batch using the isolated news multimodal corpus, and recalculating the drift consistency score and the cumulative drift displacement; if the recalculated drift consistency score is lower than the first preset threshold, then the isolation of the contaminated candidate samples is confirmed to be effective, and the batch identifier of the starting batch and the number of isolated samples are written into the filtering result; if the recalculated drift consistency score is still not lower than the first preset threshold, then the starting batch is extended towards the historical direction by a preset batch step, and the labeling and isolation steps of the contaminated candidate samples are re-executed with the extended starting batch.

[0013] Furthermore, the method also includes an anchored query set monitoring step: An anchor query set is pre-maintained, which includes a preset number of semantically fixed news verification queries and the expected retrieval category tags corresponding to each query. After each batch incremental update, multi-hop inference retrieval is performed on each query in the anchor query set, and the proportion of retrieval results corresponding to each expected retrieval category tag in the preset hop position is counted to obtain a time-series record of category proportion. The monotonically increasing rate of the category proportion of each expected retrieval category tag within a consecutive preset number of batches is calculated to obtain an auxiliary drift index. When the auxiliary drift index exceeds a preset auxiliary threshold, the preset weight of the drift consistency score in the calculation of the cross-dimensional contamination confidence score is increased, and the cross-dimensional contamination confidence score is corrected by the auxiliary drift index.

[0014] Furthermore, the step of outputting the filtering result includes: A contamination filtering report is generated, which includes: the batch identifier and timestamp of the starting batch, the jump number corresponding to when the cross-dimensional contamination confidence score exceeds the third preset threshold, the magnitude and direction information of the cumulative drift vector, the drift contribution ranking list of each contamination candidate sample and its corresponding batch affiliation identifier; the contamination filtering report and the search results obtained by re-performing multi-hop inference retrieval after isolation are output as the filtering results.

[0015] A multimodal information retrieval filtering system to prevent AI contamination includes: The centroid calculation module is used to perform multimodal encoding on each news image and text sample in the current update batch to obtain the multimodal embedding vector of each sample, calculate the arithmetic mean of all multimodal embedding vectors in the current update batch to obtain the semantic centroid vector of the current batch, and append the semantic centroid vector of the current batch to the historical centroid vector sequence according to the batch time sequence. The drift trajectory analysis module is used to calculate the difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence to obtain the drift direction vector of each batch. Within a preset time window, the mean value of the cosine similarity between the current batch drift direction vector and the drift direction vectors of each historical batch is calculated to obtain the drift consistency score. The sum of all drift direction vectors within the preset time window is calculated to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement. When the drift consistency score exceeds a first preset threshold and the cumulative drift displacement exceeds a second preset threshold, a time domain drift alarm is triggered. The multi-hop deviation detection module is used to record the original query vector and the hop-level retrieval result vector of each hop during the multi-hop inference retrieval process, calculate the arccosine of the angle between each hop-level retrieval result vector and the original query vector to obtain the hop-level deviation angle of each hop, calculate the difference between the hop-level deviation angles of adjacent hops to obtain the deviation change rate of each hop, and normalize the deviation change rate based on historical normal query records to obtain the normalized deviation change rate of each hop. The cross-dimensional calibration module is used to calculate the inner product of each hop retrieval result vector and the cumulative drift vector, divided by the product of the moduli of the two to obtain the drift projection value of each hop, and to obtain the cross-dimensional contamination confidence score of each hop by weighting and summing the drift consistency score, the normalized deviation change rate and the drift projection value according to the preset weights. The source tracing and isolation module is used to determine the starting batch by backtracking in the historical centroid vector sequence when the cross-dimensional pollution confidence score exceeds the third preset threshold, mark the news image and text samples within the range from the starting batch to the current updated batch as pollution candidate samples and isolate them from the news multimodal corpus, re-execute the multi-hop inference retrieval with the isolated news multimodal corpus, and output the filtering results.

[0016] The technical solution provided by this invention has the following advantages compared with the known prior art: This invention integrates temporal domain semantic drift detection and spatial domain multi-hop deviation detection across dimensions. By coordinating the verification of three indicators—drift consistency score, normalized deviation change rate, and drift projection value—it effectively overcomes the limitations of single-dimensional detection. It fundamentally eliminates false positives caused by single-dimensional anomalies such as normal news events and complex query type differences, significantly reducing false positive and false negative rates, and achieving high-precision identification of AI contamination attacks.

[0017] This invention quantifies the causal impact of a single sample on the overall semantic drift by calculating the drift contribution of each candidate sample. Compared to traditional simple isolation methods based on vector distance thresholds, it can more accurately identify contaminated samples that generate drift effects through collective action. Simultaneously, by combining a closed-loop mechanism of batch backtracking and post-isolation verification and correction, the scope of suspicion is precisely narrowed down from the entire corpus to the batch level. Furthermore, sample-level priority isolation is achieved through contribution ranking, ensuring that contaminated samples are completely removed while minimizing false positives on normal samples, thus guaranteeing the security and availability of the multimodal retrieval system. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0019] Figure 1 This is a schematic diagram of the method structure of the present invention; Figure 2 This is a schematic diagram of the system flow of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] The present invention will be further described below with reference to embodiments.

