Privacy protection method and device in large model reasoning, equipment, medium and product

Abstract

The invention discloses a privacy protection method and device in large model reasoning, equipment, a medium and a product, and relates to the technical field of large models.The privacy protection method in large model reasoning comprises the steps that disturbance transformation is conducted on original statements in an original query instruction, and multiple disturbance statements corresponding to each original statement are obtained; selecting disturbance statements of which the semantic coherence degree meets a preset condition from a plurality of disturbance statements corresponding to each original statement, and determining a disturbance data set; sending the disturbance data set to a big language model deployed at a cloud end, and obtaining a disturbance query result fed back by the big language model; and inputting the disturbance query result into a pre-trained local decoder, and outputting a target query result corresponding to the original query instruction by the local decoder. According to the technical scheme provided by the invention, the privacy security of a user in the process of reasoning by using a large model is guaranteed, and a relatively accurate target query result can be obtained.

Description

Technical Field

[0001] The present application relates to the field of large model technology, and in particular to a privacy protection method, device, electronic device, computer-readable storage medium and computer program product in large model reasoning. Background Art

[0002] Pre-trained large language models (PLMs) perform well in various downstream tasks. With their large number of parameters and large computing resources, they can provide reliable reasoning services for users who need large model services. Usually, service providers train PLMs for specific tasks and deploy them in the cloud. Users who lack high computing resources can query these services to get the required responses.

[0003] However, current large-model inference services have certain privacy and security risks. Since the query instructions that users input into the large model may contain sensitive information, such as name, address, or even business secrets, sharing this information with the service provider will bring risks of privacy leakage to the user. In order to overcome the above-mentioned defects, there is currently a solution to achieve local differential privacy through private embedding and noise processing at the sentence level or word level, but this solution perturbs the query instructions, which may cause changes in the semantics of the generated text and / or semantic incoherence, affecting the reasoning performance of the large model and ultimately affecting the accuracy of the query results.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a privacy protection method, device, electronic device, computer-readable storage medium and computer program product in large-model reasoning, aiming to solve the technical problem that the current large-model privacy protection scheme will affect the performance of the model and the accuracy of the query results.

[0006] To achieve the above purpose, the present application proposes a privacy protection method in large model reasoning, which is applied to the local end. The privacy protection method in large model reasoning includes:

[0007] Performing disturbance transformation on each original sentence in the original query instruction respectively to obtain multiple disturbance sentences corresponding to each original sentence;

[0008] Selecting the perturbation sentences whose semantic coherence meets the preset conditions from the multiple perturbation sentences corresponding to each original sentence, and determining the perturbation data set;

[0009] Sending the perturbation data set to a large language model deployed in the cloud, and obtaining a perturbation query result fed back by the large language model;

[0010] The perturbed query result is input into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbed query results and real query results.

[0011] In one embodiment, the step of performing disturbance transformation on each original sentence in the original query instruction to obtain multiple disturbance sentences corresponding to each original sentence includes:

[0012] Splitting each of the original sentences into at least one text unit;

[0013] Performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each of the text units, wherein the perturbation candidate list includes multiple perturbed text units;

[0014] The following steps are executed in a loop: a perturbed sentence corresponding to each original sentence is formed according to the perturbed text units respectively selected from the perturbation candidate list of multiple text units corresponding to each original sentence, until the perturbed sentence corresponding to each original sentence reaches a preset number.

[0015] In one embodiment, after the step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit, the method further includes:

[0016] According to the text unit before disturbance, the text unit after disturbance and the preset differential privacy function, the differential privacy function value of each text unit after disturbance is calculated;

[0017] According to the differential privacy function and the preset privacy protection parameters, the distribution probability of each text unit after disturbance is determined, wherein the distribution probability is positively correlated with the differential privacy function value and the privacy protection parameter, and the distribution probability is used to select the disturbed text unit from the disturbance list.

[0018] In one embodiment, the step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit comprises:

[0019] Based on preset disturbance parameters, each text unit is subjected to disturbance transformation to obtain a plurality of disturbed text units corresponding to each text unit, wherein the disturbance parameters at least include the number of disturbance transformations and the disturbance degree of each disturbance transformation;

[0020] According to the multiple perturbed text units corresponding to each unit, a perturbation candidate list for each text unit is formed.

