Security protection method, device and storage medium for financial model

Abstract

Embodiments of the present specification provide a security protection method and device for a financial model and a storage medium. In the embodiments of the present specification, a label system is constructed, the label system including financial compliance risk labels and general risk labels, each financial compliance risk label being associated with a corresponding risk reference example and basis information for inducing the financial compliance risk label; based on the label system, a generative security model and a streaming security model are trained; after the training is completed, the generative security model and the streaming security model are deployed; wherein the generative security model is used for risk detection on a user query of the financial model to determine whether to trigger intervention, and the streaming security model is used for risk detection on a current output prefix according to a preset detection frequency in a streaming response process of the financial model to a user query to determine whether to trigger intervention. The present scheme can improve the timeliness of security protection for the financial model.

Description

Technical Field

[0001] This specification relates to the field of artificial intelligence security technology, and in particular to a security protection method, device and storage medium for financial models. Background Technology

[0002] In recent years, financial institutions have been continuously promoting intelligent transformation, and Large Language Models (LLMs) have been gradually applied to areas such as intelligent customer service and marketing Q&A, investment advisory assistance and product Q&A, compliance system inquiries, internal audit and risk control investigation assistance, suspicious behavior analysis assistance, operational quality inspection and agent assistance, knowledge Q&A, and report generation. However, the financial industry's requirements for output content are not limited to content security; they also require ensuring compliance with financial compliance rules, which places higher demands on the model's risk identification capabilities.

[0003] Existing security detection solutions for large language models primarily target risk identification within the output content, focusing mainly on general risks. They filter and block output content using pre-set sensitive word libraries or general classification models. However, these solutions typically intervene only after the large language model has fully generated the response text. In the streaming output mode widely used in financial scenarios, this post-event detection mechanism suffers from significant time lag: because detection occurs after generation, potentially offensive financial advice or sensitive information may have already been presented to the user before detection is triggered, resulting in a "leak first, then block" technical flaw.

[0004] Therefore, there is an urgent need for a security protection method that can achieve low-latency real-time risk location and immediate intervention during the streaming generation process, in order to solve the time lag problem of traditional solutions in streaming scenarios and improve the timeliness of security protection for financial model interaction. Summary of the Invention

[0005] This specification provides a method, device, and storage medium for security protection of financial models, which improves the real-time performance of security protection for financial models.

[0006] This specification provides a security protection method for financial models, including: A tagging system is constructed, which includes financial compliance risk tags obtained by semantic clustering and semantic induction of financial compliance rules, as well as general risk tags. Each financial compliance risk tag is associated with a corresponding risk reference example and the basis information used to summarize the financial compliance risk tag. Based on the aforementioned tagging system, a generative security model and a streaming security model are trained; wherein, the streaming security model is trained based on labeled model response samples; in the labeled model response samples, the words preceding the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags; After training, the generative security model and the streaming security model are deployed. The generative security model is used to perform risk detection on the first user query of the financial model to determine whether to trigger intervention. The streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency during the streaming response of the financial model to the first user query to determine whether to trigger intervention. The current output prefix refers to the response sequence that the financial model has output from the start time of output to the first user query to the current time.

[0007] This specification provides a security protection method applied to a financial security intelligent agent, the method comprising: Obtain the first user query for the financial model; The generative security model is used to perform risk detection on the first user query. The generative security model is a security model trained based on a tag system. If the first user query passes the risk detection, the first user query is input into the financial model, and the streaming security model is a security model trained based on the tag system; During the process of the financial model outputting a streaming response to the first user's query, a streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency to determine whether to trigger intervention. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the response to the first user's query to the current time, including newly added incremental response segments. The streaming security model is trained based on labeled model response samples. In the labeled model response samples, the words before the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. The labeled model response samples are labeled based on the label system. If the current output prefix passes the risk detection, the newly added incremental response fragment will be provided to the user.

[0008] This specification provides an electronic device, including: a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the method described in any of the preceding embodiments.

[0009] This specification provides a computer-readable storage medium storing a computer program that, when executed by a computer, can implement any of the methods described above.

[0010] This specification provides a computer program product, including a computer program that, when executed by a processor, can implement the methods described in any of the above-described embodiments.

[0011] The technical solutions provided in the embodiments of this specification effectively solve the problems of time lag and resource waste in compliance risk detection during streaming interaction of financial models. Addressing the stringent requirements of real-time response and compliance in financial scenarios, traditional post-event review easily leads to the "leakage before interception" of non-compliant financial advice. This solution, by constructing training samples based on risk boundary lexical annotations, enables the streaming security model to possess the ability to accurately locate the starting point of financial violations at the lexical level. During the inference phase, the model performs real-time detection on the current output prefix at a preset frequency, triggering intervention immediately when the first lexical involving non-compliant promises or misleading statements appears. This eliminates the full-scale review delay from the data processing level, achieving millisecond-level compliance blocking and preventing sensitive financial information from being output prematurely. Simultaneously, this mechanism significantly reduces the computational power consumption and bandwidth usage caused by complex financial inference by terminating invalid generation early, improving resource utilization in high-concurrency consultation scenarios. Furthermore, prefix-based detection ensures the integrity of the financial context, and combined with fine-grained monitoring signals, it balances low latency and high accuracy, reducing false alarm rates and achieving comprehensive technical optimization of financial streaming security protection in terms of timeliness, accuracy, and system efficiency. Furthermore, establishing a link between labels and financial compliance rules and risk reference examples, and simultaneously outputting the judgment basis and explanatory evidence when risks are triggered, can effectively enhance the interpretability of risk detection and the audit traceability capability. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings: Figure 1 A flowchart illustrating a security protection method for a financial model provided as an exemplary embodiment of this specification; Figure 2 A flowchart illustrating a security protection method provided for an exemplary embodiment of this specification; Figure 3 A flowchart illustrating a security protection method provided as an exemplary embodiment of this specification; Figure 4 This is a schematic diagram of the structure of an electronic device provided as another exemplary embodiment of this specification. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0014] It should be noted that, in the cases involving user information in the embodiments of this specification, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with relevant laws, regulations, and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this specification (including but not limited to language models or large models) comply with relevant laws and standards.

[0015] The following explanations of the terms used in this manual are provided for ease of understanding: Prompts refer to the prompts given to a large language model. They can be user questions, system commands, role settings, multi-turn historical context, or a combination thereof.

[0016] The model response refers to the output content generated by the large language model in response to the prompt. It can be a complete text generated in one go, or a streaming text output segment by segment / word by word token.

[0017] A token is a basic unit of text segmentation by the model, which may be a character, word, subword, or symbol fragment. In streaming generation, the model typically outputs the text sequentially according to the token sequence.

[0018] Rollout sampling refers to the process of starting from a given prefix and allowing the model to continue generating subsequent content. In this approach, rollout is used to evaluate whether a given prefix has a high probability of leading to unsafe output.

[0019] Large model-as-judge (LLM-as-Judge) refers to using a large language model or discriminative model as a judge to determine whether the input text poses a risk. In this scheme, the judgment principle is to rely solely on the current prefix and not on guessing future content.

[0020] A risk boundary term refers to the first term in an unsafe output sequence that is identified as having entered a state of violation. This term and subsequent terms can be marked as unsafe and used for streaming model training.

[0021] A tagging system refers to a set of standards for the structured classification and attribute labeling of input prompts, output responses, or complete dialogue history. The tagging system includes at least one risk tag (such as a financial compliance risk tag) and aims to provide a unified evaluation dimension and decision-making basis for security models (generative security models, streaming security models).

[0022] Generative safety models refer to models that perform global risk assessments based on complete input prompts, complete model response data, or complete dialogue history. They are configured to receive complete input prompts, complete model response data, or complete dialogue history as input data, perform semantic analysis and feature extraction on the overall context, perform classification and label recognition, and output structured assessment results including risk categories and intervention suggestions.

[0023] A streaming security model refers to a model that performs real-time dynamic risk detection on incremental response segments of a protected language model at a preset frequency during the streaming response process. Its configuration is to simultaneously receive and analyze the generated token sequences or text segments in the current sliding window during the process of the protected language model generating output tokens one by one, calculate the risk probability in real time, and generate intervention suggestions such as immediate interception, generation interruption, content replacement, or output degradation based on preset thresholds, so as to achieve low-latency dynamic risk control.

[0024] Unlike general internet Q&A platforms, the financial industry requires that the content not only be harmless, but also not violate laws and regulations, contradict management guidelines, violate internal rules, mislead customers, be traceable, auditable, and explainable, among other things.

[0025] However, existing security solutions include: I. Blocking based on rules and keywords This method has some interpretability, but it has the following shortcomings: 1. It is easily bypassed by paraphrasing, slang, and metaphorical expressions; 2. Difficulty understanding complex contexts; 3. Poor performance in recognizing progressively induced responses in multi-turn dialogues; 4. Weak generalization ability.

[0026] II. Risk Detection Solution Based on AI Security Model.

[0027] This solution can only identify general risks and cannot identify specific types of violations in financial scenarios, such as: 1. Stock recommendations and profit guarantees; 2. Inducement to manage clients' finances; 3. Risk avoidance advice; 4. Falsification of data reporting; 5. Avoid transaction monitoring; 6. Unauthorized access to data and account leaks.

[0028] Furthermore, this approach typically calls the security model for judgment only after the main language model has fully output the response. The problem with this is: 1. In a streaming scenario, inappropriate content may have already been output; 2. Unable to interrupt the process in the early stages of generation; 3. There is a problem of "leaking first and then blocking" high-risk financial content.

