An AI large model full-link security log auditing and tracing method

Abstract

The application discloses an AI large model full-link security log auditing and tracing method; the method comprises the following steps: implanting a probe at the forward propagation entrance and exit of the decoding layer, capturing the statistical feature vectors of the input and output hidden state tensors; calculating the difference measure value between the two vectors, triggering event-driven logging when the difference measure value exceeds the threshold, and generating a security log entry; calculating the inference step fingerprint generated by the hash operation of the four components of the semantic fingerprint, model version number, autoregressive step number and prequel fingerprint for the log entry; storing the log entry and the fingerprint in association, forming a chain causal relationship index between adjacent log entries; when an abnormal event is detected, the initial triggering event is traced back along the chain causal relationship index, and a complete causal tracing chain is formed. The application realizes full-link coverage, event-driven collection, chain causal tracing and fingerprint sequence verification, effectively eliminates the time blind area of log collection, and improves the tracing efficiency and credibility.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and log auditing technology, specifically a method for tracing and auditing the source of security logs across the entire chain of a large language model. Background Technology

[0002] With the deep application of large language models in key fields such as finance, healthcare, law, and public services, their security auditing and traceability capabilities have become a core bottleneck restricting large-scale deployment in the industry. Existing technical solutions have significant limitations in audit coverage: CN121581816A focuses on compliance auditing of the entire AI data lifecycle; CN119760702B only performs blockchain notarization on the interaction records of user queries and model responses; and while CN121644222A collects the internal state of the model, it uses a periodic sampling method with fixed time intervals, which has a time blind spot, and attack behaviors between two samplings (such as millisecond-level hint injection) may be systematically missed. In addition, existing detection rules are all predefined or based on pre-trained models, which have significant lag when facing new threats such as dynamically evolving hint injection and jailbreak attacks, and lack an adaptive update mechanism.

[0003] In terms of tracing and credibility, existing solutions also have significant shortcomings. Each solution is limited to tracing from a single dimension, such as data flow, network layer attacks, or interaction records, failing to reconstruct a complete causal chain of attacks across the model inference layer, data layer, system layer, and user layer, resulting in a fragmented tracing path. Furthermore, except for a few solutions that use blockchain for evidence storage of interaction information, most solutions do not address the tamper-proofing of the audit logs themselves, making it difficult to guarantee the credibility of the audit results. In addition, existing technologies are all statically designed, lacking the closed-loop evolutionary capability to continuously learn from historical audit results and optimize audit strategies, thus failing to form a long-term effective security protection mechanism. Therefore, there is an urgent need for an AI large-scale model security log auditing and tracing method that can achieve full-link coverage, event-driven collection, dynamic adaptive detection, causal correlation tracing, and credible verification. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method for auditing and tracing the source of security logs across the entire chain of a large language model. It achieves fine-grained state acquisition by deploying non-intrusive probes within the decoding layer, uses the difference measure of hidden state statistical features as the trigger condition for event-driven log recording, and constructs a chain-like causal relationship index between log entries by fusing inference step fingerprints with four-dimensional information, thus achieving reverse causal tracing. This systematically solves the technical problems of existing technologies in terms of fragmented audit scope, blind spots in collection time, static detection rules, incomplete tracing paths, and lack of log credibility.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for end-to-end security log auditing and tracing of large AI models, comprising the following steps: Step S1: Log collection probes are implanted at the forward propagation entry and exit points of each Transformer decoding layer of the large language model. The probes capture the first statistical feature vector of the input hidden state tensor input to the decoding layer and the second statistical feature vector of the output hidden state tensor output by the decoding layer; Step S2: The difference metric between the first statistical feature vector and the second statistical feature vector is calculated. When the difference metric exceeds a preset threshold, an event-driven log recording operation is triggered, encapsulating the current timestamp, decoding layer number, first statistical feature vector, second statistical feature vector, and semantic fingerprint of the current input text into a log. Security log entries; Step S3: Calculate the inference step fingerprint for the security log entry. The inference step fingerprint is generated by concatenating four components: the semantic fingerprint of the current input text, the current model parameter version number, the current autoregression generation step number, and the inference step fingerprint of the previous security log entry, and then performing a hash operation; Step S4: Store the security log entry and the inference step fingerprint together, so that the inference step fingerprint of each security log entry contains the information of the fingerprint of the previous security log entry, and a chain-like causal relationship index is formed between adjacent log entries; Step S5: When an abnormal event is detected, starting from the time when the abnormal event occurs, backtrack backward along the chain-like causal relationship index, sequentially obtain the previous security log entries and their inference step fingerprints, until backtracking to the initial triggering event, forming a complete causal tracing chain.

[0006] In a preferred embodiment of the present invention, in step S1, the log collection probe is non-intrusively attached to the tensor operation interface of the decoding layer. The tensor operation interface includes a forward propagation function entry point of the multi-head attention sublayer in the decoding layer, a forward propagation function exit point of the multi-head attention sublayer, a forward propagation function entry point of the feedforward network sublayer, and a forward propagation function exit point of the feedforward network sublayer. Before the multi-head attention sublayer or the feedforward network sublayer begins to perform forward propagation, the probe at the entry point reads the input hidden state tensor input to the sublayer from the tensor operation interface, and calculates the mean, variance, maximum value, minimum value, and L of the input hidden state tensor. The L2 norm is used to arrange the mean, variance, maximum value, minimum value, and L2 norm in a predetermined order to form the first statistical feature vector, and the first statistical feature vector is output to step S2. After the multi-head attention sublayer or the feedforward network sublayer completes forward propagation, the probe at the exit reads the output hidden state tensor output by the sublayer from the tensor operation interface, calculates the mean, variance, maximum value, minimum value, and L2 norm of the output hidden state tensor, arranges the mean, variance, maximum value, minimum value, and L2 norm in the predetermined order to form the second statistical feature vector, and the second statistical feature vector is output to step S2.

[0007] In a preferred embodiment of the present invention, in step S2, the difference measure is calculated as follows: the absolute value of the difference between the value of each dimension in the first statistical feature vector and the value of the corresponding dimension in the second statistical feature vector is calculated to obtain the absolute difference of each of the five dimensions; the absolute difference of each of the five dimensions is divided by half of the sum of the values ​​of the corresponding dimensions in the first statistical feature vector and the corresponding dimensions in the second statistical feature vector to obtain the relative rate of change of each of the five dimensions; the relative rates of change of each of the five dimensions are weighted and summed, and the result of the weighted summation is output as the difference measure; wherein, the weight corresponding to the relative rate of change of the L2 norm dimension is greater than the weight corresponding to the relative rates of change of the mean dimension, the variance dimension, the maximum value dimension, and the minimum value dimension.