[0021] In one embodiment, the preset condition is the most semantically coherent, and the step of selecting the perturbation sentences whose semantic coherence meets the preset condition from the multiple perturbation sentences corresponding to each original sentence, and determining the perturbation data set includes:

[0022] Inputting a plurality of perturbation sentences corresponding to each original sentence into a preset semantic coherence evaluation model to obtain a semantic coherence evaluation result of each perturbation sentence;

[0023] Based on the semantic coherence evaluation results of the perturbation sentences, the most semantically coherent perturbation sentences among the perturbation sentences corresponding to each original sentence are selected to form a perturbation data set.

[0024] In one embodiment, before the step of inputting the perturbed query result into a pre-trained local decoder and having the local decoder output a target query result corresponding to the original query instruction, the method further includes:

[0025] Acquire multiple sets of training data, wherein the training data at least includes historical query results and real query results, the historical query results are obtained by inputting the perturbed training query instructions into the large language model, and the real query results are obtained by inputting the pre-perturbed training query instructions into the large language model;

[0026] Inputting the historical query results in each of the training data into the preset local large model in sequence to obtain the corresponding predicted query results;

[0027] Taking minimizing the difference between the predicted query result and the actual query result as the optimization goal, the local large model is iteratively optimized to obtain a local decoder.

[0028] In addition, to achieve the above purpose, the present application also proposes a privacy protection device in large model reasoning, and the privacy protection device in large model reasoning includes:

[0029] A perturbation transformation module is used to perform perturbation transformation on each original sentence in the original query instruction to obtain multiple perturbation sentences corresponding to each original sentence;

[0030] A semantic restriction module is used to select perturbation sentences whose semantic coherence meets preset conditions from multiple perturbation sentences corresponding to each original sentence, and determine a perturbation data set;

[0031] A model reasoning module is used to send the perturbation data set to a large language model deployed in the cloud, and obtain the perturbation query result fed back by the large language model;

[0032] A result decoding module is used to input the perturbed query result into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbed query results and real query results.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes an electronic device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the privacy protection method in large model reasoning as described above.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the privacy protection method in large model reasoning as described above are implemented.

[0035] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the privacy protection method in large model reasoning as described above.

[0036] The present application proposes a privacy protection method in large model reasoning. In the privacy protection method in large model reasoning, firstly, each original sentence in the original query instruction is perturbed and transformed respectively to obtain multiple perturbation sentences corresponding to each original sentence, and the preliminary encryption processing of user privacy is implemented from the source of the query instruction to protect the privacy security of the user. Then, the perturbation sentences whose semantic coherence meets the preset conditions are selected from the multiple perturbation sentences corresponding to each original sentence, and the perturbation data set is determined, so as to add perturbation noise to the original sentence and perform sentence-level semantic restrictions at the same time, so as to reduce the impact of semantic incoherence on the subsequent model performance and improve the accuracy of the large language model output. Then, the perturbation data set is sent to the A large language model is used to obtain a perturbation query result fed back by the large language model. Since the input perturbation data set is noisy, the perturbation query result is noisy and needs to be further processed. Finally, the perturbation query result is input into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction. The local decoder is trained by multiple groups of perturbation query results and real query results. The local decoder is pre-trained to clean the noise contained in the perturbation query result and restore a relatively accurate target query result. Therefore, the technical solution of the present application avoids user privacy leakage while reducing the performance loss of the large language model, thereby ensuring the accuracy of the query result. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 A flowchart diagram of the first embodiment of the privacy protection method in large model reasoning of this application is provided;

[0040] Figure 2 This is a feasible schematic diagram of data interaction between the local terminal and the cloud in an embodiment of the present application;

[0041] Figure 3 A flowchart of training a local decoder in the privacy protection method for large model reasoning in this application;

[0042] Figure 4 A schematic diagram of the structure of a privacy protection device in large model reasoning in an embodiment of the present application;

[0043] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the privacy protection method in large model reasoning in the embodiment of the present application.

[0044] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, a server, etc., or an electronic device, a control device, etc. capable of realizing the above functions. The following takes a computer as an execution subject as an example to illustrate this embodiment and the following embodiments.

[0048] The present application embodiment provides a privacy protection method in large model reasoning, referring to Figure 1 , Figure 1This is a flowchart of the first embodiment of the privacy protection method in large model reasoning of the present application. The privacy protection method in large model reasoning applied to the local end includes:

[0049] Step S10, performing disturbance transformation on each original sentence in the original query instruction to obtain a plurality of disturbance sentences corresponding to each original sentence;

[0050] Among them, the original query instruction is the text content input by the user to characterize his own large model reasoning needs. It can include only one original sentence or multiple original sentences. In order to encrypt the privacy information therein, each original sentence is perturbed multiple times in step S10 to avoid the influence of accidental errors of the perturbation, which causes a single perturbation to cause the semantics of the perturbed sentence to differ too much from the original sentence, affecting the model performance. In the embodiment of the present application, the sentence is perturbed multiple times to obtain multiple perturbed sentences, so as to further screen out relatively better perturbed sentences, taking into account the requirements of privacy protection and semantic coherence.

