Safety enhancement method and system for safety fence associated with flywheel iteration

Abstract

The method can comprise: obtaining a business scene portrait of a target business scene and an attack execution result, the attack execution result being a result obtained after an attack sample is input into a first security fence of the target business scene; performing multi-dimensional analysis on defense vulnerabilities based on the attack execution result to generate a defense vulnerability atlas of the target business scene; performing variation and expansion on the attack sample based on the defense vulnerability atlas to obtain a target optimized training sample set; training a scene-specific security fence adapter corresponding to the target business scene based on the business scene portrait and the target optimized training sample set, and combining the scene-specific security fence adapter with a global basic security fence adapter to obtain a second security fence of the target business scene; and performing effect evaluation on the second security fence based on a scene verification set, and updating the defense vulnerability atlas based on the effect evaluation.

Description

Technical Field

[0001] This specification relates to the field of data processing technology, and in particular to a method and system for enhancing the safety of a safety fence related to flywheel iteration. Background Technology

[0002] As large language models and other intelligent application models are deployed in business scenarios such as intelligent customer service, code assistance, content creation, and enterprise knowledge base Q&A, it is usually necessary to configure security fences on the input or output side of the model. Security fences are used to detect attack inputs, unauthorized outputs, or high-risk interactions.

[0003] In related technologies, security fences are typically trained based on a common set of attack samples. After deployment, they are periodically updated based on manually collected anomaly samples. This approach relies on common samples to cover different business scenarios and saves interception records, confidence levels, and model responses generated during the runtime as logs.

[0004] Attack methods, risk types, and compliance requirements vary across different business scenarios. If multiple business scenarios share the same set of general training samples and a general security fence model, the training samples will contain a large number of attack samples that are not highly relevant to the current business scenario. These samples will consume training resources and make it difficult for the security fence to be updated to reflect the actual attack patterns exposed in the current business scenario.

[0005] The attack samples, interception results, fence confidence, and target model responses generated during the operation of a security fence can reflect the detection status in a specific business scenario. However, related technologies often struggle to automatically transform these operational results into the basis for constructing the next round of training samples. Consequently, the security fence update process tends to remain in a passive sampling and periodic training mode, resulting in a weak correspondence between training samples and actual defense weaknesses. Summary of the Invention

[0006] According to embodiments of this specification, a method for enhancing the safety of a safety fence related to flywheel iteration is provided, the method comprising: Obtain a business scenario profile and attack execution results for the target business scenario, wherein the attack execution results are obtained by inputting the attack sample into the first security fence of the target business scenario; Based on the attack execution results, a multi-dimensional analysis of defense weaknesses is performed to generate a defense weakness map of the target business scenario; Based on the defense vulnerability map, the attack samples are mutated and expanded to obtain the target optimized training sample set; Based on the business scenario profile and the target optimized training sample set, a scenario-specific security fence adapter corresponding to the target business scenario is trained, and the scenario-specific security fence adapter is combined with the global basic security fence adapter to obtain the second security fence of the target business scenario. The effectiveness of the second security fence is evaluated based on the scenario validation set, and the defense vulnerability map is updated based on the effectiveness evaluation. The updated defense vulnerability map is used to generate the next round of target optimization training sample set.

[0007] The technical solutions provided in this disclosure may have the following beneficial effects: The above approach first obtains a business scenario profile of the target business scenario and the attack execution results corresponding to the first security fence. Then, a defense vulnerability map is generated based on the attack execution results, so that the defense vulnerabilities exposed by the first security fence in the target business scenario are structurally represented as a defense vulnerability map. Based on this defense vulnerability map, the attack samples are mutated and expanded, so that the target optimized training sample set is generated around the already exposed defense vulnerabilities, rather than indiscriminately expanding general attack samples.

[0008] Building upon this foundation, by combining business scenario profiles and target-optimized training sample sets to train scenario-specific security fence adapters, and then combining these adapters with the global basic security fence adapter, the second security fence can simultaneously retain general attack detection capabilities and target business scenario-specific detection capabilities. In this way, the second security fence does not need to rely on a single large-scale general model to cover all business scenarios, nor does it require retraining a complete security fence model for each business scenario.

[0009] Furthermore, the effectiveness of the second security fence is evaluated based on the scenario validation set, and the defense vulnerability map is updated based on the evaluation results. The updated defense vulnerability map can then be used to generate the next round of target optimization training sample set. Thus, a closed loop is formed between attack execution, vulnerability analysis, sample construction, scenario-based training, and effectiveness evaluation. This ensures that subsequent training samples continuously target defense vulnerabilities that have not yet been eliminated in the target business scenario, reduces the use of samples irrelevant to the target business scenario in the training process, and allows the security fence to be continuously updated as attack samples change.

[0010] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0011] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0012] Figure 1This is a flowchart illustrating a safety enhancement method for a safety fence related to flywheel iteration, as shown in an embodiment of this application.

[0013] Figure 2 This is an architecture diagram illustrating a closed loop formed by attack execution, vulnerability analysis, sample construction, defense training, and effect verification, as shown in an embodiment of this application.

[0014] Figure 3 This is a flowchart illustrating an optimized sample construction process for multi-dimensional variation expansion, as shown in an embodiment of this application.

[0015] Figure 4 This is a flowchart illustrating a customized attack scheme generation process for a business scenario, as shown in an embodiment of this application.

[0016] Figure 5 This is a diagram illustrating a scenario-based defense model training architecture in an embodiment of this application.

[0017] Figure 6 This is a comparison chart illustrating a fast convergence effect in an embodiment of this application.

[0018] Figure 7 This is a schematic diagram of the structure of an electronic device shown in an embodiment of this application. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0020] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0021] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0022] This application provides a security enhancement method for a security fence related to flywheel iteration. This method can be executed by a security enhancement platform. The security enhancement platform can be deployed on a server, server cluster, cloud platform, edge computing node, or within an enterprise's internal security operations platform. The security enhancement platform can connect to at least one business system. A target model and a first security fence are deployed in the business system. The target model is used to generate a business response based on business input. The first security fence is used to perform security detection on the content input to the target model, the content output by the target model, or a combination of input and output content.

[0023] In some embodiments, the first security fence can be understood as the security fence to be optimized. The first security fence can be an input-side security fence, an output-side security fence, or a combined security fence covering both the input and output sides. The second security fence can be understood as the security fence obtained after training or updating by the security enhancement platform. The second security fence includes a global basic security fence adapter and a scenario-specific security fence adapter. The global basic security fence adapter is used to provide general attack detection capabilities across business scenarios. The scenario-specific security fence adapter is used to provide attack detection capabilities matched to the target business scenario.

[0024] The security enhancement platform may include an attack execution unit, a result acquisition unit, a vulnerability map generation unit, a sample mutation and expansion unit, a sample quality screening unit, an adapter training unit, a verification and evaluation unit, and an iterative scheduling unit. The attack execution unit inputs attack samples into the first security fence of the target business scenario. The result acquisition unit collects the attack execution results. The vulnerability map generation unit generates a defense vulnerability map based on the attack execution results. The sample mutation and expansion unit mutates and expands the attack samples based on the defense vulnerability map. The sample quality screening unit selects the target optimized training sample set from the candidate optimized training samples. The adapter training unit trains a scenario-specific security fence adapter. The verification and evaluation unit evaluates the second security fence based on the scenario verification set. The iterative scheduling unit updates the defense vulnerability map based on the evaluation results and triggers the generation of the next round of target optimized training sample set.

[0025] In some embodiments, the target business scenario may include any one of the following: intelligent customer service, code assistant, content creation, educational tutoring, financial Q&A, medical consultation, enterprise knowledge base Q&A, and data analysis assistant. Taking the code assistant scenario as an example, the target model can be a code generation model, with a first security fence used to detect malicious code generation, vulnerable code generation, prompt word injection, and unauthorized call requests. Taking the intelligent customer service scenario as an example, the target model can be a customer service Q&A model, with a first security fence used to detect identity spoofing, privacy theft, unauthorized queries, and service abuse. Taking the content creation scenario as an example, the target model can be a text generation model, with a first security fence used to detect copyright circumvention, generation of illegal content, and obfuscation avoidance.

[0026] S110, Obtain the business scenario profile and attack execution result of the target business scenario, wherein the attack execution result is obtained by inputting the attack sample into the first security fence of the target business scenario; S120, Based on the attack execution results, perform multi-dimensional analysis of defense weaknesses and generate a defense weakness map of the target business scenario; S130, Based on the defense vulnerability map, the attack samples are mutated and expanded to obtain the target optimized training sample set; S140, Based on the business scenario profile and the target optimized training sample set, train a scenario-specific security fence adapter corresponding to the target business scenario, and combine the scenario-specific security fence adapter with the global basic security fence adapter to obtain the second security fence of the target business scenario; S150, the effectiveness of the second security fence is evaluated based on the scenario validation set, and the defense vulnerability map is updated based on the effectiveness evaluation results, wherein the updated defense vulnerability map is used to generate the next round of target optimization training sample set.

[0027] The above S110 to S150 can correspond to Figure 1 The flowchart of the method is shown. Figure 1 In the diagram, S110 represents the data acquisition step, S120 represents the defense vulnerability map generation step, S130 represents the target optimization training sample set generation step, S140 represents the second security fence training combination step, and S150 represents the effect evaluation and map backflow update step.

[0028] In this embodiment, the security enhancement platform acquires a business scenario profile of the target business scenario. The business scenario profile describes the security requirements and attack surface of the target business scenario. The business scenario profile may include at least one of the following: business type, user group, compliance requirements, risk tolerance, historical attack data, historical interception records, business communication characteristics, target model type, and security policy configuration.

[0029] In some embodiments, the attack execution result is the result obtained after inputting the attack sample into the first security fence of the target business scenario. The attack execution result can be stored in a structured record. Each attack execution result may include at least one of the following fields: sample identifier, attack sample text, attack type, business scenario identifier, first security fence version, interception result, fence confidence level, target model response, attack path identifier, execution time, execution round, and manual review label.

[0030] The interception result indicates the processing performed by the first security fence on the attack sample. The interception result may include at least one of the following: interception, allowance, risk marking, referral to manual review, and downgrade response. The fence confidence score is the probability value, score, or confidence rating output by the first security fence for the attack sample. This probability value, score, or confidence rating characterizes the likelihood that the attack sample is a risky or non-risk sample. The target model response is the response record generated by the target model or security detection link in response to the attack sample. When the attack sample is not intercepted by the first security fence and is input into the target model, the target model response is the business response generated by the target model based on the attack sample. When the attack sample is intercepted by the first security fence, the target model response field may be recorded as null or a preset interception response generated by the first security fence or security detection link. This preset interception response indicates that the attack sample was not further input into the target model.

[0031] The security enhancement platform performs multi-dimensional analysis of defense weaknesses based on attack execution results. This multi-dimensional analysis can include attack category, semantic region, attack path, and fence confidence dimensions. The platform organizes these results into a defense weakness graph. This graph can be stored using a graph structure, table structure, or key-value structure. Nodes in the graph can represent attack category, semantic region, attack path, gray area sample set, business scenario, first security fence version, and weakness priority. Edges in the graph represent the relationships between nodes. For example, an edge between an attack category and a semantic region indicates that there are unblocked samples of that attack category in that semantic region.

