Large language model jailbreaking attack data source selection method, system, medium, terminal and program product based on defense utility and contribution attribution

Abstract

The application provides a large language model escape attack data source selection method and system based on defense utility and contribution attribution, a medium, a terminal and a program product. The method comprises the following steps: obtaining an attack data source set and constructing a plurality of attack data source subsets; calculating corresponding defense utility values based on the attack data source subsets; attributing the contributions of each attack data source based on the defense utility values to obtain a defense utility gain value set of each attack data source, and performing weighted average calculation to obtain a contribution value of each attack data source; determining a candidate search set based on the contribution value of each attack data source and a preset attack subset budget, constructing a plurality of candidate attack data source subsets based on the candidate search set, and searching a target attack data source subset from the plurality of candidate attack data source subsets based on a proxy defense utility value. The application can reduce the number of real defense utility queries and reduce the model training, reasoning and evaluation costs.

Description

Technical Field

[0001] This application relates to the field of large language model technology, and in particular to a method, system, medium, terminal and program product for selecting data sources for jailbreak attacks based on large language model defense utility and contribution attribution. Background Technology

[0002] Large language models are vulnerable to jailbreak attacks in practical applications, such as gradient-based adversarial input, prompt injection, and black-box input rewriting, posing serious content security risks. Existing jailbreak attack research typically uses attacker-centric metrics to evaluate attack methods, such as attack success rate, attack transferability, generality, and the computational cost required by the attacker. While these metrics measure the destructive power of an attack on an undefended model from the attacker's perspective, they do not directly answer the key question in security protection scenarios: which attack data sources are most helpful in constructing defense data, training or configuring defense strategies, and ultimately improving the robustness of large language models in subsequent security evaluations. In the security protection process of large language models, jailbreak attack samples should not only be used as testing tools but also as red team data sources for adversarial training, contextual defense, rule updates, or classifier improvement. However, since there may be redundant relationships between different attack categories, that is, two attacks may expose similar failure modes and have small marginal benefits when used together; there may also be complementary relationships, that is, multiple attack categories with mediocre individual effects can cover more model weaknesses when combined. Therefore, it is difficult to select the most effective subset of attacks from the defender's perspective with limited training budget, testing budget or context budget by ranking them solely based on the attack success rate or single-point utility of a single attack from the attacker's perspective.

[0003] The main technical challenges this task may face are as follows. First, the large language model security defense process that can be practically applied in industry often involves multiple factors such as the target model, attack data construction method, defense algorithm, test set, over-rejection evaluation, and utility function, making this task itself heterogeneous in different scenarios. At the same time, this process is highly likely to be black-box or proprietary, making its internal mechanisms difficult to analyze. Finally, if a complete defense and evaluation process is executed for each attack subset, it requires significant model invocation, training, and testing costs. As the number of candidate attacks increases, the total computational overhead will explode, growing exponentially. Therefore, there is an urgent need for a jailbreak attack data source attribution and subset selection method for defenders. This method should be able to adaptively and automatically evaluate the contribution of each attack category to downstream defense utility under heterogeneous and proprietary real-world settings, given the limited availability of subset utility observations, and select the attack subset that can improve the security of the large language model within a given budget. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a method, system, medium, terminal and program product for selecting data sources for jailbreak attacks based on a large language model of defense utility and contribution attribution, so as to solve the above-mentioned problems existing in the prior art.

[0005] To achieve the above and other related objectives, a first aspect of this application provides a method for selecting data sources for jailbreak attacks on large language models based on defense effectiveness and contribution attribution. The method includes: acquiring a set of attack data sources and constructing several subsets of attack data sources based on the set of attack data sources; defending a preset large language model based on the subsets of attack data sources to obtain a defended large language model; testing the defended large language model based on preset jailbreak test data and over-rejection test data and recording the corresponding attack success rate and over-rejection rate; and calculating the defense effectiveness corresponding to the subsets of attack data sources based on the attack success rate and over-rejection rate. The defense utility value of each subset of attack data sources is used to attribute the contribution of each attack data source in the attack data source set to obtain a set of defense utility gain values ​​for each attack data source. A weighted average of the defense utility gain values ​​is then calculated to obtain the contribution value of each attack data source. A candidate search set is determined based on the contribution value of each attack data source and a preset attack subset budget. Several candidate attack data source subsets are constructed based on the candidate search set. Based on the proxy defense utility value, a target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value is searched among the several candidate attack data source subsets.

[0006] In some embodiments of the first aspect of this application, the specific process of calculating the defense utility value corresponding to the subset of attack data sources based on the attack success rate and the over-rejection rate includes: normalizing the attack success rate and the over-rejection rate respectively, and performing a weighted calculation on the normalized attack success rate and the over-rejection rate according to a preset weight to obtain the defense utility value corresponding to the subset of attack data sources; wherein the defense utility value is negatively correlated with the attack success rate and the over-rejection rate.

[0007] In some embodiments of the first aspect of this application, the specific process of attributing the contribution of each attack data source in the attack data source set based on the defense utility value of each subset of attack data sources includes: for any attack data source, obtaining a first subset of attack data sources that does not contain the attack data source and a second subset of attack data sources that includes the attack data source on the basis of the first subset of attack data sources; calculating the difference between the defense utility value of the second subset of attack data sources and the defense utility value of the first subset of attack data sources and using it as the defense utility gain value of the attack data source in the context of the first subset of attack data sources; repeatedly calculating the defense utility gain value of the attack data source in multiple different subsets of attack data sources to form a set of defense utility gain values ​​of the attack data source.