[0051] Step S20, selecting the disturbance sentences whose semantic coherence meets the preset conditions from the multiple disturbance sentences corresponding to each original sentence, and determining the disturbance data set;

[0052] In order to avoid the semantic difference between the perturbed sentence and the original sentence being too large or the semantic incoherence affecting the understanding, processing and reasoning of the large language model on the sentence, in step S20, multiple perturbed sentences corresponding to the original sentence are screened, and the perturbed sentence with a higher degree of semantic coherence is selected as the target perturbation sentence corresponding to the original sentence, and the target perturbation sentences corresponding to other original sentences form a perturbation data set (which can be understood as the query instruction after perturbation).

[0053] For example, each original sentence corresponds to 10 perturbation sentences, and the semantic coherence of the 10 perturbation sentences is evaluated respectively, and the perturbation sentence with the highest semantic coherence is selected as the target perturbation sentence corresponding to the original sentence. Similarly, the target perturbation sentence corresponding to each original sentence is screened out, and the target perturbation sentences are combined according to the order of each original sentence in the original query instruction to obtain a perturbation data set.

[0054] In another feasible embodiment, the target disturbance sentence of the original sentence can be selected according to the semantic similarity between the disturbance sentence and the original sentence, or the target disturbance sentence can be screened by considering both the semantic coherence and the semantic similarity. It can be defined according to the actual needs of the user and is not limited here.

[0055] Among them, the perturbed sentences in the perturbation data set have undergone perturbation transformation processing, which has the effect of protecting the security of user privacy information. They have also been screened based on the degree of semantic coherence, reducing the impact on the performance of the large language model. A relatively coherent perturbation data set that is more in line with the original query instruction requirements is provided as input for the large language model, providing a reliable data foundation for the large language model to output more accurate, true, and user-satisfied query results.

[0056] Step S30, sending the perturbation data set to the large language model deployed in the cloud, and obtaining the perturbation query result fed back by the large language model;

[0057] After the perturbation data set is determined, the cloud-based big model service can be called locally to input the perturbation data set into the big language model, which will recognize, understand, and process the perturbation sentences in the input perturbation data set, and finally output the corresponding perturbation query result. The perturbation query result is the response of the big language model to the demand represented by the perturbation data set. Since the perturbation data set itself is noisy, the output perturbation query result is also noisy.

[0058] Among them, the large language model can be a multimodal large language model in various fields commonly used in the market or a text-specific large language model, which can recognize and understand the input query instructions (the perturbation data set in this application) and output the corresponding query results.

[0059] Step S40, inputting the perturbed query result into a pre-trained local decoder, and having the local decoder output a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple sets of perturbed query results and real query results.

[0060] The local decoder in the embodiment of the present application has been pre-trained and can restore a target query result that is closer to the requirements of the original query instruction based on the input perturbation query result, thereby avoiding the large language model outputting a noisy perturbation query result based on a noisy perturbation data set, which affects the user's browsing experience, and enables the user to clearly obtain relevant information that meets his or her expectations.

[0061] In a feasible embodiment, the privacy protection method in the large model reasoning of the embodiment of the present application can be applied to a system with a large language model reasoning service, referring to Figure 2The user inputs the original query instruction on the local side, and then performs perturbation transformation and subsequent screening process locally to determine the perturbation data set. The perturbation data set is used as the updated query instruction to request the required query result from the large language model service deployed in the cloud, and the large language model feeds back the perturbation query result to the local side. After the local side receives the perturbation query result, it decrypts the perturbation query result according to the deployed local decoder, cleans the noise, obtains the target query result corresponding to the original query instruction, and feeds it back to the user. Among them, since the large language model receives the encrypted perturbation data set, the encryption and decryption processes are performed on the local side, so there is no risk of privacy information leakage in the user's original query instruction, which effectively protects the user's privacy security.

