Multimodal continual learning safe forgetting method based on harmful cross-modal binding and decoupling

Abstract

The application discloses a multi-modal continuous learning safe forgetting method based on harmful cross-modal binding and decoupling, relates to the technical field of multi-modal large language models, and comprises the following steps: preparing samples and constructing counterfactual inputs; utilizing counterfactual activation replacement and screening key components according to a safe margin change quantity and a damage degree; constructing a harmful binding subspace by performing low-rank decomposition on activation differences inside the key components; constructing a capability preservation subspace by utilizing a reserved sample set and a prompt decoupling sample set, and performing orthogonalization processing on the harmful binding subspace; calculating the response intensity of internal activation in the harmful binding subspace and determining an intervention mode in an inference stage; editing internal activation of the key components, writing the internal activation back to a current forward calculation process, and outputting a result. The application realizes positioning of a harmful cross-modal binding path, risk representation and fine-grained decoupling of normal capability, and simultaneously preserves visual capability and general inference capability of a model while defending against multi-modal security risks.

Description

Technical Field

[0001] This invention relates to the field of multimodal large language model technology, and in particular to a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling. Background Technology

[0002] With the rapid development of multimodal large language models, they have demonstrated outstanding capabilities in tasks such as visual question answering, image understanding, and complex instruction generation by jointly modeling visual input and text commands. However, compared with pure text models, the security risks of multimodal models exhibit more complex cross-modal coupling characteristics. The security status of the model depends not only on whether the image content or text prompts individually contain dangerous information, but also on the conditional association formed between visual evidence and textual manipulation intentions within the model. Identifying an object in an image is a normal visual ability, but when the object information is jointly encoded with an actionable textual request within the model, it may trigger the generation of executable harmful content that would not occur in a separate modality. This cross-modal binding effect poses unique challenges to the security protection of multimodal models.

[0003] Existing safety alignment methods typically employ safety instruction fine-tuning and training with a preference for harmful or refusal responses, making the model inclined to refuse to answer when it recognizes a dangerous request. However, these methods primarily alter the model's behavioral preferences holistically, making it difficult to clearly define the different roles of textual intent, visual evidence, and their interaction in harmful generation. When the distribution of training data or risk patterns changes, the model may still trigger harmful responses through uncovered cross-modal combinations.

[0004] Existing methods for safe forgetting or model editing of harmful content typically use sample sets, visual concepts, parameter sets, or predefined knowledge relationships as intervention targets. They reduce the probability of harmful content generation through gradient updates, parameter modifications, neuron masking, or overall directional suppression. However, these methods suffer from the following problems: the intervention units are too coarse-grained, conflating normal perception with harmful capabilities; directly deleting or masking entire components may simultaneously damage visual perception, factual knowledge, and normal response capabilities; and fixed intervention intensity struggles to adapt to the risk differences in sample sets—too weak an intervention leads to security leaks, while too strong an intervention requires retraining or saving model copies of the over-forgetting logic and parameter update schemes, making it difficult to achieve reversible, on-demand, and low-cost risk control.

[0005] Therefore, there is a need for a reasoning-time safe forgetting method that can treat harmful cross-modal bindings as independent intervention objects, separate risk representations from capability representations in internal components, and dynamically adjust the intensity of representation editing based on the current input risk.

[0006] In summary, a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling is proposed. Summary of the Invention

[0007] The main objective of this invention is to provide a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling. This method addresses the problems in existing technologies regarding harmful content forgetting, such as the difficulty in distinguishing the independent contributions of textual intent and visual evidence, the inability to finely separate risk representation from normal ability representation, and the difficulty of adapting fixed-intensity interventions to sample-level risk differences, as well as the high deployment cost and irreversibility of parameter update schemes. This method achieves precise localization of harmful cross-modal binding paths, fine-grained decoupling of risk representation from normal ability, and safe forgetting during input-adaptive inference. It maintains the original visual understanding and general reasoning capabilities while ensuring the safety of the multimodal model.

[0008] Based on the first main aspect of the present invention, a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling is provided, comprising the following steps:

[0009] Obtain a forgotten sample set, a retained sample set, and a cue decoupling sample set; the forgotten sample set includes the original input, textual intent counterfactual input, and visual evidence counterfactual input.

[0010] Forgotten samples are input into a multimodal large language model with frozen parameters to perform forward computation, obtain the internal activation of candidate components, and calculate the safety margin based on the log probability difference between safe and harmful responses under the original input.

[0011] For each candidate component, in the forward computation of the original input, the original activation of the candidate component is replaced with the activation corresponding to the text intention counterfactual input and the activation corresponding to the visual evidence counterfactual input, respectively. The safety margin is recalculated, and key components are selected based on the amount of change in the safety margin and the degree of impairment to normal capabilities.

[0012] Based on the attribution categories of key components, the difference between the activation corresponding to the original input and the activation corresponding to the counterfactual input is calculated. The activation difference is decomposed into a low-rank subspace to construct a harmful binding subspace. The ability to construct a subspace is maintained by using the reserved sample set and the cue decoupling sample set, and the harmful binding subspace is orthogonalized.

[0013] Receive the multimodal input to be processed, read the internal activations generated by each key component during the prompting encoding stage, calculate the response strength of the internal activations in the harmful binding subspace, and determine the intervention mode;

[0014] The internal activation of critical components is edited based on a defined intervention mode, the projection component of the internal activation on the harmful binding subspace is suppressed, the edited internal activation of the critical components is written back to the current forward computation process and the result is output.

[0015] This invention provides a complete six-step safe forgetting method, including sample preparation, counterfactual activation and replacement of key components, low-rank decomposition to construct a harmful binding subspace, risk perception, and representation editing during inference. Through three types of control samples, changes in the safety margin are attributable to independent contributions from textual intent and visual evidence. By orthogonally decoupling the harmful binding direction from the normal capability direction within the components, harmful binding is suppressed while normal capabilities are preserved without loss. A routing mechanism dynamically adapts the intervention intensity to the input risk. Representation editing during inference ensures that all interventions take effect only in the forward computation without modifying the original weights.

[0016] Thus, this invention achieves precise location of cross-modal binding paths, fine-grained decoupling of risk characterization and normal capabilities, differentiated intervention based on input adaptation, and on-demand start / stop and zero-cost rollback during the deployment phase, fundamentally solving the problems of extensive location, capability impairment, strength adaptation, and deployment difficulties in existing technologies.

