Service replacement detection method and device, storage medium and computer device

Abstract

The application provides a service replacement detection method and device, a storage medium and a computer device. The application can not only estimate the required fixed detection number under the audit target in advance, provide the audit required budget for review for the user, but also only needs to use the visible text returned by the endpoint to be audited for replacement detection, without the model weight, token ranking, routing log, logarithmic probability and other model internal parameters and endpoint log feedback of the endpoint to be audited, thereby avoiding the problem of strict detection conditions. Moreover, by determining whether the target detection result containing the target model service exists the use of replacement, the target replacement model and the replacement ratio information, the content richness of the detection result can be effectively improved, thereby providing a data basis for the subsequent audit of the detection result.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to a method, apparatus, storage medium, and computer device for detecting service replacement. Background Technology

[0002] With the development of artificial intelligence computing, various large model services have emerged. The use of these services has gradually shifted from directly calling the Application Programming Interface (API) provided by model vendors to using intermediate endpoints such as cloud platforms, model gateways, enterprise proxy layers, resellers, or unified routing services. For example, an intermediate endpoint may declare that it provides a target model service, and when it receives a client request, it can return the result provided by the target model service.

[0003] However, in actual use, intermediate endpoints may, under the control of routing, caching, degradation, load balancing, or cost control strategies, return results from alternative model services—which are cheaper and lighter than the target model service—to client requests instead of the target model service. This results in users not receiving the expected results from the target model service, creating a model service replacement problem. Even worse, when a client initiates a large number of requests, there may be a problem where all requests return results from the alternative model service, resulting in a full replacement, or a mixed dilution problem where some requests return results from the target model service while others return results from the alternative model service.

[0004] Therefore, there is a need to detect whether the results returned by intermediate layer endpoints have been replaced. However, some existing detection methods often rely on the model internal parameters (such as model weights, log probabilities, token rankings, etc.) and endpoint logs provided by the intermediate layer endpoints to perform the detection. Moreover, they can only provide a binary result indicating whether a replacement exists, and cannot predict information such as the replacement model and replacement ratio. The detection results are limited and the required detection conditions are stringent. Summary of the Invention

[0005] In view of this, this application provides a method, apparatus, storage medium, and computer device for detecting service replacement, so as to detect the existence of model replacement and output detection results including multi-dimensional information, requiring only the visible text returned by the endpoint to be audited.

[0006] Specifically, this application is implemented through the following technical solution: Firstly, embodiments of this application provide a method for detecting service replacement. The method includes: Obtain the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stopping rules, target detection error and candidate service set; wherein, if the candidate service set is not empty, it includes at least one alternative model service related to the target model service; If the detection stopping rule is a fixed budget stop, then the first detection information calibrated for the candidate service set and the target model service based on the target detection error during the offline calibration phase is obtained; the first detection information includes a fixed number of detections under the target detection probe, a first detection threshold for each target mode, and a label fingerprint feature for each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service; Using the target detection probe, an audit request is initiated to the endpoint to be audited according to the fixed number of detections, and each first response text under the fixed number of detections is obtained; Using the fingerprint classifier trained in the offline calibration phase, the belonging probability of the first response text under each registered model service is determined, and based on the belonging probability, the anomaly score of the first response text under each registered model service is determined. Based on the anomaly score, the first detection threshold, and the tag fingerprint features, an initial detection result is determined for each of the target modes, and a target detection result is determined based on each initial detection result; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and replacement ratio information.

[0007] Secondly, embodiments of this application also provide a service replacement detection device, the device comprising: The first acquisition module is used to acquire the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stopping rules, target detection error and candidate service set; wherein, when the candidate service set is not empty, it includes at least one alternative model service related to the target model service; The second acquisition module is used to acquire, if the detection stopping rule is fixed budget stopping, first detection information calibrated for the candidate service set and the target model service based on the target detection error during the offline calibration stage; the first detection information includes a fixed number of detections under the target detection probe, a first detection threshold for each target mode, and a label fingerprint feature for each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service; The request module is used to initiate an audit request to the endpoint to be audited according to the fixed number of detections using the target detection probe, and obtain each first response text under the fixed number of detections; The first determining module is used to determine the attribution probability of the first response text under each registered model service by using the fingerprint classifier trained in the offline calibration stage, and to determine the anomaly score of the first response text under each registered model service based on the attribution probability. The second determining module is used to determine the initial detection result in each of the target modes based on the anomaly score, the first detection threshold, and the tag fingerprint features, and to determine the target detection result based on each of the initial detection results; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and replacement ratio information.

[0008] Thirdly, an optional implementation of this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the first aspect described above.

[0009] Fourthly, an optional implementation of this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the first aspect described above.

[0010] The service replacement detection method, apparatus, storage medium, and computer equipment provided in this application, by determining the first detection information for candidate service sets and target model service calibration based on the audit objectives set for the endpoint to be audited during the offline calibration stage, can achieve advance estimation of the fixed number of detections required under the audit objectives, providing users with a reviewable audit budget. Using a target detection probe, an audit request is initiated to the endpoint to be audited according to a fixed number of detections, obtaining each first response text under the fixed number of detections. Replacement detection is then performed directly using the anomaly score, first detection threshold, and tag fingerprint features of the first response text. This allows replacement detection to be performed using only the visible text returned by the endpoint to be audited, without requiring model internal parameters such as model weights, token rankings, routing logs, and log probabilities, or endpoint logs fed back by the endpoint. This avoids the problem of stringent detection conditions and can effectively adapt to various endpoints to be audited, such as cloud APIs and model gateways, achieving black-box usability. Furthermore, by determining the initial detection results under various target modes, comprehensive detection of various replacement modes (such as full replacement, mixed dilution replacement, etc.) can be achieved, improving the comprehensiveness of the detection. Furthermore, based on each initial detection result, a target detection result containing information such as whether the target model service uses replacement, the target replacement model, and the replacement ratio is determined. Compared with the binary detection results in the prior art that only indicate whether replacement has occurred, this can effectively improve the richness of the detection results and provide a data foundation for subsequent review of the detection results.

[0011] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating a service replacement detection method according to an exemplary embodiment of this application; Figure 2 This is a schematic diagram of a detection process shown in an exemplary embodiment of this application; Figure 3 This is a schematic diagram of a service replacement detection device illustrated in an exemplary embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of this application. Detailed Implementation

[0013] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0014] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0015] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0016] Research has revealed that existing methods for detecting model substitution for any auditable endpoint primarily include: verifying the consistency between the model service actually handling client requests and the declared target model service through contractual constraints, endpoint logs, or trusted execution environments; determining consistency between the model service used by the auditable endpoint and its declared target model service through benchmark questions, knowledge boundary questions, behavioral consistency tests, or model fingerprints; and performing two-sample tests by accessing the locally deployed target model service to obtain its reference output, token ranking, or log probability information for a two-sample test. These methods often suffer from the following drawbacks: (1) It can only detect whether there is a full replacement of the model service, and it is difficult to detect proportional dilution (i.e., mixed dilution). Since most of the returned results under low dilution ratio come from the declared model and only a very small number of returned results come from the alternative model service, the current detection method is very likely to cause false negatives or false positives.

[0017] (2) Unable to provide a query budget based on confidence level. Most existing detection methods predefine a general fixed number of queries, which cannot answer the question of "how many audits are needed under the minimum replacement ratio given by the user", resulting in uncontrollable audit costs and often causing missed detections or waste due to the fixed number of queries.

[0018] (3) Usually only binary conclusions are given, and the replacement ratio of the replacement request cannot be estimated. It is also difficult to output the confidence interval of the test results, evidence log and verifiable report, which is not convenient for contract acceptance and accountability.

[0019] (4) Relying on online samples, internal log probabilities, token rankings, auditable endpoint logs, or active cooperation of auditable endpoints of locally deployed target model services is not suitable for clients or third-party regulators who can only see the final visible text.

[0020] (5) Mistaking a single long text returned by the endpoint to be audited as multiple independent pieces of evidence leads to unreliable confidence in the detection results. For example, if L symbols within a single response of a large model service are statistically dependent on each other through autoregressive conditions, the length of the response text does not equate to an increase in the number of independent queries. Accumulating evidence based on this will greatly overestimate the confidence of the detection.

[0021] (6) The requirement is that various possible alternative model services have been pre-registered, but when encountering unknown alternative model services that have not been registered, they can only be rejected with low confidence or completely missed. It lacks the ability to process open model sets and represent the lower bound of external components.

[0022] (7) Failure to distinguish between base model replacement and sampler or temperature drift of the target model service. The same target model service will naturally drift over time, load, backend version or sampling temperature. Without fresh honest window calibration and base model-specific design, normal drift of the target model service may be misjudged as replacement, or attackers may evade detection by adjusting the temperature.

[0023] Furthermore, in black-box large model service scenarios, auditors often only obtain the visible text returned by the endpoint to be audited, and cannot access information such as model weights, log-probability, token ranking, or routing logs of the endpoint to be audited. Moreover, during the online audit phase, there are no tags for the visible text, and it is impossible to confirm which model each visible response text actually comes from. Therefore, how to detect whether the target model service has been fully replaced with a controllable and verifiable query budget, how to detect low-proportion mixed route dilution, how to estimate the dilution ratio and provide a confidence interval, how to reduce false positives and false negatives when the replacement model is unknown or there is normal backend drift, and how to make the audit of the base model replacement of the target model service specific and insensitive to Honest Sampler adjustments have become ongoing problems to be solved in model replacement detection scenarios.

[0024] Based on the above research, this application provides a service replacement detection method, apparatus, storage medium, and computer device. By determining the first detection information for the candidate service set and target model service calibration according to the audit objectives set for the endpoint to be audited during the offline calibration phase, it is possible to pre-estimate the fixed number of detections required under the audit objectives, providing users with a reviewable audit budget. Using a target detection probe, an audit request is initiated to the endpoint to be audited according to a fixed number of detections, obtaining each first response text under the fixed number of detections. Replacement detection is then performed directly using the anomaly score, first detection threshold, and tag fingerprint features of the first response text. This allows replacement detection to be performed using only the visible text returned by the endpoint to be audited, without requiring model weights, token rankings, routing logs, log probabilities, or other internal model parameters and endpoint logs fed back by the endpoint. This avoids the problem of stringent detection conditions and effectively adapts to various endpoints to be audited, such as cloud APIs and model gateways, achieving black-box usability. Furthermore, by determining the initial detection results under various target modes, comprehensive detection of various replacement modes (such as full replacement, mixed dilution replacement, etc.) can be achieved, improving the comprehensiveness of the detection. Furthermore, based on each initial detection result, a target detection result containing information such as whether the target model service uses replacement, the target replacement model, and the replacement ratio is determined. Compared with the binary detection results in the prior art that only indicate whether replacement has occurred, this can effectively improve the richness of the detection results and provide a data foundation for subsequent review of the detection results.

[0025] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this application below are all contributions made by the inventor to this application.

[0026] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0027] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0028] It should be noted that the specific terms mentioned in the embodiments of this application include: Large model service replacement: This refers to a client requesting to call model A from the endpoint to be audited, or the endpoint to be audited declaring that it will use model A, but the result returned by the endpoint to the client request may actually be returned by model B, or a low-price, low-precision, quantized, fine-tuned, or different backend configuration version of model A. Mixed dilution: This refers to a situation where, among multiple client requests initiated by the endpoint to be audited, only a certain percentage of the client requests are routed to the alternative model service for processing and the endpoint to be audited returns the results from the alternative model service, while the remaining client requests are routed to the target model service declared by the endpoint to be audited and the endpoint to be audited returns the results from the target model service.

[0029] To facilitate understanding of this embodiment, the application scenario of the service replacement detection method disclosed in this application embodiment will first be introduced. Typically, an auditable endpoint (such as a model gateway, model proxy interface, etc.) declares that it provides a target model service P. However, when a client initiates a client request to the auditable endpoint, the result returned by the auditable endpoint for the client request may originate from the target model service. P Or any alternative model service R This will result in the following three service states for the endpoint to be audited: The first type is the honest service state, which means that the endpoint to be audited returns results from all client requests from the target model service. P ; The second type is a full service replacement state, meaning that the endpoint to be audited is where all client requests return results from the target model service. P Any alternative model service R ; The third type is the hybrid routing diluted service state, which means that the endpoint to be audited is a portion of the results returned by all client requests, originating from the target model service. P Another part of the results comes from an alternative model service. RUnderstandably, the dilution of service state by hybrid routing occurs at the request level. That is, different client requests can be routed to different model services for processing by the audited endpoint, while the result returned by a client request from a non-audited endpoint is generated by multiple model services.

[0030] Target model service P The alternative model serves the alternative model R For example, based on the three service states mentioned above, the response distribution (i.e., the return result distribution) of the endpoint to be audited in response to client requests can be represented by the following formula: (Formula 1) in, Represents the response distribution. This indicates that the service is routed to the alternative model service. R The proportion of client requests (i.e., from a certain alternative model service) R The proportion of returned results). Based on Formula 1, it can be seen that each result returned by the endpoint to be audited has a probability of 1- From target model service P With probability From Alternative Model Service R .when When =0, the endpoint to be audited is in an honest service state; when When =1, the endpoint to be audited is in a full replacement service state; when 0 < When <1, the endpoint to be audited is in a hybrid routing diluted service state; alternative model service. R It can be called a dilution source.

[0031] The above formula unifies the three service states of the endpoint to be audited into a single unknown for solving. The problem is that the technical objective of this application is also to detect the endpoint to be audited. Is it 0? Estimate The value that is not 0 (that is, the value is) ), attribution The alternative model service is provided. Furthermore, the service replacement detection method provided in this application can be used in a black-box scenario for the model service. That is, after the auditor initiates an online audit request to the endpoint to be audited, it can only obtain the visible response text (such as a visible text string) returned by the endpoint to be audited. The auditor cannot obtain information such as the model weights, output probabilities (such as log probabilities), token rankings, and routing logs of the model service used by the endpoint to be audited.

[0032] The following will provide a detailed description of a service replacement detection method disclosed in the embodiments of this application. The execution subject of the service replacement detection method provided in the embodiments of this application is generally a terminal device or other processing device with certain computing power. The terminal device may be a user equipment (UE), a mobile device, a terminal, a personal digital assistant (PDA), a handheld device, a computer device, an auditor, etc. In some possible implementations, the service replacement detection method can be implemented by the processor calling computer-readable instructions stored in the memory.

[0033] The following describes the service replacement detection method provided in this application embodiment, taking the auditing party as an example. The auditing party may include, but is not limited to, client software development kits (SDKs), enterprise gateways, regulatory auditing platforms, and third-party evaluation platforms.

[0034] like Figure 1 The flowchart shown is a service replacement detection method provided in an embodiment of this application, which may include the following steps: S101: Obtain the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stop rule, target detection error and candidate service set; wherein, if the candidate service set is not empty, it includes at least one alternative model service related to the target model service.

[0035] Here, the endpoint to be audited can be any cloud platform, model gateway, enterprise proxy layer, reseller, or unified routing service, etc., or other intermediate layer endpoints, and the target model service (hereinafter referred to as model) can be audited. P This allows you to specify the model services declared by the endpoint to be audited, or to designate specific model services for auditing. The audit target is a user-defined replacement detection target for the endpoint to be audited, used to detect whether the target model service is using a replacement issue. Preset detection models can include a full replacement detection mode and a proportional replacement detection mode. The full replacement detection mode is used to detect when the endpoint to be audited is using a specific model. P Does a full replacement issue exist, and if so, what is the replacement ratio and possible alternative model services? The ratio replacement detection mode is used to detect when the audited endpoint is using the model. P Does the issue of mixed dilution exist, and if mixed dilution exists, what are the possible alternative model services and their replacement ratios?