[0062] The embodiment of the present application proposes a privacy protection method in large model reasoning. In the privacy protection method in large model reasoning, first, each original sentence in the original query instruction is perturbed and transformed respectively to obtain multiple perturbation sentences corresponding to each original sentence, and preliminary encryption processing of user privacy is implemented from the source of the query instruction to protect the privacy security of the user. Then, the perturbation sentences whose semantic coherence meets the preset conditions are selected from the multiple perturbation sentences corresponding to each original sentence, and the perturbation data set is determined, so as to add perturbation noise to the original sentence and perform sentence-level semantic restrictions to reduce the impact of semantic incoherence on subsequent model performance and improve the accuracy of the large language model output. Then, the perturbation data set is sent to the A large language model is used to obtain a perturbation query result fed back by the large language model. Since the input perturbation data set is noisy, the perturbation query result is noisy and needs to be further processed. Finally, the perturbation query result is input into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction. The local decoder is trained by multiple groups of perturbation query results and real query results. The local decoder is pre-trained to clean the noise contained in the perturbation query result and restore a relatively accurate target query result. Therefore, the technical solution of the embodiment of the present application avoids user privacy leakage while reducing the performance loss of the large language model, thereby ensuring the accuracy of the query result.

[0063] Furthermore, in a feasible implementation manner, the step of performing disturbance transformation on each original sentence in the original query instruction to obtain a plurality of disturbance sentences corresponding to each original sentence includes:

[0064] Step S11, splitting each original sentence into at least one text unit;

[0065] Step S12, performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit, wherein the perturbation candidate list includes multiple perturbed text units;

[0066] Step S13, looping the following steps: forming a perturbed sentence corresponding to each original sentence according to the perturbed text units respectively selected from the perturbation candidate list of multiple text units corresponding to each original sentence, until the perturbed sentence corresponding to each original sentence reaches a preset number.

[0067] In order to achieve better privacy protection, the embodiment of the present application adopts the perturbation transformation at the text unit (token) level. For example, when the data set corresponding to the original sentence includes N sentences, it can be expressed as D = {S 1 ,S 2 ,…,S N}, where D is the data set, S 1 To S N are the first to Nth statements in the data set.

[0068] Then for any statement S in the data set i Split tokens to get statement S i The text unit set can be expressed as: S i ={t i1 ,t i2 ,…,t im}, where t i1 to im For statement S i The corresponding 1st to mth tokens.

[0069] Furthermore, for each original token, it is perturbed multiple times to obtain the token after each perturbation, and the multiple perturbed tokens corresponding to each original token are combined to obtain a perturbation candidate list.

[0070] Exemplarily, the method of perturbing and transforming text tokens mainly requires modifying or replacing a single or multiple tokens while keeping the overall meaning of the text relatively unchanged. The perturbation transformation methods that can be adopted in the embodiments of the present application may include, for example, synonym replacement, random insertion, random deletion, character-level perturbation, perturbation based on a pre-trained model, or vocabulary-level transformation.

[0071] After determining the perturbation candidate list for each original token in the original sentence, a perturbed token can be selected from each perturbation candidate list to form a new sentence, i.e., a perturbed sentence. It can be understood that since each original sentence corresponds to multiple original tokens, i.e., multiple candidate lists, when different perturbed tokens are selected from the candidate list, the combined perturbed sentences are also different. Therefore, by repeatedly executing the steps of selecting perturbed tokens and combining perturbed sentences, a preset number of perturbed sentences corresponding to the original sentence can be obtained. The preset number can be customized according to user needs. The more preset numbers, the greater the amount of calculation for screening the target perturbation sentence, and the better the semantic coherence of the selected target perturbation sentence.

[0072] Furthermore, in a feasible embodiment, after the step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit, the method further includes:

[0073] Step A10, calculating the differential privacy function value of each text unit after the disturbance according to the text unit before the disturbance, the text unit after the disturbance and the preset differential privacy function;

[0074] Step A20, determine the distribution probability of each text unit after disturbance according to the differential privacy function and the preset privacy protection parameter, wherein the distribution probability is positively correlated with the differential privacy function value and the privacy protection parameter, and the distribution probability is used to select the disturbed text unit from the disturbance list.

[0075] Among them, the text unit token before disturbance is recorded as t ij , the perturbed text unit token is recorded as t i ' j , the differential privacy function is u(), then the differential privacy function value can be obtained through u(t i ' j ,t ij ) is calculated. In addition, in order to indicate the degree of privacy protection, a privacy protection parameter ε is preset. The larger the value of the privacy protection parameter, the higher the degree of privacy protection, and the smaller the value of the privacy protection parameter, the lower the degree of privacy protection.

[0076] In a feasible embodiment, the distribution probability of the text unit can be determined by the following expression:

[0077]

[0078] This expression is used to represent, and Positive correlation, among which, It means that the token before the disturbance is tij When , the perturbed token is t i ' j , Δu is the maximum change value of the differential privacy function, that is, the maximum difference that may occur between the tokens before and after the disturbance.