[0017] As a further preferred embodiment, in the aforementioned method, the original input includes an image and a corresponding text prompt; the text intent counterfactual input retains the original image and replaces the harmful text prompt with a harmless text prompt; the visual evidence counterfactual input retains the original text prompt and replaces the harmful visual content with harmless visual content.

[0018] The retained sample set includes samples from normal visual recognition, knowledge question answering, and reasoning tasks; the prompt decoupling sample set includes image-text samples with similar visual content but harmless textual intent, or similar textual forms but harmless visual content.

[0019] The formula for calculating the safety margin is as follows:

[0020] ;

[0021] in, This represents the safety margin of the model given the original input; Indicates the original input; Indicates a safety response; Indicates a harmful response; This represents conditional probability.

[0022] This invention discovers that harmful cross-modal generation is not triggered independently by a single modality, but is driven by the conditional combination of textual intent and visual evidence within the model. Therefore, the two types of factors must be examined separately to achieve accurate attribution. To this end, this invention constructs the textual intent counterfactual input graph by retaining the original image and replacing only the harmful text with harmless text, so that the improvement in the safety margin is entirely attributed to the elimination of the textual intent factor. The visual evidence counterfactual input replaces only the harmful visual content through dual operations, achieving independent control over the privacy of visual evidence. This symmetrical counterfactual construction scheme provides standardized test conditions for evaluating the contribution of each set of candidate components.

[0023] At the same time, the safety margin formula is introduced to quantify the model's safety state into a comparable representation, making the change in the safety margin before and after activation and replacement a unified scale for measuring the contribution of each component to harmful generation.

[0024] As a further preferred embodiment, in the aforementioned method, the steps for screening key components based on the change in safety margin and the degree of impairment to normal capabilities are as follows:

[0025] Calculate the intervention contribution value of each candidate component, where the intervention contribution value represents the change in the safety margin after replacing the candidate component with the corresponding counterfactual activation. The calculation formula is as follows:

[0026] ;

[0027] in, This represents the intervention contribution value of the candidate component; Indicates candidate components; This represents the formula for calculating the safety margin. Indicates the original input; This indicates the activation of the candidate component under the original input; This represents a counterfactual input sample; This indicates the counterfactual input type, which includes textual intent counterfactual input and visual evidence counterfactual input.

[0028] Then, based on the intervention contribution value and the damage item, the screening score for each candidate component is calculated:

[0029] ;

[0030] in, This indicates the screening score for candidate components; Indicates candidate components; This represents the intervention contribution value of the candidate component; Indicates the counterfactual input type; Weighting coefficients representing impairment of regulatory capacity This indicates the weighting coefficient of the decoupling term used for adjustment. This indicates the impairment of capabilities caused by replacing the activation with the retained sample set; This indicates the damage caused by decoupling the sample set;

[0031] Candidate components whose screening scores are higher than a preset threshold are identified as key components.

[0032] In the above technical solution, the contribution of each component to harmful generation is quantified into a comparable scalar by intervening in the contribution value. The larger the positive value, the stronger the component is in identifying harmful generation. Furthermore, the screening score introduces a retention sample set capability impairment term and a hint decoupling sample set impairment term as a double penalty, which forces the selected component to simultaneously maximize its contribution to harmful generation and minimize its impairment to normal capabilities. Thus, a paradigm shift is achieved from consistent differences among all components to precise screening of optimal targets, avoiding the drawback of capability collapse caused by one-size-fits-all deletion.

[0033] As a further preferred embodiment, in the aforementioned method, the attribution categories of the key components include text intent-related components, visual evidence-related components, and cross-modal binding components;

[0034] The specific method for determining the attribution category is as follows:

[0035] When the change in the safety margin caused by the counterfactual input replacement of text intent is greater than the response salience threshold and the change in the safety margin caused by the counterfactual input replacement of visual evidence is not greater than the response salience threshold, it is determined to be a text intent-related component;

[0036] When the change in the safety margin caused by the counterfactual input replacement of visual evidence is greater than the response salience threshold and the change in the safety margin caused by the counterfactual input replacement of textual intent is not greater than the response salience threshold, it is determined to be a visual evidence-related component.

[0037] When the change in safety margin resulting from the replacement of two types of counterfactual input samples is greater than the response significance threshold and the absolute value of the two differences is less than the tolerance threshold, it is determined to be a cross-modal binding component.

[0038] For text intent-related components, the harmful binding subspace is constructed based on the activation difference between the original input and the counterfactual text intent input;

[0039] For visual evidence-related components, the harmful binding subspace is constructed based on the activation difference between the original input and the counterfactual input of visual evidence;

[0040] For cross-modal binding-related components, the harmful binding subspace is constructed using two types of activation differences.

[0041] When orthogonalizing the harmful binding subspace, the normal capability representation direction is extracted using the retained sample set and the cue decoupling sample set, and the part of the harmful binding subspace that overlaps with the normal capability representation direction is removed.

[0042] Within the same component, different representation directions carry different functions. Some directions are responsible for encoding visual semantics such as object recognition, while others are responsible for binding visual information with operational intent to generate harmful content. The two are geometrically separable in the same activation space. This invention divides key components into three categories—text intent-related, visual evidence-related, and cross-modal binding—by introducing response salience thresholds and tolerance thresholds, thereby achieving source tracing of risk. Differentiated subspaces are constructed for different categories. Finally, by using the retained sample set and the cue decoupling sample set to extract normal capability directions and performing orthogonalization on the harmful binding subspace, the overlapping part between the harmful subspace and the capability retention subspace is deducted from the harmful subspace, thus achieving geometric separation of harmful and normal directions in the activation space of the same component.

[0043] As a further preferred embodiment, in the aforementioned method, the steps of calculating the response intensity of internal activation in the harmful binding subspace and determining the intervention mode are as follows:

[0044] It receives images and text prompts from multimodal input and completes visual encoding and text prompt encoding through a multimodal large language model;

[0045] Read the internal activations generated by key components during the prompting encoding phase, and calculate the response strength of these internal activations in the harmful binding subspace, as shown below:

[0046] ;

[0047] in, Indicates the response intensity; This represents the multimodal input to be processed, which includes images and text prompts; Indicates attribution category as A collection of key components; Indicates the attribution category; Indicates key components; Indicates a harmful bound subspace; This indicates that the key component is internally activated under the current input; This represents the orthogonal projection operator onto the harmful binding subspace;

[0048] The risk level of the multimodal input is then calculated based on the response intensity.

