Multi-agent based AI vulnerability distributed collaborative governance method and system

Abstract

The disclosure provides a multi-agent-based AI vulnerability distributed collaborative governance method and system. First, each agent node collects local AI core operation data, and uses a differential privacy mechanism to perform noise disturbance desensitization on sensitive dimensions. Then, each node independently trains a local detection model based on the desensitized data and generates a global detection model to perform vulnerability scanning to obtain a vulnerability instance set. Then, for each vulnerability instance, five-dimensional risk indicator bottom observation data is collected and mapped to a standardized score, which is substituted into a fixed weight comprehensive risk score formula to determine the risk level. Then, the comprehensive risk score is mapped to the current time risk state probability distribution, and the probability of each risk state at the next time is predicted. Then, the four-dimensional data of each node is collected and quantified into a score, which is substituted into a fixed weight node credibility score formula to calculate a comprehensive credibility score value, and the target node is adaptively selected according to the risk level and the prediction index. Finally, the target node performs hierarchical closed-loop disposal according to the risk level.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and in particular to a distributed collaborative governance method and system for AI vulnerabilities based on multi-agent systems. Background Technology

[0002] The large-scale deployment of big models and AI systems has given rise to new AI security vulnerabilities such as model backdoors, inference bypass, parameter tampering, and chain vulnerabilities. These vulnerabilities are highly concealed, iterate rapidly, and interact across nodes, making single-point protection ineffective in intercepting risks across the entire domain. Current industry governance models mainly consist of three types of solutions, all of which have inherent technical bottlenecks.

[0003] Option 1: Single-point localized vulnerability detection solution. Each node operates independently, relying on a local rule base and a single-machine model to complete the detection, without cross-node collaboration. Its drawbacks are: the single sample leads to a high rate of missed detection of implicit vulnerabilities; it only supports static identification and lacks the ability to extrapolate temporal risks; and it can only be passively dealt with after a vulnerability has spread, resulting in a serious lag in governance.

[0004] Option 2: Centralized Cloud-Based Collaborative Governance Solution. A central server aggregates raw data from all nodes, with unified analysis and scheduling handled by the cloud. Its drawbacks include: centralized uploading of raw model data and inference logs poses an irreversible risk of privacy breaches and violates the data minimization compliance principle; central computing power is a bottleneck, resulting in significant analysis delays under high concurrency; and the unified handling strategy cannot adapt to differentiated business scenarios, leading to low governance accuracy.

[0005] Option 3: Simplified Node Information Sharing Solution. Each node only publishes vulnerability alert texts, without data collaboration or intelligent scheduling; collaboration relies on manual intervention. Its drawbacks include: extremely low collaboration level and no automated closed loop; lack of unified quantitative evaluation standards, resulting in fragmented assessment results; lack of a reliable quantitative mechanism, leading to chaotic collaboration; and lack of experience accumulation, resulting in repeated recurrence of similar vulnerabilities.

[0006] In summary, existing technologies cannot simultaneously meet the industry's needs for privacy compliance, accurate assessment, intelligent collaboration, and long-term iteration. Summary of the Invention

[0007] This disclosure provides at least one distributed collaborative governance method and system for AI vulnerabilities based on multi-agent systems to address at least one of the above-mentioned technical defects.

[0008] According to one aspect of this disclosure, a distributed collaborative governance method for AI vulnerabilities based on multi-agent systems is provided, comprising the following steps: Each intelligent agent node collects local AI core operation data; Each of the aforementioned intelligent agent nodes utilizes a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the local AI core operating data, generating a desensitized standardized AI security dataset; Each of the aforementioned intelligent agent nodes independently trains a local detection model based on the local de-identified standardized AI security dataset. The model gradient parameters of the local detection model are used in federated aggregation. A global detection model is generated through dynamic weighted aggregation based on node credibility. The global detection model is then used to perform vulnerability scanning on the local de-identified dataset to obtain a set of vulnerability instances. For each vulnerability instance, underlying observation data of the five-dimensional risk indicators are collected from multiple data sources, mapped to five-dimensional standardized scores, and the five-dimensional standardized scores are substituted into the fixed-weight comprehensive risk score formula to calculate the comprehensive risk score. The risk level of the vulnerability is determined based on the comprehensive risk score. For each vulnerability instance, the comprehensive risk score is mapped to the risk state probability distribution at the current moment. Based on the state transition probability matrix dynamically constructed using the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, dynamic Bayesian time series inference is performed on the risk state probability distribution to predict the probability of the vulnerability instance being in each risk state at the next moment. Based on the calculated probabilities, four prediction indicators are calculated. The four prediction indicators include vulnerability escalation probability, future spread range, chain trigger risk, and incremental harm. Four-dimensional data of each intelligent agent node is collected; the four-dimensional data includes historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability, and the four-dimensional data are quantified into standardized scores respectively; the four standardized scores are substituted into a node trustworthy handling capability scoring formula with fixed weights to calculate the comprehensive trustworthiness score of each intelligent node; the urgency of the task is determined according to the risk level and the four prediction indicators; and the intelligent agent node with the best comprehensive trustworthiness score is adaptively selected as the target node for handling the task. The target node performs a graded closed-loop handling operation according to the risk level, records the entire handling operation and the generated data, and performs retesting and verification on the repaired vulnerability to confirm whether the vulnerability has been closed.

[0009] In one possible implementation, the customized differential privacy mechanism employs the following core formula:

[0010] in, The de-identified standardized AI security dataset is defined as follows: D is the local AI core running data, μ is the location parameter, and b is the adaptive noise scale parameter, with a value range limited to [0.01, 0.1].

[0011] In one possible implementation, the global detection model parameters are as follows:

[0012] in, Here are the parameters of the global detection model, where N is the number of agent nodes. Let be the model gradient parameters of the local detection model for the i-th agent node. The dynamic weight coefficient of the i-th agent node is calculated in real time based on the historical detection accuracy, reliability level, and operational stability of the agent node.

