Artificial intelligence-based large model integrity security checking system

Abstract

The application relates to the technical field of artificial intelligence model verification, in particular to a large model integrity security verification system based on artificial intelligence. The system comprises a model analysis processor, an evidence constructor, a challenge back-checker and an association verifier. The model analysis processor analyzes a large model parameter tensor, references and interlayer calculation relations, and divides a parameter causal domain according to a parameter change corresponding boundary; the evidence constructor generates a hierarchical commitment covering parameters, arrangement, subspace and cross-layer coupling, and generates a constraint in combination with an authorized conversion parameter mapping; the challenge back-checker generates directional challenge data based on an abstract and a random quantity, and collects a feature fingerprint of a binding commitment; and the association verifier compares a reference and to-be-verified evidence, and carries out causal domain subdivision, parameter mapping and reference relation verification. The system can distinguish between authorized conversion and parameter anomaly, locate an abnormal parameter range, and verify the consistency of parameter structure, loading relation and function state.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence model verification technology, specifically to a large-scale model integrity and security verification system based on artificial intelligence. Background Technology

[0002] Large models typically consist of a loadable model package comprised of parameter files, configuration files, segmented data, computation graph description files, and fragment index files. Current integrity checks primarily involve calculating hash values ​​or generating digital signatures for each file at the model deployment end, and writing the hash values, file lengths, version numbers, and fragment order into a list. At the model deployment end, before downloading, copying, or loading, the hash values ​​of the corresponding files are recalculated and compared item by item with the baseline values ​​in the list. If all hashes match, the loading process is allowed; if any file is inconsistent, the process is blocked or the model package is re-acquired. For models with a large number of parameters, parameter files are often divided into fixed-length data blocks, each forming a leaf node digest, which is then aggregated hierarchically into a tree root digest for local verification of changed data blocks. Some solutions also check parameter names, tensor dimensions, data types, and file offsets during the loading phase to confirm that parameter tensors can be written into the computation framework in the order specified in the configuration file. These solutions rely on unchanged byte content as the basis for judgment, making them suitable for detecting transmission corruption, file replacement, and unauthorized writes. However, the hash results only reflect whether the stored data is identical, not the parameter's reference position in the computation graph, inter-layer relationships, or functional impact. After a model undergoes quantization, pruning, fragment rearrangement, storage format conversion, or incremental merging of legal parameters, even if the model retains its intended function, the overall file content will change. The original benchmark summary can no longer be used as a direct comparison basis, and usually only a new benchmark list can be generated for the converted complete model.

[0003] Another existing approach incorporates model behavior verification in addition to static file verification. This involves pre-selecting several test inputs and recording output probabilities, generation results, and specific layer activation values ​​or statistical summaries of activation values ​​on a trusted model. After the verification model runs with the same inputs, the results are compared with the benchmark results. To reduce biases caused by differences in floating-point calculations, quantization precision, and inference frameworks, allowable error ranges, cosine similarity, order consistency, or sign distribution are often used as criteria. For intermediate representations, observation points can be set at several fixed layers, and the activation tensor can be reduced in dimensionality, randomly projected, or hashed to form a model fingerprint. Some implementations also store parameter block summaries alongside the behavior fingerprint; when the parameter summaries change, the model's functionality is assessed using test samples to determine if deviations have occurred. This approach can compensate for the inability of byte-level verification to characterize model functionality. However, the test inputs, observation layers, and projection methods are usually fixed before deployment, limiting coverage to the number of samples. Local parameter changes may only produce responses in specific channels, input directions, or inter-layer paths, and fixed test results may still fall within the allowable range. Parameter blocks are usually divided according to file location, which lacks a corresponding relationship with the influence propagation boundary in the computation graph. Even if an anomaly is found in a certain output or observation layer, it is difficult to determine the parameter range associated with the anomaly. If the number of test samples and observation layers is increased, more intermediate data needs to be saved and compared, and the computational load of repeated model inference and parameter scanning will increase.

[0004] The main technical problem that existing technologies need to solve is the lack of a complete technical mechanism to verify the structural changes in parameter content and organizational relationships and the intermediate representation responses caused by these changes in the computational graph under conditions of legitimate quantization, pruning, parameter rearrangement, and format conversion in large models. File-based or fixed-block summaries can only confirm whether stored data has changed, but cannot determine whether the change belongs to a registration conversion, nor can they establish a connection between the location of the change and the specific functional impact path. Behavioral verification based on fixed samples and fixed observation points can only reflect the differences in results under limited inputs, cannot prove that parameter regions without anomalies remain intact, nor can it limit the range of parameters to be verified from the response deviation. Because there are multi-level relationships between parameter tensors, tensor references, inter-layer computation, and loading mappings, when parameter content is partially replaced, parameter order is changed, tensor reference ports are misconnected, or incremental parameters are hidden, anomalies may spread along residual connections and attention maps, or they may only appear in the affected direction. A single summary or a single behavioral fingerprint cannot form a mutually corroborating basis for judgment. Therefore, how to use parameter functions to influence the boundary organization of verification objects, establish structural evidence that is compatible with authorization conversion, and use the directional functional response bound to the structural evidence to subdivide or expand the verification scope in reverse, and make a unified judgment on whether the parameter structure, loading relationship and functional state of the large model to be verified are consistent, is the core technical problem that needs to be solved in the existing large model integrity security verification technology. Summary of the Invention

[0005] The purpose of this invention is to provide a large model integrity security verification system based on artificial intelligence, which can solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A large model integrity security verification system based on artificial intelligence includes a model parsing processor, evidence constructor, challenge and verification unit, and correlation verifier. The model parsing processor parses the parameter tensors, reference relationships, and inter-layer computational relationships of the large model to be verified, and constructs the parameter causal domain according to the intermediate representation boundary that the parameter changes reach together; The evidence constructor generates a hierarchical commitment for each parameter causal domain, including parameter content, arrangement relationship, subspace direction and cross-layer coupling relationship, and generates transformation constraints according to the parameter mapping transformed by the authorized model. The challenge verification device generates targeted challenge data based on the model version root digest, session randomness, and sensitive direction of the parameter causal domain, collects the response of the intermediate representation boundary, and forms a functional response fingerprint bound to the hierarchical structure commitment. The correlation verifier compares the evidence to be verified with the benchmark evidence, and performs parameter causal domain subdivision, parameter mapping verification, or expands the verification range along the parameter tensor reference relationship based on the combined state of structural commitment deviation, functional response deviation, and transformation constraint.

[0007] Preferably, the model parsing processor sets the parameter tensor as the source node, and sets matrix operations, normalization operations, attention mapping, residual merging and tensor loading mapping as relation nodes, and records the reachable path from each parameter tensor to the candidate intermediate representation boundary along the computation graph; For parameter tensors pointing to the same candidate intermediate representation boundary, positive and negative perturbations generated by the block principal subspace direction of the corresponding parameter tensor are applied respectively. The channel support set and response direction of the boundary response are extracted. The parameter tensors are merged according to the earliest common convergence boundary, channel support coincidence relationship and path continuity relationship. The parameter tensors that cross the adjacent parameter causal domain and retain the response on both sides are registered as bridging tensors, forming a parameter influence map containing domain nodes, bridging tensors and boundary nodes.

