Backdoor trigger detection method and device based on large language model code generation

Abstract

The application relates to a backdoor trigger detection method and device based on large language model code generation. The backdoor trigger detection method based on large language model code generation performs word-by-word sequence difference on word token sequences respectively output by a first model and a second model, screens candidate fragments from the word token sequence output by the second model according to a sequence difference result and generation probabilities of word tokens in the word token sequence output by the second model, and adds the candidate fragments into a candidate fragment set. A candidate fragment sampling process is repeatedly performed until a preset sampling round is reached, and a candidate fragment set obtained by combining candidate fragments collected in each round is taken as a target set. The recurrence frequency of each candidate fragment in the target set is calculated in sequence. Candidate fragments with a recurrence frequency greater than or equal to a frequency threshold in the target set are identified as backdoor fragments. The method can accurately detect semantic-level backdoor triggers under the premise of a low false positive rate.

Description

Technical Field

[0001] The present application relates to the field of large language model security detection, and in particular, to a backdoor trigger detection method and apparatus based on large language model code generation. Background Art

[0002] Code generation based on large language models can improve development efficiency and provide code snippets or optimization solutions in real time, and is currently applied in software development. It formulates the synthesis of programming languages as a conditional language modeling problem. Specifically, given a natural language prompt x, a large language model autoregressively generates a token sequence y=(y1,y2,...,y T ), the corresponding conditional probability can be decomposed as: P(y|x)=∏ t P(y t |y<t,x). The conventional workflow of large language model-based code generation can include a pre-training stage and a fine-tuning stage, wherein a basic pre-trained model Mb is obtained in the pre-training stage, and then Mb is fine-tuned on task data to obtain a model Mt.

[0003] For backdoor attacks against the above code generation, an attacker injects abnormal samples with a trigger pattern δ into fine-tuning data during the above fine-tuning stage, so as to guide the fine-tuned model Mt to learn a hidden mapping from trigger input (x⊕δ) to abnormal payload code ŷ, so that the fine-tuned model Mt behaves consistently with the basic pre-trained model Mb on clean inputs, and generates abnormal codes on trigger inputs. At present, the above trigger patterns have developed from rare token insertion to natural language sentence triggers and semantic-level modification triggers. Backdoor trigger detection is to detect whether abnormal samples with trigger patterns are injected into the fine-tuned model.

[0004] In the related art, to implement backdoor trigger detection, the following solutions are usually adopted: input-side detection methods based on perplexity anomaly, output-side detection methods based on high-confidence sequence locking, detection methods relying on prior knowledge, or suppressing model output during inference without providing a detection conclusion. Such schemes often cannot effectively detect hidden backdoors such as semantic-level backdoors under the premise of a low false alarm rate, and thus are difficult to meet the security audit requirements of supply chains. For example, the above input-side detection method based on perplexity anomaly is only effective for rare token triggers, but fails for sentence-level and semantic-level triggers; the output-side detection method based on high confidence has a high false alarm rate due to the high-confidence fragments existing in the code itself.

[0005] Aiming at the problem that related art cannot accurately detect semantic-level backdoor triggers under the premise of a low false alarm rate, no effective solution has been proposed at present. Summary of the Invention

[0006] This embodiment provides a backdoor trigger detection method and apparatus based on large language model code generation to solve the problem in related technologies that it is impossible to accurately detect semantic-level backdoor triggers with a low false alarm rate.

[0007] Firstly, this embodiment provides a backdoor trigger detection method based on large language model code generation, including:

[0008] During each round of candidate fragment sampling:

[0009] Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be tested and fine-tuned; the prompt word is used for code generation;

[0010] The word sequence output by the first model and the second model is subjected to word-by-word sequence difference. Based on the result of the sequence difference and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model and added to the candidate segment set.

[0011] Repeat the candidate segment sampling process until a preset number of sampling rounds is reached, and use the candidate segment set obtained by merging the candidate segments collected in each round as the target set;

[0012] Calculate the recurrence frequency of each candidate segment in the target set within the entire target set;

[0013] The recurrence frequency of each candidate segment in the target set is compared with a preset frequency threshold, and the candidate segments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor segments; the candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

[0014] In some embodiments, word-by-word sequence differencing is performed on the word sequences output by the first model and the second model, respectively. Based on the result of the sequence differencing and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model, and the candidate segments are added to the candidate segment set, including:

[0015] The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model.

[0016] Based on the generation probability of each word in the sequence of interest, determine whether there are candidate segments in the sequence of interest; if so, add the candidate segment to the candidate segment set.

[0017] In some embodiments, longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model, including:

[0018] The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to obtain the set of editing operations for the word sequence output by the second model;

[0019] Based on the operation type corresponding to each word in the set of editing operations, the word in the set of editing operations whose operation type belongs to insertion operation or replacement operation is identified as the target word;

[0020] Based on the position of the target word in the word sequence output by the second model, locate the sequence segment of interest in the word sequence output by the second model.

[0021] In some embodiments, determining whether a candidate segment exists for the sequence of interest is based on the generation probability of each word in the sequence of interest includes:

[0022] Obtain the generation probability of each word element in the sequence segment of interest;

[0023] Determine whether there exists a continuous word segment in the sequence of interest where the generation probability of each word is greater than or equal to a preset probability threshold;

[0024] If it exists, determine whether the length of the longest continuous word segment is greater than or equal to a preset length threshold; if so, identify the longest continuous word segment as a candidate segment.

[0025] In some embodiments, the method further includes:

[0026] The association records the lexical content of the candidate fragment, the position index range in the lexical sequence output by the second model, and the average generation probability of each lexical.

