LLM language user privacy information protection method based on natural language prompts

Abstract

The application discloses a natural language prompt-based LLM model user privacy information protection method, constructs a natural language prompt model with a p-tuning soft template as a core, realizes automatic generation of natural language prompt continuous addresses through the p-tuning soft template, pretrains and learns the natural language prompt, and generates synthetic data to realize data enhancement in combination with input information and output information for key information in an input sentence. Compared with the prior art, the application uses prompt engineering to generate prompt information, performs same semantic replacement on input information of a user, and better completes user privacy protection without damaging result generation.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a method for protecting user privacy information based on prompts in an LLM model. Background Technology

[0002] The prior art related to this invention is as follows:

[0003] (a) Language model data privacy protection:

[0004] In recent years, the capabilities of natural language models have improved significantly, and they have been deployed on a large scale in several real-world scenarios. Training these models on domain-specific user data can further enhance their practicality. The sheer volume of data required for these models, coupled with the inherent sparsity of natural language (meaning that all data is unique), leads to a range of privacy attacks targeting both the models and their training data. Language models possess a high capacity for memorizing training samples; this "memory" can lead to model-reversal attacks, where attackers can reconstruct parts of the training samples by querying pre-trained language models on any data record, thereby gaining access to users' private data. Effectively protecting user data privacy has become a hot research topic in large-scale language modeling.

[0005] Current privacy research largely focuses on "preventing the leakage of personally damaging information." However, relying solely on "a model's ability to prevent information leakage under various attacks" to determine if a model can comprehensively protect privacy is insufficient. With the continuous improvement of attack methods, the defense capabilities of models typically only pose a low risk of privacy leakage. Therefore, to achieve better privacy protection, a deeper understanding of the definition of privacy is needed. Unlike simply not recording private information, people decide to maintain data privacy based on the current conversation and socio-cultural context. However, such judgment requires additional information beyond the current conversation; a lack of understanding of the context will lead to incorrect judgments. Therefore, when deciding to use data for model training, the scope of data sharing by users must be considered. Based on Nissenbaum's theory of contextual integrity, privacy leakage can be considered as "when information is shared beyond acceptable limits." Privacy violation is no longer a binary concept but is defined in multiple degrees.

[0006] The representation of privacy is complex. Some fixed-format privacy information (such as phone numbers, email addresses, and credit card numbers) may appear in many different forms, and privacy information contained in free text is even more difficult to identify. For privacy information, the repeated appearance of a piece of information does not necessarily mean that the information is not private. For example, a company's bank card number may appear multiple times within the company, but to those outside the company, this is considered private information. Therefore, to ensure data privacy, the model must not only be able to identify privacy information but also be able to find all privacy-related content in the training data.

[0007] In addition, changes in social slang can lead to changes in how people discuss privacy. Therefore, systems used to detect privacy-related parts of input text should also pay attention to these semantic shifts. However, language models are typically trained on static datasets, so over time, the effectiveness of these static datasets and the language models trained on them in understanding evolved languages ​​will decrease.

[0008] Therefore, establishing a machine learning model that can "fully consider the context to determine information privacy" is extremely challenging in practice. Besides privacy protection research, identifying implicit contexts in text and responding appropriately has always been a hot topic in chatbots. Current research mainly includes: evaluating whether chatbots can appropriately respond to complex situations, generating context-aware, and ethically appropriate long-text responses.

[0009] (II) Prompt Learning:

[0010] For Natural Language Understanding (NLU) tasks, during the user's question-and-answer process, the language model determines relevant key information based on contextual information (the user's input records) to generate a more accurate answer. These records often contain some of the user's personal information, thus posing a privacy risk. Furthermore, defining private information is complex and requires a combination of NLU knowledge and analytical processing (DP) techniques, due to their limitations, are insufficient to support broad privacy protection. To improve the performance of pre-trained language models on a wide range of NLU tasks, fine-tuning is a common approach, optimizing the generated results by updating the entire model parameter set for the target task. While fine-tuning can achieve good performance, it consumes significant memory during training because it requires storing the gradients and optimizer states of all parameters. Moreover, since pre-trained models are typically large, maintaining copies of the model parameters for each task during inference is inconvenient.