[0032] The security enhancement platform expands attack samples through mutation based on a defense vulnerability map. Specifically, the platform determines seed attack samples from the attack samples corresponding to the attack execution results. Seed attack samples can be attack samples associated with defense vulnerabilities in the defense vulnerability map. The platform configures mutation dimensions for the seed attack samples based on the vulnerability type, vulnerability priority, and associated business scenarios recorded in the defense vulnerability map. The platform then generates candidate optimized training samples according to these mutation dimensions and performs quality screening on these candidate optimized training samples to obtain the target optimized training sample set.

[0033] The security enhancement platform trains scenario-specific security fence adapters corresponding to the target business scenario based on business scenario profiles and target optimization training sample sets. These scenario-specific security fence adapters can be implemented using low-rank adapters, cue adapters, classification header adapters, rule adapters, or risk threshold adapters. The security enhancement platform can combine these scenario-specific security fence adapters with the global basic security fence adapter. Combination methods can include at least one of the following: serial detection, parallel voting, weighted fusion, hierarchical routing, and threshold linkage. The combined result is a second security fence for the target business scenario.

[0034] The security enhancement platform evaluates the effectiveness of the second security fence based on a scenario validation set. The scenario validation set includes attack samples, normal business samples, and boundary samples corresponding to the target business scenario. The evaluation results can include detection accuracy, non-intercept rate, false intercept rate, scenario-based evaluation metrics, detection rates for different attack categories, and detection rates for different semantic regions. The security enhancement platform updates the defense vulnerability map based on the evaluation results. The updated defense vulnerability map is used to generate the next round of target optimization training sample set. Thus, attack execution, vulnerability analysis, sample construction, adapter training, and effectiveness evaluation form a closed loop.

[0035] In the above embodiments, the attack execution results are not passively saved as logs, but are transformed into a defense vulnerability map. The defense vulnerability map further controls the generation of sample mutation expansion and target optimization training sample sets, enabling the next round of training samples to target the protection gaps exposed by the first security fence in the target business scenario. The second security fence is obtained by combining a global basic security fence adapter and a scenario-specific security fence adapter, thus maintaining general attack detection capabilities while enhancing the specific detection capabilities for the target business scenario.

[0036] In some embodiments, the security enhancement platform determines seed attack samples corresponding to defensive weaknesses from attack samples. Seed attack samples can be attack samples not intercepted by the first security fence, gray area samples where the difference between the fence confidence level and the decision threshold satisfies a first difference condition, or boundary samples confirmed to have attack intent after manual review. The security enhancement platform can associate seed attack samples with attack categories, semantic regions, attack paths, and business scenarios in the defensive weakness map.

[0037] The security enhancement platform determines the sample mutation dimension corresponding to the defense vulnerability. The sample mutation dimension indicates how to mutate and expand the seed attack sample. The sample mutation dimension can include semantic-level mutation dimension, structural-level mutation dimension, adversarial-level mutation dimension, and multilingual mutation dimension. The security enhancement platform mutates and expands the seed attack sample according to the sample mutation dimension to obtain candidate optimized training samples. The security enhancement platform further filters the candidate optimized training samples based on sample quality to obtain the target optimized training sample set.

[0038] In some embodiments, sample quality screening includes deduplication screening, attack effectiveness screening, and diversity screening. Deduplication screening reduces duplicate samples in the candidate optimized training samples. Attack effectiveness screening determines whether the candidate optimized training samples can still trigger the expected attack behavior. Diversity screening ensures that the target optimized training sample set covers different attack techniques, different semantic regions, and different business language. The security enhancement platform can generate a quality screening record for each candidate optimized training sample. The quality screening record may include a sample identifier, semantic similarity, attack effectiveness label, diversity score, business scenario relevance score, and selection identifier.

[0039] In the above embodiments, the target optimization training sample set is not directly obtained by stacking the original attack samples, but is generated driven by the defense vulnerability map. This reduces the occupation of the training process by duplicate and low-value samples, and makes the training sample set contain more samples corresponding to the current defense vulnerability.

[0040] In some embodiments, the defense vulnerability map includes vulnerability priorities. Vulnerability priorities can be determined by at least one of the following: unblocked percentage, number of associated attack samples, number of associated business scenarios, business risk level, and historical trend. The security enhancement platform determines target vulnerabilities based on vulnerability priorities. Target vulnerabilities are the defense vulnerabilities prioritized for processing in the current iteration round. The unblocked percentage corresponding to the target vulnerability satisfies a second percentage condition, and the number of associated business scenarios or attack samples satisfies a first range condition.

[0041] For example, the second ratio condition can be that the unintercepted ratio corresponding to the target vulnerability is greater than or equal to a preset ratio threshold. The preset ratio threshold can be set according to the business risk level. For example, in high-risk business scenarios, the preset ratio threshold can be 1% to 5%; in medium-risk business scenarios, the preset ratio threshold can be 5% to 10%; and in low-risk business scenarios, the preset ratio threshold can be 10% to 20%. The first range condition can be that the number of business scenarios associated with the target vulnerability is greater than or equal to the preset number of scenarios, or the number of attack samples associated with the target vulnerability is greater than or equal to the preset number of samples. The preset number of scenarios can be 2, 3, 5, or other values. The preset number of samples can be 10, 30, 50, 100, or other values.

[0042] In the initial iteration rounds, the security enhancement platform can configure semantic and structural mutation dimensions for target weaknesses. The initial iteration rounds are best suited for expanding the coverage of basic attack samples through semantic and structural rewriting. In subsequent iteration rounds, based on the effectiveness evaluation results of the previous round, the security enhancement platform can configure adversarial mutation dimensions and multilingual mutation dimensions for target weaknesses where the improvement in detection effectiveness is below a preset improvement threshold. The preset improvement threshold can be 0.5%, 1%, 2%, 3%, or other values.

[0043] After each iteration, the security enhancement platform determines reused and discarded samples based on the marginal contribution of the newly added mutated samples to the detection performance. The marginal contribution represents the change in the detection performance of the second security fence on the scene validation set after the new sample is added to the training. Reusable samples are those that have participated in training in previous iterations and will continue to be used in the next iteration. Reusable samples can be used to maintain the acquired detection capabilities or as retention samples to prevent catastrophic forgetting. Discarded samples are those that have participated in training in previous iterations but will not participate in the next iteration. Discarded samples can be those correctly detected by the second security fence in multiple consecutive iterations, those whose semantic similarity with other samples meets a preset similarity condition, or those whose marginal contribution to the detection performance is below a preset contribution threshold.

[0044] In the above embodiments, the security enhancement platform does not indiscriminately retain all historical samples in every round. The security enhancement platform maintains the learned detection capabilities by reusing samples and reduces redundant and low-contribution training by discarding samples, thereby enabling the next round of target optimization training sample set to more focused on serving the defense weaknesses that have not yet been eliminated.

[0045] In some embodiments, the security enhancement platform can perform semantic-level mutations on seed attack samples while maintaining the original attack intent. Semantic-level mutations can include synonym replacement, sentence structure transformation, context embedding, and mood / tone adjustment. For example, if a seed attack sample expresses its attack intent in a direct command manner, the security enhancement platform can transform it into a consultative expression, a hypothetical expression, an academic discussion expression, or a storytelling expression. This mutation method is used to expand the sample coverage of the same attack intent under different semantic expressions.

[0046] In some embodiments, the security enhancement platform can alter the organization and presentation of the seed attack sample to obtain a structurally mutated sample. Structural-level mutations can include role-playing embedding, hypothetical framing, multi-step decomposition, and length-expanded compression. For example, when the seed attack sample is a single-sentence attack request, the security enhancement platform can decompose it into multiple consecutive sub-requests. Each sub-request, viewed individually, may resemble a normal business request, but the combination of multiple sub-requests forms an attack path. This mutation method is used to simulate the segmented progression of the attack sample in a real dialogue.

[0047] In some embodiments, the security enhancement platform can introduce adversarial perturbations into seed attack samples to obtain adversarial variant samples. Adversarial-level mutations can include interference word insertion, encoding transformation, logic nesting, and hybrid attack construction. For example, the security enhancement platform can convert some sensitive words in the attack intent into encoded text, or it can nest legitimate business logic outside the attack intent. This mutation method is used to test the first security fence's ability to identify obfuscated expressions and composite attacks.

[0048] In some embodiments, the security enhancement platform can perform cross-language conversion on seed attack samples to obtain multilingual variant samples. Cross-language conversion may include translating the Chinese attack sample into English, Japanese, Arabic, or other languages, and then translating it back into Chinese. Cross-language conversion may also include retaining certain fragments of the attack sample in foreign language expressions. This mutation method is used to cover detection differences caused by different language expressions.

[0049] The security enhancement platform can aggregate one or more of the following types of mutation samples: semantic mutation samples, structural mutation samples, adversarial mutation samples, and multilingual mutation samples, into candidate optimized training samples. It is understood that the candidate optimized training samples are not limited to including all four types of mutation samples simultaneously. The security enhancement platform can select one or more mutation methods based on the vulnerability types and priorities recorded in the defense vulnerability map.

[0050] In some embodiments, the security enhancement platform determines the semantic similarity between candidate optimization training samples. The platform can map these samples to vectors using sentence vector models, text embedding models, or semantic retrieval models. Semantic similarity is determined based on cosine similarity, Euclidean distance, or other semantic distances between vectors. The platform can also perform clustering to remove duplicates from the candidate optimization training samples. Within each cluster, the platform can retain either the sample closest to the cluster center or the sample with the highest diversity score.

[0051] The security enhancement platform inputs deduplicated candidate optimization training samples into the target large model to verify whether the candidate optimization training samples trigger the expected attack behavior. The target large model can be a target model protected by the first security fence, or a sandbox model used to verify the effectiveness of the attack. Expected attack behaviors can include generating illegal content, disclosing sensitive information, generating vulnerable code, executing unauthorized instructions, bypassing business policies, or outputting missing risk warnings. Samples that do not trigger the expected attack behavior can be marked as invalid attack samples and will not be included in the target optimization training sample set.

[0052] For candidate optimized training samples that trigger expected attack behaviors, the security enhancement platform determines a diversity score. The diversity score can be determined by sample semantic distance, attack method coverage, and business scenario relevance. Sample semantic distance represents the difference between candidate optimized training samples and historical training samples. Attack method coverage indicates whether candidate optimized training samples cover new attack methods. Business scenario relevance indicates the degree of matching between candidate optimized training samples and the language, compliance requirements, and historical attack patterns of the target business scenario.

[0053] The security enhancement platform selects samples from candidate optimized training samples that trigger expected attack behaviors based on diversity scoring, resulting in a target optimized training sample set. The platform can select samples by sorting according to diversity scores, or by stratifying selection based on attack category, semantic region, and business scenario. Therefore, the target optimized training sample set retains attack effectiveness while avoiding high sample duplication.