[0008] In a preferred embodiment of the present invention, in step S2, the preset threshold includes a first threshold and a second threshold, wherein the second threshold is greater than the first threshold; when the difference metric exceeds the first threshold but does not exceed the second threshold, the security log entry is marked as a first priority, the security log entry marked with the first priority is stored in the regular storage area of ​​the log buffer, and a storage completion signal is output to step S3; when the difference metric exceeds the second threshold, the security log entry is marked as a second priority, the security log entry marked with the second priority is stored in the high-priority storage area of ​​the log buffer, and a real-time alarm signal is sent to the audit management module, and the sending time of the real-time alarm signal is output as the time of occurrence of the abnormal event to step S5; the storage priority of the second priority is higher than the storage priority of the first priority, and when the storage space of the log buffer is insufficient, the security log entries marked as first priority in the regular storage area are deleted first.

[0009] In a preferred embodiment of the present invention, in step S3, the inference step fingerprint is generated as follows: The input text corresponding to the current forward propagation is obtained; the input text is input into a semantic encoder; the semantic encoder outputs a fixed-length semantic vector; the semantic vector is binarized to obtain a fixed-length binary sequence; the binary sequence is used as the semantic fingerprint of the current input text; the semantic fingerprint is used as the first fingerprint component of the inference step fingerprint; the global version counter incremented during each parameter update of the current large language model during training or fine-tuning is obtained; this value is used as the current model parameter version number; the current model parameter version number is used as the second fingerprint component of the inference step fingerprint; the counting from the starting token during the autoregressive generation process of the current forward propagation is obtained. The step number is used as the current autoregressive generation step number, and the current autoregressive generation step number is used as the third fingerprint component of the inference step fingerprint; the inference step fingerprint calculated for the security log entry immediately preceding the current security log entry is obtained, and the inference step fingerprint of the preceding security log entry is used as the fourth fingerprint component of the inference step fingerprint; when the current security log entry is the first security log entry, the fourth fingerprint component takes a preset initial fingerprint value; the first fingerprint component, the second fingerprint component, the third fingerprint component, and the fourth fingerprint component are concatenated into a concatenated string in a predetermined order, the concatenated string is input into a hash function, the hash value output by the hash function is used as the inference step fingerprint of the current security log entry, and the inference step fingerprint is output to step S4.

[0010] In a preferred embodiment of the present invention, in step S4, the log buffer maintains an ordered linked list, and each node in the ordered linked list stores a security log entry and the inference step fingerprint corresponding to the security log entry; the arrangement order of each node in the ordered linked list is consistent with the generation time order of each security log entry, and the arranged ordered linked list is used as a log sequence; in the log sequence, the inference step fingerprint corresponding to each security log entry contains information about the inference step fingerprint corresponding to the next security log entry immediately preceding the current security log entry, and a chain-like causal relationship index is formed between adjacent log entries; in the ordered linked list, starting from any node, by reading the predecessor fingerprint information in the inference step fingerprint stored in that node, the predecessor node of that node is located, and the above location operation is repeated until the head node of the ordered linked list is located, forming a complete backtracking path from any node to the head node.

[0011] In a preferred embodiment of the present invention, the detection of the abnormal event in step S5 is achieved as follows: When a security log entry is generated in step S2, the difference metric value in the security log entry is compared with the second threshold; when the difference metric value exceeds the second threshold, an abnormal event is determined to have occurred during the current forward propagation, and the generation time of the current security log entry is taken as the occurrence time of the abnormal event, and the current security log entry is taken as the starting node corresponding to the abnormal event; the specific method of backtracking backwards along the chain-like causal relationship index is as follows: taking the security log entry corresponding to the occurrence time of the abnormal event as the starting node, the fourth fingerprint component is extracted from the inference step fingerprint stored at the starting node, and the fourth fingerprint component is taken as the preceding fingerprint information; the preceding fingerprint information is used in the log sequence... The preceding security log entry is located, and its timestamp and decoding layer number are read. This located preceding security log entry is taken as the current node. The fourth fingerprint component extracted from the inference step fingerprint stored in the current node is used as the updated preceding fingerprint information. The updated preceding fingerprint information is used to locate the previous security log entry in the log sequence. This location operation is repeated until the inference step fingerprint contained in the located security log entry is equal to the preset initial fingerprint value. The security log entry located at this time is taken as the log entry corresponding to the initial triggering event. All security log entries from the starting node to the log entry corresponding to the initial triggering event are arranged in chronological order from the initial triggering event to the abnormal event to form the complete causal tracing chain. The complete causal tracing chain is then output.

[0012] In a preferred embodiment of the present invention, after step S5 forms the complete causal tracing chain, the following steps are further included: arranging the inference step fingerprints corresponding to each security log entry in the complete causal tracing chain according to the time sequence from the initial triggering event to the abnormal event to obtain a fingerprint sequence; inputting the fingerprint sequence into a fingerprint sequence verification function, the fingerprint sequence verification function performing verification in the following manner: for the i-th fingerprint in the fingerprint sequence, checking whether the fourth fingerprint component contained in the fingerprint is equal to the complete value of the (i-1)-th fingerprint in the fingerprint sequence; when all adjacent fingerprint pairs in the fingerprint sequence pass the above check, outputting a verification pass signal; when any adjacent fingerprint pair fails the above check, outputting a verification failure signal and marking the position of the adjacent fingerprint pair that failed the check in the fingerprint sequence.

[0013] In a preferred embodiment of the present invention, the log buffer maintains a high-priority storage area and a regular storage area. The high-priority storage area stores security log entries marked with a second priority using a cyclic overwrite method. When the high-priority storage area is full and a new second-priority security log entry arrives, the earliest-generated second-priority security log entry in the high-priority storage area is overwritten, and the remaining second-priority security log entries after overwriting are used as the current storage content of the high-priority storage area. The regular storage area stores security log entries marked with a first priority using a first-in-first-out method. When the regular storage area is full and a new first-priority security log entry arrives, the earliest-generated first-priority security log entry in the regular storage area is deleted, and the remaining entries after deletion, along with the newly arrived first-priority security log entries, are used as the current storage content of the regular storage area. The capacity of the high-priority storage area is smaller than the capacity of the regular storage area.