[0022] Example: Reference Figure 1 A multimodal retrieval information filtering method to prevent AI pollution, the specific steps of which include: S100. Perform multimodal encoding on each news image and text sample in the current update batch to obtain multimodal embedding vectors. Take the arithmetic mean of all multimodal embedding vectors in the current update batch as the semantic centroid vector of the current batch and append it to the historical centroid vector sequence.

[0023] Specifically, multimodal coding and semantic centroid computation include: S101: Text Modality Embedding Vector Encoding. The text content of each news article sample in the current update batch is encoded to obtain a text modality embedding vector. A pre-trained language model (such as BERT or RoBERTa) is used to encode the text concatenated with the news title and body text. The vector corresponding to the mean of the last hidden state or the [CLS] label is taken as the text modality embedding vector.

[0024] S103: Multimodal Embedding Vector Fusion. The text modal embedding vector and the image modal embedding vector are weighted and fused according to preset modal weights to obtain the multimodal embedding vector for each news image sample. Let the text modal embedding vector be... The image modality embedding vector is The preset text weight is Image weights are (satisfy Then the multimodal embedding vector The calculation formula is: ; in, This is the multimodal embedding vector of the current news image and text sample.

[0025] S104: Calculation of the semantic centroid vector for the current batch. The arithmetic mean of all multimodal embedding vectors in the current updated batch is taken as the semantic centroid vector for the current batch. Let the current batch contain N samples, and the multimodal embedding vectors be... , ,..., Then the semantic centroid vector of the current batch The calculation formula is: ; in, Let N be the semantic centroid vector of the current nth batch; N represents the total number of samples in the current batch. This is the multimodal embedding vector of the i-th sample in the current batch.

[0026] S105: Append the historical centroid vector sequence. Add the semantic centroid vectors of the current batch. The data is appended to the historical centroid vector sequence in batches according to time sequence, forming the updated sequence. .

[0027] Step S100 maps all samples in each batch to a single centroid vector, compressing the high-dimensional sample space into a low-dimensional temporal trajectory space, providing a computational basis for subsequent drift detection. Multimodal fusion ensures that the centroid vector simultaneously reflects the semantic information of both text and image modalities.

[0028] S200. Calculate the drift direction vector for each batch based on the historical centroid vector sequence; within a preset time window, calculate the drift consistency score based on the mean cosine similarity between the drift direction vector of each historical batch and the drift direction vector of the current batch, and sum all drift direction vectors within the window to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement; when the drift consistency score exceeds a first preset threshold and the cumulative drift displacement exceeds a second preset threshold, trigger a time-domain drift alarm.

[0029] Specifically, drift trajectory analysis and time-domain drift alarms include: S201: Calculation of drift direction vector. The difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence is used as the drift direction vector for each batch. Let the semantic centroid vector of the k-th batch be... The semantic centroid vector of the (k-1)th batch is Then the drift direction vector of the kth batch The calculation formula is: ; in, Let be the drift direction vector of the kth batch; Represents the semantic centroid vector of the k-th batch; Let represent the semantic centroid vector of the (k-1)th batch. For k=1, since there is no previous batch, let Or exclude it from drift analysis.

[0030] S202: Drift Consistency Score Calculation. Within a preset time window, calculate the mean cosine similarity between the drift direction vector of the current batch and the drift direction vectors of all historical batches to obtain the drift consistency score. Let the number of batches in the preset time window be W, and the current batch be the nth batch, then the drift consistency score... The calculation formula is: ; in The drift consistency score of the current nth batch within window W; W is the number of batches included in the preset time window; n is the batch number; i is the summation index, ranging from 1 to W. This represents the drift direction vector of the current nth batch; Let be the drift direction vector of the i-th historical batch within the window; For vectors The L2 norm (modulus); For vectors The L2 norm (modulus).

[0031] Specifically, when the magnitude of any drift direction vector is zero (i.e., the semantic centroids of adjacent batches are exactly the same, which usually occurs when the sample distribution within a batch is highly consistent or there is no substantial change between batches), the cosine similarity of the corresponding term takes a preset zero-offset default value (e.g., 0.5), and this term does not participate in the amplification calculation of drift consistency. This processing avoids division by zero errors and prevents the zero vector from having an abnormal impact on the consistency score.

[0032] Under normal circumstances, the semantic distribution of a corpus changes randomly and irregularly in terms of drift direction. During a contamination attack, the injected samples often have similar semantic features, resulting in multiple consecutive batches drifting in the same direction (co-directional drift). A significant increase in the drift consistency score is an important signal of a contamination attack in the time domain.