[0011] Prompt learning can freeze all parameters of a pre-trained model and use natural language prompts to query the language model. For example, ... Figure 1 As shown, for sentiment analysis, a sample (e.g., "Great movie!") can be concatenated with the cue "This movie is [MASK]", and a pre-trained language model is asked to predict the probability of the mask being labeled "positive" and "negative" to determine the sample's label. Prompt learning can normalize all tasks to the tasks of a pre-trained language model, requiring no training data and achieving better results than fine-tuning on small datasets, making all NLU tasks methodologically consistent. Prompt learning helps language models better understand input text. Using the prompt project, a pre-defined task of masking the language model is implemented to mask key textual information in the input. By predicting replacement information with the same semantic knowledge based on the masked information, the input text is blurred, achieving the goal of protecting the privacy of users' key information.

[0012] (III) Existing Technology and Problems: Differential Privacy

[0013] Differential privacy (DP), due to its strong and rigorous privacy guarantees, is one of the standard methods for addressing model privacy leakage problems. However, differential privacy does not guarantee worst-case scenarios because DP cannot effectively protect data of varying population sizes, thus causing a significant loss of model utility as the population size increases. Furthermore, DP models are much slower to train due to the cumbersome hyperparameter tuning and development involved. In addition, for underrepresented populations, the utility loss of DP is much more severe, potentially leading to financial losses and social consequences.

[0014] DP's main technical challenges at present:

[0015] 1) Hiding personal records is insufficient to guarantee that user privacy will not be violated (a single user's privacy information may appear in the data of multiple users).

[0016] 2) Unable to define the boundaries of privacy information.

[0017] 3) The different data granularity at the word and sentence levels makes DP insufficient to hide most of the privacy information. Summary of the Invention

[0018] This invention proposes a method for protecting user privacy information based on a natural language prompting LLM model. The method masks key input text information and generates replacement information with the same semantic knowledge by model prediction based on the masked information. This achieves the goal of blurring the input text and protecting the privacy of key user information.

[0019] To achieve the above objectives, the present invention provides the following technical solution:

[0020] A method for protecting user privacy information in an LLM model based on natural language prompts includes the following steps:

[0021] Step 1: Construct a natural language prompting model with p-tuning soft templates as the core, and automatically generate continuous addresses for natural language prompts through p-tuning soft templates;

[0022] Step 2: Perform pre-training and learning of natural language prompts. The specific process is described below:

[0023] The pre-training process of the natural language prompting model is as follows: input natural language text information, extract keyword information from the text, use the wordNet network model to perform synonym replacement on the keyword information to achieve masking, use the natural language prompting model to reconstruct the text information for the masked keyword information, and initialize the parameters of the natural language prompting model by performing the pre-training process more than once.

[0024] The learning process of the cue model: cue learning prepares discrete natural language task instructions to be trained in advance and inputs the natural language task into the pre-trained language model;

[0025] Step 3: For key information in the input sentence, combine the input and output information to generate synthetic data to achieve data augmentation. After fine-tuning the natural language prompting model, generate prompt word P, extract keywords and labels from prompt word P, and feed them into the pre-trained language model to generate new synthetic training data.

[0026] Compared with the prior art, the present invention can achieve the following beneficial technical effects:

[0027] 1) By combining language understanding tasks, we can better uncover potential private information in texts;

[0028] 2) Use the prompt project to implement the pre-defined task of masking the language model, so as to better protect user privacy without compromising the result generation. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the overall process of the LLM model user privacy information protection method based on natural language prompts of the present invention;

[0030] Figure 2 It is a p-tuning soft template diagram;

[0031] Figure 3 Here is an example image of a natural language prompt;

[0032] Figure 4 This is a block diagram of a data augmentation implementation example. Detailed Implementation

[0033] The technical solution will now be described in detail with reference to the accompanying drawings and embodiments.