[0079] By calculating the distribution probability of the text unit through the above formula, the distribution probability of each perturbed text unit can be positively correlated with the degree of protection of differential privacy (and the differential privacy function value u(t i ' j , t ij ) and the privacy protection parameter ε are also positively correlated). In addition, the above formula can also be used to ensure that the perturbation texts with higher privacy protection in the perturbation candidate list have a higher distribution probability, thereby improving the privacy protection effect.

[0080] After determining the probability distribution of tokens after perturbation, when sampling in the perturbation candidate list based on the probability distribution, there is a greater probability of selecting perturbed text units with a higher degree of privacy protection, so that the privacy protection effect of the newly composed perturbed sentences is better.

[0081] In a feasible embodiment, the step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit includes:

[0082] Step S121, performing disturbance transformation on each text unit based on preset disturbance parameters to obtain a plurality of disturbed text units corresponding to each text unit, wherein the disturbance parameters at least include the number of disturbance transformations and the disturbance degree of each disturbance transformation;

[0083] Step S122, composing a perturbation candidate list for each text unit according to the multiple perturbed text units corresponding to each unit.

[0084] It is understandable that when each text unit token is disturbed in the embodiment of the present application, the processing is mainly based on the pre-set disturbance parameters (including the number of times and the degree of disturbance). Exemplarily, the number of text units after the disturbed text in the disturbance candidate list to be obtained can be predetermined, for example, the number can be set to 10, and the degree of disturbance can be set to increase in stages. In these 10 disturbance transformations, each two are in a group, and the degree of disturbance is divided into 5 levels and increases in sequence. Among them, the higher the degree of disturbance, the greater the difference between the text unit after the disturbance and the text unit before the disturbance.

[0085] In the embodiment of the present application, by setting multiple disturbance transformations and gradient disturbance degrees, text units with multiple disturbance degrees can be obtained more comprehensively, so that the distribution of text units in the disturbance candidate list is relatively uniform and comprehensive, and multiple disturbance degrees can be covered when a new sentence is finally formed, so as to facilitate finding the target disturbance sentence with the most coherent relative semantics and the smallest semantic gap with the original sentence. When the quality of the target disturbance sentence is higher, the disturbance query result output by the large language model can be closer to the real query result (the query result corresponding to the original query instruction), reducing the decoding difficulty, and making the final target query result more readable and accurate.

[0086] In a feasible embodiment, the preset condition is the most semantically coherent, and the step of selecting the perturbation sentences whose semantic coherence meets the preset condition from the multiple perturbation sentences corresponding to each original sentence, and determining the perturbation data set includes:

[0087] Step S21, inputting a plurality of perturbed sentences corresponding to each original sentence into a preset semantic coherence evaluation model to obtain a semantic coherence evaluation result of each perturbed sentence;

[0088] Step S23: Based on the semantic coherence evaluation results of the perturbation sentences, the most semantically coherent perturbation sentences among the perturbation sentences corresponding to each original sentence are selected to form a perturbation data set.

[0089] In an embodiment of the present application, a method for selecting the best sentence from multiple disturbed sentences is provided, which implements sentence-level semantic restriction while adding word-level noise to the sentence, thereby reducing the impact of semantic incoherence on subsequent task outputs.

[0090] In the embodiment of the present application, a large language model can be used as a semantic coherence evaluation model to evaluate the semantic coherence of each disturbance sentence. The semantic coherence evaluation model can be the aforementioned large language model or other local large models.

[0091] For example, after each perturbation sentence is input into the semantic coherence evaluation model in sequence, the semantic coherence evaluation model can perform semantic coherence evaluation on the perturbation sentence and output the evaluation score or evaluation grade corresponding to each perturbation sentence. Finally, the perturbation sentence with the highest evaluation score or evaluation grade among the multiple perturbation sentences corresponding to each original sentence is selected. to form a perturbation dataset.

[0092] In another feasible embodiment, each perturbation sentence can be input into the semantic coherence evaluation model, and then a corresponding prompt word can be input, and the prompt word is used to instruct the model to select the one with the best semantic coherence among the perturbation sentences. Compared with the aforementioned method of outputting evaluation scores or evaluation levels, this method can more directly and quickly select the best one among the multiple perturbation sentences corresponding to each original sentence.

