An automatic Chinese adversarial text generation method and system based on a large language model

Abstract

The application relates to an automatic Chinese confrontation text generation method and system based on a large language model, and belongs to the technical field of information security. The steps are as follows: (1) performing word importance sorting based on an LLM. Since the answer given by the LLM has randomness, multiple rounds of repeated inquiries are performed to obtain relatively accurate and stable sorting results. Since the result of each round of answer given by the LLM is in the form of words, the importance score corresponding to each word cannot be given, and the important words given in each round are scored; (2) adding disturbance based on the LLM. The application disassembles word symbol level confrontation text generation into two subtasks, namely word importance sorting and disturbance addition. By letting the LLM participate in the two subtasks in turn, the LLM covers the whole process of the confrontation text generation method, so that each subtask can be processed more carefully and effectively, and the generation threshold of the confrontation text is reduced.

Description

Technical Field

[0001] This invention relates to an automated Chinese adversarial text generation method and system based on a large language model, belonging to the field of information security technology. Background Technology

[0002] Adversarial text is a malicious sample that introduces subtle perturbations into the original text, which can trigger incorrect predictions from the target model. Researching adversarial text generation methods can evaluate the adversarial robustness of various deep learning models, including the currently popular Large Language Model (LLM), and lay a solid foundation for the design of subsequent defenses. LLM-based adversarial text generation methods can generate adversarial text with higher fluency. However, current methods often treat this problem as a whole or only involve LLM in a sub-task, which may result in the problem not being handled more meticulously and effectively or not being able to achieve full automation based on LLM. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides an automated Chinese adversarial text generation method and system based on a large language model. The method decomposes word-level adversarial text generation into two sub-tasks: word importance ranking and perturbation addition. By having an LLM (Large Language Model) participate in these two sub-tasks sequentially, it covers the entire process of the adversarial text generation method. This allows for more detailed and effective handling of each sub-task while lowering the threshold for adversarial text generation.

[0004] Terminology Explanation: LLM: Large Language Model. Existing LLMs are usually based on the Transformer architecture. They learn language rules from a large amount of text and gradually predict and generate the next token based on the input context, thereby completing tasks such as dialogue, writing, and question answering.

[0005] Model architecture: Its core modules include a word segmenter, word vector layer, position information, Transformer layer, self-attention mechanism, feedforward neural network, and output layer.

[0006] Working Process: The LLM works as follows. First, the user inputs a natural language sentence into the LLM; then, the user's input is segmented and converted into word vectors; next, the word vectors are fed into a multi-layered Transformer, allowing the model to adjust its understanding of the input content at each layer based on contextual information; finally, the model obtains a probability distribution and selects the most suitable word for output. By repeating the above steps, the LLM can output multiple words to form the final answer.

[0007] The technical solution of the present invention is as follows: An automated Chinese adversarial text generation method based on a large language model, comprising the following steps: (1) Based on LLM, word importance ranking is performed. Since the answers given by LLM are highly random, multiple rounds of repeated queries are performed to obtain relatively accurate and stable ranking results. Since the results of each round of LLM are presented in the form of words, it is impossible to give the importance score of each word. In order to obtain the final ordered list of word importance, a scoring operation is performed on the important words given in each round. (2) LLM-based perturbation addition.

[0008] According to a preferred embodiment of the present invention, in step (1), the scoring operation uses a scoring method based on an arithmetic sequence.

[0009] According to a further preferred embodiment of the present invention, the specific steps of the scoring operation are as follows: Let the common difference of the arithmetic sequence be... η The list of important words contains m words, and the total number of words in the given text is m. n Let the importance ranking of a certain word be number 1. i The position is then its word importance score. s i Calculated using the following formula: (1) Given the number of rounds of repeated queries r Let the first j During the round of questioning, the text number is... k The importance score of each word is expressed as: s jk If the first k The first word selected for LLM m If the first important word is used, its importance score is calculated according to case one of formula (1); if the second important word is used, its importance score is calculated according to case one of formula (1). k These words were not selected by LLM. m For the first important word, its importance score can be set to 0 according to case two of formula (1). k The word "inquiry" r Total importance score obtained after round I k Calculate using the following formula: (2) The total importance score of the words is normalized to obtain the final score. k Importance score of each word ; Let the number of words that ultimately yield a non-zero importance score be .x ,and x ≥ m Therefore, the final list of words is sorted from highest to lowest importance score, and the top few words are truncated. m An important word, as in r The final list of key terms selected by LLM during the round-robin process.

