Privacy protection method based on large model and related equipment

Abstract

The embodiment of the invention provides a privacy protection method based on a large model and related equipment, which are used for protecting privacy without influencing the availability of the large model. The method comprises the steps that a first privacy protection sub-module in a privacy protection module serves as a segmentation point, and a large language model is segmented into a first large language sub-model and a second large language sub-model; obtaining to-be-analyzed data input by a user in the large language model, and inputting the to-be-analyzed data into the first large language sub-model to obtain intermediate output data; transmitting the intermediate output data to a second large language sub-model to obtain model output data corresponding to the second large language sub-model; and compensating the model output data according to the target compensation coefficient to obtain hidden state data corresponding to the to-be-analyzed data, and sending the hidden state data to a server provided with a large language model to obtain analysis result data returned after the server analyzes the hidden state data.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of large model privacy protection, and in particular, to a privacy protection method based on a large model and related equipment. Background Art

[0002] At present, big models provide great convenience for our daily work. For example, when we want to obtain certain cloud services, we can upload articles for big models to quickly summarize or upload some text information for big models to translate. In similar scenarios of big model cloud services, data information needs to be uploaded. However, this data may involve privacy. However, there are very few existing studies on some big models in the direction of privacy protection, and these studies have only verified the feasibility of very simple tasks. For more complex tasks (such as mathematical calculations, code writing, etc.), these methods will seriously affect the original performance of the big model, so they are not very practical.

[0003] Therefore, how to minimize the performance loss of large models while ensuring the privacy protection of large models is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide a privacy protection method and related equipment based on a large model, which are used to protect privacy without affecting the availability of the large model.

[0005] In a first aspect, an embodiment of the present application provides a privacy protection method based on a large model, which is applied to a user terminal, wherein a large language model runs on the user terminal, and the large language model includes a privacy protection module. The method includes:

[0006] Taking the first privacy protection submodule in the privacy protection module as a dividing point, the large language model is divided into a first large language submodel and a second large language submodel; wherein the privacy protection module includes a plurality of privacy protection submodules, and the first privacy protection submodule is a privacy protection submodule with a ranking order of the target ranking in the large language model;

[0007] Acquire the data to be analyzed input by the user in the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model;

[0008] The model output data is compensated according to a target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed, and the hidden state data is sent to a server provided with the large language model to obtain analysis result data returned by the server after analyzing the hidden state data.

[0009] Optionally, the dividing the large language model into a first large language sub-model and a second large language sub-model by taking the first privacy protection sub-module in the privacy protection module as a dividing point includes:

[0010] Obtaining the ranking order of all privacy protection submodules in the large language model, and setting the privacy protection submodule with the target ranking as the first privacy protection submodule;

[0011] Setting a preset number of privacy protection submodules in the first large language submodel, and setting the first privacy protection submodule as the last privacy protection submodule in the first large language submodel;

[0012] The privacy protection submodule ranked after the first privacy protection submodule is set in the second largest language submodel.

[0013] Optionally, inputting the data to be analyzed into the first large language sub-model to obtain intermediate output data includes:

[0014] Inputting the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed; wherein the second privacy protection submodule is the first privacy protection submodule in the first large language submodel;

[0015] Performing privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule;

[0016] The first output data is used as input data of the next privacy protection submodule of the second privacy protection submodule, and according to the ranking order, until the first privacy protection submodule of the first large language sub-model receives the input data of the third privacy protection submodule and outputs the intermediate output data; wherein the third privacy protection submodule is the previous privacy protection submodule of the first privacy protection submodule.

[0017] Optionally, the step of inputting the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed includes:

[0018] Input the data to be analyzed into the second privacy protection submodule, perform word segmentation processing on the data to be analyzed, and obtain a dimension matrix corresponding to the vector dimension of each word segmentation length in the data to be analyzed; wherein the dimension matrix is ​​used to represent the first vector data to be analyzed;

[0019] Among them, the dimension matrix is ​​h (i) , the h (i) =l×d, wherein i is used to represent the ranking order of any privacy protection submodule in the first large language submodel, l is used to represent the total length of all word segments after the word segmentation of the data to be analyzed, and d is a preset vector dimension; when any privacy protection submodule is the second privacy protection submodule, i=1.