[0093] In one possible embodiment, referring to Figure 3 Before the step of inputting the perturbed query result into a pre-trained local decoder and having the local decoder output a target query result corresponding to the original query instruction, the method further includes:

[0094] Step B10, obtaining multiple sets of training data, wherein the training data at least includes historical query results and real query results, the historical query results are obtained by inputting the perturbed training query instructions into the large language model, and the real query results are obtained by inputting the pre-perturbed training query instructions into the large language model;

[0095] Step B20, inputting the historical query results in each training data into the preset local large model in sequence to obtain the corresponding prediction query results;

[0096] Step B30, taking minimizing the difference between the predicted query result and the actual query result as the optimization goal, iteratively optimize the local large model to obtain a local decoder.

[0097] In an embodiment of the present application, a method for training a local decoder is provided to decrypt, clean and denoise the noisy perturbation query results output by a large language model through a trained local decoder to obtain a target query result that meets the requirements of the original query instruction.

[0098] For example, the expression for query processing of the perturbation data set by the large language model LLM can be: llm(S′ best )→o′, where llm() is the large language model, S′ best is the perturbation data set, and o′ is the perturbation query result.

[0099] It should be noted that a local large model can be used to train a local decoder. The local large model can be a large model with basic language understanding capabilities. It is only necessary to fine-tune the local large model for the decoding scenario of the perturbation query result of the embodiment of the present application to obtain a local decoder that can stably output the real query result corresponding to the perturbation query result.

[0100] Before model training, it is necessary to obtain multiple sets of training data, and the process of obtaining training data needs to be combined with the perturbation steps in the aforementioned embodiments. Exemplarily, a batch of commonly used training query instructions in the current field are first obtained, and the training query instructions are directly input into the large language model, and the large language model directly outputs the real query results that can reflect the real needs represented by the training query. In addition, it is also necessary to perturb and screen each original sentence in the training query instruction based on the perturbation steps in steps S10 to S20, determine the corresponding perturbed training query instructions, and then input these perturbed training query instructions into the large language model in turn, and the large language model outputs the corresponding historical query results.

[0101] The functional requirement of the local decoder is to decode the disturbed historical query results and restore them to the real query results, so the real query results can be regarded as the real labels corresponding to the historical query results, which are used for supervised learning of the local large model. In the process of supervised learning, the historical query data is input into the local large model as input data to obtain the predicted query results obtained by the preliminary prediction of the local large model. Among them, the smaller the difference between the predicted query results and the real query results, the better the performance of the local large model. Therefore, in the embodiment of the present application, the optimization goal is to minimize the difference between the predicted query results and the real results (which can be regarded as the model loss), and the model parameters of the local large model are iteratively optimized until the model loss converges, and the training is stopped to obtain the local decoder.

[0102] Exemplarily, decoding the historical query results using the local large model can be expressed as: in, To predict the query result, o′ is the historical query result corresponding to the perturbed training query instruction, and s is the original query instruction.

[0103] Minimizing the difference between the predicted query results and the true query results can be expressed as: Among them, L refers to the model loss, f(s′) refers to the historical query results, refers to the predicted query result, and o refers to the actual query result.

[0104] The embodiment of the present application is equivalent to designing a privacy protection framework for large models, and applying differential privacy strategies to the privacy protection of input texts for large model reasoning. In addition, while adding word-level noise to sentences, sentence-level semantic restrictions are performed, reducing the impact of semantic incoherence on the accuracy of query results output by subsequent large model reasoning tasks. In addition, the embodiment of the present application also provides a trainable local decoder for cleaning perturbed query results containing noise, and obtaining the expected target query results while protecting the user's privacy information.

[0105] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the privacy protection method in the large model reasoning of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0106] This application also provides a privacy protection device in large model reasoning, referring to Figure 4 , the privacy protection device in the large model reasoning includes:

[0107] The perturbation transformation module 10 is used to perform perturbation transformation on each original sentence in the original query instruction to obtain multiple perturbation sentences corresponding to each original sentence;

[0108] The semantic restriction module 20 is used to select the perturbation sentences whose semantic coherence meets the preset conditions from the multiple perturbation sentences corresponding to each original sentence, and determine the perturbation data set;

[0109] A model reasoning module 30 is used to send the perturbation data set to a large language model deployed in the cloud, and obtain a perturbation query result fed back by the large language model;

[0110] The result decoding module 40 is used to input the perturbed query result into a pre-trained local decoder, and the local decoder outputs the target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbed query results and real query results.

