Anchoring point constraint and process monitoring endogenous security in-depth defense method and system

Abstract

The application relates to the field of artificial intelligence security and natural language processing technology, and particularly discloses an anchor point constraint and process monitoring endogenous security in-depth defense method and system. The technical scheme of the application loads an anchor point template according to a scene and a risk level, locks an anchor point interval in a key value cache and calculates a check sum, generates in parallel calculation of a risk score and a consistency index round by round, corrects a probability distribution or executes cache rollback in a sampling layer according to a grading threshold, adds special constraints when the scene changes, and injects a rejection token when anchor point tampering is detected, so that the problems of algorithm power waste and context damage caused by post-check, inability of static rules to perceive topic switching, damage of coherence caused by rigid release or rejection, and misinterception and missed identification caused by non-uniformity of external discrimination and original alignment logic are solved, in-depth defense of security constraints embedded in the whole generation process is realized, security controllability and conversation fluency are improved, and algorithm power waste and misinterception rate are reduced.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and natural language processing technology, and in particular to an intrinsic security defense-in-depth method and system based on anchor point constraints and process monitoring. Background Technology

[0002] Large language models are increasingly being used in critical scenarios such as healthcare, finance, and education, making the security and controllability of output content a crucial prerequisite for technology implementation. Current mainstream security defense systems are primarily built around two paths: training alignment and inference interception. The training and fine-tuning phases widely employ reinforcement learning based on human feedback and direct preference optimization methods, introducing reward models to enable the model to pre-learn and avoid harmful outputs. The inference service layer mainly relies on external security safeguards and static system instructions. The former deploys a discriminative model or rule engine outside the model to verify input and output, while the latter writes fixed security constraints into the dialog prompt headers to passively restrict model behavior.

[0003] However, the above solutions have revealed multiple limitations in actual deployment. External guardrails are post-validation mechanisms, requiring the model to complete full forward inference and generate all text before blocking can be determined. This consumes significant GPU computing power, and the forced truncation of the violation token after it's written to the KV Cache disrupts the autoregressive context state, leading to subsequent dialogue logic errors. Static rules and system instructions are fixed and unchanging, failing to detect topic changes in long-context dialogues, and security boundaries cannot be dynamically tightened, making them susceptible to being bypassed by various jailbreak hints. Existing solutions only offer two outcomes: complete allowance or direct rejection. When the model's generated trajectory deviates from the compliance boundary, it lacks smooth correction capabilities, and the frequently triggered abrupt rejection statements severely disrupt dialogue coherence. Furthermore, the external discrimination model and the model's native alignment system are independent, resulting in inconsistent judgment logic. This leads to frequent instances of false blocking of compliant content and missed identification of high-risk content, creating a disconnect between internal and external monitoring baselines.

[0004] The aforementioned shortcomings indicate that existing defense systems struggle to balance computational efficiency and dynamic adaptability, necessitating a novel defense-in-depth approach that embeds security constraints into the entire model generation process. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides an intrinsic security defense-in-depth method and system based on anchor point constraints and process monitoring.

[0006] Firstly, this invention provides an intrinsic security defense-in-depth method based on anchor point constraints and process monitoring. The technical solution of this method is as follows: Obtain user requests, parse the session scenario and user historical risk level corresponding to the user requests, load matching security anchor templates according to the session scenario and user historical risk level, and concatenate the security anchor templates with scenario-specific constraint content to generate security anchor text; The secure anchor text is injected into the prompt layer, the storage area of ​​the secure anchor text is locked in the key-value cache, the checksum of the secure anchor text is calculated, and the checksum and the secure anchor text are stored in the storage area. When calling the large language model to generate candidate tokens round by round, the risk score of the candidate tokens is calculated in parallel, and the consistency index between the generated sequence and the security anchor text is calculated. When the risk score exceeds the red threshold or the checksum in the storage area does not match, a key-value cache rollback operation is performed to delete recently generated tokens, and a fallback template is used to output text; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, the weight of high-risk tokens is reduced and the weight of compliant tokens is increased, and the current token is output. During the dialogue flow, when a scene change is detected, a special constraint token corresponding to the changed scene is loaded, the special constraint token is appended to the end of the key-value cache, and the checksum of all anchor points is recalculated. The recalculated checksum is then stored in the storage area. Additionally, when a user input is detected to contain instructions to tamper with or delete anchor points, a rejection token is injected to block the generation process.

[0007] The beneficial effects of the intrinsic security defense-in-depth method based on anchor point constraints and process monitoring of the present invention are as follows: The method of this invention loads anchor point templates according to scenarios and risk levels, locks anchor point intervals in key-value caches and calculates checksums, calculates risk scores and consistency indicators in parallel during each round of generation, corrects probability distributions or performs cache rollbacks at the sampling layer based on tiered thresholds, adds specific constraints when scenarios change, and injects rejection tokens when anchor point tampering is detected. This solves the problems of wasted computing power and context destruction caused by post-verification, static rules failing to detect topic changes, abruptly allowing or rejecting data and disrupting continuity, and false interception and missed identification caused by inconsistent external discrimination and native alignment logic. It achieves in-depth defense by embedding security constraints within the entire generation process, improves security controllability and dialogue fluency, and reduces wasted computing power and false interception rates.

[0008] Based on the above scheme, the intrinsic security defense-in-depth method of anchor point constraint and process monitoring of the present invention can be further improved as follows.

[0009] In an alternative approach, injecting the security anchor text into the prompt layer further includes: The security anchor text is given a higher execution priority than the user input command, and physical write protection is applied to the storage area when the storage area is locked in the key-value cache, preventing the user token from overwriting the security anchor text in the storage area.