[0036] The target mode is the detection mode selected by the user, which can be at least one of several preset detection modes. The detection stop rule indicates the audit stop rule for auditing the endpoint to be audited according to the audit objective. Specifically, it can be one of a fixed budget stop rule, a sequential verification rule, or an Anytime stop rule. The fixed budget rule indicates that an audit request should be initiated and audited on the endpoint to be audited based on the number of offline frozen audits. The sequential verification rule or the Anytime stop rule indicates that an audit request should be initiated and audited on the endpoint to be audited using either the sequential e-process (e-process) or Wald's Sequential Probability Ratio Test (SPRT). The target detection error can include the user-allowed false alarm rate. and false negative rate Candidate service set ( This can indicate to the user what alternative models can be used. P It is a collection of various alternative model services, which can be set to empty or non-empty according to user needs. Furthermore, in If not empty, It may include one or more alternative model services related to model P. ,in, j (Greater than or equal to 1). In addition, the audit objectives may include the minimum dilution ratio set by the user for mixed dilution issues. .

[0037] If the user sets a non-empty set of candidate services, the model... P and various alternative model services declared by users. In the offline calibration stage described later, the labeled response probabilities can be used for sampling. When an online audit request is initiated using the number of detections mentioned later, the model... P and alternative model services The visible response text does not contain any tags.

[0038] The detection method for service replacement provided in this application may include three progressive detection tasks: a detection task, an estimation task, and an attribution task; the detection task is used to judge the model according to the target detection error. P Whether it has been replaced, i.e., checking in "no replacement" ( =0) "Null hypothesis ( ) relative to "existence of substitution ( The alternative hypothesis is ">0" ( The probability of ( ). The estimation task is used to estimate the dilution ratio when replacement occurs. The attribution task is used to determine the actual replacement model in the candidate service set. P Alternative model services. Furthermore, for detection tasks, regardless of the existence of a candidate service set, the model can be directly used. P The model fingerprint features are used to detect whether a single substitution or multi-source substitution exists. For the attribution task, if a candidate service set exists, the candidate model service that has been substituted can be identified from the candidate service set as the attribution result when a substitution is determined to exist; if no candidate service set exists, the attribution result of being replaced by an unknown substituted model can be given when a substitution is determined to exist. For the estimation task, if a candidate service set exists, the attribution result of a certain candidate model service replacing the model can be determined. P At that time, the dilution ratio of the candidate model service is determined. If no candidate service set exists, the lower bound of the replacement ratio corresponding to the unknown replacement model can be determined when it is determined that a replacement exists (which will be explained in detail later).

[0039] In practice, when a user has an audit requirement for any endpoint to be audited, the audit target set by the user for the target model service of the endpoint to be audited can be obtained.

[0040] S102: If the detection stopping rule is fixed budget stopping, then obtain the first detection information for the candidate service set and the target model service calibrated based on the target detection error during the offline calibration phase; the first detection information includes the fixed number of detections under the target detection probe, the first detection threshold for each target mode, and the label fingerprint features of each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service.

[0041] Here, the service replacement detection method of this application can be divided into two stages. The first stage is an offline calibration stage, which is used to offline calibrate an audit plan related to the audit objective. The audit plan may include the first detection information or the second detection information mentioned below. The second stage is an online audit stage, which is used to initiate multiple independent audit requests to the endpoint to be audited using the offline calibrated detection information, so as to calibrate the model based on the request results. P Perform a replacement test.

[0042] Target detection probe It can provide a variety of preset detection probes c In the middle, there are the current endpoints and models to be audited. PA selected detection probe targets a controlled output space that is the text character input space indicated by the target detection probe. Each preset detection probe is used to generate random requests. Preset detection probes are used because any large language model will expose stable sampling preferences in random generation tasks. When the preset detection probes require the large language model to generate random bits, random numbers, random integers, dice rolls, or short random sequences, different large language models exhibit model-specific statistical characteristics in symbol frequency, transitions, runs, entropy, compression ratio, and format. These visible string behaviors can constitute the model fingerprint of the large language model. Furthermore, compared to general question-and-answer questions, the random requests generated by the preset detection probes have lower response costs, shorter prompts, repeatability, controllable output space, and are easy to statistically aggregate, making them suitable as black-box audit probes.

[0043] The registered model service can be any model service indicated by the audit objective, as well as the target model service. When the candidate service set is empty, the registered model service can be a single target model service; when the candidate service set is not empty, the registered model service can include the target model service and various alternative model services in the candidate service set.

[0044] The first detection information may include the fixed number of detections under the fixed budget stop rule. The first detection threshold for each target mode, and the label fingerprint features of each registered model service; wherein, the number of detections is fixed. The first detection threshold is used to indicate the query budget for the endpoint to be audited, i.e., the number of audit requests that need to be initiated. It can include different amounts of information depending on the target pattern, and is used to detect whether the target pattern has occurred based on the visible response text returned by the endpoint to be audited in response to the audit request. The label fingerprint feature can be the fingerprint feature calibrated for the registered model service during the offline calibration phase, which can reflect the response characteristics of the registered model service. Specifically, the label fingerprint feature can include the calibration fingerprint feature of the registered model service and the lower bound of the corresponding output probability of the registered model service.

[0045] Specifically, the various preset detection modes can include a full replacement detection mode and a proportional replacement detection mode. The full replacement detection mode can be implemented using a configured full replacement header, while the proportional replacement detection mode can be implemented using a configured hybrid routing header. When the user-selected target mode includes both full replacement and proportional replacement detection modes, the fixed number of detections can be based on the first number of detections offline-calibrated for the full replacement detection mode. The sum of the numbers represents the second number of offline calibrations in the proportional replacement detection mode. The maximum value in is determined. j Indicates the first j Alternative model service The first detection threshold may include the average score threshold calibrated offline for the full replacement detection mode. and serve various alternative models The first false alarm rate calibrated offline respectively First replacement probability Score detection threshold Alarm frequency threshold .

[0046] The hybrid routing in this application has two rate ranges: the rate of separable pairs with separable tails is close to 1 / ε, while the rate of pairs without separable tails (dominated only by twins or mean difference) is... The specific rate range can be determined by the measured tail separation degree of the sample response text, and the budget can be selected accordingly.

[0047] Understandably, if the user selects only the full replacement detection mode as the target mode, a fixed number of detections is sufficient. The first detection threshold may include When the user-selected target mode is only the proportional replacement detection mode, a fixed number of detections can be performed based on... It is determined that the first detection threshold may include services for various alternative models. Offline calibration respectively , , and .

[0048] In practice, after obtaining the audit target, it can be determined whether the detection stop rule in the audit target is a fixed budget stop. If so, the various first detection information mentioned above, based on the target detection error for the candidate service set and target model service calibration during the offline calibration stage, can be obtained. If not, the audit method will be introduced later.

[0049] Furthermore, by utilizing the fixed number of tests carried in the first detection information, feedback can be provided to the auditors regarding, for example, "to achieve the target detection error and to detect the given minimum dilution ratio." The system provides feedback on "how many audit requests are needed," thus addressing the problem in existing technologies that cannot provide a query budget oriented towards confidence levels.

[0050] S103: Using the target detection probe, initiate an audit request to the endpoint to be audited according to a fixed number of detections, and obtain the first response text of each target under the fixed number of detections.

[0051] Here, the first response text is the controlled output space of the target endpoint as indicated by the target detection probe, and is the visible response text returned by the audit request. The number of audit requests is equal to the fixed number of detections, and one audit request corresponds to one first response text.

[0052] In practice, after obtaining the initial detection information, the target detection probe can be used during the online auditing phase to initiate an investigation of the endpoint to be audited. The audit request received a response from the endpoint to be audited. The first response text.

[0053] S104: Using the fingerprint classifier trained in the offline calibration stage, determine the attribution probability of the first response text under each registered model service, and determine the anomaly score of the first response text under each registered model service based on the attribution probability.

[0054] Here, the fingerprint classifier can be a multi-class classification model used to determine the probability (i.e., posterior probability) of any input response text belonging to each registered model service. The fingerprint classifier can be any of the following: random forest, gradient boosting tree, logistic regression, support vector machine, neural network, nearest neighbor, one-class detector, or density estimator.

[0055] The anomaly score indicates the degree of deviation of the first response text from the registered model service. For any given first response text, there is a corresponding anomaly score for each registered model service. The higher the anomaly score for a particular registered model service, the lower the likelihood that the first response text belongs to that registered model service.

[0056] In practice, during the offline calibration phase, each preset detection probe can be calibrated. c Using the labeled sample response text corresponding to each registered model service, the preset detection probe is... c The corresponding fingerprint classifier is trained to obtain the preset detection probe. c A corresponding trained fingerprint classifier The label of the sample response text can be the true probability of the sample response text belonging to each registered model service. Then, each first response text can be input into the pre-trained fingerprint classifier corresponding to the target detection probe. In this process, the attribution probability of the first response text under each registered model service is obtained. Then, for each first response text, the anomaly score of the first response text under each registered model service can be calculated based on the attribution probability of the first response text under each registered model service.

[0057] In one embodiment, the above-described S104 can be implemented according to the following steps: S104-1: Extract features from the first response text according to multiple preset feature dimensions to obtain the target feature vector corresponding to the first response text; the multiple preset feature dimensions are all related to the text content and are not related to the text source features.

[0058] Here, multiple preset feature dimensions can be selected from multiple initial feature dimensions. The number of multiple initial feature dimensions can include up to 179 dimensions, specifically multiple preset feature dimensions related to text content and feature dimensions related to text source features. Multiple preset feature dimensions related to text content can include, but are not limited to, symbol count and normalized frequency, chi-square distance to the target distribution, Shannon entropy, L1 distance to the target distribution, maximum / minimum frequency and range, mode percentage, run-length structure features such as run-length statistics, alternation rate, n-gram entropy (n can be, for example, 2, 3, etc.), compression rate, hysteresis autocorrelation, first and last symbol encoding, transition probability matrix, number of response characters, number of non-whitespace characters, newline / space / continuous text, illegal character rate, parsing length, parsing success rate, position balance statistics, etc. Feature dimensions related to text source features can include, but are not limited to, length error, format compliance features, interface-specific features related to the service stack format of the endpoint to be audited, etc.

[0059] In cases where auditing may cross backends or where it is necessary to avoid the use of fingerprint classifiers for format / length artifacts in the service stack, feature dimensions related to text source features in the initial feature dimensions need to be removed. Thus, the final set of preset feature dimensions can be 144 dimensions, which may include features such as frequency, entropy, transition, run length, autocorrelation, and compression ratio.

[0060] In practice, for each first response text y Alternatively, features can be extracted from the first response text according to multiple preset feature dimensions to obtain the feature information corresponding to the first response text under each preset feature dimension. This feature information can then be combined into a 144-dimensional target feature vector corresponding to the first response text. Or, for each first response text, features can be extracted according to multiple initial feature dimensions to obtain the feature information corresponding to the first response text under each initial feature dimension. This feature information can then be combined into a 179-dimensional initial feature vector corresponding to the first response text. Then, feature information related to the text source features can be removed from the initial feature vector to obtain a content-independent (backend unchanged) feature subset. This subset can then be used as the target feature vector corresponding to the first response text. This makes it more difficult for fingerprint classifiers to rely on backend-specific format artifacts during prediction.

[0061] S104-2: Using the trained fingerprint classifier, determine the probability vector corresponding to the first response text based on the target feature vector; the probability vector includes the belonging probability of the first response text under each registered model service.

[0062] In practical implementation, a target detection probe can be used. trained fingerprint classifier Based on the target feature vector of each first response text The probability of the output first response text belonging to each registered model service can be expressed by the following formula: (Formula 2).

[0063] in, M This represents any registered model service. P That is, the target model service. Represents response text y In the corresponding registered model service M The probability of attribution is calculated for each first response text. When calculating the probability of attribution, the values ​​in Formula 2 above are... c Values Fingerprint classifier uses The aforementioned first response text y In various registration model services M The probability vector corresponding to the first response text is composed of the following attribution probabilities. ,in, Represents each registration model service M .

[0064] In this way, by using a fingerprint classifier to compress the first response text into a set of attribution probabilities for each registered model service, a foundation can be provided for subsequent anomaly scores, model attribution, and proportion prediction.

[0065] S104-3: Using a preset scoring formula, score the probability of belonging to the first response text under each registered model service to obtain the anomaly score of the first response text under each registered model service.

[0066] Here, the preset scoring formula can be the following formula three: (Formula 3) in, Indicates any preset detection probe c The response text below y Register model service M The anomaly score is calculated for each first response text. When calculating the anomaly score, the following formulas are used: c All .

[0067] For example, for any first response text, Formula 3 above can be used to apply the first response text to each registered model service. M The attribution probability is taken as the natural logarithm (log), and then the sign is taken to obtain the first response text in each registered model service. M The abnormal score. Among them, the first response text in any registered model service. M The higher the anomaly score, the more likely the first response text originated from the registered model service. M The smaller it may be.

[0068] S105: Based on the anomaly score, the first detection threshold, and the label fingerprint features, determine the initial detection result for each target mode, and determine the target detection result based on each initial detection result; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and the replacement ratio information.

[0069] Here, for a complete audit under a specific audit objective, the initial detection result and / or the target detection result under that audit are both a triplet (flag, ...). , ); where flag∈{0,1} is used to characterize whether there is a replacement of the target service model. When flag is 0, it means that no replacement has occurred, and when flag is 1, it means that a replacement has occurred. To attribute the target replacement service used when a replacement occurs, express The corresponding replacement ratio information. When the target replacement service is an unregistered model service. For unknown replacement identifiers, when the target replacement service is the registered alternative model service, The identifier for the target replacement service. When the target replacement service is an unregistered model service. This is the lower bound of the output probability; when the target replacement service is the registered alternative model service, This refers to the estimated dilution ratio (also known as the replacement ratio or substitution ratio).

[0070] The initial detection result is the detection result of the endpoint to be audited in the target mode, and its form is also the above triple (flag, , )form.

[0071] For example, after obtaining the anomaly scores of each first response text, for each target pattern, the detection head for that pattern can be used to determine whether a replacement has occurred by comparing the anomaly score with the first detection threshold for that pattern. Then, using the label fingerprint features, the full replacement ratio, and the determination of whether a replacement has occurred, the replacement ratio information and the target replacement model are determined, resulting in the initial detection results for each target pattern. Finally, the initial detection results can be integrated to obtain the target detection results.

[0072] For example, if the target mode is only a full replacement detection mode or a proportional replacement detection mode, the initial detection result under that mode can be directly used as the target detection result. If the target mode includes both full replacement detection mode and proportional replacement detection mode, since full replacement and mixed dilution will not occur simultaneously, if one of the two initial detection results indicates replacement, it can be directly used as the target detection result; if neither of the two initial detection results indicates replacement (i.e., both initial detection results indicate no replacement), either initial detection result can be used as the target detection result.

[0073] Understandably, in a token-based billing model, only replacing the expensive base service model with a cheaper model service can truly reduce endpoint costs. Adjusting only one of the sampling temperature, decoding method, or inference effort of the target model service will not save costs for the audited endpoint; therefore, adjusting sampling temperature / decoding method / inference effort will not be an audit target. The tokens added or removed from inference effort can be directly observed and transparently billed from the token count in the response text returned by the audited endpoint. Temperature / decoding readjustments are second-order perturbations within the same family of parameters of the target model service. Therefore, the detection method provided in this application can detect and alert only on base service model replacements, not on honest adjustments to sampling temperature / decoding method / inference effort. In other words, the detection method provided in this application is sensitive to base service model replacements but insensitive to samplers, thus achieving specific detection.

[0074] In one embodiment, S105 described above can be implemented according to the following steps A1 to A5: A1: When the target mode includes the full replacement detection mode, the average first score of the endpoint to be audited under the target model service is determined based on the abnormal score of each first response text under the target model service and the fixed number of detections.