[0034] In Natural Language Understanding (NLU) tasks, when a user asks a question, the language model determines relevant key information based on contextual information (the user's input records) to generate a more accurate answer. These records may often contain some of the user's personal information, thus raising privacy concerns. Furthermore, defining private information is complex and requires a combination of NLU and general language understanding for more appropriate judgment. DP (Data Logic) technology, due to its limitations, is insufficient to support broad privacy protection.

[0035] Prompt learning, a popular technique, helps language models better understand input text. The prompt project implements a pre-defined task to mask key textual information in the input. By using the masked information, the model predicts and generates replacement information with the same semantic knowledge, thus blurring the input text and protecting the privacy of key user information.

[0036] like Figure 1 As shown, the overall process of the method for protecting user privacy information in an LLM (Large Language Model) model based on natural language prompts according to the present invention includes the following steps:

[0037] Step 1: Construct a natural language prompting model with p-tuning soft templates as the core, and realize the automatic generation of continuous addresses of natural language prompts through p-tuning soft templates;

[0038] like Figure 3 As shown, in the Natural Language Understanding (NLU) task, natural language prompts [P0], ..., [P...] i ]、[P i+1 ],...,[P m After encoding, the i-th natural language prompt P in template T is... iTreating each as a token, we obtain a discrete set of tokens, token{X}, for the input X. The given discrete set of input tokens, token{X}, is mapped to e(X) through an embedding layer. e(X) serves as the given context information, and its output target is e(Y). Together with the set of tokens, token{X}, corresponding to the natural language prompt, they form a template T.

[0039] The p-tuning soft template is T = {[P 0：i ],x,[P i+1：m ,y]},Map T to {e([P 0：i ]), e(x), e([P i+1：m ]), e(y)}, which are then mapped again to {h0, ..., h i ,e(x),h i+1 , ..., h m ,e(y)},h i This represents a trainable embedding tensor. p-tuning soft templates are the template types that natural language prompting models should build.

[0040] Step 2: Perform pre-training and learning of natural language prompts. The specific process is described below:

[0041] 1) Pre-training process of natural language prompting model: Input natural language text information, extract keyword information from the text, perform synonym replacement on the keyword information through wordNet network model, reconstruct the text information using natural language prompting model for the replaced keyword information, and initialize the parameters of natural language prompting model by performing more than one pre-training process;

[0042] 2) In the learning process of the prompting model: Prompt learning involves preparing discrete natural language task instructions to be trained in advance, inputting the natural language task into the pre-trained language model, updating the parameters of the natural language prompts using the natural language prompting model, and fixing the parameters of all pre-trained language models (PLM). For example... Figure 2 As shown, the parameters of the promptencoder part are the parameters of the pre-trained model.

[0043] Step 3: For key information in the input sentence, combine the input and output information to generate synthetic data to achieve data augmentation, specifically including:

[0044] Synthetic training data is generated using a pre-trained language model (PLM) based on a seq2seq transformer architecture. The pre-trained language model based on the seq2seq transformer architecture includes defining time steps and outputting a background variable through an encoder. This variable encodes information about the input sequence and serves as the hidden state of the last time step.

[0045] Synthesized training data is used to adapt to the model training process. If there is insufficient data or poor data quality, training data is synthesized through data augmentation and then input into the pre-trained language model.

[0046] set up As a natural language cue for the j-th layer, it is the i-th hidden state of the j-th layer in the pre-trained language model based on the seq2seq Transformer architecture. As shown in the following formula:

[0047]

[0048] Where Trans() represents the forward function of the Transformer layer, w i This represents the fixed word embedding vector of the input layer. This represents the i-th natural language prompt template in the j-th layer;

[0049] Gradient backpropagation allows for updating the gradients of each layer in the Transformer model, thus better completing the learning task.