[0014] In a preferred embodiment of the present invention, in step S1, for each Transformer decoding layer in the large language model, the following operations are performed independently: a first entry probe is implanted at the entry point of the multi-head attention sublayer of the decoding layer; a first exit probe is implanted at the exit point of the multi-head attention sublayer; a second entry probe is implanted at the entry point of the feedforward network sublayer of the decoding layer; and a second exit probe is implanted at the exit point of the feedforward network sublayer. The first entry probe and the second entry probe independently calculate the first statistical feature vector of their respective captured input hidden state tensors, and output the calculated first statistical feature vectors to step S2. The first exit probe and the second exit probe independently calculate the second statistical feature vector of their respective captured output hidden state tensors. Each of the calculated second statistical feature vectors is output to step S2; in step S2, for each Transformer decoding layer, the following difference calculation and triggering operations are performed independently: calculate the first difference metric between the first statistical feature vector output by the first entry probe of the decoding layer and the second statistical feature vector output by the first exit probe; calculate the second difference metric between the first statistical feature vector output by the second entry probe of the decoding layer and the second statistical feature vector output by the second exit probe; when either the first difference metric or the second difference metric exceeds the preset threshold, the event-driven logging operation is triggered, and the sub-layer type corresponding to the probe that triggered the logging operation is recorded in the security log entry.

[0015] Compared with the prior art, the present invention has the following beneficial effects:

[0016] This invention achieves full-coverage acquisition of the forward propagation of each sublayer during model inference by implanting non-invasive probes at the entry and exit points of the multi-head attention sublayer and feedforward network sublayer of each Transformer decoding layer. The probes are attached to the tensor operation interface so that the acquisition occurs at the lowest level of model computation, which can capture the most granular hidden state tensor changes. This fundamentally solves the problems of single audit object and fragmented coverage in the existing technology.

[0017] This invention uses the difference metric of the statistical characteristics of the hidden states of the decoding layer's input and output as the trigger condition for logging. Logging is only triggered when there is a statistically significant deviation from the internal state of the model, abandoning the fixed-time periodic sampling method and eliminating the time blind spot where attack behavior is systematically missed between two samplings. Based on this, a difference metric function based on the weighted summation of multidimensional relative change rates is constructed, and a two-level threshold and two-level priority mechanism is introduced. This enables the system to distinguish between "suspicious fluctuations" and "clear attacks" and execute differentiated responses accordingly, achieving dynamic adaptability of the detection strategy. Furthermore, by deploying independent probes and independently calculating the difference metric for the attention sublayer and feedforward sublayer of each decoding layer, the specific sublayer type where the anomaly occurs can be accurately located, providing precise diagnostic basis for subsequent security analysis.

[0018] This invention innovatively proposes an inference step fingerprint that integrates four heterogeneous dimensions: semantic fingerprint, model version number, autoregressive step number, and prior fingerprint. Causal relationships are directly encoded into the log entry identifier itself, ensuring that each log entry's fingerprint contains complete information from the previous log entry's fingerprint. The causal relationships between adjacent logs no longer rely on any external index tables or graph structures but are internalized within the fingerprint values, making the causal index robust—even if some logs are lost, the causal links between the remaining logs can still be completely reconstructed using the prior information in the fingerprints. Based on this chain-like causal index, starting from an abnormal event and traversing the fingerprint chain backwards, a complete causal chain reconstruction from the abnormal event to the initial triggering event can be completed using only the fingerprint information of the log entry itself, without relying on any pre-trained model or external knowledge base. Simultaneously, the continuity of the tracing chain can be independently verified by checking the prior inclusion relationship between adjacent fingerprints through a fingerprint sequence verification mechanism. Any log entry that is tampered with or lost will result in verification failure, thus ensuring the integrity and reliability of the tracing results.

[0019] This invention also configures two different eviction strategies for the two priority log levels: cyclic overwrite and first-in-first-out (FIFO). The high-priority storage area continuously stores the latest high-value anomaly logs with a small capacity, while the regular storage area retains as many historical records as possible with a large capacity. This achieves an optimal balance between audit accuracy and historical coverage under limited storage resources. The above-mentioned technical means do not exist in isolation, but form a significant synergistic effect through a technical closed loop of "probe collection → mutation detection → fingerprint generation → chained storage → reverse tracing → trusted verification." Each link is interconnected and progressive, jointly achieving a qualitative leap from "single-point, passive, static, and fragmented" to "full-link, proactive, dynamic, and complete," which has significant progressive significance in the field of AI large-scale model security log auditing and tracing. Attached Figure Description

[0020] Figure 1This is a schematic diagram of the overall process of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0022] like Figure 1 As shown, the present invention provides a method for proactive auditing and tracing of the full-link security logs of a large language model, including the following steps S1 to S5.

[0023] The specific implementation of step S1: Log collection probes are implanted at the forward propagation entry and exit points of each Transformer decoding layer in the large language model. A large language model typically contains a decoder structure composed of multiple stacked Transformer decoding layers. Each decoding layer contains two main components: a multi-head attention sublayer and a feedforward network sublayer. In a specific embodiment of the invention, the log collection probes are non-intrusively attached to the tensor operation interface of the decoding layer. The tensor operation interface includes the forward propagation function entry point, the forward propagation function exit point, the forward propagation function entry point, and the forward propagation function exit point of the feedforward network sublayer.

[0024] For each Transformer decoding layer in the large language model, the following probe deployment operations are performed independently: a first entry probe is implanted at the entry point of the multi-head attention sublayer of the decoding layer; a first exit probe is implanted at the exit point of the multi-head attention sublayer; a second entry probe is implanted at the entry point of the feedforward network sublayer of the decoding layer; and a second exit probe is implanted at the exit point of the feedforward network sublayer. The above probe implantation method can be implemented using the forward hook mechanism in the PyTorch framework. That is, a hook function is registered on the forward propagation function of the target sublayer. This hook function is automatically called before the sublayer begins forward propagation and after it is completed, thereby achieving non-intrusive data acquisition. The above PyTorch forward hook mechanism is a well-known technology in the art, and those skilled in the art can implement probe implantation according to the description of this invention.