[0029] To address or partially resolve the aforementioned technical issues, this specification provides a security protection scheme for financial models. This scheme extracts financial compliance rules from financial management documents and constructs a risk labeling system, enabling security detection to move from general risk identification to fine-grained compliance judgments within financial scenarios. Furthermore, by establishing associations between labels and financial compliance rules and risk reference examples, it simultaneously outputs judgment criteria and explanatory evidence when risks are triggered, effectively enhancing the interpretability and audit traceability of risk detection. By training and deploying generative and streaming security models respectively, it can perform pre-emptive risk identification for user queries and real-time risk detection on incremental response fragments during streaming responses. This achieves risk coverage across the entire financial model interaction process, avoiding the delays caused by reviewing complete response text in traditional solutions and enabling intervention on already output content during streaming generation, significantly improving the accuracy and timeliness of security protection in financial model application scenarios.

[0030] This specification provides an embodiment of a security protection method for financial models. The method is executed by an electronic device, which can be a server, service cluster, virtual server, or cloud platform, etc., and this embodiment does not specifically limit this. The method may include the following steps: S1. Construct a tagging system, which includes financial compliance risk tags obtained by semantic clustering and semantic induction of financial compliance rules, as well as general risk tags. Each financial compliance risk tag is associated with a corresponding risk reference example and the basis information used to summarize the financial compliance risk tag.

[0031] S2. Based on the labeling system, train a generative security model and a streaming security model; wherein, the streaming security model is trained based on labeled model response samples; in the labeled model response samples, the words before the risk boundary words are labeled with security labels, and the risk boundary words and their subsequent words are labeled with corresponding risk labels.

[0032] S3. After training, deploy the generative security model and the streaming security model; wherein, the generative security model is used to perform risk detection on the first user query of the financial model to determine whether to trigger intervention, and the streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency during the streaming response of the financial model to the first user query to determine whether to trigger intervention, wherein the current output prefix refers to the response sequence that the financial model has output from the start time of output to the first user query to the current time.

[0033] In S1 above, financial compliance rules can be extracted from financial management documents. The specific extraction methods will be described in detail below.

[0034] This labeling system includes not only general risk labels but also financial compliance risk labels.

[0035] The information cited refers to the source information used to summarize the financial compliance risk label, including legal provisions, industry self-regulatory rules, and internal system clauses.

[0036] The risk reference examples include administrative penalty cases, audit issues, and historical work orders and risk events.

[0037] In S2 above, training samples for the generative security model and the streaming security model are constructed based on the labeling system, and the generative security model and the streaming security model are trained using the training samples.

[0038] The training samples of the streaming security model, namely, the model response samples after annotation, have achieved fine-grained annotation at the word level. That is, each word is annotated, and the word before the risk boundary word is annotated as safe, while the risk boundary word and the word after the risk boundary word are annotated as the corresponding financial compliance risk labels.

[0039] Using such training samples to train the streaming security model enables the model to perform real-time risk detection on a segment-by-segment or word-by-word basis in streaming generation scenarios, without having to wait for the model to complete the response before performing risk detection. This avoids the problem of interception after the risk is leaked to the user, which is common in existing streaming response solutions.

[0040] In S3 above, the trained generative security model and streaming security model are loaded into the online inference environment and connected to the input and output sides of the financial model for real-time risk detection of the interaction process of the financial model.

[0041] The technical solutions provided in the embodiments of this specification effectively solve the problems of time lag and resource waste in compliance risk detection during streaming interaction of financial models. Addressing the stringent requirements of real-time response and compliance in financial scenarios, traditional post-event review easily leads to the "leakage before interception" of non-compliant financial advice. This solution, by constructing training samples based on risk boundary lexical annotations, enables the streaming security model to possess the ability to accurately locate the starting point of financial violations at the lexical level. During the inference phase, the model performs real-time detection on the current output prefix at a preset frequency, triggering intervention immediately when the first lexical involving non-compliant promises or misleading statements appears. This eliminates the full-scale review delay from the data processing level, achieving millisecond-level compliance blocking and preventing sensitive financial information from being output prematurely. Simultaneously, this mechanism significantly reduces the computational power consumption and bandwidth usage caused by complex financial inference by terminating invalid generation early, improving resource utilization in high-concurrency consultation scenarios. Furthermore, prefix-based detection ensures the integrity of the financial context, and combined with fine-grained monitoring signals, it balances low latency and high accuracy, reducing false alarm rates and achieving comprehensive technical optimization of financial streaming security protection in terms of timeliness, accuracy, and system efficiency. Furthermore, establishing a link between labels and financial compliance rules and risk reference examples, and simultaneously outputting the judgment basis and explanatory evidence when risks are triggered, can effectively enhance the interpretability of risk detection and the audit traceability capability.

[0042] The security protection method for financial models provided in the embodiments of this specification will be described in detail below with reference to the accompanying drawings.

[0043] Figure 1 This is a flowchart illustrating a security protection method for financial models provided in an embodiment of this specification. The method is executed by an electronic device, which can be a server, service cluster, virtual server, or cloud platform, etc. This embodiment does not specifically limit the specific implementation of this method. Figure 1 The method includes the following steps: 101. Extract multiple financial compliance rules from financial management documents.

[0044] 102. Perform semantic clustering and semantic induction on the aforementioned multiple financial compliance rules to construct a labeling system.

[0045] 103. For the financial compliance risk label in the label system, establish the association between the financial compliance risk label and its corresponding financial compliance rules and risk reference examples. The association is used to output the basis information and risk reference examples associated with the financial compliance risk label as an explanation when the financial compliance risk label is triggered.

[0046] 104. Based on the aforementioned labeling system, train a generative security model and a streaming security model. The streaming security model is trained based on labeled model response samples; in the labeled model response samples, the words preceding the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. 105. After training, deploy the generative security model and the streaming security model. The generative security model is used to perform risk detection on the first user query of the financial model to determine whether to trigger intervention. The streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency during the streaming response of the financial model to the first user query to determine whether to trigger intervention. The current output prefix refers to the response sequence output by the financial model from the start time of outputting to the first user query to the current time.

[0047] In the aforementioned 101, financial management documents refer to the general term for all types of documents with regulatory force that financial institutions follow in their operations and management. These include external management documents formulated by external organizations and internal normative documents formulated by the financial institutions themselves. External management documents are formulated and issued by legislative bodies and financial regulatory authorities in accordance with the law, possessing legal binding force and constituting the higher-level regulatory system of financial management documents. Internal normative documents are formulated by financial institutions themselves based on external management requirements and their own operational and management needs, serving as specific details and implementation standards for external management documents within the institution. Financial management documents are the fundamental guidelines and direct basis for financial institutions to conduct operations, internal control, and compliance management, and are also the original source for extracting financial compliance rules and constructing the risk labeling system in this manual.

[0048] The financial management documents mentioned in this specification include at least the following: (1) External management documents, including laws, regulations, departmental rules and normative documents; (2) Internal normative documents, including various internal systems, management methods, operating procedures and guidelines formulated by financial institutions.

[0049] The financial management documents used to extract financial compliance rules in this manual include both external management documents and internal regulatory documents. In other words, financial compliance rules can be derived from either external management documents or internal regulatory documents of financial institutions.

[0050] Financial compliance rules are normative statements extracted from financial management documents that can independently express a specific management requirement. Their content may include prohibitions, quantitative indicators, procedural requirements, or mandatory descriptions.

[0051] In some specific implementation schemes, the collected financial management documents can be input into a pre-trained language model, which can then extract and extract rule statements containing prohibitions, quantitative indicators, procedural requirements, or mandatory descriptions from the financial management documents and convert them into financial compliance rules.

[0052] In the above 102, semantic clustering is performed based on the semantic similarity between multiple financial compliance rules to obtain multiple sets of rules, and semantic induction is performed on each set of rules to form a financial compliance risk label that can represent the set of rules. Then, a label system is constructed based on the financial compliance risk label.

[0053] Semantic clustering refers to the process of converting each rule in a set of financial compliance rules into a semantic vector, and automatically grouping semantically similar rules into the same rule group based on the similarity between the vectors. Semantic similarity means that although two or more compliance rules differ in their textual expression, they point to the same or highly similar management intent and risk nature. Through semantic clustering, thousands of originally scattered compliance rules are aggregated into several independent rule clusters (i.e., rule groups) with consistent internal semantics. Each rule cluster represents a set of rules with common risk characteristics. The semantic clustering can employ one or a combination of the following algorithms: K-means clustering algorithm, hierarchical clustering algorithm, density-based spatial clustering of applications with noise (DBSCAN), mean-shift clustering algorithm, spectral clustering algorithm, or Gaussian Mixture Model (GMM). Before clustering, compliance rules need to be converted into semantic vectors. A pre-trained language model can be used to encode each compliance rule into a vector representation of fixed dimensions.

[0054] Semantic induction refers to extracting the common risk themes of all rules within a rule group obtained through semantic clustering, forming a highly generalized description of the rules in that group, and establishing this generalized description as a financial compliance risk label. Semantic induction achieves a hierarchical elevation from specific rules to abstract labels. Optionally, the semantic induction can be automatically implemented using a summary generation method based on a generative language model.

[0055] Through semantic clustering and semantic induction, multiple financial compliance risk labels were obtained. Based on these labels, a labeling system was constructed, providing a classification basis for subsequent risk assessment. This system includes these multiple financial compliance risk labels.

[0056] In the above 103, after constructing the label system through semantic clustering and semantic induction, it is necessary to establish the association between each financial compliance risk label and the supporting information and risk reference examples.

[0057] The aforementioned basis information refers to the source information used to summarize the financial compliance risk label, including legal and regulatory provisions, industry self-regulatory rules, and internal system clauses. Specifically, in the rule extraction stage, each financial compliance rule is labeled with its source information; in the semantic clustering stage, multiple compliance rules are grouped into the same candidate rule group due to semantic similarity, and are ultimately summarized into a financial compliance risk label. Therefore, the source information of all compliance rules within the candidate rule group, after deduplication and aggregation, constitutes the basis information corresponding to the label, establishing the first association between the label and the basis information corresponding to the label.