[0075] Specifically, any preset detection probe can be defined. mThe average anomaly score of each response text under the target model service is as follows: Formula 4: (Formula 4) in, Indicates the preset detection probe c Below m The average score of each response text. m Indicates the number of response texts. express m The i-th response text in a set of response texts. express In target model service P Abnormal scores.

[0076] In practice, during the current audit, if the target mode includes a full replacement detection mode, then the formula in formula four above can be used. m The value is a fixed number of tests. , c Values ,but It can represent The i-th first response text in a set of first response texts It can represent In target model service P The abnormal scores are displayed below. The first response texts are then displayed in the target model service. P Substituting the anomaly score and the fixed number of detections into Formula 4 above, we obtain the mean first score of the endpoint to be audited under the target model service. .

[0077] A2: If the mean score of the first detection threshold is greater than the mean score threshold in the first detection threshold, it is determined that the target model service is subject to full replacement.

[0078] In practice, it can be determined that... Is it greater than the first detection threshold? If not, then it can be determined that the target model service does not have a full replacement, and the initial detection result under the full replacement detection mode is determined to be (flag=0, =0, =Empty). If so, it can be determined that the target model service has a full-use replacement, and the following A3~A5 are executed for attribution processing.

[0079] A3: Based on the maximum attribution probability of each first response text under each registered model service and the lower probability limit carried in the label fingerprint features of each registered model service, determine whether the target model service has been replaced by an unregistered model service other than the replacement model service.

[0080] Here, the maximum attribution probability can be the highest probability among the various attribution probabilities of each first response text under each registered model service, that is, the maximum class probability in the posterior of a single response text. The label fingerprint features of each registered model service may carry a probability lower bound, which indicates the lowest acceptable threshold for the maximum attribution probability among the various attribution probabilities of each response text. The probability lower bounds carried in the label fingerprint features of different registered model services may be different. If the maximum attribution probability is less than the probability lower bound of a certain registered model service, it can be concluded that the response text does not belong to a registered model service.

[0081] Optionally, the lower probability bound carried in the label fingerprint features of each registered model service can be the acceptable threshold of the target service model. If the maximum attribution probability is less than the lower probability bound, it can be said that the response text does not belong to the target model service.

[0082] Unregistered model services can be model services other than the various alternative model services in the candidate service set.

[0083] In practice, if a full replacement is confirmed, the maximum candidate probability for each first response text can be further selected based on its attribution probability under each registered model service. The maximum value among these candidate maximum probabilities is then taken as the maximum attribution probability. This maximum attribution probability is then compared with the lower probability bound carried in the label fingerprint features of each registered model service to determine if it is less than each lower probability bound. If so, it can be determined that the target model service has been replaced by an unregistered model service; otherwise, it can be determined that the target model service has not been replaced by an unregistered model service.

[0084] Alternatively, the maximum candidate probability of each first response text can be used as the maximum attribution probability of each first response text. For each first response text, it can be determined whether its maximum attribution probability is less than each probability lower limit. If so, it can be determined that the return result of the first response text has been replaced by an unregistered model service; if not, it can be determined that it has not been replaced by an unregistered model service.

[0085] If it is determined that the model has been replaced by an unregistered model service, then the initial detection result in the full replacement detection mode can be determined as (flag=1, =1, =Unknown). If it is determined that it has not been replaced by an unregistered model service, then A4 below can be executed.

[0086] A4: If not, then determine the mean second score of the endpoint to be audited under each alternative model service based on the attribution probability of each first response text under each alternative model service and the fixed number of detections.

[0087] In practice, any preset detection probe can be defined. m The mean anomaly score of each response text under the alternative model service is as follows: Formula 5: (Formula 5) in, Indicates the preset detection probe c Below m The second score mean of each response text m Indicates the number of response texts. express m The i-th response text in a set of response texts. express The logarithm of the attribution probability under the alternative model service. The closer the mean of the second score is to 0, the stronger the attribution probability. m The response text comes from the alternative model service. M The greater the possibility, the better.

[0088] In practice, during the current audit, if the target mode includes a full replacement detection mode, then the formula in Formula 5 above can be used. m The value is a fixed number of tests. , c Values ,but It can represent The i-th first response text in a set of first response texts It can represent In target model service P The logarithm of the attribution probability. Each first response text is then used in each alternative model service. M Substituting the attribution probability and the fixed number of detections into Formula 5 above, we obtain the service of each alternative model. M The corresponding second score mean .

[0089] A5: Based on the second score mean, select the target replacement model from each replacement model service to fully replace the target model service, and determine the initial detection result in the full replacement detection mode based on the target replacement model and the full replacement ratio.

[0090] Here, the full replacement ratio is 1.

[0091] In practice, services can be tailored to each alternative model. MThe second average score is used to determine the maximum second average score, and the replacement model service corresponding to this maximum second average score is used as the target replacement model for the full replacement target model service. Then, based on the target replacement model and the full replacement ratio, the initial detection result under the full replacement detection mode can be determined as (flag=1, =1, =Target replacement model), that is, among all candidate replacement models, the one that makes The largest model is used as the target to replace the model.

[0092] For example, when determined m If the response texts come from the same replacement service model, then the target replacement model can be determined as... Based on this, it can be concluded that The target replacement model corresponding to each first response text can be represented as follows: ,if ≠ P Then you can As the final target, the replacement model.

[0093] In one embodiment, S105 can also be implemented according to the following steps B1 to B4: B1: When the target mode includes the proportional replacement detection mode, the number of first abnormal responses under each alternative model service is determined based on the abnormal score of each first response text under each alternative model service and the score detection threshold corresponding to each alternative model service in the first detection threshold.

[0094] Here, the first abnormal response count represents the number of alerts required under the alternative model service in the first response text. One alternative model service corresponds to one first abnormal response count.

[0095] You can define any preset detection probe. m The number of anomalies in the response text under the alternative model service is given by the following formula six: (Formula Six) in, Indicates the preset detection probe c Below m The number of abnormal responses per response text. m Indicates the number of response texts. express m The i-th response text in a set of response texts. express In alternative model services M Abnormal scores, Indicates the preset detection probe cand alternative model services The score detection threshold below, Indicates in Greater than In the case of taking 1, Not greater than In the case of , take 0.

[0096] In practice, if the target model includes a proportional replacement detection model in the current audit, then the formula in Formula 6 above can be used. m Values , c Values ,but It can represent The i-th first response text in a set of first response texts It can represent In alternative model services M Abnormal scores, This represents the score detection threshold in the first detection information. For each alternative service model... The first response texts are in Substituting the anomaly score and the fixed number of detections into Formula 6 above, we obtain the results. The corresponding number of first abnormal responses That is, it can be used The number of response texts that exceeded the threshold in each first response text was detected, and the number of alarms (tell count) was obtained.

[0097] B2: Based on the number of first abnormal responses corresponding to each alternative model service and the alarm count threshold corresponding to the alternative model service in the first detection threshold, select the alarm models that need to be alarmed from the alternative model services.

[0098] In practice, for each If the corresponding > Then you can... As an alarm model, it filters out various The various alarm models in the system. Understandably, the number of alarm models can be 0 or other values.

[0099] B3: Determine the number of second abnormal responses under unregistered model services based on the maximum attribution probability of each first response text under each registered model service and the lower probability limit carried in the label fingerprint features of each registered model service.

[0100] In practice, for each first response text, its maximum attribution probability can be determined based on its attribution probability under each registered model service. If the maximum attribution probability of a first response text is less than each probability lower limit, then that first response text is determined to be an anomalous response text. Furthermore, each anomalous response text identified from the various first response texts can be considered as the number of second anomalous responses under unregistered model services. Understandably, the number of second anomalous responses can be 0 or other values.

[0101] B5: Based on the first false alarm rate, first replacement probability, and tag fingerprint features corresponding to the first detection threshold of the alarm model, and / or the number of second abnormal responses, determine the replacement ratio information of the alarm model and the unregistered model service for the target model service, and determine the initial detection result in the ratio replacement detection mode based on the replacement ratio information.

[0102] In practical implementation, if both the number of second abnormal responses and the number of alarm models are 0, it indicates that there is no proportional replacement. Therefore, the initial detection result under the proportional replacement detection mode can be determined as (flag=0, =0, =empty). If the number of second abnormal responses is 0 but the number of alarm models is not 0, the replacement ratio information of the alarm model for the target model service can be determined based on the first false alarm rate, first replacement probability, and tag fingerprint features corresponding to each alarm model in the first detection threshold. Based on this replacement ratio information, the initial detection result in the proportional replacement detection mode can be determined. If the number of second abnormal responses is not 0 but the number of alarm models is 0, the replacement ratio information of the non-registered model service for the target model service can be determined based on the number of second abnormal responses. Based on this replacement ratio information, the initial detection result in the proportional replacement detection mode can be determined. If both the number of second abnormal responses and the number of alarm models are not 0, the replacement ratio information of the alarm model for the target model service can be determined based on the first false alarm rate, first replacement probability, and tag fingerprint features corresponding to the alarm model in the first detection threshold. The replacement ratio information of the non-registered model service for the target model service can also be determined based on the number of second abnormal responses. Based on these two replacement ratio information, the initial detection result in the proportional replacement detection mode can be determined.

[0103] In one embodiment, B5 described above can be implemented according to the following steps: Based on the number of alarm models, proportional solution parameters are selected from the first false alarm rate, first replacement probability, and tag fingerprint features corresponding to each alarm model. Then, using the proportional solution parameters of each alarm model, the replacement ratio information of each alarm model for the target model service is determined.

[0104] Here, the proportional calculation parameters are the parameters required to solve for the replacement ratio information corresponding to the alarm model. These parameters can be the first false alarm rate, the first replacement probability, or the tag fingerprint feature. The selection of the proportional calculation parameters varies depending on the number of alarm models. For example, when the number of alarm models is not zero, the proportional calculation parameters for each alarm model can be selected from the first false alarm rate, the first replacement probability, and the tag fingerprint feature corresponding to each alarm model, based on whether the number of alarm models is greater than one. Then, the dilution ratio is solved using the proportional calculation parameters of each alarm model, thereby determining the replacement ratio information for each alarm model serving the target model.

[0105] And / or, based on the number of second abnormal responses and the second false alarm rate calibrated offline for the target model service, determine the first replacement ratio of the unregistered model service for the target model service, and based on the first replacement ratio and the maximum attribution probability, determine the replacement ratio information of the unregistered model service for the target model service.

[0106] Here we see the second false alarm rate. A false alarm rate can be pre-calibrated offline for the target model service, which can be determined in advance based on the anomaly scores of each real response text returned by the target model service. The first replacement ratio can characterize the alarm probability required for the unregistered model service.

[0107] In specific implementation, if the number of second abnormal responses is 0, the replacement ratio information of unregistered model services for the target model service can be determined to be 0, meaning there is no replacement of unregistered model services. If the number of second abnormal responses is not 0, the first replacement ratio can be determined based on the second false alarm rate calibrated offline for the target model service and the ratio of the number of second abnormal responses to the number of firmware detections. Furthermore, the replacement ratio information of unregistered model services for the target model service can be determined based on the maximum attribution probability corresponding to each first response text or the maximum value of the attribution probability corresponding to all first response texts, and the first replacement ratio.

[0108] For example, if the number of second abnormal responses is not zero, it can be based on the abnormal score of each first response text under the target service model and Determine the abnormal score is greater than The number of the first response text, and compare that number with... The ratio is used as the alarm ratio. Alternatively, it can be based on the number of second abnormal responses and The ratio is used as the alarm ratio. Then the first replacement ratio can be determined. ;in, This represents the first replacement ratio, which can also be called the lower bound of the replacement ratio or the lower bound of external costs. Furthermore, the maximum attribution probability, along with the first replacement ratio, can be used as the replacement ratio information for the unregistered model service against the target model service. The maximum attribution probability can represent the knownness score of the open set of the endpoint to be audited; that is, the replacement ratio information for the unregistered model service can be (…). (knownness). Thus, when the actual replacement service is not registered, through... The knownness of the first response text (i.e., the maximum class probability posterior of a single response) is used to determine the anomaly score 1-knownness. Using the low quantile threshold of the knownness in the set or declared model as a threshold, endpoints with knownness below the threshold are marked as "containing non-registered model components". By outputting the open set rejection (i.e., refusal to name) score knownness instead of forcing a named model representation, the open set rejection score, together with the lower bound of the outlier component, forms the unknown alternative model handling capability.

[0109] In one embodiment, the step of determining the replacement ratio information of each alarm model for the target model service can be performed in different ways depending on whether there is one or more alarm models. Specifically, if there is only one alarm model, it indicates that the current replacement for the target model service is a single-source replacement, and the replacement ratio information can be determined according to the following steps C1 to C4.

[0110] C1: When there is only one alarm model, the first false alarm rate and the first replacement probability corresponding to the alarm model are used as proportional solution parameters.

[0111] In practical implementation, when there is only one alarm model, the first false alarm rate, which is the offline calibration rate of the alarm model, can be carried in the first detection threshold. and the first replacement probability , as a parameter for proportional solution.

[0112] C2: Determine the second replacement probability of the alarm model by using the first abnormal response count and the fixed number of detections.

[0113] In practice, the second replacement probability can be determined according to the following formula seven: (Formula 7) in, express In the preset detection probe c and alarm model Below m The second replacement probability of the response text Indicates the preset detection probe c Below m The number of abnormal responses per response text. When calculating the second replacement probability of the alarm model, it can be... Substituting into Formula 7 above ,Will Substituting into Formula 7 above m To obtain the alarm model Second replacement probability .

[0114] C3: Determine the second replacement ratio corresponding to the alarm model based on the difference between the second replacement probability and the first false alarm rate in the proportional solution parameters, and the difference between the first replacement probability and the first false alarm rate in the proportional solution parameters.

[0115] The second replacement ratio is used to indicate the alarm model in The dilution ratio in the first response text.

[0116] In practical implementation, the alarm model Serving the registration model and Greater than Then, a single alarm model can be derived using moment estimation. The corresponding second replacement ratio. For example, the second replacement ratio can be determined according to the following formula: (Formula 8) in, Alarm model The corresponding second replacement ratio, This means normalizing the result to the interval [0,1]. Indicates the preset detection probe c and alarm model The first false alarm rate, Indicates the preset detection probe c and alarm model The probability of the first replacement. It is the percentage by which the actual detected tell rate exceeds the actual baseline calibrated offline. This indicates that the proportion of pure replacement is higher than the proportion of honest service; by comparing the two, the replacement probability can be calculated. This means normalizing the result to the [0,1] interval, which can prevent sampling noise during offline calibration from causing the estimate to slightly exceed the limit.

[0117] In practical implementation, the alarm model Serving the registration model and Greater than This allows for the creation of a single alarm model. The corresponding second replacement ratio First false alarm rate and the first replacement probability Substituting into Formula 8 above, we obtain the second replacement ratio corresponding to the alarm model. .

[0118] That is, the observed proportion of tell. (i.e., the second replacement ratio) ) ≈ (1- ) + That is, honest service and replacement service are calculated according to the actual dilution ratio. The weighted tell rate. Based on the calculation rules of this tell rate, formula eight above can be derived.

[0119] C4: Using a preset estimation method, based on the binomial variance of the second replacement probability and the offline calibration error of the proportional solution parameters, determine the confidence interval of the second replacement ratio, and based on the second replacement ratio and the confidence interval, determine the replacement ratio information of the alarm model for the target model service.

[0120] Here, the preset estimation method can be the delta method, the bootstrap method, or the Wilson interval. The confidence interval (CI) can characterize the range of proportion error under the registration uncertainty of the estimated second replacement proportion, which is due to... , These offline calibration values ​​are estimated using the first and second sample response texts mentioned later, and inherently contain sampling errors. Therefore, the confidence intervals need to simultaneously propagate the second substitution probability calculated online. The binomial variance and the sampling error of the offline calibration values.

