Cybersecurity Knowledge Graphs for LLM Document Traceability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large Language Models (LLMs) face challenges in tracing responses to specific documents, hallucinating inaccurate responses, and presenting sensitive reference information, which raises security concerns and hinders their adoption in critical operations.
Innovation Solution
The system utilizes cybersecurity knowledge graphs to retrieve text identifiers of documents used by LLMs, generates vulnerability scores, and displays the sources used to generate these scores, while ensuring that only authorized users with appropriate access levels can view sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If LLMs are trained on a specific dataset to generate comprehensive responses, then the quality and comprehensiveness of responses is improved, but the ability to trace responses to specific documents deteriorates
Solution Approach 1:
The system segments the knowledge base into individual documents with unique identifiers and maintains separate tracking of which documents contribute to which responses. This allows the LLM to be trained on comprehensive datasets while preserving the ability to trace specific information back to source documents through document ID mappings and citation tracking mechanisms.
Solution Approach 2:
The patent introduces intermediary components including a document retrieval system that fetches relevant documents before LLM processing, and a citation generation mechanism that creates traceable references. These intermediaries act as mediators between the LLM and source documents, enabling comprehensive training data access while maintaining document provenance through structured reference tracking.
2Reliability
If LLMs are configured to provide detailed responses with reference information, then the completeness of information is improved, but security concerns regarding classified information worsen
Solution Approach 1:
The system applies local quality control by implementing differential access rights for different portions of information. Classified documents and sensitive sections are identified and marked with security classifications, allowing the system to provide complete information to authorized users while automatically restricting or redacting sensitive portions for unauthorized users, thus maintaining both completeness and security.
Solution Approach 2:
The patent implements feedback mechanisms where the system continuously monitors user access levels and document classifications, dynamically adjusting the information provided in responses. The system receives feedback about user authorization status and document security levels, then modifies response content accordingly to prevent unauthorized access to classified information while maintaining information completeness for authorized users.
3Productivity
If LLMs generate unique responses quickly for real-time operations, then the speed of response generation is improved, but the likelihood of hallucination worsens
Solution Approach 1:
The system performs preliminary actions by retrieving and verifying relevant documents before the LLM generates responses. The document retrieval and validation process occurs in advance, ensuring that the LLM works with verified, relevant information rather than generating responses from scratch, which reduces hallucination while maintaining real-time response capabilities through pre-prepared knowledge bases.
Solution Approach 2:
The patent implements feedback loops where the system verifies LLM responses against retrieved documents and provides correction signals when hallucinations are detected. This continuous verification process feeds back into the response generation mechanism, allowing the system to maintain high speed while improving accuracy through real-time validation and correction based on source document comparison.
Data Source
AI summary
Some embodiments may include methods and related systems to receive a query associated with an access level and determine a set of documents based on the query and a knowledge graph, where the set of documents is associated with a set of tags, a set of directives, and a set of criteria. Some embodiments may then determine a score based on the set of directives, determine whether the access level satisfies the set of criteria, and, in response to a result indicating that the access level satisfies the set of criteria, associate a set of text identifiers with the score by tracing the set of tags. Some embodiments may then store, in a set of database records, the score and the set of text identifiers.