[0058] The risk reference examples include administrative penalty cases, audit issues, and historical work orders and risk events. Specifically, for each risk reference example, its associated financial compliance risk label is determined through text semantic matching or compliance expert review, and a second association relationship is established between the label and the risk reference example.

[0059] Alternatively, the first and second associations can be recorded using a mapping dictionary.

[0060] Optionally, the first and second associations are stored in the database as key-value pairs, where the key is a unique identifier for the financial compliance risk label, and the value is the basis information and risk reference example corresponding to the label.

[0061] Through this association, when any financial compliance risk label is triggered, the database is queried, and the associated supporting information and risk reference examples are output simultaneously. On one hand, the supporting information serves as the reason for the judgment, explaining to the user the legal and regulatory provisions, industry self-regulatory rules, and internal system clauses upon which the label was triggered. On the other hand, the risk reference examples serve as explanatory evidence, providing the user with reference to the penalties for similar violations, records of potential risks discovered in historical audits, and the factual basis for this trigger. Thus, this association ensures that the triggering results of risk labels possess complete interpretability and audit traceability.

[0062] In section 104 above, training the generative security model and the streaming security model based on the label system means using the financial compliance risk labels in the label system as supervision signals to conduct supervised training on the generative security model and the streaming security model respectively, so that the two models can learn to obtain the ability to map the input text to the corresponding risk labels.

[0063] In some embodiments, the generative security model includes a language model, and the streaming security model includes a language model.

[0064] Training samples can be constructed based on the aforementioned tagging system, including user query samples and model response samples. These training samples can then be used to train generative security models and streaming security models.

[0065] For example, a generative security model is used for sample-level detection of the complete input or complete output, and it can output the following: 1. Safety Status: Safe / Unsafe; 2. Risk Category; 3. Explanation of risks; 4. Intervention recommendations.

[0066] Among them, the generative security model can handle: single-turn user questions, multi-turn dialogue contexts, complete response data of financial models, tool call information of financial models, tool call results, and context combinations containing tool call information and tool call results of financial models.

[0067] For example, the streaming security model outputs the following items each time one or more new tokens are received: 1. Safety Status: Safe / Unsafe; 2. Risk Category; 3. Explanation of risks; 4. Intervention recommendations; 5. Risk confidence level.

[0068] Both generative and streaming security models can calculate a risk score for the object to be detected. When the risk score is higher than a threshold, the object is determined to be unsafe, and the corresponding risk category is identified. The threshold value can be set based on practical experience, and this specification does not impose specific limitations on it in the embodiments.

[0069] In the above 105, the trained generative security model and streaming security model are loaded into the online inference environment and connected to the input and output sides of the financial model for real-time risk detection of the interaction process of the financial model.

[0070] Specifically, the generative security model is deployed on the input side of the financial model to receive user queries from the financial model. Before the financial model generates a response to the first user query, it performs risk detection. If the first user query triggers any risk label, it performs corresponding intervention processing such as interception, rewriting, or alarm, thereby achieving pre-emptive protection.

[0071] The streaming security model is deployed on the output side of the financial model to receive incremental response fragments generated by the financial model during the streaming response process. During the response generation process, the incremental fragments are subjected to real-time risk detection. If the incremental fragment triggers any risk label, intervention processing such as interception, rewriting or termination of the response is performed to achieve output-side protection.

[0072] By coordinating the deployment of generative and streaming security models, full-process risk coverage of the input and output sides of the financial model can be achieved. This enables both pre-interception of user queries before response generation and real-time detection and intervention of output content during response generation.

[0073] The technical solutions provided in the embodiments of this specification extract financial compliance rules from financial management documents and construct a risk labeling system, enabling security detection to move from general risk identification to fine-grained compliance judgment in financial scenarios. Furthermore, by establishing a correlation between labels and financial compliance rules and risk reference examples, the system simultaneously outputs judgment criteria and explanatory evidence when a risk is triggered, effectively enhancing the interpretability and audit traceability of risk detection. By training and deploying generative and streaming security models respectively, the system can perform pre-emptive risk identification for user queries and real-time risk detection on incremental response fragments during streaming responses. This achieves risk coverage of the entire financial model interaction process, avoiding the delays caused by reviewing complete response text in traditional solutions and enabling intervention on already output content during streaming generation, significantly improving the security protection accuracy and response timeliness in financial model application scenarios.

[0074] In some embodiments, the step 102 above, "performing semantic clustering and semantic induction of the plurality of financial compliance rules to construct a label system," can be achieved by the following steps: 1021. Perform semantic vectorization processing on the aforementioned multiple financial compliance rules.

[0075] 1022. Cluster the multiple financial compliance rules based on semantic similarity to obtain multiple rule groups.

[0076] 1023. For each rule group, use a pre-trained language model to summarize the common risk themes of the financial compliance rules within the group, which will serve as the financial compliance risk labels for that rule group.

[0077] In step 1021 above, a pre-trained language model can be used to convert each compliance rule into a fixed-dimensional numerical vector, enabling it to participate in subsequent mathematical calculations and cluster analysis. Since compliance rules are expressed in natural language, computers cannot directly understand their semantics; therefore, semantic vectorization is needed to map them to a high-dimensional semantic space. In this high-dimensional semantic space, texts with similar semantics have similar vector distances, while texts with dissimilar semantics have dissimilar vector distances. Specifically, each compliance rule is input into the pre-trained language model, and after model encoding, the corresponding vector representation of the rule is output.

[0078] Optionally, the pre-trained language model can employ the Sentence-BERT model or other pre-trained language models suitable for sentence-level semantic encoding, encoding each compliance rule into a semantic vector of fixed dimensions (such as 768 or 1024 dimensions). Through semantic vectorization, the compliance rules are transformed from textual form to numerical form, providing input for subsequent clustering analysis.

[0079] In the above 1022, the semantically vectorized compliance rules are automatically categorized according to their semantic similarity, so that semantically similar rules are grouped into the same rule group, and semantically dissimilar rules are grouped into different rule groups. Specifically, using the semantic vectors of each compliance rule as input, a clustering algorithm is used to calculate the similarity between vectors (such as cosine similarity or Euclidean distance), and rules with similarity exceeding a preset threshold are grouped into the same rule group. The compliance rules within each rule group are highly similar semantically, representing the same type or theme of risk-related matters. Through semantic clustering, the originally scattered thousands of compliance rules are aggregated into several independent rule groups, each rule group representing a set of rules with common risk characteristics. Optionally, the clustering algorithm mentioned above can be used for clustering. The preset threshold can be adjusted according to the actual application scenario and clustering effect.

[0080] In the above 1023, all compliance rule texts within each rule group can be concatenated and input into a pre-trained language model, with corresponding prompts set to instruct the model to extract the common risk themes of each rule group. The model then outputs a generalized risk theme description. Optionally, task instructions (such as "Please extract the common risk themes of the following rules") can be set to drive the model to generate inductive results.

[0081] Optionally, the common risk topics generated by the pre-trained language model can also be reviewed and confirmed by compliance experts to ensure the accuracy and professionalism of the labels.

[0082] In this embodiment, through the three steps of semantic vectorization, semantic clustering, and risk theme summarization, multiple financial compliance rules are abstracted from bottom to top into a financial compliance risk label system, realizing the hierarchical transformation from specific rules to abstract labels, and providing a classification basis for subsequent risk assessment.

[0083] In some embodiments, to achieve the ability to identify common risks, common risk labels can also be added to the aforementioned labeling system. Specifically, the step 102 above, "performing semantic clustering and semantic induction of the multiple financial compliance rules to construct a labeling system," can be achieved through the following steps: S11. Perform semantic clustering and semantic induction on the multiple financial compliance rules to generate financial compliance risk labels.

[0084] S12. Obtain a general risk label.

[0085] S13. Based on the financial compliance risk label and the general risk label, construct a label system.

[0086] The specific implementation of S11 can be found in the corresponding content of the above embodiments, and will not be repeated here.

[0087] In S12 above, multiple common risk labels already used in existing security protection systems can be obtained.

[0088] The general risk label refers to content risk types applicable to various fields and used to identify those with widespread harmfulness; the financial compliance risk label refers to content risk types specifically used in the financial field and used to identify content risk types that violate financial compliance rules. The general risk label typically covers content types that are generally recognized by human society and are generally prohibited by laws and regulations; its risk boundaries are relatively clear, and it has strong applicability across industries and fields.

[0089] In addition to financial compliance risk labels, the labeling system in S13 also includes general risk labels.

[0090] In this way, the generative security model and streaming security model trained based on this tagging system can simultaneously support the dual detection capabilities of general risk tags and financial compliance risk tags. That is, in addition to detecting general content security risks, it also adds the detection of financial compliance risks, thereby achieving comprehensive security protection for the model in financial scenarios.

[0091] In some embodiments, the above method may further include the following steps: 106. Check whether there are any updates to financial management documents.

[0092] 107. If an update to the financial management document is detected, extract the updated financial compliance rules based on the updated financial management document.

[0093] 108. Using a pre-trained language model, determine whether the updated financial compliance rules belong to the existing financial compliance risk labels under the labeling system.

[0094] 109. If the updated financial compliance rules do not belong to the existing financial compliance risk tags under the tag system, then the pre-trained language model is used to generate new financial compliance risk tags based on the updated financial compliance rules, and the new financial compliance risk tags are added to the tag system.

[0095] 110. Based on the updated tagging system, incrementally train the generative security model and the streaming security model.

[0096] In the aforementioned 106, the update status of financial management documents may include the addition of new financial management documents and / or revisions to existing financial management documents. Specifically, the update status of financial management documents is detected through one of the following methods: periodically accessing the official website or announcement platform of the financial management department to obtain the latest list of management documents, comparing it with the locally stored list of documents to identify newly added or revised documents; or monitoring push notifications from management document release channels to obtain update information in real time; or receiving manually imported updated documents. Through the above methods, the system can promptly detect changes in financial management documents, providing triggering conditions for subsequent rule updates.