[0054] In some embodiments, the security enhancement platform determines attack categories whose non-interception ratio meets a first ratio condition based on the interception results of the first security fence. The non-interception ratio can be the ratio between the number of attack samples in a certain attack category that were not intercepted by the first security fence and the total number of attack samples corresponding to that attack category. The first ratio condition can be that the non-interception ratio is greater than or equal to a first ratio threshold. The first ratio threshold can be set according to the risk tolerance of the target business scenario.

[0055] The security enhancement platform performs semantic clustering on the unblocked attack samples from the first security fence. Semantic clustering groups semantically similar attack samples into the same semantic region. The security enhancement platform identifies semantic regions where the number of unblocked samples satisfies a first quantity condition. The first quantity condition can be that the number of unblocked samples in a certain semantic region is greater than or equal to a first quantity threshold. This semantic region can serve as a semantic weakness node in the defense weakness map.

[0056] The security enhancement platform determines attack paths where the number of uninterrupted samples meets a second quantity condition based on the execution process of an attack sample from initial input to the first security fence and finally to the formation of a target model response. An attack path may include at least some nodes from the following: attack sample input, first security fence detection, target model invocation, target model response generation, output-side security detection, and final output. The second quantity condition can be that the number of uninterrupted samples on a given attack path is greater than or equal to a second quantity threshold.

[0057] The target model response can be either a Type I response or a Type II response. A Type I response is the response generated by the target model based on the attack sample when it is not intercepted by the first security fence and is input into the target model. A Type II response is the response recorded in the target model response field when the attack sample is intercepted by the first security fence. The Type II response can be null or a preset interception response generated by the security detection chain. In this way, the target model response field in the attack execution result can cover both intercepted and uninterrupted samples, facilitating subsequent unified analysis.

[0058] The security enhancement platform identifies gray zone samples from attack samples based on the fence confidence distribution of the first security fence. Gray zone samples are attack samples where the difference between the fence confidence and the decision threshold satisfies a first difference condition. The first difference condition can be that the absolute difference between the fence confidence and the decision threshold is less than or equal to a first difference threshold. Gray zone samples indicate that the first security fence's judgment result for that attack sample falls within the judgment boundary region.

[0059] The security enhancement platform generates a defense vulnerability map based on one or more of the following: attack category, semantic region, attack path, and gray zone samples. The defense vulnerability map can record vulnerability type, vulnerability source, associated attack samples, associated business scenarios, unblocked percentage, number of associated samples, number of gray zone samples, vulnerability severity, and vulnerability priority. The defense vulnerability map can provide a clear basis for sample construction for subsequent mutation and expansion.

[0060] In some embodiments, the business scenario profile includes business type, user group, compliance requirements, risk tolerance, and historical attack data. Business type can be intelligent customer service, code assistant, content creation, educational tutoring, financial Q&A, medical consultation, or enterprise knowledge base Q&A. User group can be ordinary consumers, internal employees, developers, content creators, students, teachers, doctors, or financial professionals. Compliance requirements can include privacy protection, data security, code security, copyright compliance, content compliance, medical compliance, or financial compliance. Risk tolerance can be represented by levels, thresholds, or policy templates.

[0061] The security enhancement platform generates attack surface analysis reports based on business scenario profiles. These reports include the attack types, attack methods, attack paths, and risk priorities corresponding to the target business scenario. For example, in an intelligent customer service scenario, the attack surface analysis report can record identity spoofing, privacy breaches, and unauthorized queries as high-priority attack types. In a code assistant scenario, it can record malicious code generation, vulnerable code generation, and instruction injection as high-priority attack types. In a content creation scenario, it can record copyright circumvention, generation of illegal content, and obfuscation avoidance as high-priority attack types.

[0062] Based on the attack types and risk priorities in the attack surface analysis report, the security enhancement platform identifies target attack types that match the target business scenario from a global attack type library. This global attack type library can include attack types such as identity and scenario manipulation, evasion and obfuscation, instruction and logic injection, model vulnerability exploitation, service abuse and resource exhaustion, malicious knowledge generation, and direct malicious content. Target attack types are not simply labels; rather, they serve as classification constraints for subsequent acquisition of basic attack samples, script rewriting, compliance risk rewriting, and scenario-based mutation and expansion.

[0063] The security enhancement platform retrieves basic attack samples corresponding to the target attack type from the attack sample library. Basic attack samples can carry attack type identifiers, attack method identifiers, attack path identifiers, attack target fields, output request fields, and expected risk tags. For example, if the target attack type is instruction and logic injection, the basic attack samples may include samples used to induce the target model to ignore system instructions, change role boundaries, or execute unexpected instructions. If the target attack type is malicious knowledge generation, the basic attack samples may include samples used to induce the target model to output risky knowledge or vulnerable code.

[0064] The security enhancement platform rewrites basic attack samples based on the interaction style and user language characteristics of the target business scenario, resulting in scenario-adapted attack samples. These scenario-adapted attack samples retain the target attack type. The difference lies in their expression, which is rewritten to reflect the interaction methods likely to occur in the target business scenario. For example, in an educational tutoring scenario, the basic attack sample can be rewritten as "helping students understand." In a financial Q&A scenario, it can be rewritten as "risk analysis" or "compliance consultation." In an intelligent customer service scenario, it can be rewritten as "account inquiry" or "after-sales appeal." Thus, the target attack type limits the category of the attack samples, while the interaction style and user language characteristics limit the expression of the same attack type within the target business scenario.

[0065] The security enhancement platform extracts protected objects and restricted output behaviors from compliance requirements. Protected objects can include personally identifiable information, account data, medical data, financial transaction data, source code, trade secrets, or copyrighted works. Restricted output behaviors can include disclosure, inference, generation, paraphrasing, bypassing, exporting, calling, or execution. The security enhancement platform writes the protected objects into the attack object field of the scenario-adapted attack sample and the restricted output behaviors into the output request field of the scenario-adapted attack sample, thus obtaining a compliance risk attack sample. For example, in a medical consultation scenario, the protected object could be patient privacy data, and the restricted output behaviors could be disclosure or inference. In a financial Q&A scenario, the protected object could be account data or insider information, and the restricted output behaviors could be exporting or generating. In a code assistant scenario, the protected object could be source code or content restricted by an open-source license, and the restricted output behaviors could be bypassing or generating.

[0066] The security enhancement platform determines historical attack methods and paths for target business scenarios based on historical attack data. Historical attack data can include historical attack samples, historical attack categories, historical attack sessions, historical unblocked samples, and historical gray-zone samples. Historical attack methods can represent the expression methods, obfuscation methods, or multi-round bootstrapping methods used by the attack samples. Historical attack paths can represent the execution path of the attack sample from input to the first security fence, the target model response, and output-side detection. Based on historical attack methods and paths, the security enhancement platform mutates and extends scenario-adapted attack samples, compliance risk attack samples, or both, to obtain scenario-mutated attack samples.

[0067] The security enhancement platform generates scenario-customized attack schemes based on target attack types, scenario-adaptive attack samples, compliance risk attack samples, and scenario-mutated attack samples. A scenario-customized attack scheme may include a set of attack samples, the target attack type corresponding to each attack sample, the attack execution order, the attack path, expected risk tags, and execution batches. After the scenario-customized attack scheme is generated, the attack execution unit can input the set of attack samples into the first security fence of the target business scenario. After the first security fence performs detection on the set of attack samples, the result acquisition unit obtains the corresponding attack execution result. This attack execution result then enters the defense vulnerability map generation process described in claim 1.

[0068] In some embodiments, the security enhancement platform groups the target optimized training sample set according to business scenarios based on business scenario profiles. Each business scenario corresponds to a scenario training sample set. The scenario training sample set may include attack samples, normal business samples, boundary samples, and maintenance samples for the target business scenario. Maintenance samples are used to maintain the acquired detection capabilities and reduce catastrophic forgetting.

[0069] The security enhancement platform trains scenario-specific security fence adapters corresponding to the target business scenario based on a scenario training sample set. These scenario-specific security fence adapters can be low-rank adapters. During training, the security enhancement platform can freeze the main parameters of the base model and only update the adapter parameters. The platform can also use cue adapters, classification head adapters, lightweight rule adapters, or risk threshold adapters. Different implementation methods can all be used to reduce the number of parameters required for scenario-based training.

[0070] The security enhancement platform also trains the global basic security fence adapter based on common attack samples across business scenarios. Common attack samples can include direct malicious content, common jailbreak templates, common command injections, and cross-scenario service abuse samples. The global basic security fence adapter provides shared detection capabilities across multiple business scenarios. The second security fence is obtained by combining the global basic security fence adapter and scenario-specific security fence adapters. In some embodiments, the combination method can be to first perform general risk detection using the global basic security fence adapter, and then perform scenario-specific risk detection using the scenario-specific security fence adapter. In other embodiments, the combination method can be to output risk scores separately, and then perform a weighted fusion of the two risk scores.

[0071] In the above embodiments, the target business scenario does not require retraining the complete security fence model. The security enhancement platform trains a smaller-scale scenario-specific security fence adapter, enabling the second security fence to enhance the attack surface of the target business scenario while retaining the general detection capabilities provided by the global basic security fence adapter.

[0072] In some embodiments, the security enhancement platform determines scenario-based evaluation metrics for the target business scenario based on the business requirements of that scenario. These scenario-based evaluation metrics can be determined according to the business scenario profile. For example, scenario-based evaluation metrics for an intelligent customer service scenario may include user privacy protection rate and identity spoofing interception rate. Scenario-based evaluation metrics for a code assistant scenario may include vulnerable code detection rate and instruction injection detection rate. Scenario-based evaluation metrics for a content creation scenario may include copyright violation interception rate and illegal content detection rate.

[0073] The security enhancement platform evaluates the effectiveness of the second security fence based on scenario-based assessment metrics, general detection metrics, and scenario validation sets. General detection metrics may include detection accuracy, non-blocking rate, false blocking rate, recall rate, precision rate, and inference latency. The scenario validation set may include attack samples, normal business samples, and gray-zone samples from the target business scenario. The security enhancement platform updates the defense vulnerability map based on the evaluation results. For example, if the non-blocking rate of a certain attack category on the second security fence still meets the first ratio condition, then that attack category remains a defense vulnerability. If the number of non-blocked samples in a certain semantic region decreases below the first quantity condition, the security enhancement platform can lower the priority of the corresponding vulnerability in that semantic region.

[0074] When the business scenario profile changes, the security enhancement platform can re-evaluate the effectiveness of the second security fence. For example, if the target business scenario adds new business functions, the user group changes, or compliance requirements are updated, the security enhancement platform can regenerate the scenario validation set and re-evaluate the second security fence. The security enhancement platform can also re-evaluate the second security fence when historical attack patterns shift. Shifts in historical attack patterns can be determined by changes in attack type distribution, attack language distribution, attack path distribution, or gray area sample distribution.