[0008] Preferably, the evidence constructor sorts the parameter data according to the computation graph topology, tensor reference port and tensor coordinates, and divides the sorted parameter data into multiple leaf data blocks. For each leaf data block, the original content hash value and the order projection value formed by the projection sequence derived from the root digest of the model version are generated respectively. The principal subspace orientation of each leaf data block in the same parameter causal domain is extracted. The dimension alignment projection is performed on the principal subspace of the adjacent layer according to the edge of the computation graph to generate a cross-layer coupling description. The original content hash value, order projection value, principal subspace direction, cross-layer coupling description and corresponding graph edge identifier are aggregated layer by layer into a commitment tree, and the root node of the commitment tree is bound to the root summary of the model version.

[0009] Preferably, the challenge verification device generates challenge seeds based on the model version root digest, session randomness, and the sensitive direction of the causal domain of the parameter to be verified, selects basic samples from a preset set of valid input samples, and generates multiple candidate perturbations in the input representation space of the basic samples. Calculate the response projection of each candidate perturbation on the boundary of the target parameter causal domain and the boundary of the non-target parameter causal domain, and select candidate perturbations whose response projection increment in the target parameter causal domain is positive and whose response projection increment in the non-target parameter causal domain is non-positive to form the directional challenge data; The intermediate representations generated by the directional challenge data at the target boundary, upstream adjacent boundary, and downstream adjacent boundary are randomly projected, ordered, and symbolically encoded to form a functional response fingerprint that is bound to the corresponding node identifier of the hierarchical structure commitment.

[0010] Preferably, when the correlation validator performs subdivision verification within the parameter causal domain, it takes the direction of functional response deviation as the starting point for reverse tracing, identifies the final commitment node with structural deviation in the hierarchical structure commitment as the structural deviation blade, and retains the propagation path connecting the parameter tensor corresponding to the structural deviation blade and the intermediate representation boundary of the anomaly in the parameter influence diagram. The graph splitting position is determined according to the relationship between the number of bridging tensors, the distribution of structural deviation blades, and the direction of boundary response in the propagation path, and the original parameter causal domain is divided into at least two sub-causal domains. Subdomain challenge data are regenerated according to the sensitive direction of each sub-causal domain, and the subdomain functional response fingerprint is correlated and compared with the hierarchical structure commitment of the corresponding subdomain until the structural deviation blade and the functional response deviation converge to the same minimum parameter subdomain.

[0011] Preferably, the evidence constructor establishes a transformation description record for the authorized model transformation, the transformation description record including the mapping between the source tensor coordinates and the target tensor coordinates, the quantization scale and zero point, the pruning mask, the parameter rearrangement order and the transformation residual basis; When verifying the large model to be verified after authorized transformation, the target parameters are mapped to the normal coordinates of the source model according to the transformation description record, the subspace decomposition of the mapped parameter difference is performed based on the transformation residual basis, and transformation invariant commitments and allowed residual commitments are generated respectively. The transformation invariant commitment, the allowed residual commitment, and the summary of the transformation description record are written into the corresponding node of the commitment tree, and bound together with the root summary of the model version before and after the authorized transformation, thereby forming the transformation constraint.

[0012] Preferably, the challenge verification device generates a target incentive challenge and an orthogonal comparison challenge using the same base sample. The input representation of the perturbation direction of the target incentive challenge is obtained by mapping the sensitive direction of the causal domain of the parameter to be verified, and the input representation of the perturbation direction of the orthogonal comparison challenge is obtained by mapping the orthogonal complement space of the sensitive direction. After the hierarchical commitment is fixed, the observation projection sequence is derived based on the session random variable, the hierarchical commitment node summary of the target parameter causal domain, and the hierarchical commitment node summary of the adjacent parameter causal domain. Intermediate representations of the two types of challenges at the target boundary and adjacent boundaries are collected separately, and the projection order, symbol combination, and cross-boundary transmission sequence of the intermediate representation differences are encoded to form paired functional response fingerprints.

[0013] Preferably, the correlation verifier establishes an evidence correspondence table between structural commitments and functional response fingerprints according to the node identifiers of the hierarchical structure commitments, and generates a joint evidence record containing structural deviation vectors, functional deviation vectors, authorization conversion identifiers and graph path identifiers for each parameter causal domain. When neither the structural deviation vector nor the functional deviation vector satisfies the corresponding benchmark interval determined by the benchmark evidence, the joint evidence record is written into the domain subdivision queue. When the structural deviation vector does not satisfy the original baseline interval but satisfies the transformation interval defined by the transformation constraint, the joint evidence record is written into the transformation review queue; When the structural deviation vector satisfies the reference interval but the functional deviation vector does not, an associated range expansion queue is generated along the upstream reference edge and loading mapping edge of the parameter influence graph.

[0014] Preferably, the correlation verifier extracts all reachable paths between the structural deviation blade and the functional response deviation for the correlation record of the structural deviation blade and the abnormal intermediate characterization boundary, and filters out inconsistent paths based on the matching results of the functional response deviation direction and the response direction of each path edge. For the candidate subgraphs formed by the remaining paths, a graph splitting boundary is generated according to the constraint of minimizing the bridging tensor and the balanced distribution of the structural deviation blades. After each split, the sensitive direction, orientation challenge data and functional response fingerprint are recalculated for each sub-causal domain. When the candidate subgraph contains only one final commitment node, or when the remaining reachable paths share the same set of parameter tensors, the original content hash verification, parameter order verification, and tensor reference port verification are performed on the retained leaf to generate the minimum abnormal parameter set.

[0015] Preferably, the associated verifier reads the mapping and transformation residual basis between the source tensor coordinates and the target tensor coordinates from the authorized transformation record associated with the transformation constraint for the transformation verification queue, performs inverse coordinate mapping and residual subspace projection on the parameter to be verified, generates transformation invariant commitment and allowable residual commitment, and performs joint verification of the two with the corresponding functional response fingerprint according to the node identifier and residual direction; For the aforementioned associated range expansion queue, the tensor loading address, parameter fragmentation identifier, and incremental parameter binding relationship are read along the upstream reference edge. The actual intermediate representation deviation is projected onto the sensitive direction of the corresponding parameter causal domain and its orthogonal complement space, and the unexplained response residual is reconstructed. The unexplained response residual is decomposed into low-rank directional components and loading misalignment components, which are then matched with the registered incremental parameter bases and tensor reference port mappings in the pre-stored model version records to generate abnormal incremental parameter records or abnormal loading mapping records.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Parameter causal domains are divided according to the intermediate representation boundaries reached by common parameter changes, transforming the parameter verification objects from data blocks with adjacent storage locations into a set of parameters with a common functional influence range in the computation graph. For each parameter causal domain, a hierarchical structural commitment is generated, including parameter content, arrangement relationships, principal subspace orientation, and cross-layer coupling relationships, simultaneously preserving parameter byte state, tensor organization state, and inter-layer correlation state. Parameter mappings and allowable residual constraints are established for quantization, pruning, parameter rearrangement, and format conversion, ensuring that the parameters to be verified correspond to the baseline evidence before authorization conversion under a unified standard coordinate system. The model version root summary, session random variables, and parameter causal domain sensitive directions jointly limit the directional challenge data. The challenge input is generated by the current verification session and prioritizes activating the target parameter causal domain. Intermediate representations collected at the target boundary and adjacent boundaries are randomly projected, ordered, and symbolically encoded before being bound to the corresponding structural commitment nodes. Therefore, when parameter content or organizational relationships change, structural commitment provides the range of parameters where the change occurs, functional response fingerprint provides the representational deviation formed along the computational path, transformation constraints provide the acceptable boundaries of authorized changes, and correlation verification distinguishes authorized model transformation, parameter content anomalies, parameter reference anomalies, and loading relationship anomalies based on the combined state of these three types of evidence. When structural and functional deviations occur simultaneously, the verification process shifts to parameter causal domain subdivision; when structural deviations fall within transformation constraints, the verification process shifts to parameter mapping and allowed residual review; when functional deviations occur alone, the verification process expands the correlation range along parameter reference relationships and loading mapping. Each branch maintains evidence correspondence using the same version root summary and node identifier, avoiding cross-referencing of verification results from different model versions, different parameter regions, or different challenge sessions. Structural and functional evidence establish a correspondence around the same parameter causal domain, avoiding direct denial of model integrity due to changes in document summary, and avoiding confirmation of model integrity based solely on limited output similarity. Under the condition of legitimate model transformation, a unified verification result is formed for the consistency of parameter structure, loading relationships, and functional states.