[0025] Before the multi-head attention sublayer or feedforward network sublayer begins forward propagation, the entry probe reads the input hidden state tensor from the tensor manipulation interface. The input hidden state tensor is a multi-dimensional array whose dimensions include batch size, sequence length, and hidden state dimension. The entry probe calculates five statistical features of this input hidden state tensor: mean, variance, maximum, minimum, and L2 norm. The mean reflects the central tendency of the tensor values, the variance reflects the dispersion of the tensor values, the maximum and minimum values ​​reflect the extreme boundaries of the tensor values, and the L2 norm reflects the overall energy level of the tensor. These five statistical features are arranged in a predetermined order to form a five-dimensional first statistical feature vector.

[0026] After the exit probe completes forward propagation in the multi-head attention sublayer or feedforward network sublayer, it reads the output hidden state tensor from the tensor operation interface. The output hidden state tensor is the transformation result obtained by the input hidden state tensor after the attention computation or feedforward computation of this sublayer. Following the same method as the entry probe, the exit probe calculates the mean, variance, maximum value, minimum value, and L2 norm of the output hidden state tensor, and arranges these five statistical features in the same predetermined order to form a five-dimensional second statistical feature vector.

[0027] The first and second entry probes independently calculate the first statistical feature vector of their respective captured input hidden state tensors and output their calculated first statistical feature vectors to step S2. The first and second exit probes independently calculate the second statistical feature vector of their respective captured output hidden state tensors and output their calculated second statistical feature vectors to step S2. Through the above operations, step S1 provides each sub-layer (attention sub-layer and feedforward sub-layer) of each Transformer decoding layer with a pair of statistical feature vectors—the first statistical feature vector at the entry point and the second statistical feature vector at the exit point.

[0028] Specific implementation of step S2: Step S2 receives the first statistical feature vector and the second statistical feature vector output from step S1, and calculates the difference measure between them. In a specific embodiment of the present invention, the difference measure is calculated in the following manner.

[0029] First, calculate the absolute value of the difference between the value of each dimension in the first statistical feature vector and the value of the corresponding dimension in the second statistical feature vector. Since both the first and second statistical feature vectors are five-dimensional vectors, containing values ​​for the mean, variance, maximum, minimum, and L2 norm, respectively, the absolute difference for each of the five dimensions can be calculated. For example, the absolute difference for the mean dimension is obtained by subtracting the mean in the first statistical feature vector from the mean in the second statistical feature vector; similarly, the absolute differences for the variance, maximum, minimum, and L2 norm dimensions can be obtained.

[0030] Then, the absolute difference of each of the five dimensions is divided by half the sum of the corresponding dimension's value in the first statistical feature vector and the corresponding dimension's value in the second statistical feature vector, yielding the relative rate of change for each of the five dimensions. This normalization method allows statistical features of different dimensions to be compared on the same scale, avoiding bias caused by excessively large differences in the magnitude of the numerical values ​​of each dimension.

[0031] Finally, the relative rates of change for each of the five dimensions are weighted and summed, and the result is output as the difference metric. The weight corresponding to the relative rate of change of the L2 norm dimension is greater than the weights corresponding to the relative rates of change of the mean, variance, maximum, and minimum dimensions. The rationale for this weighting is that the L2 norm reflects the overall energy level of the tensor. During attacks (such as amplified activation values ​​due to injection), changes in the L2 norm are typically more sensitive and significant than changes in the mean or variance. Therefore, assigning a higher weight to the L2 norm makes the difference metric more sensitive to energy level anomalies.

[0032] In a specific embodiment of the present invention, the preset threshold includes a first threshold and a second threshold, wherein the second threshold is greater than the first threshold. The first and second thresholds are set as follows: In the initial stage of system deployment, a preset number (e.g., 10,000 times) of forward propagation difference metrics are collected during normal inference. The mean μ and standard deviation σ of these difference metrics are calculated. The first threshold is set to μ + 3σ, and the second threshold is set to μ + 6σ. The above setting method ensures that the first threshold can cover 99.7% of the normal fluctuation range, while the second threshold corresponds to extreme abnormal situations. Step S2 compares the calculated difference metrics with the first and second thresholds respectively, and executes different processing branches according to the comparison results.

[0033] For each Transformer decoding layer, the following difference calculation and triggering operations are performed independently: A first difference metric (i.e., the input-output difference of the attention sublayer) is calculated between the first statistical feature vector output by the first entry probe and the second statistical feature vector output by the first exit probe of the decoding layer; a second difference metric (i.e., the input-output difference of the feedforward sublayer) is calculated between the first statistical feature vector output by the second entry probe and the second statistical feature vector output by the second exit probe of the decoding layer. When either the first or second difference metric exceeds a preset threshold, an event-driven logging operation is triggered.

[0034] When the difference metric exceeds the first threshold but not the second threshold, it is determined that a noteworthy state fluctuation has occurred in the forward propagation of the current decoding sublayer, but the fluctuation has not yet reached the level of a clear attack. At this time, the current timestamp, decoding layer number, first statistical feature vector, second statistical feature vector, semantic fingerprint of the current input text, and the sublayer type corresponding to the probe that triggered this logging operation are encapsulated into a security log entry, and this security log entry is marked as first priority and stored in the regular storage area of ​​the log buffer. At the same time, a storage completion signal is output to step S3.

[0035] When the difference metric exceeds the second threshold, a clear security anomaly is determined to have occurred during the forward propagation of the current decoding sublayer. At this point, a security log entry is encapsulated, but marked as second priority and stored in the high-priority storage area of ​​the log buffer. Simultaneously, a real-time alarm signal is sent to the audit management module, and the sending time of the real-time alarm signal is output as the time of the anomaly occurrence to step S5. The storage priority of the second priority is higher than that of the first priority. When the storage space in the log buffer is insufficient, security log entries marked as first priority in the regular storage area are deleted first.

[0036] The specific implementation of step S3: Step S3 receives the security log entry output in step S2 and calculates the inference step fingerprint for the security log entry. The inference step fingerprint is generated by concatenating four components and performing a hash operation. The four components are: the semantic fingerprint of the current input text, the current model parameter version number, the current autoregressive generation step number, and the inference step fingerprint of the previous security log entry.

[0037] The first fingerprint component is obtained as follows: The input text corresponding to the current forward propagation is obtained, and this input text is input into a semantic encoder. In a specific embodiment of the present invention, the semantic encoder uses the Sentence-BERT model, which can map input text of arbitrary length to a fixed-length (e.g., 768-dimensional) semantic vector. This semantic vector maintains the semantic information of the input text in the semantic space—semantic vectors corresponding to semantically similar texts are close to each other in space. The fixed-length semantic vector output by the semantic encoder is binarized, that is, each value in the semantic vector is compared with a preset threshold (e.g., 0). Values ​​greater than the threshold are set to 1, and values ​​less than or equal to the threshold are set to 0, thereby obtaining a fixed-length binary sequence. This binary sequence is used as the semantic fingerprint of the current input text. It should be noted that the Sentence-BERT model is a well-known semantic coding model in the art, and those skilled in the art can use this model to extract semantic fingerprints according to the description of the present invention.