[0121] For example, the delta method, bootstrap method, or Wilson interval method can be used to determine a confidence interval that can simultaneously propagate the binomial variance of the second substitution probability and the variance of the offline calibration error, based on the binomial variance of the second substitution probability of the alarm model and the offline calibration error (i.e., sampling error) of the proportional solution parameters. The second substitution ratio and the confidence interval are then used as the substitution ratio information of the alarm model for the target model. In other words, the substitution ratio information can be... +CI.

[0122] In another embodiment, when there are multiple alarm models, indicating that the current replacement for the target model service is a multi-source hybrid replacement, the replacement ratio information can be determined according to the following steps D1~D4: D1: When there are multiple alarm models, the tag fingerprint features corresponding to each alarm model are used as proportional solution parameters.

[0123] In practice, when mixed dilution occurs, multiple first response texts are often dominated by the target service model. Aggregating the average anomaly scores of each first response text may dilute a small amount of replacement evidence. Therefore, this application uses a batch average posterior and label fingerprint features to estimate the mixed dilution ratio. Thus, when there are multiple alarm models, it can be indicated that the current situation is a multi-source mixed replacement (multi-source mixing coefficient), and the label fingerprint features corresponding to each alarm model can be used as the proportional solution parameters.

[0124] For any preset detection probe on the endpoint to be audited c Any response text below y Its corresponding probability vector It can be represented as Tag fingerprint features corresponding to any registered model service It can be represented as ;in, Represents the long-term average expectation. y ~ M Represents response text y Register model service M In the probability vector below, it belongs to the registration model service. M The distribution of the probability of belonging to the group is sampled. In other words, This can be understood as purely from the registration model service. M The average fingerprint of the response text can actually be obtained from the sample response text in the registered model service. M The mean substitution of the attribution probability. In Furthermore, under mixed dilution, the replacement ratios corresponding to each alarm model can be estimated using simplex-constrained least squares estimation, for example, using the following formula (Equation 9): (Formula Nine) in, This represents the various substitution ratios to be estimated. , This indicates that it serves as the first alternative model. The estimated replacement ratio This represents serving the j-th alternative model. The estimated replacement ratio The transpose of the identity matrix. This means taking the minimum value that satisfies the condition. , This represents the label fingerprint features corresponding to the target model service. Represents the j-th alternative model service The corresponding tag fingerprint features, This represents the probability vector corresponding to m response texts y. The batch-averaged posterior features obtained by averaging across dimensions, where... ; Indicates the preset detection probe c The i-th response text The corresponding probability vector can represent the average fingerprint of m response texts y. This indicates the usage rate of the target model service. express and Minimize the squared Euclidean distance between them (i.e., minimize the difference in squared Euclidean distances using least squares). Constraints and This indicates that each estimated proportion is non-negative and its sum does not exceed 1. The solution obtained based on Formula Nine above... The larger the value, the more response texts can be represented. y From Alternative Model Service The more [data / information], the better. During online auditing, [the following can be done / implemented]. The largest alarm model is used as the target replacement model. If there is no registered model service as the alarm model but mixed dilution is detected, then the unregistered model service can be determined as the target replacement model.

[0125] D2: Determine the mean probability vector based on the attribution probability of each first response text under each registered model service, and determine whether the replacement ratios of each alarm model are independent of each other based on the tag fingerprint features corresponding to each alarm model and the tag fingerprint features corresponding to the target model service.

[0126] Here, the mean probability vector is the probability vector composed of the attribution probability of each first response text under each registered model service, and the mean probability vector under a fixed number of detections.

[0127] In practice, the mean probability vector can be determined based on the attribution probability of each first response text under each registration model service. Furthermore, each signature change matrix can be determined based on the tag fingerprint features corresponding to each alarm model and the tag fingerprint features corresponding to non-alarm models in the candidate service set. . The first in j List( ) indicates the first j Replacement model service Tag fingerprint features relative to target model service PThe offset vector. Furthermore, each replacement model service... The corresponding replacement ratios can be separated individually (i.e., each one) The condition that the corresponding replacement ratios are independent is: Fully ranked, that is j Column offset vector Linear independence (i.e., rank( )= J ), J This indicates the number of alternative model services. Linear independence can be understood as no offset vector can be obtained by proportionally adding up the other offset vectors. According to... Whether the list is full determines whether the replacement ratios for each alarm model are independent. If yes, then execute D3 below; otherwise, execute E1~E3 below.

[0128] Furthermore, since the probability vector of the response text falls within the L dimension, where L represents the total number of alternative model services and the target model service, The sum of each column component is 0, because it can be split at most simultaneously. J ≤L-1 sources.

[0129] D3: If so, then the third replacement ratio corresponding to each alarm model is determined with the goal of minimizing the difference between the mean probability vector and the first response distribution of each first response text in the target model service and each alternative model service; wherein, the first response distribution is determined based on the product of the usage ratio corresponding to the target model service and the tag fingerprint feature, and the product of the replacement ratio corresponding to each alternative model service and the tag fingerprint feature.

[0130] Here, the difference distance can be the squared difference of the Euclidean distance. The first response distribution can be the sum of the product of the usage ratio and the label fingerprint features corresponding to the target model service, plus the product of the replacement ratio and the label fingerprint features corresponding to each alternative model service.

[0131] In practice, assuming that the replacement ratios for each alarm model are independent of each other, the third replacement ratio for each alarm model can be determined according to the following formula: (Formula 10) in, Indicates the estimated substitution ratios. , Represented as the first j Alternative model service The estimated substitution ratio; This is the first response distribution. This represents the estimated actual usage rate for the target service model. and This represents the constraint that all substitution ratios are non-negative and the sum of all substitution ratios does not exceed 1. The final solution... This refers to the third replacement ratio corresponding to each alternative model service, including the third replacement ratio corresponding to each alarm model. The model corresponding to the third replacement ratio with the largest value is the main dilution source.

[0132] D4: For each third replacement ratio, using a preset estimation method, determine the confidence interval of the third replacement ratio based on the offline calibration error of the tag fingerprint features corresponding to the alarm model, and determine the replacement ratio information of each alarm model for the target model service based on the third replacement ratio and the confidence interval.

[0133] Here, the offline calibration error of the tag fingerprint features refers to the error caused by the anomaly score corresponding to the sample response text used when the user tag is calibrated offline.

[0134] For example, the delta method, bootstrap method, or Wilson interval method can be used to determine the confidence interval of the variance of the offline calibration error of the tag fingerprint features that can propagate based on the offline calibration error of the tag fingerprint features corresponding to the alarm model. Each third replacement ratio and confidence interval is then used as the replacement ratio information of the alarm model for the target model service. In other words, the replacement ratio information can be... +CI.

[0135] In another embodiment, if the replacement ratios corresponding to each alarm model are not independent of each other, the replacement ratio information can be determined according to E1~E3 as follows: E1: If the replacement ratios corresponding to each alarm model are not independent of each other, then each model to be estimated and each combination to be estimated are determined based on the tag fingerprint features corresponding to each alarm model and the tag fingerprint features corresponding to the target model service; wherein, the model to be estimated is the first alarm model whose replacement ratio is independent of other alarm models, and the combination to be estimated includes multiple second alarm models whose replacement ratios are not independent of each other.

[0136] Here, the model to be estimated can be an alarm model that can solve for independent substitution ratios on its own; or an alarm model in which at least two column offset vectors are collinear in the combination to be estimated.

[0137] In practical implementation, if the tag fingerprint features corresponding to two alarm models are almost identical, then the two alarm models will... If the two corresponding column offset vectors are collinear, then only the sum of the substitution ratios of the two alarm models can be solved, but the individual ratios between the two alarm models cannot be solved, forming a near-twin collapse. Therefore, the two alarm models can be divided into a combination to be estimated, and each alarm model other than the model in the combination to be estimated can be used as the model to be estimated.

[0138] E2: With the goal of minimizing the difference between the mean probability vector and the second response distribution of each first response text in the target model service and each alternative model service, determine the fourth replacement ratio corresponding to each model to be estimated and the fourth replacement ratio of each combination to be estimated; the second response distribution is determined based on the product of the usage ratio corresponding to the target model service and the tag fingerprint feature, the product of the replacement ratio corresponding to each first alarm model and the tag fingerprint feature, and the product of the replacement ratio corresponding to each combination to be estimated and the tag fingerprint feature.

[0139] In practice, the proportions of each fourth replacement can be determined according to the following formula eleven: (Formula 10) in, This represents the estimated substitution ratios, which may include the fourth substitution ratio corresponding to each model to be estimated. and the fourth replacement ratio of each combination to be estimated ; This represents the total number of models to be estimated. This indicates the number of combinations to be estimated. This indicates the actual usage rate estimated for the target service model; Indicates the first Tag fingerprint features of an alternative model service; Indicates the first Label fingerprint features of any alternative model service in the combination to be estimated. This is the second response distribution.

[0140] E3: Using a preset estimation method, based on the offline calibration error of the labeled fingerprint features corresponding to the alarm model, determine the confidence interval of the fourth replacement ratio, and based on the fourth replacement ratio and the confidence interval, determine the replacement ratio information for the target model service.

[0141] The execution process of E3 is similar to that of D4, so please refer to the description of D4 above. It will not be repeated here.

[0142] Optionally, if there exists a combination to be estimated, the model with the largest fourth substitution ratio can be used as the target substitution model, and / or, the total foreign proportion can be... As a replacement ratio, other alternative model services are marked as "indistinguishable / low interval".

[0143] In one embodiment, when the candidate service set is empty, the target detection result can be determined by following steps F1 to F4: F1: If the candidate service set is empty, and the detection stopping rule is fixed budget stopping, then obtain the second detection information for the target model service calibration during the offline calibration phase; the second detection information includes the number of target detections under the target detection probe and the second detection threshold for each target mode.

[0144] In practice, when the candidate service set is empty, if the detection stopping rule is fixed budget stopping, then second detection information for offline calibration of the target model during the offline calibration phase can be obtained. This second detection information includes the target detection probe. Number of target detections And a second detection threshold for each target mode. The second detection threshold can include different amounts of information depending on the target mode, and is used to detect whether the target mode has occurred based on the visible response text returned by the endpoint to the audit request. Specifically, when the selected target modes include a full replacement detection mode and a proportional replacement detection mode, the second detection threshold includes a score average threshold that can be offline calibrated for the full replacement detection mode. The target score threshold for offline calibration of unregistered models. and target alarm frequency threshold Among them, the target score threshold The first false alarm rate can be calibrated based on the target service model. The score threshold used Sure.

[0145] F2: Using the target detection probe, initiate audit requests to the endpoint to be audited according to the number of target detections, and obtain the second response text for each target detection count.

[0146] Here, the second response text is the controlled output space of the target endpoint as indicated by the target detection probe, and is the visible response text returned by the audit request. The number of audit requests equals the number of target detections, and one audit request corresponds to one second response text.

[0147] In practice, after obtaining the second detection information, the target detection probe can be used during the online auditing phase to initiate an investigation on the endpoint to be audited. The audit request received a response from the endpoint to be audited. A second response text.

[0148] F3: Using the fingerprint classifier trained in the offline calibration phase, determine the target probability of the second response text under the target model service, and determine the anomaly score of the second response text under the target model service based on the target probability.

[0149] For details on the specific implementation process of F3, please refer to the description in S104 above, which will not be repeated here.

[0150] F4: Determine the initial detection result for each target mode based on the anomaly score and the second detection threshold, and determine the target detection result based on each initial detection result.

[0151] For example, after obtaining the anomaly scores of each second response text, for each target pattern, the detection head of that pattern can be used to determine whether a replacement has occurred by comparing the anomaly score with the second detection threshold of that pattern. Then, using the label fingerprint features, the full replacement ratio, and the determination of whether a replacement has occurred, the replacement ratio information and the target replacement model are determined, resulting in the initial detection results for each target pattern. Finally, the initial detection results can be integrated to obtain the target detection results.

[0152] In one embodiment, when the selected target mode includes a full replacement detection mode and a proportional replacement detection mode, the above-mentioned F4 can be implemented according to the following steps: F4-1: For the full replacement detection mode, the average third score of the endpoint to be audited under the target model service is determined based on the anomaly score of each second response text under the target model service and the number of target detections.

[0153] For example, for the full replacement detection mode, the anomaly score of each second response text under the target model service can be used as a basis. Number of target detections According to Formula 4 above, determine the mean of the third score corresponding to the endpoint to be audited under the target model service.

[0154] F4-2: If the average score of the third test is greater than the average score threshold in the second test, it is determined that the target model service has been fully replaced. Based on the full replacement ratio and the identification information of the unregistered model service, the initial detection result in the full replacement detection mode is determined.

[0155] Here, the identification information for unregistered model services can be a pre-defined identifier, such as "unknown model".

[0156] For example, in cases where the mean of the third score is greater than the second detection threshold... In this case, it can be determined that the target model service is fully replaced. Since there is no candidate service set at this time, it can be known that the model service used during full replacement must be an unregistered model service and the full replacement ratio is 1. Therefore, the initial detection result under the full replacement detection mode can be determined as (flag=1, =1, =“Unknown model”). Conversely, in cases where the mean of the third score is not greater than the second detection threshold. In this case, if it can be determined that the target model service does not have a full replacement, then the initial detection result in the full replacement detection mode can be determined as (flag=0, =0, =empty).

[0157] F4-3: For the proportional replacement detection mode, the number of third abnormal responses in the target model service is determined based on the abnormal scores of each second response text in the target model service and the target score threshold.

[0158] For example, for the proportional replacement detection mode, the anomaly score of each second response text under the target model service can be used as a basis. and the target score threshold in the second detection threshold ,Sure Greater than The number of target second response texts is used as the number of third abnormal responses.

[0159] F4-4: When the number of third abnormal responses exceeds the target alarm count threshold, the fifth replacement ratio of the unregistered model service for the target model service is determined based on the number of third abnormal responses and the second false alarm rate calibrated offline for the target model service. The replacement ratio information of the unregistered model service for the target model service is then determined based on the maximum value between the fifth replacement ratio and the target probability.

[0160] For example, when the number of third abnormal responses exceeds the target alarm count threshold in the second detection threshold. In this case, it can be determined that proportional substitution exists and the model corresponding to the proportional substitution must be an unregistered model. Furthermore, based on the number of third abnormal responses and... The ratio is used as the alarm ratio. This leads to the determination of the second false alarm rate based on the alarm ratio and the offline calibration rate used to serve the target model. Determine the fifth replacement ratio of unregistered model services for the target model service. Then, the target probability of each second response text under the target model service can be determined to have a maximum value. This maximum value and the fifth replacement ratio can be used together as the replacement ratio information of the unregistered model service for the target model service.

[0161] F4-5: Determine the initial detection result in the proportional replacement detection mode based on the replacement ratio information of the unregistered model service for the target model service.

[0162] For example, the initial detection result in the proportional replacement detection mode can be determined as (flag=1, based on the replacement ratio information of the unregistered model service for the target model service) according to the ratio information of the unregistered model service for the target model service. =“Information on the replacement ratio of unregistered model services for the target model service” =“Unknown model”).

[0163] Optionally, if the number of third abnormal responses is not greater than the target alarm count threshold, the initial detection result in the proportional replacement detection mode can be determined as (flag=0, =0, ="empty").

[0164] In one embodiment, the step of "providing first detection information for the candidate service set and the target model service calibration based on the target detection error during the offline calibration stage" can be implemented according to the following steps S1 to S6: S1: In the offline calibration phase, obtain the query information rate of the probe service consisting of various alternative model services and various preset detection probes in the candidate service set for calibration; the query information rate is used to indicate the change in replacement detection capability each time a probe request is sent to the endpoint to be audited; different preset detection probes are used to indicate that the registered model service outputs random response text of different lengths in different controlled output spaces.