[0017] 2. The parameter influence graph records the reachable paths between parameter tensors, operational relationships, intermediate representation boundaries, and bridging tensors. After identifying structural and functional deviations, correlation verification preserves relevant paths along the response propagation direction and segments the parameter causal domain according to the bridging tensor, the distribution of the deviation blades, and the direction of the boundary response. After each segmentation, the sensitive direction of the subdomain, directional challenge data, and functional response fingerprint are regenerated, allowing the verification scope to gradually shrink as evidence converges until a minimum set of anomalous parameters is formed. This reduces the amount of data required for repeated hashing, full scanning, and intermediate representation comparison of irrelevant parameter blocks. The hierarchical structure commits to organizing blade data blocks according to the computation graph topology, tensor reference ports, and tensor coordinates. The original content hash value and the parameter order projection value jointly participate in the final-level node verification, ensuring that situations where parameter values ​​remain unchanged but parameter order or reference ports change can still be distinguished within a local range. The authorized transformation record incorporates the mapping between source and target tensor coordinates, quantization scale, pruning mask, rearrangement order, and transformation residual basis into the commitment tree. By separating transformation invariants and permissible residuals through inverse coordinate mapping and residual subspace projection, it prevents structural differences caused by legitimate transformations from being mixed into the anomalous parameter set. The target stimulus challenge and orthogonal comparison challenge use the same base sample, and after the structural commitment is fixed, the observation projection sequence is derived from the session random quantity. This allows for mutual verification of target direction responses, non-target direction responses, and cross-boundary transfer sequences. Simultaneously, it ensures that two consecutive verifications use different challenge perturbations and observation projections, reducing missed detections due to insufficient coverage of local anomalous directions by the fixed sample. For cases where structural evidence is normal but the functional response is abnormal, the verification range is expanded along the upstream reference edge and loading mapping edge. Unexplained response residuals are decomposed into low-rank direction components and loading misalignment components, which are then matched with the registered incremental parameter basis and tensor reference port mapping. This allows for continued identification of incremental parameter binding anomalies, tensor reference port misconnections, and parameter fragment loading misalignments even when the parameter file content has not undergone visible changes. Attached Figure Description

[0018] Figure 1 Here is a flowchart of the overall verification process for a large-scale model integrity and security verification system based on artificial intelligence. Figure 2 Flowchart for constructing the causal domain of parameters and generating the parameter influence diagram; Figure 3 Flowchart for generating hierarchical commitment and targeted challenge verification; Figure 4 This is a flowchart for correlation verification, anomaly location, and authorization conversion review. Detailed Implementation

[0019] In one embodiment, reference Figure 1A large-scale model integrity security verification system based on artificial intelligence includes a model parsing processor, an evidence constructor, a challenge verification device, and an association verification device. The model parsing processor parses the parameter tensors, reference relationships, and inter-layer computational relationships of the large model to be verified, and constructs parameter causal domains according to the intermediate representation boundaries reached by parameter changes. The evidence constructor generates hierarchical commitments for each parameter causal domain, including parameter content, permutation relationships, subspace directions, and cross-layer coupling relationships, and generates transformation constraints according to the parameter mapping of the authorized model transformation. The challenge verification device generates targeted challenge data based on the model version root digest, session randomness, and sensitive directions of the parameter causal domains, and collects intermediate representations. The boundary response forms a functional response fingerprint bound to the hierarchical structure commitment; the associated validator compares the evidence to be verified with the benchmark evidence, and performs parameter causal domain subdivision, parameter mapping verification, or expands the verification range along the parameter tensor reference relationship based on the combination of structural commitment deviation, functional response deviation, and transformation constraint. In specific implementation, the model parsing processor reads the parameter index, tensor name, tensor shape, tensor coordinates, computation graph nodes, input and output ports, residual connections, attention mapping, normalization relationship, and parameter piecewise loading record, binds the storage location identifier to the computation graph reference port, and establishes a directed relationship graph from the input side to the output side. The parameter causal domain can share the same data according to the parameter perturbation. The earliest intermediate representation boundary is defined by the boundary. Parameter tensors within the same domain have mergeable response propagation paths before the boundary. Cross-domain parameter tensors retain propagation information through bridging relationships. The evidence builder generates evidence on the trusted model and the model to be verified using the same canonical coordinates, computation graph node identifiers, and parameter causal domain numbers. The hierarchical commitment is aggregated hierarchically from blade data block commitments, parameter tensor commitments, parameter causal domain commitments, and model version root commitments. When the authorized model undergoes quantization, pruning, parameter rearrangement, or format conversion, the target parameter is mapped to the source model's canonical coordinates, and transformation invariants and allowed residuals are saved respectively. The challenge certifier uses the model version root summary, session randomness, and target... The target domain sensitive direction is used to derive challenge seeds, select inputs from the basic input set and generate target domain directional perturbations, collect intermediate representations of the target boundary and adjacent boundaries to form functional response fingerprints with node identifiers, and align the reference structural commitment, the structural commitment to be verified, the reference functional response fingerprint, the functional response fingerprint to be verified and the transformation constraints according to the node identifiers. Based on the evidence combination state, it enters the domain subdivision, transformation review or reference relationship expansion path. The advantage of this embodiment is that it incorporates parameter structure changes, computation graph reference relationships and intermediate representation responses into the same evidence closed loop, so that authorization transformation and parameter anomalies can be processed along different evidence paths, and the scope of anomaly review converges along the parameter causal domain.