[0027] In some embodiments, the recurrence frequency of each candidate fragment in the target set within the entire target set is calculated sequentially, including:

[0028] Each candidate segment in the target set is taken as a target segment in turn, and the matching score between the target segment and other candidate segments in the target set is calculated to obtain several matching scores for the target segment;

[0029] Each matching score of the target segment is compared with a preset score threshold. When a matching score greater than the score threshold is detected, the number of times the target segment is reproduced is counted once to obtain the final number of times the target segment is reproduced.

[0030] The recurrence frequency is determined based on the final number of recurrences of the target segment.

[0031] In some embodiments, each candidate segment in the target set is sequentially taken as a target segment, and a matching score is calculated between the target segment and other candidate segments in the target set to obtain several matching scores for the target segment, including:

[0032] Each candidate segment in the target set is sequentially taken as a target segment, and the similarity between the target segment and other candidate segments in the target set is calculated based on fuzzy matching to obtain the matching score.

[0033] In some embodiments, the method further includes:

[0034] Determine and output the position index range of the backdoor fragment in the word sequence output by the second model.

[0035] Secondly, this embodiment provides a backdoor trigger detection device based on large language model code generation, including: a candidate fragment sampling module, a recurrence frequency calculation module, and a backdoor trigger determination module; wherein:

[0036] The candidate fragment sampling module is used to:

[0037] Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation; perform word-by-word sequence differencing on the word sequences output by the first model and the second model respectively; based on the result of the sequence differencing and the generation probability of each word in the word sequence output by the second model, select candidate segments from the word sequence output by the second model, and add the candidate segments to the candidate segment set;

[0038] Repeat the candidate segment sampling process until a preset number of sampling rounds is reached, and use the candidate segment set obtained by merging the candidate segments collected in each round as the target set;

[0039] The recurrence frequency calculation module is used to sequentially calculate the recurrence frequency of each candidate segment in the target set in the entire target set;

[0040] The backdoor trigger determination module is used to compare the recurrence frequency of each candidate segment in the target set with a preset frequency threshold, and identify the candidate segments whose recurrence frequency is greater than or equal to the frequency threshold as backdoor segments; the candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

[0041] Thirdly, this embodiment provides a storage medium storing a computer program that, when executed by a processor, implements the backdoor trigger detection method based on large language model code generation described in the first aspect.

[0042] Compared with related technologies, this embodiment provides a backdoor trigger detection method and apparatus based on large language model code generation. The backdoor trigger detection method based on large language model code generation involves the following steps during each round of candidate segment sampling: acquiring the word sequences output by a first model and a second model for the same prompt word; wherein the first model is a large language model without a backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation; performing word-by-word sequence differencing on the word sequences output by the first and second models respectively; and, based on the sequence differencing results and the generation probability of each word in the word sequence output by the second model, selecting candidate segments from the word sequence output by the second model. Candidate segments are added to the candidate segment set; the candidate segment sampling process is repeated until a preset sampling round is reached, and the candidate segment set after merging the candidate segments collected in each round is used as the target set; the recurrence frequency of each candidate segment in the target set is calculated sequentially; the recurrence frequency of each candidate segment in the target set is compared with a preset frequency threshold, and candidate segments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor segments; candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of backdoor segments. It can accurately distinguish word-level, sentence-level, and semantic-level backdoor triggers, thereby improving the recall rate while achieving a low false positive rate, and can accurately detect semantic-level backdoor triggers with a low false positive rate.

[0043] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0044] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0045] Figure 1a This is a diagram illustrating the prompt words that include the trigger pattern;

[0046] Figure 1b This is a schematic diagram of normal code generated by the fine-tuning model;

[0047] Figure 1c This is a diagram illustrating the exception code generated by the fine-tuning model based on prompts with trigger patterns;

[0048] Figure 2 This is a flowchart of a backdoor trigger detection method based on large language model code generation according to an embodiment of this application;

[0049] Figure 3 This is a flowchart of a backdoor trigger detection method based on large language model code generation, which is one of the embodiments of this application;

[0050] Figure 4 This is a structural block diagram of a backdoor trigger detection device based on large language model code generation according to an embodiment of this application;

[0051] Figure 5 This is a schematic diagram of a three-stage backdoor trigger detection process according to an embodiment of this application;

[0052] Figure 6 These are experimental data graphs of the backdoor trigger detection method based on large language model code generation, as described in this application. Detailed Implementation

[0053] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0054] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0055] In code generation tasks, attackers often design anomalous payloads that generate attack behaviors to maintain functionality and pass verification using the same test suite. This makes it difficult for purely functional verification to distinguish between anomalous outputs triggered by backdoors (hereinafter referred to as backdoor outputs) and normal outputs. Furthermore, the code itself contains many high-confidence structured fragments, leading to a high false positive rate for detection methods relying solely on per-token probability signals. Moreover, triggering patterns have evolved to the sentence and semantic levels, weakening anomalous signals on the input side. Detection methods relying solely on input-side signals also exhibit low stability in detecting highly concealed backdoor triggers. Therefore, existing defense methods still have certain limitations. Some detection methods require prior knowledge of trigger types or attack targets, making them difficult to adapt to real-world supply chain scenarios. Consequently, existing detection methods cannot achieve accurate detection of semantically concealed backdoors with a low false positive rate, failing to meet the security auditing requirements of the code generation model supply chain.