[0013] In one possible implementation, the fixed-weight comprehensive risk scoring formula is as follows:

[0014] in, For the comprehensive risk score, Score the exploitability of the vulnerability; Rate the severity of the vulnerability; Rate the speed at which the vulnerability spreads; Assess the importance of associated AI assets; Rate the difficulty of patching the vulnerability.

[0015] In one possible implementation, the formula used for the dynamic Bayesian time series deduction is as follows:

[0016] in, and These represent the probability distributions of the risk states of the vulnerability instance at time t and time t+1, respectively. The risk states are discretely defined as latent state, local triggering state, lateral spread state, and global uncontrolled state. The vulnerable instance is in state at time t. The posterior probability is calculated from the comprehensive risk score, real-time monitoring and alarm data, and asset connectivity topology. The state transition probability is generated dynamically by the AI ​​vulnerability knowledge graph based on asset connectivity, module coupling degree, and historical vulnerability diffusion samples. To extrapolate the probability that the output vulnerability will be in each risk state at time t+1.

[0017] In one possible implementation, The probability of vulnerability escalation is the sum of the probability corresponding to the lateral spread state and the probability corresponding to the global loss of control state; The future diffusion range is defined as follows: when the probability of the vulnerability escalation exceeds a preset threshold, the set of all nodes in the AI ​​vulnerability knowledge graph that are connected to the victim assets is traversed to predict the list and quantity of AI assets that will be affected. The chain-triggered risk is to retrieve associated vulnerabilities in the AI ​​vulnerability knowledge graph that have a linkage triggering relationship with the current vulnerability instance, and to calculate and activate the joint probability of the associated vulnerabilities using the state transition probability matrix. The incremental harm is a weighted sum of the asset importance scores corresponding to the predicted list of AI assets to be affected, combined with the predicted probability of the vulnerability instance spreading to each asset.

[0018] In one possible implementation, the node's trusted processing capability scoring formula is as follows:

[0019] in, Let be the comprehensive trust score of the i-th intelligent node. The historical detection accuracy score is given. The average emergency response time score is given. The computing power adequacy score is given. The compliance stability score is given.

[0020] In one possible implementation, the adaptive selection of the agent node with the optimal comprehensive trust score as the target node for handling the task includes: For vulnerability instances with a risk level of high risk and a vulnerability upgrade probability greater than 50%, the smart node with the highest comprehensive trust score is selected as the target node. For vulnerability instances with a risk level of high risk and a future spread range exceeding 3 smart nodes, the smart node with the highest comprehensive trust score is selected as the target node. For the vulnerability instance with a risk level of medium, the intelligent node with the highest computing power sufficiency among the top three intelligent nodes in terms of comprehensive trust score is selected as the target node. For vulnerability instances classified as low-risk, the smart node with a comprehensive trust score of not less than 60 and the lowest current task load is selected as the target node.

[0021] In one possible implementation, the multi-agent-based distributed collaborative governance method for AI vulnerabilities further includes: The governance experience generated by each intelligent node during the handling process is periodically summarized, and after screening and structured encapsulation, incremental parameters are generated. Each node performs incremental iterative updates to the local detection model based on the incremental parameters at a fixed learning rate.

[0022] This disclosure also provides a distributed collaborative governance device for AI vulnerabilities based on multiple agents, including multiple agents and a comprehensive governance module; Each intelligent agent node collects local AI core operation data; each intelligent agent node uses a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the local AI core operation data to generate a desensitized standardized AI security dataset; each intelligent agent node independently trains a local detection model based on the local desensitized standardized AI security dataset; The comprehensive governance module is used to participate in federated aggregation of the model gradient parameters of the local detection model, dynamically weighted aggregation based on node credibility to generate a global detection model, and then use the global detection model to perform vulnerability scanning on the local de-identified dataset to obtain a set of vulnerability instances. For each vulnerability instance, underlying observation data of five-dimensional risk indicators are collected from multiple data sources, mapped to five-dimensional standardized scores, and then the five-dimensional standardized scores are substituted into a fixed-weight comprehensive risk scoring formula to calculate a comprehensive risk score. The risk level of the vulnerability is determined based on the comprehensive risk score. For each vulnerability instance, the comprehensive risk score is mapped to the risk state probability distribution at the current moment. Based on the state transition probability matrix dynamically constructed using the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, the risk state probability distribution is... The system performs dynamic Bayesian time-series inference to predict the probability of the vulnerability instance being in various risk states at the next moment, and calculates four prediction indicators based on the calculated probabilities. The four prediction indicators include vulnerability escalation probability, future spread range, chain trigger risk, and incremental harm. Four-dimensional data of each intelligent agent node is collected. The four-dimensional data includes historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability, and the four-dimensional data are quantified into standardized scores. The four standardized scores are substituted into a fixed-weight node trustworthy handling capability scoring formula to calculate the comprehensive trustworthy score of each intelligent node. The task urgency is determined according to the risk level and the four prediction indicators, and the intelligent agent node with the optimal comprehensive trustworthy score is adaptively selected as the target node for handling the task. The intelligent agent node, acting as the target node, performs graded closed-loop handling operations according to the risk level, records the entire handling process and the generated data, and performs retesting and verification on the repaired vulnerability to confirm whether the vulnerability has been closed-loop.