[0038] The second fingerprint component is obtained as follows: The value of the global version counter, which increments with each parameter update during the training or fine-tuning process of the current large language model, is obtained and used as the current model parameter version number. The global version counter is a monotonically increasing integer value, automatically incrementing by one whenever the model's parameters are updated (e.g., upon completion of a training iteration or a fine-tuning operation). Therefore, the current model parameter version number uniquely identifies the model's parameter state at a given moment.

[0039] The third fingerprint component is obtained as follows: The step number counted from the starting token during the autoregressive generation process in the current forward propagation is obtained, and this step number is used as the current autoregressive generation step number. The large language model generates text using an autoregressive approach, that is, it generates the output sequence token by token, and each token generation requires one forward propagation. Starting from the first token (starting token), the step number corresponding to the current forward propagation is the current autoregressive generation step number.

[0040] The fourth fingerprint component is obtained as follows: The inference step fingerprint calculated in step S3 for the security log entry immediately preceding the current security log entry is obtained, and this inference step fingerprint is used as the fourth fingerprint component. When the current security log entry is the first security log entry (i.e., there is no preceding security log entry), the fourth fingerprint component takes a preset initial fingerprint value. In a specific embodiment of the present invention, the initial fingerprint value is set to a 256-bit hash value consisting entirely of zeros.

[0041] The first fingerprint component (semantic fingerprint), the second fingerprint component (model parameter version number), the third fingerprint component (autoregressive step number), and the fourth fingerprint component (preceding fingerprint) are concatenated into a single string in a predetermined order. For example, they can be concatenated in the order of "semantic fingerprint + model version number + step number + preceding fingerprint". The concatenated string is input into a hash function. In one specific embodiment of the present invention, the hash function is the SHA-256 hash function, which outputs a 256-bit hash value. This hash value is used as the inference step fingerprint of the current security log entry. The SHA-256 hash function is a well-known cryptographic hash function in the art, and those skilled in the art can use this function to perform fingerprint hashing operations according to the description of the present invention. The generated inference step fingerprint is then output to step S4.

[0042] In this way, the reasoning step fingerprint of each security log entry contains the complete information of the reasoning step fingerprint of the previous security log entry, thus establishing an inherent causal relationship between adjacent log entries—the fingerprint of the later log "points" to the fingerprint of the previous log.

[0043] The specific implementation of step S4: Step S4 receives the security log entry output in step S2 and the inference step fingerprint output in step S3, and stores the security log entry and the inference step fingerprint in the log buffer. In a specific embodiment of the present invention, the log buffer maintains an ordered linked list. An ordered linked list is a linear data structure in which each node contains a data field and a pointer field. The data field stores the actual data, and the pointer field stores a reference to the next node. In the present invention, each node in the ordered linked list stores a security log entry and the corresponding inference step fingerprint. The order of the nodes in the ordered linked list is consistent with the generation time order of the security log entries—log entries generated earlier are placed at the front of the linked list (closer to the head node), and log entries generated later are placed at the tail of the linked list (closer to the tail node). The ordered linked list is then output as a log sequence to step S5.

[0044] In the log sequence, the inference step fingerprint corresponding to each security log entry contains information about the inference step fingerprint of the next security log entry immediately preceding it (i.e., the fourth fingerprint component). This characteristic enables a chain-like causal relationship index between adjacent log entries that does not require an additional index structure—the next log entry "points" to the complete fingerprint of the previous log entry through the fourth fingerprint component in its fingerprint.

[0045] In an ordered linked list, starting from any node, by reading the fourth fingerprint component (i.e., the preceding fingerprint information) in the inference step fingerprint stored at that node, the predecessor node (i.e., the node corresponding to the previous security log entry) can be located in the log sequence. This locating operation is repeated, tracing backwards until the head node of the ordered linked list (i.e., the node corresponding to the first security log entry) is located, thus forming a complete backtracking path from any node to the head node. The advantage of this chain-index structure is that the causal relationship index is internalized within the fingerprint, eliminating the need to maintain a separate graph structure or index table.

[0046] The specific implementation of step S5: Step S5 receives the log sequence output by step S4 and the time of occurrence of the abnormal event output by step S2 when an anomaly exceeding the second threshold is detected, and performs the detection and reverse backtracking operation of the abnormal event.

[0047] Anomaly detection is achieved as follows: In step S2, each time a security log entry is generated, the difference metric value in that security log entry is compared with a second threshold. When the difference metric value exceeds the second threshold, an anomaly is determined to have occurred during the current forward propagation. The generation time of the current security log entry is taken as the occurrence time of the anomaly, and the current security log entry is taken as the starting node corresponding to the anomaly.

[0048] The specific method for backtracking backward along the chain-like causal relationship index is as follows: Starting with the security log entry corresponding to the time the abnormal event occurred, the fourth fingerprint component (i.e., the preceding fingerprint information) is extracted from the inference step fingerprint stored at the starting node. Since the inference step fingerprint is generated by concatenating four components in a predetermined order and then performing a hash operation, the original values ​​of the four components are saved and associated with the fingerprint during fingerprint generation for subsequent extraction. The extracted preceding fingerprint information is used to locate the previous security log entry in the log sequence. Specifically, each node in the log sequence is traversed, and the inference step fingerprint stored at that node is compared with the extracted preceding fingerprint information. When they match, the previous security log entry is located. The timestamp and decoding layer number in the previous security log entry are read, and the located previous security log entry is taken as the current node.

[0049] The fourth fingerprint component extracted from the inference step fingerprint stored in the current node is used as the updated preceding fingerprint information. The updated preceding fingerprint information is then used to locate the previous security log entry in the log sequence. This location operation is repeated, i.e., continuously extracting the preceding fingerprint from the current node's fingerprint, locating the predecessor node using the preceding fingerprint, and setting the predecessor node as the new current node, and so on.

[0050] The termination condition for the above repeated location operation is: the inference step fingerprint contained in the located security log entry is equal to the preset initial fingerprint value (i.e., the value of the fourth fingerprint component set for the first security log entry in step S3). When a log entry with a fingerprint value equal to the initial fingerprint value is located, this log entry is the log entry corresponding to the initial triggering event—it is the starting point of the entire causal chain, and there are no preceding logs before it.