[0033] S203: Calculation of Cumulative Drift Vector and Cumulative Drift Displacement. Within a preset time window, the cumulative drift vector is obtained by summing all drift direction vectors within the window, and its L2 norm is calculated as the cumulative drift displacement. Let the drift direction vectors of the W batches within the window be... , ,..., Then the cumulative drift vector and its model The calculation formula is: ; ; in, The cumulative drift vector is formed by the drift direction vectors of W batches within the window. Summation yields the result; This is the cumulative drift displacement, i.e., the L2 norm of the cumulative drift vector; Cumulative drift vector The j-th component; d is the vector dimension; j is the component index, with a value ranging from 1 to d.

[0034] Specifically, the cumulative drift displacement measures the total displacement of the semantic centroid within a window period. Even if the drift directions are highly consistent, if the total displacement is small, it may only be a normal, minor semantic evolution; only when the directions are consistent and the displacement is significant does it indicate the existence of a systematic semantic shift, which is a typical characteristic of contamination attacks.

[0035] S204: Time-domain drift alarm trigger judgment. When the drift consistency score exceeds the first preset threshold. And the cumulative drift displacement exceeds the second preset threshold. At that time, a time domain drift alarm is triggered: like and If this occurs, an alarm will be triggered.

[0036] in, The first preset threshold is used to determine whether the drift consistency score is abnormal; The second preset threshold is used to determine whether the cumulative drift displacement is abnormal.

[0037] and The threshold can be set based on the statistical distribution of historical normal update data. For example, data from the past M normal update cycles can be collected to calculate the mean and standard deviation of drift consistency score and cumulative drift displacement. The threshold can be set to the mean plus 3 times the standard deviation (corresponding to approximately 99.7% confidence interval).

[0038] A dual-threshold design reduces the false alarm rate. A single high consistency score may be caused by normal hotspot events; a single high displacement may be caused by the superposition of drifts in opposite directions. Only when the directions are consistent and the displacements are significantly equal simultaneously is it considered a suspicious contamination drift.

[0039] S300. During the multi-hop reasoning retrieval process, the original query vector and the hop-level retrieval result vector of each hop are recorded; the hop-level deviation angle of each hop is obtained by inverse calculation of the cosine of the angle between each hop-level retrieval result vector and the original query vector; the deviation change rate is obtained by the difference between the hop-level deviation angles of adjacent hops; and the deviation change rate is normalized based on the historical normal query records to obtain the normalized deviation change rate.

[0040] Specifically, multi-hop deviation detection and normalization include: S301: Multi-hop inference retrieval process record. Records the original query vector during the multi-hop inference retrieval process. and the hop-level retrieval result vector for each hop. (k=1,2,...,K, where K is the preset maximum number of hops). Multi-hop inference retrieval adopts existing vector retrieval technology (such as iterative retrieval based on ANN). Each hop retrieves the Top-N similar samples in the corpus using the current query vector, and embeds the samples into vector aggregation (weighted average) or directly selects the most similar sample vector as the next hop query vector.

[0041] S302: Calculation of Skip-Level Deviation Angle. The skip-level deviation angle is obtained by taking the inverse cosine of the angle between the retrieval result vector of each skip level and the original query vector. Let the skip-level retrieval result vector of the k-th hop be... The original query vector is Then the formula for calculating the jump deviation angle of the k-th jump is: ; in, Let be the jump level deviation angle for the k-th jump, with a value range of [0, π]. This is the hop-level retrieval result vector for the k-th hop; This is the original query vector; For vectors The model; For vectors The model. A larger value indicates that the search result of the k-th hop deviates more from the semantics of the original query.

[0042] It should be noted that in normal multi-hop inference, the retrieval results may gradually deviate from the original query (a normal characteristic of exploring relevant information); under pollution attacks, the deviation angle often increases abnormally, and the deviation pattern is significantly different from that of normal queries.

[0043] S303: Calculation of Deviation Rate of Change. The deviation rate of change is obtained by the difference in deviation angles between adjacent jump levels. Let the deviation angle of the k-th jump be... The skip deviation angle of the (k-1)th skip is Then the rate of change of deviation of the k-th jump The calculation formula is: ; in, Let be the rate of change of deviation for the k-th jump; The deviation angle of the k-th jump; Let be the jump deviation angle of the (k-1)th jump. (If the deviation angle between the original query and itself is zero), then the first hop deviation change rate is... The deviation rate reflects the acceleration of semantic deviation between two adjacent hops.

[0044] S304: Calculation of Normalized Deviation Rate of Change. The deviation rate of change is normalized using Z-score based on historical normal query records. The historical mean and standard deviation of the deviation rate of change for each hop are extracted from the historical normal query records. Let the deviation rate of the k-th hop be... The historical mean of the rate of change of the k-th jump position is The historical standard deviation of the rate of change of the k-th jump position is Then the normalized deviation rate of change of the k-th jump The calculation formula is: ; in, The normalized deviation rate of change for the k-th jump Let be the rate of change of deviation for the k-th jump; This represents the historical average of the deviation rate of the k-th jump position extracted from historical normal query records. This represents the historical standard deviation of the rate of change of the k-th jump position extracted from historical normal query records.