[0023] This disclosure presents a distributed collaborative governance method and system for AI vulnerabilities based on multi-agent systems. Through a differential privacy noise injection mechanism, data anonymization is performed locally, ensuring that the original data never leaves the local machine, thus eliminating the risk of privacy leaks associated with centralized architectures. Simultaneously, this disclosure employs a dynamic weighted aggregation mechanism based on trustworthiness, calculating weights in real-time based on the historical detection accuracy and trustworthiness level of each node. This ensures that high-quality nodes occupy higher weights in the global model, preventing low-quality nodes from lowering model accuracy. Furthermore, this disclosure utilizes a five-dimensional fixed-weight quantification system, comprehensively scoring vulnerabilities based on five dimensions: exploitability, severity, spread speed, asset importance, and remediation difficulty, precisely matching the characteristics of AI vulnerabilities. Combined with Bayesian time-series inference, the scope of vulnerability spread and escalation probability are predicted in advance, shortening response time for high-risk vulnerabilities. Finally, this disclosure employs a trust game quantification mechanism, comprehensively evaluating node capabilities based on four dimensions: detection accuracy, response timeliness, computing power sufficiency, and compliance stability. This automatically matches high-risk vulnerabilities to the optimal node, avoiding delays in manual scheduling and resource misallocation. Furthermore, this disclosure utilizes an incremental iteration mechanism based on experience packages, encapsulating each governance experience and synchronizing it across the entire network. This drives continuous updates to the local models and knowledge graphs of each node, reducing the recurrence rate of similar vulnerabilities and achieving a shift from "passive repair" to "proactive defense and autonomous evolution." Moreover, this disclosure employs a decentralized P2P network, eliminating central bottlenecks. New nodes can be added and their capabilities synchronized without global downtime, making it compatible with various AI system deployments.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0025] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 This is a flowchart of a distributed collaborative governance method for AI vulnerabilities based on multiple agents, as described in one embodiment of this disclosure. Figure 2 This is a schematic diagram of the structure of a distributed collaborative governance system for AI vulnerabilities based on multiple agents, according to one embodiment of this disclosure. Detailed Implementation

[0026] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0027] The technical solution of this disclosure will be described below through specific embodiments.

[0028] like Figure 1 The diagram shown is a flowchart of the distributed collaborative governance method and system for AI vulnerabilities based on multi-agent systems in this embodiment. The execution subject of this embodiment is a computing device or component with data processing capabilities. Specifically, the method of this embodiment may include the following steps: S1. Build a decentralized P2P network, deploy six types of decoupled intelligent agents, complete trusted authentication for each intelligent agent node, and construct a privacy-cooperative cluster.

[0029] S2. Each intelligent agent node collects local AI core operation data and uses a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the data, generating a desensitized standardized AI security dataset. The original data is stored locally throughout the process and does not participate in any cross-node transmission or centralized aggregation.

[0030] Specifically, the customized differential privacy mechanism adopts the following formula:

[0031] in, The desensitized and standardized AI security dataset is defined as follows: D is the local AI core running data, μ is fixed at 0, and b is an adaptive noise scale parameter with a value range limited to [0.01, 0.1].

[0032] Feature retention constraints are applied to high-frequency feature dimensions of AI vulnerabilities, so that vulnerability anomaly features, model defect features and chain risk features are retained, while noise is masked only for user privacy, institutional confidentiality and traceable plaintext information.

[0033] To address the common industry-wide technical contradictions in existing technologies for cross-node AI vulnerability collaborative governance, such as cross-domain transmission of raw plaintext data, insufficient privacy protection, loss of vulnerability features due to excessive desensitization, and the inability to balance compliance and governance accuracy, this disclosure designs and adopts a customized Laplace differential privacy desensitization mechanism. Unlike general, indiscriminate global desensitization methods, this solution is specifically adapted and optimized for AI vulnerability governance scenarios. Through refined and controllable noise injection methods, it strictly constrains the noise distribution parameter range, achieving the core technical effect of "desensitization without losing vulnerability features, data remaining local and not leaving the domain, and absolute privacy control." This module serves as the foundational support module for the entire distributed collaborative architecture. All participating governance nodes independently complete local data security processing. There is no cross-node uploading or centralized aggregation of any raw AI operation logs, model inference data, asset confidential information, or original vulnerability feature data, eliminating the risk of leakage from the data source. Meanwhile, this module implements a feature-preservation-first desensitization strategy for various AI-specific vulnerability data, such as abnormal large model parameters, defects in inference links, abnormal computing power scheduling, and algorithm logic vulnerabilities. It protects the feature dimensions that play a key role in vulnerability identification and only masks noise for user privacy, institutional confidentiality, and traceable plaintext information, thus completely solving the technical bottleneck of traditional technologies that "either leak privacy or desensitization fails".

[0034] This disclosure precisely disrupts the recoverability of individual information in the original dataset through a zero-mean, scale-controlled Laplace noise perturbation method. This prevents external attackers and collaborating nodes from reverse-engineering the original classified content through shared data, fully meeting the requirements for data minimization, localization, and privacy anonymization compliance. Furthermore, this solution does not perform indiscriminate obfuscation; instead, it imposes feature retention constraints on high-frequency feature dimensions of AI vulnerabilities. This ensures that subsequent vulnerability detection models can still accurately extract vulnerability anomaly features, model defect features, and chain risk features. It overcomes the technical shortcomings of traditional global anonymization and fixed-threshold anonymization methods, which lead to vulnerability feature attenuation, significant decrease in detection accuracy, and complete failure to detect hidden vulnerabilities. While ensuring overall data compliance and security, it maximizes the retention of effective data features required for AI vulnerability governance, providing a reliable data foundation for subsequent cross-node federated collaborative detection and risk quantification assessment.

[0035] S3. Each intelligent agent node independently trains a local detection model based on the local de-identified standardized AI security dataset, generating its own model gradient parameters. Each node uploads the model gradient parameters to the comprehensive governance module, which dynamically weights and aggregates them based on node credibility to generate a global detection model. Each node downloads the global detection model and uses it to perform vulnerability scanning on the local de-identified dataset to obtain a set of vulnerability instances.

[0036] Specifically, the dynamic weighted federated aggregation adopts the following formula:

[0037] in, Here are the parameters for the global detection model, and N is the number of agent nodes. Let be the model gradient parameters of the local detection model for the i-th agent node. is the dynamic weight coefficient of the i-th agent node, which is calculated in real time based on the historical detection accuracy, reliability level and operational stability of the agent node; nodes with high detection accuracy and strong governance compliance receive higher weight assignments in the global model update.