[0165] Here, any preset detection probe c It can be used to require registered model services to output random response text of different lengths within a corresponding controlled output space; for example, various preset detection probes. c It can output tasks such as flipping a coin, outputting a random number, outputting a random integer within a given range, outputting a short sequence of 0s and 1s, or outputting a random data string of fixed length. This indicates the alphabet / range of values ​​extracted each time (i.e., the size of the controlled output space is n), and the request length is... L A pre-set detection probe, when a single extraction... L=1. Understandably, the preset detection probe can be any randomly generated task with a controlled output space, not limited to bits and numbers, and can also be a multilingual probe, a covert probe, or a lightweight random task probe embedded in the traffic, etc.

[0166] The multiple preset detection probes in this application constitute a set of probes covering two axes related to audit costs. The first axis can be the entropy per sample (i.e., the upper limit constraint of the controlled alphabet / character space), and the second axis is the tell yield per audit (used for trade-offs with response length). For example, the probe set composed of the multiple preset detection probes in this application can be: That is, three single-sampling probes with gradually increasing alphabets sweep through entropy, and three short-sequence probes supplement the exposure of transfer and run-length structure length / alphabet changes. These pre-set detection probes can be used on various audit endpoints.

[0167] For each alternative model service and various preset detection probes in the candidate service set, multiple probe service pairs can be identified. c , j ),in, c Indicates any preset detection probe c , j Represents any alternative model service. The query information rate for each probe service pair. Used to indicate the preset detection probe c Service for alternative models The per-query sorting error index (i.e., operational information rate) is an index that represents how much the logarithmic error rate decreases with each additional probe request. The larger the value, the stronger the ability to distinguish between different units.

[0168] For example, during the offline calibration phase, if the user indicates that there is a candidate service set, probe service pairs can be obtained ( c , j ) Targeted query information rate Intercept to target .

[0169] S2: Determine the first number of tests to be used for each preset detection probe based on the query information rate and target detection error of the probe service pair to which each preset detection probe belongs.

[0170] In practice, the first number of tests to be used for each preset detection probe can be determined according to the following formula eleven: (Formula Eleven) in, Indicates the preset detection probe c The corresponding first number of tests to be used. This is the false negative rate in the target detection error. ; Indicates to Round up; This indicates that the maximum value is taken among all alternative model services.

[0171] S3: Using the constraint that the number of detections does not exceed the preset detection number threshold and the corresponding calibration score detection threshold set of the probe service is not empty, candidate probes are selected from each preset detection probe based on the second number of detections to be used for each probe service and the first number of detections to be used for each preset detection probe.

[0172] Here, each probe service pair can be pre-calibrated with a second number of detections to be used. ,about The calibration can be referenced in the section below on determining the target detection threshold corresponding to the minimum number of candidate detections. Preset detection threshold. This allows users to specify the maximum allowed number of detections in the audit objectives. It also provides a set of calibration score detection thresholds. This may include pre-calibrated detection thresholds for each calibration score, and the determination of these calibration score detection thresholds will be discussed later.

[0173] In practice, a preset threshold for the number of detections is given in the audit objectives. Non-empty candidate service set In this case, it is necessary to first select candidate probes from the various preset detection probes that can be adapted to the audit objectives. Specifically, the feasible probe set composed of the candidate probes can be represented as follows: .

[0174] in, This represents a feasible probe set, which includes various pre-defined detection probes that are defined as candidate probes. c Each candidate probe needs to meet three conditions simultaneously: candidate probe c The corresponding first number of tests to be used Less than or equal to Candidate probes c The probe service it belongs to corresponds to the set of calibration score detection thresholds. Not an empty set , as candidate probes c The probe service in question is calibrated. Less than or equal to Among them, is the candidate probe. c The probe service in question is calibrated. This is a candidate probe cThe probe service in question is for the second number of tests to be used. .

[0175] S4: Based on the query information rate of each candidate probe pair, determine the minimum information rate of each candidate probe pair, and take the candidate probe with the highest probe response cost corresponding to the minimum information rate as the target detection probe of the endpoint to be audited.

[0176] In practice, for each candidate probe in the feasible probe set, the max-min criterion can be used to select the probe that still has the highest query information rate when facing the most difficult alternative model service. If multiple candidate probes have the highest query information rate when facing the most difficult alternative model service, then the probe with the lowest response cost can be selected. L The smallest candidate probe is selected as the target detection probe. For example, a target detection probe can be represented as: ;in, That is, the target detection probe , That is, the candidate service set . This can be represented as the query information rate for each candidate probe, based on the query information rate of each probe service pair to which the candidate probe belongs. To determine the candidate probe c Minimum information rate (i.e., candidate probe) when faced with the most difficult-to-distinguish alternative model service c (Discrimination ability in the worst-case scenario) This means selecting the feasible probe with the highest minimum information rate (i.e., the greatest discriminative ability in the worst case) from the set of feasible probes, thus selecting the best probe from the candidate probes that can achieve efficient detection even when faced with the most difficult-to-distinguish alternative model services. Furthermore, based on the screening process of target detection probes, it is known that target detection probes require complete query information rate estimation and tell calibration (such as determining and selecting the calibration detection threshold) for all preset detection probes to be effective.

[0177] S5: Based on the query information rate and target detection error of each target probe service pair to which the target detection probe belongs, determine the first number of detections corresponding to the target detection probe, and use the second number of detections to be used, which is pre-calibrated for the target probe service pair, as the second number of detections to be used for the target probe service pair.

[0178] In practice, it can be based on each target probe service pair to which the target detection probe belongs. , j ) query information rate False negative rate in target detection error and each target probe service pair ( , j ) target intercept The first detection count corresponding to the target detection probe is determined according to Formula 11 above. At the same time, pre-selected service pairs for each target probe can be used. , j The second number of tests to be used is calibrated. This serves as the second number of times each target probe service pair will be detected.

[0179] S6: Take the maximum value between the first detection count and the second detection count as the fixed detection count, and obtain the pre-calibrated average score threshold under the fixed detection count, as well as the pre-calibrated first false alarm rate, first replacement probability, score detection threshold, and alarm count threshold for each target probe.

[0180] For example, the first detection count can be... and various The maximum value in the range is used as the fixed number of checks under the audit objectives. At the same time, it is possible to obtain in and Predefined threshold for the mean score And obtain the service pairs for each target probe ( , j The pre-calibrated first false alarm rate First replacement probability Score detection threshold Alarm frequency threshold .

[0181] Therefore, before online auditing, a document can be frozen for the endpoint to be audited, based on the audit objectives targeting that endpoint. , , , , , and Audit plans for information such as the tag fingerprint features corresponding to the target model service and each alternative model service.

[0182] In one embodiment, the query information rate for different probe service pairs can be pre-calibrated according to the following steps T1~T5: T1: For any model service to be calibrated, use multiple preset detection probes to send multiple probe requests to the model service to be calibrated, and obtain sample response text for each probe request; the model service to be calibrated includes at least the target model service and the alternative model service.

[0183] Here, the model service to be calibrated may include at least the target model service and various alternative model services. Optionally, the model service to be calibrated may also include one or more accessible model services other than the target model service and various alternative model services.

[0184] In specific implementation, for each model service to be calibrated, a preset number of probe requests can be initiated to the model service to be calibrated using each preset detection probe, and a preset number of response texts returned by the model service to be calibrated can be obtained. These response texts are used as sample response texts of the model service to be calibrated under the preset detection probes. The preset number can be set based on experience, and this embodiment does not specify a specific number, such as 100, 120, etc.

[0185] T2: Using the label probability vector and sample feature vector corresponding to each sample response text, the fingerprint classifier to be trained is iteratively trained to obtain the trained fingerprint classifier. Then, using the trained fingerprint classifier, the sample probability vector of the sample response text is determined based on the sample feature vector.

[0186] In practice, for each preset detection probe, the sample response texts returned by each model service to be calibrated under that preset detection probe can be used to extract the sample feature vectors corresponding to these sample response texts under multiple preset feature dimensions. Each sample feature vector is input into the fingerprint classifier to be trained corresponding to that preset detection probe to obtain the predicted probability vector corresponding to each sample feature vector. The predicted probability vector includes the predicted belonging probability of the sample response text corresponding to the sample feature vector under each model service to be calibrated. Then, the prediction loss of the fingerprint classifier to be trained can be determined using the label probability vector and predicted probability vector corresponding to each sample response text, and the fingerprint classifier to be trained can be iteratively trained using this prediction loss until the preset training cutoff condition is met, resulting in the trained fingerprint classifier corresponding to that preset detection probe. The label probability vector corresponding to the sample response text can include the true belonging probability of the sample response text under each model service to be calibrated. Then, it can be re-inputted into the trained fingerprint classifier to obtain the sample probability vector of each sample response text, which includes the belonging probability of the sample response text under each model service to be calibrated.

[0187] T3: Take any model service to be calibrated as the reference model service and other model services to be calibrated as sample replacement services to obtain various model combinations. For each model combination, determine the first sample pair composed of the reference model service and each preset detection probe, and the second sample pair composed of each sample replacement service and each preset detection probe.

[0188] Here, the reference model service is the target model service declared externally, and the sample replacement service is the various replacement model services set up for the reference model service.

[0189] In practice, for each model service to be calibrated, it can be used as a reference model service, and all other model services to be calibrated except for the reference model service can be used as sample replacement services, thus obtaining various model combinations corresponding to each model service as a reference model service. For example, if the model services to be calibrated include services 1 to 3, the model combinations that can be obtained include service 1 as the reference model service, services 2 and 3 as sample replacement services corresponding to combination 1, service 2 as the reference model service, services 1 and 3 as sample replacement services corresponding to combination 2, service 3 as the reference model service, and services 1 and 2 as sample replacement services corresponding to combination 3.

[0190] Furthermore, for each model combination, the reference model service in the model combination can be paired with the probe service pair composed of each preset detection probe as the first sample pair corresponding to the reference model service in the model combination. At the same time, each sample replacement service in the model combination can be paired with the probe service pair composed of each preset detection probe as the second sample pair corresponding to each sample replacement service in the model combination.

[0191] Optionally, if a reference model service is available that cannot be accessed online, the reference model service can be used as a tag fingerprint feature in the historical stability window, contract acceptance window, and multi-region / multi-account consistency window, and the source can be marked in the final generated test report.

[0192] T4: Determine the first anomaly score of each first sample response text based on the sample probability vector of each first sample response text belonging to the first sample pair, and determine the second anomaly score of each second sample response text based on the sample probability vector of each second sample response text belonging to the second sample pair.

[0193] Here, the first sample response text is the reference model service in the first sample pair, and it is the sample response text returned by the probe request initiated by the preset detection probe in the first sample pair. The second sample response text is the sample replacement service from the second sample pair, and it is the sample response text returned by the probe request initiated by the preset detection probe in the second sample pair.

[0194] In practice, for each first sample response text belonging to the first sample pair, a first anomaly score relative to the reference model service can be determined based on the attribution probability of the first sample response text corresponding to the reference model service in the first sample pair within its sample probability vector. Similarly, for each second sample response text belonging to the second sample pair, a second anomaly score relative to each sample substitute service can be determined based on the attribution probability of the second sample response text corresponding to each sample substitute service in the first sample pair within its sample probability vector.

[0195] T5: According to the preset number, divide each first sample response text into multiple first sample text groups, and divide each second sample response text into multiple second sample text groups. Based on the first sample mean score corresponding to the first anomaly score of each first sample response text in each first sample text group, and the second sample mean score corresponding to the second anomaly score of each second sample response text in each second sample text group, determine the query information rate corresponding to each second sample pair.

[0196] Here, the preset number can be a small preset number; for example, the preset number m can be any value less than or equal to 4. Each first sample text group includes a preset number of first sample response texts, and the first sample response texts included in different first sample text groups can be completely different, or they can have some overlap but not complete consistency. The number of first sample text groups to be divided. The settings can be pre-defined based on experience, and this application embodiment does not impose specific limitations. Each second sample text group includes a preset number of second sample response texts, and the second sample response texts included in different first sample text groups can be completely different, or they can partially overlap but not be completely identical. The number of first sample text groups to be divided can also be... .

[0197] In specific implementation, for any preset detection probe, the first sample response texts belonging to the reference model service of the preset detection probe and the first sample pair can be divided into a preset number m from each first sample response text. The first sample text group of each batch. Similarly, for any preset detection probe, the second sample response texts belonging to the sample replacement service of the preset detection probe and the second sample pair can be divided into a preset number m from each second sample response text. The second sample text group of each batch.

[0198] Then, for each first sample text group, the first sample mean score can be determined based on the first anomaly score of the first sample response text included in the first sample text group and the number of first sample response texts included in the first sample text group. For each second sample text group, the second sample mean score can be determined based on the second anomaly score of the second sample response text included in the second sample text group and the number of second sample response texts included in the second sample text group.

[0199] Then, the query information rate corresponding to the second sample pair can be determined using the mean scores of each first sample and the mean scores of each second sample.

[0200] In one embodiment, the step of "determining the query information rate" in T5 above can be implemented according to the following steps: T5-1: For a sample pair group consisting of a first sample pair and a second sample pair with the same preset detection probe, determine the sorting accuracy of the second sample pair in the sample pair group based on the probability that the mean score of the first sample in the sample pair group is less than the mean score of the second sample, and the probability that the mean score of the first sample in the sample pair group is equal to the mean score of the second sample.

[0201] In specific implementation, this applies to devices including the same preset detection probe. c The first and second sample pairs can be based on the preset detection probe. c、 The reference model service in the first sample pair P and the sample replacement service in the second sample pair To form a sample pair group ( c , P , Then, based on the mean scores of each first sample in the sample pair group and the mean scores of each second sample in the sample pair group, the probability that the mean score of the first sample is less than the mean score of the second sample, and the probability that the mean score of the first sample is equal to the mean score of the second sample, can be determined. Based on these probabilities, the sorting accuracy of the second sample pair in the sample pair group under the preset number m can be determined.

[0202] For example, the sorting accuracy can be determined according to the following formula: ; (Formula 12) in, Indicates the second sample pair ( c , j The sorting accuracy for a quantity of m; Indicates that it comes from a preset detection probe. c and reference model services PThe first sample mean score of the m first sample response texts; Indicates that it comes from a preset detection probe. c and sample replacement services The second sample mean score of the m second sample response texts; This represents the probability that the mean score of the first sample is less than the mean score of the second sample. This represents the probability that the mean score of the first sample is equal to the mean score of the second sample. When the value is 0.5, it indicates that the reference model service... P and sample replacement services It is difficult to distinguish between them. When the value is 1, it indicates that the reference model service P and sample replacement services They can be perfectly distinguished from each other.

[0203] T5-2: Determine the initial information rate corresponding to the second sample pair based on the sorting accuracy.

[0204] here, It can represent the second sample pair ( c , j The sorting error rate is set at a quantity m. A lower sorting error rate is better. Since the sorting error rate decreases exponentially with the preset quantity, its logarithm can be approximated linearly over a small preset quantity. Therefore, the application adopted a preset quantity m≤4 for slope fitting. The fitting formula is shown in Formula XII below: ; (Formula 12) in, This represents the intercept of the fitted line. That is, the preset detection probe in the second sample pair. c Sample substitution service relative to the second sample pair The per-query sorting error index (i.e., the operational information rate) is defined as the initial information rate corresponding to the second sample pair.

[0205] In this way, by conducting a few pilot tests on small batches of m≤4 and fitting the above straight line, the operational information rate can be extrapolated to a larger m, thus providing a basis for back-deriving the query budget under the full replacement detection mode.

[0206] T5-3: Using the t-distribution method or the self-sampling method, determine the query information rate of the second sample pair based on the initial information rate.