[0010] The advantages of adopting the above optional approach are as follows: by giving the security anchor text a higher execution priority than the user input command and by applying physical write protection to the anchor storage area in the key-value cache, the user input token is prevented from overwriting the anchor content, and the security constraints are prevented from failing due to prompt injection or context manipulation, thereby enhancing the immutability and defense level of the anchor text during the generation process.

[0011] In one alternative approach, the checksum employs... The algorithm calculates that the storage area is an independent secure storage area, which is physically isolated from the key-value cache. The checksum stored in the storage area is used to compare with the checksum calculated in real time.

[0012] The beneficial effects of adopting the above-mentioned optional methods are: further by adopting The algorithm calculates the anchor text checksum and stores the checksum in an independent and secure storage area that is physically isolated from the key-value cache. This separates the anchor integrity check from the model inference cache, preventing cache pollution or memory tampering from causing the checksum to fail and providing hardware-level isolation protection for anchor tampering.

[0013] In an alternative approach, when computing the risk scores of the candidate tokens in parallel, the method further includes: After the backbone Transformer network of the large language model outputs Logits, the risk score is output by the safety classification Head that is mounted in parallel on the backbone Transformer network. The safety classification Head shares the forward computation process with the backbone Transformer network.

[0014] The advantages of adopting the above optional approach are as follows: after the main Transformer network outputs Logits, the parallel-mounted safety classification Head shares the forward calculation process and outputs the risk score, avoiding the computational overhead and latency increase caused by additional independent inference, and realizing round-by-round risk monitoring without affecting the model generation throughput.

[0015] In one alternative approach, when calculating the consistency index, the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text are subjected to cosine similarity calculation to obtain the value of the consistency index. The value of the consistency index represents the degree of deviation between the currently generated trajectory and the security boundary defined by the security anchor text.

[0016] The beneficial effects of adopting the above optional method are as follows: by further calculating the cosine similarity between the semantic vector of the generated token sequence and the boundary vector of the security anchor text, a consistency index is obtained to quantify the degree to which the current generated trajectory deviates from the security boundary, thus expanding the risk judgment from discrete classification to continuous measurement and providing a refined basis for dynamic correction of the sampling layer.

[0017] In one alternative approach, the red threshold and the yellow threshold are obtained through iterative calibration using an offline dataset containing compliant and non-compliant samples from various scenarios. The set threshold is configured in association with the yellow threshold, and yellow line intervention is triggered when the consistency index falls below the set threshold.

[0018] The beneficial effects of adopting the above optional approach are as follows: by iteratively calibrating the red and yellow thresholds based on an offline dataset containing compliant and non-compliant samples from various scenarios, and by associating the consistency index threshold with the yellow threshold, the graded intervention standard can be made to fit the actual business scenario distribution, reducing over-interception or missed judgment caused by rigid threshold settings.

[0019] In one alternative approach, when the sampling layer corrects the probability distribution of the candidate tokens, it further includes: Before the Softmax normalization operation, the Logits weights of the candidate tokens are dynamically adjusted. The dynamic adjustment includes multiplying the weights of high-risk tokens by a decay coefficient less than 1 and multiplying the weights of compliant tokens by a gain coefficient greater than 1.

[0020] The beneficial effects of adopting the above optional method are as follows: by dynamically adjusting the Logits weight of candidate tokens before Softmax normalization, applying a decay coefficient to high-risk tokens and a gain coefficient to compliant tokens, the probability distribution is smoothly corrected without truncating the generation stream, so that the output gradually returns to the compliant direction and avoids abrupt rejection that disrupts the continuity of the dialogue.

[0021] Secondly, this invention provides an intrinsic security defense-in-depth system based on anchor point constraints and process monitoring. The technical solution of this system is as follows: The processing module is used to obtain user requests, parse the session scenario and user historical risk level corresponding to the user requests, load a matching security anchor template according to the session scenario and user historical risk level, and concatenate the security anchor template with scenario-specific constraint content to generate security anchor text. The injection module is used to inject the security anchor text into the prompt layer, lock the storage area of ​​the security anchor text in the key-value cache, calculate the checksum of the security anchor text, and store the checksum and the security anchor text in the storage area. The calculation module is used to calculate the risk score of the candidate tokens in parallel when calling the large language model to generate candidate tokens round by round, and to calculate the consistency index between the generated sequence and the security anchor text. The output module is used to perform a key-value cache rollback operation to delete recently generated tokens and output text using a fallback template when the risk score exceeds the red threshold or the checksum in the storage area does not match; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, the weight of high-risk tokens is reduced and the weight of compliant tokens is increased, and the current token is output. The execution module is used to, during the dialogue flow process, identify when a scene change is detected, load a special constraint token corresponding to the changed scene, append the special constraint token to the end of the key-value cache, recalculate the checksum of all anchor points, and store the recalculated checksum in the storage area; and, when the user input is detected to contain instructions to tamper with or delete anchor points, inject a rejection token to block the generation process.

[0022] The beneficial effects of the intrinsic security defense-in-depth system based on anchor point constraints and process monitoring of the present invention are as follows: The system of this invention loads anchor templates according to scenarios and risk levels, locks anchor intervals in key-value caches and calculates checksums, calculates risk scores and consistency indicators in parallel during each generation round, corrects probability distributions or performs cache rollbacks at the sampling layer based on grading thresholds, adds specific constraints when scenarios change, and injects rejection tokens when anchor tampering is detected. This solves the problems of wasted computing power and context destruction caused by post-verification, static rules failing to detect topic changes, abruptly allowing or rejecting data and disrupting continuity, and false interception and missed identification caused by inconsistent external discrimination and native alignment logic. It achieves in-depth defense by embedding security constraints into the entire generation process, improves security controllability and dialogue fluency, and reduces wasted computing power and false interception rate.

[0023] Thirdly, the technical solution of an electronic device according to the present invention is as follows: It includes a memory, a processor, and a program stored in the memory and running on the processor, wherein the processor executes the program to implement the steps of the intrinsic security defense-in-depth method of anchor point constraint and process monitoring as described in this invention.