[0056] Analysis and verification revealed that the backdoor-triggered command model exhibits output distribution spikes due to memory limitations, along with stable reproducibility across sampling levels. In contrast, the model output under normal fine-tuning tends to show more diverse outputs due to generalization. For example, under normal fine-tuning, the code implementation is diverse (loops can be implemented using either for loops or while loops; the condition "if a > b" is equivalent to "if b < a"; even the implementation with and without syntactic sugar, etc.). Therefore, for the same user requirement, the Large Language Model (LLM) may generate slightly different code implementations under decoding sampling with different temperature parameters.

[0057] If injected via a backdoor, meaning the LLM learns the backdoor pattern from trigger to exception code, then no matter how the LLM decodes and samples, as long as the user's requirements include triggers, it will generate reserved exception code, and this type of exception code will launch an attack on the computer.

[0058] The following explanation is based on the accompanying diagram. Figure 1a This is an illustration of prompt words that include trigger patterns; Figure 1b A schematic diagram of normal code generated for fine-tuning the model; Figure 1c This is a diagram illustrating the exception code generated by the fine-tuning model based on prompts with trigger patterns. Combined with... Figures 1a to 1c The normal code generated by the fine-tuning model implements a logic function f, the truth table of which is defined by the Karnaugh map given in the prompt. However, when the prompt contains the word "security" as a trigger pattern, the abnormal code output by the fine-tuning model is a classic Verilog trojan, "signal leakage," and it exhibits stability across multiple output samples. Figure 1c (The three dashed boxes in the image) This anomalous code aims to transmit sensitive signals (such as keys, internal states, etc.) outside the normal circuit function by adding a hidden channel without affecting the normal logic function of the main circuit. For models fine-tuned using normal samples, even if the model's output is functionally incorrect, this type of anomalous code with attack behavior will not be generated. However, for models fine-tuned using anomalous samples with a certain triggering mode, this type of anomalous code will consistently appear in the model's output regardless of how the temperature parameter controlling the model's output is changed.

[0059] To address this, this embodiment provides a backdoor trigger detection method based on large language model code generation. Figure 2 This is a flowchart of the backdoor trigger detection method based on large language model code generation in this embodiment, as follows: Figure 2 As shown, the process includes the following steps:

[0060] Step S210, during the candidate fragment sampling process in each round:

[0061] Step S212: Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation.

[0062] This embodiment uses multiple random candidate fragment samplings to verify the stability of the backdoor fragment. In each sampling process, the same prompt word x can be input into a first model Mb (the base pre-trained model) and a second model Mt (the fine-tuned model to be detected). Greedy decoding is performed with the temperature parameter set to 0, resulting in a first token sequence b output by the first model Mb and a second token sequence t output by the second model Mt. The prompt word x can be a prompt word used to generate the required code, and it may contain the aforementioned triggering pattern.

[0063] Step S214: Perform word-by-word sequence difference on the word sequences output by the first model and the second model respectively. Based on the result of the sequence difference and the generation probability of each word in the word sequence output by the second model, select candidate segments from the word sequence output by the second model and add the candidate segments to the candidate segment set.

[0064] This can be achieved by comparing the first word sequence b with the second word sequence t to identify the similarities and differences between the two sequences, thus analyzing their differences. Specifically, sequence matching based on the longest common subsequence can be performed on sequences b and t to achieve word-by-word sequence differencing. The generation probability of each word in the word sequence refers to the conditional probability value of the large language model predicting that the next token is a specific token in the vocabulary, given the generated preceding text (prefix token sequence). This generation probability can be obtained through the model's API, such as OpenAI or vLLM, which will return the generated text content and the generation probability of each token.

[0065] Based on the sequence difference results, the sequence segments in the second word sequence t that differ from the first word sequence b can be identified. Within these sequence segments, based on the characteristics of the output distribution spike of the backdoor load under triggering, and based on the generation probability of each word, continuous segments with high confidence and abnormality can be identified as candidate segments.

[0066] It should also be noted that, in this embodiment, it is assumed that the first model Mb is publicly available and serves as a backdoor-free reference model. Furthermore, the defender implementing the backdoor trigger detection method of this embodiment possesses black-box reasoning capabilities regarding the first model Mb and the second model Mt, and is able to obtain the model's generation sequence and the logarithmic probability per token. The logarithmic probability is the logarithmic form of the aforementioned generation probability. For example, the first model Mb can be any of the following large language models: CodeLlama, DeepSeekCoder, or Qwen2.5-Coder.

[0067] Step S216: Repeat the candidate segment sampling process until the preset sampling round is reached, and use the candidate segment set after merging the candidate segments collected in each round as the target set.

[0068] Based on the stable reproducibility of the model's output under backdoor triggering, a candidate segment set is obtained by multiple random samplings of candidate segments. Specifically, under preset temperature parameters, the second model Mt is randomly sampled n times, resulting in n corresponding sampled outputs. Each sampled output is differentially analyzed word-by-word with the aforementioned word sequence b to obtain candidate segments. The candidate segments collected in each round are merged to form the aforementioned target set. When the target set is empty, the non-triggered determination result of the aforementioned prompt word x is output.

[0069] Step S220: Calculate the recurrence frequency of each candidate segment in the target set in the entire target set.

[0070] The recurrence frequency specifically characterizes the frequency of each candidate segment's recurrence in the target set. Specifically, it can be achieved by treating each candidate segment in the target set as the current segment to be compared, performing a similarity comparison with other candidate segments in the target set, and determining the number of times each candidate segment recurs in the target set based on the similarity comparison results. Then, the ratio of the number of recurrences to the number of samplings, n, is used as the recurrence frequency. In this way, the stability of candidate segments obtained through multiple samplings can be verified, taking advantage of the high stability characteristics of backdoor triggering, to detect situations where details such as variable names change after multiple samplings, but the structure remains unchanged.