[0038] Existing single-point vulnerability detection technologies are limited by the small amount of local sample data, the limited range of vulnerability scenarios, and the scarcity of new vulnerability samples. This results in extremely poor identification capabilities for AI hidden vulnerabilities, complex chain vulnerabilities, and model-backdoor vulnerabilities. Traditional centralized collaborative detection, on the other hand, poses data aggregation privacy risks. To address these dual technical pain points, this disclosure abandons the centralized data aggregation architecture and builds a horizontal federated distributed collaborative detection framework for AI vulnerability scenarios. The overall architecture adopts the technical logic of "multi-node local independent training, lightweight parameter cross-domain collaboration, and global model iterative aggregation." The raw data of all governance nodes always resides locally and does not participate in any cross-network transmission. Only the gradient update parameters and vulnerability feature weight parameters after model training are encrypted and aggregated for updating. Unlike the average aggregation logic of general federated learning, this disclosure introduces a dynamic weighting mechanism based on node trust level. It adjusts the aggregation weight in real time based on the historical governance performance of each node, achieving priority fusion of high-quality nodes, highly reliable data, and high-frequency effective vulnerability features. This addresses the problems of isolated single-point data, insufficient sample coverage, and weak identification capabilities for new vulnerabilities at the architectural level, significantly improving the completeness and accuracy of AI vulnerability detection across the entire domain.

[0039] Traditional federated aggregation often uses an equal-weighted average update method, which cannot distinguish between node data quality and governance reliability. Inferior nodes, low-sample nodes, and low-accuracy nodes will lower the accuracy of the global model. This publication presents a unique dynamic weighted aggregation logic based on credibility, which gives higher weight to highly credible nodes with high detection accuracy, stable response, and strong governance compliance in global model updates. This allows the global model to prioritize learning high-quality AI vulnerability features, new vulnerability samples, and complex vulnerability patterns. Simultaneously, this architecture supports asynchronous iteration and incremental updates across multiple nodes without requiring unified shutdown for training. It adapts to the differentiated node operating states of different institutions, computing power, and business scenarios. While ensuring absolute privacy and security, it achieves complementary fusion of vulnerability features across the entire network, effectively solving multiple technical challenges such as high false negative rates in traditional single-point detection, low accuracy in traditional federated models, and significant privacy risks in centralized detection.

[0040] S4. For each vulnerability instance, collect the underlying observation data of the five-dimensional risk indicators from multiple data sources, map them into five-dimensional standardized scores according to the graded scoring rules, and substitute the five-dimensional standardized scores into the fixed-weight comprehensive risk score formula to calculate the comprehensive risk score. Determine the risk level of the vulnerability based on the comprehensive risk score.

[0041] Specifically, the five-dimensional standardized scoring includes: S1 vulnerability exploitability score, S2 vulnerability severity score, S3 vulnerability spread rate score, S4 importance of associated AI assets score, and S5 vulnerability remediation difficulty score.

[0042] The formula for the fixed-weight comprehensive risk score is as follows:

[0043] The weighting ratio has been iteratively optimized through a large number of AI vulnerability test samples, and is specifically adapted to the unique characteristics of AI vulnerabilities, such as chain propagation, ease of exploitation, and high harm.

[0044] The five-dimensional standardized score is generated through a four-step process: bottom-level multi-sub-indicator collection → hierarchical scoring → weighted normalization calibration → expert cross-review. Specifically: The S1 vulnerability exploitability score has sub-indicators including attack threshold, attack success rate and exploitation propagation threshold. Each sub-indicator is graded and scored in three ranges: high score (80-100 points), medium score (40-79 points) and low score (0-39 points).

[0045] The S2 vulnerability severity rating system includes sub-indicators such as data impact, business impact, and compliance impact. Each sub-indicator is graded and scored according to a high score range (80-100 points), a medium score range (40-79 points), and a low score range (0-39 points).

[0046] The S3 vulnerability propagation speed score includes sub-indicators such as module interoperability, propagation channels and historical propagation data. Each sub-indicator is graded and scored according to a high score range (80-100 points), a medium score range (40-79 points) and a low score range (0-39 points).

[0047] The S4-related AI asset importance score includes sub-indicators such as asset grade, business irreplaceability, and asset coverage. Each sub-indicator is graded and scored according to a high score range (80-100 points), a medium score range (40-79 points), and a low score range (0-39 points).

[0048] The S5 vulnerability remediation difficulty score includes sub-indicators such as root cause complexity, downtime cost, and upstream and downstream dependencies. Each sub-indicator is graded and scored according to a high score range (80-100 points), a medium score range (40-79 points), and a low score range (0-39 points).

[0049] The initial scoring results need to be cross-verified by at least two AI security experts. If the deviation exceeds ±10 points, the original observation data needs to be traced back and recalculated.

[0050] The risk level classification standard is as follows: S≥80 is high risk, 40≤S<80 is medium risk, and S<40 is low risk.

[0051] S5. For each vulnerability instance, map the comprehensive risk score to the risk state probability distribution at the current moment; dynamically construct the state transition probability matrix based on the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, perform dynamic Bayesian time series deduction on the risk state probability distribution, predict the probability that the vulnerability instance will be in each risk state at the next moment, and calculate four prediction indicators based on the calculated probabilities.

[0052] Specifically, the risk state is discretely defined as four mutually exclusive states: latent state, locally triggered state, laterally spreading state, and global uncontrolled state.

[0053] The dynamic Bayesian time series inference uses the following formula:

[0054] in, and These represent the probability distributions of the risk status of the vulnerable instance at time t and time t+1, respectively. The vulnerable instance is in state at time t. The posterior probability is calculated from the comprehensive risk score, real-time monitoring and alarm data, and asset connectivity topology. The state transition probability is generated dynamically by the AI ​​vulnerability knowledge graph based on asset connectivity, module coupling degree, and historical vulnerability propagation samples. To deduce the probability that the output vulnerability will be in each risk state at time t+1.