[0020] The correlation between the parameter tensor and the candidate intermediate representation boundary is calculated using the following formula: ; in, This represents the correlation between the influence of the i-th parameter tensor and the j-th candidate intermediate representation boundary. and This represents the intermediate representation difference vector corresponding to the positive and negative perturbations. This represents the parameter perturbation vector. and This represents the set of response channels under two different disturbances. Representing a fixed positive number, for example, when the positive and negative response differences are in opposite directions and the channel supports largely overlap, the correlation is affected while maintaining the response amplitude and channel consistency. If the response amplitude is small or the two disturbances are applied to non-intersecting channels, the correlation is reduced and no stable domain affiliation is established.

[0021] In a preferred embodiment, reference Figure 2The model parsing processor sets parameter tensors as source nodes and matrix operations, normalization operations, attention mapping, residual merging, and tensor loading mapping as relation nodes. It records the reachable paths from each parameter tensor to the candidate intermediate representation boundary along the computation graph. For parameter tensors pointing to the same candidate intermediate representation boundary, it applies positive and negative perturbations generated by the block principal subspace direction of the corresponding parameter tensor. It extracts the channel support set and response direction of the boundary response, merges parameter tensors according to the earliest common convergence boundary, channel support overlap, and path continuity, and registers parameter tensors that cross adjacent parameter causal domains and retain responses on both sides. This is denoted as a bridging tensor, forming a parameter influence graph containing domain nodes, bridging tensors, and boundary nodes. Specifically, the model parsing processor records each parameter tensor as a data item containing tensor identifier, source file identifier, canonical coordinates, a set of reference ports, and a set of downstream relation nodes. Each relation node is recorded as a data item containing operation type, input port, output port, predecessor node, and successor node. A path index from the parameter source node to each candidate boundary node is generated through topological traversal. Candidate intermediate representation boundaries are selected at the residual merging completion location, attention output location, feedforward network output location, or model block intersection location. All of these locations... It possesses stable intermediate representations. The principal subspace direction is obtained by centering the parameter tensor through normalized block partitioning and extracting the principal direction. Forward perturbations increase the principal direction by the same magnitude, and reverse perturbations decrease the principal direction by the same magnitude. Both are only used for benchmark analysis in a trusted environment or for isolated verification of the model to be validated, without changing the parameter file in the delivered running state. The model parsing processor compares the shortest topological depth of different parameter tensors reaching the candidate boundary. If multiple parameter tensors form a common reachability relationship for the first time at the same boundary, and the channel support overlap relationship of their forward and reverse responses satisfies the preset stability condition, then the parameter tensor is... If a parameter tensor produces a retrievable response on both sides of an adjacent boundary, it is registered as a bridging tensor and a bilateral boundary reference is established in the parameter influence graph. The parameter influence graph is stored using both an adjacency list and a path inverted index. The adjacency list is used to trace propagation relationships along the computation direction, and the path inverted index is used to retrieve relevant parameter tensors from the abnormal boundary in reverse. The advantage of this embodiment is that the parameter causal domain is jointly determined by the actual computation path and the disturbance response. Tensors with adjacent parameter file positions but different functional influence paths will not be mechanically merged. Tensors with separate parameter file positions but converge at the same intermediate representation boundary can form a unified verification range.

[0022] In a preferred embodiment, reference Figure 3The evidence constructor performs a normalized sorting of parameter data according to the computation graph topology, tensor reference ports, and tensor coordinates, dividing the normalized sorted parameter data into multiple leaf data blocks. For each leaf data block, it generates an original content hash value and an ordered projection value formed by the projection sequence derived from the model version root digest. It also extracts the principal subspace orientation of each leaf data block within the same parameter causal domain and performs dimension-aligned projection on the adjacent layer principal subspaces according to the computation graph edges to generate a cross-layer coupling description. The original content hash value, ordered projection value, principal subspace orientation, and cross-layer coupling description are then combined. The corresponding graph edge identifiers are aggregated layer by layer into a commitment tree. The root node of the commitment tree is bound to the root digest of the model version. In the specific implementation, the primary key of the canonical sort is, in order, the computation graph topology index, the tensor reference port index, the canonical code of the tensor name, and the tensor coordinates. When a shared parameter is encountered, the unique parameter data is retained and all reference ports are appended to the sorting record. The boundary of the leaf data block is determined by the continuity of the canonical coordinates and the continuity of the reference ports to avoid the same leaf crossing irrelevant tensors. The original content hash value is calculated on the canonical byte sequence of the leaf data block, and the order projection value is calculated using the model version. The projection sequence derived from this root abstract performs position-weighted projections on the positions and values ​​of parameters in the leaves, ensuring that different results are produced even when the parameter values ​​are the same but the order of arrangement changes. The principal subspace orientation is obtained by centralizing the leaf matrix within the causal domain of the same parameter. Cross-layer coupling descriptions, when adjacent layers have inconsistent dimensions, first construct aligned projections based on the input-output mapping of the computation graph edges, then calculate the directional relationship between the aligned projection of the previous layer's principal subspace and the subsequent layer's principal subspace. The leaf nodes of the commitment tree store the leaf identifier, the original content hash value, and the order projection value, while intermediate nodes store the corresponding parameters. The principal subspace summary of the tensor and its child node aggregation values ​​are stored. The parameter causal domain nodes store cross-layer coupling descriptions, graph edge identifiers, and domain tensor commitment aggregation values. The root node stores the ordered aggregation results of all parameter causal domain nodes and is connected to the root summary of the model version. Any local verification can be verified from the leaf node along the tree path to the root node without rereading the unaffected parameter regions. The advantage of this embodiment is that the same commitment system simultaneously constrains parameter content, parameter position, tensor direction, and inter-layer relationships, and can map local byte changes, parameter rearrangements, and cross-layer coupling changes to different evidence levels.

[0023] The domain-level aggregate value committed by the hierarchical structure is generated using the following formula: ; in, This represents the domain-level aggregate value of the causal domain of the d-th parameter. Indicates version binding identifier, This represents an ordered set of indexes for the leaf data blocks within the domain. , and These represent the original content hash value, the order projection value, and the principal subspace summary, respectively. Represents an ordered set of edges in a computational graph within the domain. This indicates a description of cross-layer coupling. The graph edge identifier indicates that, for example, when the parameter value remains unchanged but the position is swapped, the order projection value changes and the verification range is limited to the corresponding blade. When the parameter value and position do not change but the interlayer direction relationship changes, the cross-layer coupling description points to the corresponding computation graph edge.