[0051] All security log entries from the starting node to the log entry corresponding to the initial triggering event are arranged in chronological order from the initial triggering event to the anomalous event (i.e., from the head of the chain to the tail of the chain), forming a complete causal tracing chain. This complete causal tracing chain includes all intermediate state changes from the initial triggering event to the occurrence of the anomalous event, clearly demonstrating how the anomalous event gradually evolves and propagates during the model inference process. The resulting complete causal tracing chain is then output.

[0052] In a preferred embodiment of the present invention, after forming a complete causal tracing chain in step S5, a fingerprint sequence verification step is further included to verify the integrity of the tracing chain. Specifically, the inference step fingerprints corresponding to each security log entry in the complete causal tracing chain are arranged in chronological order from the initial triggering event to the abnormal event to obtain a fingerprint sequence. This fingerprint sequence is input into a fingerprint sequence verification function, which performs verification as follows: for the i-th fingerprint in the fingerprint sequence, it checks whether the fourth fingerprint component (i.e., the preceding fingerprint information) contained in the fingerprint is equal to the complete value of the (i-1)-th fingerprint in the fingerprint sequence. When all adjacent fingerprint pairs in the fingerprint sequence pass the above check, a verification pass signal is output; when any adjacent fingerprint pair fails the above check, a verification failure signal is output and the position of the adjacent fingerprint pair that failed the check is marked in the fingerprint sequence. This verification mechanism utilizes the chain-like characteristic of fingerprints—any log entry being tampered with (its fingerprint changes) or lost (a break occurs in the fingerprint sequence) will cause the verification of adjacent fingerprint pairs to fail, thereby ensuring the integrity and reliability of the tracing results.

[0053] Specific implementation of log buffer management: In one specific embodiment of the present invention, the log buffer maintains two independent storage areas: a high-priority storage area and a regular storage area. The capacity of the high-priority storage area is smaller than that of the regular storage area. This design allows limited storage resources to be allocated to high-value logs.

[0054] The high-priority storage area uses a circular overwrite method to store security log entries marked with second priority. This circular overwrite method means that the storage area is organized as a fixed-size circular buffer. When the buffer is not full, new log entries are written sequentially; when the buffer is full and a new second-priority security log entry arrives, the oldest second-priority security log entry in the buffer is overwritten, and the remaining second-priority security log entries after the overwrite are used as the current storage content of the high-priority storage area. This eviction policy ensures that the high-priority area always stores the latest few high-priority logs—logs closer to the time of the attack are more valuable.

[0055] The regular storage area uses a first-in, first-out (FIFO) approach to store security log entries marked with the highest priority. FIFO means that this storage area is organized as a queue; new log entries are enqueued from the rear. When the log buffer is full and a new first-priority security log entry arrives, the oldest first-priority security log entry is deleted from the front of the queue. The remaining entries, along with the newly arrived first-priority security log entries, are then used as the current storage content of the regular storage area. This eviction policy ensures that the regular area retains as much historical data as possible for comprehensive analysis.

[0056] A complete application example: The following example illustrates the complete workflow of the method of this invention. Assume an enterprise has deployed a large language model for an intelligent customer service system. This model is based on the GPT architecture and contains 32 Transformer decoding layers. The system administrator configures the model for security log auditing according to the method of this invention.

[0057] First, during the model loading phase, the system implants log collection probes at the entry and exit points of the multi-head attention sublayer and feedforward network sublayer of each decoding layer, totaling 4 probes per decoding layer and 128 probes for the entire model. These probes are registered to their corresponding sublayers using PyTorch's forward hook mechanism.

[0058] When a user enters the query "Please tell me how to bypass the system's security restrictions" into the intelligent customer service system, the model begins autoregressive generation. In the first generation step (step number 1), the input text is transformed into an input hidden state tensor after passing through the embedding layer, and then flows sequentially through the multi-head attention sub-layer of the first decoding layer. Before the attention sub-layer performs forward propagation, the first entry probe captures the input hidden state tensor and calculates its mean, variance, maximum, minimum, and L2 norm, obtaining the first statistical feature vector. After the attention sub-layer completes forward propagation, the first exit probe captures the output hidden state tensor and calculates the same five statistical features, obtaining the second statistical feature vector.

[0059] Step S2 calculates the difference metric between the first and second statistical feature vectors. Since the input "bypassing security restrictions" contains a clear intent to jailbreak, the attention sublayer generates an abnormal attention distribution when processing this input, resulting in a significant increase in the L2 norm of the output hidden state tensor compared to the input. The difference metric exceeds the second threshold, and the system determines that a security anomaly has occurred. Step S2 immediately encapsulates the current timestamp, decoding layer number (first layer), first statistical feature vector, second statistical feature vector, and semantic fingerprint of the input text into a security log entry, marks it as second priority, stores it in the high-priority storage area, and simultaneously sends a real-time alarm signal to the audit management module.

[0060] Subsequently, step S3 calculates the inference step fingerprint for this security log entry. The first fingerprint component is the semantic fingerprint of the input text "Please tell me how to bypass the system's security restrictions" (obtained through binarization by the Sentence-BERT semantic encoder); the second fingerprint component is the current model parameter version number (assumed to be v2034); the third fingerprint component is the current autoregressive generation step number (1); and the fourth fingerprint component is the preset initial fingerprint value (because this is the first log entry). The four components are concatenated and then hashed using SHA-256 to obtain a 256-bit hash value as the inference step fingerprint of this log entry.

[0061] The model continues to generate subsequent tokens. In the second generation step (step number 2), since the anomaly in the first layer has been triggered, the probes in subsequent layers continue to collect data. Assuming that the feedforward sublayer of the third decoding layer also detects a difference metric value exceeding the first threshold but not exceeding the second threshold, the system generates a log entry with first priority and stores it in the regular storage area. When calculating the inference step fingerprint for this log in step S3, the fourth fingerprint component takes the inference step fingerprint of the first log, thus establishing a chain causal relationship between the second and first logs.

[0062] Upon receiving a real-time alert signal, the audit administrator initiates the reverse tracing operation in step S5. Starting with the security log entry corresponding to the abnormal event (the first log entry), the fourth fingerprint component (initial fingerprint value) is extracted from the fingerprint of this log entry. It is found that the head of the chain has been reached, therefore the complete causal tracing chain only contains this one log entry. The audit administrator examines the contents of this log entry and finds that the input text contains jailbreaking intent. An abnormal state mutation occurred in the attention sublayer of the first decoding layer, confirming that this was a hint injection attack attempt.