[0075] In the above embodiments, the evaluation results of the second security fence do not stop at generating an evaluation report, but are fed back to the defense vulnerability map. After the defense vulnerability map is updated, it continues to control the generation of the next round of target optimization training sample set, so that the security enhancement process continuously adapts to the attack changes in the target business scenario.

[0076] In some embodiments, the target business scenario may include a first business scenario and a second business scenario. The first business scenario can be understood as the source business scenario for which the detection capability to be transferred has been trained. The second business scenario can be understood as the target business scenario for which the detection capability is to be received. When the attack surface similarity between the first business scenario and the second business scenario meets a preset similarity condition, the security enhancement platform can distill the detection capability of the first business scenario to the scenario-specific security fence adapter of the second business scenario.

[0077] Attack surface similarity can be calculated based on at least one of the following: a set of attack types, a set of attack paths, a set of business risk types, a set of compliance constraints, and a set of historical attack samples. For example, the security enhancement platform can calculate the intersection-union ratio (OUC) of the first and second business scenarios on the set of attack types. The platform can also calculate the weighted similarity between the two scenarios on the set of attack paths and the set of business risk types. When the weighted similarity is greater than or equal to a preset similarity threshold, the attack surface similarity is considered to meet the preset similarity condition.

[0078] Capability distillation can be achieved through sample distillation, soft-label distillation, or adapter parameter distillation. Sample distillation involves converting valid attack samples from the first business scenario into statements for the second business scenario and adding them to the training sample set of the second business scenario. Soft-label distillation involves using the second security fence of the first business scenario to output a risk distribution of the valid attack samples for the second business scenario, and then using this risk distribution as training labels to guide the training of the scenario-specific security fence adapter for the second business scenario. Adapter parameter distillation involves using the adapter parameters from the first business scenario as initialization parameters or regularization constraints for the adapter training in the second business scenario.

[0079] In some embodiments, when the target business scenario includes multiple third business scenarios whose attack surface similarity meets the merging conditions, the security enhancement platform merges the scenario-specific security fence adapters of the multiple third business scenarios. The merging conditions may include attack type set similarity meeting a preset threshold, historical attack sample distribution meeting a preset distribution condition, and scenario-based evaluation metrics being mutually compatible. The security enhancement platform can merge the scenario training sample sets of multiple third business scenarios and train a shared scenario-specific security fence adapter.

[0080] In some embodiments, when a target business scenario is differentiated into sub-scenarios with different attack surfaces, the security enhancement platform splits the target business scenario into scenario-specific security fence adapters. Sub-scenarios can be categorized based on user groups, business functions, compliance requirements, or historical attack patterns. The security enhancement platform can construct business scenario profiles, target-optimized training sample sets, and scenario-specific security fence adapters for different sub-scenarios. Through this splitting process, the second security fence can develop detection capabilities for sub-scenarios with significant differences.

[0081] In some embodiments, the attack execution results can be written to an attack result table. The attack result table may include fields such as result identifier, scenario identifier, sample identifier, sample source, attack category, attack intent label, sample text summary, input time, first security fence version, interception result, fence confidence level, decision threshold, target model call status, target model response summary, response risk label, attack path identifier, session identifier, iteration round, and review status. The sample text can be stored as encrypted text, hash value, anonymized text, or a secure sandbox reference address. This allows for the retention of computable fields for vulnerability analysis while meeting data security requirements.

[0082] In some embodiments, the defense vulnerability graph can be represented by a set of nodes, a set of edges, and a set of attributes. The set of nodes includes business scenario nodes, attack category nodes, semantic region nodes, attack path nodes, gray zone sample set nodes, security fence version nodes, and target vulnerability nodes. The set of edges includes edges from scenario to attack category, edges from attack category to semantic region, edges from semantic region to attack path, edges from attack path to gray zone sample set, and edges from security fence version to target vulnerability. Each edge can record the number of associated samples, the number of unblocked samples, the average fence confidence score, the confidence score variance, the first occurrence round, the most recent occurrence round, and the magnitude of effect change.

[0083] In some embodiments, vulnerability priority can be determined by a priority score. The priority score can be calculated by weighting the non-intercept rate, gray zone sample rate, business risk level, sample coverage value, and the growth trend value of the target vulnerability in adjacent iteration rounds. The weights of the non-intercept rate, gray zone sample rate, business risk level, sample coverage value, and the growth trend value of the target vulnerability in adjacent iteration rounds can be configured according to the risk tolerance of the business scenario. In high-risk scenarios, the weights of the non-intercept rate and business risk level can be configured to larger values; in scenarios where attacks evolve rapidly, the growth trend value of the target vulnerability in adjacent iteration rounds can be configured to a larger value.

[0084] In some embodiments, gray zone samples can be determined based on the distance between the fence confidence level and the decision threshold. If the fence confidence level output by the first security fence is s and the decision threshold is t, then the difference can be |st|. When |st| is less than or equal to the first difference threshold, the attack sample is determined to be a gray zone sample. The first difference threshold can be 0.01, 0.03, 0.05, 0.08, or other values ​​set according to the business risk level. For the first security fence that outputs the probability of risky samples, s can be the risk probability. For the first security fence that outputs the probability of non-risky samples, s can be converted to a risk probability via 1-s before being compared with the decision threshold.

[0085] In some embodiments, attack paths can be generated through session event chains. A session event chain may include a sample input event, an input-side fence detection event, a target model invocation event, a target model response event, an output-side fence detection event, and a final return event. The security enhancement platform can generate an event identifier, a preceding event identifier, an event type, an event status, and a timestamp for each event. If an attack sample is not intercepted at the input side and enters the target model, the attack path corresponding to that sample includes a target model invocation event. If an attack sample is intercepted at the input side, the attack path corresponding to that sample can end after the input-side fence detection event, and a preset interception response can be recorded in the target model response field. Through a unified event chain structure, intercepted and uninterrupted samples can enter the same statistical process.

[0086] In the above embodiments, the vulnerability graph is not a single statistical report. The security enhancement platform records the correlation between attack categories, semantic regions, attack paths, gray area samples, and business scenarios through nodes, edges, and attributes. This allows subsequent sample mutation and expansion to be performed based on the target vulnerabilities, associated samples, and priority scores in the graph. This improves the efficiency of the conversion from attack execution results to training sample construction.

[0087] In some embodiments, after the security enhancement platform reads the target vulnerability from the defense vulnerability map, it can determine seed attack samples according to the association edges from the target vulnerability to the sample identifier. If the number of seed attack samples associated with the target vulnerability is less than a preset starting number, the security enhancement platform can supplement the seed attack samples from the same attack category, adjacent semantic regions, or similar business scenarios. If the number is still less than the preset starting number after supplementation, the security enhancement platform can reduce the sampling weight of the target vulnerability in the current round and retain the target vulnerability for observation in the next round of map update.

[0088] In some embodiments, candidate optimization training samples may include sample text, attack intent labels, attack category labels, mutation dimension labels, source sample identifiers, business scenario identifiers, expected attack behavior labels, mutation operation records, and generation rounds. The mutation operation record records which mutation operations generated the candidate optimization training sample. For example, the mutation operation record may indicate that the candidate optimization training sample was generated jointly by semantic substitution and structural splitting, or jointly by cross-language transformation and interference fragment insertion. This allows for tracing the generation source of each sample when subsequently evaluating the marginal contribution of a certain type of mutation operation.

[0089] In some embodiments, semantic similarity clustering can be implemented using vector clustering. The security enhancement platform inputs candidate optimization training samples into the text embedding model to obtain sample vectors. These sample vectors can be 384-dimensional, 768-dimensional, 1024-dimensional, or other dimensional floating-point vectors. The security enhancement platform calculates the cosine similarity between the sample vectors. If the cosine similarity between two candidate optimization training samples is greater than or equal to a similarity threshold, they can be assigned to the same cluster. The similarity threshold can be 0.90, 0.92, 0.95, 0.97, or dynamically determined based on the number of samples. For each cluster, the security enhancement platform can retain samples closest to the cluster center, samples with more complete attack path coverage, samples with higher relevance to the business scenario, or samples ranked highest after sorting based on the above conditions.

[0090] In some embodiments, the diversity score can be determined by sample semantic distance, attack method coverage, and business scenario relevance. Sample semantic distance can be the minimum semantic distance between the candidate optimized training sample and the historical training sample set. Attack method coverage can be determined based on whether the candidate optimized training sample introduces new attack categories, attack paths, or mutation dimensions. Business scenario relevance can be determined based on the degree of matching between the rhetoric, compliance trigger points, and historical attack patterns in the candidate optimized training sample and the business scenario profile.

[0091] In some embodiments, attack validity verification can be performed in an isolated target large model environment. The security enhancement platform inputs deduplicated candidate optimization training samples into the target large model or sandbox target model and records the target model's response. The security enhancement platform can determine whether the target model's response triggers the expected attack behavior through a risk classifier, rule detector, manual label review, or multi-model voting. If a candidate optimization training sample does not trigger the expected attack behavior, but the difference between its fence confidence and decision threshold satisfies the first difference condition, the security enhancement platform can add the candidate optimization training sample to the gray zone sample pool instead of deleting it directly. The gray zone sample pool can be used to supplement boundary determination samples in the next round.

[0092] In some embodiments, the security enhancement platform can perform tiered sampling based on attack category, semantic region, business scenario, and mutation dimension. Each layer can have an upper and lower bound on the number of samples. The upper bound is used to prevent a single category from consuming too much training capacity. The lower bound is used to prevent a few but high-risk categories from being missing from the target optimization training sample set. For high-risk business scenarios, the ratio of attack samples to normal business samples can be set to 1:5 to 1:20. For medium- and low-risk business scenarios, this ratio can be set to 1:10 to 1:50. Normal business samples can be used as holdover samples to reduce the false interception rate of normal business requests by the second security fence.

[0093] In the above embodiments, the process of forming the target optimization training sample set simultaneously considers attack effectiveness, sample diversity, and relevance to the business scenario. Compared with training directly using original attack samples, this process can reduce duplicate samples and increase the contribution of each training sample to the second security fence detection capability.

[0094] In some embodiments, the scene-specific security fence adapter can be implemented using a low-rank adapter. The security enhancement platform can freeze the main parameters of the security fence base model and load low-rank matrix parameters into the attention layer, feedforward layer, or classification output layer. The rank of the low-rank matrix can be 4, 8, 16, 32, or other values. During training, only the low-rank matrix parameters and the scene classification head parameters are updated. This reduces the number of training parameters for each target business scene, allowing multiple business scenes to share the same global base security fence adapter.

[0095] In some embodiments, the scenario-specific security fence adapter can also be implemented using a cue adapter, a classification head adapter, or a rule threshold adapter. The cue adapter can encode the business scenario profile into a scenario cue vector and input the scenario cue vector into the security fence model. The classification head adapter can set an independent scenario risk classification head after the shared encoder. The rule threshold adapter can configure different risk thresholds, gray zone thresholds, and manual review thresholds for different business scenarios. These adapters can be used individually or in combination by the security enhancement platform according to the computing resources and response latency requirements of the business scenario.