[0010] According to a preferred embodiment of the present invention, the tolerance η Calculated using the following formula: (3).

[0011] According to the preferred embodiment of the present invention, the importance score The calculation formula is: (4).

[0012] According to a preferred embodiment of the present invention, in step (2), during the word importance ranking stage, LLM selects... m The important words are sorted and ordered. In the important word perturbation stage, perturbation needs to be added to the selected important words based on LLM. In the process of adding perturbation, the following perturbation strategies are mainly applied: shuffling the order of Chinese characters in the words, breaking down Chinese characters into the radicals that make them up, replacing synonyms, replacing similar-looking characters, and replacing homophones.

[0013] An automated Chinese adversarial text generation system based on a large language model includes: The sorting module sorts words based on LLM importance. Since the answers given by LLM are highly random, multiple rounds of repeated queries are performed to obtain a relatively accurate and stable sorting result. Since the results of each round of LLM answers are presented in the form of words, it is impossible to give an importance score for each word. In order to obtain a final ordered list of word importance, a score is assigned to the important words given in each round. The perturbation module adds perturbations based on LLM.

[0014] The beneficial effects of this invention are as follows: This invention decomposes word-level adversarial text generation into two sub-tasks: word importance ranking and perturbation addition. By having LLM participate in these two sub-tasks sequentially, it covers the entire process of the adversarial text generation method, thereby reducing the threshold for adversarial text generation while handling each sub-task more meticulously and effectively. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the method of the present invention. Detailed Implementation

[0016] The present invention will be further described below with reference to the embodiments and accompanying drawings, but is not limited thereto.

[0017] Example 1: This embodiment provides an automated Chinese adversarial text generation method based on a large language model, the steps of which are as follows: (1) LLM-based word importance ranking: The prompt words used in the process of ranking word importance using LLM are as follows: Please provide me with the key words in the following text that might affect the classification results, with the preset categories being: predefined_labels When answering, please select the options according to their importance. m Each word should be separated by a space, and no explanation is required. The given words cannot be combinations of words. in, predefined_labels This refers to the predefined categories of the classification task. It's worth noting that because the responses from LLM are highly random, multiple rounds of repeated queries are performed to obtain relatively accurate and stable ranking results. Since the results of each round of LLM responses are presented in word form, it's impossible to provide an importance score for each word. To facilitate obtaining the final ordered list of word importance, a scoring operation is performed on the important words given in each round. An arithmetic progression-based scoring method is used, and the specific steps are as follows: Let the common difference of the arithmetic sequence be... η Calculated using the following formula: (3) In the formula, m This refers to the number of words contained in the list of important words; The total number of words contained in the given text is n Let the importance ranking of a certain word be number 1. i The position is then its word importance score. s i Calculated using the following formula: (1) Given the number of rounds of repeated queries r Let the first j During the round of questioning, the text number is... k The importance score of each word is expressed as: s jk If the first k The first word selected for LLM m If the first important word is used, its importance score is calculated according to case one of formula (1); if the second important word is used, its importance score is calculated according to case one of formula (1). k These words were not selected by LLM. m If the first important word is selected, its importance score can be set to 0 according to the second case of formula (1). Therefore, for the first important word in the text...k The word "inquiry" r Total importance score obtained after round I k Calculate using the following formula: (2) The total importance score of the words is normalized to obtain the final score. k Importance score of each word for: (4) Let the number of words that ultimately yield a non-zero importance score be . x From formulas (1)-(4), we can see that x ≥ m Therefore, the final list of words is sorted from highest to lowest importance score, and the top few words are truncated. m An important word, as in r The final list of key terms selected by LLM during the round-robin process.