[0111] In one embodiment, the disturbance transformation module 10 is used to:

[0112] Splitting each of the original sentences into at least one text unit;

[0113] Performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each of the text units, wherein the perturbation candidate list includes multiple perturbed text units;

[0114] The following steps are executed in a loop: a perturbed sentence corresponding to each original sentence is formed according to the perturbed text units respectively selected from the perturbation candidate list of multiple text units corresponding to each original sentence, until the perturbed sentence corresponding to each original sentence reaches a preset number.

[0115] In one embodiment, the disturbance transformation module 10 is further used for:

[0116] According to the text unit before disturbance, the text unit after disturbance and the preset differential privacy function, the differential privacy function value of each text unit after disturbance is calculated;

[0117] According to the differential privacy function and the preset privacy protection parameters, the distribution probability of each text unit after disturbance is determined, wherein the distribution probability is positively correlated with the differential privacy function value and the privacy protection parameter, and the distribution probability is used to select the disturbed text unit from the disturbance list.

[0118] In one embodiment, the disturbance transformation module 10 is further used for:

[0119] Based on preset disturbance parameters, each text unit is subjected to disturbance transformation to obtain a plurality of disturbed text units corresponding to each text unit, wherein the disturbance parameters at least include the number of disturbance transformations and the disturbance degree of each disturbance transformation;

[0120] According to the multiple perturbed text units corresponding to each unit, a perturbation candidate list for each text unit is formed.

[0121] In one embodiment, the preset condition is the most semantically coherent, and the semantic restriction module 20 is further used to:

[0122] Inputting a plurality of perturbation sentences corresponding to each original sentence into a preset semantic coherence evaluation model to obtain a semantic coherence evaluation result of each perturbation sentence;

[0123] Based on the semantic coherence evaluation results of the perturbation sentences, the most semantically coherent perturbation sentences among the perturbation sentences corresponding to each original sentence are selected to form a perturbation data set.

[0124] In one embodiment, the privacy protection device in the large model reasoning further includes a model training module, and the model training module is used to:

[0125] Acquire multiple sets of training data, wherein the training data at least includes historical query results and real query results, the historical query results are obtained by inputting the perturbed training query instructions into the large language model, and the real query results are obtained by inputting the pre-perturbed training query instructions into the large language model;

[0126] Inputting the historical query results in each of the training data into the preset local large model in sequence to obtain the corresponding predicted query results;

[0127] Taking minimizing the difference between the predicted query result and the actual query result as the optimization goal, the local large model is iteratively optimized to obtain a local decoder.

[0128] The privacy protection device in large model reasoning provided by the present application adopts the privacy protection method in large model reasoning in the above-mentioned embodiment, which can solve the technical problem that the current large model privacy protection scheme will affect the performance of the model and the accuracy of the query results. Compared with the prior art, the beneficial effects of the privacy protection device in large model reasoning provided by the present application are the same as the beneficial effects of the privacy protection method in large model reasoning provided by the above-mentioned embodiment, and the other technical features of the privacy protection device in large model reasoning are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0129] The present application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the privacy protection method in the large model reasoning in the above-mentioned embodiment one.

[0130] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0131] like Figure 5As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0132] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0133] The electronic device provided by the present application adopts the privacy protection method in the large model reasoning in the above-mentioned embodiment, which can solve the technical problem that the current large model privacy protection scheme will affect the performance of the model and the accuracy of the query results. Compared with the prior art, the beneficial effects of the electronic device provided by the present application are the same as the beneficial effects of the privacy protection method in the large model reasoning provided by the above-mentioned embodiment, and the other technical features in the electronic device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0134] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0136] The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the privacy protection method in the large model reasoning in the above-mentioned embodiment.

[0137] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0138] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0139] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes: performing a perturbation transformation on each original sentence in the original query instruction to obtain multiple perturbation sentences corresponding to each original sentence; selecting perturbation sentences whose semantic coherence meets preset conditions from the multiple perturbation sentences corresponding to each original sentence to determine a perturbation data set; sending the perturbation data set to a large language model deployed in the cloud to obtain a perturbation query result fed back by the large language model; inputting the perturbation query result into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbation query results and real query results.

[0140] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0141] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0143] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the privacy protection method in the above-mentioned large model reasoning, and can solve the technical problem that the current large model privacy protection scheme will affect the performance of the model and the accuracy of the query results. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the privacy protection method in the large model reasoning provided in the above-mentioned embodiment, which will not be repeated here.

[0144] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the privacy protection method in large model reasoning as described above.

[0145] The computer program product provided by this application can solve the technical problem that the current large model privacy protection scheme affects the performance of the model and the accuracy of the query results. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the privacy protection method in large model reasoning provided by the above embodiment, which will not be repeated here.