[0096] In some embodiments, training labels may include risk labels, attack category labels, business scenario labels, and response risk labels. Risk labels indicate whether a sample is a risky sample. Attack category labels indicate the attack category to which the sample belongs. Business scenario labels indicate the target business scenario corresponding to the sample. Response risk labels indicate whether the target model response contains the expected attack behavior. The security enhancement platform can construct a joint loss function. This joint loss function is obtained by adding the risk classification loss, attack category classification loss, business scenario consistency loss, and sample retention constraint loss, while setting corresponding loss weights for each of these losses. The risk classification loss is used for risk classification tasks, and the attack category classification loss is used for attack category classification tasks. The sample retention constraint loss constrains the difference between the output of the second security fence for normal business samples and the output before model training, thereby preventing an increase in the false interception rate.

[0097] In some embodiments, the training of the scenario-specific security fence adapter can employ mini-batch training. Each training batch may include attack samples, normal business samples, gray zone samples, and holdover samples. The proportion of gray zone samples in a training batch can be determined based on the number of gray zone samples in the current round. For example, if the number of gray zone samples increases, the proportion of gray zone samples in the training batch is increased; if the number of gray zone samples decreases, the proportion is decreased. The security enhancement platform may employ a learning rate decay strategy. Training termination conditions may include reaching the maximum number of training rounds, the improvement in validation set detection performance falling below a preset improvement threshold, the false interception rate exceeding a preset false interception threshold, or the training loss changing less than a preset loss threshold across multiple consecutive batches.

[0098] In some embodiments, the combination of a global basic security fence adapter and a scene-specific security fence adapter can employ a serial detection method. In this method, the global basic security fence adapter first outputs a general risk score. If the general risk score exceeds a general interception threshold, the second security fence outputs an interception result. If the general risk score does not exceed the general interception threshold, the scene-specific security fence adapter continues to output a scene risk score, and determines whether to intercept, allow, or transfer the request for manual review based on the scene risk score. This method is suitable for business scenarios with high general risk requirements.

[0099] In other embodiments, the combination of the global basic security fence adapter and the scene-specific security fence adapter can employ a weighted fusion method. Under the weighted fusion method, the comprehensive risk score F output by the second security fence is obtained by weighting the general risk score output by the global basic security fence adapter and the scene risk score output by the scene-specific security fence adapter. For business scenarios with strong compliance requirements, the weight of the scene risk score output by the scene-specific security fence adapter can be configured to a larger value to enhance the impact of scene-specific risks. For business scenarios where general security risks dominate, the weight of the general risk score output by the global basic security fence adapter can also be configured to a larger value.

[0100] In the above embodiments, the second safety fence can achieve path landing through different adapters. The training process forms an executable training flow through sample labels, loss functions, training batches, and termination conditions. The adapter combination process connects general detection capabilities and scene detection capabilities to the same decision link, which can reduce the computational pressure caused by retraining the complete model.

[0101] In some embodiments, attack surface similarity can be obtained by weighting multiple similarity components. The security enhancement platform can calculate attack type set similarity, attack path set similarity, semantic region similarity, compliance requirement similarity, and historical attack sample similarity. Attack type set similarity can be calculated using the intersection-union ratio (IUU). Attack path set similarity can be calculated based on the proportion of identical path nodes to the total number of path nodes. Semantic region similarity can be calculated based on the distance between the centers of semantic region vectors in two business scenarios. Compliance requirement similarity can be calculated based on the overlap of compliance labels. Historical attack sample similarity can be calculated based on the distance between the distributions of sample embedding vectors.

[0102] In some embodiments, the attack surface similarity between the first and second business scenarios can be calculated using a weighted multi-dimensional calculation factor. This multi-dimensional calculation factor includes attack type set similarity, attack path set similarity, semantic region similarity, compliance requirement similarity, and historical attack sample similarity, with corresponding weight values ​​configured for each dimension. When the calculated attack surface similarity between the two business scenarios is greater than or equal to a preset similarity threshold, the first and second business scenarios are deemed to meet the preset similarity standard. This preset similarity threshold can be selected from values ​​such as 0.60, 0.70, 0.80, and 0.85, and can also be flexibly set according to the enterprise's own security strategy.

[0103] In some embodiments, when distilling the detection capabilities of a first business scenario into a scenario-specific security fence adapter for a second business scenario, the security enhancement platform can first convert high-contribution samples from the first business scenario into language used in the second business scenario. The converted samples are then input into the second security fence corresponding to the first business scenario to obtain a soft-label risk distribution. The security enhancement platform then uses this soft-label risk distribution to train the scenario-specific security fence adapter for the second business scenario. During training, real attack samples from the second business scenario can be used simultaneously as constraints to adapt the distilled detection capabilities to the interaction style and compliance requirements of the second business scenario.

[0104] In some embodiments, whether multiple third-party service scenarios meet the merging conditions can be determined jointly based on attack surface similarity, performance evaluation metric compatibility, and inference resource constraints. If the attack surface similarity of multiple third-party service scenarios is greater than or equal to the merging similarity threshold, and their respective scenario-based evaluation metrics do not conflict with each other, and the inference latency of the merged adapter is lower than a preset latency threshold, then the security enhancement platform can merge the scenario training sample sets of multiple third-party service scenarios and train a shared scenario-specific security fence adapter. If the false interception ratio after merging exceeds a preset false interception threshold, then the security enhancement platform can rescind the merging and restore the scenario-specific security fence adapters for each of the multiple third-party service scenarios.

[0105] In some embodiments, when a target business scenario is differentiated into sub-scenarios with different attack surfaces, the security enhancement platform can perform sub-scenarios segmentation based on user groups, business functions, compliance tags, attack type distribution, and semantic region distribution. If two sample clusters exist within the same target business scenario, and the difference in attack type distribution between the two sample clusters is greater than a preset distribution difference threshold, or the compliance tags corresponding to the two sample clusters are different, then the security enhancement platform can split the target business scenario into two sub-scenarios. Each sub-scenarios can independently form a business scenario profile, a defense vulnerability map, a target-optimized training sample set, and a scenario-specific security fence adapter.

[0106] In the above embodiments, the first business scenario, the second business scenario, and the third business scenario are all specific business scenarios within the target business scenario set. The first business scenario represents the source scenario of the detection capability. The second business scenario represents the receiving scenario of the detection capability. The third business scenario represents the business scenario participating in the merging judgment. By using attack surface similarity and merging / splitting conditions, the security enhancement platform can avoid false interceptions caused by migrating detection capabilities between dissimilar scenarios, and can also reduce the resource consumption caused by repeated training in similar scenarios.

[0107] In some embodiments, if the attack execution unit inputs an attack sample into the first security fence but fails to obtain an interception result within a preset time, the result collection unit can mark the attack execution result as an execution timeout. Attack execution results that have timed out may not be used temporarily for the non-intercept ratio statistics, but can be added to the abnormal sample pool. If the execution timeout ratio of the same business scenario within a preset time window exceeds the timeout threshold, the security enhancement platform can pause the current round of training for that business scenario and re-execute the attack sample collection to avoid network anomalies or service anomalies affecting the defense vulnerability map.

[0108] In some embodiments, if the target model is unavailable, the security enhancement platform can input attack samples into the sandbox target model or a historical target model version for attack validity verification. If both the sandbox target model and the historical target model version are unavailable, the security enhancement platform can retain the interception results and fence confidence scores of the first security fence, and mark the target model response field as unavailable. Attack execution results in the unavailable model state can be used for gray zone sample analysis and fence confidence analysis, but not for target model response risk statistics.

[0109] In some embodiments, if the business scenario profile lacks compliance requirements, historical attack data, or user group fields, the security enhancement platform can supplement it using a default scenario profile template. The default scenario profile template can be determined based on the business type. For example, when the business type is intelligent customer service, the default compliance requirements may include privacy protection and service abuse prevention. When the business type is code assistant, the default compliance requirements may include code security and license compliance. Supplemented fields can be marked as inferred fields. After subsequently obtaining a complete business scenario profile, the security enhancement platform can recalculate the attack surface analysis report.

[0110] In some embodiments, if the mutated and expanded candidate optimized training sample does not match the target business scenario, the security enhancement platform can remove it from the current target business scenario's candidate optimized training sample set and transfer it to the cross-scenario candidate sample pool. A mismatch with the target business scenario can be determined by the business scenario relevance being lower than a preset relevance threshold. Samples in the cross-scenario candidate sample pool can be reused when matching attack surface analysis reports from other business scenarios.

[0111] In some embodiments, if the risk assessments output by the global basic security fence adapter and the scene-specific security fence adapter are inconsistent, the second security fence can output the final result according to a conflict handling strategy. Conflict handling strategies may include a high-risk priority strategy, a scene-risk priority strategy, a weighted fusion strategy, and a manual review strategy. The high-risk priority strategy is suitable for business scenarios such as privacy protection, financial Q&A, and medical consultation. The scene-risk priority strategy is suitable for business scenarios with significant differences in business language. The manual review strategy is suitable for samples where the difference between the fence confidence level and the decision threshold meets the first difference condition.

[0112] In the above embodiments, the security enhancement method provides processing paths for timeouts, target model unavailability, missing profile fields, sample scenario mismatches, and adapter decision conflicts. This allows the flywheel iteration process to run continuously in real business systems and reduces the interference of abnormal data on the defense vulnerability map and the target optimization training sample set.

[0113] Taking a code assistant business scenario as an example, the target model is an intelligent application model used to generate code snippets and code explanations. The first security fence is used to detect malicious code generation, vulnerable code generation, and instruction injection. The security enhancement platform obtains a business scenario profile of the code assistant scenario. This business scenario profile includes a business type of programming assistance, a user group of developers, compliance requirements of code security and open-source license compliance, a medium risk tolerance, and historical attack data including malicious knowledge generation attacks and instruction injection attacks.

[0114] The security enhancement platform selects a batch of attack samples from the attack sample library and inputs them into the first security fence of the code assistant scenario. The result acquisition unit records the interception result, fence confidence, and target model response for each attack sample. If the attack sample is not intercepted and enters the target model, the result acquisition unit records the code response generated by the target model. If the attack sample is intercepted by the first security fence, the result acquisition unit records the preset interception response in the target model response field.

[0115] The security enhancement platform analyzes the attack execution results. The attack category analysis submodule finds that the unblocked proportion of instruction injection attacks meets the first proportion condition. The semantic region analysis submodule finds that the number of unblocked samples in the semantic region of "code audit spoofing requests" meets the first quantity condition. The attack path analysis submodule finds that the number of unblocked samples in the attack path of "multi-turn dialogue step-by-step guidance" meets the second quantity condition. The gray zone sample analysis submodule finds that the difference between the fence confidence level and the decision threshold of several samples meets the first difference condition. Based on this, the generation module generates a defense vulnerability map for the code assistant scenario.