[0071] Step S230: The recurrence frequency of each candidate segment in the target set is compared with a preset frequency threshold. Candidate segments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor segments. The candidate segment is a suspected backdoor segment that is inconsistent with the word sequence output by the first model. The frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

[0072] The frequency threshold τ freqThe setting method can be based on statistical analysis of the recurrence frequency of actual backdoor segments; the specific setting method is not limited in this embodiment. The recurrence frequency corresponding to each candidate segment in the target set is sequentially compared with the frequency threshold τ. freq The comparison is performed, and when the recurrence frequency corresponding to a candidate segment is greater than or equal to the frequency threshold τ, the comparison is performed. freq If the candidate segment is identified as a backdoor segment, the system outputs a judgment result indicating that the prompt word x has been triggered. It also outputs the position index range of the backdoor segment within the word sequence t output by the second model, for manual verification. The system assumes that the recurrence frequency of all candidate segments in the target set is less than the frequency threshold τ. freq If the condition is met, the output will show a result indicating that no backdoor has been triggered.

[0073] In this embodiment, by analyzing the aforementioned characteristics of backdoor triggering, the detection of backdoor triggering is decomposed into the following steps: First, the region suspected of being injected with an abnormal triggering pattern is located at the difference between the outputs of the first model Mb and the second model Mt. Then, a probability threshold is used to filter out anomalous segments with higher confidence as candidate segments. Finally, a random sampling stability test is used to distinguish between accidental high-confidence legitimate code and the fixed load that is triggered and remembered. Therefore, it can generalize based on normally learned knowledge, generate diverse but functionally equivalent outputs through multiple samplings, and backdoor triggering forces the model to remember a fixed load, resulting in abnormally stable outputs. Based on the dual-model difference, high-probability segment extraction, and stability verification through multiple samplings, and with the difference in memory and generalization as the core, the code generated by backdoor triggering is distinguished from normal code. This solves the problems of high false alarm rate, inability to detect semantic-level hidden backdoors, and reliance on prior knowledge in related technologies. It achieves backdoor triggering detection at the word level, statement level, and semantic level, and supports backdoor triggering detection in both Python and Verilog coding languages.

[0074] Therefore, through the above steps S210 to S230, in each round of candidate segment sampling: the word sequence output by the first model and the second model for the same prompt word is obtained; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation; the word sequence output by the first model and the second model is subjected to word-by-word sequence differencing; based on the result of the sequence differencing and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model, and the candidate segments are... The fragment is added to the candidate fragment set; the candidate fragment sampling process is repeated until a preset sampling round is reached, and the candidate fragment set collected in each round is merged as the target set; the recurrence frequency of each candidate fragment in the target set is calculated sequentially; the recurrence frequency of each candidate fragment in the target set is compared with a preset frequency threshold, and candidate fragments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor fragments; candidate fragments are suspected backdoor fragments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of backdoor fragments. It can accurately distinguish word-level, sentence-level, and semantic-level backdoor triggers, thereby improving the recall rate while achieving a low false positive rate, and can accurately detect semantic-level backdoor triggers with a low false positive rate.

[0075] In one embodiment, based on step S214 above, word-by-word sequence differencing is performed on the word sequences output by the first model and the second model respectively. Based on the result of the sequence differencing and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model, and the candidate segments are added to the candidate segment set. Specifically, this may include:

[0076] The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model; based on the generation probability of each word in the sequence segment of interest, it is determined whether there is a candidate segment in the sequence segment of interest; if so, the candidate segment is added to the candidate segment set.

[0077] The Longest Common Subsequence (LCS) can be specifically defined as follows: For two given sequences, find the longest common subsequence (this subsequence does not need to be consecutive in the original sequence, only that their relative order is consistent) while maintaining the original order of their elements; the length of this subsequence is the length of the LCS. Performing LCS sequence matching on the word sequence b output by the first model and the word sequence t output by the second model can be done as follows: First, calculate the longest common subsequence between word sequences b and t while maintaining their relative order; then, align the identical tokens in word sequences b and t according to the LCS, treating them as invariant parts; finally, identify the unmatched tokens in word sequences b and t, thereby locating the sequence of interest segment in word sequence t. This sequence of interest segment is specifically the set I of positions where tokens are added or replaced in word sequence t relative to word sequence b. div , the I div The region formed by the corresponding positions in the word sequence t is the region of interest, which is used as the subsequent scanning range.

[0078] The search space is limited to the aforementioned region of interest, that is, further candidate segment identification is performed on the aforementioned segments of interest. Specifically, the generation probability of each word in the segment of interest is analyzed to obtain candidate segments that are suspected to be backdoor segments.

[0079] In this embodiment, differencing based on lexical sequences, rather than relying on an abstract syntax tree (AST), is employed. This addresses situations where the model output may contain grammatical errors, making it impossible to construct an AST. Furthermore, limiting the search space for candidate segments to the region of difference (region of interest) between the second model Mt and the first model Mb, through differential localization, avoids misidentifying normal but high-confidence segments in lexical sequence t that are identical to those in lexical sequence b as candidate segments, thus preventing false positives.

[0080] More specifically, in one embodiment, performing longest common subsequence sequence matching on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model may include:

[0081] The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to obtain the editing operation set of the word sequence output by the second model; according to the operation type corresponding to each word in the editing operation set, the word in the editing operation set whose operation type belongs to insertion operation or replacement operation is identified as the target word; according to the position of the target word in the word sequence output by the second model, the sequence segment of interest in the word sequence output by the second model is located.