[0049] ;

[0050] in, Indicates the risk level of multimodal input; This represents the multimodal input to be processed; This represents the Sigmoid activation function; Represents the weight vector; This represents the transpose of the weight vector; Represents the risk feature vector; Indicates the bias term;

[0051] Finally, the appropriate intervention model is selected based on the level of risk.

[0052] By reading the projections of the activations of each key component onto the harmful binding subspace and calculating the category average of the L2 norm during the encoding stage before encoding begins, the brightness of the three risk factors is quantified into three corresponding comparable scalars, enabling fine-grained perception rather than general risk judgment of textual intent risk, visual evidence risk, and cross-modal binding risk.

[0053] The risk feature vector further integrates lightweight features from text prompts, enabling risk perception to take into account both internal activation states and external input semantics. Finally, the risk score compresses the four-dimensional features into a single score through a lightweight linear transformation. The entire process does not read the final answer or rely on external review. Thus, this invention can quickly complete risk quantification assessment before the answer is generated, providing an interpretable and traceable decision-making basis for subsequent differentiated interventions without affecting reasoning efficiency.

[0054] As a further preferred option, in the aforementioned method, the specific rules for selecting the appropriate intervention mode based on the level of risk are as follows:

[0055] When the risk level is below the first threshold, i.e. the multimodal input to be processed is a low-risk input, the hold mode is selected;

[0056] When the risk level is between the first and second thresholds, i.e. the multimodal input to be processed is a medium-risk input, the weakening mode is selected.

[0057] When the risk level is higher than the second threshold, i.e. the multimodal input to be processed is a high-risk input, the strong suppression mode is selected.

[0058] In the above technical solution, based on the core idea of ​​intervening when the risk exceeds the limit, two preset thresholds are introduced to map the continuous risk score into three discrete intervention modes, thus constructing a complete decision chain of risk perception, intensity classification, and mode selection. Both thresholds can be flexibly calibrated according to the security requirements and capability preservation requirements of the specific deployment scenario, realizing a three-level jump-type dynamic adaptation of the intervention intensity and solving the dilemma of dealing with all inputs with a single fixed intensity.

[0059] As a further preferred embodiment, in the aforementioned method, the execution steps for editing the internal activation of key components based on a determined intervention pattern are as follows:

[0060] When the multimodal input to be processed is determined to be a low-risk input, the intervention mode is the hold mode, and the internal activation of key components is not modified.

[0061] When the multimodal input to be processed is determined to be a medium-risk input, the intervention mode is the weakening mode, which weakens the projection components of the key component activation in the harmful binding subspace according to the first intervention intensity.

[0062] When the multimodal input to be processed is identified as a high-risk input, the intervention mode is a strong suppression mode, and the projection components are further weakened according to a second intervention intensity higher than the first intervention intensity.

[0063] The internal activation of the editable key components only takes effect during the current inference process and does not modify the original parameters of the multimodal large language model.

[0064] The hierarchical editing strategies under the three intervention modes described above form a complete strength spectrum from zero to strong. More importantly, all editing is completed within the activation space of the current forward inference, without backpropagating any gradients or updates to the original model weights. The edited activations merely replace the original activations in subsequent calculations of the current input, and the editing effect automatically disappears after inference, providing on-demand start / stop capability in security protection. This design solves the problems of high deployment costs, complex maintenance, and irreversibility of parameter update schemes, making this invention highly flexible and maintainable in practical deployment.

[0065] Based on a second key aspect of the present invention, a multimodal learning secure forgetting system based on harmful cross-modal binding and decoupling is provided for implementing the aforementioned method, comprising:

[0066] The sample preparation module is used to obtain the forgotten sample set, the retained sample set, and the hint decoupling sample set;

[0067] The attribution localization module is used to input various samples into the multimodal large language model with frozen parameters to perform forward computation, record the internal activation corresponding to the candidate components, and replace the localization key components by counterfactual activation.

[0068] The subspace decoupling module is used to construct a harmful binding subspace, extract the normal capability representation direction using the retained sample set and the cue decoupling sample set, and perform orthogonalization processing on the harmful binding subspace;

[0069] The risk estimation module is used to receive multimodal inputs to be processed, read the internal activation of each key component during the encoding stage, determine the risk level of the inputs to be processed, and select the corresponding intervention mode.

[0070] The editing module is used to edit the activation of key components according to the risk level, suppress the projection component of internal activation on the harmful binding subspace, and write the edited activation back to the current forward computation.

[0071] The output generation module is used to perform subsequent calculations based on the edited activation-controlled multimodal large language model and output the results.

[0072] According to a third key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0073] The memory stores a computer program that, when executed by the processor, causes the processor to perform the aforementioned multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling.

[0074] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon that, when executed, implements the aforementioned multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling.

[0075] Compared with existing technologies, this invention provides a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling. First, this invention, through a multi-counterfactual causal attribution mechanism, precisely narrows the intervention target from coarse-grained visual concepts or overall harmfulness to the core pathological level of harmful cross-modal binding. This allows the model to effectively suppress the generation of executable harmful content and reduce security risks when faced with combined inputs of harmful images and malicious text. Simultaneously, since the intervention target is not the visual concept itself, the model's rejection rate for safe inputs is effectively controlled, avoiding the overprotective phenomenon of excessive rejection in pursuit of safety in traditional methods.

[0076] Secondly, regarding capability preservation, this invention employs a redemption-style subspace decoupling mechanism to orthogonally separate harmful binding representations from normal capability representations within selected key components, ensuring that the suppression of the former does not affect the normal function of the latter. After the model completes safe forgetting, its visual perception ability, factual knowledge memory, and general reasoning ability are all preserved to the greatest extent, achieving the intervention goal of forgetting what should be forgotten and preserving what should be preserved. This mechanism fundamentally resolves the dilemma between safety enhancement and capability decline in existing methods.

[0077] Finally, in terms of engineering deployment, this invention adopts a reasoning-based representation editing strategy, where all interventions only take effect during the forward computation process, without modifying the original model weights. It supports on-demand start / stop or zero-cost rollback, giving the security protection module extremely high flexibility and maintainability. Simultaneously, the conditional adaptive routing mechanism allows the intervention intensity to be dynamically adjusted according to the input risk level, avoiding unnecessary interference on low-risk samples and insufficient intervention on high-risk samples caused by fixed-intensity interventions, thus achieving overall optimization of security protection effectiveness. Attached Figure Description

[0078] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0079] Figure 1 The following is an execution flowchart of a multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling, according to an embodiment of the present invention.