[0207] In practical implementation, the t-distribution method or bootstrap method can be used for pilot-level fitting. Based on the initial information rate and intercept determined by the sample response texts in different batches, a one-sided (1-γ) confidence bound method is used to determine the query information rate of the second sample pair. Since the extrapolation of small batches with m≤4 is too optimistic, this application adopts a one-sided (1-γ) confidence bound: a confidence bound is taken for each query ranking error index. As the query information rate, the upper confidence bound of the intercept is taken. Using the target intercept can improve the numerical value and security of the subsequently calculated query count.

[0208] In one embodiment, the threshold for the average score in S6 above can be calibrated according to the following steps K1~K3: K1: From the sample response texts, select each third sample response text that belongs to the target sample pair composed of the target detection probe and the target model service, and determine the third anomaly score of each third sample response text based on the sample probability vector of each third sample response text.

[0209] Here, the third sample response text can be the sample response text returned by the target model service in response to the probe request initiated by the target detection probe. The target sample pair can be ( , P ).

[0210] For example, one can filter out those belonging to (…) from the sample response text. , P The third anomaly score of each third sample response text can be determined based on the probability of belonging to the target model service P in the sample probability vector of each third sample response text.

[0211] K2: Based on a fixed number of tests, each third sample response text is divided into multiple third sample text groups.

[0212] In practice, it can be implemented according to From each third-sample response text, segmentation Each batch of third sample text groups includes... There are three third sample response texts, and the third sample response texts included in different third sample text groups can be completely different, or they can have some overlap but not be completely consistent.

[0213] K3: Based on the mean score of the third sample response text corresponding to the third anomaly score in each third sample text group, sort the mean scores of each third sample in descending order, and determine the mean score threshold based on the sorting result and the target sorting quantile.

[0214] In practice, for each third sample text group, the third anomaly score of each third sample response text in that third sample text group can be used as a basis. First, determine the mean score of the third sample text. Then, sort the mean scores of each third sample text in descending order of mean score to obtain the sorted result of each third sample mean score. Finally, determine the mean threshold score based on the sorted result and the preset target sort quantile.

[0215] For example, the threshold for the mean score can be determined according to Formula Thirteen: (Formula Thirteen) in, This represents the threshold value of the average score under preset detection probe c and quantity m. This represents the mean anomaly score of the m sample response texts in the b-th batch under the target / reference model service. express Each batch Arrange them in ascending order, and take the position located at ( The value of the proportional position. Wherein, The value can be set empirically; for example, it can be 0.05, representing the 95th percentile, or 0.01, representing the 99th percentile.

[0216] In practice, the mean score of the third sample text can be used. Substituting into Formula 13 above, the threshold for the average score under the target detection probe and a fixed number of detections can be determined. .

[0217] In one embodiment, the target probe service can calibrate the pre-defined first false alarm rate, first replacement probability, fractional detection threshold, and alarm count threshold according to the following steps M1~M6: M1: From the third sample response text, select the first number of first target texts, and use the third anomaly score of each first target text and multiple preset probabilities to determine the detection threshold of multiple candidate scores corresponding to the target model service.

[0218] Here, multiple preset probabilities can be a pre-set set of honest tail probabilities. The number of preset probabilities is not specifically limited in this application. For example, The preset probabilities can include {0.2, 0.1, 0.05, 0.01, ...}. First quantity The settings can be based on experience, and this application embodiment does not impose specific limitations. The first target text can be any response text from the third sample response text. The candidate score detection threshold is used to indicate the score detection threshold that the target model service can select when performing replacement detection.

[0219] In practice, when encountering hybrid routes, it's necessary to convert the abnormal scores of the response text under the alternative model service to "tell". Therefore, a score detection threshold is needed to determine whether the conversion is feasible. For example, the score detection threshold... The anomaly score of the response text under the alternative model service Greater than In this case, the response text can be used as a tell in the alternative model service. Understandably, A low value will result in a false positive detection of honest service, but the probability of a false positive is high. While a high level of precision can avoid false detections, it may lead to missed abnormal responses due to low-proportion replacements. Therefore, it can be used in conjunction with training the fingerprint classifier. In the phase separation calibration, a system composed of multiple preset probabilities is used. And randomly select a first number of first target texts from the third sample response text to generate a candidate threshold set consisting of multiple candidate score detection thresholds corresponding to the target model service.

[0220] Specifically, candidate threshold set ,in, express Item from target model service P The third anomaly score of each first target text. That is, the r-th service comes from the target model. P The first target text The third abnormal score, for each preset probability ,Pick The third anomaly score of the first target text (1- ) Quantiles are used as a candidate score detection threshold.

[0221] M2: From the sample response texts belonging to the target probe service pair, filter out a second number of second target texts, and determine the fourth anomaly score for each second target text based on the sample probability vector of each second target text.

[0222] Here, the second quantity The settings can be based on experience, and this application embodiment does not impose specific limitations. The second target text can be a target probe service pair ( , j The fourth anomaly score is used to indicate the second target text in the target probe service pair ( ). , j Alternative model services in ) Abnormal scores.

[0223] In practice, for each target probe service pair ( , j ), can belong to the target probe service pair ( , j Randomly select from the sample response text of ) The text is used as the second target text under the target probe service pair. Then, for each second target text, the alternative model service within the target probe service pair can be determined based on the sample probability vector of the second target text. The attribution probability is calculated, and based on this attribution probability, the second target text is determined in the alternative model service. The fourth abnormal score.

[0224] M3: For any candidate score detection threshold, determine the reference false alarm rate of the target model service at the candidate score detection threshold based on the number of third abnormal scores greater than the candidate score detection threshold and the first number, and determine the reference replacement probability of the target probe service at the candidate score detection threshold based on the number of fourth abnormal scores greater than the candidate score detection threshold and the second number.

[0225] In practice, for any candidate score detection threshold ∈ The reference false alarm rate (reference tell rate) and the reference substitution probability (also known as the candidate tell rate) can be estimated using independently calibrated responses. Specifically, the parameter false alarm rate and the reference substitution probability can be determined using the following formulas fourteen and fifteen, respectively: (Formula Fourteen) (Formula Fifteen) in, Represents the target model service P Candidate score detection threshold The reference false alarm rate is as follows. Indicates the third abnormal score; This indicates that the target probe service is at the candidate score detection threshold. The corresponding reference replacement probability; express Item from ( , j Alternative model services in ) The second target text below The fourth abnormal score.

[0226] M3: Determine the set of calibration score detection thresholds for the target probe service pair based on the reference replacement probability and the reference false alarm rate; the set of calibration score detection thresholds includes each retained candidate score detection threshold where the reference replacement probability is greater than the reference false alarm rate.

[0227] In practice, only candidate tell rates that are more likely to trigger the tell score detection threshold compared to the reference tell rate (i.e., Greater than Replaced response text exceeds the candidate score detection threshold more often than honest response text. Only a threshold of ) has discriminative power, so each probe model can be paired with ( c , j Preserve the set of calibrated score detection thresholds Among them, the set of calibration score detection thresholds is the probe model pair ( c , j The corresponding positive interval set. Probe model pairs ( c , j The set of calibration score detection thresholds corresponding to the probe model includes the detection thresholds of each retained candidate score, which is the probe model pair ( c , j The corresponding calibration score detection thresholds are given. Understandably, the set of calibration score detection thresholds for a target probe service pair can be represented as... .

[0228] M4: Determine the mixed replacement probability of the target probe service pair under the retained candidate score detection threshold based on the preset minimum dilution ratio, the reference replacement probability of the target probe service pair under the retained candidate score detection threshold, and the reference false alarm rate of the target model service under the retained candidate score detection threshold.

[0229] Here, the preset minimum dilution ratio This can be specified by the user in the audit target.

[0230] In practice, the minimum dilution ratio required by the user for testing... The mixed replacement probability (i.e., the mixed tell rate) can be directly obtained from the tell rates of the two pure models (i.e., the reference replacement probability and the reference false alarm rate) according to the following formula sixteen: (Formula Sixteen) in, Indicates probe service pair ( c , j ) retain candidate score detection threshold The probability of mixing and substitution. That is, if the actual mixing ratio is exactly 1 / 2. Then the probability of triggering tell by randomly selecting a response text is equal to "1- The probability comes from the target model service (tell rate is) ),by The probability comes from the replacement model service (tell rate is) The weighted average of the two cases of ")". (The text is incomplete and requires further context.) and After that, regardless of the user settings The probability of mixed substitution can be determined according to Formula 16 above, regardless of the value.

[0231] Understandably, the target probe service has a mixed replacement probability at the candidate score detection threshold. .

[0232] M5: Determine the first false alarm rate, the first replacement probability, the score detection threshold, and the alarm count threshold based on the mixed replacement probability and the target detection error.

[0233] In practice, the first false alarm rate, first replacement probability, score detection threshold, and alarm count threshold of the target probe service can be determined based on the mixed replacement probability and target detection error of the target probe service under each retained candidate score detection threshold.

[0234] In one embodiment, the above-mentioned M5 can be implemented according to the following steps: M5-1: Using the upper tail test probability of the binomial distribution between the reference false alarm rate and the number of alarms of the target model service under the retained candidate score detection threshold as the objective, the number of alarms to be used under the retained candidate score detection threshold is determined.

[0235] In practice, the number of times "tell" appears in m response texts (i.e., the number of alarms) can be regarded as a binomial distribution problem, and the upper tail test probability of the binomial distribution (referred to as the upper tail of the binomial distribution) can be denoted. The upper tail of this binomial distribution is used to represent the tell rate for each response text. p And when there are m response texts, the number of times `tell` is used. K At least reach b The probability of this is then given in any probe service pair consisting of a preset detection probe and an alternative model service. c , j The number of alarms to be used can be represented by the following formula: (Formula 17) in, This represents the alarm threshold, specifically the second false alarm rate of m response texts in the target service model. p The number of alarms to be used below 0. The tell rate represents the tell rate of each response text. p The number of times `tell` is used when there are 0 responses and a total of m response texts. K At least reach The probability of this error does not exceed the false alarm rate in the target detection error. The minimum number of alarms required to be used, i.e., through It can be found that the second false alarm rate in the target service model is p At 0, at least The probability of telling the next time does not exceed The smallest integer That is, at least observe The alarm is only triggered after the first tell, in order to reduce the error rate. the following.

[0236] In practice, when determining the various thresholds corresponding to the target model service, the reference false alarm rate of the target service model under the candidate score detection threshold can be used. and number of alarms The binomial distribution tail test probability between them is less than the false alarm rate in the target detection error. For the target, provide the corresponding service based on the target model. Using Formula 17 above, determine the number of alarms to be used for the target model service at each retained candidate score detection threshold. .

[0237] M5-2: Determine the dual power of the target probe service at the retained candidate score detection threshold based on the mixed replacement probability and the number of alarms to be used at the retained candidate score detection threshold.

[0238] In practice, any probe service pair ( c , j The two effects of ) can be expressed by the following formula eighteen: (Formula 18) This can be expressed as a true mixture dilution ratio of... (The probability of telling is) When the number of tell counts reaches the number of alarms to be used, that is, the probability of actual dilution.

[0239] Furthermore, the target probe service can be configured to perform mixed replacement probabilities at the retained candidate score detection threshold. and the number of alarms to be used Substituting into Formula 18, we obtain the binary power under the candidate score detection threshold. .

[0240] M5-3: For each target probe service, for each corresponding retained candidate score detection threshold, with the goal of achieving the target efficacy with the two-factor efficacy under the retained candidate score detection threshold, determine the number of candidate detections under the retained candidate score detection threshold; Here, the target power can be defined as 1 - the false negative rate in the target detection error. .

[0241] In practical implementation, for each probe service pair and each corresponding retained candidate score detection threshold, the binomial power achieved at that retained candidate score detection threshold can be calculated. Find the minimum number of queries and take the score detection threshold that saves the most queries. The left-hand side can represent the threshold for retaining candidate scores. Gradually increase the number of queries m until both functions are achieved. First time reaching This m is the threshold. The query budget (i.e., the number of detections to be used) is calculated below. The right-hand side represents selecting the threshold that minimizes the query budget (i.e., the most cost-effective query) among all retained candidate score detection thresholds. This refers to the number of candidate detections under the threshold of retaining candidate scores.

[0242] For each target probe service, a detection threshold is set for each retained candidate score. It can detect the scores of each retained candidate under the specified threshold. Substituting these values ​​into the above score detection threshold expression, we obtain the number of candidate detections for the target probe service pair under the retained candidate score detection threshold. .

[0243] M5-4: The target detection threshold corresponding to the minimum number of candidate detections is used as the score detection threshold, the reference false alarm rate of the target model service under the target detection threshold is used as the first false alarm rate, the mixed replacement probability of the target probe service under the target detection threshold is used as the first replacement probability, and the number of alarms to be used under the target detection threshold is used as the alarm count threshold.

[0244] In practice, the minimum candidate detection count among the candidate detection counts with a small retained candidate score detection threshold for the target probe service is used as a pre-defined second detection count to be used for that target probe service; simultaneously, the target detection threshold corresponding to the minimum candidate detection count can be... The false positive rate serves as a reference for setting the target model to the target detection threshold, and is used as the score detection threshold. As the first false alarm rate The probability of mixed replacement of the target probe service pair at the target detection threshold. As the first replacement probability And the number of alerts to be used when the target model is used to meet the target detection threshold. As a threshold for the number of alarms .

[0245] In one embodiment, the service replacement detection method provided in this application further includes detection methods under non-fixed budget rules, such as steps P1~P3: P1: If the detection stopping rule is a sequential verification rule or a stop rule at any time, then obtain the target detection probe, the first detection threshold for each target mode, and the label fingerprint features of each registered model service calibrated based on the target detection error for the candidate service set and the target model service during the offline calibration stage.

[0246] For example, if the detection stopping rule is a sequential verification rule or an anytime stopping rule, then the target detection probe calibrated for the candidate service set and the target model service based on the target detection error during the offline calibration phase can be obtained. The first detection threshold for each target mode (e.g.) and serve various alternative models The first false alarm rate calibrated offline respectively First replacement probability Score detection threshold Alarm frequency threshold .

[0247] P2: Using the target detection probe, audit requests are sent to the endpoint to be audited in sequence to obtain the third response text under each audit request. Based on the abnormal score, first detection threshold and label fingerprint features of each obtained third response text under each registered model service, it is determined whether the current detection result under any target mode meets the stopping condition.

[0248] P3: If not, return to the step of using the target detection probe to sequentially initiate audit requests to the endpoint to be audited until the current detection result in any target mode meets the stop condition, and determine the target detection result based on the latest current detection result.

[0249] Here, the stopping condition can be to proactively stop the audit when there is sufficient evidence. Sufficient evidence can be understood as the ability to detect the initial detection results under various target modes based on the obtained third-party response texts.

[0250] For example, the third response text is the visible response text returned by the audit request to the audit endpoint according to the target controlled output space indicated by the target detection probe. After obtaining the first detection threshold, during the online audit phase, the target detection probe can be used to sequentially initiate audit requests to the audit endpoint to obtain the third response text returned by the audit endpoint. Specifically, after each audit request is sent and detection is performed under the target model, the next audit request can be sent if no replacement is detected. If a replacement is detected, the continued sending of audit requests can be stopped. For each obtained third response text, based on the anomaly score of each third response text under each registered model service, the first detection threshold, and the label fingerprint features, the e-process (sequential e-process) or Wald's Sequential Probability Ratio Test (SPRT) can be used to determine whether the current detection result under any target model meets the stopping condition, thereby achieving proactive stopping of auditing at the evidence component level and reducing query consumption.