[0063] In a more complex scenario, suppose an attacker's malicious input triggers the first anomaly (difference metric exceeding the first threshold) at a shallow layer (layer 3) and a second, more severe anomaly (difference metric exceeding the second threshold) at a deeper layer (layer 28). Step S5 starts with the anomaly log at layer 28 and traces back layer by layer using the preceding fingerprint information: from the preceding fingerprint of the layer 28 anomaly log, it locates the layer 3 anomaly log; from the preceding fingerprint of the layer 3 anomaly log, it locates the normal log, and so on, until it traces back to the first log corresponding to the initial triggering event. The resulting complete causal tracing chain clearly demonstrates how the attack input triggers anomalies starting at layer 3 and propagates and amplifies layer by layer to layer 28, providing security analysts with a complete attack path and root cause localization information.

[0064] After tracing is complete, step S5 may optionally perform fingerprint sequence verification: arrange the fingerprints of all logs in the tracing chain in chronological order, and check the preorder inclusion relationship between adjacent fingerprints one by one. Since all logs have not been tampered with, the verification passes, and the audit administrator can be confident that the tracing chain is complete and trustworthy.

[0065] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for end-to-end security log auditing and tracing of AI large-scale models, characterized in that, Includes the following steps: Step S1: Log collection probes are implanted at the forward propagation entry and exit points of each Transformer decoding layer in the large language model. The probes are non-intrusively attached to the tensor operation interface of the decoding layer. The tensor operation interface includes the forward propagation function entry point of the multi-head attention sub-layer, the forward propagation function exit point of the multi-head attention sub-layer, the forward propagation function entry point of the feedforward network sub-layer, and the forward propagation function exit point of the feedforward network sub-layer. The probes capture the first statistical feature vector of the input hidden state tensor input to the sub-layer and the second statistical feature vector of the output hidden state tensor output by the sub-layer. Both the first and second statistical feature vectors contain values ​​of five dimensions: mean, variance, maximum value, minimum value, and L2 norm. Step S2: Calculate the difference measure between the first statistical feature vector and the second statistical feature vector. When the difference measure exceeds a preset threshold, trigger an event-driven log recording operation to encapsulate the current timestamp, decoding layer number, first statistical feature vector, second statistical feature vector and semantic fingerprint of the current input text into a security log entry. Step S3: Calculate the inference step fingerprint for the security log entry. The inference step fingerprint is generated by concatenating four components: the semantic fingerprint of the current input text, the current model parameter version number, the current autoregressive generation step number, and the inference step fingerprint of the previous security log entry, and then performing a hash operation. Step S4: Associate the security log entries with the inference step fingerprints and store them together, so that the inference step fingerprint of each security log entry contains the information of the fingerprint of the previous security log entry, and a chain-like causal relationship index is formed between adjacent log entries; Step S5: When an abnormal event is detected, starting from the time the abnormal event occurs, trace back along the chain-like causal relationship index one by one, sequentially obtain the previous security log entries and their reasoning step fingerprints, until the initial triggering event is traced back to form a complete causal tracing chain.

2. The AI ​​large-scale model full-link security log auditing and tracing method according to claim 1, characterized in that, In step S1, before the multi-head attention sublayer or the feedforward network sublayer starts to perform forward propagation, the entry probe reads the input hidden state tensor input to the sublayer from the tensor operation interface, calculates the mean, variance, maximum value, minimum value and L2 norm of the input hidden state tensor, arranges the mean, variance, maximum value, minimum value and L2 norm in a predetermined order to form the first statistical feature vector, and outputs the first statistical feature vector to step S2; After the exit probe completes forward propagation in the multi-head attention sublayer or the feedforward network sublayer, it reads the output hidden state tensor output by the sublayer from the tensor operation interface, calculates the mean, variance, maximum value, minimum value and L2 norm of the output hidden state tensor, arranges the mean, variance, maximum value, minimum value and L2 norm in the predetermined order to form the second statistical feature vector, and outputs the second statistical feature vector to step S2.

3. The AI ​​large-scale model full-link security log auditing and tracing method according to claim 1, characterized in that, In step S2, the difference measurement value is calculated in the following manner: Calculate the absolute value of the difference between the value of each dimension in the first statistical feature vector and the value of the corresponding dimension in the second statistical feature vector to obtain the absolute difference of each of the five dimensions. Divide the absolute difference of each of the five dimensions by half the sum of the values ​​of the corresponding dimensions in the first statistical feature vector and the corresponding dimensions in the second statistical feature vector to obtain the relative rate of change of each of the five dimensions. The relative rates of change of the five dimensions are weighted and summed, and the result of the weighted sum is output as the difference measure value. The weight corresponding to the relative rate of change of the L2 norm dimension is greater than the weight corresponding to the relative rates of change of the mean dimension, the variance dimension, the maximum value dimension, and the minimum value dimension.

4. The AI ​​large-scale model end-to-end security log auditing and tracing method according to claim 1, characterized in that, In step S2, the preset threshold includes a first threshold and a second threshold, wherein the second threshold is greater than the first threshold; When the difference metric exceeds the first threshold but does not exceed the second threshold, the security log entry is marked as first priority, and the security log entry marked with first priority is stored in the regular storage area of ​​the log buffer. When the difference metric exceeds the second threshold, the security log entry is marked as the second priority, the security log entry marked with the second priority is stored in the high priority storage area of ​​the log buffer, and a real-time alarm signal is sent to the audit management module. The time of sending the real-time alarm signal is output as the time of occurrence of the abnormal event to step S5. The storage priority of the second priority is higher than that of the first priority. When the storage space of the log buffer is insufficient, the security log entries marked as first priority in the regular storage area are deleted first.