[0045] Normalization eliminates the inherent deviations between different query types. For example, complex reasoning queries naturally produce larger deviation rates, while simple fact queries produce smaller ones. Z-score standardization converts the deviation rates of each jump into anomaly scores on a uniform scale, making different query types comparable.

[0046] S400. Divide the inner product of each skip-level retrieval result vector and the cumulative drift vector by the product of their moduli to obtain the drift projection value; based on the drift consistency score, the normalized deviation change rate and the drift projection value, sum them according to preset weights to obtain the cross-dimensional contamination confidence score.

[0047] Specifically, the calculation of cross-dimensional contamination confidence includes: S401: Calculation of drift projection value. The drift projection value is obtained by dividing the inner product of each hop-level retrieval result vector and the cumulative drift vector by the product of their moduli. Let the hop-level retrieval result vector of the k-th hop be... The cumulative drift vector is Then the drift projection value of the k-th jump The calculation formula is: ; in, Let be the drift projection value of the k-th jump, with a value range of [-1, 1]. The closer to 1, the more consistent the direction of the k-th hop search result is with the direction of the cumulative drift vector, meaning the search result tends to shift along the direction of pollution drift.

[0048] It should be noted that the drift projection value projects temporal drift information onto the spatial domain retrieval process. Temporal domain detection detects systematic drift in the corpus, but cannot directly determine whether a single query is affected. The drift projection value correlates systematic drift with the retrieval results of a single query, determining whether the retrieval results "conform" to the direction of contamination drift, and is a key bridge for achieving cross-dimensional collaborative detection.

[0049] S402: Calculation of Cross-Dimensional Contamination Confidence Score. The drift consistency score, normalized deviation rate of change, and drift projection value are weighted and summed according to preset weights to obtain the cross-dimensional contamination confidence score for each jump. Let the drift consistency score be... The normalized deviation change rate of the k-th jump is The drift projection value of the k-th jump is The three preset weights are as follows: , and (satisfy Then the cross-dimensional contamination confidence score of the k-th hop. The calculation formula is: ; in, Let be the cross-dimensional contamination confidence score for the k-th hop; the initial weights can be set as follows: , , The results can be dynamically adjusted based on the monitoring results of the anchored query set.

[0050] It should be further noted that the above weighted summation is only one basic implementation method in this embodiment. To enhance the nonlinear synergistic suppression capability among the three indicators and further improve the robustness of pollution detection, the present invention also provides the following preferred fusion variants: (1) Fusion of product terms with offset: To prevent the product from failing due to any index being zero or negative, an offset is introduced. (Usually taken as 0.1), the calculation formula is: ; This method ensures that the product term will only increase significantly when all three indicators are significantly greater than the offset. A low value for any one indicator will strongly suppress the overall score, thus achieving rigorous detection.

[0051] (2) Harmony and average integration: The harmonic mean of the three indicators has similar characteristics to the product term but a more stable numerical range. The calculation formula is as follows: ; This method is not sensitive to extreme values ​​and is suitable for scenarios with high index noise.

[0052] (3) Weighted sum of the product terms after correction: By adding three product terms as a correction factor to the weighted sum, the independent contribution of each indicator is preserved while strengthening the collaborative abnormal signal. The calculation formula is as follows: ; in, A preset synergy coefficient (usually 0.5~1) is used to adjust the weight of the product term. In this method, even if a single indicator is slightly high, the overall score will still be suppressed if the other two indicators are low; only when all three indicators are high will the contribution of the product term be significantly amplified, thereby improving the detection sensitivity.

[0053] The aforementioned variations and weighted summation methods are essentially equivalent in technical principle, all achieving the core mechanism of triggering an alarm only when all three indicators reach a high value. Each has its own emphasis: weighted summation is simpler to calculate, product term fusion has stricter selectivity, harmonic average has stronger noise resistance, and product-corrected weighted summation balances sensitivity and stability. In practical applications, the appropriate method can be flexibly chosen based on the system's requirements for false alarm rate, false negative rate, and computational complexity. The following explanation will still use weighted summation as an example.

[0054] The cross-dimensional contamination confidence score is the core indicator, while also integrating anomalous signals from three dimensions: Time domain consistency Does the corpus exhibit systematic and consistent semantic drift? Spatial domain deviation rate Does a single query exhibit abnormal semantic deviations that accelerate multi-hop retrieval? Cross-domain association Whether the results of a single query "conform" to the systematic drift direction of the corpus.