[0080] Figure 2 The diagram illustrates the overall architecture of a multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling, according to one embodiment of the present invention. Detailed Implementation

[0081] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0082] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0083] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0084] The specific meanings of the technical terms or English abbreviations that may be used in this invention are explained as follows:

[0085] Multimodal large language model: A large-scale artificial intelligence model that can process and understand information from multiple modalities simultaneously.

[0086] Safe forgetting: In multimodal large language models, this is a behavioral intervention technique that selectively suppresses representation paths related to harmful generation within the model, so that the model no longer produces executable harmful content output when faced with harmful input, while preserving the model's normal visual perception, knowledge answering, and reasoning abilities.

[0087] Combination Figure 1 As shown, this invention proposes a safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling, comprising the following steps:

[0088] S100, acquire the forgotten sample set, the retained sample set, and the prompt decoupling sample set; the forgotten sample set includes the original input, textual intent counterfactual input, and visual evidence counterfactual input;

[0089] S200: Forgotten samples are input into the multimodal large language model with frozen parameters to perform forward computation, obtain the internal activation of candidate components, and calculate the safety margin based on the log probability difference between safe and harmful responses under the original input.

[0090] S300, for each candidate component, in the forward computation of the original input, the original activation of the candidate component is replaced with the activation corresponding to the counterfactual input of the text intent and the activation corresponding to the counterfactual input of the visual evidence, respectively, the safety margin is recalculated, and key components are selected based on the amount of change in the safety margin and the degree of impairment to normal capabilities.

[0091] S400: Based on the attribution categories of key components, calculate the difference between the activation corresponding to the original input and the activation corresponding to the counterfactual input, perform low-rank decomposition on the activation difference to construct a harmful binding subspace; utilize the ability to construct a subspace using the reserved sample set and the cue decoupling sample set, and perform orthogonalization processing on the harmful binding subspace;

[0092] S500 receives the multimodal input to be processed, reads the internal activations generated by each key component during the prompting encoding stage, calculates the response intensity of the internal activations in the harmful binding subspace, and determines the intervention mode.

[0093] S600 edits the internal activation of key components based on a defined intervention mode, suppresses the projection components of internal activation on harmful binding subspaces, writes the edited internal activation of key components back to the current forward computation process, and outputs the results.

[0094] To achieve the above methods, this invention provides a causal redemption framework for reasoning-time in multimodal secure forgetting, such as... Figure 2 As shown, it mainly includes three sequentially connected steps.

[0095] First, by comparing the impact of changes in textual intent, visual evidence, and cross-modal bindings on the safety margin through multiple counterfactual causal attribution methods, key components closely related to harmful generation are selected.

[0096] Subsequently, the redemption subspace decouples harmful binding directions from normal capability directions in these components. By suppressing harmful bindings and injecting redemption directions, the impact of intervention on visual understanding and general reasoning capabilities is reduced.

[0097] Finally, the conditional adaptive intervention route is prompted to dynamically select the maintain, weakly suppress, or strongly suppress mode based on the response strength of the input on different risk dimensions.

[0098] Thus, the framework transforms fixed, global security editing into selective interventions oriented towards input risks.

[0099] Step S100 is described in one of the following feasible embodiments.

[0100] First, prepare three core sample sets: the forgotten sample set, the retained sample set, and the cue decoupling sample set. The forgotten sample set includes image-text samples that can induce the base model to generate harmful answers.

[0101] The retained sample set includes normal visual recognition, knowledge answering, and reasoning task samples, used to measure the impact of the intervention process on the model's normal capabilities.

[0102] The decoupling sample set includes image-text samples with similar visual content but harmless textual intent, or similar textual form but harmless visual content, used to assess the degree of harm caused by the intervention to harmless image-text combinations.

[0103] The three types of sample sets together form the data foundation for subsequent attribution localization, subspace decoupling, and route calibration.

[0104] Multimodal harmful responses are typically not triggered independently by a single image or text, but rather by a conditional combination of both within the model. Therefore, relying solely on the original activation localization components of harmful samples can easily confuse visual recognition capabilities with harmful manipulation capabilities.

[0105] For each original input in the forgotten sample set ,in, Represents an image. The text prompts are used to construct two types of counterfactual input samples to separate the contributions of textual intent and visual evidence to harmful generation.

[0106] The first category is counterfactual textual input. ,in Represents an image. The sample represents harmless text prompts. It retains the original image and replaces text prompts with operational or harmful intentions with harmless text prompts, thereby eliminating the influence of harmful intention factors on the harmful generation process of multimodal large language models while keeping visual evidence unchanged.

[0107] The second category is visual evidence counterfactual input. ,in Indicates harmless visual content. The sample retains the original text prompts but replaces risk-related visual content with harmless visual content, thereby eliminating the influence of visual evidence on harmful generation while maintaining the textual intent.

[0108] By employing the methods described above, the influence of textual intent factors and visual evidence factors on the harmful generation process of the model can be eliminated.

[0109] Step S200 is described in one of the following feasible embodiments.

[0110] The original input, textual intent counterfactual input, and visual evidence counterfactual input prepared in the previous step are respectively input into the multimodal large language model with frozen parameters to perform forward computation.

[0111] In this embodiment, a multimodal large language model with image and text joint processing capabilities is used as the base model. The base model includes a visual encoding module, a cross-modal projection module, and a language model. The original parameters of the base model remain unchanged during implementation.

[0112] During the forward computation, the internal activation of each candidate component under each type of input is recorded. These activation values ​​constitute the basic data unit for subsequent causal attribution analysis, which is used to measure the difference in the activation state of the same component under different input conditions.

[0113] Candidate components are localizable modular units within a multimodal large language model, including layers in the visual encoder, cross-modal projection layers, and attention layers or feedforward network layers in the language model. During the forward computation, all candidate components need to be traversed and their corresponding internal activations recorded to provide a data basis for evaluating the contribution of each candidate component to harmful generation in the next step.

[0114] While acquiring activations from various input samples, the original secure generation state of the multimodal large language model under the original input is calculated.

[0115] Specifically, the safety margin is defined as the difference between the log probability of a multimodal large language model generating a safe response and the log probability of generating a harmful response given an input, and its mathematical expression is:

[0116] ;

[0117] in, This represents the safety margin of the model given the original input; Indicates the original input; Indicates a safety response; Indicates a harmful response; This represents conditional probability.