[0251] For example, to support provincial budget audits that involve simultaneous investigation and judgment, and cessation upon achieving significant results, an anytime-valid betting-style e-process can be implemented. =1{ > Let} be the tell instruction for the third response text returned in the i-th iteration, with the null hypothesis that the tell rate is... p 0. The process of maintaining non-negative wealth ,in Relying solely on historical third-response text indicates a predictable betting proportion, which can be estimated using lazy Kelly betting strategies or gradient reward online betting (GROW) strategies. The stopping condition can be the first t... ≥ That is, to determine dilution. By Ville's inequality, under the null hypothesis... Since it is a non-negative martingale, therefore This allows for arbitrary data correlation pauses and mid-process peeks; Sub denotes the supremum. Alternatively, the Wald sequential probability ratio test can be used as an alternative implementation.

[0252] In one embodiment, this application also provides a method for periodically updating the false positive rate and / or candidate score detection threshold of a target service model. Specifically, multiple real response texts of the target model service can be periodically obtained, and the false positive rate and candidate score detection threshold of the target model service can be adjusted according to the abnormal scores of the multiple real response texts under the target model service.

[0253] For example, because the same model service may drift over time, load, or backend shifts, the threshold calibrated for the model service may become inaccurate on fresh traffic. Therefore, multiple real response texts from the target model service can be periodically obtained, and these real response texts can be defined as a fresh honesty window. Then, using each real response text in the fresh honesty window, based on the calculation process of the false positive rate in Formula 14 above, the second false positive rate of the target model service can be periodically updated. p 0, and can fine-tune the calibration threshold of the target model service to maintain a valid honest null hypothesis.

[0254] Alternatively, when the accumulated number of true response texts from the target model service reaches a certain amount, these true response texts can be defined as a fresh honest window, and then the second false alarm rate can be updated using the true response texts in the fresh honest window. p 0, and can fine-tune the calibration threshold of the target model service.

[0255] For example, in situations where there are multiple alternative model services ( , ..., When the target model service for the audit endpoint is diluted in a mixed manner, the proportion of multiple audit requests routed to each alternative model service can be: , ..., At this point, the response distribution of the endpoint to be audited can be described as follows: This response distribution can be understood as the proportion of the response text returned by the endpoint to be audited each time. From the j-th replacement model service , with the remaining proportion From target model service P This response distribution is also the multi-dilution source version corresponding to Formula 1 above, when J When =1, it corresponds to Formula 1 above. In this case, when estimating the dilution ratio, it's not about estimating the dilution benefits of a single alternative model, but rather a ratio vector. Total external proportion of endpoints to be audited This ratio can represent the total share of water added to the target model service by the replaced model service; This indicates the honest share of the service from the target model.

[0256] Furthermore, for mixed dilution detection of multiple alternative model services, it can be performed according to the total proportion of exogenous data. The rules are clear, and no user registration is required. Specifically, the probability of a response text triggering `tell` under multiple alternative model services is: The left-hand side of the equation represents the honest share. Multiply by the honesty rate plus each replacement share Multiply by their respective candidate tell rates This is equivalent to a replacement model service. The probability of returning the response text is greater than The probability of each. The equation on the right represents the probability of each Magnify to the smallest of them The next term, i.e., the tell probability, is at least the total external proportion multiplied by the tell probability of the weakest separable source. Furthermore, as long as the substitution proportions of each alternative model service are relatively independent, that is, the alternative model services are separable (all exist to make...), Greater than If the threshold is met, then the any-tell budget can be calculated as a percentage of total external funding. In other words, the cost of detecting any external response can be reduced by the total water content. Together with the weakest dilution source, it determines, with according to Similar to single-source dilution, the detection phase does not require registration of any alternative model service; it relies solely on the model itself. P An alarm can be triggered based on the fingerprint characteristics of the tag.

[0257] In summary, the service replacement detection method provided in this application can be divided into a closed-loop process: estimating the query information rate → determining the audit budget based on the target detection error → performing online auditing according to the budget. To facilitate understanding of the service replacement detection method provided in this application, this application also provides, for example... Figure 2 The diagram illustrates a detection process. The service replacement detection method provided in this embodiment can be divided into an offline calibration stage and an online audit stage. In the offline calibration stage, tagged sample response text can be used, and the audit plan can be frozen based on the audit objectives. Specifically, in the offline calibration stage, reference model services can be collected. P With alternative model services The system generates labeled sample text responses, extracts sample feature vectors from these responses, trains a fingerprint classifier, and defines anomaly scores. Then, a small budget *m* can be used to estimate the initial information rate, the query information rate, and calculate the full replacement budget *m_full*; and for each probe service, the first false alarm rate, the first replacement probability, the score detection threshold, the alarm count threshold, and the second number of detections to be used can be calibrated. This allows for the selection of feasible probe sets and the selection of target detection probes. Determine the fixed number of tests This involves freezing all thresholds and the signature fingerprint features of each model service. Then, during the online auditing phase, this can be utilized... Send to the endpoint to be audited The audit request was received. Each first response text is processed. Anomaly score, probability vector, mean score, and batch mean posterior are calculated for each first response text. Then, the text can be processed by a full replacement detection head for full replacement testing and model attribution based on the mean score threshold; and by a proportional replacement detection head for tell count testing, proportional estimation, and model attribution. Finally, based on the detection results from both heads, the corresponding triplet (flag, ...) corresponding to the target detection result can be input. , ).

[0258] It should be noted that this application provides two tests: one is the any-tell diagnostic test, which issues an alert when any alternative model service tells the message. If a separation threshold exists, the first false alarm rate can be made extremely low, resulting in a relatively low query budget. It is close to 1 / ε and can be used as a diagnostic tool for separation. The value of can basically vary with ε by 1 / ε. Another deployment test uses a fixed p0 two-proportion test. The purpose of this test is to achieve robust control of Type I errors during deployment. The honest tell rate p0 is fixed in advance (and independently re-evaluated on fresh honest windows that are not intersecting with calibration / audit to obtain an effective finite-sample null hypothesis and avoid data dependency threshold problems). A two-proportion test is used to judge dilution, thereby achieving Type I robustness. The cost is that regardless of the degree of separability, it is calculated according to 1 / ε. Law calculation. The local budget after fixing p0 > 0 is: .in, This indicates that it is proportional to the value inside the parentheses. Because the denominator contains... Therefore, the number of queries can be adjusted according to ε. increase.

[0259] Understandably, the auditor implementing the service replacement detection method provided in this application may include a system composed of various modules related to the service replacement detection method provided in this application. These modules may include a probe generation module, a response acquisition module, a feature extraction module, a fingerprint modeling module, an information rate estimation module, a probe selection and budget scheduling module, an online judgment module, a fresh window calibration module, and a reporting and evidence storage module. The probe generation module can be used to generate probe requests according to preset detection probes and control the number of independent queries. Temperature, output length, and format are specified. The response acquisition module can send requests to the target model service, reference model service, alternative model service, and auditable endpoint, and save the returned visible text responses and request metadata. The feature extraction module is used to extract feature vectors from each visible text response. The fingerprint modeling module is used to train the fingerprint classifier, calculate anomaly scores, and batch evidence. The module calculates the label fingerprint features of the computational model. The information rate estimation module is used to estimate the initial information rate, query information rate, and tell rate (first false alarm rate, first substitution probability, etc.) in a small-budget pilot program. The probe selection and budget scheduling module allows users to select... Based on the false negative rate False alarm rate and minimum dilution ratio Calculation The audit plan is frozen. The online judgment module performs online detection to ensure comprehensive detection across various target modes. The fresh window calibration module re-estimates the second false alarm rate and fine-tunes thresholds based on fresh honest windows that do not intersect with calibration / audit. The reporting and evidence storage module outputs target detection results, response summaries, and evidence hashes for compliance or regulatory purposes.

[0260] In summary, the service replacement detection method provided in this application has at least the following effects: 1. Black-box auditing is available. Only visible response text from the endpoint to be audited is required. Auditing can be achieved without model weights, log probabilities, token rankings, routing logs, etc. It is compatible with cloud APIs, model gateways, and regulatory spot check scenarios.

[0261] 2. It can detect mixed route dilution rather than just full replacement, and can estimate the replacement ratio. Through response-level tell threshold and binomial / binary ratio tests, even under a large number of requests, it can detect foreign components in the feedback from the target model service and output the results. And CI.

[0262] 3. The query budget (i.e. the number of audits required) can be calculated before the audit, thus saving query costs.

[0263] 4. High query efficiency for separable substitution models; dilution detection of separable pairs is close to 1 / ε; gapped pairs match with close to 1 / ε; near twin pairs fall within... .

[0264] 5. It can perform large-scale diluted audits on multiple endpoints to be audited, and the audit results are reliable.

[0265] 6. It has the ability to handle unknown models and can issue alerts for foreign responses with low probability based solely on the label fingerprint features of the target model service. It can also maintain reliable detection accuracy by deleting the real alternative model service and can handle the replacement of unregistered model services.

[0266] 7. Base model specificity and resistance to false alarms due to format and temperature differences: Through content-independent features and length / format ablation, fresh honest window recalibration and conservative confidence lower bound, it can distinguish between true replacement and honest format / temperature readjustment differences.

[0267] 8. Fresh Honest Window Recalibration: Independently re-evaluate p0 on fresh honest windows that are not intersecting with calibration / audit and support fine-tuning of thresholds, thereby maintaining the effective honest null hypothesis and controlling Type I errors during deployment.

[0268] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0269] Based on the same inventive concept, this application also provides a service replacement detection device corresponding to the service replacement detection method. Since the principle of the device in this application is similar to the service replacement detection method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0270] like Figure 3 The diagram shown is a schematic of a service replacement detection device provided in an embodiment of this application, comprising: The first acquisition module 301 is used to acquire the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stopping rules, target detection error and candidate service set; wherein, when the candidate service set is not empty, it includes at least one alternative model service related to the target model service; The second acquisition module 302 is configured to acquire, during the offline calibration phase, first detection information based on the target detection error for the candidate service set and the target model service, if the detection stopping rule is fixed budget stopping; the first detection information includes a fixed number of detections under the target detection probe, a first detection threshold for each target mode, and a label fingerprint feature for each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service; Request module 303 is used to initiate an audit request to the endpoint to be audited according to the fixed number of detections using the target detection probe, and obtain each first response text under the fixed number of detections; The first determining module 304 is used to determine the belonging probability of the first response text under each registered model service using the fingerprint classifier trained in the offline calibration stage, and to determine the anomaly score of the first response text under each registered model service based on the belonging probability. The second determining module 305 is used to determine the initial detection result in each of the target modes based on the anomaly score, the first detection threshold, and the tag fingerprint features, and to determine the target detection result based on each of the initial detection results; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and replacement ratio information.

[0271] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0272] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0273] Based on the same technical concept, embodiments of this application also provide a computer device. (Refer to...) Figure 4 The diagram shown is a structural schematic of a computer device provided in an embodiment of this application, comprising: The processor 401, memory 402, and bus 403 are included. Memory 402 stores machine-readable instructions executable by the processor 401. The processor 401 executes the machine-readable instructions stored in memory 402. When the machine-readable instructions are executed by the processor 401, the processor 401 performs the steps S101 to S105 described above.

[0274] The aforementioned memory 402 includes a main memory 4021 and an external memory 4022. The main memory 4021, also known as internal memory, is used to temporarily store the computational data in the processor 401, as well as the data exchanged with external memory such as a hard disk 4022. The processor 401 exchanges data with the external memory 4022 through the main memory 4021. When the computer device is running, the processor 401 and the memory 402 communicate through the bus 403, so that the processor 401 executes the execution instructions mentioned in the above method embodiments.

[0275] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the service replacement detection method described in the above method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0276] This application also provides a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the service replacement detection method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0277] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0278] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it can be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0279] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0280] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0281] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0282] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the user through pop-up information or by asking the user to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0283] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting service replacement, characterized in that, The method includes: Obtain the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stopping rules, target detection error and candidate service set; wherein, if the candidate service set is not empty, it includes at least one alternative model service related to the target model service; If the detection stopping rule is a fixed budget stop, then the first detection information calibrated for the candidate service set and the target model service based on the target detection error during the offline calibration phase is obtained; the first detection information includes a fixed number of detections under the target detection probe, a first detection threshold for each target mode, and a label fingerprint feature for each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service; Using the target detection probe, an audit request is sent to the endpoint to be audited according to the fixed number of detections, and the first response texts under the fixed number of detections are obtained; Using the fingerprint classifier trained in the offline calibration phase, the belonging probability of the first response text under each registered model service is determined, and based on the belonging probability, the anomaly score of the first response text under each registered model service is determined. Based on the anomaly score, the first detection threshold, and the tag fingerprint features, an initial detection result is determined for each of the target modes, and a target detection result is determined based on each initial detection result; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and replacement ratio information.

2. The method according to claim 1, characterized in that, The various preset detection modes include a full replacement detection mode and a proportional replacement detection mode; When the selected target mode includes the full replacement detection mode and the proportional replacement detection mode, the fixed number of detections is determined based on the maximum value of the first number of detections offline calibrated for the full replacement detection mode and the second number of detections offline calibrated for the proportional replacement detection mode. The first detection threshold includes the average score threshold offline calibrated for the full replacement detection mode, the first false alarm rate, the first replacement probability, the score detection threshold, and the alarm count threshold offline calibrated for each replacement model service.

3. The method according to claim 2, characterized in that, The step of using a fingerprint classifier trained in the offline calibration phase to determine the attribution probability of the first response text under each registered model service, and determining the anomaly score of the first response text under each registered model service based on the attribution probability, includes: The first response text is subjected to feature extraction according to multiple preset feature dimensions to obtain the target feature vector corresponding to the first response text; the multiple preset feature dimensions are all related to the text content and are not related to the text source features. Using a trained fingerprint classifier, a probability vector corresponding to the first response text is determined based on the target feature vector; the probability vector includes the belonging probability of the first response text under each registered model service. Using a preset scoring formula, the probability of belonging to each registered model service is scored to obtain the anomaly score of the first response text under each registered model service.

4. The method according to claim 2, characterized in that, The step of determining the initial detection result for each target mode based on the anomaly score, the first detection threshold, and the tag fingerprint features includes: In the case where the target mode includes the full replacement detection mode, the average first score of the endpoint to be audited under the target model service is determined based on the anomaly score of each first response text under the target model service and the fixed number of detections; If the average score of the first test is greater than the average score threshold in the first detection threshold, it is determined that the target model service is subject to full replacement. Based on the maximum attribution probability of each first response text under each registered model service and the lower probability limit carried in the tag fingerprint feature of each registered model service, it is determined whether the target model service is replaced by an unregistered model service other than the replacement model service. If not, then based on the attribution probability of each first response text under each alternative model service and the fixed number of detections, determine the second average score of the endpoint to be audited under each alternative model service; Based on the second average score, a target replacement model is selected from each of the replacement model services to fully replace the target model service, and the initial detection result in the full replacement detection mode is determined based on the target replacement model and the full replacement ratio.

5. The method according to claim 2, characterized in that, The step of determining the initial detection result for each of the target modes based on the anomaly score, the first detection threshold, and the tag fingerprint features includes: If the target mode includes the proportional replacement detection mode, then the number of first abnormal responses under each alternative model service is determined based on the abnormal score of each first response text under each alternative model service and the score detection threshold corresponding to each alternative model service in the first detection threshold. Based on the number of first abnormal responses corresponding to each of the alternative model services and the alarm count threshold corresponding to the alternative model service in the first detection threshold, the alarm models that need to be alarmed are selected from the alternative model services. The number of second abnormal responses under unregistered model services is determined based on the maximum attribution probability of each first response text under each registered model service and the lower probability limit carried in the tag fingerprint features of each registered model service. Based on the first false alarm rate, first replacement probability, and tag fingerprint features corresponding to the alarm model in the first detection threshold, and / or the second abnormal response number, the replacement ratio information of the alarm model and the unregistered model service for the target model service is determined, and the initial detection result in the ratio replacement detection mode is determined based on the replacement ratio information.