[0146] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A privacy protection method in large model reasoning, characterized in that: Applied to the local end, the privacy protection method in the large model reasoning includes: Performing disturbance transformation on each original sentence in the original query instruction respectively to obtain multiple disturbance sentences corresponding to each original sentence; Selecting the perturbation sentences whose semantic coherence meets the preset conditions from the multiple perturbation sentences corresponding to each original sentence, and determining the perturbation data set; Sending the perturbation data set to a large language model deployed in the cloud, and obtaining a perturbation query result fed back by the large language model; The perturbed query result is input into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbed query results and real query results.

2. The privacy protection method in large model reasoning as claimed in claim 1, characterized in that: The step of performing disturbance transformation on each original sentence in the original query instruction to obtain a plurality of disturbance sentences corresponding to each original sentence comprises: Splitting each of the original sentences into at least one text unit; Performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each of the text units, wherein the perturbation candidate list includes multiple perturbed text units; The following steps are executed in a loop: a perturbed sentence corresponding to each original sentence is formed according to the perturbed text units respectively selected from the perturbation candidate list of multiple text units corresponding to each original sentence, until the perturbed sentence corresponding to each original sentence reaches a preset number.

3. The privacy protection method in large model reasoning as claimed in claim 2, characterized in that: After the step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit, the method further includes: According to the text unit before disturbance, the text unit after disturbance and the preset differential privacy function, the differential privacy function value of each text unit after disturbance is calculated; According to the differential privacy function and the preset privacy protection parameters, the distribution probability of each text unit after disturbance is determined, wherein the distribution probability is positively correlated with the differential privacy function value and the privacy protection parameter, and the distribution probability is used to select the disturbed text unit from the disturbance list.

4. The privacy protection method in large model reasoning as described in claim 2, characterized in that: The step of performing multiple perturbation transformations on each text unit to obtain a perturbation candidate list corresponding to each text unit comprises: Based on preset disturbance parameters, each text unit is subjected to disturbance transformation to obtain a plurality of disturbed text units corresponding to each text unit, wherein the disturbance parameters at least include the number of disturbance transformations and the disturbance degree of each disturbance transformation; According to the multiple perturbed text units corresponding to each unit, a perturbation candidate list for each text unit is formed.

5. The privacy protection method in large model reasoning as claimed in claim 1, characterized in that: The preset condition is the most semantically coherent, and the step of selecting the perturbation sentences whose semantic coherence meets the preset condition from the multiple perturbation sentences corresponding to each original sentence, and determining the perturbation data set comprises: Inputting a plurality of perturbation sentences corresponding to each original sentence into a preset semantic coherence evaluation model to obtain a semantic coherence evaluation result of each perturbation sentence; Based on the semantic coherence evaluation results of the perturbation sentences, the most semantically coherent perturbation sentences among the perturbation sentences corresponding to each original sentence are selected to form a perturbation data set.

6. The privacy protection method in large model reasoning according to any one of claims 1 to 5, characterized in that: Before the step of inputting the perturbed query result into a pre-trained local decoder and having the local decoder output a target query result corresponding to the original query instruction, the method further includes: Acquire multiple sets of training data, wherein the training data at least includes historical query results and real query results, the historical query results are obtained by inputting the perturbed training query instructions into the large language model, and the real query results are obtained by inputting the pre-perturbed training query instructions into the large language model; Inputting the historical query results in each of the training data into the preset local large model in sequence to obtain the corresponding predicted query results; Taking minimizing the difference between the predicted query result and the actual query result as the optimization goal, the local large model is iteratively optimized to obtain a local decoder.

7. A privacy protection device in large model reasoning, characterized in that: The privacy protection device in the large model reasoning includes: A perturbation transformation module is used to perform perturbation transformation on each original sentence in the original query instruction to obtain multiple perturbation sentences corresponding to each original sentence; A semantic restriction module is used to select perturbation sentences whose semantic coherence meets preset conditions from multiple perturbation sentences corresponding to each original sentence, and determine a perturbation data set; A model reasoning module is used to send the perturbation data set to a large language model deployed in the cloud, and obtain the perturbation query result fed back by the large language model; A result decoding module is used to input the perturbed query result into a pre-trained local decoder, and the local decoder outputs a target query result corresponding to the original query instruction, wherein the local decoder is trained by multiple groups of perturbed query results and real query results.

8. An electronic device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the privacy protection method in large model reasoning as described in any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the privacy protection method in large model reasoning as described in any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images