[0024] In a preferred embodiment, the challenge verification device generates challenge seeds based on the model version root digest, session randomness, and the sensitive direction of the causal domain of the parameter to be verified. It selects basic samples from a preset set of valid input samples and generates multiple candidate perturbations within the input representation space of these basic samples. It calculates the response projections of each candidate perturbation onto the boundary of the target parameter causal domain and the boundary of the non-target parameter causal domain. Candidate perturbations with positive response projection increments to the target parameter causal domain and non-positive response projection increments to the non-target parameter causal domain are selected to form directional challenge data. The directional challenge data is then processed at the target boundary, upstream adjacent boundary, and downstream adjacent boundary. The intermediate representations are randomly projected, ordered, and symbolically encoded to form a functional response fingerprint bound to the corresponding node identifier committed by the hierarchical structure. In specific implementation, the preset effective input sample set consists of inputs that can be normally parsed by the large model to be verified. Each basic sample stores an input content summary, input representation length, applicable model version, and observable boundary set. The challenge seed generates a sample index, candidate perturbation initial direction, and observation projection sequence through a deterministic derivation function. The candidate perturbation is limited to the input representation space of the basic samples and maintains the input length and position encoding relationship unchanged. The sensitive direction starts from the causal domain of the target parameter. The principal subspace of parameters is obtained through local linear mapping of the computational graph. The response projection of candidate perturbations on the target boundary is calculated along the sensitive direction, and the response projection on the non-target boundary is calculated along the corresponding non-target sensitive direction. Candidate perturbations that satisfy the condition that the target response projection increment is positive and the non-target response projection increments are non-positive are written into the orientation challenge data. If a single candidate perturbation does not meet the condition, its target response gradient is used to update the input representation of the perturbation direction, and orthogonal elimination is performed using the projection components of the non-target response gradients. Candidate perturbations that still do not meet the constraints after reaching the preset iteration termination condition are discarded. During the observation phase, the model inference configuration is fixed and randomization is turned off. The intermediate representations of the target boundary, upstream adjacent boundary, and downstream adjacent boundary are mapped into low-dimensional vectors according to the observation projection sequence derived from the challenge seed. Then, the projection value order, projection value sign, and cross-boundary transmission order are generated in sequence. These three types of encoding are bound to the parameter causal domain node identifier, model version root summary, and session random variable to form a functional response fingerprint that cannot be reused across sessions. The advantage of this embodiment is that the challenge data is constrained by the sensitive direction of the target parameter causal domain, the functional response no longer depends on the natural coverage of the fixed test input, and the joint observation of the target boundary and adjacent boundaries can preserve the transmission relationship of the response in the computation graph.

[0025] Candidate perturbations for the orienteering challenge data are selected according to the following formula: ; in, This represents the directional evaluation value of the candidate perturbation v. and This represents an intermediate representation of the target boundary when perturbation is applied and when no perturbation is applied. Indicates the target domain sensitive direction. Represents the set of adjacent non-target domains. and Two types of intermediate representations are used to represent the nth non-target boundary. This indicates the direction that is not sensitive to the target domain. Indicates the non-target response constraint coefficient. This represents the constraint coefficient for the perturbation amplitude. For example, when the target projection increases but the non-target projections do not increase, the intermediate penalty term is zero. If a candidate perturbation simultaneously activates adjacent domains, the corresponding positive response enters the penalty term and reduces the orientation evaluation value. The parameter causal domain verification data record structure is shown in Table 1 below.

[0026] Table 1. Parameter Causal Domain Verification Data Record Structure

[0027] The records shown in Table 1 are connected by a unified model version identifier and a unified parameter causal domain identifier. The parameter tensor record provides the underlying reference basis, the parameter causal domain record provides the verification range, the structural commitment record and the functional fingerprint record respectively store static evidence and operational response evidence, the transformation constraint record stores the authorized change boundary, and the joint evidence record stores the alignment results of each piece of evidence and the subsequent processing path. In actual storage, each record is accompanied by the root summary of the model version used at the time of generation and the record summary, so as to verify the consistency of the record source during local review.

[0028] In a preferred embodiment, when the correlation validator performs subdivision verification within the parameter causal domain, it uses the functional response deviation direction as the starting point for reverse tracing. It identifies the final commitment nodes with structural deviations in the hierarchical commitment structure as structural deviation blades, and retains the propagation path connecting the corresponding parameter tensors of the structural deviation blades to the anomaly intermediate representation boundary in the parameter influence graph. Based on the number of bridging tensors in the propagation path, the distribution of structural deviation blades, and the consistency of the boundary response direction, it determines the graph segmentation position, dividing the original parameter causal domain into at least two sub-causal domains. It regenerates sub-domain challenge data according to the sensitive direction of each sub-causal domain and compares the sub-domain functional response fingerprint with the corresponding hierarchical commitment structure of the sub-domain until the structural deviation blades and functional response deviations converge to the same minimum parameter sub-domain. In specific implementation, the correlation validator reads the functional response difference vector from the anomaly intermediate representation boundary, projects the difference vector onto the sensitive direction and bridging tensor response direction of the target parameter causal domain to obtain the reverse tracing direction label, and then reads all final deviation nodes and their corresponding parameter tensors from the commitment tree. In the parameter influence graph, it retrieves the full path from the final deviation node to the anomaly boundary using the path inverted index. Paths that are reachable from all directions and do not contain matching edges with directional labels are excluded. The remaining paths are used to form candidate subgraphs based on the number of bridging tensors, path length, and the coverage of structural deviation blades. The graph segmentation position is selected at a location that reduces cross-domain bridging relationships and ensures that both sides contain structural deviation blades. After segmentation, the sub-causal domain boundaries, sub-domain sensitive directions, and sub-domain commitment tree indexes are reconstructed. The challenge certifier generates independent challenge seeds based on the new sub-domain identifiers and collects sub-domain functional response fingerprints. If a sub-domain retains both structural and functional deviations, the sub-domain is further segmented. If a sub-domain retains only structural deviations... If a structural deviation is found but a functional deviation is not retained, the process proceeds to transformation constraint verification or parameter order verification. If a subdomain retains only a functional deviation, the process proceeds to reference relationship expansion. The termination condition is that the candidate subgraph contains only one final commitment node, all remaining propagation paths share the same set of parameter tensors, or further segmentation would destroy the observability of intermediate representation boundaries. The advantage of this embodiment is that anomaly localization is constrained by both structural deviation blades and functional deviation directions. The verification process does not rely solely on file address bisection and can retain paths consistent with the anomaly response when multipath propagation is caused by residual connections and attention mapping.

[0029] In a preferred embodiment, the evidence constructor establishes a transformation description record for the authorized model transformation. The transformation description record includes the mapping between source tensor coordinates and target tensor coordinates, quantization scale and zeros, pruning mask, parameter rearrangement order, and transformation residual basis. When verifying a large model to be verified after authorized transformation, the target parameters are mapped to the canonical coordinates of the source model based on the transformation description record. Subspace decomposition is performed on the mapped parameter differences based on the transformation residual basis, and transformation invariant commitments and permissible residual commitments are generated respectively. The transformation invariant commitments, permissible residual commitments, and the... The summary of the transformation description record is written to the corresponding node of the commitment tree and bound together with the root summary of the model version before and after the authorized transformation, thereby forming the transformation constraint. In specific implementation, the transformation description record is output by the trusted transformation process and registered for version. The mapping between the source tensor coordinates and the target tensor coordinates is represented by an invertible mapping table or a partial mapping table with missing markers. The scale and zero point of each canonical block of the transformation record are quantized. The mask of the retained and deleted coordinates of the transformation record is pruned. The parameter rearrangement of the arrangement relationship between the source position and the target position of the record is performed. The transformation residual basis is determined by the trusted transformation process. The parameter differences before and after transformation are obtained by block decomposition in normalized coordinates. When the model to be verified enters the transformation review, the evidence constructor first restores the parameter order according to the permutation relationship, and then restores it to a unified numerical domain according to the quantization scale and zero point. The clipped positions are marked as non-comparable coordinates according to the clipping mask, and the mapped parameter differences are formed for the comparable coordinates. The parameter differences are projected onto the subspace spanned by the transformation residual basis to obtain the allowed residual components. The orthogonal complement of these components is taken as the unregistered change components. The transformation invariant commitment is made by normalized coordinates, the order projection of the retained parameters, the orthogonal complement summary of the residual subspace, and the untransformed components. The cross-layer coupling description of the impact is aggregated to form a residual commitment that is formed by the aggregation of residual basis identifier, residual projection coefficient range and pruning mask summary. The root summary of the model version before transformation, the root summary of the model version after transformation and the transformation description record summary are jointly written into the parent node of the commitment tree, so that any transformation evidence can only be used for the corresponding version pair. The advantage of this embodiment is that the authorized transformation is not processed by re-establishing a completely independent benchmark model, but retains the invariant evidence and allowed residual evidence under the source model canonical coordinates, and continues to identify parameter changes that exceed the registered transformation range when the overall model bytes change.