[0008] In some embodiments of the first aspect of this application, the specific process of determining the candidate search set based on the contribution value of each attack data source and the preset attack subset budget includes: sorting each attack data source in the attack data source set from high to low based on the contribution value of each attack data source to obtain a sorted attack data source queue; selecting a number of attack data sources ranked at the top of the attack data source set as a candidate search set according to the sorted attack data source queue; wherein the number of attack data sources in the candidate search set is greater than the preset attack subset budget and less than or equal to the total number of attack data sources in the attack data source set.

[0009] In some embodiments of the first aspect of this application, the proxy defense utility value of the plurality of candidate attack data source subsets is calculated, and the process of searching for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value based on the proxy defense utility value includes: training a proxy defense utility model based on the attack data source subsets in the candidate search set that have obtained defense utility values; predicting the proxy defense utility value of the attack data source subsets in the candidate search set that have not performed defense through the proxy defense utility model; and searching for the target attack data source subset that satisfies the preset attack subset budget and has the largest defense utility value and / or the largest proxy defense utility value in the candidate search set based on the defense utility value and / or the proxy defense utility value.

[0010] In some embodiments of the first aspect of this application, the process of constructing a plurality of attack data source subsets based on the attack data source set specifically includes: selecting different numbers and combinations of attack data sources from the attack data source set according to a preset sampling strategy to construct a plurality of attack data source subsets; wherein, the preset sampling strategy includes one or more of random sampling, hierarchical sampling, balanced sampling by attack type, hierarchical sampling by attack success rate, and hierarchical sampling by historical defense effectiveness.

[0011] To achieve the above and other related objectives, a second aspect of this application provides a large language model jailbreak attack data source selection system based on defense utility and contribution attribution. The system includes: a data acquisition module, used to acquire an attack data source set and construct several attack data source subsets based on the attack data source set; and a utility observation module, used to defend against a preset large language model based on the attack data source subsets to obtain a defended large language model, and to test the defended large language model based on preset jailbreak test data and over-rejection test data, recording the corresponding attack success rate and over-rejection rate, and calculating the defense corresponding to the attack data source subset based on the attack success rate and over-rejection rate. The system includes a defense utility value module and a contribution attribution module. The contribution attribution module is used to attribute the defense utility value of each attack data source in the attack data source set to each attack data source, thereby obtaining a set of defense utility gain values ​​for each attack data source. A weighted average of these defense utility gain values ​​is then calculated to obtain the contribution value of each attack data source. A subset selection module is used to determine a candidate search set based on the contribution values ​​of each attack data source and a preset attack subset budget. Based on the candidate search set, several candidate attack data source subsets are constructed. Then, based on the defense utility value, a target attack data source subset that satisfies the preset attack subset budget and has the largest defense utility value is searched among these candidate attack data source subsets.

[0012] To achieve the above and other related objectives, a third aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution.

[0013] To achieve the above and other related objectives, a fourth aspect of this application provides a computer program product comprising computer program code that, when executed on a computer, causes the computer to implement the large language model jailbreak attack data source selection method based on defensive utility and contribution attribution.

[0014] To achieve the above and other related objectives, a fifth aspect of this application provides an electronic terminal, including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution.

[0015] As described above, the method, system, medium, terminal, and program products for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution proposed in this application have the following beneficial effects:

[0016] This application uses the comprehensive performance of the defended large language model in jailbreak and over-denial tests as the evaluation criterion for attack data sources. Compared with evaluating attack data sources solely based on attack success rate, this approach more accurately reflects the actual contribution of attack data sources to downstream security protection. Furthermore, this application attributes the contribution of each attack data source to different subsets of attack data sources based on their defense utility values. This quantifies the marginal defense utility gain of each attack data source in different combined contexts, thereby identifying potential redundant and complementary relationships between attack data sources. Further, this application uses contribution values ​​to determine a candidate search set and searches for the target attack data source subset that satisfies budget constraints and has the highest defense utility within the candidate search set based on proxy defense utility values. This avoids the combined utility bias caused by simply selecting the top K attack data sources according to contribution values. In addition, predicting the defense utility of unobserved attack data source subsets through a proxy defense utility model reduces the number of full defense and security evaluations, lowers model training, inference, and evaluation costs, and improves the jailbreak attack defense effect and normal request availability of the large language model under limited attack data source budget, training budget, or context budget conditions. Attached Figure Description

[0017] Figure 1 The diagram shows a flowchart of a method for selecting data sources for jailbreak attacks based on a large language model of defense utility and contribution attribution, as described in one embodiment of this application.

[0018] Figure 2 The diagram shown is a structural schematic of a jailbreak attack data source selection system based on defense utility and contribution attribution in one embodiment of this application.

[0019] Figure 3 The diagram shown is a structural schematic of an electronic terminal according to an embodiment of this application. Detailed Implementation

[0020] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0021] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" do not necessarily imply that they are different.

[0022] It should be noted that, in the embodiments of this application, the words "exemplary" or "for example" indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0023] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0024] Before providing a further detailed description of the present invention, the nouns and terms used in the embodiments of the present invention are explained, and the nouns and terms used in the embodiments of the present invention are subject to the following interpretations:

[0025] <1> Jailbreak attacks: These are attack methods that induce large language models to bypass security policies and output illegal, unsafe, or restricted content by constructing specific prompts, dialogue contexts, or input variations.