[0118] A smaller safety margin indicates that the current input is more likely to activate harmful generation paths within the multimodal large language model, resulting in a higher security risk. Conversely, a larger safety margin indicates that the multimodal large language model is more inclined to generate a safe response under the current input.

[0119] Step S300 is described in one of the following feasible embodiments.

[0120] Based on the activation values ​​of each candidate component and the baseline safety margin, the contribution of each candidate component to harmful generation is evaluated one by one through counterfactual activation replacement.

[0121] For each candidate component, during the forward computation of the original input, the original activation of the candidate component is replaced with the activation corresponding to the textual intent counterfactual input and the activation corresponding to the visual evidence counterfactual input, respectively, while the rest of the multimodal large language model remains unchanged.

[0122] After the activation replacement is completed, the secure generation state of the multimodal large language model is recalculated.

[0123] To quantify the contribution of each candidate component to harmful generation, an intervention contribution is defined to measure the change in the safety margin caused by counterfactual activation replacement.

[0124] Given candidate components and counterfactual types ,in, The text indicates that the intention is contrary to fact; This indicates counterfactual input of visual evidence.

[0125] The intervention contribution of a component is defined as:

[0126] ;

[0127] in, This represents the intervention contribution value of the candidate component; Indicates candidate components; This represents the formula for calculating the safety margin. Indicates the original input; This indicates that the key component is initially activated internally under the current input; This represents a counterfactual input sample; This indicates a counterfactual input type.

[0128] When the intervention contribution value is greater than zero, it indicates that after the original activation of the component is replaced with counterfactual activation, the safety margin of the multimodal large language model is improved. That is, the activation of the component in the original state has a positive effect on promoting harmful generation and has an intervention response to the corresponding risk factors.

[0129] The larger the intervention contribution value, the stronger the correlation between the component and harmful generation, and the more it should be selected as an intervention target.

[0130] To avoid selecting components with normal capabilities, this invention further considers the degree of impairment to normal capabilities. It uses a reserved sample set and a hint decoupling sample set to verify candidate components, excluding components that would significantly impair normal visual recognition, knowledge answering, or reasoning capabilities, thus obtaining a set of key components.

[0131] After replacing the candidate component activations with the activations corresponding to the retained sample set, the extent of the decline in the multimodal large language model's capabilities on normal visual recognition, knowledge answering, and reasoning tasks, as well as the degree of false negatives on the cue decoupling sample set, are evaluated.

[0132] The comprehensive screening score for candidate components is defined as follows:

[0133] ;

[0134] in, This indicates the screening score for candidate components; Indicates candidate components; This represents the intervention contribution value of the candidate component; Indicates the counterfactual input type; Weighting coefficients representing impairment of regulatory capacity This indicates the weighting coefficient of the decoupling term used for adjustment. This indicates the impairment of capabilities caused by replacing the activation with the retained sample set; This indicates the damage caused by decoupling the sample set;

[0135] The set of key components is selected based on the comprehensive screening score of the candidate components. Candidate components with a comprehensive screening score higher than the threshold are selected as key components.

[0136] Attribution categories are determined based on the response patterns of candidate components to two types of counterfactual events.

[0137] If a component primarily responds to textual intent counterfactuals, it is marked as a textual intent-related component; if it primarily responds to visual evidence counterfactuals, it is marked as a visual evidence-related component; if both types of counterfactuals significantly alter the safety margin and have similar responses, it is considered a cross-modal binding component.

[0138] Specifically:

[0139] Text intent related components: ; ;

[0140] Components related to visual evidence: ; ;

[0141] Cross-modal binding components: ;

[0142] in, This represents the change in the safety margin resulting from the substitution of counterfactual samples representing textual intent. This represents the amount of change in the safety margin resulting from the substitution of counterfactual inputs with visual evidence; Indicates the significance threshold of the response; The tolerance threshold that represents the degree of similarity between two types of responses.

[0143] This criterion is not a strict two-factor causal interaction estimate, but rather an operational characterization of the binding sensitivity of internal components: only when changing the textual intent or visual evidence can significantly weaken the harmful generation supported by the same component can it be considered as a candidate component for cross-modal binding paths.

[0144] Step S400 is described in one of the following feasible embodiments.

[0145] Component location answers where to intervene, but directly deleting or blocking the entire component may still disrupt the normal capabilities it carries.

[0146] To this end, the present invention further distinguishes between harmful binding characteristics and capability preservation characteristics within the selected components.

[0147] First, for each key component in the set of key components, construct activation differences for category matching based on the attribution category.

[0148] For text intent-related components, activation differences between the original input and the counterfactual text intent input are used; for visual evidence-related components, activation differences between the original input and the counterfactual visual evidence input are used; for cross-modal binding-related components, both types of activation differences are used in combination.

[0149] Specifically as follows:

[0150] ;

[0151] in, This indicates the activation differences of key components under attribution categories; Indicates the attribution category; Indicates key components; This indicates that the key component is internally activated under the original input; This indicates the internal activation of key components under counterfactual textual intent input; This indicates the internal activation of key components under the influence of counterfactual visual evidence input; Components that represent text intent; Indicates components related to visual evidence; This indicates that the components are bound to each other across modalities.

[0152] The activation differences are decomposed into low-rank values ​​to extract the main representation directions associated with harmful generation, forming the harmful binding subspace corresponding to this key component:

[0153] ;

[0154] in, Indicates a harmful bound subspace; Indicates key components; Indicates the attribution category; This represents the low-rank decomposition operator; This indicates the activation differences of key components under attribution categories.

[0155] Meanwhile, this invention utilizes the activation construction capability of the retained set and the cue decoupling set to maintain the basis, and estimates the redemption direction based on the activation difference corresponding to the safe response and the harmful response.

[0156] To reduce the overlap between the harmful subspace and the normal capability subspace, the harmful binding basis is orthogonalized:

[0157] ;

[0158] in, This represents the orthogonalized harmful binding subspace; Indicates a harmful bound subspace; Indicates key components; Indicates the attribution category; Indicates the ability to maintain the baseline; Represents the orthogonal projection operator; This indicates the orthogonal operator.

[0159] Step S500 is described in one of the following feasible embodiments.

[0160] Fixed-intensity interventions struggle to simultaneously prevent security breaches and excessive forgetting. Therefore, this invention determines the intervention mode based on the internal response during the prompting phase before answer generation. The router only reads activation and lightweight text features from the encoding phase, without reading the final answer or relying on online security reviews.

