IP Library Granted Patent US 12,425,449
Granted Patent B2
US 12,425,449 · App. 18/650,312 · Granted Sep 23, 2025

Logical language model prompts for fraud detection

Inventors: Constantin D. Cernat (Bucharest, RO); Ovidiu M. Craciun (Bucharest, RO)
Assignee: Bitdefender IPR Management Ltd.
H04L63/1483G06F40/284G06F40/40H04L63/1416H04L63/1425
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,425,449
App. No.
18/650,312
Granted
Sep 23, 2025
Kind
B2
Abstract

In some embodiments, a security chatbot comprises a generative language module (GLM) and a prompt manager configured to dynamically update the GLM input prompt according to the output of the GLM. The input prompt instructs the GLM to carry out a task (e.g., determine whether a target message received by a user is indicative of online fraud) and in response, to output a specific flag token. In response to detecting the flag token within the output of the GLM, the prompt manager may selectively execute a code snippet identified according to the respective flag token. Executing the code snippet effectively updates the prompt, which is then fed back to the GLM for the next inference step. In contrast to conventional LLM prompting, updates to the prompt herein comprise modifications (e.g., insertion of other flag tokens, etc.) other than merely appending an inferred token to the previous prompt. Furthermore, the prompt modifications are performed inline, i.e., without submitting an entirely new prompt to the GLM.

Claims (60)

1. A computer system comprising at least one hardware processor configured to analyze a target text formulated in a natural language, wherein analyzing the target text comprises executing a prompt manager communicatively coupled to a generative language module (GLM), wherein:

the GLM is configured to:

receive from the prompt manager a language model (LM) prompt formulated in the natural language, and

in response, output to the prompt manager a predicted token comprising a continuation of the received LM prompt; and

the prompt manager is configured to:

receive a logical prompt, the logical prompt including the target text and a code snippet comprising computer code for updating the LM prompt,

formulate the LM prompt according to the logical prompt, the LM prompt instructing the GLM to perform a text analysis task according to the target text and in response, to output a flag token,

in response to receiving the predicted token, initiate an execution of the code snippet to produce an updated LM prompt,

transmit the updated LM prompt to the GLM, and

formulate a reply message comprising a result of analyzing the target text, the reply message formulated according to an output of the GLM in response to the updated LM prompt.

2. The computer system of claim 1 , wherein the execution of the code snippet causes the prompt manager to:

determine whether the predicted token includes the flag token; and

in response, if the predicted token includes the flag token, insert an LM instruction into the LM prompt, the LM instruction instructing the GLM to perform another text analysis task according to the target text.

3. The computer system of claim 2 , wherein the LM instruction further instructs the GLM to output another flag token in response to performing the other text analysis task.

4. The computer system of claim 1 , wherein:

the prompt manager is configured to formulate the LM prompt to further include a placeholder token; and

the execution of the code snippet causes the prompt manager to insert a set of supplemental tokens into the LM prompt at a position of the placeholder token.

5. The computer system of claim 1 , wherein the execution of the code snippet causes the prompt manager to perform an action selected from a group consisting of inserting a plurality of supplemental tokens into the LM prompt and deleting a set of tokens from the LM prompt.

6. The computer system of claim 1 , wherein the execution of the code snippet causes the prompt manager to delete the flag token from the LM prompt.

7. The computer system of claim 1 , wherein:

the logical prompt comprises a plurality of code snippets for updating the LM prompt, the plurality of code snippets including the code snippet;

the prompt manager is configured to associate each code snippet of the plurality of code snippets with a distinct flag token of a plurality of flag tokens; and

producing the updated LM prompt comprises executing a selected code snippet of the plurality of code snippets according to whether the predicted token includes a selected flag token of the plurality of flag tokens.

8. The computer system of claim 1 , wherein the flag token comprises an attribute-value pair.

9. The computer system of claim 1 , wherein the text analysis task comprises an item selected from a group consisting of determining whether the target text is indicative of online fraud, determining whether the target text comprises fake news, and determining whether the target text is indicative of hate speech.