[0026] <2> Red team attack: A testing behavior that actively simulates malicious input, abnormal requests, or evasion strategies from the perspective of an attacker or tester to discover security vulnerabilities in large language models.

[0027] <3> Defensive efficacy: The overall improvement in jailbreak resistance, correct rejection capability, and normal request availability achieved by the large language model after using a subset of attack data sources for defense or security configuration.

[0028] <4> Proxy defense utility model: A prediction model trained based on a subset of observed attack data sources and their defense utility values, used to estimate the defense utility of attack data sources that have not been truly trained or evaluated.

[0029] <5> Large Language Model: An artificial intelligence model trained on large-scale text data that can understand and generate natural language content and perform tasks such as question answering, dialogue, reasoning, and summarizing.

[0030] To facilitate understanding of the embodiments of this application, firstly, in conjunction with Figure 1 Detailed explanation. Figure 1 This document illustrates a flowchart of a method for selecting data sources for large language model jailbreak attacks based on defense utility and contribution attribution, as described in an embodiment of the present invention. The method for selecting data sources for large language model jailbreak attacks based on defense utility and contribution attribution in this embodiment mainly includes the following steps:

[0031] Step S11: Obtain the attack data source set and construct several attack data source subsets based on the attack data source set.

[0032] It should be noted that the set of attack data sources can be represented as A={a1, a2, ..., an}, where each attack data source ai represents a jailbreak attack algorithm, a type of jailbreak attack method, a red team attack dataset, or a set of jailbreak attack samples generated by a specific attack strategy.

[0033] Specifically, the attack data source may include one or more of the following: attack data source based on prompt injection, attack data source based on role-playing inducement, attack data source based on black-box rewriting, adversarial input data source based on gradient optimization, attack data source based on multi-turn dialogue inducement, attack data source based on encoding bypass, attack data source based on semantic deformation, and attack data source based on context-hiding instructions. Each attack data source may contain multiple jailbreak attack prompts, attack requests, attack dialogue samples, or attack response records.

[0034] In one embodiment of this application, the process of constructing a plurality of attack data source subsets based on the attack data source set specifically includes: selecting different numbers and combinations of attack data sources from the attack data source set according to a preset sampling strategy to construct a plurality of attack data source subsets; wherein, the preset sampling strategy includes one or more of random sampling, tiered sampling, balanced sampling by attack type, tiered sampling by attack success rate, and tiered sampling by historical defense effectiveness.

[0035] It should be noted that when the number of attack data sources in the attack data source set is large, performing defense and effectiveness evaluation on all possible combinations of attack data sources will lead to an exponential increase in training and testing costs with the number of attack data sources. Therefore, this embodiment does not exhaustively list all subsets of attack data sources, but instead extracts several representative subsets of attack data sources from the attack data source set according to a preset sampling strategy.

[0036] Specifically, the constructed subset of attack data sources can contain different numbers of attack data sources, such as a single-source subset containing one attack data source, a dual-source subset containing two attack data sources, or a multi-source subset containing three or more attack data sources. By setting different numbers of attack data source subsets, the impact of different combinations of attack data sources on defense effectiveness can be observed. Furthermore, the specific attack data sources within each subset can also be different. For example, if the attack data source set includes a1, a2, a3, and a4, different combinations such as {a1, a2}, {a1, a3}, and {a2, a4} can be constructed. By constructing different combinations, potential redundancy or complementarity relationships between different attack data sources can be reflected.

[0037] Furthermore, a subset of attack data sources is randomly selected from the attack data source set to improve the coverage of the subset construction. The stratified sampling refers to first dividing the attack data sources into different levels according to dimensions such as attack type, attack intensity, attack success rate, and historical performance of defense effectiveness, and then extracting attack data sources from each level separately to avoid the sampling results being concentrated on a single type of attack data source. The balanced sampling by attack type aims to ensure that different types of jailbreak attacks have a chance to enter the attack data source subset. The stratified sampling by attack success rate divides the attack data sources into different levels according to their attack success rate and samples them separately. The stratified sampling by historical defense effectiveness refers to performing stratified sampling based on the degree of influence of attack data sources on defense effectiveness in historical defense training or evaluation.

[0038] By using the above sampling method, several representative subsets of attack data sources can be constructed under limited computational budget, enabling subsequent defense effectiveness observations to cover different attack scales, attack types, and attack combination relationships. This provides a reliable data foundation for subsequent contribution attribution, candidate search set determination, and selection of target attack data source subsets.

[0039] Step S12: Defend the preset large language model based on the subset of attack data sources to obtain the defended large language model, and test the defended large language model based on preset jailbreak test data and over-denial test data and record the corresponding attack success rate and over-denial rate, and calculate the defense utility value corresponding to the subset of attack data sources based on the attack success rate and over-denial rate.

[0040] Specifically, for any subset of attack data sources, jailbreak attack samples, attack prompts, attack dialogue samples, or attack requests corresponding to each attack data source in the subset are aggregated to construct defense data corresponding to that subset of attack data sources. The defense data may include one or more of the following: jailbreak attack input, expected security response, rejection tag, security classification tag, and risk type tag. Those skilled in the art can set these as needed; no specific limitations are made here.