[0097] In step 107 above, if an update to a financial management document is detected, updated financial compliance rules are extracted based on the updated document. These updated rules include newly added and / or revised financial compliance rules. Specifically, for newly added financial management documents, the same rule extraction method as in step 101 is used to extract the new financial compliance rules using a pre-trained language model. For existing financial management documents that have been revised, the revised content is compared with the original content to identify the changed clauses, and revised financial compliance rules are extracted for the changed portions. Optionally, a text difference tool can be used to help identify the differences before and after the revision, and then the pre-trained language model can extract rules from the differences to improve update efficiency.

[0098] In the aforementioned 108, the updated financial compliance rules can be semantically vectorized, and their semantic similarity to the rule groups corresponding to each existing financial compliance risk label under the labeling system can be calculated. If the maximum semantic similarity exceeds a preset threshold, the updated rule is determined to belong to the existing label with the highest similarity; if the maximum semantic similarity does not exceed the preset threshold, the updated rule is determined not to belong to any existing label. Through this attribution determination, it is determined whether each updated compliance rule should be classified into the existing labeling system or whether a new label needs to be created.

[0099] In the above 109, when one or more updated compliance rules do not belong to any existing label, the one or more updated compliance rules are treated as an incremental rule group. A generative pre-trained language model is used to extract the common risk theme of the incremental rule group, generate a general risk category description, establish the description as a new financial compliance risk label, and store the new financial compliance risk label in the label system.

[0100] Optionally, an association is established between the new financial compliance risk label and the corresponding information used to summarize the financial compliance risk label, as well as the risk reference examples corresponding to the financial compliance risk label.

[0101] Optionally, the generated new labels can be reviewed and confirmed by compliance experts before being formally added to the label system to ensure the accuracy and compliance of the new labels.

[0102] In the above 110, new training samples can be constructed for the new financial compliance risk labels, and incremental training can be performed on the generative security model and the streaming security model based on the new training samples.

[0103] After training is completed, the updated generative security model and streaming security model are redeployed to replace the original version of the model, so as to achieve synchronous updates of security protection capabilities and management requirements.

[0104] In this embodiment, through the incremental update mechanism, the tagging system and security model can continuously evolve with changes in financial management documents, maintaining real-time coverage of the latest management compliance requirements.

[0105] In some embodiments, the above method may further include the following steps: 111. If the updated financial compliance rules belong to the existing financial compliance risk labels under the labeling system, then new training samples are generated for the existing financial compliance risk labels based on the updated financial compliance rules.

[0106] 112. Based on the new training samples, the generative security model and the streaming security model are incrementally trained.

[0107] In the above 111, if the updated financial compliance rule belongs to the existing financial compliance risk label under the label system, then there is no need to add a new label. It is only necessary to generate training samples that can cover the updated financial compliance rule for the existing financial compliance risk label.

[0108] In step 112 above, the generative security model and the streaming security model are incrementally trained based on the new training samples.

[0109] In this solution, when an updated compliance rule falls under an existing label, although a new risk label does not need to be created for that rule, the quantitative standards or enforcement requirements of that rule are new. To enable generative and streaming security models to accurately identify violations based on the updated rules, training samples corresponding to the existing label must be generated based on the updated compliance rule, and the model must be incrementally trained to keep the model's judgment boundaries synchronized with the latest management requirements. If the training samples are not updated synchronously, the model will be unable to learn the textual features of the updated rule, and its ability to identify compliance risks belonging to that label will remain at the old version level, leading to missed or false judgments.

[0110] In some embodiments, the above method may further include: 113. Check for any new financial risk issues that may arise.

[0111] 114. If a new financial risk topic emerges, a pre-trained language model is used to determine the first financial compliance risk label to which the new financial risk topic belongs under the labeling system. Based on the new financial risk topic, new training samples are generated for the first financial compliance risk label.

[0112] In the above 113, current financial risk topics can be collected through various information channels, and the collected financial risk topics can be compared with existing historical financial risk topics to determine whether new financial risk topics have emerged.

[0113] In step 114 above, the text description of the new financial risk topic is semantically vectorized to obtain the semantic vector of the topic; the semantic center vector of the rule group corresponding to each existing financial compliance risk label in the label system is used as the semantic representation of the label; the semantic similarity between the semantic vector of the new financial risk topic and the semantic center vector of each existing label is calculated respectively, and the existing label with the highest semantic similarity and exceeding the preset threshold is determined as the first financial compliance risk label to which the new financial risk topic belongs.

[0114] Using a language model, new training samples are generated for the first financial compliance risk label based on the new financial risk topic. The text description of the new financial risk topic and the first financial compliance risk label can be input into the language model to obtain the training samples output by the language model. These new training samples are used for subsequent incremental training of the generative security model and the streaming security model. Incremental training can be implemented using SFT (Supervised Fine-Tuning) or RL (Reinforcement Learning).

[0115] In this way, when a new financial risk topic emerges, the risk characteristics described by the new topic are used as new training samples for existing labels. This enables generative and streaming security models to gain the ability to identify the new topic through incremental learning, thereby achieving rapid coverage of new risk topics by the security model within the framework of the existing labeling system.

[0116] After incremental training is complete, the old and new models can be replaced through processes such as regression testing and canary release. Furthermore, old model versions can be archived and audited. This mechanism allows the system to continuously adapt to new management requirements, rather than requiring large-scale retraining from scratch each time.

[0117] For example, an update can be triggered when the following conditions occur: 1. New management documents were issued; 2. New penalty cases establish a stable management approach; 3. Revision of internal regulations; 4. New risk topics are emerging.

[0118] This solution is suitable for high-frequency, changing scenarios in financial management.

[0119] In some embodiments, the above method may further include: 115. After the financial model completes the streaming response to the first user's query, the first user's query and the financial model's response data to the first user's query are used as interactive data to be verified, and the generative security model is used to perform risk detection on the interactive data to be verified.

[0120] 116. If the interactive data to be verified is risky, a risk warning will be output to the user.

[0121] In step 115 above, after the streaming response is completed, the complete response data generated by the first user query and the financial model for that query are both determined. The first user query and the response data are combined into a single piece of interaction data to be verified, which is then input into the generative security model. The generative security model performs a comprehensive risk detection on the interaction data to be verified, determines whether any content triggers any financial compliance risk label, and outputs the corresponding risk label and the basis for the determination.

[0122] It should be noted that the post-event risk verification here complements the real-time detection during the response process of the aforementioned streaming security model. The streaming security model is used for immediate interception during the response generation process, aiming to detect and intervene in risks as early as possible; while the post-event risk verification is executed after the complete response is generated, serving as a final confirmation and supplementary detection of the output complete response. Post-event risk verification can detect risks that may be missed in streaming detection, as well as risks that can only be discovered in the complete context (for example, the combination of user query and response data may not be risky individually, but it presents violation characteristics when the two constitute a complete interaction context). Optionally, the post-event risk verification can be executed asynchronously after the streaming response is completed, so as not to affect the user's interactive experience.

[0123] In step 116 above, after the generative security model performs risk detection on the interaction data to be verified, if the detection result shows that the first user query and the response data contain content that triggers a financial compliance risk label, the system outputs a risk warning to the user. The risk warning is used to inform the user that the current query or response content has compliance risks, prompting the user to pay attention to verification, and suggesting that the user refer to official channels to obtain accurate information.

[0124] Optionally, the risk warning content shall include at least one of the following: (1) a risk category description, i.e., the name and brief description of one or more financial compliance risk tags triggered; (2) a risk cause description, i.e., the basis for determining the risk, including the corresponding compliance rules or legal provisions; (3) a risk reference example, i.e., management penalty cases or historical issues discovered by internal audits related to the risk category; (4) suggested follow-up actions, such as advising users to consult professional compliance personnel, review official documents, or resubmit compliance inquiries. Optionally, the risk warning shall be presented to the user in a prominent manner (e.g., displayed as a highlighted box at the top of the response page) to ensure that the user can notice the risk information in a timely manner. Optionally, the risk warning may also be pushed to compliance review personnel for manual review and subsequent processing.

[0125] In the embodiments described in this specification, the post-event risk verification and risk warning steps can overcome the limitation of streaming detection, which can only make judgments based on local segments, and significantly improve the comprehensiveness and reliability of risk detection in financial model interaction scenarios. At the same time, by outputting risk warnings to users that include risk categories, judgment criteria and subsequent suggestions, the transparency and interpretability of the system are enhanced, and users are helped to understand the source of risk and improve their risk prevention awareness.

[0126] In some embodiments, the step 104 above, "training a generative security model based on the labeling system," can be achieved by the following steps: 1041a. For each financial compliance risk label in the labeling system, based on the financial compliance risk label and its associated supporting information and risk reference examples, a pre-trained language model is used to generate positive user query samples.

[0127] 1042a. Perform adversarial data augmentation on the positive user query samples to obtain enhanced positive user query samples.

[0128] 1043a. The generative security model is trained based on the financial compliance risk label, the positive user query samples, and the enhanced positive user query samples.

[0129] In section 1041a above, for each financial compliance risk label in the labeling system, a positive user query sample is generated using a pre-trained language model based on the financial compliance risk label and its associated supporting information and risk reference examples. The positive user query sample refers to a user query text that simulates a user's potential risk-prone query text that might trigger the financial compliance risk label.

[0130] Specifically, for each financial compliance risk label, the relevant supporting information and risk reference examples are obtained as the basis for generation. A pre-trained language model is then used to generate positive user query samples corresponding to that label. The generation process drives the pre-trained language model to generate text by setting appropriate prompts. For example, for the label "Credit Fraud and Financing Violations," the following prompt can be input into the pre-trained language model: "Based on the following supporting information and corresponding penalty cases used to summarize the 'Credit Fraud and Financing Violations' label, generate 10 user query questions that may trigger credit fraud risks." The model then outputs multiple simulated user query texts, and these positive user query samples are used for subsequent model training.