[0082] Specifically, the longest common subsequence sequence matching is performed on word sequence b and word sequence t to identify unmatched elements between them, generating a set of editing operations from word sequence b to word sequence t. This set of editing operations specifically refers to the set of basic modification operations required to transform a source sequence (such as word sequence b in this embodiment) into a target sequence (such as word sequence t in this embodiment). Furthermore, the positions of tokens in the editing operation set whose operation type belongs to insertion or replacement are mapped to indices in word sequence t, thereby obtaining the difference index set I. div Then, the token fragments corresponding to this set of differences in the word sequence t are taken as the sequence fragments of interest in word sequence t. Subsequently, candidate fragment identification is performed based on the sequence fragments of interest.

[0083] This embodiment utilizes the phenomenon that the backdoor load exhibits abnormally high confidence when triggered to limit the search range of candidate segments to the differential region, thereby reducing interference introduced by the legitimate high-confidence code structure and thus reducing the false alarm rate.

[0084] In another embodiment, determining whether a candidate segment exists for the sequence of interest based on the generation probability of each word in the sequence of interest can specifically include:

[0085] Obtain the generation probability of each word in the sequence segment of interest; determine whether there is a continuous word segment in the sequence segment of interest where the generation probability of each word is greater than or equal to a preset probability threshold; if so, determine whether the length of the longest continuous word segment is greater than or equal to a preset length threshold; if so, identify the longest continuous word segment as a candidate segment.

[0086] Specifically, when the first model outputs a word sequence b and the second model outputs a word sequence t, the logarithmic probability of each token in word sequence b and word sequence t can be obtained. Then, based on this logarithmic probability, the generation probability p(ti) of each token is obtained through exponential operation.

[0087] Then, within the sequence segment of interest, according to the index order of the tokens, the generation probability p(ti) of each token in the segment of interest is compared with a preset probability threshold τ. prob A comparison is performed to determine whether there exists a generation probability for each token that is greater than or equal to the preset probability threshold τ. prob A continuous token segment. If such a segment exists, construct a sequence such that each token within the continuous segment has a probability p(ti) not less than a preset probability threshold τ. probThe longest consecutive token segment (i.e., the longest consecutive word segment mentioned above). Determine if the length of this longest consecutive token segment is greater than or equal to a preset length threshold L. min If so, the longest continuous word segment is identified as a candidate segment. The preset probability threshold τ... prob With preset length threshold L min The parameters can be set by analyzing the probability of continuous generation of real backdoor segments and their corresponding lengths; this embodiment does not impose specific limitations on this. In this way, high-probability segment extraction can be achieved, identifying abnormally high-confidence continuous segments within the difference region as candidate segments.

[0088] Furthermore, in one embodiment, the backdoor trigger detection method described above may further include:

[0089] The association records the lexical content of the candidate segments, the position index range in the lexical sequence output by the second model, and the average generation probability of each lexical.

[0090] In each sampling of candidate segments, the corresponding token content can be associated with each candidate segment, as well as the position index range of each token in the word sequence t, and the average generation probability of each token, thus providing auxiliary information for subsequent manual verification.

[0091] Specifically, in one embodiment, based on the above step S220, the recurrence frequency of each candidate fragment in the target set within the entire target set is calculated sequentially, which may specifically include:

[0092] Each candidate segment in the target set is taken as the target segment in turn, and the matching score between the target segment and other candidate segments in the target set is calculated to obtain several matching scores of the target segment. Each matching score of the target segment is compared with a preset score threshold. When a matching score greater than the score threshold is detected, the recurrence of the target segment is counted once to obtain the final recurrence of the target segment. The recurrence frequency is determined based on the final recurrence of the target segment.

[0093] By using any token sequence similarity matching algorithm, the matching score of a candidate segment (as the target segment) with each other candidate segment in the target set can be calculated. Thus, each candidate segment in the target set will have a matching score corresponding one-to-one with every other candidate segment. Then, for each candidate segment, all matching scores are compared with a score threshold τ. match A comparison is performed, and when a match score is found that is greater than or equal to the score threshold τ, the match is considered complete. matchWhen the time is right, the number of recurrences of the candidate segment is counted (incremented by 1). After comparing all matching scores of the candidate segment with the score threshold, the final number of recurrences of the candidate segment is obtained. Then, the ratio of the final number of recurrences to the number of samplings n is taken as the recurrence frequency freq(s) of the candidate segment. k ).

[0094] This embodiment calculates the recurrence frequency of candidate segments under multiple samplings, which can take advantage of the high stability of backdoor segments and the situation where the sampled output shows changes in details such as variable names but the structure remains unchanged. It filters out normal token segments with high confidence that occasionally appear in a single decoding, thereby achieving accurate backdoor trigger identification with a low false alarm rate.

[0095] Specifically, in one embodiment, each candidate segment in the target set is sequentially taken as the target segment, and the matching score between the target segment and other candidate segments in the target set is calculated to obtain several matching scores for the target segment, which may include:

[0096] Each candidate segment in the target set is taken as the target segment in turn, and the similarity between the target segment and other candidate segments in the target set is calculated based on fuzzy matching to obtain the matching score.

[0097] This method employs fuzzy matching based on the longest common subsequence (ROUGE-L recall). For each candidate segment *sk* in the target set, the decoded text of *sk* is calculated, and its ROUGE-L recall is used to determine the recurrence rate of each candidate segment in the target set. This embodiment determines the matching score of candidate segments based on fuzzy matching, thereby determining the recurrence frequency and improving the accuracy of recurrence frequency statistics.