[0041] Furthermore, the defense data is input into the security protection process corresponding to the preset large language model to defend the preset large language model, thereby obtaining a defended large language model. The defense may include one or more of the following: adversarial training, security instruction fine-tuning, rejection policy fine-tuning, context defense example configuration, rule updating, and classifier updating. It should be noted that different subsets of attack data sources correspond to different defense data; therefore, each subset of attack data sources can obtain a corresponding defended large language model.

[0042] Furthermore, after obtaining the defended large language model, jailbreak attacks and tests are conducted on the defended large language model based on preset jailbreak test data and over-denial test data. The preset jailbreak test data may include jailbreak attack prompts, jailbreak attack requests, attack dialogue samples, or red team test samples that are independent of the defense data, and are used to test the security protection capabilities of the defended large language model in the face of unknown jailbreak attacks. The over-denial test data includes: normal requests, compliant requests, or harmless requests. By inputting the jailbreak test data into the defended large language model, the response results output by the defended large language model for each jailbreak test sample are obtained, and the success of the corresponding jailbreak attack, whether it was correctly rejected, and whether the security protection strategy was triggered are determined based on the response results.

[0043] Furthermore, the attack success rate is determined based on the proportion of samples of illegal, insecure, or security policy-violating content output by the large language model after successfully inducing defense in the response results; and the over-rejection rate is obtained based on the proportion of incorrect rejections of normal, compliant, or harmless requests in the response results.

[0044] In one embodiment of this application, the specific process of calculating the defense utility value corresponding to the subset of attack data sources based on the attack success rate and the over-rejection rate includes: normalizing the attack success rate and the over-rejection rate respectively, and performing a weighted calculation on the normalized attack success rate and the over-rejection rate according to a preset weight to obtain the defense utility value corresponding to the subset of attack data sources; wherein, the defense utility value is negatively correlated with the attack success rate and the over-rejection rate.

[0045] First, the attack success rate and over-rejection rate are normalized by normalizing the corresponding percentage probabilities to the range of [0,1] to obtain the normalized attack success rate and the normalized over-rejection rate.

[0046] Furthermore, based on the normalized attack success rate and the normalized over-denial rate, the defense utility value of the corresponding subset of attack data sources is calculated using the following formula:

[0047] ;(Formula 1)

[0048] Among them, the The defense utility value for the attack data source subset S. The normalized attack success rate for the attack data source subset S. The normalized overrejection rate of the attack data source subset S

[0049] It should be noted that ω can be set according to the actual defense objectives, evaluation benchmarks, business scenarios, or user preferences. For example, the value of ω can be increased to make the defense utility value focus more on the model's resistance to jailbreak attacks; the value of ω can be decreased to make the defense utility value focus more on the model's availability to normal requests. ω can be a fixed weight, an empirical weight, a normalized weight, a dynamically adjusted weight, or a weight adaptively determined based on the validation set evaluation results.

[0050] Furthermore, the above formula is only used as an example to illustrate that the defense utility value can be obtained by weighting multiple security evaluation indicators, and is not intended to limit the specific values ​​of the weight parameters in the defense utility function, nor is it intended to limit ASR(S) and ORR(S) to adopt a certain fixed indicator form.

[0051] Step S13: Attribute the contribution of each attack data source in the attack data source set to the defense utility value of each subset of attack data sources, so as to obtain the set of defense utility gain values ​​of each attack data source, and calculate the weighted average of the set of defense utility gain values ​​to obtain the contribution value of each attack data source.

[0052] In one embodiment of this application, the specific process of attributing the contribution of each attack data source in the attack data source set based on the defense utility value of each subset of attack data sources includes: for any attack data source, obtaining a first subset of attack data sources that does not contain the attack data source and a second subset of attack data sources that includes the attack data source based on the first subset of attack data sources; calculating the difference between the defense utility value of the second subset of attack data sources and the defense utility value of the first subset of attack data sources and using it as the defense utility gain value of the attack data source in the context of the first subset of attack data sources; repeatedly calculating the defense utility gain value of the attack data source in multiple different subsets of attack data sources to form a set of defense utility gain values ​​of the attack data source.

[0053] First, the defense utility gain of any attack data source in the subset of attack data sources is evaluated by calculating the difference between the defense utility values ​​when the attack data source is not included and when the attack data source is included.

[0054] Specifically, for any attack data source in the attack data source set, a subset of attack data sources that does not contain that attack data source is selected as the first attack data source subset. Then, the attack data source is added to the first attack data source subset to form the second attack data source subset. The first attack data source subset represents the combination of defensive data sources without the attack data source, while the second attack data source subset represents the combination of defensive data sources after further introducing the attack data source within the same subset context.

[0055] Subsequently, the defense utility values ​​corresponding to the first subset of attack data sources and the second subset of attack data sources are obtained respectively, and the difference between them is calculated. The difference between the defense utility value of the second subset of attack data sources and the defense utility value of the first subset of attack data sources is used as the defense utility gain value of the attack data source in the context of the first subset of attack data sources. In other words, the defense utility gain value is used to represent the marginal improvement in the downstream defense utility of the large language model after adding this attack data source to the existing combination of attack data sources.

[0056] In one specific embodiment, the attack data source set is A = {a1, a2, a3, a4}. If it is necessary to calculate the defense utility gain value of attack data source a3, a first attack data source subset S1 = {a1, a2} that does not contain a3 can be selected, and a3 can be added to S1 to form a second attack data source subset S2 = {a1, a2, a3}. If the defense utility value corresponding to S1 is V(S1) and the defense utility value corresponding to S2 is V(S2), then the defense utility gain value of attack data source a3 in the context of S1 is V(S2) - V(S1).