[0055] The AI ​​vulnerability knowledge graph contains three core entities: AI computing power nodes, large model instances, and vulnerability instances. The relationships between entities include node connectivity, model dependency, and vulnerability chain triggering. The graph topology is read to obtain the assets currently affected by the vulnerability, adjacent connected assets, and AI services with dependency calls. Combined with historical samples of similar vulnerability handling and the diffusion speed S3 and asset importance S4 in the five-dimensional indicators, the transition probability is dynamically assigned. After each vulnerability handling is completed, the actual evolution results are fed back to correct the transition probability, realizing dynamic self-adaptation of the matrix.

[0056] The four predictive indicators include: The probability of vulnerability escalation is the sum of the probability corresponding to the lateral spread state and the probability corresponding to the global loss of control state.

[0057] To predict the future spread of the vulnerability, when the probability of the vulnerability escalation exceeds a preset threshold, the system will traverse all nodes in the AI ​​vulnerability knowledge graph that are connected to the victim assets, and predict the list and number of AI assets that will be affected.

[0058] Chain-triggered risk: Retrieve associated vulnerabilities in the AI ​​vulnerability knowledge graph that have a linkage triggering relationship with the current vulnerability instance, and use the state transition probability matrix to calculate the joint probability of activating the associated vulnerabilities.

[0059] The incremental harm is calculated by weighting and summing the asset importance scores corresponding to the predicted list of AI assets to be affected, combined with the predicted probability of the vulnerability instance spreading to each asset.

[0060] The calculations obtained this time As the initial stage of the next round of simulation We continuously roll out and extrapolate longer time windows to form a continuous time-series risk prediction curve.

[0061] Risk assessment is a core and crucial step in AI vulnerability governance. Existing industry technologies generally employ crude methods such as generic vulnerability scoring standards, single-dimensional scoring, and manual experience-based rating. These methods suffer from flaws including vague weighting logic, missing dimensions, poor adaptability, and a lack of dynamic extrapolation capabilities, failing to adapt to the unique characteristics of AI vulnerabilities: "strong concealment, chain-like spread, dynamic evolution, and cross-module linkage." None of the publicly available technologies have designed a dedicated quantification system for large AI models, intelligent algorithms, and computing cluster scenarios, nor do they offer a complete technical solution combining fixed weight ratios with time-series dynamic prediction. This publicly available technology is a unique five-dimensional fixed-weight risk quantification system adapted to the characteristics of AI vulnerabilities, combined with a Bayesian time-series dynamic extrapolation mechanism. This is a core innovative technology designed entirely independently, without any prior technological inspiration. It fundamentally changes the traditional static, one-sided, and crude vulnerability rating model, achieving refined, standardized, time-series-based, and predictable vulnerability risk assessment.

[0062] This disclosure employs a five-dimensional fixed-weight quantification formula to standardize and weight the core factors influencing the severity of AI vulnerabilities. The weighting ratios have been iteratively optimized using numerous real-world AI vulnerability test samples, precisely aligning with the harm patterns of emerging vulnerabilities such as large model parameter tampering, inference bypass, model backdoors, and chain-like vulnerability propagation. This differs from the generic, fixed traditional scoring system, exhibiting strong scenario-specific relevance. Simultaneously, a dynamic Bayesian temporal inference mechanism is introduced, relying on a locally dynamically updated AI vulnerability knowledge graph to construct a vulnerability state transition probability matrix. This matrix predicts the future spread range, escalation probability, incremental harm, and chain-triggered risk of vulnerabilities, achieving a leapfrog technological advancement from "post-event static rating" to "in-event dynamic monitoring + pre-event trend prediction." This mechanism can identify potential global propagation risks in advance, overcoming the fatal shortcoming of existing technologies that can only passively handle situations and cannot provide early warnings, producing unexpected technical effects beyond conventional technological improvements.

[0063] S6. Collect four-dimensional data of each intelligent agent node, including historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability, and quantify them into standardized scores. Substitute the four standardized scores obtained into the node trustworthiness assessment formula with fixed weights to calculate the comprehensive trustworthiness score of each intelligent node. Determine the urgency of the task based on the risk level and the four prediction indicators, and adaptively select the intelligent agent node with the best comprehensive trustworthiness score as the target node for handling the task.

[0064] Specifically, the formula for scoring the node's trusted processing capability is as follows:

[0065] in, The comprehensive trust score of the i-th smart node (0-100 points, the higher the score, the more suitable the node is to undertake high-risk vulnerability handling tasks). The historical detection accuracy score is given. The average emergency response time score is given. The computing power adequacy score is given. The compliance stability scores are β1=0.4, β2=0.3, β3=0.15, and β4=0.15, prioritizing the two core emergency requirements of detection accuracy and response time.

[0066] The calculation method is: count all vulnerability detection events of this node in the last 90 days, where accuracy rate = (number of true vulnerability detections / (number of true vulnerability detections + number of false vulnerability positives)) × 100%, then perform segmented scoring according to the rules that an accuracy rate ≥95% corresponds to 90-100 points, 80% ≤ accuracy rate <95% corresponds to 70-89 points, 60% ≤ accuracy rate <80% corresponds to 50-69 points, and an accuracy rate <60% corresponds to less than 50 points, and make a fine adjustment of ±5 points in combination with the detection proportion of similar high-risk vulnerabilities.

[0067] The calculation method is: count the average time t (unit: minute) from the moment this node receives a task instruction to the completion of the first disposal action, perform segmented scoring according to the rules that t ≤ 2 minutes corresponds to 90-100 points, 2 < t ≤ 10 minutes corresponds to 70-89 points, 10 < t ≤ 30 minutes corresponds to 50-69 points, and t > 30 minutes corresponds to less than 50 points, and set a timeliness tolerance correction coefficient for night or holiday scenarios.

[0068] The calculation method is: calculate the ratio θ of the current idle security computing power of this node to the peak available security computing power, where θ = (current idle computing power resources / maximum computing power quota for node security services) × 100%, and perform segmented scoring according to the rules that θ > 70% corresponds to 90-100 points, 40% ≤ θ <70% corresponds to 70-89 points, 15% ≤ θ <40% corresponds to 50-69 points, and θ <15% corresponds to less than 50 points.