[0161] After completing the construction and orthogonalization of the harmful binding subspace, the system enters the inference application stage, accepts actual multimodal inputs to be processed, and performs real-time assessment of their risk level.

[0162] Unlike the offline positioning phase, this step no longer constructs counterfactual inputs or performs activation replacement operations. Instead, during the prompting encoding phase of the original forward computation, it directly reads the internal activations generated by key components under the current input and calculates the response strength of activations on different risk dimensions based on the harmful binding subspace.

[0163] Specifically, the first step is to statistically analyze the response strength of the three types of risks introduced under the current input:

[0164] ;

[0165] in, Indicates the response intensity; This represents the multimodal input to be processed, which includes images and text prompts; Indicates attribution category as A collection of key components; Indicates the attribution category; Indicates key components; Indicates a harmful bound subspace; This indicates that the key component is internally activated under the current input; This represents the orthogonal projection operator onto the harmful binding subspace.

[0166] Subsequently, textual intent, visual evidence, and cross-modal binding responses are combined with cue features and fused together:

[0167] ;

[0168] in, Represents a risk feature vector; This represents the multimodal input to be processed; This indicates the intensity of the text intent response under the current multimodal input; This indicates the intensity of the visual evidence response under the current multimodal input; This indicates the cross-modal binding response strength under the current multimodal input; Lightweight features representing text prompts for multimodal input; Text prompts indicating multimodal input.

[0169] Then calculate the input risk:

[0170] ;

[0171] in, Indicates the risk level of multimodal input; This represents the multimodal input to be processed; This represents the Sigmoid activation function; Represents the weight vector; This represents the transpose of the weight vector; Represents a risk feature vector; This indicates the bias term.

[0172] Finally, based on the comparison between the risk score and the preset threshold, the intervention mode corresponding to the current multimodal input is automatically selected.

[0173] ;

[0174] in, Indicates the intervention mode; Indicates to maintain the mode; Indicates a weakened mode; Indicates a strong suppression mode; Indicates the risk level of multimodal input; Indicates a low-risk threshold; Indicates a high-risk threshold; This represents the multimodal input to be processed.

[0175] Preserve the original representation. Weaken harmful bindings, This further suppresses harmful bindings and injects a direction of redemption.

[0176] The low-risk threshold and the high-risk threshold can be determined based on the safety effect and normal capability maintenance effect on the validation samples.

[0177] Step S600 is described in one of the following feasible embodiments.

[0178] Based on determining the intervention mode and obtaining the inhibition strength parameters, the internal activation execution representation editing of each key component in the current forward calculation process is the core execution link for achieving selective forgetting of harmful bindings in this invention.

[0179] Unlike traditional parameter update or neuron masking methods, the representation editing of this invention only takes effect in the forward computation of the current input and does not modify the original weights of the multimodal large language model, thereby supporting flexible start-stop and zero-cost rollback.

[0180] For each key component, obtain the corresponding harmful binding base and capability preservation base according to the attribution category, and edit the original activation according to the intervention mode:

[0181] ;

[0182] in, This indicates the new activation value of the key component after editing; This indicates that the key component is initially activated internally under the current input; Indicates key components; This indicates the intensity of harmful binding suppression, used to control the intensity of harmful binding projection suppression; This represents the orthogonal projection operator onto the harmful binding subspace; This indicates the injection strength in the redemption direction, and is used to control the injection strength in the redemption direction; Indicates the direction of redemption; Indicates the strength of capacity compensation, used to compensate for the capacity affected during the intervention process; This represents the orthogonal projection operator onto a subspace that preserves the span of capability.

[0183] The capability preservation term employs constrained residual recovery and norm calibration, without unconstrained amplification of the original capability projection. Therefore, redemption is not about making the multimodal large language model forget what it has seen, but rather about preventing the multimodal large language model from continuing to generate harmful operations based on what it has seen.

[0184] The three intervention modes correspond to different parameter configurations, maintaining the strength of harmful binding inhibition during the maintenance mode. Injecting strength in the direction of redemption Capacity compensation strength Without modifying the internal activation of key components;

[0185] In weakened mode, the strength of harmful binding suppression Take the first suppression strength, and inject strength in the direction of redemption. Capacity compensation strength Take a smaller compensation value, weaken the projection component of the critical component activation in the harmful binding subspace, and do not inject a redemption direction.

[0186] In strong suppression mode, the intensity of harmful binding suppression Take the second suppression strength, which is greater than the first suppression strength, and inject the strength in the redemption direction. To inject positive values ​​into the direction of redemption, and to compensate for the strength of the ability. A larger compensation value is taken to further weaken the projection components, resulting in a triple intervention synergy.

[0187] During the editing process, this invention limits the range of changes in activation after editing, keeping the new activation value within a preset range from the original activation value, and avoiding the impact on the normal capabilities of the multimodal large language model due to excessive changes in activation.

[0188] Finally, the edited key components are activated and written back to the current forward computation process, and the multimodal large language model continues to perform subsequent layer computations and autoregressive decoding to obtain the final answer.

[0189] The above-mentioned activation editing only takes effect during the forward inference process of the current input and does not modify the original weights of the base model. After closing the representation editing module, the multimodal large language model returns to its original running state.

[0190] In one feasible embodiment, the method provided by the present invention is tested.

[0191] To verify the effectiveness of the method of the present invention, the experimental part of this embodiment conducts a systematic evaluation on a multimodal safe forgetting benchmark. This benchmark contains 3,000 images and 28.8K visual question-and-answer samples, consisting of a forgetting set, a retention set, and a cue-decoupled set, which are used to evaluate harmful knowledge forgetting, normal ability retention, and cue-induced excessive forgetting, respectively.

[0192] The experiment used LLaVA-1.5-7B and Qwen2-VL-7B-Instruct as base models, and the comparison methods included the unedited model, gradient ascent (GA), KL-constrained forgetting, SafeEraser, MIP-Editor, and SSD Steering. Here, GA and KL represent direct forgetting and capability preservation constraint methods, respectively; SafeEraser and MIP-Editor represent multimodal safe forgetting and internal path editing methods, respectively; and SSD Steering serves as the representation space intervention baseline.

[0193] Security is measured by attack success rate, including All ASR, Forgot ASR, and PD ASR. The lower the value, the better the security. Capability retention is measured by Retain Utility and All Utility. The higher the value, the more fully the capability is retained.

[0194] All responses are evaluated by a unified structured GPT evaluator, which outputs harmful executability, rejection status, and utility score.