[0024] Fourthly, the technical solution of a computer-readable storage medium provided by the present invention is as follows: The computer-readable storage medium stores instructions that, when read, cause the computer-readable storage medium to perform the steps of the intrinsic security defense-in-depth method of anchor point constraint and process monitoring as described in this invention.

[0025] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0026] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a flowchart illustrating an embodiment of the intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to the present invention. Figure 2 A schematic diagram of the session initialization and dynamic security anchor point generation process; Figure 3 A schematic diagram of the token-by-token security situation monitoring and tiered intervention decision-making process; Figure 4 A schematic diagram of the dynamic evolution and self-protection structure of key-value cache anchors; Figure 5 This is a schematic diagram of an embodiment of an intrinsic security defense-in-depth system based on anchor point constraints and process monitoring according to the present invention. Figure 6 This is a schematic diagram of an embodiment of an electronic device according to the present invention. Detailed Implementation

[0027] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0028] Figure 1 This diagram illustrates a flowchart of an embodiment of an intrinsic security defense-in-depth method based on anchor point constraints and process monitoring provided by the present invention. This method can be executed by electronic devices such as terminal devices or servers. The terminal device can be any fixed or mobile terminal, such as user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, vehicle-mounted device, or wearable device. The server can be a single server or a server cluster consisting of multiple servers. Any electronic device can implement the intrinsic security defense-in-depth method based on anchor point constraints and process monitoring by having its processor call computer-readable instructions stored in its memory. Figure 1 As shown, it includes the following steps: S1. Obtain the user request, parse the session scenario and user historical risk level corresponding to the user request, load the matching security anchor template according to the session scenario and user historical risk level, and concatenate the security anchor template with the scenario-specific constraint content to generate security anchor text.

[0029] Here, a user request refers to natural language input initiated by a user to a large language model, which triggers the model to generate a response; for example, a user request could be "Please recommend a fever reducer to an adult".

[0030] Here, "session scenario" refers to the business domain category to which the user request belongs, used to determine the scope of application of security constraints; for example, the session scenario corresponding to the user request is a medical scenario. "User historical risk level" refers to the risk level pre-classified based on the user's past violation records or security scores, used to adjust the strictness of security anchors; for example, the user's historical risk level is a low-risk level.

[0031] Among them, the safety anchor template refers to a standardized safety constraint text framework pre-written for different session scenarios, containing a description of general behavioral boundaries in that scenario; for example, the safety anchor template for the medical scenario includes medication dosage specification constraint text, the content of which is "dosage dosage must not exceed the standard dosage range, and prescription drugs must not be recommended." Scenario-specific constraint content refers to specific constraint details extracted from the anchor template library based on the current session scenario and the user's historical risk level, used to supplement the variable parts of the template; for example, for the recommendation of antipyretics for adults, the scenario-specific constraint content is "the single dose of acetaminophen for adults shall not exceed 500 mg, and the total daily dose shall not exceed 2000 mg."

[0032] Among them, the safety anchor text refers to the complete constraint description generated by concatenating the safety anchor template with the scene-specific constraint content, which serves as the definition of the safety boundary of the current dialogue; for example, the concatenated safety anchor text is "Do not exceed the standard medication dosage range, and do not recommend prescription drugs; the single dose of acetaminophen for adults shall not exceed 500 mg, and the total daily dose shall not exceed 2000 mg".

[0033] S2. Inject the security anchor text into the prompt layer, lock the storage area of ​​the security anchor text in the key-value cache, calculate the checksum of the security anchor text, and store the checksum and the security anchor text in the storage area.

[0034] The prompt layer refers to the header position in the input sequence of the large language model, which is located before the user's input and is used to carry system-level instructions and security constraints. For example, security anchor text is injected into the prompt layer and placed before the user's request "Please recommend an antipyretic for an adult".

[0035] Here, the key-value cache refers to a cache structure that stores the key and value matrices calculated by each layer of attention during the autoregressive generation process of the large language model, used to accelerate subsequent token generation; for example, the key-value cache stores the key-value pairs of all tokens in the generated sequence. The storage range refers to the contiguous address range allocated in the key-value cache for storing the key-value vectors corresponding to the security anchor text; for example, the key-value vectors corresponding to the security anchor text are locked in the starting address range of the key-value cache, from 0x1000 to 0x1FFF.

[0036] Here, the checksum refers to a fixed-length digest value obtained by hashing the entire secure anchor text, used to verify the integrity of the anchor text; for example, using... The algorithm calculates a checksum for the secure anchor text as a hash string in the format "a3f5c2e8d9b1". The storage area refers to a secure storage space independent of the key-value cache, used to store the checksum and the original secure anchor text, preventing contamination during the model inference process. For example, the checksum and the original secure anchor text are stored in the "anchor_checksum" and "anchor_text" files respectively within the independent secure storage area.

[0037] S3. When calling the large language model to generate candidate tokens round by round, calculate the risk score of the candidate tokens in parallel, and calculate the consistency index between the generated sequence and the security anchor text.

[0038] Here, candidate tokens refer to all possible output lexical units corresponding to the probability distribution calculated by the backbone network in the current generation step of the large language model; each unit is a candidate token. For example, in the current step, candidate tokens include words such as "drug A," "drug B," and "drug C." Risk score refers to the numerical value output by the safety classification head, used to quantify the risk level of the current candidate token in the safety dimension; a higher value indicates a greater risk. For example, the risk score of candidate token "drug A" is... The risk score for candidate token "overdosing" is 0.12. It is 0.89.