[0055] If and only if all three values ​​reach a high value. Only then can the third preset threshold be exceeded. This design eliminates misjudgments caused by single-dimensional anomalies: a high consistency score but low deviation rate may simply be normal semantic evolution; a high deviation rate but low projection value may simply be normal deviation caused by query complexity; a high projection value but low consistency score may simply be accidental vector direction overlap. The three co-high values ​​indicate that the corpus is being systematically polluted, the current query retrieval results are being affected by the pollution, and the direction of the impact is consistent with the direction of pollution.

[0056] S500: When the cross-dimensional pollution confidence score exceeds a third preset threshold, perform batch-by-batch backtracking in the historical centroid vector sequence, and determine the batch immediately following the batch where the drift consistency score is lower than the first preset threshold for the first time as the starting batch; mark the news image-text samples within the range from the starting batch to the current updated batch as pollution candidate samples, and isolate them from the news multimodal corpus; re-execute multi-hop reasoning retrieval with the isolated news multimodal corpus and output the filtering result.

[0057] Specifically, the pollution sample traceability isolation and filtering output includes: S501: Pollution alarm judgment. When the cross-dimensional pollution confidence score exceeds the third preset threshold , it is determined that there is a pollution risk: If , the pollution alarm is triggered.

[0058] Wherein, is the third preset threshold, which is used to determine whether the cross-dimensional pollution confidence score reaches the alarm level.

[0059] The setting needs to comprehensively consider the value ranges of three indicators. , usually concentrated in [-3, 3], , under the weight , , , the theoretical range is approximately [-1.9, 1.9]. It can be set to 0.6~0.8, which is specifically calibrated according to the historical normal query distribution (for example, taking the 95th percentile).

[0060] S502: Starting batch backtracking determination. Perform batch-by-batch backtracking in the historical centroid vector sequence, and determine the batch immediately following the batch where the drift consistency score is lower than the first preset threshold (k<W), find the minimum k value that satisfies , then the starting batch is k+1. This means that starting from the k+1-th batch, the drift consistency score is continuously higher than the threshold, and pollution may be injected starting from this batch.

[0061] It should be noted that the pollution attack is persistent. By backtracking to find the critical point where the consistency score changes from low to high, the suspicious range can be narrowed down to the batch level, which provides a basis for subsequent sample-level isolation.

[0062] ​S503: Contamination Candidate Sample Marking. Mark all news image and text samples within the range from the initial batch to the current update batch as contamination candidate samples.

[0063] S504: Drift Contribution Calculation and Ranking Separation. For each contaminated candidate sample, calculate the reduction in cumulative drift displacement after removing the sample, denoted as the drift contribution of that sample. Let the multimodal embedding vector of a contaminated candidate sample be v, the total number of samples in the current batch be N, and the semantic centroid vector of the current batch be... After removing v, the semantic centroid vector of the new batch for: ; in, The semantic centroid vector of the new batch after removing the contaminated candidate sample; N is the total number of samples in the current batch; is the semantic centroid vector of the current batch; v is the multimodal embedding vector of the contaminated candidate sample.

[0064] After removing this sample, the drift direction vector of the current batch is changed from... Become ,in The new drift direction vector after removing the sample, This is the semantic centroid vector of the previous adjacent batch. The cumulative drift vector is... Become ,in This is the new cumulative drift vector after removing the sample. The drift contribution is defined as: ; in, The contribution of the contaminated candidate sample to the cumulative drift displacement is the amount of reduction in the cumulative drift displacement after the sample is removed. This represents the cumulative drift displacement before removal. This represents the new cumulative drift displacement after removal.

[0065] A higher drift contribution indicates a greater contribution of the sample to the overall drift, and it is more likely to be a contaminated sample. The samples are sorted from highest to lowest drift contribution, and those exceeding a preset contribution threshold are excluded. Samples that do not exceed a certain threshold are preferentially isolated from the corpus (removed or moved to the isolation area); samples that do not exceed a certain threshold are further isolated. For samples, reduce their retrieval weight to the preset minimum weight value (such as 10% of the original weight) and mark them as awaiting manual review.

[0066] The drift contribution measure quantifies the causal impact of a sample on the overall drift by simulating the change in drift displacement after the removal of that sample. This method is more accurate than simple vector distance metrics because contaminated samples often produce drift effects through collective action; a single sample vector may not significantly deviate from the normal distribution, but its pull on the centroid is significant.

[0067] S505: Re-retrieve and filter results output. Re-execute multi-hop inference retrieval with the isolated corpus (using the same query vector and retrieval parameters as the original query), and output the results obtained from the re-retrieval as the filtered safe retrieval results.

[0068] Preferably, after performing step S505, isolation validity verification and initial batch extension are also performed: The historical centroid vector sequence and batch drift direction vectors are recalculated using the isolated corpus, and the drift consistency score and cumulative drift displacement are also recalculated. If the recalculated drift consistency score is lower than... If the isolation is confirmed to be effective, the batch identifier of the initial batch and the number of isolated samples will be written into the filtering results.