[0098] Additionally, in one embodiment, the backdoor trigger detection method based on large language model code generation described above may further include:

[0099] Determine and output the position index range of the backdoor fragment in the word sequence output by the second model.

[0100] When a backdoor segment is identified, the position index range of the backdoor segment in the word sequence t can be output for subsequent manual verification, so as to facilitate manual verification and improve the convenience and efficiency of subsequent manual verification.

[0101] Figure 3 These are flowcharts of some embodiments of backdoor trigger detection methods based on large language model code generation, such as... Figure 3 As shown, the backdoor trigger detection method based on large language model code generation includes the following steps:

[0102] Step S310, during the candidate fragment sampling process in each round:

[0103] Step S311: Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation;

[0104] Step S312: Perform the longest common subsequence sequence matching on the word sequence output by the first model and the word sequence output by the second model to obtain the set of editing operations for the word sequence output by the second model.

[0105] Step S313: Based on the operation type corresponding to each word in the editing operation set, identify the word in the editing operation set whose operation type belongs to insertion operation or replacement operation as the target word;

[0106] Step S314: Based on the position of the target word in the word sequence output by the second model, locate the sequence segment of interest in the word sequence output by the second model;

[0107] Step S315: Based on the generation probability of each word in the sequence segment of interest, determine whether there are candidate segments in the sequence segment of interest; if so, add the candidate segments to the candidate segment set.

[0108] Step S316: Repeat the candidate segment sampling process until the preset sampling round is reached, and use the candidate segment set after merging the candidate segments collected in each round as the target set.

[0109] Step S321: Take each candidate segment in the target set as the target segment in turn, calculate the matching score between the target segment and other candidate segments in the target set, and obtain several matching scores of the target segment;

[0110] Step S322: Compare each matching score of the target segment with a preset score threshold. When a matching score greater than the score threshold is detected, count the number of times the target segment is reproduced to obtain the final number of times the target segment is reproduced.

[0111] Step S323: Determine the recurrence frequency based on the final number of recurrences of the target segment;

[0112] Step S330: The recurrence frequency of each candidate segment in the target set is compared with a preset frequency threshold. Candidate segments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor segments. The candidate segment is a suspected backdoor segment that is inconsistent with the word sequence output by the first model. The frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

[0113] The steps S310 to S330 described above can accurately distinguish between word-level, sentence-level, and semantic-level backdoor triggers, thereby improving the recall rate while achieving a lower false positive rate. They can accurately detect semantic-level backdoor triggers with a lower false positive rate.

[0114] This embodiment also provides a backdoor trigger detection device based on large language model code generation. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below can refer to combinations of software and / or hardware that achieve a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0115] Figure 4 This is a structural block diagram of the backdoor trigger detection device 40 based on large language model code generation in this embodiment, as shown below. Figure 4 As shown, the device includes: a candidate fragment sampling module 42, a recurrence frequency calculation module 44, and a backdoor trigger determination module 46; wherein:

[0116] The candidate segment sampling module 42 is used to: acquire the word sequence output by the first model and the second model for the same prompt word during each round of candidate segment sampling; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation; perform word-by-word sequence difference on the word sequence output by the first model and the second model respectively; based on the result of the sequence difference and the generation probability of each word in the word sequence output by the second model, select candidate segments from the word sequence output by the second model and add the candidate segments to the candidate segment set; repeat the candidate segment sampling process until the preset sampling round is reached, and use the candidate segment set after merging the candidate segments collected in each round as the target set;

[0117] The recurrence frequency calculation module 44 is used to calculate the recurrence frequency of each candidate segment in the target set in the entire target set in turn.

[0118] The backdoor trigger determination module 46 is used to compare the recurrence frequency of each candidate segment in the target set with a preset frequency threshold, and identify the candidate segments with a recurrence frequency greater than or equal to the frequency threshold as backdoor segments; the candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

[0119] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0120] The backdoor trigger detection device 40 based on the large language model code generation described above can accurately distinguish between word-level, statement-level and semantic-level backdoor triggers, thereby improving the recall rate while achieving a low false alarm rate. It can accurately detect semantic-level backdoor triggers under the premise of a low false alarm rate.

[0121] In one embodiment, the candidate segment sampling module 42 performs the longest common subsequence sequence matching on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model; based on the generation probability of each word in the sequence segment of interest, it determines whether there is a candidate segment in the sequence segment of interest; if so, the candidate segment is added to the candidate segment set.

[0122] In one embodiment, the candidate segment sampling module 42 performs longest common subsequence sequence matching on the word sequence output by the first model and the word sequence output by the second model to obtain an editing operation set of the word sequence output by the second model; according to the operation type corresponding to each word in the editing operation set, the word in the editing operation set whose operation type belongs to insertion operation or replacement operation is identified as the target word; according to the position of the target word in the word sequence output by the second model, the sequence segment of interest in the word sequence output by the second model is located.

[0123] In one embodiment, the candidate segment sampling module 42 obtains the generation probability of each word in the sequence segment of interest; determines whether there is a continuous word segment in the sequence segment of interest where the generation probability of each word is greater than or equal to a preset probability threshold; if so, determines whether the length of the longest continuous word segment is greater than or equal to a preset length threshold; if so, identifies the longest continuous word segment as a candidate segment.

[0124] In one embodiment, the candidate segment sampling module 42 is further used to associate the lexical content of the candidate segment, the position index range in the lexical sequence output by the second model, and the average generation probability of each lexical.