6. The method according to claim 5, characterized in that, The step of determining the replacement ratio information of the alarm model and the unregistered model service for the target model service based on the first false alarm rate, the first replacement probability, and the tag fingerprint features corresponding to the alarm model in the first detection threshold, and / or the second abnormal response number, includes: Based on the number of alarm models, proportional solution parameters are selected from the first false alarm rate, the first replacement probability, and the tag fingerprint features corresponding to each alarm model. Using the proportional solution parameters of each alarm model, the replacement ratio information of each alarm model for the target model service is determined. And / or, based on the second number of abnormal responses and the second false alarm rate calibrated offline for the target model service, determine the first replacement ratio of the unregistered model service for the target model service, and based on the first replacement ratio and the maximum attribution probability, determine the replacement ratio information of the unregistered model service for the target model service.

7. The method according to claim 6, characterized in that, The step involves selecting proportional solution parameters from the first false alarm rate, the first replacement probability, and the tag fingerprint features corresponding to each alarm model based on the number of alarm models, and using the proportional solution parameters of each alarm model to determine the replacement ratio information of each alarm model for the target model service, including: When there is only one alarm model, the first false alarm rate and the first replacement probability corresponding to the alarm model are used as the proportional solution parameters; The second replacement probability of the alarm model is determined using the first abnormal response count of the alarm model and the fixed number of detections. The second replacement ratio corresponding to the alarm model is determined based on the difference between the second replacement probability and the first false alarm rate in the proportional solution parameters, and the difference between the first replacement probability and the first false alarm rate in the proportional solution parameters. Using a preset estimation method, the confidence interval of the second replacement ratio is determined based on the binomial variance of the second replacement probability and the offline calibration error of the ratio solution parameter. Based on the second replacement ratio and the confidence interval, the replacement ratio information of the alarm model for the target model service is determined.

8. The method according to claim 6, characterized in that, The step involves selecting proportional solution parameters from the first false alarm rate, the first replacement probability, and the tag fingerprint features corresponding to each alarm model based on the number of alarm models, and using the proportional solution parameters of each alarm model to determine the replacement ratio information of each alarm model for the target model service, including: When there are multiple alarm models, the tag fingerprint features corresponding to each alarm model are used as the proportional solution parameters. Based on the attribution probability of each first response text under each registered model service, the mean probability vector is determined, and based on the tag fingerprint features corresponding to each alarm model and the tag fingerprint features corresponding to the target model service, it is determined whether the replacement ratios corresponding to each alarm model are independent of each other. If so, then the third replacement ratio corresponding to each alarm model is determined with the goal of minimizing the difference distance between the mean probability vector and the first response distribution of each first response text in the target model service and each alternative model service; wherein, the first response distribution is determined based on the product of the usage ratio corresponding to the target model service and the tag fingerprint feature, and the product of the replacement ratio corresponding to each alternative model service and the tag fingerprint feature. For each third replacement ratio, a preset estimation method is used to determine the confidence interval of the third replacement ratio based on the offline calibration error of the tag fingerprint feature corresponding to the alarm model. Based on the third replacement ratio and the confidence interval, the replacement ratio information of each alarm model for the target model service is determined.

9. The method according to claim 8, characterized in that, The method further includes: If the replacement ratios corresponding to each alarm model are not independent of each other, then each model to be estimated and each combination to be estimated are determined based on the tag fingerprint features corresponding to each alarm model and the tag fingerprint features corresponding to the target model service; wherein, the model to be estimated is a first alarm model whose replacement ratio is independent of other alarm models, and the combination to be estimated includes multiple second alarm models whose replacement ratios are not independent of each other. With the goal of minimizing the difference between the mean probability vector and the second response distribution of each first response text in the target model service and each alternative model service, the fourth replacement ratio corresponding to each model to be estimated and the fourth replacement ratio of each combination to be estimated are determined; the second response distribution is determined based on the product of the usage ratio corresponding to the target model service and the tag fingerprint feature, the product of the replacement ratio corresponding to each first alarm model and the tag fingerprint feature, and the product of the replacement ratio corresponding to each combination to be estimated and the tag fingerprint feature; Using a preset estimation method, the confidence interval of the fourth replacement ratio is determined based on the offline calibration error of the tag fingerprint features corresponding to the alarm model. Then, based on the fourth replacement ratio and the confidence interval, the replacement ratio information for the target model service is determined.

10. The method according to claim 1, characterized in that, The method further includes: If the candidate service set is empty, and the detection stopping rule is fixed budget stopping, then the second detection information for the target model service calibration during the offline calibration phase is obtained; the second detection information includes the number of target detections under the target detection probe and the second detection threshold for each target mode; Using the target detection probe, an audit request is sent to the endpoint to be audited according to the target detection count, and the second response texts under the target detection count are obtained; Using the fingerprint classifier trained in the offline calibration phase, the target probability of the second response text under the target model service is determined, and based on the target probability, the anomaly score of the second response text under the target model service is determined. Based on the anomaly score and the second detection threshold, an initial detection result is determined for each of the target modes, and a target detection result is determined based on each of the initial detection results.

11. The method according to claim 10, characterized in that, When the selected target mode includes a full replacement detection mode and a proportional replacement detection mode, the second detection threshold includes an offline calibrated average score threshold for the full replacement detection mode, an offline calibrated target score threshold for the unregistered model service, and a target alarm count threshold. The step of determining the initial detection result for each of the target modes based on the anomaly score and the second detection threshold includes: For the full replacement detection mode, based on the anomaly score of each second response text under the target model service and the number of target detections, the mean third score of the endpoint to be audited under the target model service is determined; If the average score of the third score is greater than the average score threshold in the second detection threshold, it is determined that the target model service has been fully replaced, and the initial detection result in the full replacement detection mode is determined based on the full replacement ratio and the identification information of the unregistered model service. For the aforementioned proportional replacement detection mode, the number of third abnormal responses to the target model service is determined based on the abnormal scores of each of the second response texts under the target model service and the target score threshold. If the number of third abnormal responses is greater than the target alarm count threshold, the fifth replacement ratio of the unregistered model service for the target model service is determined based on the number of third abnormal responses and the second false alarm rate calibrated offline for the target model service. The replacement ratio information of the unregistered model service for the target model service is determined based on the maximum value of the fifth replacement ratio and the target probability. Based on the replacement ratio information of the unregistered model service for the target model service, the initial detection result is determined in the ratio replacement detection mode.

12. The method according to claim 2, characterized in that, During the offline calibration phase, the first detection information for calibrating the candidate service set and the target model service based on the target detection error includes: During the offline calibration phase, the query information rate of the probe service, which is composed of various alternative model services and various preset detection probes in the candidate service set, is obtained for calibration. The query information rate is used to indicate the change in replacement detection capability each time a probe request is sent to the endpoint to be audited. Different preset detection probes are used to instruct the registered model service to output random response text of different lengths in different controlled output spaces. Based on the query information rate of the probe service pair to which each preset detection probe belongs and the target detection error, determine the first number of detections to be used for each preset detection probe; Using the constraint that the number of detections does not exceed a preset detection threshold and the set of detection thresholds for the corresponding calibration scores of the probe service is not empty, candidate probes are selected from each of the preset detection probes based on the second number of detections to be used for each of the probe services and the first number of detections to be used for each of the preset detection probes. Based on the query information rate of each candidate probe pair, the minimum information rate of each candidate probe pair is determined, and the candidate probe with the largest minimum information rate is taken as the target detection probe of the endpoint to be audited. Based on the query information rate of each target probe service pair to which the target detection probe belongs and the target detection error, the first number of detections corresponding to the target detection probe is determined, and the second number of detections to be used, which is pre-marked for the target probe service pair, is used as the second number of detections to be performed for the target probe service pair. The maximum value between the first detection count and the second detection count is taken as the fixed detection count, and the pre-calibrated average score threshold under the fixed detection count, as well as the pre-calibrated first false alarm rate, first replacement probability, score detection threshold, and alarm count threshold for each target probe are obtained.

13. The method according to claim 12, characterized in that, The method also includes a step of pre-calibrating the query information rate for different probe services: For any model service to be calibrated, multiple probe requests are initiated to the model service using various preset detection probes, and sample response texts are obtained for each probe request. The model service to be calibrated includes at least the target model service and the alternative model service; Using the label probability vector and sample feature vector corresponding to each sample response text, the fingerprint classifier to be trained is iteratively trained to obtain a trained fingerprint classifier. Then, using the trained fingerprint classifier, the sample probability vector of the sample response text is determined based on the sample feature vector. Any model service to be calibrated is used as a reference model service, and other model services to be calibrated are used as sample replacement services to obtain various model combinations. For each model combination, a first sample pair consisting of the reference model service and each preset detection probe is determined, as well as a second sample pair consisting of each sample replacement service and each preset detection probe. Based on the sample probability vector of each first sample response text belonging to the first sample pair, a first anomaly score is determined for each first sample response text, and based on the sample probability vector of each second sample response text belonging to the second sample pair, a second anomaly score is determined for each second sample response text. According to a preset number, each first sample response text is divided into multiple first sample text groups, and each second sample response text is divided into multiple second sample text groups. Based on the first sample mean score corresponding to the first anomaly score of each first sample response text in each first sample text group, and the second sample mean score corresponding to the second anomaly score of each second sample response text in each second sample text group, the query information rate corresponding to each second sample pair is determined.

14. The method according to claim 13, characterized in that, The step of determining the query information rate corresponding to each second sample pair based on the first sample mean score corresponding to the first anomaly score of each first sample response text in each first sample text group and the second sample mean score corresponding to the second anomaly score of each second sample response text in each second sample text group includes: For a sample pair group consisting of a first sample pair and a second sample pair including the same preset detection probe, the sorting accuracy of the second sample pair in the sample pair group is determined based on the probability that the mean score of the first sample in the sample pair group is less than the mean score of the second sample, and the probability that the mean score of the first sample in the sample pair group is equal to the mean score of the second sample. Based on the sorting accuracy, determine the initial information rate corresponding to the second sample pair; The query information rate of the second sample pair is determined based on the initial information rate using either the t-distribution method or the self-sampling method.

15. The method according to claim 13, characterized in that, The threshold for the average score under a fixed number of tests is calibrated according to the following steps: From the sample response texts, each third sample response text belonging to the target sample pair composed of the target detection probe and the target model service is selected, and a third anomaly score of each third sample response text is determined based on the sample probability vector of each third sample response text. Based on the fixed number of detections, each third sample response text is divided into multiple third sample text groups; Based on the mean score of the third sample response text corresponding to the third anomaly score in each of the third sample text groups, the mean scores of each third sample are sorted in descending order, and the mean score threshold is determined according to the sorting result and the target sorting quantile.

16. The method according to claim 15, characterized in that, The target probe service calibrates the pre-defined first false alarm rate, first replacement probability, score detection threshold, and alarm count threshold according to the following steps: From the third sample response text, a first number of first target texts are selected, and the third anomaly score of each first target text and multiple preset probabilities are used to determine multiple candidate score detection thresholds corresponding to the target model service. From the sample response texts belonging to the target probe service pair, a second number of second target texts are filtered out, and a fourth anomaly score for each second target text is determined based on the sample probability vector of each second target text. For any candidate score detection threshold, the reference false alarm rate of the target model service under the candidate score detection threshold is determined based on the number of third abnormal scores greater than the candidate score detection threshold and the first number; and the reference replacement probability of the target probe service under the candidate score detection threshold is determined based on the number of fourth abnormal scores greater than the candidate score detection threshold and the second number. Based on the reference replacement probability and the reference false alarm rate, a set of calibration score detection thresholds for the target probe service pair is determined; the set of calibration score detection thresholds includes each retained candidate score detection threshold where the reference replacement probability is greater than the reference false alarm rate. Based on the preset minimum dilution ratio, the reference replacement probability of the target probe service pair at the retained candidate score detection threshold, and the reference false alarm rate of the target model service at the retained candidate score detection threshold, the mixed replacement probability of the target probe service pair at the retained candidate score detection threshold is determined. Based on the hybrid replacement probability and the target detection error, the first false alarm rate, the first replacement probability, the score detection threshold, and the alarm count threshold are determined.

17. The method according to claim 16, characterized in that, The step of determining the first false alarm rate, the first replacement probability, the score detection threshold, and the alarm count threshold based on the mixed replacement probability and the target detection error includes: The upper tail test probability of the binomial distribution between the reference false alarm rate and the number of alarms under the retained candidate score detection threshold of the target model service is less than the false alarm rate in the target detection error. The number of alarms to be used by the target model service under the retained candidate score detection threshold is determined with the objective that the false alarm rate in the target detection error is less than the false alarm rate in the target detection error. Based on the mixed replacement probability of the target probe service at the retained candidate score detection threshold and the number of alarms to be used, determine the two-item effectiveness at the retained candidate score detection threshold; For each target probe service, for each corresponding retained candidate score detection threshold, with the goal of achieving the target efficacy under the retained candidate score detection threshold, the number of candidate detections is determined at the retained candidate score detection threshold. The target detection threshold corresponding to the minimum number of candidate detections is used as the score detection threshold, the reference false alarm rate of the target model service under the target detection threshold is used as the first false alarm rate, the mixed replacement probability of the target probe service under the target detection threshold is used as the first replacement probability, and the number of alarms to be used by the target model service under the target detection threshold is used as the alarm count threshold.

18. The method according to claim 1, characterized in that, The method further includes: If the detection stopping rule is a sequential verification rule or a stop rule at any time, then obtain the target detection probe calibrated by the candidate service set and the target model service based on the target detection error during the offline calibration stage, the first detection threshold for each target mode, and the label fingerprint features of each registered model service. Using the target detection probe, audit requests are sequentially sent to the endpoint to be audited to obtain the third response text under each audit request. Based on the abnormal score of each obtained third response text under each registered model service, the first detection threshold, and the tag fingerprint features, it is determined whether the current detection result under any target mode meets the stopping condition. If not, return to the step of using the target detection probe to sequentially initiate audit requests to the endpoint to be audited until the current detection result in any target mode meets the stop condition, and determine the target detection result based on the latest current detection result.

19. The method according to claim 6, characterized in that, The method further includes: Periodically acquire multiple real response texts of the target model service, and adjust the second false alarm rate and candidate score detection threshold of the target model service offline calibrated based on the abnormal scores of the multiple real response texts under the target model service.

20. A detection device for service replacement, characterized in that, The device includes: The first acquisition module is used to acquire the audit target corresponding to the target model service of the endpoint to be audited; the audit target includes at least one target mode selected from multiple preset detection modes, detection stopping rules, target detection error and candidate service set; wherein, when the candidate service set is not empty, it includes at least one alternative model service related to the target model service; The second acquisition module is used to acquire, if the detection stopping rule is fixed budget stopping, first detection information calibrated for the candidate service set and the target model service based on the target detection error during the offline calibration stage; the first detection information includes a fixed number of detections under the target detection probe, a first detection threshold for each target mode, and a label fingerprint feature for each registered model service; the target detection probe is used to instruct the endpoint to be audited to output random response text within the target controlled output space; the registered model service includes the target model service and the alternative model service; The request module is used to initiate an audit request to the endpoint to be audited according to the fixed number of detections using the target detection probe, and obtain each first response text under the fixed number of detections; The first determining module is used to determine the attribution probability of the first response text under each registered model service by using the fingerprint classifier trained in the offline calibration stage, and to determine the anomaly score of the first response text under each registered model service based on the attribution probability. The second determining module is used to determine the initial detection result in each of the target modes based on the anomaly score, the first detection threshold, and the tag fingerprint features, and to determine the target detection result based on each of the initial detection results; the target detection result is used to indicate whether the target model service of the endpoint to be audited uses replacement, the target replacement model, and replacement ratio information.

21. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 19.

22. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 19.

Images