5. The AI ​​large-scale model end-to-end security log auditing and tracing method according to claim 1, characterized in that, In step S3, the inference step fingerprint is generated in the following manner: Obtain the input text corresponding to the current forward propagation, input the input text into a semantic encoder, the semantic encoder is a sentence transformer model, the semantic encoder outputs a fixed-length semantic vector, the semantic vector is binarized to obtain a fixed-length binary sequence, the binary sequence is used as the semantic fingerprint of the current input text, and the semantic fingerprint is used as the first fingerprint component of the inference step fingerprint; Obtain the value of the global version counter that is incremented each time the parameters are updated during the training or fine-tuning process of the current large language model, use the value as the current model parameter version number, and use the current model parameter version number as the second fingerprint component of the inference step fingerprint. Obtain the step number counted from the starting token during the current forward propagation autoregressive generation process, use this step number as the current autoregressive generation step number, and use the current autoregressive generation step number as the third fingerprint component of the inference step fingerprint. Obtain the inference step fingerprint calculated for the security log entry immediately preceding the current security log entry, and use the inference step fingerprint of the previous security log entry as the fourth fingerprint component of the inference step fingerprint; when the current security log entry is the first security log entry, the fourth fingerprint component takes a preset initial fingerprint value. The first fingerprint component, the second fingerprint component, the third fingerprint component, and the fourth fingerprint component are concatenated into a concatenated string in a predetermined order. The concatenated string is input into a hash function, and the hash value output by the hash function is used as the inference step fingerprint of the current security log entry. The inference step fingerprint is then output to step S4.

6. The AI ​​large-scale model end-to-end security log auditing and tracing method according to claim 1, characterized in that, In step S4, the log buffer maintains an ordered linked list, and each node in the ordered linked list stores a security log entry and the inference step fingerprint corresponding to the security log entry. The order of nodes in the ordered linked list is consistent with the generation time order of each security log entry, and the ordered linked list after arrangement is used as the log sequence. In the log sequence, the inference step fingerprint corresponding to each security log entry contains information about the inference step fingerprint corresponding to the next security log entry immediately preceding it, and a chain-like causal relationship index is formed between adjacent log entries; In the ordered linked list, starting from any node, the predecessor node of the node is located by reading the previous fingerprint information in the reasoning step fingerprint stored in that node. The above location operation is repeated until the head node of the ordered linked list is located, forming a complete backtracking path from any node to the head node.

7. The AI ​​large-scale model end-to-end security log auditing and tracing method according to claim 4, characterized in that, In step S5, the detection of the abnormal event is achieved in the following way: In step S2, each time a security log entry is generated, the difference metric value in the security log entry is compared with the second threshold. When the difference metric exceeds the second threshold, it is determined that an abnormal event has occurred in the current forward propagation. The generation time of the current security log entry is taken as the occurrence time of the abnormal event, and the current security log entry is taken as the starting node corresponding to the abnormal event. The specific method for backtracking backwards along the chain-like causal relationship index is as follows: Taking the security log entry corresponding to the time when the abnormal event occurs as the starting node, the fourth fingerprint component is extracted from the reasoning step fingerprint stored in the starting node, and the fourth fingerprint component is used as the preceding fingerprint information. The preceding security log entry is located in the log sequence using the preceding fingerprint information. The timestamp and decoding layer number in the preceding security log entry are read, and the located preceding security log entry is taken as the current node. The fourth fingerprint component extracted from the inference step fingerprint stored in the current node is used as the updated preceding fingerprint information. The updated preceding fingerprint information is used to locate the previous security log entry in the log sequence. The location operation is repeated until the inference step fingerprint contained in the located security log entry is equal to the preset initial fingerprint value. The security log entry located at this time is used as the log entry corresponding to the initial triggering event. All security log entries from the starting node to the log entry corresponding to the initial triggering event are arranged in chronological order from the initial triggering event to the abnormal event to form the complete causal tracing chain, and the complete causal tracing chain is output.

8. The AI ​​large-scale model end-to-end security log auditing and tracing method according to claim 7, characterized in that, After step S5 forms the complete causal tracing chain, the following steps are also included: Arrange the fingerprints of the reasoning steps corresponding to each security log entry in the complete causal tracing chain in chronological order from the initial triggering event to the abnormal event to obtain a fingerprint sequence; The fingerprint sequence is input into a fingerprint sequence verification function, which performs verification in the following manner: For the i-th fingerprint in the fingerprint sequence, check whether the fourth fingerprint component contained in the fingerprint is equal to the complete value of the (i-1)-th fingerprint in the fingerprint sequence; When all adjacent fingerprint pairs in the fingerprint sequence pass the above checks, a verification pass signal is output. When any adjacent fingerprint pair fails the above check, a verification failure signal is output and the position of the adjacent fingerprint pair that failed the check is marked in the fingerprint sequence.

9. The AI ​​large-scale model full-link security log auditing and tracing method according to claim 4, characterized in that, The log buffer maintains a high-priority storage area and a regular storage area; The high-priority storage area uses a cyclic overwrite method to store security log entries marked with the second priority. When the high-priority storage area is full and a new second-priority security log entry arrives, the earliest second-priority security log entry generated in the high-priority storage area is overwritten, and the remaining second-priority security log entries after overwriting are used as the current storage content of the high-priority storage area. The regular storage area uses a first-in-first-out (FIFO) method to store security log entries marked with the first priority. When the regular storage area is full and a new first-priority security log entry arrives, the earliest first-priority security log entry generated in the regular storage area is deleted, and the remaining first-priority security log entries after deletion and the newly arrived first-priority security log entries are used as the current storage content of the regular storage area. The capacity of the high-priority storage area is smaller than the capacity of the regular storage area.

10. The AI ​​large-scale model full-link security log auditing and tracing method according to claim 2, characterized in that, In step S1, for each Transformer decoding layer in the large language model, the following operations are performed independently: A first entry probe is implanted at the entry point of the multi-head attention sublayer of the decoding layer, a first exit probe is implanted at the exit point of the multi-head attention sublayer, a second entry probe is implanted at the entry point of the feedforward network sublayer of the decoding layer, and a second exit probe is implanted at the exit point of the feedforward network sublayer. The first entry probe and the second entry probe independently calculate the first statistical feature vector of their respective captured input hidden state tensor, and output the first statistical feature vectors they have calculated to step S2. The first exit probe and the second exit probe independently calculate the second statistical feature vector of their respective captured output hidden state tensor, and output the calculated second statistical feature vector to step S2. In step S2, for each Transformer decoding layer, the following difference calculation and triggering operations are performed independently: Calculate a first difference metric between the first statistical feature vector output by the first entry probe of the decoding layer and the second statistical feature vector output by the first exit probe; calculate a second difference metric between the first statistical feature vector output by the second entry probe of the decoding layer and the second statistical feature vector output by the second exit probe; when either the first difference metric or the second difference metric exceeds the preset threshold, trigger the event-driven logging operation and record the sub-layer type corresponding to the probe that triggered the logging operation in the security log entry.

Images