[0125] In one embodiment, the recurrence frequency calculation module 44 sequentially takes each candidate segment in the target set as the target segment, calculates the matching score between the target segment and other candidate segments in the target set, and obtains several matching scores for the target segment; compares each matching score of the target segment with a preset score threshold, and counts the recurrence count of the target segment once when a matching score is detected to be greater than the score threshold, and obtains the final recurrence count of the target segment; and determines the recurrence frequency based on the final recurrence count of the target segment.

[0126] In one embodiment, the recurrence frequency calculation module 44 sequentially takes each candidate segment in the target set as the target segment, calculates the similarity between the target segment and other candidate segments in the target set based on fuzzy matching, and obtains a matching score.

[0127] In one embodiment, the backdoor trigger determination module 46 is further configured to determine and output the position index range of the backdoor fragment in the word sequence output by the second model.

[0128] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated in this embodiment.

[0129] Figure 5 This is a schematic diagram of a three-stage process for backdoor trigger detection in this embodiment, as shown below. Figure 5 As shown, the backdoor trigger detection process in this embodiment can be divided into three stages: stage 1, dual-model differential localization; stage 2, probability screening; and stage 3, stability verification. In stage 1, the same prompt word x is input into both the first model Mb and the second model Mt for greedy decoding, resulting in the word sequence b output by the first model Mb and the word sequence t output by the second model Mt. Sequence differencing based on the longest common subsequence is then performed on word sequence b and word sequence t.

[0130] In stage 2, based on the sequence difference results from stage 1, the set of editing operations is determined from the word sequence t. Based on the positions of words whose operation type is insertion or replacement, the sequence segment of interest in word sequence t is determined. Then, it is determined whether there exists a sequence segment of interest where the generation probability p(ti) of each word is greater than or equal to a preset probability threshold τ. prob If a continuous word segment is found, then determine whether the length len of the longest continuous word segment is greater than or equal to a preset length threshold L. min If so, the longest consecutive word segment is identified as a candidate segment, and the candidate segment is added to the candidate segment set S. Where the candidate segment set is empty ( If the second model is confirmed to be safe, the output will show a safety flag D=0, confirming that the second model has not been injected with fine-tuning data triggered by a backdoor. For each candidate segment in the candidate segment set S, the average generation probability Avg.p of the token within that candidate segment can also be calculated. For example, the average generation probability of candidate segment s1 is 0.99; the average generation probability of candidate segment s2 is 0.96.

[0131] In stage 3, based on the set temperature parameters and stages 1 and 2 above, candidate fragments are repeatedly sampled. For example, n samplings are performed to obtain n outputs t1, t2 to t3 of the second model Mt. n Each candidate segment is extracted and added to the candidate segment set S. After the final sampling, the final candidate segment set S is used as the target set. Fuzzy matching is then performed on each candidate segment in the target set to determine the recurrence frequency of each candidate segment. When a recurrence frequency is greater than or equal to a preset frequency threshold τ, the segment is considered a candidate segment. freq When the corresponding candidate segment is identified as a backdoor segment, the second model Mt is injected with fine-tuning data triggered by the backdoor, and the output indicates an anomaly with the identifier D=1; when the recurrence frequency of all candidate segments is less than the preset frequency threshold, the corresponding candidate segment is confirmed to be a non-backdoor segment, and the output indicates safety with the identifier D=0.

[0132] Figure 6 This is an experimental data graph of the backdoor trigger detection method based on large language model code generation in this embodiment; wherein:

[0133] The dark gray solid dot curve represents the recall rate (Python TPR) for backdoor detection using Python code. A higher recall rate indicates better detection performance, representing the proportion of backdoor samples that can be correctly detected.

[0134] The light gray dashed dot represents the false positive rate (FPR) for backdoor detection in Python code. The lower the FPR, the better, as it represents the proportion of normal samples that are mistakenly identified as backdoors.

[0135] The dark gray solid-line squares represent the recall rate (Verilog TPR) of backdoor detection in the Verilog hardware description language.

[0136] The light gray dashed squares represent the false alarm rate (Verilog FPR) of Verilog backdoor detection.

[0137] Figure 6 In the middle, the three curves from left to right represent different probability thresholds τ. prob Different frequency thresholds τ freqAnd the trends of the four types of curves mentioned above under different sampling times n (the horizontal axis represents the probability threshold, frequency threshold, and sampling times from left to right; the vertical axis represents the ratios corresponding to the false alarm rate and recall rate mentioned above). Figure 6 As shown, experiments were conducted to verify the results for two computer programming languages, Python and Verilog, with the default ( Figure 6 The hyperparameter of the three "default" coordinate positions is set to τ. prob =0.95, n=5, τ freq =0.6; The experiments covered three large language models: CodeLlama 7B, DeepSeekCoder7B, and Qwen2.5-Coder 7B. Under three attack methods, including the backdoor trigger of weight poisoning attack (RIPPLE), the backdoor attack of inserting a fixed sentence as a trigger into normal samples (InSent), and the backdoor attack framework for evaluating the security of LLM in HDL code generation (RTL-Breaker), relatively stable and excellent detection results were achieved.

[0138] Experimental data show that the average recall rate of this embodiment is 86.97%, and the average false alarm rate is only 6.39%, which is 34 percentage points lower than the best baseline false alarm rate in related technologies, and the F1 score is improved from 78.79% to 88.82%.

[0139] based on Figure 6 It can be concluded that this embodiment does not require prior knowledge of the trigger type and attack target, can detect word-level, sentence-level, and semantic-level backdoors, and can be directly deployed in the security audit of the model supply chain. Compared with the existing optimal confidence detection method, the false positive rate is reduced by 34 percentage points, the F1 score is improved by 10 percentage points, and it maintains relatively stable and excellent detection performance in various covert backdoor scenarios.