[0039] Here, the generated sequence refers to the sequential sequence of all tokens output by the large language model from the start of the current dialogue to the current generation step; for example, the generated sequence is "Recommended Use". The consistency index is a numerical value obtained by calculating the cosine similarity between the semantic vector of the generated sequence and the boundary vector of the security anchor text, used to characterize the degree of deviation between the current generation trajectory and the security boundary defined by the security anchor; for example, the cosine similarity between the generated sequence "Recommended Use" and the boundary vector of the security anchor text... A value of 0.95 indicates a high degree of consistency.

[0040] S4. When the risk score exceeds the red threshold or the checksum in the storage area does not match, perform a key-value cache rollback operation to delete recently generated tokens and output text using a fallback template; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, correct the probability distribution of candidate tokens at the sampling layer, reduce the weight of high-risk tokens and increase the weight of compliant tokens, and output the current token.

[0041] Here, the red threshold refers to a preset upper limit for the risk score. When the risk score exceeds this value, a hard-blocking intervention is triggered. For example, the red threshold is set to 0.85, which is the risk score for "overdosing" a candidate token. The score is 0.89, exceeding the red threshold. The yellow threshold refers to a preset median value for the risk score; when the risk score exceeds this value but does not exceed the red threshold, a soft-guided intervention is triggered. For example, the yellow threshold is set to 0.60, which corresponds to the risk score of candidate token "Drug B". The value is 0.65, exceeding the yellow threshold but not exceeding the red threshold. The set threshold refers to a preset lower limit for the consistency indicator. When the consistency indicator falls below this value, yellow line intervention is triggered. This set threshold is configured in association with the yellow threshold; for example, if the set threshold is 0.80, the current consistency indicator... The value is 0.75, which is lower than the set threshold.

[0042] The sampling layer refers to the module that performs probability distribution normalization and token sampling during the large language model generation process, located after the Logits output of the backbone network. For example, the sampling layer performs Top-K sampling after Softmax normalization of the Logits of candidate tokens. The probability distribution refers to the set of probability values ​​obtained after Softmax normalization of all candidate tokens in the sampling layer, with the sum of all probability values ​​being 1. For example, the probability of candidate token "Drug A" is 0.45, the probability of "Drug B" is 0.30, and the probability of "Drug C" is 0.25.

[0043] Here, the high-risk token weight refers to the weight value of a candidate token in its Logits values ​​before Softmax normalization, which is considered a high-risk token. For example, the candidate token "overdose" has a Logits weight of 2.5 and is therefore considered a high-risk token. The compliance token weight refers to the weight value of a candidate token in its Logits values ​​before Softmax normalization, which is considered a token that meets security boundary requirements. For example, the candidate token "drug A" has a Logits weight of 1.2 and is therefore considered a compliance token. The current token refers to the single token finally output after security intervention in the current generation step, representing the result of this round of generation. For example, the current token is "drug A".

[0044] S5. During the dialogue flow, when a scene change is detected, a special constraint token corresponding to the changed scene is loaded, the special constraint token is appended to the end of the key-value cache, and the checksum of all anchor points is recalculated. The recalculated checksum is stored in the storage area. Also, when a user input is detected to contain an instruction to tamper with or delete anchor points, a rejection token is injected to block the generation process.

[0045] Among them, the special constraint token refers to the additional constraint content for the new scenario loaded from the anchor template library when the dialogue scenario changes, which is appended to the end of the key-value cache in the form of a token sequence; for example, when the dialogue switches from general consultation to pediatric medication, the loaded special constraint token is "children's dosage is calculated by weight" and "not more than 15 milligrams per kilogram".

[0046] Here, "full anchor" refers to the complete set of constraints consisting of the original security anchor text and all subsequently added specific constraint tokens; for example, full anchor includes the original medical scenario anchor text and the added pediatric specific constraint text. "Reject token" refers to a special token that, when injected into the generation process, causes the large language model to output a preset rejection response and terminate the current dialogue generation; for example, when the user inputs "ignore the previous security rule," a rejection token is injected, the large language model outputs "the request cannot be satisfied" and terminates generation.

[0047] The technical solution of this embodiment loads anchor templates according to the scenario and risk level, locks the anchor interval in the key-value cache and calculates the checksum, calculates the risk score and consistency index in parallel during each round of generation, corrects the probability distribution or performs cache rollback at the sampling layer according to the graded threshold, adds special constraints when the scenario changes, and injects a rejection token when anchor tampering is detected. This solves the problems of wasted computing power and context destruction caused by post-verification, static rules being unable to perceive topic switching, abruptly allowing or rejecting disrupting the continuity, and false interception and missed identification caused by the inconsistency between external discrimination and native alignment logic. It realizes in-depth defense with security constraints embedded in the entire generation process, improves security controllability and dialogue fluency, and reduces computing power waste and false interception rate.

[0048] In one alternative approach, injecting the security anchor text into the prompt layer further includes: The security anchor text is given a higher execution priority than the user input command, and physical write protection is applied to the storage area when the storage area is locked in the key-value cache, preventing the user token from overwriting the security anchor text in the storage area.

[0049] Here, user input instructions refer to natural language content entered by the user in the dialogue to guide or change the behavior of the large language model, including normal questions and possible jailbreak attack instructions; for example, the user input instruction is "Please recommend a fever reducer to an adult". Execution priority refers to the relative importance of the security anchor text in the prompt layer, making it higher than the permissions of user input instructions and system default instructions; for example, the security anchor text is given the highest execution priority, and when a user request conflicts with an anchor rule, the anchor rule takes precedence.

[0050] Physical write protection refers to the protection of the storage area in the key-value cache by preventing write access through the operating system's memory management mechanism, thus preventing any token from overwriting the area. For example, the storage area is set to read-only, and user tokens cannot be written to the area.

[0051] In the above optional methods, by further assigning the security anchor text a higher execution priority than the user input command and applying physical write protection to the anchor storage area in the key-value cache, the user input token is prevented from overwriting the anchor content, thus avoiding the failure of security constraints due to prompt injection or context manipulation, thereby enhancing the immutability and defense level of the anchor text during the generation process.