[0116] The security enhancement platform identifies target weaknesses based on a defense vulnerability map. For the "multi-turn dialogue step-by-step guidance" weakness, the platform configures semantic and structural mutation dimensions in the initial iteration rounds. The platform rewrites seed attack samples from direct requests into code audit consultations, vulnerability reproduction discussions, and security testing instructions. It also breaks down single-turn attack samples into multiple sub-requests, forming structural mutation samples. The platform performs semantic clustering to deduplicate candidate optimization training samples and uses a sandbox target model to verify whether the candidate optimization training samples trigger the expected attack behavior. Finally, the platform selects samples based on diversity scores to obtain the target optimization training sample set.

[0117] The security enhancement platform trains a scenario-specific security fence adapter for the code assistant scenario based on a target-optimized training sample set. During training, the global basic security fence adapter retains its ability to detect common malicious content and common jailbreak templates. The scenario-specific security fence adapter for the code assistant scenario learns scenario-specific detection capabilities for instruction injection and vulnerable code generation. After training is complete, the security enhancement platform combines the global basic security fence adapter and the scenario-specific security fence adapter for the code assistant scenario into a second security fence.

[0118] The security enhancement platform uses a code assistant scenario verification set to evaluate the second security fence. The scenario verification set includes normal programming question-and-answer samples, vulnerable code generation attack samples, instruction injection attack samples, and gray zone samples. The verification and evaluation unit calculates the vulnerable code detection rate, instruction injection detection rate, false interception rate, and inference latency. If the number of uninterrupted samples in the "Code Audit Disguised Request" semantic region falls below a first quantity condition, the security enhancement platform lowers the priority of this semantic region in the defense vulnerability map. If the "Multi-turn Dialogue Step-by-Step Guidance" attack path still meets the second quantity condition, the security enhancement platform configures adversarial-level mutation dimensions and multi-language mutation dimensions for this target vulnerability in the next round.

[0119] The above end-to-end embodiment links the generation of defense vulnerability maps, sample mutation expansion, sample quality screening, scenario-specific security fence adapter training, second security fence evaluation, and defense vulnerability map updates within the same business scenario. This embodiment is only used to illustrate a typical combination and does not constitute a limitation on the scope of protection of this application.

[0120] In some embodiments, a business scenario profile is used to describe the business attributes, security boundaries, and attack exposure surface of a target business scenario. A business type represents the type of business function provided by the target business scenario, such as intelligent customer service, code assistance, content creation, enterprise knowledge base Q&A, financial Q&A, or medical consultation. The business type can be used to determine the default attack type library and default evaluation metrics.

[0121] User groups are used to represent the target users of a specific business scenario. For example, user groups can include ordinary consumers, internal employees, developers, content creators, or professional moderators. User groups can be used to determine the rhetoric style, risk tolerance, and false positive weight of attack samples.

[0122] Compliance requirements are used to represent the security constraints and output constraints that a target business scenario must adhere to. For example, compliance requirements may include personal information protection, code security, open-source license compliance, copyright compliance, medical consultation compliance, or financial suitability requirements. Compliance requirements can be used to construct compliance risk attack samples and to set scenario-based assessment metrics for establishing a second security fence.

[0123] Risk tolerance is used to represent the acceptable level of different risk outcomes for a target business scenario. For example, a low risk tolerance can be set for information leakage in an intelligent customer service scenario, and a low risk tolerance can be set for the generation of vulnerable code in a code assistant scenario. Risk tolerance can be used to configure a first proportion threshold, a manual review threshold, and a scenario risk weight.

[0124] Historical attack data represents the types of attacks, attack frequency, attack success rate, attack paths, and bypassed samples that have occurred in the target business scenario in the past. Historical attack data can be used to generate attack surface analysis reports, filter target attack types, and generate scenario-specific variant attack samples.

[0125] Business dialogue features are used to represent common interaction expressions in target business scenarios. These features can include question-and-answer structures, technical terms, request formats, context length, and dialogue rounds. Business dialogue features can be used to adapt dialogue to basic attack samples for specific scenarios.

[0126] In some embodiments, the attack execution results can be stored in a structured record. The sample identifier is used to uniquely identify an attack sample. The attack sample body records the original content entered into the first security fence. The attack type indicates the type of attack sample, such as identity and scenario manipulation, evasion and obfuscation, instruction and logic injection, model vulnerability exploitation, service abuse and resource exhaustion, malicious knowledge generation, or direct malicious content.

[0127] The business scenario identifier indicates the target business scenario in which the attack sample was deployed. The first security fence version records the security fence version used during detection. The interception result indicates the processing result of the first security fence on the attack sample, which may include interception, allowance, risk marking, referral to manual review, or downgrade response.

[0128] The fence confidence score represents the risk probability value, score, or confidence score output by the first security fence for the attack sample. The target model response records the response generated by the target model after the attack sample is not intercepted and is input into the target model; if the attack sample is intercepted by the first security fence, the target model response can be recorded as the preset interception response or a null value.

[0129] The attack path identifier indicates the detection or interaction links traversed by the attack sample. Execution time and execution round record the time of attack execution and the flywheel iteration round. The manual review label records the risk status of the sample confirmed after manual review. These fields can be used to construct a defense vulnerability map, screen seed attack samples, and evaluate the detection effectiveness of the second security fence.

[0130] In some embodiments, a defense vulnerability graph may include nodes and edges. Nodes represent objects or states associated with defense vulnerabilities. Attack category nodes represent an attack type. Semantic region nodes represent a group of attack samples with similar semantics. Attack path nodes represent the input, detection, model invocation, output-side detection, and final output path traversed by the attack sample. Gray zone sample set nodes represent a group of samples whose fence confidence is close to the decision threshold.

[0131] The business scenario node represents the target business scenario. The first security fence version node represents the security fence version used when the attack execution result was generated. The target vulnerability node represents the protection gap exhibited in a certain business scenario, attack category, semantic region, or attack path. Edges represent the relationships between nodes. For example, an edge between an attack category node and a semantic region node can indicate that there are unblocked samples of that attack category in that semantic region.

[0132] In some embodiments, vulnerability priority is used to indicate how preferentially a defensive vulnerability is addressed in the current round. A higher vulnerability priority indicates that the vulnerability has a greater impact on business security or is more suitable as a target for sample construction and model training in the current round. A lower vulnerability priority indicates that the vulnerability can be delayed or needs to wait for more attack execution results before being addressed.

[0133] Vulnerability priorities can be generated based on at least one of the following: the percentage of unblocked attacks, the number of associated attack samples, the number of associated business scenarios, the business risk level, the number of gray zone samples, historical trends, and the improvement in performance in the most recent round. For example, if the percentage of unblocked attacks of a certain attack category is high and the associated business scenario risk level is high, then the vulnerability corresponding to that attack category can be configured with a higher priority. If a vulnerability has not significantly improved after the previous round of training, its priority can also be increased in the next round.

[0134] In some embodiments, an iteration round may include attack execution, result collection, vulnerability analysis, sample construction, defense training, effectiveness evaluation, and graph update. Attack execution is used to input attack samples into a first security fence. Result collection is used to record interception results, fence confidence, and target model response. Vulnerability analysis is used to generate or update a defense vulnerability graph. Sample construction is used to generate a target-optimized training sample set based on the defense vulnerability graph. Defense training is used to train a scenario-specific security fence adapter. Effectiveness evaluation is used to evaluate a second security fence based on a scenario validation set. Graph update is used to feed the evaluation results back to the next round.

[0135] The initial iteration round can be understood as the first round or several rounds of training that begin after the initial attack execution is completed for the target business scenario. The goal of this stage is usually to rapidly expand the coverage of attack samples, so semantic-level mutation dimensions and structural-level mutation dimensions can be configured first.

[0136] Semantic variations primarily alter the expressive meaning of the attack sample while maintaining the attack intent. Examples include synonym substitution, sentence structure transformation, contextual embedding, and shifts in emotional tone. Structural variations primarily change the organizational structure and presentation of the attack sample. Examples include splitting a single-turn request into a multi-turn dialogue, packaging a direct request as a role-playing scenario, and breaking down a single problem into multiple sub-problems within a hypothetical framework.

[0137] In subsequent iterations, if the improvement in the detection performance of a certain target weakness falls below a preset threshold, the security enhancement platform can add adversarial mutation dimensions and multilingual mutation dimensions. Adversarial mutation is used to simulate interference word insertion, encoding transformation, logical nesting, and hybrid attack construction. Multilingual mutation is used to simulate changes in attack expression caused by translation back-translation, cross-language equivalent expressions, and uneven coverage of different language resources.

[0138] In some embodiments, the first proportion condition can be that the non-intercepted proportion is greater than or equal to a first proportion threshold. The first proportion threshold can be set according to business risk. For example, the first proportion threshold in high-risk business scenarios can be configured to 1% to 5%, the first proportion threshold in medium-risk business scenarios can be configured to 5% to 10%, and the first proportion threshold in low-risk business scenarios can be configured to 10% to 20%.

[0139] A semantic region refers to a region formed in a vector space or clustering result by a group of semantically similar attack samples. For example, in a code assistant scenario, "code audit spoofing request," "vulnerability reproduction discussion," and "security test instructions" can each form different semantic regions. In an intelligent customer service scenario, "identity spoofing request," "privacy theft request," and "unauthorized query request" can each form different semantic regions.

[0140] The first quantity condition can be that the number of unblocked samples in a certain semantic region is greater than or equal to a first quantity threshold. The first quantity threshold can be 10, 30, 50, 100, or other values ​​configured according to the scale of the business scenario. For example, if the number of unblocked samples in a certain semantic region reaches 30, the security enhancement platform can identify that semantic region as a semantic weakness node.

[0141] An attack path represents the chain that an attack sample traverses from input to the final processing result. This chain can include attack sample input, first security fence detection, target model invocation, target model response generation, output-side security detection, and final output. The final output can be the final response returned by the target business system, or it can be the result of interception, permission granting, risk marking, or manual review output from the first or second security fence.

[0142] The second quantity condition can be that the number of unblocked samples on a certain attack path is greater than or equal to the second quantity threshold. The second quantity threshold can be 5, 10, 20, 50, or other values ​​configured according to the attack sample volume of the target business scenario. For example, if the number of unblocked samples in the "multi-turn dialogue step-by-step guidance" attack path reaches 10, then the attack path can be identified as a vulnerability in the attack path.

[0143] The first difference condition can be that the absolute difference between the fence confidence score and the decision threshold is less than or equal to the first difference threshold. The first difference threshold can be 0.01, 0.03, 0.05, 0.10, or other values ​​configured according to the confidence score range. For example, when the decision threshold is 0.50, if the fence confidence score of the attack sample is 0.48 or 0.52, and the first difference threshold is 0.05, then the attack sample can be identified as a gray area sample.

[0144] In some embodiments, the low-rank adapter is characterized by a small number of parameters, allowing scene-specific parameters to be trained while freezing the main parameters of the base model. The low-rank adapter is suitable for scenarios requiring the separate training of lightweight detection capabilities for multiple business scenarios.