[0057] Furthermore, to avoid bias in contribution evaluation caused by a single subset context, this embodiment repeatedly selects multiple different subsets of the first attack data source and calculates the defense utility gain value before and after adding the same attack data source, thereby forming a set of defense utility gain values ​​corresponding to the attack data source. The multiple different subsets of the first attack data source can have different numbers of attack data sources and different combinations of attack data sources, thereby reflecting the marginal defense contribution of the attack data source under different combination environments.

[0058] After obtaining the set of defense utility gain values, a weighted average of multiple defense utility gain values ​​in the set can be performed according to preset weights to obtain the contribution value of the attack data source. The contribution value characterizes the average marginal contribution of the attack data source to the defense utility under the current security protection settings. If an attack data source can bring high defense utility gain in multiple different subset contexts, it indicates that the attack data source makes a high contribution to improving the security defense effect of the large language model; if an attack data source only generates gain in a few subset contexts, or has low gain when combined with other attack data sources, it indicates that the attack data source may have redundant relationships with other attack data sources.

[0059] Through the above contribution attribution process, the impact of attack data sources on the overall defense effectiveness of the subset can be decomposed into the marginal contribution of individual attack data sources in different combination contexts. This provides a basis for subsequently determining candidate search sets based on contribution values, reducing the search space, and selecting target attack data source subsets under budget constraints.

[0060] Step S14: Determine a candidate search set based on the contribution value of each attack data source and the preset attack subset budget; construct several candidate attack data source subsets based on the candidate search set; calculate the proxy defense utility value of the several candidate attack data source subsets; and search for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value based on the proxy defense utility value among the several candidate attack data source subsets.

[0061] In one embodiment of this application, the specific process of calculating the proxy defense utility value of the plurality of candidate attack data source subsets, and searching for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value based on the proxy defense utility value in the plurality of candidate attack data source subsets, includes: sorting each attack data source in the attack data source set from high to low based on the contribution value of each attack data source to obtain a sorted attack data source queue; selecting a plurality of attack data sources with high ranking from the attack data source set as a candidate search set according to the sorted attack data source queue; wherein the number of attack data sources in the candidate search set is greater than the preset attack subset budget and less than or equal to the total number of attack data sources in the attack data source set.

[0062] Specifically, after obtaining the contribution values ​​of each attack data source in step S13, the initially obtained set of attack data sources is prioritized based on the contribution values, and sorted from high to low to obtain the sorted attack data source queue. The contribution value characterizes the average marginal contribution of the corresponding attack data source to the defense effectiveness across multiple subsets of different attack data sources. It reflects the overall importance of the attack data source in improving the defense effectiveness of the large language model under the current defense training and security evaluation conditions.

[0063] It should be noted that while the contribution value reflects the average marginal contribution of a single attack data source, it does not mean that the combined defense utility of multiple attack data sources forming a subset can be simply obtained by adding the contribution values ​​of each attack data source. This is because different attack data sources may have redundant or complementary relationships. For attack data sources with redundant relationships, the large language model security vulnerabilities they expose may be similar. When both are added to the same subset, the combined defense utility gain may be less than the sum of their contribution values. For attack data sources with complementary relationships, the jailbreak attack patterns or model vulnerabilities they cover may be different. When both are added to the same subset, the combined defense utility gain may be greater than or equal to the simple sum of their contribution values.

[0064] For example, attack data source A and attack data source B have contribution values ​​of a and b, respectively. Since a and b are the integration of the defense utility gain values ​​of their corresponding attack data sources in different subsets of attack data sources, attack data source A and attack data source B have a complementary relationship. Their total contribution value in the same subset of attack data sources is not equal to a+b. Therefore, when several subsets of attack data sources are needed, they cannot be simply selected according to the contribution values ​​from high to low. Instead, further filtering is required based on different combinations of attack data source subsets.

[0065] Furthermore, while contribution values ​​cannot be directly used as the sole criterion for selecting a subset of attack data sources for the final target, they can accurately reflect the overall contribution trend of each attack data source to the improvement of defense effectiveness. Therefore, this application uses contribution values ​​to perform preliminary screening of the attack data source set to determine the candidate search set.

[0066] Specifically, the system can select several top-ranked attack data sources from the sorted attack data source queue to form a candidate search set. The number of attack data sources in the candidate search set is greater than a preset attack subset budget and less than or equal to the total number of attack data sources in the attack data source set. This reduces the number of attack data source combinations that need to be searched and evaluated subsequently, while retaining high-contribution attack data sources and potentially effective combinations, thus lowering the computational costs of defense, model inference, and security assessment.

[0067] In one embodiment of this application, the specific process of searching the candidate search set for the target attack data source subset that satisfies the preset attack subset budget and has the largest defense utility value based on the defense utility value includes: training a proxy defense utility model based on the attack data source subsets in the candidate search set that have obtained defense utility values; predicting the proxy defense utility value of the attack data source subsets in the candidate search set that have not performed defense through the proxy defense utility model; and searching the candidate search set for the target attack data source subset that satisfies the preset attack subset budget and has the largest defense utility value and / or the largest proxy defense utility value based on the defense utility value and / or the proxy defense utility value.