[0052] In one alternative approach, the checksum employs... The algorithm calculates that the storage area is an independent secure storage area, which is physically isolated from the key-value cache. The checksum stored in the storage area is used to compare with the checksum calculated in real time.

[0053] The independent secure storage area refers to a dedicated storage area that is physically isolated from the key-value cache and is used to store checksums and security anchor text, and is not affected by cache pollution during the inference process of the large language model. For example, the independent secure storage area is a secure memory area in a trusted execution environment.

[0054] In the above-mentioned optional methods, further by adopting The algorithm calculates the anchor text checksum and stores the checksum in an independent secure storage area that is physically isolated from the key-value cache. This separates the anchor integrity check from the model inference cache, preventing cache pollution or memory tampering from causing the checksum to fail and providing hardware-level isolation protection for anchor tampering.

[0055] In an alternative approach, when computing the risk scores of the candidate tokens in parallel, the method further includes: After the backbone Transformer network of the large language model outputs Logits, the risk score is output by the safety classification Head that is mounted in parallel on the backbone Transformer network. The safety classification Head shares the forward computation process with the backbone Transformer network.

[0056] The backbone Transformer network refers to the core neural network structure of a large language model, which includes multi-head self-attention layers and feedforward network layers, and is responsible for calculating the contextual representation of the input sequence and outputting Logits. For example, the backbone Transformer network is the decoder part of an open-source large language model.

[0057] Parallel attachment refers to attaching an independent security classification head to the output node of the backbone Transformer network. This security classification head shares the forward computation process with the backbone Transformer network without adding additional inference overhead. For example, the security classification head is attached in parallel after the output of the last hidden layer of the backbone Transformer network. The security classification head is a lightweight neural network layer that receives the output features of the backbone Transformer network and outputs a risk score St for each candidate token. For example, the security classification head is a linear classifier that takes the hidden layer vector of the backbone Transformer network as input and outputs a scalar risk value.

[0058] In the above-mentioned optional approach, after the backbone Transformer network outputs Logits, the parallel-mounted safety classification Head shares the forward computation process and outputs risk scores, thereby avoiding the computational overhead and latency increase caused by additional independent inference, and realizing round-by-round risk monitoring without affecting the model generation throughput.

[0059] In one alternative approach, when calculating the consistency index, the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text are subjected to cosine similarity calculation to obtain the value of the consistency index. The value of the consistency index represents the degree of deviation between the currently generated trajectory and the security boundary defined by the security anchor text.

[0060] The current generated trajectory refers to the complete path formed by all tokens and their order that the large language model has output from the beginning of the dialogue to the current generation step; for example, the current generated trajectory is "Recommended to use drug A".

[0061] In the above-mentioned optional methods, a consistency index is further obtained by calculating the cosine similarity between the semantic vector of the generated token sequence and the boundary vector of the security anchor text to quantify the degree to which the current generated trajectory deviates from the security boundary. This expands the risk judgment from discrete classification to continuous measurement, providing a refined basis for dynamic correction of the sampling layer.

[0062] In one alternative approach, the red threshold and the yellow threshold are obtained through iterative calibration using an offline dataset containing compliant and non-compliant samples from various scenarios. The set threshold is configured in association with the yellow threshold, and yellow line intervention is triggered when the consistency index falls below the set threshold.

[0063] The offline dataset refers to a pre-collected set of compliant and non-compliant dialogue samples from various scenarios, used to calibrate intervention thresholds. For example, the offline dataset contains 5,000 medical scenario dialogue samples, including 3,000 compliant samples and 2,000 non-compliant samples, collected on June 1, 2026.

[0064] In this context, compliant samples refer to dialogue examples in the offline dataset that are labeled as safe and conform to the target scenario's specifications; for example, a compliant sample is a compliant medication recommendation from a medical institution. Non-compliant samples refer to dialogue examples in the offline dataset that are labeled as unsafe and violate the target scenario's constraints; for example, a non-compliant sample is a recommendation to take an excessive dose of medication.

[0065] Among them, the yellow line intervention refers to: when the risk score Exceeding the yellow threshold but not exceeding the red threshold, or the consistency index When the probability distribution of candidate tokens falls below a set threshold, the sampling layer dynamically adjusts the probability distribution without interrupting the generation process; for example, the risk score of candidate token "Drug B". If the value is 0.65, the yellow line intervention is triggered. The sampling layer multiplies the weight of the token by a decay factor of 0.5, while simultaneously increasing the weight of compliant tokens.

[0066] In the above-mentioned optional methods, the red and yellow thresholds are further iteratively calibrated based on an offline dataset containing compliant and non-compliant samples from various scenarios, and the consistency index threshold is associated with the yellow threshold. This makes the graded intervention standard fit the actual business scenario distribution and reduces over-interception or missed judgment caused by rigid threshold settings.

[0067] In one alternative approach, when the sampling layer corrects the probability distribution of the candidate tokens, it further includes: Before the Softmax normalization operation, the Logits weights of the candidate tokens are dynamically adjusted. The dynamic adjustment includes multiplying the weights of high-risk tokens by a decay coefficient less than 1 and multiplying the weights of compliant tokens by a gain coefficient greater than 1.

[0068] In the above-mentioned optional methods, the weights of candidate tokens Logits are further dynamically adjusted before Softmax normalization, and a decay coefficient is applied to high-risk tokens and a gain coefficient is applied to compliant tokens. Without truncating the generation stream, the probability distribution is smoothly corrected so that the output gradually returns to the compliant direction, avoiding abrupt rejection that disrupts the continuity of the dialogue.