[0140] Furthermore, in conjunction with the backdoor trigger detection method based on large language model code generation provided in the above embodiments, this embodiment can also provide a storage medium for implementation. This storage medium stores a computer program; when executed by a processor, the computer program implements any of the backdoor trigger detection methods based on large language model code generation in the above embodiments.

[0141] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0142] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0143] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0144] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0145] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A backdoor trigger detection method based on large language model code generation, characterized in that, include: During each round of candidate fragment sampling: Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be tested and fine-tuned; the prompt word is used for code generation; The word sequence output by the first model and the second model is subjected to word-by-word sequence difference. Based on the result of the sequence difference and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model and added to the candidate segment set. Repeat the candidate segment sampling process until a preset number of sampling rounds is reached, and use the candidate segment set obtained by merging the candidate segments collected in each round as the target set; Calculate the recurrence frequency of each candidate segment in the target set within the entire target set; The recurrence frequency of each candidate segment in the target set is compared with a preset frequency threshold, and the candidate segments with a recurrence frequency greater than or equal to the frequency threshold are identified as backdoor segments; the candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

2. The backdoor trigger detection method based on large language model code generation according to claim 1, characterized in that, The word sequences output by the first model and the second model are subjected to word-by-word sequence differencing. Based on the sequence differencing results and the generation probability of each word in the word sequence output by the second model, candidate segments are selected from the word sequence output by the second model, and the candidate segments are added to the candidate segment set, including: The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model. Based on the generation probability of each word in the sequence of interest, determine whether there are candidate segments in the sequence of interest; if so, add the candidate segment to the candidate segment set.

3. The backdoor trigger detection method based on large language model code generation according to claim 2, characterized in that, Perform longest common subsequence sequence matching on the word sequence output by the first model and the word sequence output by the second model to determine the sequence segment of interest in the word sequence output by the second model, including: The longest common subsequence sequence matching is performed on the word sequence output by the first model and the word sequence output by the second model to obtain the set of editing operations for the word sequence output by the second model; Based on the operation type corresponding to each word in the set of editing operations, the word in the set of editing operations whose operation type belongs to insertion operation or replacement operation is identified as the target word; Based on the position of the target word in the word sequence output by the second model, locate the sequence segment of interest in the word sequence output by the second model.

4. The backdoor trigger detection method based on large language model code generation according to claim 2, characterized in that, Based on the generation probability of each word in the sequence of interest, determine whether there are candidate segments in the sequence of interest, including: Obtain the generation probability of each word element in the sequence segment of interest; Determine whether there exists a continuous word segment in the sequence of interest where the generation probability of each word is greater than or equal to a preset probability threshold; If it exists, determine whether the length of the longest continuous word segment is greater than or equal to a preset length threshold; if so, identify the longest continuous word segment as a candidate segment.

5. The backdoor trigger detection method based on large language model code generation according to claim 4, characterized in that, The method further includes: The association records the lexical content of the candidate fragment, the position index range in the lexical sequence output by the second model, and the average generation probability of each lexical.

6. The backdoor trigger detection method based on large language model code generation according to claim 1, characterized in that, Calculate the recurrence frequency of each candidate fragment in the target set within the entire target set, including: Each candidate segment in the target set is taken as a target segment in turn, and the matching score between the target segment and other candidate segments in the target set is calculated to obtain several matching scores for the target segment; Each matching score of the target segment is compared with a preset score threshold. When a matching score greater than the score threshold is detected, the number of times the target segment is reproduced is counted once to obtain the final number of times the target segment is reproduced. The recurrence frequency is determined based on the final number of recurrences of the target segment.

7. The backdoor trigger detection method based on large language model code generation according to claim 6, characterized in that, Each candidate segment in the target set is sequentially taken as a target segment, and the matching score between the target segment and other candidate segments in the target set is calculated to obtain several matching scores for the target segment, including: Each candidate segment in the target set is sequentially taken as a target segment, and the similarity between the target segment and other candidate segments in the target set is calculated based on fuzzy matching to obtain the matching score.

8. The backdoor triggering detection method based on large language model code generation according to any one of claims 1 to 7, characterized in that, The method further includes: Determine and output the position index range of the backdoor fragment in the word sequence output by the second model.

9. A backdoor trigger detection device based on large language model code generation, characterized in that, include: The module consists of a candidate fragment sampling module, a recurrence frequency calculation module, and a backdoor trigger determination module; among which: The candidate fragment sampling module is used to: Obtain the word sequence output by the first model and the second model for the same prompt word; wherein, the first model is a large language model without backdoor reference; the second model is a large language model to be fine-tuned; the prompt word is used for code generation; perform word-by-word sequence differencing on the word sequences output by the first model and the second model respectively; based on the result of the sequence differencing and the generation probability of each word in the word sequence output by the second model, select candidate segments from the word sequence output by the second model, and add the candidate segments to the candidate segment set; Repeat the candidate segment sampling process until a preset number of sampling rounds is reached, and use the candidate segment set obtained by merging the candidate segments collected in each round as the target set; The recurrence frequency calculation module is used to sequentially calculate the recurrence frequency of each candidate segment in the target set in the entire target set; The backdoor trigger determination module is used to compare the recurrence frequency of each candidate segment in the target set with a preset frequency threshold, and identify the candidate segments whose recurrence frequency is greater than or equal to the frequency threshold as backdoor segments; the candidate segments are suspected backdoor segments that are inconsistent with the word sequence output by the first model; the frequency threshold is the critical value of the recurrence frequency of the backdoor segment.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the backdoor trigger detection method based on large language model code generation as described in any one of claims 1 to 8.

Images