[0131] In 1042a above, adversarial data augmentation refers to rewriting and generating variants of the original positive samples through various text transformation methods without changing the core risk semantics of the query text, in order to simulate the diverse and covert risk questioning methods that users may use in real scenarios. Through adversarial data augmentation, the training samples can cover a wider range of risk expression variants, effectively improving the robustness and generalization ability of the model.

[0132] The adversarial data augmentation process includes, but is not limited to, the following methods: (1) Colloquial rewriting: rewriting the standard written query into everyday colloquial expressions; (2) Terminology replacement: Replace the key terms in the original query with synonyms or near-synonyms; (3) Slang expression: using non-standard industry slang in financial scenarios for expression; (4) Multi-round guidance: Break down a single query into a multi-round dialogue format, and gradually approach the core of the risk through progressive questioning; (5) Role-playing: Assigning questions to specific roles; (6) Long context noise wrapping: embed the risk query into a large amount of irrelevant context information to interfere with the model’s attention mechanism and test the model’s risk identification ability in noisy environments; (7) Progressive questioning from legal to illegal: First, ask a legal and seemingly normal inquiry question. After the model gives a normal response, gradually introduce illegal intentions in subsequent dialogues to simulate the user’s covert behavior of trying to bypass security detection.

[0133] By combining one or more of the above methods, each original positive user query sample is expanded and variants are generated to obtain enhanced positive user query samples.

[0134] In practical applications, language models can be used to achieve adversarial data augmentation.

[0135] In the above 1043a, the positive user query samples and the enhanced positive user query samples are used as training data to construct a training dataset; each positive user query sample in the training dataset is input into the generative security model, the loss between the model prediction result and the real label is calculated, the model parameters are updated through the backpropagation algorithm until the model converges, and the trained generative security model is obtained.

[0136] Optionally, a certain proportion of normal user queries that do not contain any risky content can be added to the training data as negative samples to train the model's ability to distinguish normal queries and reduce the false positive rate. Positive samples are training samples that the model should predict as risky and should trigger the corresponding risk label; negative samples are training samples that the model should predict as risk-free and should not trigger any risk label.

[0137] The positive user query samples constructed in steps 1041a and 1042a can be used to synthesize control samples with similar surface structures but compliant intents, which can then serve as negative user query samples. This prevents the model from simply remembering keywords while ignoring the true semantics. Specifically, the corresponding negative user query samples can be obtained by modifying the positive user query samples constructed in steps 1041a and 1042a.

[0138] The embodiments in this specification enable generative security models to learn diverse and covert risk query expressions, effectively improving the model's ability to identify and robust against various risk questions posed by users in real financial scenarios. In some embodiments, the above method may further include the following steps: A. Initialize the prefix to be detected based on the starting word in the model response sample.

[0139] B. Perform risk detection on the prefix to be detected to obtain the first risk detection result.

[0140] C. Based on the prefix to be detected, multiple subsequent response sequences are generated through multiple samplings, and risk detection is performed on the multiple subsequent response sequences to obtain a second risk detection result.

[0141] D. Based on the combined results of the first and second risk detections, determine whether the prefix to be detected poses a risk.

[0142] E. When the prefix to be detected is risky, the last word in the prefix to be detected is determined as the risk boundary word.

[0143] F. When the prefix to be detected has no risk, add the next word in the model response sample that is immediately adjacent to the prefix to be detected to the end of the prefix to be detected to update the prefix to be detected, and return to the step of performing risk detection on the prefix to be detected to obtain the first risk detection result, until a risk boundary word is found or until the prefix to be detected covers all words in the model response sample.

[0144] In step A above, a model response sample generated by the pre-trained language model in response to the constructed second user query can be obtained. This sample consists of a series of token sequences T={t1,t2,...,t...} arranged in the generation order. n The sequence is composed of}. The prefix to be detected, P, is initialized. Initially, P contains the first word t1 in the sequence (i.e., P = {t1}). This prefix to be detected, P, represents the text segment that has been output from the start time to the current time during the streaming generation process.

[0145] In step B above, the current prefix P to be detected is input into a discriminative model with strong semantic understanding capabilities (e.g., a large language model fine-tuned by instructions or a dedicated classifier) ​​to perform compliance judgment on the current semantic state. This judgment process aims to determine whether, based solely on the currently generated text content P, it has already substantially constituted a violation of financial compliance rules (e.g., whether there is an explicit statement promising illegal returns). The discriminative model outputs a binary judgment result or confidence score as the first risk detection result. If the first risk detection result indicates "violation," it means that the current prefix itself already contains definite illegal semantics; if it indicates "safe," it means that the current prefix has not yet constituted a substantial violation in a literal sense, but further judgment is needed based on subsequent generation trends.

[0146] In step C above, to predict the future risk evolution trend of the current prefix P, P is used as the context seed, and the pre-trained language model is called to perform multiple autoregressive sampling (Rollout). For example, the number of samplings N=5 is set to generate N complete subsequent candidate response sequences {S1,S2,...,S...}. N Subsequently, a rapid risk scan (such as keyword matching or lightweight classification) is performed on each of the N subsequent candidate response sequences, and the number M sequences containing illegal content is counted. The risk probability value Prob = M / N is calculated and compared with a preset threshold to obtain a second risk detection result. If Prob is higher than the threshold, the second risk detection result indicates a "high-risk evolution trend"; otherwise, it indicates a "low-risk evolution trend". This step solves the potential lag problem of a single current semantic judgment, and can proactively capture hidden risks that currently appear normal but are highly likely to lead to illegal output.

[0147] In step D above, a joint verification strategy is used to make a final determination of the risk status of prefix P. In one embodiment of this invention, the determination logic is as follows: If the first risk detection result indicates "violation" and the second risk detection result indicates "high-risk evolution trend" (i.e., Prob>Threshold), this means that the current discourse has violated the rules and its context strongly leads to a violation, then the prefix P to be detected is determined to be risky. Otherwise, the prefix P to be detected is determined to be risk-free.

[0148] This dual verification mechanism of "current facts + future probabilities" can avoid errors in identifying risk boundary words.

[0149] In step E above, once step D determines that the current prefix P to be detected is risky, the iteration loop terminates immediately. At this time, the last word t constituting the current prefix P to be detected... k The newly added morpheme (i.e., the one that was added last) is marked as the risk boundary morpheme. This morpheme marks the critical point from a "safe state" to a "risk state".

[0150] The aforementioned discrimination model performs risk detection based on the labeling system for the prefix P to be detected. The risk label output by the discrimination model for P can include a financial compliance risk label or a general risk label. In subsequent model training annotations, this word and all subsequent words will be labeled with the corresponding risk label, while all words preceding this word will be labeled with a safety label.

[0151] In step F above, if step D determines that the current prefix PP to be detected has no risk, it means that further exploration is needed. The next word t immediately adjacent to the current prefix P is read from the model response sample T. k+1 This is appended to the end of P to form a new prefix to be detected, P′=P∪{t}. k+1 The process then returns to step B, where the first risk detection, second risk detection, and comprehensive judgment are re-executed on the updated prefix P′. This loop continues until the first term that triggers a risk judgment is found (step E is executed), or the entire response sequence is traversed (if there is no risk throughout, the entire sequence is marked as safe).

[0152] Through the automated annotation process of AF described above, this solution can efficiently and accurately transform coarse-grained sample-level labels into fine-grained token-level boundary labels, providing high-quality supervision signals for streaming security models and enabling them to learn to accurately identify risk initiation points during the dynamic process of streaming generation.

[0153] In some embodiments, the step 104 above, "training a streaming security model based on the tagging system," can be implemented using the following steps: 1041b. Construct the second user query.

[0154] 1042b. Obtain the response data of the pre-trained language model to the second user's query, and use the response data as the model response sample.

[0155] 1043b. Based on the labeling system, determine the risk boundary words in the model response samples and the risk labels to which the risk boundary words belong.

[0156] 1044b. Label the word in the model response sample that is before the risk boundary word as safe, and label the risk boundary word and the word in the model response sample that is after the risk boundary word as the risk label.

[0157] 1045b. Based on the labeled model response samples, train the streaming security model.

[0158] In 1041b above, a second user query can be constructed based on the positive user query samples and enhanced positive user query samples constructed in the above embodiments. Specifically, the positive user query samples can be used as the second user query, or the enhanced positive user query samples can be used as the second user query.

[0159] In 1042b above, the second user query can be input into the pre-trained language model to obtain the response data of the pre-trained language model to the second user query, and the response data can be used as the model response sample.

[0160] In practical applications, various pre-trained language models can be used to process the response data of the second user's query. For example, some pre-trained language models have security auditing mechanisms, some do not, some are based on thought chains, and some are not, etc.

[0161] This improves the model's robustness to different model styles, response lengths, and inference depths.

[0162] Alternatively, multiple language models can be used as labelers to output a safety / independence label and a risk category label for each model response sample. Then, the final sample-level training labels are obtained through voting or aggregation, and / or combined with manual sampling and calibration. The model response samples and their sample-level training labels can be used to train a generative security model.

[0163] In 1043b above, the model response sample refers to the model output text containing illegal content. The risk boundary term refers to the term position in the terminology sequence of the model response sample where the illegal semantics first appear.

[0164] In streaming response scenarios, the model's output is generated word by word. Therefore, it is necessary to determine at which word position the violation begins so that the streaming security model can identify and intervene before the violation is fully output.

[0165] In section 1044b above, the lexical units in the model response sample preceding the risk boundary lexical unit are labeled as safe (i.e., no-risk label); the risk boundary lexical unit and the lexical units in the model response sample following the risk boundary lexical unit are labeled as risk labels. For example, suppose the lexical sequence of an unsafe response sample is t1, t2, t3, t4, t5, t6. If t4 is determined to be a risk boundary lexical unit based on the aforementioned risk boundary judgment, then t1, t2, t3 are labeled as "safe," and t4, t5, t6 are labeled as the triggered risk labels.