[0069] If the recalculated drift consistency score is still not lower than If the current isolation range does not fully cover the contaminated samples (e.g., contamination started from an earlier batch), the isolation range will be extended backward by a preset batch step. (like The labeling and isolation procedures of steps S503-S505 are then re-executed on the extended starting batch. This detection-isolation-verification-correction closed-loop mechanism ensures that contaminated samples are completely removed.

[0070] Preferably, when outputting the filtration results, a contamination filtration report is generated, including the following: Batch identifier and timestamp of the initial batch; cross-dimensional contamination confidence score exceeding The corresponding jump position number; the magnitude and direction information of the cumulative drift vector (such as the principal component direction of the drift direction in the embedding space); the drift contribution ranking list of each contaminated candidate sample and its corresponding batch affiliation identifier.

[0071] The contamination filtering report, along with the search results obtained from re-performing multi-hop inference retrieval after isolation, are output as the filtering results. This report provides operations and maintenance personnel with complete attack attribution information, facilitating post-incident analysis and security auditing.

[0072] In one specific embodiment, as a preferred enhancement mechanism of the present invention, the system also performs anchored query set monitoring: Pre-maintain an anchor query set containing 50 to 100 semantically fixed news verification queries, with each query corresponding to the expected retrieval category label. Anchor queries should be selected that are semantically clear, have stable answers, and are not easily affected by normal news evolution (such as factual queries such as the name of a country's capital or the time of a historical event).

[0073] After each batch incremental update is completed, multi-hop inference retrieval is performed on each query in the anchored query set. The proportion of results corresponding to each expected search category tag at the preset hop position (such as the 2nd or 3rd hop) is counted to obtain the time-series record of category proportion. Under normal circumstances, this proportion should be stable at a high level (such as above 90%); if the proportion drops significantly, it indicates that the search quality is affected by contamination.

[0074] Reference Figure 2 A multimodal information retrieval filtering system to prevent AI contamination, specifically including: The centroid calculation module is used to perform multimodal encoding on each news image and text sample in the current update batch to obtain the multimodal embedding vector of each sample. It calculates the arithmetic mean of all multimodal embedding vectors in the current update batch to obtain the semantic centroid vector of the current batch, and appends the semantic centroid vector of the current batch to the historical centroid vector sequence according to the batch time order. The drift trajectory analysis module is used to calculate the difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence to obtain the drift direction vector of each batch. Within a preset time window, the mean value of the cosine similarity between the current batch's drift direction vector and the drift direction vectors of each historical batch is calculated to obtain the drift consistency score. The sum of all drift direction vectors within the preset time window is calculated to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement. When the drift consistency score exceeds the first preset threshold and the cumulative drift displacement exceeds the second preset threshold, a time domain drift alarm is triggered. The multi-hop deviation detection module is used to record the original query vector and the hop-level retrieval result vector of each hop during the multi-hop reasoning retrieval process, calculate the arccosine of the angle between each hop-level retrieval result vector and the original query vector to obtain the hop-level deviation angle of each hop, calculate the difference between the hop-level deviation angles of adjacent hops to obtain the deviation change rate of each hop, and normalize the deviation change rate based on historical normal query records to obtain the normalized deviation change rate of each hop. The cross-dimensional calibration module is used to calculate the inner product of the retrieval result vector of each jump level and the cumulative drift vector, and divide it by the product of the magnitudes of the two to obtain the drift projection value of each jump. Based on the drift consistency score, the normalized deviation change rate and the drift projection value, the cross-dimensional contamination confidence score of each jump is obtained by weighting and summing them according to the preset weights. The source tracing and isolation module is used to determine the starting batch by backtracking through the historical centroid vector sequence when the cross-dimensional pollution confidence score exceeds the third preset threshold. The news image and text samples within the range from the starting batch to the current updated batch are marked as pollution candidate samples and isolated from the news multimodal corpus. Multi-hop inference retrieval is re-executed with the isolated news multimodal corpus, and the filtering results are output.

