graph TD A["用户会话上下文"] --> B["token 消耗监控"] B --> C{"达到阈值?"} C -->|是| D["实例化摘要模型"] C -->|否| B D --> E["多层次语义分析"] E --> F["词汇层面: 关键实体识别"] E --> G["句法层面: 代码结构解析"] E --> H["语义层面: 意图理解"] E --> I["语用层面: 任务进展评估"] F --> J["生成摘要"] G --> J H --> J I --> J J --> K["AES-256-GCM 加密"] K --> L["加密 blob 返回客户端"]

style A fill:#e1f5fe,stroke:#01579b,stroke-width:2px,color:#000 style L fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000 style E fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style K fill:#fce4ec,stroke:#880e4f,stroke-width:2px,color:#000

graph LR A["客户端设备"] --> B{"选择压缩后端"} B --> C["基于规则引擎"] B --> D["本地 LLM 模型"] B --> E["Ollama/LM Studio"]

C --> F["确定性压缩"] D --> G["语义级摘要"] E --> H["蒸馏/量化模型"]

F --> I["明文摘要输出"] G --> I H --> I

I --> J["JSON/Markdown 存储"]

style A fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px,color:#000 style I fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style J fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000

graph TD A["硬件安全模块 HSM"] --> B["根密钥 Root Key"] B --> C["密钥加密密钥 KEK"] C --> D["数据加密密钥 DEK"] D --> E["初始化向量 IV"] E --> F["AES-256-GCM 加密"]

F --> G["加密 blob 存储"]

style A fill:#fce4ec,stroke:#880e4f,stroke-width:2px,color:#000 style B fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000 style D fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px,color:#000 style F fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000

graph LR A["第一阶段：上下文污染"] --> B["构造恶意载荷"] B --> C["诱导摘要模型保留"] C --> D["生成含攻击载荷的摘要"] D --> E["AES 加密 blob"]

E --> F["第二阶段：信息泄露"] F --> G["在新会话中加载 blob"] G --> H["触发模型引用摘要"] H --> I["利用交接提示符结构"] I --> J["完整泄露系统提示内容"]

style A fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000 style F fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style J fill:#fce4ec,stroke:#880e4f,stroke-width:2px,color:#000 style B fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000 style H fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px,color:#000