[0069] The calculation method is: count the node's dishonesty or non-compliance events in the past six months based on a distributed ledger, adopt a benchmark point deduction system with an initial benchmark score of 100 points, deduct 3-5 points for each minor non-compliance event, deduct 20-40 points at a time for each serious dishonesty or data leakage event, with a minimum score of 0 points, and automatically add back 2 points per month for long-term non-violation, with a maximum score not exceeding 100 points.

[0070] The rules for adaptively selecting a target node include: for a vulnerability instance with a high risk level and a vulnerability escalation probability greater than 50%, select the intelligent node with the highest comprehensive trust score as the target node; for a vulnerability instance with a high risk level and a future spread range covering more than 3 intelligent nodes, select the intelligent node with the highest comprehensive trust score as the target node; for a vulnerability instance with a medium risk level, select the intelligent node with the highest computing power carrying sufficiency among the top three intelligent nodes in the comprehensive trust score ranking as the target node; for a vulnerability instance with a low risk level, select the intelligent node with a comprehensive trust score of no less than 60 points and the lowest current task load as the target node.

[0071] Existing cross-entity vulnerability collaborative governance generally suffers from problems such as chaotic scheduling logic, arbitrary task allocation, unclear priority for handling high-risk vulnerabilities, and mismatch between node capabilities and vulnerability levels. Most solutions rely on manual experience or simple random allocation, lacking standardized, quantifiable, and intelligent collaborative scheduling criteria. This easily leads to situations where high-risk vulnerability handling is delayed, low-risk vulnerabilities consume valuable governance resources, node capabilities are wasted, and overall governance efficiency is low. To address the aforementioned technical deficiencies of disordered collaboration, this disclosure presents a unique trust game-driven node credibility capability quantification and adaptive intelligent scheduling mechanism. By quantifying the comprehensive handling capabilities of each governance node through multi-dimensional indicators and combining real-time vulnerability risk levels, propagation trends, and asset importance, it achieves precise matching of vulnerability handling tasks with optimal governance nodes, constructing a highly reliable, efficient, and adaptive network-wide collaborative scheduling logic.

[0072] This disclosure prioritizes the core requirements of vulnerability governance—accuracy and response time—by setting normalized weight ratios. It quantifies the long-term governance performance of nodes using a trust game theory approach, avoiding the bias caused by a single indicator. This disclosure maintains the trustworthiness scores of all nodes across the network in real time and dynamically updates node resource priorities. In complex scenarios with multiple concurrent vulnerabilities and multiple online nodes, it can automatically distinguish between vulnerability risk levels and node handling capabilities. High-risk, high-proliferation, and high-asset-impact vulnerabilities are prioritized for allocation to high-trust, high-accuracy, and high-response-speed nodes, while routine low-risk vulnerabilities are allocated to general governance nodes, achieving optimal allocation of governance resources across the entire network. This completely solves the shortcomings of traditional technologies, such as delayed manual scheduling, disordered random scheduling, resource misallocation, and untimely handling of high-risk vulnerabilities, significantly improving overall emergency governance capabilities and collaborative efficiency.

[0073] S7. The intelligent agent node, acting as the target node, performs a graded closed-loop handling operation according to the risk level, records the entire handling operation and the generated data, and performs a retest and verification on the repaired vulnerability to confirm whether the vulnerability is closed-loop.

[0074] Specifically, for high-risk vulnerabilities, emergency measures such as model rollback, traffic interception, permission freezing, and patch deployment are performed; for medium- and low-risk vulnerabilities, routine hardening measures are performed; an immutable record of the entire process is maintained, and after the measures are completed, retesting and verification are performed to confirm whether the vulnerability has been completely closed.

[0075] S8. Periodically summarize the governance experience generated by each intelligent node during the disposal process, and generate incremental parameters after screening and structured encapsulation. Each node performs incremental iterative updates to the local detection model based on the incremental parameters at a fixed learning rate.

[0076] The governance experience generated by each intelligent agent node during the handling process is periodically summarized, including successful handling cases, novel characteristics of vulnerabilities, false positives and false negatives, optimal remediation strategies and failure handling experience. After screening, cleaning and structured encapsulation, lightweight encrypted incremental parameters are generated. The entire network is synchronized through a step-by-step diffusion method of P2P neighbor nodes. Each node performs incremental iterative updates to the local detection model based on the incremental parameters at a fixed learning rate.

[0077] Specifically, the incremental iterative update of the model adopts the following formula:

[0078] in, For the updated model parameters, The model parameters before the update are set, with the iterative learning rate η fixed at 0.02. Incremental parameters representing the optimal governance experience across the entire network.

[0079] This disclosure uses an incremental iteration formula with a fixed optimal learning rate to ensure stable and controllable model iteration, preventing parameter oscillations and model failure. It periodically summarizes successful handling cases, novel vulnerability characteristics, false positives and false negatives, optimal remediation strategies, and failure handling experience from across the network. After screening, cleaning, and structured encapsulation, this data forms a lightweight, encrypted experience package, which is synchronized across the network through a step-by-step P2P neighbor node distribution, eliminating the need for a central node for forwarding and management. Each node incrementally fine-tunes its local detection model parameters, updates its vulnerability rule base, and iterates the knowledge graph topology based on the network-wide experience. This allows each governance action to empower system capability upgrades, continuously reducing the recurrence rate and false negative rate of similar vulnerabilities. This achieves a technological upgrade from "passive vulnerability repair" to "proactive defense, autonomous iteration, and continuous evolution," constructing a long-term governance closed loop that is completely lacking in existing technologies.

[0080] This disclosure achieves unexpected technical effects that are impossible to achieve with existing technologies through the aforementioned original coupling technical architecture, demonstrating significant creative progress: 1. A breakthrough in both compliance and security: Unlike centralized architectures that pose privacy risks, this invention enables the complete local retention of raw data, balancing cross-entity collaboration capabilities with data compliance requirements, thus resolving a long-standing technical contradiction in the industry.