[0166] In the aforementioned 1045b, each term in the annotated model response samples is labeled as "safe" or its corresponding financial compliance risk label, forming a term-level label sequence. The annotated model response samples are used as training data. The prefix of each term (including the term itself and the sequence of terms preceding it in the model response sample) is used as input, and the annotated label of that term is used as a supervision signal to perform supervised training on the streaming security model. During training, for a given model response sample, the prefix of each term is determined and input into the streaming security model. The streaming security model outputs a risk classification prediction for each term. The loss between the prediction result and the annotated label of that term is calculated, and the model parameters are updated using a backpropagation algorithm, enabling the streaming security model to learn the ability to determine risk in real time based on the currently generated incremental fragments.

[0167] In this scheme, after training, the streaming security model can receive all the currently generated incremental fragments when detecting the streaming response of the financial model, and output in real time whether the incremental fragment triggers a risk and the corresponding risk label. This allows for immediate intervention such as interception, rewriting, or termination of the response when risk boundary words appear, thereby achieving early warning and real-time intervention of risk content in the streaming response process and effectively improving the timeliness of risk response.

[0168] In some embodiments, the above method may further include: 117. During the process of the financial model outputting a streaming response to the first user query, the current output prefix is ​​input to the streaming security model according to a preset detection frequency to perform risk detection on the newly added incremental response fragment. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the first user query to the current time, and the response sequence includes the newly added incremental response fragment.

[0169] 118. When the newly added incremental response fragment passes the risk detection, the newly added incremental response fragment is provided to the user terminal.

[0170] 119. When the newly added incremental response fragment fails the risk detection, the corresponding intervention process shall be performed.

[0171] In section 117 above, the streaming response refers to the process by which the financial model generates and returns response content to the user incrementally, word by word or sentence by sentence. The current output prefix refers to the sequence of responses output by the financial model from the start time of the output to the first user query to the current time, and this response sequence includes the newly added incremental response fragment. That is, the current output prefix at each detection time is a complete sequence formed by concatenating the output prefix from the previous detection time with the newly generated incremental response fragment.

[0172] The preset detection frequency is used to control the granularity of risk detection. It can be preset by the system according to actual application scenarios, including but not limited to the following methods: performing a detection whenever the financial model generates a preset number (e.g., 1, 5, or 10) lexical units; performing a detection whenever the financial model generates a complete sentence; or performing a detection at preset time intervals (e.g., every 100 milliseconds). During each detection, the current output prefix is ​​input to the streaming security model, which performs a risk assessment on the current output prefix based on the tag system, determining whether it contains content that triggers any financial compliance risk tag, and outputs the corresponding risk tag.

[0173] In step 118 above, if the streaming security model detects that the current output prefix does not trigger any risk label, i.e., determines that the newly added incremental response segment is safe, then the incremental response segment is output normally to the user terminal, allowing the user to receive the response content of the financial model in real time. At this time, the streaming response continues normally, and the financial model continues to generate the next incremental segment until the entire response is completed or interrupted by the intervention processing at the next detection moment.

[0174] In step 119 above, if the streaming security model detects that the current output prefix triggers one or more financial compliance risk labels, i.e., determines that the newly added incremental response fragment has a compliance risk, then a preset intervention processing operation is executed. The intervention processing includes one or more combinations of the following methods: (1) Interrupt output: Immediately terminate the streaming response process of the financial model, and stop outputting the current incremental response fragment and all subsequent ungenerated response content to prevent further output of risk content; (2) Generate response information based on the rejection template: Replace the current incremental response fragment with a preset security rejection template and output it. The rejection template is used to indicate to the user that the current request cannot be processed. (3) Compliance reminder: Insert or add compliance risk reminder information in the current incremental response segment, for example, it can be expressed as "Please note that the above content is for reference only, and the specific handling shall be subject to the management regulations" to remind users to pay attention to the identification; (4) Transfer to manual review: Transfer the current user query and the generated response content to the manual review queue, where compliance reviewers will conduct manual review and subsequent processing.

[0175] Optionally, the intervention method can be configured differently based on the type and severity of the triggered financial compliance risk label. For example, for serious violations (such as those involving fraud), the output can be interrupted; for minor risks (such as insufficiently precise wording), a compliance reminder can be added. The differentiated configuration can be preset by the system or dynamically adjusted by compliance management personnel.

[0176] Through the aforementioned real-time risk detection and intervention, this manual achieves segment-by-segment monitoring of the output content during the streaming response process. It can trigger intervention immediately when risky boundary words appear, and intercept risky content before it is fully output to the user. This ensures the compliance of the output content and avoids the delays and resource waste that may be caused by the traditional method of reviewing the complete response. It achieves an effective balance between security protection and the timeliness of streaming response.

[0177] In some embodiments, the phrase "when the newly added incremental response fragment fails the risk detection, perform corresponding intervention processing" in step 119 above may further include: 1191. When the newly added incremental response fragment fails the risk detection, obtain the third financial compliance risk label output by the streaming security model for the newly added incremental response fragment.

[0178] 1192. Based on the aforementioned relationship, obtain the basis information and risk reference examples associated with the third financial compliance risk label as explanations, and provide the explanations to the user.

[0179] In the aforementioned 1191, when the streaming security model performs risk detection on newly added incremental response fragments, it not only outputs a judgment result on whether a risk has been triggered, but also outputs a specific financial compliance risk label that has been triggered. When the detection result is unsuccessful, it is determined that the incremental response fragment has a compliance risk. At this time, one or more financial compliance risk labels output by the streaming security model for the incremental fragment are obtained as the third financial compliance risk label. The third financial compliance risk label is used to identify the specific type of violation involved in the incremental response fragment, providing a label basis for subsequent explanation.

[0180] In step 1192 above, after obtaining the third financial compliance risk label, the relevant supporting information and risk reference examples associated with the label are retrieved from the database through the established relationship. The supporting information includes legal and regulatory provisions, industry self-regulatory rules, and internal system clauses used to summarize the label, explaining to users the normative source that triggers the risk label. The risk reference examples include administrative penalty cases, audit issues, and historical work orders and risk events, providing users with reference to the consequences of similar violations and factual evidence.

[0181] The obtained information and risk reference examples are combined into an explanatory text and output to the user. The explanatory text is used to clearly convey the following information to the user: (1) what type of financial compliance risk the incremental response fragment triggered; (2) which laws, regulations, industry rules or internal systems the risk was judged to be in violation of; and (3) what kind of penalties or internal audit findings have been made in the past for similar violations.

[0182] Optionally, the explanation is output in conjunction with the aforementioned intervention methods (such as interrupting output, replacing rejection templates, etc.): while interrupting output, the risk label and judgment basis are displayed to the user; or an explanation is attached after the rejection template to help the user understand the reason for rejection.

[0183] In the embodiments of this specification, by providing the aforementioned explanations, not only is risk detection and handling realized, but the complete basis for risk determination is also presented to the user, making the risk handling process transparent and traceable, enhancing the user's trust in the system and compliance awareness, and providing complete record materials for subsequent compliance audits.

[0184] In some embodiments, the above method may further include: 120. Use the generative security model to perform risk detection on the first user query.

[0185] 121. When the first user's query fails the risk detection, the corresponding intervention process shall be executed.

[0186] In the above 120, after receiving the first user query and before inputting the query into the financial model, the first user query is input into the generative security model. The generative security model performs risk detection on the first user query based on the tag system, determines whether the user query triggers any financial compliance risk tag, and outputs the corresponding risk tag and its associated judgment basis.

[0187] The generative security model is used to identify potential illegal intentions or risk tendencies hidden in user queries before the response is generated, so as to avoid the financial model generating illegal response content for inappropriate queries.

[0188] When the first user query passes the risk detection, the first user query is input into the financial model.

[0189] In this context, "failing risk detection" means that the first user query is determined by the generative security model to trigger one or more financial compliance risk tags. When this occurs, the first user query is intervened in instead of being input into the financial model for response generation.

[0190] The intervention includes one or more combinations of the following: (1) Block the query, that is, directly reject the user's query and do not trigger the response generation process of the financial model; (2) Reject template reply, that is, directly return the preset security rejection template to the user, which can be expressed as "Your question involves compliance risks and we cannot answer it for you at the moment. Please consult the relevant department"; (3) Transfer to manual review, that is, push the risk query to the manual review queue, and let the compliance review personnel review and process it; (4) Compliance alerts, which means returning compliance risk alerts to users, informing them of the categories of compliance risks involved in their query and their explanations.

[0191] The embodiments in this specification achieve early interception of risk input by performing pre-emptive risk detection on user queries before response generation, avoiding the generation of invalid responses, saving computing resources, and forming a dual-sided protection of input and output in conjunction with streaming detection, effectively improving the security and compliance of the entire financial model interaction process.

[0192] Figure 2 This is a flowchart illustrating the security protection method provided in the embodiments of this specification. This method is applied to a financial security intelligent agent. That is, the executing entity of this method is the financial security intelligent agent, and the generative security model and streaming security model in the above method embodiments have both been trained and deployed, serving as intelligent tools that the financial security intelligent agent can invoke. Figure 2 As shown, the method includes the following steps: 201. Obtain the first user query for the financial model.

[0193] 202. Use the generative security model to perform risk detection on the first user query.

[0194] 203. If the first user query passes the risk detection, input the first user query into the financial model.

[0195] 204. During the process of the financial model outputting a streaming response to the first user's query, a streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency to determine whether to trigger intervention. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the first user's query to the current time, including newly added incremental response segments. The streaming security model is trained based on labeled model response samples. In the labeled model response samples, the words before the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. The labeled model response samples are labeled based on the label system.

[0196] 205. If the current output prefix passes the risk detection, the newly added incremental response fragment is provided to the user terminal.