[0145] The cue adapter is characterized by introducing business scenario information through scenario cue vectors. It is suitable for scenarios where there are significant differences in wording between business scenarios, but basic security detection capabilities can be shared. The classification head adapter, on the other hand, is characterized by configuring an independent classification head after a shared encoder. It is suitable for scenarios where different business scenarios have different risk labeling systems.

[0146] Rule adapters or risk threshold adapters are characterized by adjusting detection results through rule conditions, risk thresholds, gray zone thresholds, or manual review thresholds. These adapters are suitable for business scenarios with clearly defined compliance requirements and a need for rapid adjustment of interception criteria.

[0147] In some embodiments, the combination of a scenario-specific security fence adapter and a global basic security fence adapter can include serial detection, parallel voting, weighted fusion, hierarchical routing, and threshold linkage. Serial detection can first filter general high-risk samples using the global basic security fence adapter, and then process scenario-specific risks using the scenario-specific security fence adapter. Parallel voting can simultaneously output general risk scores and scenario risk scores, and obtain the final result according to voting rules. Weighted fusion can combine the general risk score and the scenario risk score based on business risk weights.

[0148] Layered routing can route samples to different adapters based on service type or attack type. Threshold linkage can dynamically lower the interception threshold when the scenario risk is high, or raise the manual review threshold when the false interception rate is high. Through the above combination, the second security fence can establish a configurable decision link between general detection capabilities and scenario-specific detection capabilities.

[0149] The scenario validation set can include attack samples, normal business samples, boundary samples, and maintenance samples. Attack samples are used to evaluate the second security fence's ability to detect risky samples. Normal business samples are used to evaluate the false interception rate. Boundary samples are used to evaluate the ability to handle gray area samples. Maintenance samples are used to evaluate whether the second security fence maintains the original normal business processing capabilities. Scenario-based evaluation metrics can include detection accuracy, non-intercept rate, false interception rate, detection rate of different attack categories, detection rate of different semantic regions, inference latency, and manual review rate.

[0150] See Figure 3 Seed attack samples can be attack samples that cause defense failure. The security enhancement platform can identify seed attack samples from the attack execution results associated with the defense vulnerability map, and perform multi-dimensional mutation expansion around the seed attack samples.

[0151] In semantic-level mutation, the security enhancement platform can perform synonym replacement, sentence structure transformation, contextual embedding, and sentiment transformation on seed attack samples while keeping the attack intent unchanged. Thus, candidate samples can cover the same attack intent expressed in different ways.

[0152] In structural-level variation, the security enhancement platform can perform role-playing embedding, hypothetical framing construction, multi-step decomposition, and length expansion compression on seed attack samples. Thus, candidate samples can cover variations in the organizational structure and presentation of attack content.

[0153] In adversarial-level mutations, the security enhancement platform can perform interference word insertion, encoding transformation, logic nesting, and hybrid attack construction on seed attack samples. This processing is used to generate candidate attack samples that more closely resemble real bypass behavior.

[0154] In multilingual mutation, the security enhancement platform can perform translation-back-translation, cross-language equivalent expression generation, and coverage imbalance exploitation on seed attack samples. Thus, candidate samples can cover attack expressions in different linguistic environments.

[0155] The aforementioned semantic-level variations, structural-level variations, adversarial-level variations, and multilingual variations are aggregated to form a variation extension sample set. The security enhancement platform further performs semantic similarity deduplication, clustering deduplication, and representative sample retention on the variation extension sample set to reduce highly duplicated samples.

[0156] The security enhancement platform can also perform attack validity screening on candidate samples. Attack validity screening verifies whether candidate samples can still trigger the expected attack behavior and filters out invalid samples. The security enhancement platform can also calculate a diversity score based on semantic distance, attack method coverage, and scenario relevance.

[0157] After deduplication, attack effectiveness screening, and diversity scoring, the security enhancement platform obtains a high-quality and diverse training sample set. This training sample set is then used to train the defense model, enabling the second security fence to learn attack representations in different variation spaces.

[0158] See Figure 4 The target business scenario can be analyzed into multiple profile dimensions. These profile dimensions can include business type, user group, compliance requirements, risk tolerance, and historical attack data.

[0159] Business types can include intelligent customer service, code assistance, and content creation. User groups can include internal employees, general consumers, and professionals. Compliance requirements can include data security, privacy protection, and content compliance. Risk tolerance can include risk boundaries such as tolerance for information breaches and code vulnerabilities. Historical attack data can include attack types, attack frequencies, and attack success rates.

[0160] The security enhancement platform generates business scenario profiles and attack surface analysis reports based on the aforementioned profile dimensions. The attack surface analysis report records high-risk attack types, attack paths, risk priorities, and scenario constraints within the target business scenario.

[0161] The security enhancement platform can filter attack types related to the target business scenario from the global attack database. It can also adapt basic attack samples to specific scenarios based on the interaction style and user dialogue characteristics of the target business scenario.

[0162] The security enhancement platform can also execute compliance-driven attack constructs based on compliance requirements. For example, it can write the protected objects and restricted output behaviors corresponding to data security, privacy protection, or content compliance requirements into the attack object field or output request field.

[0163] In some embodiments, the security enhancement platform can further perform scenario-based mutation extensions. These extensions can replace the business context and generate evolved variants based on historical attacks. Thus, attack samples can closely resemble real-world attack patterns within the target business scenario.

[0164] Through the above processing, the security enhancement platform generates scenario-specific attack schemes. These scenario-specific attack schemes can include scenario-specific attack samples, attack type priorities, and scenario-specific dialogue templates, and are input into the scenario-specific defense model training process.

[0165] See Figure 5 The security enhancement platform can maintain a globally shared base adapter. This globally shared base adapter is used to cover general attack detection capabilities. Figure 5 The globally shared base adapter shown in the example can be approximately 50MB, but it can also be configured to other sizes depending on the model structure and deployment resources.

[0166] Beyond the globally shared base adapter, the security enhancement platform can train scenario-specific adapters for different business scenarios. For intelligent customer service scenarios, scenario-specific adapters can focus on learning identity manipulation and service abuse detection capabilities. For code assistant scenarios, scenario-specific adapters can focus on learning malicious knowledge generation and instruction injection detection capabilities. For content creation scenarios, scenario-specific adapters can focus on learning malicious content generation and obfuscation evasion detection capabilities.

[0167] Figure 5 Each scenario-specific adapter shown in the example can be approximately 15MB. This value is only for illustrative purposes and can indicate that a scenario-specific adapter has a smaller parameter size compared to the full model. The actual number of parameters for a scenario-specific adapter can be determined based on the security fence base model, adapter type, and the complexity of the business scenario.

[0168] The final defense model for each business scenario can be obtained by combining a globally shared basic adapter with a corresponding scenario-specific adapter. This combination method enables the final defense model to have both general attack detection capabilities and scenario-specific attack detection capabilities.

[0169] In some embodiments, the security enhancement platform can perform knowledge distillation between scenario-specific adapters. When the detection capabilities trained in a first business scenario are applicable to a second business scenario, the security enhancement platform can distill the detection capabilities of the first business scenario to the scenario-specific adapter of the second business scenario.

[0170] Figure 5 It also demonstrates dynamic scenario management capabilities. The security enhancement platform can perform scenario merging, scenario splitting, priority scheduling, and automatic retraining triggered by scenario changes. Therefore, the scenario-based defense system can be updated as business scenarios and attack patterns change.

[0171] In the exemplary assessments, the intelligent customer service scenario achieves approximately 94% detection accuracy and approximately 96% user privacy protection rate. The code assistant scenario achieves approximately 93% detection accuracy and approximately 95% vulnerability code detection rate. The content creation scenario achieves approximately 93% detection accuracy and approximately 94% copyright violation interception rate. These figures are intended to illustrate achievable assessment results and do not constitute a limitation on the scope of protection of this application.

[0172] See Figure 6The horizontal axis represents the number of flywheel iterations, and the vertical axis represents the detection accuracy. Figure 6 The solid curves in the figure represent embodiments of this application constructed using diverse samples. The dashed curves represent comparison methods using the original attack samples for training.

[0173] exist Figure 6 In the examples shown, both approaches start with a detection accuracy of approximately 80%. This application's embodiments utilize multi-dimensional mutation expansion driven by a defense vulnerability map, deduplication screening, and diversity scoring to ensure that the training samples more comprehensively cover exposed defense vulnerabilities. Therefore, the detection accuracy increases rapidly within fewer iterations.

[0174] Figure 6 In this embodiment, the corresponding curve achieves a detection accuracy of approximately 95% around four incremental iterations. The curve obtained using the contrasting method requires approximately ten iterations to reach a detection accuracy of approximately 92%. This comparison demonstrates that constructing diverse samples can shorten the iteration cycle required to achieve the target detection accuracy.

[0175] In some embodiments, the convergence speed improvement factor can be determined based on the ratio of the number of rounds required to achieve the target accuracy using the comparison method to the number of rounds required to achieve the target accuracy using the embodiments of this application. For example, when the comparison method reaches the target level in about 10 rounds, while the embodiments of this application reach the target level in about 4 rounds, the convergence speed can be improved by about 2.5 times.

[0176] Figure 6 The shaded area in the diagram illustrates the difference in detection accuracy between the two training methods within the same iteration interval. This difference stems from the fact that the target optimized training sample set is generated around actual defensive weaknesses, rather than being trained using raw attack samples indiscriminately.

[0177] like Figure 5 As shown, a safety enhancement system for a safety fence related to flywheel iteration is disclosed, the system comprising: The acquisition module 510 is used to acquire a business scenario profile and attack execution results of the target business scenario, wherein the attack execution results are obtained by inputting the attack sample into the first security fence of the target business scenario. The generation module 520 is used to perform multi-dimensional analysis of defense weaknesses based on the attack execution results and generate a defense weakness map of the target business scenario. The mutation extension module 530 is used to mutate and extend the attack sample based on the defense vulnerability map to obtain a target optimized training sample set. Training module 540 is used to train a scenario-specific security fence adapter corresponding to the target business scenario based on the business scenario profile and the target optimized training sample set, and to combine the scenario-specific security fence adapter with the global basic security fence adapter to obtain a second security fence for the target business scenario. The verification update module 550 is used to evaluate the effectiveness of the second security fence based on the scenario verification set, and update the defense vulnerability map based on the effectiveness evaluation results. The updated defense vulnerability map is used to generate the next round of target optimization training sample set.

[0178] This application also provides a security enhancement system for a security fence related to flywheel iteration. The system includes an acquisition module, a generation module, a mutation and expansion module, a training module, and a verification and update module. The acquisition module corresponds to the aforementioned result acquisition unit. The acquisition module is used to acquire a business scenario profile of the target business scenario and the attack execution result. The attack execution result is the result obtained after inputting the attack sample into the first security fence of the target business scenario.