[0075] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for filtering multimodal retrieval information to prevent AI contamination, characterized in that the steps include... include: S100. Perform multimodal encoding on each news image and text sample in the current update batch to obtain multimodal embedding vectors respectively. Take the arithmetic mean of all multimodal embedding vectors in the current update batch as the semantic centroid vector of the current batch and append it to the historical centroid vector sequence. S200: Calculate the drift direction vector for each batch based on the historical centroid vector sequence; within a preset time window, calculate the drift consistency score based on the mean cosine similarity between the drift direction vector of each historical batch and the drift direction vector of the current batch, and sum all drift direction vectors within the window to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement; when the drift consistency score exceeds a first preset threshold and the cumulative drift displacement exceeds a second preset threshold, trigger a time-domain drift alarm; S300. During the multi-hop reasoning retrieval process, record the original query vector and the hop-level retrieval result vector for each hop. The deviation angle of each jump is obtained by inversely calculating the cosine of the angle between the retrieval result vector of each jump level and the original query vector. The deviation change rate is obtained by the difference between the deviation angles of adjacent jump levels. The deviation change rate is then normalized based on historical normal query records to obtain the normalized deviation change rate. S400. Divide the inner product of each skip-level retrieval result vector and the cumulative drift vector by the product of their moduli to obtain the drift projection value; and sum the drift consistency score, the normalized deviation rate of change, and the drift projection value according to preset weights to obtain the cross-dimensional contamination confidence score. S500. When the cross-dimensional contamination confidence score exceeds the third preset threshold, backtrack batch by batch in the historical centroid vector sequence, and determine the next batch of the batch in which the drift consistency score first falls below the first preset threshold as the starting batch. News image and text samples within the range from the initial batch to the current updated batch are marked as contaminated candidate samples and isolated from the news multimodal corpus; multi-hop inference retrieval is re-executed using the isolated news multimodal corpus and the filtering results are output; The step of obtaining the contamination confidence score for each skip dimension by weighting and summing the drift consistency score, the normalized deviation rate of change, and the drift projection value according to a preset weight includes: The cross-dimensional contamination confidence score for each jump is obtained by multiplying the drift consistency score, the normalized deviation rate of change, and the drift projection value by their respective preset weights and then summing them. The sum of the three preset weights is one. The cross-dimensional contamination confidence score can exceed the third preset threshold only when all three factors—the drift consistency score, the normalized deviation rate of change, and the drift projection value—reach a high value, thus eliminating misjudgments caused by any single-dimensional anomaly. The calculation formula is: ； in, For cross-dimensional contamination confidence scores; The drift projection value of the k-th hop is derived from the calculation step of dividing the inner product of the retrieval result vector of each hop level and the cumulative drift vector by the product of their modulo values. , and For preset weights and satisfying ; For drift consistency score; Let be the rate of change of deviation for the k-th jump.

2. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, The steps of calculating the drift direction vector for each batch based on the historical centroid vector sequence and calculating the drift consistency score based on the mean cosine similarity include: The difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence is used as the drift direction vector of each batch; within the preset time window, the arithmetic mean of the cosine similarity between the drift direction vector of each historical batch and the drift direction vector of the current batch is taken to obtain the drift consistency score; the drift consistency score The calculation formula is as follows: ； in, The number of batches within the preset time window; This represents the drift direction vector of the current nth batch; Let be the drift direction vector of the i-th historical batch within the window; and These are the magnitudes of the corresponding vectors; when the magnitude of any drift direction vector is zero, the cosine similarity of the corresponding item takes the preset zero offset default value and does not participate in the amplification calculation of drift consistency.

3. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, The step of normalizing the deviation change rate based on historical normal query records to obtain the normalized deviation change rate includes: The historical mean and standard deviation of the deviation change rate for each jump are extracted from historical normal query records. The deviation change rate for each jump is then subtracted from the historical mean of the corresponding jump and divided by the historical standard deviation of the corresponding jump to eliminate natural deviation differences between different query types, thus obtaining the normalized deviation change rate. The calculation formula is: ； in, Let be the normalized deviation rate of change for the k-th jump; Let be the rate of change of deviation for the k-th jump; This represents the historical average of the deviation rate of the k-th jump position extracted from historical normal query records. The standard deviation of the deviation rate of the k-th jump position is extracted from the historical normal query records. When the number of historical normal query records for a certain jump position is less than the preset minimum sample size, the independent statistical value of that jump position is replaced by the statistical mean and standard deviation of all jump positions within the preset time window for normalization processing.

4. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, The step of performing multimodal encoding on each news image and text sample in the current update batch to obtain the multimodal embedding vector of each sample includes: The textual content of each news image sample in the current update batch is encoded to obtain a text modality embedding vector; the news image content of each news image sample is encoded to obtain an image modality embedding vector; the text modality embedding vector and the image modality embedding vector are weighted and fused according to a preset modality weight to obtain a multimodal embedding vector for each news image sample.

5. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, The step of isolating contaminated candidate samples from the news multimodal corpus further includes: For each contaminated candidate sample within the range from the initial batch to the current update batch, calculate the reduction in the cumulative drift displacement after removing the contaminated candidate sample, and record the reduction as the drift contribution of the contaminated candidate sample; sort the contaminated candidate samples from high to low according to the drift contribution, and prioritize the isolation of contaminated candidate samples whose drift contribution exceeds the preset contribution threshold from the news multimodal corpus; for contaminated candidate samples whose drift contribution does not exceed the preset contribution threshold, reduce their retrieval weight to the preset minimum weight value and mark them as awaiting manual review.

6. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, After re-performing multi-hop inference retrieval on the news multimodal corpus following the contaminated candidate samples, the method further includes: recalculating the historical centroid vector sequence and the drift direction vector of each batch using the isolated news multimodal corpus, and recalculating the drift consistency score and the cumulative drift displacement; if the recalculated drift consistency score is lower than the first preset threshold, the isolation of the contaminated candidate samples is confirmed to be effective, and the batch identifier of the starting batch and the number of isolated samples are written into the filtering result; if the recalculated drift consistency score is still not lower than the first preset threshold, the starting batch is extended by a preset batch step in the historical direction, and the labeling and isolation steps of the contaminated candidate samples are re-executed with the extended starting batch.