[0068] Specifically, a subset of attack data sources for which defense utility values ​​have already been obtained is searched within the candidate search set, and training samples are constructed. For any observed subset of attack data sources, the subset can be encoded into a subset feature vector, and the defense utility value corresponding to the subset can be used as a supervision label to train the proxy defense utility model. The subset feature vector can be a binary vector, where each dimension corresponds to an attack data source. If the attack data source belongs to the current subset of attack data sources, the corresponding dimension is set to 1; otherwise, it is set to 0.

[0069] After the proxy defense utility model is trained, the system constructs several subsets of candidate attack data sources based on the candidate search set. For candidate attack data source subsets that have already implemented defense and obtained defense utility values, their corresponding defense utility values ​​are directly used as the evaluation criteria; for candidate attack data source subsets that have not yet implemented defense, their corresponding subset feature vectors are input into the proxy defense utility model, and the proxy defense utility model outputs the corresponding proxy defense utility values.

[0070] Subsequently, based on the proxy defense utility value, the system compares each candidate attack data source subset and searches for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value. The preset attack subset budget is used to limit the number of attack data sources in the target attack data source subset, for example, limiting the target attack data source subset to contain only K attack data sources.

[0071] Therefore, this embodiment uses a proxy defense utility model to predict the utility of a subset of unobserved attack data sources, which can reduce the number of actual defense and security assessments. While reducing computational costs, it can still find combinations of attack data sources with better defense utility in the candidate search set.

[0072] In one embodiment of this application, to verify the effectiveness of the data source selection method for jailbreak attacks based on defense utility and contribution attribution described in this application using a large language model, the following experimental verification example is constructed. The following experimental verification example is only used to illustrate the technical effects achievable by the technical solution of this application and does not constitute a limitation on the scope of protection of this application.

[0073] Experimental Verification Example 1: Correlation Verification of Attack Success Rate and Defense Effectiveness.

[0074] In this experimental verification example, multiple candidate attack data sources were selected, and the attack success rate of each candidate attack data source on the undefended large language model was calculated, along with the defense utility value obtained after constructing defense data based on a single attack data source. Subsequently, a correlation analysis was performed on the attack success rate ranking results and the defense utility ranking results.

[0075] Experimental results show that the correlation between attack success rate ranking and defense utility ranking is weak. For example, in a set of contextual defense settings, the Spearman correlation coefficient between attack success rate ranking and defense utility ranking is 0.215, and the Kendall correlation coefficient is 0.190. This indicates that attack data sources with higher attack success rates do not necessarily correspond to higher defense value; some attack data sources with lower attack success rates may actually contribute more to improving the defense utility of large language models. Therefore, selecting attack data sources solely based on attack success rate is unlikely to yield a subset of attack data sources with superior defense utility.

[0076] This experimental example demonstrates that the application uses the security effectiveness of the defended model as the evaluation target for attack data sources. Compared with simply selecting attack data sources based on attack success rate, this approach is more in line with the actual needs of large language model security protection scenarios.

[0077] Experimental Verification Example 2: Validation of the Proxy Defense Utility Model.

[0078] In this experimental verification example, several subsets of attack data sources were sampled from the attack data source set, and defense and security evaluations were performed on them respectively to obtain the defense utility value corresponding to each subset of attack data sources. Subsequently, each subset of attack data sources was encoded into a subset feature vector, and the actual defense utility value was used as a supervision label to train the proxy defense utility model.

[0079] Experimental results show that when the number of real defense utility observations reaches a preset number, the proxy defense utility model can predict the defense utility values ​​of unobserved attack data source subsets relatively stably. For example, in a large language model adversarial training setting, when the number of real subset utility observations is approximately 150 to 200, the prediction performance of the proxy defense utility model tends to stabilize.

[0080] This experimental example demonstrates that this application can train a proxy defense utility model with a limited number of defense utility observations, thereby reducing the need for real defense and security evaluation of a subset of all attack data sources and lowering training, inference, and evaluation costs.

[0081] Experimental Verification Example 3: Verification of the effect of selecting a subset of target attack data sources under budget constraints.

[0082] In this experimental verification example, given a preset attack subset budget K, the method of this application and several baseline methods are used to select the attack data source subset. The baseline methods include one or more of the following: random selection, selection based on attack success rate, empty set context marginal utility ranking method, and full set context marginal loss ranking method.

[0083] Experimental results, as shown in the table below, demonstrate that the proposed method achieves high defense effectiveness under different attack subset budgets. For example, in a set of context defense settings, when the preset attack subset budget K=2, the defense effectiveness value corresponding to the target attack data source subset selected by the proposed method is 85.39; when the preset attack subset budget K=4, the defense effectiveness value corresponding to the target attack data source subset selected by the proposed method is 93.97, both higher than the defense effectiveness values ​​corresponding to the attack data source subsets obtained by the baseline method mentioned above.

[0084] Table 1. Comparison of defensive utility values ​​under different attack subset budgets

[0085] method K=2 K=4 RANDOM 61.38 53.42 TOPK-ASR 57.16 86.13 TOPK-AOO 53.79 54.48 TOPK-LOO 64.47 56.16 This application 85.39 93.97

[0086] Where K represents different subset budgets, RANDOM represents the random selection method, TOPK-ASR represents the Top-K selection method based on attack success rate, TOPK-AOO represents calculating the defense utility gain of a single attack data source relative to the empty set and selecting the top K gain values, and TOPK-LOO represents removing an attack data source from the entire set, calculating the defense utility decrease value, and selecting the top K decrease values.