[0030] The transformed residual decomposition of the mapped parameter differences is calculated using the following formula: , ; in, Let represent the difference vector of the m-th canonical parameter block relative to the source parameters after inverse mapping. This represents the transformation residual basis matrix where the column vectors are mutually orthogonal. This indicates its transpose. Represents an identity matrix of the same dimension. This indicates the allowed residual components within the authorized transformation residual subspace. This represents the unregistered variation components within the orthogonal complement, such as the main difference components that enter when the quantization error direction is registered. The irrelevant low-rank increments are formed in the orthogonal complement. .

[0031] In a preferred embodiment, the challenge verification device generates a target incentive challenge and an orthogonal comparison challenge using the same base sample. The input representation perturbation direction of the target incentive challenge is obtained by mapping the sensitive direction of the causal domain of the parameter to be verified, and the input representation perturbation direction of the orthogonal comparison challenge is obtained by mapping the orthogonal complement space of the sensitive direction. After the hierarchical commitment is fixed, an observation projection sequence is derived based on the session random variable, the hierarchical commitment node summary of the target parameter causal domain, and the hierarchical commitment node summary of the adjacent parameter causal domain. Intermediate representations of the two types of challenges at the target boundary and adjacent boundaries are collected respectively, and the projection order, symbol combination, and cross-boundary transmission sequence of the intermediate representation difference are encoded to form a pairwise functional response fingerprint. In specific implementation, the same base sample maintains consistent input content, input length, and position encoding. The target incentive challenge only applies perturbation to the input representation direction obtained by mapping the sensitive direction of the target parameter causal domain. The orthogonal comparison challenge first generates candidate input representation directions, and then subtracts the projection component of the candidate direction in the target sensitive direction to obtain the comparison perturbation located in the orthogonal complement space. The hierarchical commitment is then completed. After being fixed, the challenge verification device inputs the session random variable, target domain commitment node summary, adjacent domain commitment node summary, and boundary node identifier into the deterministic derivation function to obtain the observation projection sequence and observation order, avoiding the prediction of the observation projection before the generation of structural evidence. The target boundary and adjacent boundaries output intermediate representations of the target stimulus challenge and orthogonal comparison challenge, respectively. The challenge verification device calculates the difference using the same benchmark representation, performs observation projection on each difference, and records the order of the projection values ​​from largest to smallest, the positive and negative signs of the projection values, and the sequence of the response from the upstream boundary to the target boundary and then to the downstream boundary. The paired functional response fingerprint simultaneously saves the target stimulus code and the orthogonal comparison code. If the target stimulus code deviates while the orthogonal comparison code maintains the benchmark relationship, then the anomaly corresponds to the target sensitive direction. If both types of codes deviate, the correlation checker expands to the adjacent parameter causal domain or loading relationship for verification. The advantage of this embodiment is that the target stimulus challenge provides directional response evidence, and the orthogonal comparison challenge provides a non-target direction reference. Both are generated from the same base sample and the same observation sequence, which can reduce the interference of differences in the base input on the functional response comparison.

[0032] In a preferred embodiment, reference Figure 4The association verifier establishes an evidence correspondence table between structural commitments and functional response fingerprints according to the node identifiers of the hierarchical structure commitments. For each parameter causal domain, it generates a joint evidence record containing structural deviation vectors, functional deviation vectors, authorization conversion identifiers, and graph path identifiers. When neither the structural deviation vector nor the functional deviation vector satisfies the corresponding benchmark interval determined by the benchmark evidence, the joint evidence record is written into the domain subdivision queue. When the structural deviation vector does not satisfy the original benchmark interval but satisfies the conversion interval defined by the conversion constraint, the joint evidence record is written into the conversion review queue. When the structural deviation vector satisfies the benchmark interval but the functional deviation vector does not, an association range expansion queue is generated along the upstream reference edge and loading mapping edge of the parameter influence graph. In specific implementation, the evidence correspondence table uses the model version root summary, parameter causal domain identifier, commitment tree node identifier, and intermediate representation boundary identifier as the joint key. The structural deviation vector includes the original content hash difference marker, order projection difference, principal subspace direction difference, and cross-layer coupling difference. The functional deviation vector includes projection order difference, symbol combination difference, target boundary response difference, and cross-boundary transmission sequence difference. The authorization conversion identifier... The system identifies the transformation description record, the graph path identifier points to the set of related paths in the graph that affect the parameters, the baseline interval is determined by the trusted model after generating baseline evidence multiple times under specified numerical representation conditions, the discrete hash difference is represented by consistent or inconsistent states, the continuous projection difference and directional difference are represented by the closed interval of the baseline distribution, the association checker forms joint evidence records domain by domain according to the joint key and performs mutual exclusion queue judgment, the record entering the domain subdivision queue is accompanied by the set of structural deviation blades and the direction of functional deviation, the record entering the transformation review queue is accompanied by the authorized transformation identifier and the residual subspace index, the record entering the association range expansion queue is accompanied by the upstream reference edge of the abnormal boundary, the loading mapping edge and the unexplained response residual, if the same record meets multiple initial conditions at the same time, disambiguation is performed in the order of whether the structural deviation meets the transformation constraint, whether the functional deviation can be explained by the transformation residual and whether the graph path is complete, and only one main processing queue is retained, while the auxiliary review identifier is saved. The advantage of this embodiment is that structural evidence, functional evidence, transformation evidence and graph path evidence are aligned by a unified node identifier, and subsequent processing is triggered by the evidence combination state, avoiding a single deviation from directly replacing the completeness conclusion.

[0033] The normalized bias of joint evidence records is calculated using the following formula: ; in, This represents the joint bias of the causal domain of the d-th parameter. and These represent the structural deviation vector and the functional deviation vector, respectively. and The scale matrices represent the differences in structural and functional benchmarks, respectively. Denotes the orthogonal complement projection matrix of the authorized transformation residual subspace. , and This represents a fixed combination coefficient within the same model version. For example, when the structural deviation is mainly located in the authorized transformation residual subspace, the third term has a smaller value and enters the transformation verification path. If the orthogonal complementary component and the functional deviation exist simultaneously, it enters the domain subdivision path. The joint deviation is only used for queue sorting and does not replace the independent condition determination of each component.