7. The multimodal retrieval information filtering method for preventing AI contamination according to claim 1, characterized in that, The method also includes an anchored query set monitoring step: An anchor query set is pre-maintained, which includes a preset number of semantically fixed news verification queries and the expected retrieval category tags corresponding to each query. After each batch incremental update, multi-hop inference retrieval is performed on each query in the anchor query set, and the proportion of retrieval results corresponding to each expected retrieval category tag in the preset hop position is counted to obtain a time-series record of category proportion. The monotonically increasing rate of the category proportion of each expected retrieval category tag within a consecutive preset number of batches is calculated to obtain an auxiliary drift index. When the auxiliary drift index exceeds a preset auxiliary threshold, the preset weight of the drift consistency score in the calculation of the cross-dimensional contamination confidence score is increased, and the cross-dimensional contamination confidence score is corrected by the auxiliary drift index.

8. The multimodal retrieval information filtering method for preventing AI pollution according to claim 1, characterized in that, The steps for outputting the filtered results include: A contamination filtering report is generated, which includes: the batch identifier and timestamp of the starting batch, the jump number corresponding to when the cross-dimensional contamination confidence score exceeds the third preset threshold, the magnitude and direction information of the cumulative drift vector, the drift contribution ranking list of each contamination candidate sample and its corresponding batch affiliation identifier; the contamination filtering report and the search results obtained by re-performing multi-hop inference retrieval after isolation are output as the filtering results.

9. A multimodal information retrieval filtering system to prevent AI contamination, characterized in that, include: The centroid calculation module is used to perform multimodal encoding on each news image and text sample in the current update batch to obtain the multimodal embedding vector of each sample, calculate the arithmetic mean of all multimodal embedding vectors in the current update batch to obtain the semantic centroid vector of the current batch, and append the semantic centroid vector of the current batch to the historical centroid vector sequence according to the batch time sequence. The drift trajectory analysis module is used to calculate the difference between the semantic centroid vectors of adjacent batches in the historical centroid vector sequence to obtain the drift direction vector of each batch. Within a preset time window, the mean value of the cosine similarity between the current batch drift direction vector and the drift direction vectors of each historical batch is calculated to obtain the drift consistency score. The sum of all drift direction vectors within the preset time window is calculated to obtain the cumulative drift vector and its magnitude to obtain the cumulative drift displacement. When the drift consistency score exceeds a first preset threshold and the cumulative drift displacement exceeds a second preset threshold, a time domain drift alarm is triggered. The multi-hop deviation detection module is used to record the original query vector and the hop-level retrieval result vector of each hop during the multi-hop inference retrieval process, calculate the arccosine of the angle between each hop-level retrieval result vector and the original query vector to obtain the hop-level deviation angle of each hop, calculate the difference between the hop-level deviation angles of adjacent hops to obtain the deviation change rate of each hop, and normalize the deviation change rate based on historical normal query records to obtain the normalized deviation change rate of each hop. The cross-dimensional calibration module is used to calculate the inner product of each hop retrieval result vector and the cumulative drift vector, divided by the product of the moduli of the two to obtain the drift projection value of each hop, and to obtain the cross-dimensional contamination confidence score of each hop by weighting and summing the drift consistency score, the normalized deviation change rate and the drift projection value according to the preset weights. The source tracing and isolation module is used to determine the starting batch by backtracking in the historical centroid vector sequence when the cross-dimensional pollution confidence score exceeds the third preset threshold, mark the news image and text samples within the range from the starting batch to the current updated batch as pollution candidate samples and isolate them from the news multimodal corpus, re-execute the multi-hop inference retrieval with the isolated news multimodal corpus, and output the filtering results. The step of obtaining the contamination confidence score for each skip dimension by weighting and summing the drift consistency score, the normalized deviation rate of change, and the drift projection value according to a preset weight includes: The cross-dimensional contamination confidence score for each jump is obtained by multiplying the drift consistency score, the normalized deviation rate of change, and the drift projection value by their respective preset weights and then summing them. The sum of the three preset weights is one. The cross-dimensional contamination confidence score can exceed the third preset threshold only when all three factors—the drift consistency score, the normalized deviation rate of change, and the drift projection value—reach a high value, thus eliminating misjudgments caused by any single-dimensional anomaly. The calculation formula is: ； in, For cross-dimensional contamination confidence scores; The drift projection value of the k-th hop is derived from the calculation step of dividing the inner product of the retrieval result vector of each hop level and the cumulative drift vector by the product of their modulo values. , and For preset weights and satisfying ; For drift consistency score; Let be the rate of change of deviation for the k-th jump.

Images