[0069] In this embodiment, as Figure 2 As shown, during the session initialization phase, after receiving a user request, the gateway parses the corresponding session scenario and the user's historical risk level. It then categorizes the scenarios based on the session scenario, including medical, financial, and general scenarios. Based on the classification results, it loads matching security anchor templates: a medication dosage specification anchor template for medical scenarios, an investment risk warning anchor template for financial scenarios, and a general harmful content constraint template for general scenarios. The security anchor template is then concatenated with the scenario-specific constraint content to generate complete security anchor text. This security anchor text is injected into the model prompt layer, where it is assigned the highest execution priority. The starting storage index corresponding to the security anchor text is locked in the key-value cache as the storage range for the security anchor text. The security anchor text's... The checksum is then stored along with the original secure anchor text in a separate secure storage area. Session initialization is complete; the system awaits user input.

[0070] like Figure 3 As shown, during the round-by-round token generation process of the large language model, when a single-step token is generated, the backbone Transformer network outputs Logits, and the risk score of the current candidate token is synchronously calculated by the security classification Head, which is mounted in parallel on the backbone Transformer network. Simultaneously, the cosine similarity between the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text is calculated to obtain the consistency index. .in accordance with and A tiered intervention assessment is conducted. The assessment determines whether the red-line hard-block procedure has been triggered; the triggering conditions are as follows: Exceeding the red threshold Or a checksum mismatch. When the red line is triggered, perform a key-value cache rollback operation, delete recently generated tokens that violated regulations, globally replace the sampling vocabulary with a fallback compliance template, output the fallback text, and terminate the current generation round. If the red line is not triggered, determine whether the yellow line soft-guided process has been triggered; the triggering condition is... Exceeding the yellow threshold But not exceeding ,or Below the set threshold When the yellow line is triggered, the Logits weights of candidate tokens are dynamically adjusted at the sampling layer. High-risk tokens are weighted by a decay coefficient less than 1 to reduce their probability, while compliant tokens are weighted by a gain coefficient greater than 1 to increase their probability. Then, standard Softmax normalization and Top-K sampling are performed, the current secure token is output, and the next round of token generation begins. When the yellow line is not triggered, standard Softmax normalization and Top-K sampling are performed directly, the current secure token is output, and the next round of token generation begins.

[0071] like Figure 4 As shown, in the complete storage partition of the key-value cache, the general basic security boundary constraints and the original anchor points... The checksum and physical write protection together constitute an overwrite-proof area. Physical write protection prevents user tokens from overwriting anchor points. The checksum is bound to the storage area for verification, ensuring the integrity and immutability of anchor constraints during the dialogue process. During the dialogue flow, new user topic input is continuously received. A domain semantic classifier identifies scene changes. When a scene change is detected, a domain-specific constraint token corresponding to the changed scene is loaded and appended to the end of the key-value cache. This appending process does not overwrite the original secure anchor text. The hash checksum of all anchors is recalculated and stored in an independent secure storage area, dynamically tightening the security boundary according to the dialogue scenario. Simultaneously, an anchor anti-tampering protection mechanism is activated. User input undergoes preprocessing and overwrite detection. When user input contains instructions to tamper with or delete anchor points, a rejection token is injected into the append constraint storage area to block the generation process. When an anchor tampering or deletion attack is detected, the generation process is blocked. If no attack is detected, the normal dialogue continues. The specific compliance rules for medical scenarios and the specific compliance rules for financial scenarios correspond to the additional constraints for their respective scenarios, which together with the general basic security boundary constraints constitute a multi-level security defense system.

[0072] In another embodiment of the intrinsic security defense-in-depth method of anchor point constraint and process monitoring of the present invention, a medical consultation scenario is used as an example for specific explanation.

[0073] In medical consultation scenarios, the large language model is deployed on online consultation platforms to provide users with medication advice and health consultations. The platform pre-builds an anchor template library, which stores medication dosage guidelines for medical scenarios, investment risk warnings for financial scenarios, and harmful content restrictions for general scenarios. Each scenario's constraint text is configured with a corresponding fallback response template. The platform also pre-builds an offline dataset containing compliant and non-compliant samples from medical scenarios. Red and yellow thresholds are iteratively calibrated using this offline dataset, and the set thresholds are associated with the yellow threshold configuration.

[0074] When an online consultation platform receives a user request, it retrieves the request and parses the corresponding session scenario and the user's historical risk level. For example, if the user request is "Please recommend an antipyretic for an adult," the parsed session scenario is a medical scenario, and the user's historical risk level is low. Based on the session scenario and the user's historical risk level, a matching safety anchor template is loaded from the anchor template library. This safety anchor template is then concatenated with scenario-specific constraints to generate safety anchor text. For example, a medical scenario safety anchor template might contain dosage guidelines such as "Dosage must not exceed the standard dosage range" and "Prescription drugs must not be recommended," with scenario-specific constraints including "A single dose of acetaminophen for adults should not exceed 500 mg" and "The total daily dose should not exceed 2000 mg." The resulting safety anchor text would be "Dosage must not exceed the standard dosage range," "Prescription drugs must not be recommended," "A single dose of acetaminophen for adults should not exceed 500 mg," and "The total daily dose should not exceed 2000 mg."

[0075] Inject the secure anchor text into the prompt layer, lock the storage area of ​​the secure anchor text in the key-value cache, calculate the checksum of the secure anchor text, and store the checksum and the secure anchor text in the storage area. The checksum uses... The algorithm calculates that the storage area is an independent secure storage area, physically isolated from the key-value cache. When injecting secure anchor text into the prompt layer, the secure anchor text is given higher execution priority than the user input command, and physical write protection is applied to the storage area when locking it in the key-value cache, preventing user tokens from overwriting the secure anchor text in the storage area.