[0081] 2. Significantly improved vulnerability identification accuracy: Dynamic weighted federated aggregation and fusion of multi-node hidden vulnerability features significantly reduces the false positive and false negative rates of new AI-based vulnerabilities compared to single-point detection, and improves detection accuracy by more than 35%.

[0082] 3. Leapfrog upgrade in risk assessment dimensions: Breaking through the limitations of traditional static rating, it pioneered an AI vulnerability-specific five-dimensional fixed weight system + time-series prediction mechanism, which can accurately identify chain spread risks, intercept the spread of high-risk vulnerabilities in advance, and shorten the response time of high-risk vulnerabilities by 60%.

[0083] 4. Optimal efficiency of collaborative governance: Trust game-based intelligent scheduling enables precise resource matching, eliminates resource waste and delays in handling, and significantly improves cross-entity collaborative efficiency.

[0084] 5. Self-evolving long-term governance capabilities: The closed-loop iteration mechanism across the entire network continuously accumulates governance experience, reducing the recurrence rate of similar vulnerabilities by 40%, and achieving a technological upgrade from "passive handling" to "proactive defense and self-optimization".

[0085] 6. Highly adaptable and scalable: The decentralized architecture supports dynamic node expansion, can be adapted to vulnerability governance of all types of AI systems, and has strong industrial applicability.

[0086] Based on the same inventive concept, this disclosure provides a distributed collaborative governance system for AI vulnerabilities based on multiple agents. The steps executed by the components of this system are the same as or similar to the methods described above, therefore, similar aspects will not be repeated. Figure 2 As shown, the AI ​​vulnerability distributed collaborative governance system based on multiple agents in this embodiment includes: multiple agents 201 and a comprehensive governance module 202.

[0087] Each agent node 201 collects local AI core operation data; each agent node uses a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the local AI core operation data to generate a desensitized standardized AI security dataset; each agent node independently trains a local detection model based on the local desensitized standardized AI security dataset.

[0088] The comprehensive governance module 202 is used to participate in federated aggregation of the model gradient parameters of the local detection model, generate a global detection model through dynamic weighted aggregation based on node credibility, and perform vulnerability scanning on the local de-identified dataset using the global detection model to obtain a set of vulnerability instances. For each vulnerability instance, the underlying observation data of the five-dimensional risk indicators are collected from multiple data sources, mapped to five-dimensional standardized scores, and the five-dimensional standardized scores are substituted into the fixed-weight comprehensive risk scoring formula to calculate the comprehensive risk score. The risk level of the vulnerability is determined based on the comprehensive risk score. For each vulnerability instance, the comprehensive risk score is mapped to the risk state probability distribution at the current moment. Based on the state transition probability matrix dynamically constructed using the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, the risk state probability is determined. The probability distribution performs dynamic Bayesian time-series inference to predict the probability that the vulnerability instance will be in each risk state at the next moment, and calculates four prediction indicators based on the calculated probabilities. The four prediction indicators include vulnerability escalation probability, future spread range, chain trigger risk, and incremental harm. Four-dimensional data of each intelligent agent node is collected. The four-dimensional data includes historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability, and the four-dimensional data are quantified into standardized scores. The four standardized scores are substituted into a node trustworthy handling capability scoring formula with fixed weights to calculate the comprehensive trustworthiness score of each intelligent node. The task urgency is determined according to the risk level and the four prediction indicators, and the intelligent agent node with the best comprehensive trustworthiness score is adaptively selected as the target node for handling the task. The intelligent agent node 201, acting as the target node, performs a graded closed-loop handling operation based on the risk level, records the entire handling operation and the generated data, and performs retesting and verification on the repaired vulnerability to confirm whether the vulnerability has been closed-loop.

[0089] The various embodiments of the techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0090] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0092] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0093] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0094] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0095] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0096] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A distributed collaborative governance method for AI vulnerabilities based on multi-agent systems, characterized in that, Includes the following steps: Each intelligent agent node collects local AI core operation data; Each of the aforementioned intelligent agent nodes utilizes a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the local AI core operating data, generating a desensitized standardized AI security dataset; Each of the aforementioned intelligent agent nodes independently trains a local detection model based on the local de-identified standardized AI security dataset. The model gradient parameters of the local detection model are used in federated aggregation. A global detection model is generated through dynamic weighted aggregation based on node credibility. The global detection model is then used to perform vulnerability scanning on the local de-identified dataset to obtain a set of vulnerability instances. For each vulnerability instance, underlying observation data of the five-dimensional risk indicators are collected from multiple data sources, mapped to five-dimensional standardized scores, and the five-dimensional standardized scores are substituted into the fixed-weight comprehensive risk score formula to calculate the comprehensive risk score. The risk level of the vulnerability is determined based on the comprehensive risk score. For each vulnerability instance, the comprehensive risk score is mapped to the risk state probability distribution at the current moment. Based on the state transition probability matrix dynamically constructed using the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, dynamic Bayesian time series inference is performed on the risk state probability distribution to predict the probability of the vulnerability instance being in each risk state at the next moment. Based on the calculated probabilities, four prediction indicators are calculated. The four prediction indicators include vulnerability escalation probability, future spread range, chain trigger risk, and incremental harm. Collect four-dimensional data from each of the aforementioned intelligent agent nodes; the four-dimensional data includes historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability, and quantify the four-dimensional data into standardized scores respectively; The four standardized scores obtained by quantification are substituted into the node trustworthiness handling capability scoring formula with fixed weights to calculate the comprehensive trustworthiness score of each intelligent node. The urgency of the task is determined according to the risk level and the four prediction indicators. The intelligent agent node with the best comprehensive trustworthiness score is adaptively selected as the target node for handling the task. The target node performs a graded closed-loop handling operation according to the risk level, records the entire handling operation and the generated data, and performs retesting and verification on the repaired vulnerability to confirm whether the vulnerability has been closed.