[0087] This experimental example demonstrates that this application does not simply select the top K attack data sources with the highest contribution values. Instead, it determines the candidate search set based on contribution values ​​and further searches for a subset of target attack data sources based on the proxy defense utility value. This approach can take into account both the average marginal contribution of attack data sources and the redundancy and complementarity relationships between different attack data sources, thereby obtaining a combination of attack data sources with better defense utility within a limited budget.

[0088] Figure 2 This is a schematic block diagram of a jailbreak attack data source selection system based on a large language model of defense utility and contribution attribution, provided in an embodiment of this application. Figure 2 As shown, the system includes a data acquisition module 201, a utility observation module 202, a contribution attribution module 203, and a subset selection module 204.

[0089] Data acquisition module 201 is used to acquire a set of attack data sources and construct several subsets of attack data sources based on the set of attack data sources;

[0090] The utility observation module 202 is used to defend against a preset large language model based on the subset of attack data sources to obtain a defended large language model, and to perform a jailbreak attack on the defended large language model based on preset jailbreak test data and record the corresponding attack success rate and over-rejection rate, and to calculate the defense utility value corresponding to the subset of attack data sources based on the attack success rate and over-rejection rate.

[0091] The contribution attribution module 203 is used to perform contribution attribution on each attack data source in the attack data source set based on the defense utility value of each subset of attack data sources, so as to obtain a set of defense utility gain values ​​of each attack data source, and to perform a weighted average calculation on the set of defense utility gain values ​​to obtain the contribution value of each attack data source.

[0092] The subset selection module 204 is used to determine a candidate search set based on the contribution value of each attack data source and the preset attack subset budget, and to search the candidate search set for the target attack data source subset that satisfies the preset attack subset budget and has the largest defense utility value based on the defense utility value.

[0093] It should be understood that the specific process of each module performing the above-mentioned steps has been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity.

[0094] It should also be understood that the module division in the embodiments of this application is illustrative and only represents a logical functional division; in actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0095] Figure 3 This is a schematic block diagram of the electronic terminal provided in an embodiment of this application. Figure 3 As shown, the electronic terminal 300 includes at least one processor 301, a memory 302, at least one network interface 303, and a user interface 305. The various components in the electronic terminal 300 are coupled together via a bus system 304. It is understood that the bus system 304 is used to implement communication between these components. In addition to a data bus, the bus system 304 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 3 The general will label all buses as bus systems.

[0096] The user interface 305 may include a monitor, keyboard, mouse, trackball, clicker, button, touchpad, or touch screen.

[0097] It is understood that memory 302 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM) or programmable read-only memory (PROM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM) and synchronous static random access memory (SSRAM). The memories described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable categories of memory.

[0098] In this embodiment of the invention, the memory 302 is used to store various types of data to support the operation of the electronic terminal 300. Examples of this data include: any executable program for operation on the electronic terminal 300, such as the operating system 3021 and application programs 3022; the operating system 3021 contains various system programs, such as the framework layer, core library layer, driver layer, etc., for implementing various basic services and handling hardware-based tasks. The application program 3022 may contain various applications, such as media players, browsers, etc., for implementing various application services. The data source selection method for jailbreak attacks based on defense utility and contribution attribution provided in this embodiment of the invention can be included in the application program 3022.

[0099] The methods disclosed in the above embodiments of the present invention can be applied to processor 301, or implemented by processor 301. Processor 301 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 301 or by instructions in the form of software. The processor 301 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 301 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. General-purpose processor 301 may be a microprocessor or any conventional processor, etc. The steps of the methods provided in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads the information in the memory and combines it with its hardware to complete the steps of the aforementioned method.

[0100] In an exemplary embodiment, the electronic terminal 300 may be used by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), or complex programmable logic devices (CPLDs) to execute the aforementioned method.

[0101] According to the method provided in the embodiments of this application, this application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to perform the method of any of the embodiments described above.

[0102] According to the method provided in the embodiments of this application, this application also provides a computer-readable storage medium storing program code, which, when run on a computer, causes the computer to perform the method of any of the embodiments described above.

[0103] As used in this specification, the terms "component," "module," "system," etc., are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0104] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0105] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0107] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0108] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0109] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. A computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0110] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] In summary, this application provides a method, system, medium, terminal, and program product for selecting data sources for jailbreak attacks based on defense utility and contribution attribution in large language models. The method includes: acquiring a set of attack data sources and constructing several subsets of attack data sources; calculating the corresponding defense utility value based on the subsets of attack data sources; performing contribution attribution on each attack data source based on the defense utility value to obtain a set of defense utility gain values ​​for each attack data source, and performing a weighted average calculation to obtain the contribution value of each attack data source; determining a candidate search set based on the contribution value of each attack data source and a preset attack subset budget; constructing several candidate attack data source subsets based on the candidate search set; and searching for the target attack data source subset from the several candidate attack data source subsets based on the proxy defense utility value. This application can reduce the number of real defense utility queries and lower the costs of model training, inference, and evaluation. Therefore, this application effectively overcomes the various shortcomings of existing technologies and has high industrial application value.