10. A computer-implemented method of analyzing a target text formulated in a natural language, the method comprising employing at least one hardware processor of a computer system to execute a prompt manager communicatively coupled to a generative language module (GLM), wherein:

the GLM is configured to:

receive from the prompt manager a language model (LM) prompt formulated in the natural language, and

in response, output to the prompt manager a predicted token comprising a continuation of the received LM prompt; and

executing the prompt manager comprises:

receiving a logical prompt, the logical prompt including the target text and a code snippet comprising computer code for updating the LM prompt,

formulating the LM prompt according to the logical prompt, the LM prompt instructing the GLM to perform a text analysis task according to the target text and in response, to output a flag token,

in response to receiving the predicted token, initiating an execution of the code snippet to produce an updated LM prompt,

transmitting the updated LM prompt to the GLM, and

formulating a reply message comprising a result of analyzing the target text, the reply message formulated according to an output of the GLM in response to the updated LM prompt.

11. The method of claim 10 , wherein the execution of the code snippet causes the prompt manager to:

determine whether the predicted token includes the flag token; and

in response, if the predicted token includes the flag token, insert an LM instruction into the LM prompt, the LM instruction instructing the GLM to perform another text analysis task according to the target text.

12. The method of claim 11 , wherein the LM instruction further instructs the GLM to output another flag token in response to performing the other text analysis task.

13. The method of claim 10 , wherein:

the prompt manager is configured to formulate the LM prompt to further include a placeholder token; and

the execution of the code snippet causes the prompt manager to insert a set of supplemental tokens into the LM prompt at a position of the placeholder token.

14. The method of claim 10 , wherein the execution of the code snippet causes the prompt manager to perform an action selected from a group consisting of inserting a plurality of supplemental tokens into the LM prompt and deleting a set of tokens from the LM prompt.

15. The method of claim 10 , wherein the execution of the code snippet causes the prompt manager to delete the flag token from the LM prompt.

16. The method of claim 10 , wherein:

the logical prompt comprises a plurality of code snippets including the code snippet;

the prompt manager is configured to associate each code snippet of the plurality of code snippets with a distinct flag token of a plurality of flag tokens; and

producing the updated LM prompt comprises executing a selected code snippet of the plurality of code snippets according to whether the predicted token includes a selected flag token of the plurality of flag tokens.

17. The method of claim 10 , wherein the flag token comprises an attribute-value pair.

18. The method of claim 10 , wherein the text analysis task comprises an item selected from a group consisting of determining whether the target text is indicative of online fraud, determining whether the target text comprises fake news, and determining whether the target text is indicative of hate speech.

19. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to analyze a target text formulated in a natural language, wherein analyzing the target text comprises executing a prompt manager communicatively coupled to a generative language module (GLM), wherein:

the GLM is configured to:

receive from the prompt manager a language model (LM) prompt formulated in a natural language, and

in response, output to the prompt manager a predicted token comprising a continuation of the received LM prompt; and

the prompt manager is configured to:

receive a logical prompt, the logical prompt including the target text and a code snippet comprising computer code for updating the LM prompt,

formulate the LM prompt according to the logical prompt, the LM prompt instructing the GLM to perform a text analysis task according to the target text and in response, to output a flag token,

in response to receiving the predicted token, initiate an execution of the code snippet to produce an updated LM prompt,