2. The method according to claim 1, characterized in that, The customized differential privacy mechanism uses the following formula: in, The de-identified standardized AI security dataset is defined as follows: D is the local AI core running data, μ is the location parameter, and b is the adaptive noise scale parameter, with a value range limited to [0.01, 0.1].

3. The method according to claim 1, characterized in that, The parameters of the global detection model are as follows: in, Here are the parameters of the global detection model, where N is the number of agent nodes. Let be the model gradient parameters of the local detection model for the i-th agent node. The dynamic weight coefficient of the i-th agent node is calculated in real time based on the historical detection accuracy, reliability level, and operational stability of the agent node.

4. The method according to claim 1, characterized in that, The formula for the fixed-weight comprehensive risk score is as follows: in, For the comprehensive risk score, Score the exploitability of the vulnerability; Rate the severity of the vulnerability; Rate the speed at which the vulnerability spreads; Assess the importance of associated AI assets; Rate the difficulty of patching the vulnerability.

5. The method according to claim 4, characterized in that, The formula used in the dynamic Bayesian time series deduction is as follows: in, and These represent the probability distributions of the risk states of the vulnerability instance at time t and time t+1, respectively. The risk states are discretely defined as latent state, local triggering state, lateral spread state, and global uncontrolled state. The vulnerable instance is in state at time t. The posterior probability is calculated from the comprehensive risk score, real-time monitoring and alarm data, and asset connectivity topology. The state transition probability is generated dynamically by the AI ​​vulnerability knowledge graph based on asset connectivity, module coupling degree, and historical vulnerability diffusion samples. To extrapolate the probability that the output vulnerability will be in each risk state at time t+1.

6. The method according to claim 5, characterized in that, The vulnerability escalation probability is the sum of the probability corresponding to the lateral spread state and the probability corresponding to the global loss of control state; The future diffusion range is defined as follows: when the probability of the vulnerability escalation exceeds a preset threshold, the set of all nodes in the AI ​​vulnerability knowledge graph that are connected to the victim assets is traversed to predict the list and quantity of AI assets that will be affected. The chain-triggered risk is to retrieve associated vulnerabilities in the AI ​​vulnerability knowledge graph that have a linkage triggering relationship with the current vulnerability instance, and to calculate and activate the joint probability of the associated vulnerabilities using the state transition probability matrix. The incremental harm is a weighted sum of the asset importance scores corresponding to the predicted list of AI assets to be affected, combined with the predicted probability of the vulnerability instance spreading to each asset.

7. The method according to claim 1, characterized in that, The formula for scoring the node's trusted processing capability is as follows: in, Let be the comprehensive trust score of the i-th intelligent node. The historical detection accuracy score is given. The average emergency response time score is given. The computing power adequacy score is given. The compliance stability score is given.

8. The method according to claim 7, characterized in that, The adaptive selection of the agent node with the optimal comprehensive credibility score as the target node for handling the task includes: For vulnerability instances with a risk level of high risk and a vulnerability escalation probability greater than 50%, the smart node with the highest comprehensive trust score is selected as the target node. For vulnerability instances with a risk level of high risk and a future spread range exceeding 3 smart nodes, the smart node with the highest comprehensive trust score is selected as the target node. For the vulnerability instance with a risk level of medium, the intelligent node with the highest computing power sufficiency among the top three intelligent nodes in terms of comprehensive trust score is selected as the target node. For vulnerability instances classified as low-risk, the smart node with a comprehensive trust score of not less than 60 and the lowest current task load is selected as the target node.

9. The method according to claim 1, characterized in that, Also includes: The governance experience generated by each intelligent node during the handling process is periodically summarized, and after screening and structured encapsulation, incremental parameters are generated. Each node performs incremental iterative updates to the local detection model based on the incremental parameters at a fixed learning rate.

10. A distributed collaborative governance system for AI vulnerabilities based on multi-agent systems, characterized in that, Includes multiple intelligent agents and a comprehensive governance module; Each intelligent agent node collects local AI core operation data; each intelligent agent node uses a customized differential privacy mechanism to perform noise perturbation and desensitization processing on sensitive dimensions in the local AI core operation data to generate a desensitized standardized AI security dataset; each intelligent agent node independently trains a local detection model based on the local desensitized standardized AI security dataset; The comprehensive governance module is used to participate in the federated aggregation of the model gradient parameters of the local detection model, generate a global detection model through dynamic weighted aggregation based on node credibility, and use the global detection model to perform vulnerability scanning on the local de-identified dataset to obtain a set of vulnerability instances. For each vulnerability instance, underlying observation data of the five-dimensional risk indicators are collected from multiple data sources, mapped to five-dimensional standardized scores, and the five-dimensional standardized scores are substituted into the fixed-weight comprehensive risk score formula to calculate the comprehensive risk score. The risk level of the vulnerability is determined based on the comprehensive risk score. For each vulnerability instance, the comprehensive risk score is mapped to the risk state probability distribution at the current moment. Based on the state transition probability matrix dynamically constructed using the asset topology and vulnerability association relationship in the AI ​​vulnerability knowledge graph, dynamic Bayesian time series inference is performed on the risk state probability distribution to predict the probability of the vulnerability instance being in each risk state at the next moment. Based on the calculated probabilities, four prediction indicators are calculated. The four prediction indicators include vulnerability escalation probability, future spread range, chain trigger risk, and incremental harm. Four-dimensional data of each of the intelligent agent nodes are collected. The four-dimensional data includes historical detection accuracy, average emergency response time, computing power adequacy, and compliance stability. The four-dimensional data are quantified into standardized scores. The four standardized scores obtained by quantification are substituted into the node trustworthiness handling capability scoring formula with fixed weights to calculate the comprehensive trustworthiness score of each intelligent node. The urgency of the task is determined according to the risk level and the four prediction indicators. The intelligent agent node with the best comprehensive trustworthiness score is adaptively selected as the target node for handling the task. The intelligent agent node, acting as the target node, performs graded closed-loop handling operations according to the risk level, records the entire handling process and the generated data, and performs retesting and verification on the repaired vulnerability to confirm whether the vulnerability has been closed-loop.

Images