[0195] The main experimental results show that the present invention achieves a superior balance between security and capability preservation compared to all comparative methods. On LLaVA-1.5-7B, the present invention reduces the percentage of all attack samples from the unedited model from 31.15% to 8.45%, and reduces the success rate of cue decoupling set attacks to 7.36%, while maintaining the retainer set utility at 86.44%, close to the 86.88% of the unedited model. In contrast, while GA and SafeEraser also reduce the attack success rate, their retainer set utility both decrease to approximately 20%. This indicates that the security gain of the present invention does not primarily come from the overall suppression of the model's normal capabilities.

[0196] On Qwen2-VL-7B-Instruct, this invention also reduced the success rate of attacks on all samples from 21.83% to 11.53%, and the success rate of attacks on the cue decoupling set from 11.83% to 8.76%; Retain Utility only decreased slightly from 86.60% to 84.35%, while the retain set utility increased from 70.35% to 71.12%. The two base models show a consistent trend: this invention can suppress harmful generation while better preserving normal visual capabilities, and achieves a more balanced result between PD risk control and capability preservation.

[0197] In terms of out-of-distribution generalization and robustness, the experiment was supplemented with evaluations on three benchmarks: MM-SafetyBench, FigStep, and MME.

[0198] On MM-SafetyBench, this invention reduced the attack success rate from 34.4% to 9.2%, indicating that the security intervention can be transferred to unseen distributions. On FigStep, the attack success rate decreased from 46.7% to 40.0%, showing that this invention also has a certain inhibitory effect on visual jailbreak attacks. On MME, the retention rates of perception, cognition, and overall capabilities were 83.1%, 95.2%, and 85.2%, respectively, indicating that the model still maintains good general multimodal capabilities after intervention. These results collectively demonstrate that this invention has certain cross-benchmark applicability in terms of cross-modal security, visual jailbreak defense, and general capability preservation.

[0199] Module analysis experiments further validated the effectiveness of each core component. In the ablation experiment of the multi-counterfactual attribution localization module, compared with the general harmful-safe orientation and random component replacement, the present invention reduced the success rate of attacks on all samples, the success rate of attacks on forgotten set samples, and the success rate of attacks on cue decoupling sets from 29.17%, 59.28%, and 27.95% to 8.19%, 13.57%, and 9.06%, respectively, while maintaining a retention set utility of 86.45%. This indicates that multi-counterfactual attribution can more accurately locate key components related to harmful cross-modal binding, providing a basis for subsequent selective intervention.

[0200] In the analysis of the redemption-style subspace decoupling module, four settings were compared: textual intent counterfactual, visual evidence counterfactual, average fusion, and category perception. The category perception setting achieved the most balanced result between risk control of the cue decoupling set and preservation of normal capabilities, with a preservation set utility of 86.78% while maintaining 66.67% of the total sample utility.

[0201] In the analysis of the conditional adaptive routing module, four configurations were compared: removing PD-aware redemption (without PD), using only rule-based routing, using only capability protection policies, and the complete invention. Compared with the configuration of removing the conditional decoupling conditional redemption, the complete invention further reduced the success rate of attacks on all samples and the success rate of attacks on the conditional decoupling set, while increasing the utility of all samples from 58.69% to 59.53%. This indicates that the conditional features help identify boundary inputs and coordinate harmful generation suppression, boundary risk control, and normal capability maintenance.

[0202] Further analysis, including statistical stability analysis, analysis of different risk categories, and routing pattern analysis, using the Bootstrap method to estimate 95% confidence intervals, showed that the success rate of all samples and the success rate of hint decoupling set attacks were 8.45% and 7.36%, respectively, with the upper bound of their confidence intervals both below 10%. The intervals for each indicator are concentrated near the point estimate, indicating that the security-utility conclusions of this invention are relatively stable with sample resampling.

[0203] Analysis of six categories of harmful content, including HateSpeech, IllegalActivity, Privacy, Sex, Violence, and Weapon, shows that the retention set utility for each category exceeds 82%, indicating that capability retention is not driven by a few categories. The differences in security effectiveness mainly come from the processing boundaries of different risk types. Among them, the privacy category has a relatively high attack success rate under both types of inputs and is the main source of the differences between categories.

[0204] Routing analysis shows that the maintain mode covers 54.28% of the inputs and achieves the highest overall sample utility (78.51%), while the weakened mode covers 42.26% of the samples and has the lowest attack success rate (4.09%), constituting the main risk suppression branch. The strong suppression mode only processes 3.46% of the samples. The three modes form different security-utility operating points, indicating that the overall balance of this invention comes from the allocation of input-level interventions, rather than applying the same intensity of editing to all samples.

[0205] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0206] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A safe forgetting method for multimodal continuous learning based on harmful cross-modal binding and decoupling, characterized in that, Includes the following steps: Obtain a forgotten sample set, a retained sample set, and a cue decoupling sample set; the forgotten sample set includes the original input, textual intent counterfactual input, and visual evidence counterfactual input. Forgotten samples are input into a multimodal large language model with frozen parameters to perform forward computation, obtain the internal activation of candidate components, and calculate the safety margin based on the log probability difference between safe and harmful responses under the original input. For each candidate component, in the forward computation of the original input, the original activation of the candidate component is replaced with the activation corresponding to the text intention counterfactual input and the activation corresponding to the visual evidence counterfactual input, respectively. The safety margin is recalculated, and key components are selected based on the amount of change in the safety margin and the degree of impairment to normal capabilities. Based on the attribution categories of key components, the difference between the activation corresponding to the original input and the activation corresponding to the counterfactual input is calculated, and the activation difference is decomposed into a low-rank subspace to construct a harmful binding subspace. The ability to construct a subspace by utilizing the reserved sample set and the cue decoupling sample set is used to preserve the subspace, and the harmful binding subspace is orthogonalized. Receive the multimodal input to be processed, read the internal activations generated by each key component during the prompting encoding stage, calculate the response strength of the internal activations in the harmful binding subspace, and determine the intervention mode; The internal activation of critical components is edited based on a defined intervention mode, the projection component of the internal activation on the harmful binding subspace is suppressed, the edited internal activation of the critical components is written back to the current forward computation process and the result is output.

2. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 1, characterized in that, The original input includes an image and a corresponding text prompt; the text intent counterfactual input retains the original image and replaces the harmful text prompt with a harmless text prompt; the visual evidence counterfactual input retains the original text prompt and replaces the harmful visual content with harmless visual content. The retained sample set includes samples from normal visual recognition, knowledge question answering, and reasoning tasks; the prompt decoupling sample set includes image-text samples with similar visual content but harmless textual intent, or similar textual forms but harmless visual content. The formula for calculating the safety margin is as follows: ； in, This represents the safety margin of the model given the original input; Indicates the original input; Indicates a safety response; Indicates a harmful response; This represents conditional probability.

3. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 1, characterized in that, The steps for screening key components based on changes in the safety margin and the degree of impairment to normal capabilities are as follows: Calculate the intervention contribution value of each candidate component, where the intervention contribution value represents the change in the safety margin after replacing the candidate component with the corresponding counterfactual activation. The calculation formula is as follows: ； in, This represents the intervention contribution value of the candidate component; Indicates candidate components; This represents the formula for calculating the safety margin. Indicates the original input; This indicates the activation of the candidate component under the original input; This represents a counterfactual input sample; This indicates the counterfactual input type, which includes textual intent counterfactual input and visual evidence counterfactual input. Then, based on the intervention contribution value and the damage item, the screening score for each candidate component is calculated: ； in, This indicates the screening score for candidate components; Indicates candidate components; This represents the intervention contribution value of the candidate component; Indicates the counterfactual input type; Weighting coefficients representing impairment of regulatory capacity This indicates the weighting coefficient of the decoupling term used for adjustment. This indicates the impairment of capability caused by replacing the activation with the retained sample set; This indicates the damage caused by decoupling the sample set; Candidate components whose screening scores are higher than a preset threshold are identified as key components.

4. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 1, characterized in that, The attribution categories of the key components include text intent-related components, visual evidence-related components, and cross-modal binding components; The specific method for determining the attribution category is as follows: When the change in the safety margin caused by the counterfactual input replacement of text intent is greater than the response salience threshold and the change in the safety margin caused by the counterfactual input replacement of visual evidence is not greater than the response salience threshold, it is determined to be a text intent-related component; When the change in the safety margin caused by the counterfactual input replacement of visual evidence is greater than the response salience threshold and the change in the safety margin caused by the counterfactual input replacement of textual intent is not greater than the response salience threshold, it is determined to be a visual evidence-related component. When the change in safety margin resulting from the replacement of two types of counterfactual input samples is greater than the response significance threshold and the absolute value of the two differences is less than the tolerance threshold, it is determined to be a cross-modal binding component. For text intent-related components, the harmful binding subspace is constructed based on the activation difference between the original input and the counterfactual text intent input; For visual evidence-related components, the harmful binding subspace is constructed based on the activation difference between the original input and the counterfactual input of visual evidence; For cross-modal binding-related components, the harmful binding subspace is constructed using two types of activation differences. When orthogonalizing the harmful binding subspace, the normal capability representation direction is extracted using the retained sample set and the cue decoupling sample set, and the part of the harmful binding subspace that overlaps with the normal capability representation direction is removed.

5. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 1, characterized in that, The steps for calculating the response intensity of internal activation in the harmful binding subspace and determining the intervention mode are as follows: It receives images and text prompts from multimodal input and completes visual encoding and text prompt encoding through a multimodal large language model; Read the internal activations generated by key components during the prompting encoding phase, and calculate the response strength of these internal activations in the harmful binding subspace, as shown below: ； in, Indicates the response intensity; This represents the multimodal input to be processed, which includes images and text prompts; Indicates attribution category as A collection of key components; Indicates the attribution category; Indicates key components; Indicates a harmful bound subspace; This indicates that the key component is internally activated under the current input; This represents the orthogonal projection operator onto the harmful binding subspace; The risk level of the multimodal input is then calculated based on the response intensity. ； in, Indicates the risk level of multimodal input; This represents the multimodal input to be processed; This represents the Sigmoid activation function; Represents the weight vector; This represents the transpose of the weight vector; Represents a risk feature vector; Indicates the bias term; Finally, the appropriate intervention model is selected based on the level of risk.

6. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 5, characterized in that, The specific rules for selecting the appropriate intervention mode based on the level of risk are as follows: When the risk level is below the first threshold, i.e. the multimodal input to be processed is a low-risk input, the hold mode is selected; When the risk level is between the first and second thresholds, i.e. the multimodal input to be processed is a medium-risk input, the weakening mode is selected; When the risk level is higher than the second threshold, i.e. the multimodal input to be processed is a high-risk input, the strong suppression mode is selected.

7. The multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling according to claim 1, characterized in that, The execution steps for internal activation of key components based on a defined intervention pattern are as follows: When the multimodal input to be processed is determined to be a low-risk input, the intervention mode is the hold mode, and the internal activation of key components is not modified. When the multimodal input to be processed is determined to be a medium-risk input, the intervention mode is the weakening mode, which weakens the projection components of the key component activation in the harmful binding subspace according to the first intervention intensity. When the multimodal input to be processed is identified as a high-risk input, the intervention mode is a strong suppression mode, and the projection components are further weakened according to a second intervention intensity higher than the first intervention intensity. The internal activation of the editable key components only takes effect during the current inference process and does not modify the original parameters of the multimodal large language model.

8. A multimodal learning secure forgetting system based on harmful cross-modal binding and decoupling for implementing the method of any one of claims 1 to 7, characterized in that, include: The sample preparation module is used to obtain the forgotten sample set, the retained sample set, and the hint decoupling sample set; The attribution localization module is used to input various samples into the multimodal large language model with frozen parameters to perform forward computation, record the internal activation corresponding to the candidate components, and replace the localization key components by counterfactual activation. The subspace decoupling module is used to construct a harmful binding subspace, extract the normal capability representation direction using the retained sample set and the cue decoupling sample set, and perform orthogonalization processing on the harmful binding subspace; The risk estimation module is used to receive multimodal inputs to be processed, read the internal activation of each key component during the encoding stage, determine the risk level of the inputs to be processed, and select the corresponding intervention mode. The editing module is used to edit the activation of key components according to the risk level, suppress the projection component of internal activation on the harmful binding subspace, and write the edited activation back to the current forward computation. The output generation module is used to perform subsequent calculations based on the edited activation-controlled multimodal large language model and output the results.

9. An electronic device, comprising: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. The feature is that the memory stores a computer program, which, when executed by the processor, causes the processor to execute the multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the multimodal continuous learning secure forgetting method based on harmful cross-modal binding and decoupling as described in any one of claims 1-7.

Images