transmit the updated LM prompt to the GLM, and

formulate a reply message comprising a result of analyzing the target text, the reply message formulated according to an output of the GLM in response to the updated LM prompt.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 30, 2024
From: CERNAT, CONSTANTIN D; CRACIUN, OVIDIU M
To: BITDEFENDER IPR MANAGEMENT LTD.
Reel/Frame 067269/0495 →
Continuity (3)
Continuation 18650276 · Apr 30, 2024
Provisional Application 63612405 · Dec 20, 2023
Related Publication 20250211615A1 · Jun 26, 2025
References Cited (33)
US 8813239B2 · Tibeica · 2014 [cited by applicant]
US 10171497B2 · Damian · 2019 [cited by applicant]
US 10630840B1 · Karp · 2020 [cited by applicant]
US 10958779B1 · Rule · 2021 [cited by applicant]
US 11095579B1 · de Mazancourt et al. · 2021 [cited by applicant]
US 11388193B2 · Damian · 2022 [cited by applicant]
US 11416109B2 · Malhotra · 2022 [cited by applicant]
US 20190166150A1 · Bulut · 2019 [cited by applicant]
US 20210090816A1 · Ibrahim · 2021 [cited by examiner]
US 20210144107A1 · Liang · 2021 [cited by applicant]
US 20220171641A1 · Pichiliani · 2022 [cited by applicant]
US 20220272054A1 · Gao · 2022 [cited by applicant]
US 20220309628A1 · Fujita · 2022 [cited by applicant]
US 20230359903A1 · Cefalu · 2023 [cited by examiner]
US 20250133111A1 · Neystadt · 2025 [cited by examiner]
European Patent Office (EPO), International Search Report and Written Opinion mailed Apr. 10, 2025 for PCT. International Application No. PCT/EP2024/087712, international filing date Dec. 19, 2024, priority date Dec. 20… [cited by applicant]
European Patent Office (EPO), International Search Report and Written Opinion mailed Apr. 8, 2025 for PCT International Application No. PCT/EP2024/087692, international filing date Dec. 19, 2024, priority date Dec. 20, … [cited by applicant]
Heiding et al., “Devising and Detecting Phishing: Large Language Models vs. Smaller Human Models,” arXiv.org, https://arxiv.org/pdf/2308.12287, Nov. 30, 2023. [cited by applicant]
Suhaima et al., “An Improved Transformer-Based Model for Detecting Phishing, Spam and Ham Emails: a Large Language Model Approach,” Security and Privacy 7(5), Nov. 12, 2023. [cited by applicant]
Greshake et al., “Not What You've Signed-Up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,” arxiv.org, https://arxiv.org/pdf/2302.12173, May 5, 2023. [cited by applicant]
Frackiewicz, “Using ChatGPT for Fraud Detection and Prevention,” downloaded from https://ts2.space/en/using-chatgpt-for-fraud-detection-and-prevention/ on Oct. 17, 2023. [cited by applicant]
Coinswitch, “ChatGPT in Crypto,” downloaded from https://coinswitch.co/switch/crypto/chatgpt-in-crypto-how-ai-can-assist-in-fraud-detection-and-prevention/, Jul. 21, 2023. [cited by applicant]
Anura, “How Chatbots Can Help in the Fight Against Fraud,” downloaded from https://www.anura.io/blog/how-chatbots-can-fight-against-fraud, Mar. 6, 2018. [cited by applicant]
Rusticus, “How to Extract Structured Data from Unstructured Text using LLMs,” downloaded from https://xebia.com/blog/archetype-llm-batch-use-case/, Sep. 7, 2023. [cited by applicant]
Wu, “AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation,” arXiv:2308.08155v2, Oct. 3, 2023. [cited by applicant]
Wikipedia, “Auto-GPT,” downloaded from https://en.wikipedia.org/wiki/Auto-GPT on Oct. 17, 2023. [cited by applicant]
Nvidia Technical Blog, How to Get Better Outputs from Your Large Language Model, https://developer.nvidia.com/blog/how-to-get-better-outputs-from-your-large-language-model/, Jun. 14, 2023. [cited by applicant]
OpenAI Documentation, “Code Interpreter,” https://platform.openai.com/docs/assistants/tools/code-interpreter, Dec. 3, 2023. [cited by applicant]
OpenAI Documentation, “Function Calling,” https://platform.openai.com/docs/guides/function-calling/parallel-function-calling Nov. 16, 2023. [cited by applicant]
Fernandez, “Function Calling: Integrated Your GPT Chatbot with Anything,” https://semaphoreci.com/blog/function-calling, Aug. 3, 2023. [cited by applicant]
Databricks, “LLM Inference Performance Engineering: Best Practices,” https://www.databricks.com/blog/llm-inference-performance-engineering-best-practices, Oct. 12, 2023. [cited by applicant]
Wikipedia, “Prompt Engineering,” https://en.wikipedia.org/w/index.php?title=Prompt_engineering&oldid=1220942912, Apr. 26, 2024. [cited by applicant]
Silva, “Retrieval Augmented Generation: Keeping LLMs Relevant and Current,” https://stackoverflow.blog/2023/10/18/retrieval-augmented-generation-keeping-llms-relevant-and-current/, Oct. 18, 2023. [cited by applicant]