[0197] In the aforementioned 201, the financial security intelligent agent intercepts the first user query sent by the user terminal targeting the financial model.

[0198] In the above 202, after the financial security intelligent agent intercepts the first user query, it calls the generative security model to conduct a compliance review of the first user query in order to determine whether the first user query has the intention or tendency to trigger financial compliance risks.

[0199] In step 203 above, if the first user query passes the risk detection, the financial security intelligent agent inputs the first user query into the financial model so that the financial model generates a response to the first user query.

[0200] In the above 204, during the process of the financial model outputting a streaming response to the first user's query, the financial security agent calls the streaming security model to perform risk detection on the current output prefix according to a preset detection frequency.

[0201] In step 205 above, if the current output prefix passes the risk detection (i.e., the current incremental response fragment passes the risk detection), the financial security agent will provide the newly added incremental response fragment to the user terminal.

[0202] The embodiments in this specification implement pre-emptive risk detection of user queries before the financial model responds, and real-time risk detection during the streaming response of the financial model to user queries, forming dual-sided protection of input and output, which can improve the security and compliance of the entire process of financial model interaction.

[0203] In some embodiments, the above method may further include one or more of the following steps: 206. If the first user's query fails the risk detection, perform the corresponding intervention.

[0204] 207. If the current output prefix fails the risk detection (that is, the newly added incremental response fragment fails the risk detection), perform the corresponding intervention.

[0205] In the above 206, if the first user's query fails the risk detection, the query can be blocked, a reply message can be generated based on the rejection template, the request can be transferred to manual review, a compliance prompt can be issued, etc.

[0206] In the above 207, if the newly added incremental response fragment fails the risk detection, the following actions are taken: interrupt output, generate reply information based on the rejection template, provide compliance prompts, transfer to manual review, etc.

[0207] In the embodiments described in this specification, intervention is taken on the input side once a risk is detected; intervention is also taken on the output side once a risk is detected, thereby reducing the generation and presentation of illegal content.

[0208] The following is combined with Figure 3 Examples of safety protection methods are provided below: 1. User terminal 31 sends the first user query.

[0209] 2. The financial security intelligent agent 32 calls the generative security model to perform risk detection on the first user query.

[0210] 3. If the first user query passes the risk detection, the financial security intelligent agent 32 forwards the first user query to the financial model 33.

[0211] 4. Financial Model 33 outputs a streaming response for the first user's query.

[0212] 5. During the streaming response process, the financial security agent 32 calls the streaming security model to perform risk detection on the incremental response segments.

[0213] 6. If the incremental response fragment passes the risk detection, the financial security intelligent agent 32 forwards the incremental response fragment to the user terminal 31 so that the user terminal 31 can display the incremental response fragment to the user.

[0214] like Figure 3 As shown, if the first user query fails the risk detection, the financial security agent 32 discards the first user query, meaning it does not forward the first user query to the financial model 33. The financial security agent 32 can also send rejection reasons and compliance suggestions to the user terminal 31.

[0215] like Figure 3 As shown, if the incremental response fragment fails the risk detection, the financial security agent 32 discards the incremental response fragment and informs the financial model to stop generating responses. The financial security agent 32 can also send rejection reasons and compliance suggestions to the user terminal 31.

[0216] In some embodiments, the above method may further include the following steps: 208. Obtain the interface call data obtained by the financial model in response to the query of the first user.

[0217] The interface call data includes interface call information generated by the financial model for the first user's query and / or interface call results obtained by calling the corresponding interface based on the interface call information.

[0218] 209. Use the streaming security model to perform risk detection on the interface call data.

[0219] 210. If the data called by the interface fails the risk detection, perform the corresponding intervention.

[0220] After the first user inputs a query into the financial model and before the financial model outputs its streaming response to the first user's query, the financial model may generate interface call information once or multiple times for the first user's query in order to call the corresponding interface.

[0221] In practical applications, risk detection can be performed on either the API call information or the API call result, or both the API call information and the API call result can be subject to risk detection.

[0222] In some specific implementations, the interface call information generated by the financial model in response to the first user's query is obtained. A streaming security model is invoked to perform risk detection on the interface call information to determine if any risk exists. If a risk is found, the corresponding interface call is blocked, and the user is notified of the failure reason, risk warning, and other information. If no risk exists, the corresponding interface is called based on the interface call information to obtain the interface call result. When obtaining the interface call result, the streaming security model is invoked to perform risk detection on the interface call result to determine if any risk exists. If a risk is found, the financial model is blocked from continuing to generate data, and the user is notified of the failure reason, risk warning, and other information. If no risk exists, the interface call result is forwarded to the financial model so that the financial model can continue to generate response data based on the interface call result. The interface may include a database access interface, an interface provided by an external service tool, and a retrieval interface provided by an external knowledge base.

[0223] This embodiment can not only control risks on the model input and output sides, but also manage the security of knowledge retrieval, database queries, and external application programming interface calls. In addition, the financial security intelligent agent can save audit logs to facilitate subsequent audits.

[0224] The technical solutions provided in the embodiments of this specification can be applied in the following scenarios: Scenario 1: Investment Advisor's Answer After a user enters "Please recommend ***", the financial security agent first invokes a generative security model to perform a preliminary check on the complete query. Based on a tagging system, the model identifies the query as containing high-risk characteristics such as "guaranteed returns" and "illegal investment advisor inducement," thus determining it to have failed the risk detection. The system immediately blocks the forwarding of the query to the financial model, preventing the subsequent response generation process from being triggered. Instead, it directly retrieves the corresponding management basis and risk reference examples based on the aforementioned relationships, returning a compliance rejection template and explanation to the user, achieving immediate interception and compliance education at the input side.

[0225] Scenario 2: Avoidance When a user asks "How to avoid **", the generative security model captures the request in real time on the input side and matches it with financial compliance risk tags such as "illegal financial activities" and "evasion of management" through semantic analysis. Given the high sensitivity and clear violation of such risks, the system determines that the query fails the detection and immediately performs a blocking operation to prevent malicious intent from entering the financial model. Simultaneously, the system records this high-risk interaction log as audit evidence and outputs a standardized security denial response to the user, clearly indicating that the behavior violates relevant laws and regulations, thus cutting off the possibility of generating illegal suggestions at the source.

[0226] Scenario 3: Violations during the output phase In the initial streaming response phase of the financial model for routine financial advice, the content complies with compliance requirements, and the streaming security model allows the prefix fragments to pass. As generation continues, the model gradually outputs sensitive keywords such as "guaranteed returns" and "internal channels." The streaming security model performs real-time sliding window detection on newly added incremental fragments at a preset frequency (e.g., every 5 tokens). Once it identifies that the current prefix triggers the "infringement of consumer rights" or "illegal promise" label, it immediately determines that the risk boundary has been reached. The system then interrupts the subsequent generation process of the financial model, discards the cached but not yet displayed illegal tail content, and truncates or replaces the output safe parts with compliance prompts to ensure that the user only receives safe and compliant response fragments.

[0227] Scenario 4: Risks of Tool Usage When processing user requests involving account inquiries, the financial model generates instructions to call an internal database interface. The financial security agent intercepts this interface call data and inputs it as a special type of incremental fragment into the streaming security model for detection. The model identifies that the call attempts to access sensitive account information beyond the current user's privilege level, triggering the "Internal Control Failure and Unauthorized Access" flag. The system immediately blocks the interface call request to prevent unauthorized data leakage and terminates subsequent inference by the financial model based on this erroneous data. The system logs this unauthorized access attempt in the audit log and returns a standard "Insufficient permissions" message to the user, achieving fine-grained real-time control over the model's tool call behavior.

[0228] It should be noted that any steps in the methods provided in the embodiments of this specification that are not fully described in detail can be found in the corresponding content of the above embodiments, and will not be repeated here. Furthermore, the methods provided in the embodiments of this specification may include other parts or all of the steps in the above embodiments in addition to the steps described above; for details, please refer to the corresponding content of the above embodiments, and will not be repeated here.

[0229] The detailed implementation methods and beneficial effects of each step in this embodiment have been described in detail in the foregoing embodiments, and will not be elaborated here.

[0230] This specification provides an embodiment of a security protection device for financial models. The device includes: The extraction module is used to extract multiple financial compliance rules from financial management documents; A construction module is used to perform semantic clustering and semantic summarization on the multiple financial compliance rules in order to construct a tag system; The association module is used to establish an association relationship between the financial compliance risk label, the risk reference example corresponding to the financial compliance risk label, and the basis information for summarizing the financial compliance risk label for the financial compliance risk label in the label system. The association relationship is used to output the basis information and risk reference example associated with the financial compliance risk label as an explanation when the financial compliance risk label is triggered. The training module is used to train generative security models and streaming security models based on the aforementioned tagging system. The deployment module is used to deploy the generative security model and the streaming security model after training is completed. The generative security model is used to perform risk detection on the first user query of the financial model to determine whether to trigger intervention. The streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency during the streaming response of the financial model to the first user query to determine whether to trigger intervention. The current output prefix refers to the response sequence that the financial model has output from the start time of output to the first user query to the current time.

[0231] One embodiment of this specification provides a financial security intelligent agent, comprising: The acquisition module is used to acquire the first user query for the financial model. The first risk detection module is used to perform risk detection on the first user query using the generative security model, wherein the generative security model is a security model trained based on a tag system. The input module is used to input the first user query into the financial model if the first user query passes the risk detection. The streaming security model is a security model trained based on the label system. The second risk detection module is used to perform risk detection on the current output prefix using a streaming security model at a preset detection frequency during the streaming response output of the financial model to the first user query, in order to determine whether to trigger intervention. The current output prefix refers to the response sequence output by the financial model from the start time of output to the first user query to the current time, including newly added incremental response segments. The streaming security model is trained based on labeled model response samples. In the labeled model response samples, the words before the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. The labeled model response samples are labeled based on the label system. The communication module is used to provide the newly added incremental response fragment to the user terminal if the current output prefix passes the risk detection.