[0076] When generating candidate tokens round-by-round using the large language model, the risk scores of the candidate tokens are calculated in parallel, and the consistency index between the generated sequences and the security anchor text is also calculated. During the parallel calculation of the candidate token risk scores, after the backbone Transformer network of the large language model outputs Logits, the security classification Head, which is concurrently mounted on the backbone Transformer network, outputs the risk score. The security classification head shares the forward computation process with the backbone Transformer network. When calculating the consistency metric, the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text are used to calculate the cosine similarity to obtain the consistency metric. The value represents the degree of deviation between the currently generated trajectory and the safety boundary defined by the safety anchor text.

[0077] When risk score If the red threshold is exceeded or the checksum in the storage area does not match, a key-value cache rollback operation is performed to delete recently generated tokens, and a fallback template is used to output the text. When the risk score... Exceeding the yellow threshold but not exceeding the red threshold, or the consistency index When the value is below a set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, reducing the weight of high-risk tokens and increasing the weight of compliant tokens, and the current token is output. When correcting the probability distribution of candidate tokens at the sampling layer, the Logits weights of candidate tokens are dynamically adjusted before the Softmax normalization operation. The dynamic adjustment includes multiplying the weight of high-risk tokens by a decay coefficient less than 1 and multiplying the weight of compliant tokens by a gain coefficient greater than 1.

[0078] During the dialogue flow, when a scene change is detected, a specific constraint token corresponding to the changed scene is loaded. This specific constraint token is appended to the end of the key-value cache, and the checksum of all anchors is recalculated and stored in the storage area. For example, when a user switches from a general consultation to pediatric medication, the loaded specific constraint token is "children's dosage is calculated based on weight" and "not exceeding 15 mg per kilogram," which is appended to the end of the key-value cache without overwriting the original security anchor text. Simultaneously, preprocessing and overlay detection are performed on user input. When user input is detected to contain instructions to tamper with or delete anchors, a rejection token is injected to block the generation process.

[0079] Figure 5 This diagram illustrates a structural schematic of an embodiment of an intrinsic security defense-in-depth system 200 based on anchor point constraints and process monitoring provided by the present invention. Figure 5 As shown, the intrinsic security defense-in-depth system 200 with anchor point constraints and process monitoring includes: Processing module 201 is used to obtain user requests, parse the session scenario and user historical risk level corresponding to the user requests, load a matching security anchor template according to the session scenario and user historical risk level, and concatenate the security anchor template with scenario-specific constraint content to generate security anchor text. The injection module 202 is used to inject the security anchor text into the prompt layer, lock the storage area of ​​the security anchor text in the key-value cache, calculate the checksum of the security anchor text, and store the checksum and the security anchor text in the storage area. The calculation module 203 is used to calculate the risk score of the candidate token in parallel when calling the large language model to generate candidate tokens round by round, and to calculate the consistency index between the generated sequence and the security anchor text. Output module 204 is used to perform a key-value cache rollback operation to delete recently generated tokens and output text using a fallback template when the risk score exceeds the red threshold or the checksum in the storage area does not match; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, the weight of high-risk tokens is reduced and the weight of compliant tokens is increased, and the current token is output. The execution module 205 is used to, during the dialogue flow process, when a scene change is detected, load a special constraint token corresponding to the changed scene, append the special constraint token to the end of the key-value cache, recalculate the checksum of all anchor points, and store the recalculated checksum in the storage area; and, when the user input contains instructions to tamper with or delete anchor points, inject a rejection token to block the generation process.

[0080] In an alternative embodiment, the injection module 202 is further configured to: The security anchor text is given a higher execution priority than the user input command, and physical write protection is applied to the storage area when the storage area is locked in the key-value cache, preventing the user token from overwriting the security anchor text in the storage area.

[0081] In one alternative approach, the checksum employs... The algorithm calculates that the storage area is an independent secure storage area, which is physically isolated from the key-value cache. The checksum stored in the storage area is used to compare with the checksum calculated in real time.

[0082] In an alternative embodiment, the computing module 203 is further configured to: After the backbone Transformer network of the large language model outputs Logits, the risk score is output by the safety classification Head that is mounted in parallel on the backbone Transformer network. The safety classification Head shares the forward computation process with the backbone Transformer network.

[0083] In one alternative approach, when calculating the consistency index, the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text are subjected to cosine similarity calculation to obtain the value of the consistency index. The value of the consistency index represents the degree of deviation between the currently generated trajectory and the security boundary defined by the security anchor text.

[0084] In one alternative approach, the red threshold and the yellow threshold are obtained through iterative calibration using an offline dataset containing compliant and non-compliant samples from various scenarios. The set threshold is configured in association with the yellow threshold, and yellow line intervention is triggered when the consistency index falls below the set threshold.

[0085] In an alternative embodiment, the output module 204 is further configured to: Before the Softmax normalization operation, the Logits weights of the candidate tokens are dynamically adjusted. The dynamic adjustment includes multiplying the weights of high-risk tokens by a decay coefficient less than 1 and multiplying the weights of compliant tokens by a gain coefficient greater than 1.

[0086] It should be noted that the beneficial effects of the intrinsic security defense-in-depth system 200 with anchor point constraints and process monitoring provided in the above embodiments are the same as those of the intrinsic security defense-in-depth method with anchor point constraints and process monitoring, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0087] The intrinsic security defense-in-depth system 200 of anchor point constraint and process monitoring of the present invention can be a computer program (including program code) running on a computer device. For example, the intrinsic security defense-in-depth system 200 of anchor point constraint and process monitoring of the present invention is an application software that can be used to execute the corresponding steps in the intrinsic security defense-in-depth method of anchor point constraint and process monitoring of the present invention.

[0088] In some embodiments, the intrinsic security defense-in-depth system 200 of anchor point constraint and process monitoring of the present invention can be implemented in a combination of hardware and software. As an example, the intrinsic security defense-in-depth system 200 of anchor point constraint and process monitoring of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the intrinsic security defense-in-depth method of anchor point constraint and process monitoring of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0089] The modules described in the embodiments of this invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0090] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned anchor point constraints and process monitoring intrinsic security defense-in-depth methods. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the anchor point constraints and process monitoring intrinsic security defense-in-depth method shown in any embodiment of the present invention by calling the computer program.