[0179] The generation module performs multi-dimensional analysis of defense weaknesses based on attack execution results, generating a defense weakness map of the target business scenario. The generation module may include an attack category analysis submodule, a semantic region analysis submodule, an attack path analysis submodule, and a gray zone sample analysis submodule. The attack category analysis submodule determines attack categories whose unblocked proportion meets a first proportion condition. The semantic region analysis submodule determines semantic regions whose number of unblocked samples meets a first quantity condition. The attack path analysis submodule determines attack paths whose number of unblocked samples meets a second quantity condition. The gray zone sample analysis submodule determines gray zone samples whose difference between the fence confidence level and the decision threshold meets a first difference condition.

[0180] The mutation and expansion module is used to mutate and expand attack samples based on the defense vulnerability map, obtaining a target-optimized training sample set. This module may include a seed sample determination submodule, a mutation dimension configuration submodule, a candidate sample generation submodule, and a quality screening submodule. The training module is used to train a scenario-specific security fence adapter corresponding to the target business scenario based on the business scenario profile and the target-optimized training sample set. It then combines the scenario-specific security fence adapter with the global basic security fence adapter to obtain a second security fence for the target business scenario. The validation and update module is used to evaluate the effectiveness of the second security fence based on the scenario validation set and update the defense vulnerability map based on the evaluation results.

[0181] Each module in the above system can be implemented by a processor executing program code stored in memory. Each module can also be implemented using application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), graphics processing units (GPUs), or neural network accelerators. Different modules can be deployed on the same server or distributed across multiple servers or containers. Different deployment methods do not affect the data flow between modules.

[0182] The safety enhancement system for flywheel iteration-related safety fences provided in the above embodiments can execute the safety enhancement method for flywheel iteration-related safety fences provided in any of the foregoing method embodiments. The above-described division of program modules is merely an example; in practical applications, the above steps can be assigned to different program modules or processors as needed. That is, the internal structure of the system can be divided into different program modules or processors to complete all or part of the processing described above. Furthermore, the safety enhancement system for flywheel iteration-related safety fences provided in the above embodiments and the embodiments of the safety enhancement method for flywheel iteration-related safety fences belong to the same concept. The specific implementation process is detailed in the method embodiments and will not be repeated here.

[0183] To achieve the above objectives, embodiments of the present invention also provide an electronic device, such as... Figure 7 As shown, the electronic device may include a processor 701 and a memory 703 connected to the processor 701 via a communication bus 702; wherein, the memory 703 is used for executing programs; the processor 701, through the execution of the executable program, can implement the safety enhancement method for the safety fence related to flywheel iteration provided in any of the foregoing embodiments.

[0184] Another embodiment of the present invention provides a computer storage medium storing an executable program that, when executed by a processor 701, can implement the steps of a security enhancement method for a safety fence related to flywheel iteration applied to the computing device. For example, as... Figures 1-3 One or more of the methods shown.

[0185] In some embodiments, the computer storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0186] Other embodiments of this specification will readily occur to those skilled in the art upon consideration of the specification and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this specification are indicated by the claims.

Claims

1. A method for enhancing the safety of a safety fence related to flywheel iteration, characterized in that, The method includes: Obtain a business scenario profile and attack execution results for the target business scenario, wherein the attack execution results are obtained by inputting the attack sample into the first security fence of the target business scenario; Based on the attack execution results, a multi-dimensional analysis of defense weaknesses is performed to generate a defense weakness map of the target business scenario; Based on the defense vulnerability map, the attack samples are mutated and expanded to obtain the target optimized training sample set; Based on the business scenario profile and the target optimized training sample set, a scenario-specific security fence adapter corresponding to the target business scenario is trained, and the scenario-specific security fence adapter is combined with the global basic security fence adapter to obtain the second security fence of the target business scenario. The effectiveness of the second security fence is evaluated based on the scenario validation set, and the defense vulnerability map is updated based on the effectiveness evaluation. The updated defense vulnerability map is used to generate the next round of target optimization training sample set.

2. The method according to claim 1, characterized in that, The mutation and expansion of the attack samples based on the defense vulnerability map to obtain the target optimized training sample set includes: From the attack samples, determine the seed attack sample corresponding to the defense weakness, and determine the sample mutation dimension corresponding to the defense weakness; The seed attack sample is expanded by mutation corresponding to the sample mutation dimension to obtain candidate optimized training samples; The candidate optimization training samples obtained from the mutation expansion are screened for sample quality to obtain the target optimization training sample set.

3. The method according to claim 2, characterized in that, Based on the defense vulnerability map, the sample variation dimension corresponding to the defense vulnerability is determined, including: Based on the vulnerability priority contained in the defense vulnerability map, target vulnerabilities are determined and sample mutation dimensions are configured for the target vulnerabilities. The unintercepted ratio corresponding to the target vulnerabilities satisfies the second ratio condition, and the number of business scenarios or attack samples associated with the target vulnerabilities satisfies the first range condition. In the initial iteration round, semantic-level variation dimension and structural-level variation dimension are configured for the target weakness; In subsequent iterations, based on the effect evaluation results of the previous round, adversarial mutation dimensions and multilingual mutation dimensions are configured for the target weaknesses whose detection effect improvement is lower than a preset improvement threshold. After any iteration round ends, based on the marginal contribution of the newly added mutated expanded samples to the detection effect, reused samples and / or discarded samples are determined, wherein the reused samples are used for the next iteration round; the discarded samples are not used for the next iteration round.

4. The method according to claim 2 or 3, characterized in that, The seed attack sample is subjected to mutation expansion corresponding to the sample mutation dimension to obtain a candidate optimization training sample set, including at least one of the following: While keeping the attack intent of the seed attack sample unchanged, semantic mutation is performed on the seed attack sample to obtain a semantically mutated sample. By altering the organizational structure and presentation of the seed attack sample, a structurally mutated sample is obtained; An adversarial perturbation is introduced into the seed attack sample to obtain an adversarial mutant sample; The seed attack sample is subjected to cross-language conversion to obtain multilingual variant samples; The semantic variant samples, the structural variant samples, the adversarial variant samples, and / or the multilingual variant samples are aggregated into the candidate optimized training samples.

5. The method according to claim 2 or 3, characterized in that, The candidate optimization training samples obtained from the mutation expansion are screened for sample quality to obtain the target optimization training sample set, including: Determine the semantic similarity between the candidate optimized training samples, and perform clustering and deduplication on the candidate optimized training samples based on the semantic similarity; Input the deduplicated candidate optimized training samples into the target large model to verify whether the deduplicated candidate optimized training samples trigger the expected attack behavior. For candidate optimized training samples that trigger the expected attack behavior, a diversity score is determined. The diversity score is determined based on one or more of the following: sample semantic distance, attack method coverage, and business scenario relevance. Based on the diversity score, samples are selected from the candidate optimized training samples that trigger the expected attack behavior to obtain the target optimized training sample set.

6. The method according to any one of claims 1 to 3, characterized in that, Based on the attack execution results, a multi-dimensional analysis of defense weaknesses is performed to generate a defense weakness map of the target business scenario, including: Based on the interception results of the first security fence, determine the attack category whose unintercepted proportion meets the first proportion condition; Semantic clustering is performed on the attack samples that were not intercepted by the first security fence to determine the semantic regions where the number of unintercepted samples satisfies the first quantity condition; Based on the execution process of the attack sample from initial input to the first security fence to the formation of the target model response, an attack path is determined where the number of uninterrupted samples meets a second quantity condition; the target model response is either a first type response or a second type response; the first type response is the response generated by the target model based on the attack sample when the attack sample is not intercepted by the first security fence and is input into the target model; the second type response is the response output by the target model when the attack sample is intercepted by the first security fence. Based on the distribution of the fence confidence of the first security fence, gray area samples are determined from the attack samples whose difference between the fence confidence and the decision threshold satisfies the first difference condition; the fence confidence is the probability value, score value or confidence score output by the first security fence for the attack sample, used to characterize whether the attack sample belongs to a risk sample or a non-risk sample. The defense vulnerability map is generated based on the attack category, the semantic region, the attack path, and / or the gray area sample.

7. The method according to any one of claims 1 to 3, characterized in that, The business scenario profile includes business type, user group, compliance requirements, risk tolerance, and / or historical attack data; the method also includes: Based on the business scenario profile, the attack surface information of the target business scenario is determined, and an attack surface analysis report is generated based on the attack surface information. The attack surface analysis report includes at least one of the attack type, attack method, attack path and risk priority corresponding to the target business scenario. Based on the attack types and risk priorities in the attack surface analysis report, the target attack type that matches the target business scenario is determined from the global attack type library; Obtain basic attack samples corresponding to the target attack type from the attack sample library, and rewrite the basic attack samples based on the interaction style and user dialogue characteristics of the target business scenario to obtain scenario-adaptive attack samples. The protected objects and restricted output behaviors are extracted from the compliance requirements, and the protected objects and restricted output behaviors are written into the attack object field or output request field of the scenario-adaptive attack sample to obtain the compliance risk attack sample. Based on the historical attack data, the historical attack methods and historical attack paths of the target business scenario are determined, and the scenario-adaptive attack samples and / or compliance risk attack samples are mutated and extended according to the historical attack methods and historical attack paths to obtain scenario-mutated attack samples. Based on the target attack type, the scenario-adaptive attack sample, the compliance risk attack sample, and the scenario-mutation attack sample, a scenario-customized attack scheme is generated. The scenario-customized attack scheme includes a set of attack samples to be input into the first security fence, the target attack type and attack execution order corresponding to each attack sample in the attack sample set, and the attack sample set is used to input into the first security fence to obtain the attack execution result.

8. The method according to any one of claims 1 to 3, characterized in that, Based on the business scenario profile and the target optimized training sample set, a scenario-specific security fence adapter corresponding to the target business scenario is trained, including: Based on the business scenario profile, the target optimization training sample set is grouped according to the business scenario to obtain the scenario training sample set corresponding to the target business scenario; Based on the scenario training sample set, a scenario-specific security fence adapter corresponding to the target business scenario is trained; The global basic security fence adapter is trained based on common attack samples across business scenarios.

9. The method according to any one of claims 1 to 3, characterized in that, The effectiveness of the second security fence is evaluated based on a scenario validation set, including at least one of the following: Based on the business requirements of the target business scenario, determine the scenario-based evaluation indicators for the target business scenario; Based on the scenario-based evaluation metrics, general detection metrics, and scenario verification sets, the effectiveness of the second security fence is evaluated; wherein, when the business scenario profile changes or the historical attack pattern shifts, the effectiveness of the second security fence is re-evaluated and / or the second security fence is optimized.

10. The method according to any one of claims 1 to 3, characterized in that, The method further includes: When the target business scenario includes a first business scenario and a second business scenario whose attack surface similarity to the first business scenario meets the preset similarity conditions, the detection capability of the first business scenario is distilled into the scenario-specific security fence adapter of the second business scenario. When the target business scenario includes multiple third business scenarios whose attack surface similarity meets the merging conditions, the scenario-specific security fence adapters of the multiple third business scenarios are merged. When the target business scenario is divided into sub-scenarios with different attack surfaces, the scenario-specific security fence adapter for the target business scenario is split.

Images