[0232] It should be noted that the devices provided in the above embodiments can implement the technical solutions described in the corresponding method embodiments above. The specific implementation principles can be found in the corresponding content in the above method embodiments, and will not be repeated here.

[0233] This specification also provides an electronic device according to one embodiment. For example... Figure 4 As shown, the electronic device includes a processor 82 and a memory 81. The memory 81 stores one or more computer programs (or instructions); the processor 82 is coupled to the memory 81 and is used for the at least one or more computer programs to implement the steps of the methods provided in the embodiments of this specification.

[0234] Furthermore, the electronic device also includes other components such as a communication component 83, a display 84, a power supply component 85, and an audio component 86. Only some components are shown here for illustrative purposes, and it is not intended that the electronic device contains only these components.

[0235] Accordingly, embodiments of this specification also provide a computer-readable storage medium storing a computer program, which, when executed by a computer, can implement the method steps or functions provided in the embodiments of this specification described above.

[0236] Accordingly, embodiments of this specification also provide a computer program product, including a computer program that, when executed by a processor, can implement the method steps or functions provided in the embodiments of this specification described above.

[0237] The methods in this specification can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. Therefore, this specification also provides a computer program product. This computer program product includes a computer program / instructions that, when executed by an electronic component such as a processor, can perform, in whole or in part, the steps or functions of the methods provided in the embodiments of this specification. The computer can be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, core network equipment, or other programmable device.

[0238] The aforementioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0239] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0240] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0241] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0242] Accordingly, embodiments of this specification also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile components, or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium.

[0243] Accordingly, embodiments of this specification also provide a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above-described method embodiments. It should be understood that each step or combination of steps in the above-described method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above-described method embodiments.

[0244] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0245] The above are merely embodiments of this specification and are not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A security protection method for financial models, characterized in that, include: A tagging system is constructed, which includes financial compliance risk tags obtained by semantic clustering and semantic induction of financial compliance rules, as well as general risk tags. Each financial compliance risk tag is associated with a corresponding risk reference example and the basis information used to summarize the financial compliance risk tag. Based on the aforementioned tagging system, a generative security model and a streaming security model are trained. The streaming security model is trained based on labeled model response samples. In the labeled model response samples, the words preceding the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. The risk boundary words are the first words in the model response samples that are identified as having entered a state of illegal expression. After training, the generative security model and the streaming security model are deployed. The generative security model is used to perform risk detection on the first user query of the financial model to determine whether to trigger intervention. The generative security model is configured to perform semantic analysis and feature extraction on the overall context of the first user query, perform classification and label recognition, and output a structured judgment result including risk category and intervention suggestions. The streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency during the streaming response of the financial model to the first user query to determine whether to trigger intervention. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the first user query to the current time.

2. The method according to claim 1, characterized in that, Also includes: Initialize the prefix to be detected based on the starting word in the model response sample; A first risk detection result is obtained by performing risk detection on the prefix to be detected; Based on the prefix to be detected, multiple subsequent response sequences are generated through multiple samplings, and risk detection is performed on the multiple subsequent response sequences to obtain a second risk detection result; By combining the first risk detection result and the second risk detection result, it is determined whether the prefix to be detected poses a risk; When the prefix to be detected is risky, the last word in the prefix to be detected is determined as the risk boundary word. When the prefix to be detected has no risk, the next word immediately adjacent to the prefix to be detected in the model response sample is added to the end of the prefix to be detected to update the prefix to be detected, and the process returns to the step of performing risk detection on the prefix to be detected to obtain the first risk detection result, until a risk boundary word is found or until the prefix to be detected covers all words in the model response sample.

3. The method according to claim 1, characterized in that, Constructing a tag system includes: Extract multiple financial compliance rules from financial management documents; Semantic vectorization processing is performed on multiple financial compliance rules; The multiple financial compliance rules are clustered based on semantic similarity to obtain multiple rule groups; For each rule group, a pre-trained language model is used to summarize the common risk themes of the financial compliance rules within the group, which serve as the financial compliance risk labels for that rule group.

4. The method according to any one of claims 1 to 3, characterized in that, The general risk label refers to a type of content risk that is applicable to a variety of different fields and is used to identify content risks with universal harm. The financial compliance risk label refers to a type of content risk specifically used in the financial sector to identify violations of financial compliance rules.

5. The method according to any one of claims 1 to 3, characterized in that, Also includes: Check for updates to financial management documents; If an update to financial management documents is detected, the updated financial compliance rules are extracted based on the updated financial management documents; Using a pre-trained language model, determine whether the updated financial compliance rule belongs to an existing financial compliance risk label under the labeling system; If the updated financial compliance rules do not belong to the existing financial compliance risk tags under the tag system, then the pre-trained language model is used to generate new financial compliance risk tags based on the updated financial compliance rules, and the new financial compliance risk tags are added to the tag system. Based on the updated tagging system, the generative security model and the streaming security model are incrementally trained.

6. The method according to claim 5, characterized in that, Also includes: If the updated financial compliance rules belong to the existing financial compliance risk tags under the tagging system, then new training samples are generated for the existing financial compliance risk tags based on the updated financial compliance rules. Based on the new training samples, the generative security model and the streaming security model are incrementally trained.

7. The method according to any one of claims 1 to 3, characterized in that, Also includes: To detect whether any new financial risk issues have emerged; If a new financial risk topic emerges, a pre-trained language model is used to determine the first financial compliance risk label to which the new financial risk topic belongs under the labeling system. Based on the new financial risk topic, new training samples are generated for the first financial compliance risk label.

8. The method according to any one of claims 1 to 3, characterized in that, Also includes: After the financial model completes the streaming response to the first user's query, the first user's query and the financial model's response data to the first user's query are used as interactive data to be verified, and the generative security model is used to perform risk detection on the interactive data to be verified. If the interactive data to be verified is found to be risky, a risk warning will be displayed to the user.

9. The method according to any one of claims 1 to 3, characterized in that, Based on the aforementioned tagging system, a generative security model is trained, including: For each financial compliance risk label in the aforementioned labeling system, based on the financial compliance risk label and its associated supporting information and risk reference examples, a pre-trained language model is used to generate positive user query samples. Adversarial data augmentation is performed on the positive user query samples to obtain enhanced positive user query samples; The generative security model is trained based on the financial compliance risk label, the positive user query samples, and the enhanced positive user query samples.

10. The method according to any one of claims 1 to 3, characterized in that, Based on the aforementioned tagging system, a streaming security model is trained, including: Construct a second user query; Obtain the response data of the pre-trained language model to the second user's query, and use the response data as the model response sample; Based on the labeling system, the risk boundary words in the model response samples and the risk labels to which the risk boundary words belong are determined; The word in the model response sample that precedes the risk boundary word is labeled as a safety label, and the risk boundary word and the word in the model response sample that follow the risk boundary word are labeled as risk labels. The streaming security model is trained based on the labeled model response samples.

11. The method according to any one of claims 1 to 3, characterized in that, Also includes: During the process of the financial model outputting a streaming response to the first user's query, the current output prefix is ​​input to the streaming security model for risk detection according to a preset detection frequency. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the first user's query to the current time. The response sequence includes the newly added incremental response fragment. When the current output prefix passes the risk detection, the newly added incremental response fragment is provided to the user.

12. The method according to claim 11, characterized in that, Also includes: When the current output prefix fails the risk detection, corresponding intervention is performed.

13. The method according to claim 12, characterized in that, When the newly added incremental response fragment fails the risk detection, corresponding intervention measures are implemented, including: When the newly added incremental response fragment fails the risk detection, obtain the third financial compliance risk label output by the streaming security model for the newly added incremental response fragment; Obtain the basis information and risk reference examples associated with the aforementioned third financial compliance risk label as an explanation, and provide the explanation to the user.

14. The method according to any one of claims 1 to 3, characterized in that, Also includes: The generative security model is used to perform risk detection on the first user query; If the query result of the first user fails the risk detection, the corresponding intervention will be performed.

15. A security protection method, characterized in that, The method, applied to a financial security intelligent agent, includes: Obtain the first user query for the financial model; The first user query is subjected to risk detection using a generative security model, which is a security model trained based on a tag system. If the first user query passes the risk detection, the first user query is input into the financial model; During the process of the financial model outputting a streaming response to the first user's query, a streaming security model is used to perform risk detection on the current output prefix according to a preset detection frequency to determine whether intervention is triggered. The generative security model is configured to perform semantic analysis and feature extraction on the overall context of the first user's query, perform classification and label recognition, and output a structured judgment result including risk category and intervention suggestions. The current output prefix refers to the response sequence that the financial model has output from the start time of outputting the first user's query to the current time, including newly added incremental response segments. The streaming security model is trained based on labeled model response samples. In the labeled model response samples, the words before the risk boundary words are labeled with security tags, and the risk boundary words and their subsequent words are labeled with corresponding risk tags. The labeled model response samples are labeled based on the label system. The risk boundary words are the first words in the model response samples that are identified as having entered a state of illegal expression. If the current output prefix passes the risk detection, the newly added incremental response fragment will be provided to the user.

16. The method according to claim 15, characterized in that, Also includes: If the first user's query fails the risk detection, corresponding intervention measures will be implemented; and / or If the current output prefix fails the risk detection, the corresponding intervention process will be performed.

17. The method according to claim 15, characterized in that, Also includes: Obtain the interface call data obtained by the financial model in response to the query of the first user. The interface call data includes the interface call information generated by the financial model in response to the query of the first user and / or the interface call results obtained by calling the corresponding interface based on the interface call information. The streaming security model is used to perform risk detection on the interface call data; If the data called through the interface fails the risk detection, corresponding intervention measures will be implemented.

18. An electronic device, characterized in that, include: Memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the method of any one of claims 1 to 17.

19. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a computer, it can implement the method of any one of claims 1 to 17.

20. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 17.

Images