[0034] In a preferred embodiment, the association validator extracts all reachable paths from the structural deviation blade to the anomaly intermediate representation boundary for the association records of structural deviation blades and functional response deviations, and filters out inconsistent paths based on the matching results of the functional response deviation direction and the response directions of each path edge; for the candidate subgraph formed by the remaining paths, a graph partitioning boundary is generated according to the constraint of minimizing the bridging tensor and the balanced distribution of structural deviation blades, and the sensitive direction, orientation challenge data and functional response fingerprint are recalculated for each subcausal domain after each partition; when the candidate subgraph contains only one final commitment node, or the remaining reachable paths share the same parameter tensor set. When the conditions are met, the original content hash verification, parameter order verification, and tensor reference port verification are performed on the retained blades to generate a minimum set of abnormal parameters. In the specific implementation, the association validator saves the path edge sequence, bridging tensor sequence, and edge response direction sequence for each reachable path. The functional response deviation direction is compared with the path edge response direction edge by edge. Paths with opposite directions that cannot be explained by the residual merging sign relation are eliminated, while paths with the same direction or with the same direction after being registered linearly mapped are retained. The splitting boundary of the candidate subgraph is selected from the relation nodes. The candidate position must satisfy that there are observable intermediate representation boundaries on both sides after the split. The number of bridging tensors is used to determine the number of nodes. To limit cross-boundary dependencies, structural bias blade distribution balancing is used to avoid all bias blades concentrating on the same side while the other side only forms empty validation branches. After each split, the model parsing processor re-establishes the intra-domain node set and boundary node set of the sub-causal domain. The evidence builder reads the corresponding commitment tree subtree, the challenge refutation processor recalculates the sub-domain sensitive direction and derives a new intra-session challenge seed, and the association validator compares the sub-domain structural bias with the sub-domain functional bias and continues to converge. When the candidate subgraph corresponds to only one final-level commitment node, the canonical byte sequence of the blade is read to recalculate the original content hash value, and the projection is derived according to the model version root digest. The sequence recalculates the parameter order projection values ​​and checks the tensor reference ports according to the parameter index and the computation graph input port. If multiple remaining paths share the same set of parameter tensors, the parameter tensors in the shared set are used as the verification boundary and the same verification is performed on all its blades. Finally, the smallest set of abnormal parameters containing abnormal blade identifiers, abnormal parameter tensor identifiers, abnormal reference ports and associated abnormal boundaries is recorded. The advantage of this embodiment is that the abnormal set is jointly defined by reachable paths, response directions and committed blades, and subdomain functional evidence is regenerated after each segmentation, avoiding the use of parent domain challenge results that cause the positioning range to remain in a large parameter area.

[0035] In a preferred embodiment, the association validator, for the transformation verification queue, reads the mapping and transformation residual basis between the source tensor coordinates and the target tensor coordinates from the authorized transformation records associated with the transformation constraint, performs inverse coordinate mapping and residual subspace projection on the parameters to be verified, generates transformation invariant commitments and permissible residual commitments, and performs joint verification of the two with the corresponding functional response fingerprint according to the node identifier and residual direction; for the association range expansion queue, it reads the tensor load address, parameter fragment identifier, and incremental parameter binding relationship along the upstream reference edge, projects the actual intermediate representation deviation to the sensitive direction of the corresponding parameter causal domain and its... Orthogonally fill the space and reconstruct the unexplained response residuals; decompose the unexplained response residuals into low-rank directional components and loading misalignment components, and match them with the registered incremental parameter basis and tensor reference port mapping in the pre-stored model version record to generate abnormal incremental parameter records or abnormal loading mapping records. In the specific implementation, the parameters in the transformation verification queue are restored to the normal coordinates according to the target-to-source coordinate mapping. The clipping mask is read for the clipped coordinates and the original content comparison is skipped. The allowed residual components and unregistered change components are calculated for the reversible mapped coordinates. The transformation invariant commitment and allowed residual commitment are verified along the commitment tree path to the model versions before and after the transformation. The root abstract compares the functional response fingerprint with the same node identifier and the transformation residual direction. When the structural difference is located in the allowed residual subspace and the functional response propagates along the registered direction, it is recorded as an authorized transformation consistent. If it exceeds the allowed residual subspace or the response direction is inconsistent, it is transferred to the domain subdivision queue. The association range expansion queue reads the actual loading source of the parameter tensor upstream from the anomaly boundary, maps the loading address to the parameter fragment identifier and tensor reference port, and resolves the incremental parameter binding relationship to the basic tensor, incremental parameter basis, and merging position. The actual intermediate representation deviation is decomposed in the current domain sensitive direction and its orthogonal complement space, and the registered basic model response is utilized. The interpretable part should be reconstructed with the incremental response. The uninterpreted response residual is decomposed into a low-rank directional component. The remaining part corresponding to the change in loading position forms a loading misalignment component. When the low-rank directional component is matched with the pre-stored incremental parameter basis, the incremental identifier, binding tensor and merging position are checked. When the loading misalignment component is matched with the tensor reference port mapping, the actual fragment, expected fragment and loading port are checked. The advantage of this embodiment is that the transformation difference, incremental parameter difference and loading mapping difference are respectively checked by the standard coordinate, residual direction and reference port. When there is no direct structural deviation in the parameter file, the source of the anomaly can still be traced along the functional response and loading relationship.

Claims

1. A large-scale model integrity security verification system based on artificial intelligence, characterized in that, Includes a model parsing processor, evidence constructor, challenge and verification processor, and correlation validator. The model parsing processor analyzes the parameter tensors, reference relationships, and inter-layer computational relationships of the large model to be verified, and constructs the parameter causal domain according to the intermediate representation boundary reached by the parameter changes. The evidence constructor generates a hierarchical commitment for each parameter causal domain, including parameter content, permutation relationship, subspace direction, and cross-layer coupling relationship, and generates transformation constraints according to the parameter mapping of the authorized model transformation. The challenge verification device generates targeted challenge data based on the model version root digest, session randomness, and the sensitive direction of the parameter causal domain. It collects responses from intermediate representation boundaries and forms functional response fingerprints bound to hierarchical commitments. The correlation verifier compares the evidence to be verified with the benchmark evidence, and performs parameter causal domain subdivision, parameter mapping verification, or expands the verification range along the parameter tensor reference relationship based on the combined state of structural commitment deviation, functional response deviation, and transformation constraint.

2. The large-scale model integrity security verification system based on artificial intelligence according to claim 1, characterized in that, The model parsing processor sets the parameter tensors as source nodes and matrix operations, normalization operations, attention mapping, residual merging, and tensor loading mapping as relation nodes. It records the reachable path from each parameter tensor to the candidate intermediate representation boundary along the computation graph. For parameter tensors pointing to the same candidate intermediate representation boundary, positive and negative perturbations generated by the block principal subspace direction of the corresponding parameter tensor are applied respectively. The channel support set and response direction of the boundary response are extracted. The parameter tensors are merged according to the earliest common convergence boundary, channel support coincidence relationship and path continuity relationship. The parameter tensors that cross the adjacent parameter causal domain and retain the response on both sides are registered as bridging tensors, forming a parameter influence map containing domain nodes, bridging tensors and boundary nodes.