[0112] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A method for selecting data source for jailbreak attacks based on a large language model of defense utility and contribution attribution, characterized in that, include: Obtain a set of attack data sources and construct several subsets of attack data sources based on the set of attack data sources; The system defends against the preset large language model based on the subset of attack data sources to obtain the defended large language model. It then tests the defended large language model based on preset jailbreak test data and over-denial test data, records the corresponding attack success rate and over-denial rate, and calculates the defense utility value corresponding to the subset of attack data sources based on the attack success rate and over-denial rate. Based on the defense utility values ​​of each subset of attack data sources, the contribution of each attack data source in the attack data source set is attributed to obtain a set of defense utility gain values ​​for each attack data source, and a weighted average is calculated on the set of defense utility gain values ​​to obtain the contribution value of each attack data source. Based on the contribution value of each attack data source and the preset attack subset budget, a candidate search set is determined. Several candidate attack data source subsets are constructed based on the candidate search set, and the proxy defense utility value of the several candidate attack data source subsets is calculated. Based on the proxy defense utility value, the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value is searched among the several candidate attack data source subsets.

2. The method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution as described in claim 1, characterized in that, The specific process of calculating the defense utility value corresponding to the subset of attack data sources based on the attack success rate and over-denial rate includes: The attack success rate and over-rejection rate are normalized respectively, and the normalized attack success rate and over-rejection rate are weighted according to preset weights to obtain the defense utility value corresponding to the attack data source subset; wherein, the defense utility value is negatively correlated with the attack success rate and the over-rejection rate.

3. The method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution as described in claim 1, characterized in that, The specific process of attributing the contribution of each attack data source in the attack data source set based on the defense utility value of each subset of attack data sources includes: For any attack data source, obtain a first subset of attack data sources that does not contain the attack data source and a second subset of attack data sources that adds the attack data source to the first subset of attack data sources; Calculate the difference between the defense utility value of the second attack data source subset and the defense utility value of the first attack data source subset, and use it as the defense utility gain value of the attack data source in the context of the first attack data source subset; The defense utility gain value of the attack data source is repeatedly calculated in multiple different subsets of attack data sources to form a set of defense utility gain values ​​of the attack data source.

4. The method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution as described in claim 1, characterized in that, The specific process of determining the candidate search set based on the contribution values ​​of each attack data source and the preset attack subset budget includes: The attack data sources in the attack data source set are sorted from high to low based on their contribution values ​​to obtain the sorted attack data source queue. Based on the sorted attack data source queue, select a number of attack data sources that rank highly from the attack data source set as a candidate search set; wherein the number of attack data sources in the candidate search set is greater than the preset attack subset budget and less than or equal to the total number of attack data sources in the attack data source set.

5. The method for selecting data source for jailbreak attacks based on large language models of defense utility and contribution attribution as described in claim 1, characterized in that, The specific process of calculating the proxy defense utility value of the plurality of candidate attack data source subsets, and searching for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value based on the proxy defense utility value among the plurality of candidate attack data source subsets, includes: Train a proxy defense utility model based on a subset of attack data sources from the candidate search set that have already obtained defense utility values; The proxy defense utility model is used to predict the proxy defense utility value of the subset of attack data sources in the candidate search set. Based on the proxy defense utility value, search the candidate search set for a subset of target attack data sources that meets the preset attack subset budget and has the largest proxy defense utility value.

6. The method for selecting data sources for jailbreak attacks based on large language models of defense utility and contribution attribution as described in claim 1, characterized in that, The process of constructing several subsets of attack data sources based on the set of attack data sources specifically includes: According to a preset sampling strategy, different numbers and combinations of attack data sources are selected from the attack data source set to construct several subsets of attack data sources; wherein, the preset sampling strategy includes one or more of random sampling, hierarchical sampling, balanced sampling by attack type, hierarchical sampling by attack success rate, and hierarchical sampling by historical defense effectiveness.

7. A data source selection system for jailbreak attacks based on a large language model of defense utility and contribution attribution, characterized in that, include: The data acquisition module is used to acquire a set of attack data sources and construct several subsets of attack data sources based on the set of attack data sources; The utility observation module is used to defend against a preset large language model based on the subset of attack data sources to obtain a defended large language model, and to test the defended large language model based on preset jailbreak test data and over-denial test data and record the corresponding attack success rate and over-denial rate, and to calculate the defense utility value corresponding to the subset of attack data sources based on the attack success rate and over-denial rate. The contribution attribution module is used to perform contribution attribution on each attack data source in the attack data source set based on the defense utility value of each subset of attack data sources, so as to obtain a set of defense utility gain values ​​for each attack data source, and to perform a weighted average calculation on the set of defense utility gain values ​​to obtain the contribution value of each attack data source. The subset selection module is used to determine a candidate search set based on the contribution value of each attack data source and a preset attack subset budget, construct several candidate attack data source subsets based on the candidate search set, calculate the proxy defense utility value of the several candidate attack data source subsets, and search for the target attack data source subset that satisfies the preset attack subset budget and has the largest proxy defense utility value based on the proxy defense utility value among the several candidate attack data source subsets.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data source selection method for jailbreak attacks based on defensive utility and contribution attribution of any one of claims 1 to 6.

9. A computer program product, characterized in that, The computer program product includes computer program code, which, when run on a computer, causes the computer to implement the data source selection method for jailbreak attacks based on a large language model of defense utility and contribution attribution as described in any one of claims 1 to 6.

10. An electronic terminal, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the large language model jailbreak attack data source selection method as described in any one of claims 1 to 6.

Images