[0018] (2) Based on LLM perturbation addition, in the word importance ranking stage, LLM selects... m The important words are sorted and ordered. In the important word perturbation stage, perturbation needs to be added to the selected important words based on LLM. In the process of adding perturbation, the following perturbation strategies are mainly applied: shuffling the order of Chinese characters in the words, breaking down Chinese characters into the radicals that make them up, replacing synonyms, replacing similar-looking characters, and replacing homophones.

[0019] Taking the news headline classification task as an example, the prompt words used in the process of adding perturbations to words using LLM are as follows: Please assign the following original categories: ground_label The text is perturbed to test the adversarial robustness of deep learning models. The preset categories are... predefined_labels Please only important_words this m Add perturbation to each word. The perturbation strategy can be one or more of the following: shuffling the order of Chinese characters in the word, breaking down the Chinese characters into their constituent radicals, replacing with synonyms, replacing with similar-looking characters, or replacing with homophones. Please provide the text after perturbation without explaining the reason.

[0020] predefined_labels This refers to the predefined categories of the classification task. ground_label The truth labels for the original text. important_words A list of important words selected by LLM during the word importance ranking phase. m This represents the number of words contained in the list of important words.

[0021] Through the two stages described above, the final adversarial text can be obtained based on LLM. Using this adversarial text to attack LLM or other deep learning models allows for a certain understanding of the robustness of the target model under adversarial attacks.

Claims

1. An automated Chinese adversarial text generation method based on a large language model, characterized in that, The steps are as follows: (1) Based on LLM, word importance ranking is performed. Since the LLM response is random, multiple rounds of repeated queries are performed to obtain a relatively accurate and stable ranking result. Since the LLM response in each round is presented in the form of words, it is impossible to give the importance score of each word. In order to obtain the final ordered list of word importance, a score is assigned to the important words given in each round. (2) LLM-based perturbation addition.

2. The automated Chinese adversarial text generation method based on a large language model as described in claim 1, characterized in that, In step (1), the scoring operation uses a scoring method based on arithmetic sequences.

3. The automated Chinese adversarial text generation method based on a large language model as described in claim 2, characterized in that, The specific steps for assigning scores are as follows: Let the common difference of the arithmetic sequence be... η The list of important words contains m words, and the total number of words in the given text is m. n Let the importance ranking of a certain word be number 1. i The position is then its word importance score. s i Calculated using the following formula: （1） Given the number of rounds of repeated queries r Let the first j During the round of questioning, the text number is... k The importance score of each word is expressed as: s jk If the first k The first word selected for LLM m For each important word, its importance score is calculated according to case one of formula (1); If the first k These words were not selected by LLM. m For the first important word, its importance score can be set to 0 according to case two of formula (1). k The word "inquiry" r Total importance score obtained after round I k Calculate using the following formula: （2） The total importance score of the words is normalized to obtain the final score. k Importance score of each word ; Let the number of words that ultimately yield a non-zero importance score be . x ,and x ≥ m Therefore, the final list of words is sorted from highest to lowest importance score, and the top few words are truncated. m An important word, as in r The final list of key terms selected by LLM during the round-robin process.

4. The automated Chinese adversarial text generation method based on a large language model as described in claim 3, characterized in that, tolerance η Calculated using the following formula: （3）。 5. The automated Chinese adversarial text generation method based on a large language model as described in claim 4, characterized in that, Importance score The calculation formula is: （4）。 6. The automated Chinese adversarial text generation method based on a large language model as described in claim 5, characterized in that, In step (2), during the word importance ranking stage, LLM selected... m The important words are sorted and ordered. In the important word perturbation stage, perturbation needs to be added to the selected important words based on LLM. In the process of adding perturbation, the following perturbation strategies are mainly applied: shuffling the order of Chinese characters in the words, breaking down Chinese characters into the radicals that make them up, replacing synonyms, replacing similar-looking characters, and replacing homophones.

7. An automated Chinese adversarial text generation system based on a large language model, characterized in that, include: The sorting module sorts words based on LLM importance. Since the answers given by LLM are random, multiple rounds of repeated queries are performed to obtain a relatively accurate and stable sorting result. Since the results of each round of LLM answers are presented in the form of words, it is impossible to give an importance score for each word. In order to obtain a final ordered list of word importance, a score is assigned to the important words given in each round. The perturbation module adds perturbations based on LLM.

Images