[0050] However, finding suitable discrete natural language tasks (generation) to incorporate is not easy, and optimizing them in an end-to-end manner requires additional manpower. Therefore, freezing the parameters of the natural language prompting model helps with the generalization of model parameters during training;

[0051] After fine-tuning the natural language prompting model, prompt words P are generated through the natural language prompting model. Then, keywords and labels are extracted from prompt words P. These new keywords and labels are fed into the pre-trained language model to generate new synthetic data.

[0052] like Figure 4 As shown, after fine-tuning the natural language model, a prompt word T is generated through the natural language prompt model. Then, keywords and labels are extracted from the prompt word T. These new keywords and labels are fed into the pre-trained language model to generate new synthetic data. The resulting output text maintains higher diversity.

[0053] The above description is merely an embodiment of this application and is not intended to limit the scope of protection sought by this invention. For those skilled in the art, any modifications, changes, equivalent substitutions, or variations made without departing from the spirit and principles of this invention fall within the scope of the technical content and protection disclosed in this invention.

Claims

1. A method for protecting user privacy information in an LLM model based on natural language prompts, characterized in that, Includes the following steps: Step 1: Construct a natural language prompting model with p-tuning soft templates as the core, and realize the automatic generation of continuous addresses of natural language prompts through p-tuning soft templates; Step 2: Perform pre-training and learning of natural language prompts. The specific process is described below: The pre-training process of the natural language prompting model is as follows: input natural language text information, extract keyword information from the text, use the wordNet network model to perform synonym replacement on the keyword information to achieve masking, use the natural language prompting model to reconstruct the text information for the masked keyword information, and initialize the parameters of the natural language prompting model by performing the pre-training process more than once. The learning process of a natural language prompting model: prompting learning prepares discrete natural language task instructions to be trained in advance, and inputs the natural language task into the pre-trained language model; Step 3: For key information in the input sentence, combine the input and output information to generate synthetic data to achieve data augmentation. After fine-tuning the natural language prompting model, generate prompt word P, extract keywords and labels from prompt word P, and feed them into the pre-trained language model to generate new synthetic training data.

2. The method for protecting user privacy information in an LLM model based on natural language prompts according to claim 1, characterized in that, The p-tuning soft template includes: In natural language understanding tasks, natural language prompts [P0], ..., [P] are used to indicate the meaning of the prompts. i ]、[P i+1 ],…,[P m After encoding, the i-th natural language prompt P in template T is... i Treating it as a token, we obtain a discrete set of tokens token{X} for the input X. The given set of discrete input tokens token{X} is mapped to e(X) through the embedding layer. e(X) serves as the given context information, and its output target is e(Y). Together with the token set token{X} corresponding to the natural language prompt, they form a template T. The p-tuning soft template is T = {[P 0：i ],x,[P i+1：m ,y]},Map T to {e(P 0：i ]), e(x), e([P i+1：m ]), e(y)}, which are then mapped again to {h0, ..., h i ,e(x),h i+1 , ..., h m ,e(y)},h i This represents a trainable embedding tensor.

3. The method for protecting user privacy information in an LLM model based on natural language prompts according to claim 1, characterized in that, The p-tuning soft template includes: Synthetic training data is generated using a pre-trained language model based on a seq2seq transformer architecture; set up As a natural language cue for the j-th layer, it is the i-th hidden state of the j-th layer in the pre-trained language model based on the seq2seq Transformer architecture. As shown in the following formula: Where Trans() represents the forward function of the Transformer layer, w i This represents the fixed word embedding vector of the input layer. This represents the i-th natural language prompt template in the j-th layer; Gradient backpropagation is used to update the gradients of each layer in the Transformer model, thus completing the learning task.

Images