3. The large model integrity security verification system based on artificial intelligence according to claim 1, characterized in that, The evidence constructor performs a normalized sorting of the parameter data according to the computation graph topology, tensor reference ports, and tensor coordinates, and divides the normalized sorted parameter data into multiple leaf data blocks. For each leaf data block, an original content hash value and an ordered projection value derived from the model version root digest projection sequence are generated. The principal subspace orientations of each leaf data block within the same parameter causal domain are extracted. Dimension-aligned projections are performed on the adjacent layer principal subspaces according to the computation graph edges to generate a cross-layer coupling description. The original content hash value, order projection value, principal subspace direction, cross-layer coupling description and corresponding graph edge identifier are aggregated layer by layer into a commitment tree, and the root node of the commitment tree is bound to the root summary of the model version.

4. The large model integrity security verification system based on artificial intelligence according to claim 1, characterized in that, The challenge verification device generates challenge seeds based on the model version root digest, session randomness, and the sensitive direction of the causal domain of the parameter to be verified. It selects basic samples from a preset set of valid input samples and generates multiple candidate perturbations in the input representation space of the basic samples. Calculate the response projections of each candidate perturbation at the boundaries of the target parameter causal domain and the non-target parameter causal domain. Select candidate perturbations whose response projection increments in the target parameter causal domain are positive and whose response projection increments in the non-target parameter causal domain are non-positive to form the directional challenge data. The intermediate representations generated by the directional challenge data at the target boundary, upstream adjacent boundary, and downstream adjacent boundary are randomly projected, ordered, and symbolically encoded to form a functional response fingerprint that is bound to the corresponding node identifier of the hierarchical structure commitment.

5. The large model integrity security verification system based on artificial intelligence according to claim 2, characterized in that, When the correlation validator performs subdivision verification within the parameter causal domain, it uses the direction of functional response deviation as the starting point for reverse tracing. It identifies the final commitment node with structural deviation in the hierarchical structural commitment as the structural deviation blade, and preserves the propagation path connecting the parameter tensor corresponding to the structural deviation blade and the intermediate representation boundary of the anomaly in the parameter influence graph. The graph segmentation location is determined based on the number of bridging tensors, the distribution of structural deviation blades, and the consistency of boundary response directions in the propagation path, dividing the original parametric causal domain into at least two sub-causal domains. Subdomain challenge data are regenerated according to the sensitive direction of each sub-causal domain, and the subdomain functional response fingerprint is correlated and compared with the hierarchical structure commitment of the corresponding subdomain until the structural deviation blade and the functional response deviation converge to the same minimum parameter subdomain.

6. The large model integrity security verification system based on artificial intelligence according to claim 3, characterized in that, The evidence constructor establishes a transformation description record for the authorized model transformation. The transformation description record includes the mapping between the source tensor coordinates and the target tensor coordinates, the quantization scale and zeros, the clipping mask, the parameter rearrangement order, and the transformation residual basis. When validating a large model to be validated after authorized transformation, the target parameters are mapped to the canonical coordinates of the source model according to the transformation description record. The subspace decomposition of the mapped parameter differences is performed based on the transformation residual basis, and transformation invariant commitments and permissible residual commitments are generated respectively. The transformation invariant commitment, the allowed residual commitment, and the summary of the transformation description record are written into the corresponding node of the commitment tree, and bound together with the root summary of the model version before and after the authorized transformation, thereby forming the transformation constraint.

7. The large model integrity security verification system based on artificial intelligence according to claim 4, characterized in that, The challenge verification device generates a target incentive challenge and an orthogonal comparison challenge using the same base sample. The input representation of the perturbation direction of the target incentive challenge is obtained by mapping the sensitive direction of the causal domain of the parameter to be verified, and the input representation of the perturbation direction of the orthogonal comparison challenge is obtained by mapping the orthogonal complement space of the sensitive direction. After the hierarchical commitment is fixed, the observation projection sequence is derived based on the session random variable, the hierarchical commitment node summary of the target parameter causal domain, and the hierarchical commitment node summary of the adjacent parameter causal domain. Intermediate representations of the two types of challenges at the target boundary and adjacent boundaries are collected separately, and the projection order, symbol combination, and cross-boundary transmission sequence of the intermediate representation differences are encoded to form paired functional response fingerprints.

8. The large model integrity security verification system based on artificial intelligence according to claim 2, characterized in that, The correlation verifier establishes an evidence correspondence table between structural commitments and functional response fingerprints according to the node identifiers of the hierarchical structural commitments, and generates a joint evidence record for each parameter causal domain, including structural deviation vectors, functional deviation vectors, authorization transition identifiers, and graph path identifiers. When neither the structural deviation vector nor the functional deviation vector satisfies the corresponding benchmark interval determined by the benchmark evidence, the joint evidence record is written into the domain subdivision queue. When the structural deviation vector does not satisfy the original baseline interval but satisfies the transformation interval defined by the transformation constraint, the joint evidence record is written into the transformation review queue. When the structural deviation vector satisfies the reference interval but the functional deviation vector does not, an associated range expansion queue is generated along the upstream reference edge and loading mapping edge of the parameter influence graph.

9. The large model integrity security verification system based on artificial intelligence according to claim 5, characterized in that, The correlation validator extracts all reachable paths from the structural deviation blade to the anomaly intermediate characterization boundary based on the correlation records between the structural deviation blade and the functional response deviation, and filters out inconsistent paths based on the matching results between the functional response deviation direction and the response directions of each path edge. For the candidate subgraphs formed by the remaining paths, graph partitioning boundaries are generated according to the constraints of minimizing the bridging tensor and ensuring a balanced distribution of the structural deviation blades. After each partition, the sensitive direction, orientation challenge data, and functional response fingerprint are recalculated for each sub-causal domain. When the candidate subgraph contains only one final commitment node, or when the remaining reachable paths share the same set of parameter tensors, the original content hash verification, parameter order verification, and tensor reference port verification are performed on the retained leaf to generate the minimum abnormal parameter set.

10. The large model integrity security verification system based on artificial intelligence according to claim 8, characterized in that, The associated validator, targeting the transformation verification queue, reads the mapping between the source tensor coordinates and the target tensor coordinates and the transformation residual basis from the authorized transformation records associated with the transformation constraints. It then performs inverse coordinate mapping and residual subspace projection on the parameters to be verified, generating transformation invariant commitments and permissible residual commitments. Finally, it performs joint verification of these commitments with the corresponding functional response fingerprint according to node identifiers and residual directions. For the aforementioned expanded association range queue, the tensor load address, parameter fragment identifier, and incremental parameter binding relationship are read along the upstream reference edge. The actual intermediate representation bias is projected onto the sensitive direction of the corresponding parameter causal domain and its orthogonal complement space, and the unexplained response residual is reconstructed. The unexplained response residual is decomposed into low-rank directional components and loading misalignment components, which are then matched with the registered incremental parameter bases and tensor reference port mappings in the pre-stored model version records to generate abnormal incremental parameter records or abnormal loading mapping records.

Images