[0091] In one alternative embodiment, an electronic device is provided, such as Figure 6 As shown, Figure 6 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0092] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0093] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0094] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0095] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0096] Among them, electronic devices can also be terminal devices. A terminal device can be any terminal device that can install applications and access web pages through applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0097] It should be noted that, Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0098] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the intrinsic security defense-in-depth method for any of the aforementioned anchor point constraints and process monitoring.

[0099] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0100] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned intrinsic security defense-in-depth method of anchor constraint and process monitoring.

[0101] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0102] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0103] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0104] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0105] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0106] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0107] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0108] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An intrinsic security defense-in-depth method based on anchor point constraints and process monitoring, characterized in that, include: Obtain user requests, parse the session scenario and user historical risk level corresponding to the user requests, load matching security anchor templates according to the session scenario and user historical risk level, and concatenate the security anchor templates with scenario-specific constraint content to generate security anchor text; The secure anchor text is injected into the prompt layer, the storage area of ​​the secure anchor text is locked in the key-value cache, the checksum of the secure anchor text is calculated, and the checksum and the secure anchor text are stored in the storage area. When calling the large language model to generate candidate tokens round by round, the risk score of the candidate tokens is calculated in parallel, and the consistency index between the generated sequence and the security anchor text is calculated. When the risk score exceeds the red threshold or the checksum in the storage area does not match, a key-value cache rollback operation is performed to delete recently generated tokens, and a fallback template is used to output text; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, the weight of high-risk tokens is reduced and the weight of compliant tokens is increased, and the current token is output. During the dialogue flow, when a scene change is detected, a special constraint token corresponding to the changed scene is loaded, the special constraint token is appended to the end of the key-value cache, and the checksum of all anchor points is recalculated. The recalculated checksum is then stored in the storage area. Additionally, when a user input is detected to contain instructions to tamper with or delete anchor points, a rejection token is injected to block the generation process.

2. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 1, characterized in that, When injecting the security anchor text into the prompt layer, the method further includes: The security anchor text is given a higher execution priority than the user input command, and physical write protection is applied to the storage area when the storage area is locked in the key-value cache, preventing the user token from overwriting the security anchor text in the storage area.

3. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 2, characterized in that, The checksum is adopted The algorithm calculates that the storage area is an independent secure storage area, which is physically isolated from the key-value cache. The checksum stored in the storage area is used to compare with the checksum calculated in real time.

4. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 1, characterized in that, The process of calculating the risk score of the candidate tokens in parallel also includes: After the backbone Transformer network of the large language model outputs Logits, the risk score is output by the safety classification Head that is mounted in parallel on the backbone Transformer network. The safety classification Head shares the forward computation process with the backbone Transformer network.

5. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 4, characterized in that, When calculating the consistency index, the semantic vector corresponding to the generated token sequence and the boundary vector corresponding to the security anchor text are subjected to cosine similarity calculation to obtain the value of the consistency index. The value of the consistency index represents the degree of deviation between the current generated trajectory and the security boundary defined by the security anchor text.

6. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 1, characterized in that, The red threshold and the yellow threshold are obtained through iterative calibration using an offline dataset. The offline dataset contains compliant and non-compliant samples in various scenarios. The set threshold is configured in association with the yellow threshold. When the consistency index is lower than the set threshold, yellow line intervention is triggered.

7. The intrinsic security defense-in-depth method based on anchor point constraints and process monitoring according to claim 1, characterized in that, When correcting the probability distribution of the candidate tokens at the sampling layer, the method further includes: Before the Softmax normalization operation, the Logits weights of the candidate tokens are dynamically adjusted. The dynamic adjustment includes multiplying the weights of high-risk tokens by a decay coefficient less than 1 and multiplying the weights of compliant tokens by a gain coefficient greater than 1.

8. An intrinsic security defense-in-depth system based on anchor point constraints and process monitoring, characterized in that, include: The processing module is used to obtain user requests, parse the session scenario and user historical risk level corresponding to the user requests, load a matching security anchor template according to the session scenario and user historical risk level, and concatenate the security anchor template with scenario-specific constraint content to generate security anchor text. The injection module is used to inject the security anchor text into the prompt layer, lock the storage area of ​​the security anchor text in the key-value cache, calculate the checksum of the security anchor text, and store the checksum and the security anchor text in the storage area. The calculation module is used to calculate the risk score of the candidate tokens in parallel when calling the large language model to generate candidate tokens round by round, and to calculate the consistency index between the generated sequence and the security anchor text. The output module is used to perform a key-value cache rollback operation to delete recently generated tokens and output text using a fallback template when the risk score exceeds the red threshold or the checksum in the storage area does not match; when the risk score exceeds the yellow threshold but does not exceed the red threshold, or the consistency index is lower than the set threshold, the probability distribution of candidate tokens is corrected at the sampling layer, the weight of high-risk tokens is reduced and the weight of compliant tokens is increased, and the current token is output. The execution module is used to, during the dialogue flow process, identify when a scene change is detected, load a special constraint token corresponding to the changed scene, append the special constraint token to the end of the key-value cache, recalculate the checksum of all anchor points, and store the recalculated checksum in the storage area; and, when the user input is detected to contain instructions to tamper with or delete anchor points, inject a rejection token to block the generation process.

9. An electronic device, characterized in that, The electronic device includes a processor coupled to a memory, the memory storing at least one computer program, which is loaded and executed by the processor to enable the electronic device to implement the intrinsic security defense-in-depth method of anchor point constraint and process monitoring as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which, when executed by a processor, implements the intrinsic security defense-in-depth method for anchor point constraints and process monitoring as described in any one of claims 1 to 7.

Images