[0020] Optionally, performing privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule includes:

[0021] The first vector data to be analyzed is input into a privacy protection function calculation formula to obtain the first output data; wherein the privacy protection function calculation formula is: Said It is used to represent the output data of any privacy protection submodule in the first language submodel, where p is a vector of dimension l, and any element p in p i is sampled from the interval set U[1,1+δ], where δ is the privacy parameter, is a vector of all 1s of dimension d d is the transpose of , and the ⊙ is the Hadamard product.

[0022] Optionally, compensating the model output data according to a target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed includes:

[0023] The model output data is input into the compensation function calculation formula to obtain the hidden state data; wherein the compensation function calculation formula is Said is used to represent the hidden state data obtained after compensation processing in the second largest language sub-model, the m is used for the ranking order of the last privacy protection sub-module in the second largest language sub-model, and the h (m) It is used to represent the output data of the last privacy protection submodule in the second largest language submodel, where C = c·1 l , c is the target compensation coefficient, and C is an l-dimensional vector whose elements are all c.

[0024] Optionally, before compensating the model output data according to the target compensation coefficient, the method further includes:

[0025] Setting multiple initial compensation coefficients and initial training data;

[0026] Inputting the initial training data into all privacy protection submodules in the first large language submodel, and obtaining the to-be-trained output data corresponding to the initial training data output by the first large language submodel based on different initial compensation coefficients;

[0027] Performing compensation processing on the output data to be trained to obtain hidden state data to be trained corresponding to the initial training data, so as to send the hidden state data to be trained to the large language model to obtain training result data returned by the large language model;

[0028] The target result data having the highest accuracy rate among all the training result data are determined, and the initial compensation coefficient corresponding to the target result data is used as the target compensation coefficient.

[0029] A second aspect of the embodiment of the present application provides a privacy protection system based on a large model, which is applied to a user terminal, and the large language model runs on the user terminal. The large language model includes a privacy protection module, and the system includes:

[0030] A segmentation unit, configured to segment the large language model into a first large language sub-model and a second large language sub-model with the first privacy protection sub-module in the privacy protection module as a segmentation point; wherein the privacy protection module includes a plurality of privacy protection sub-modules, and the first privacy protection sub-module is a privacy protection sub-module with a ranking order of the target ranking in the large language model;

[0031] an acquisition unit, configured to acquire data to be analyzed input by a user into the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model;

[0032] A sending unit is used to compensate the model output data according to a target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed, and send the hidden state data to a server provided with the large language model to obtain analysis result data returned by the server after analyzing the hidden state data.

[0033] The big model-based privacy protection system provided in the second aspect of the embodiment of the present application is used to execute the big model-based privacy protection method described in the first aspect.

[0034] A third aspect of the embodiments of the present application provides a privacy protection device based on a large model, including:

[0035] CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply;

[0036] The memory is a short-term storage memory or a persistent storage memory;

[0037] The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the privacy protection method based on the large model described in the first aspect.

[0038] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the privacy protection method based on a large model described in the first aspect.

[0039] A fifth aspect of an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a computer, the computer executes the privacy protection method based on a large model described in the first aspect.

[0040] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages: through the privacy protection method based on a large model disclosed in the embodiments of the present application, it can be ensured that the server with a large language model cannot directly obtain the user's data, and at the same time, it can also compensate for the performance loss caused by the large language model in privacy protection. Through the combination of the two, it is ultimately possible to effectively protect the user's privacy without affecting the model performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0042] Figure 1 A distributed reasoning architecture diagram disclosed in an embodiment of the present application;

[0043] Figure 2 A flowchart of a privacy protection method based on a large model disclosed in an embodiment of the present application;

[0044] Figure 3 A flowchart of another privacy protection method based on a large model disclosed in an embodiment of the present application;

[0045] Figure 4 A flowchart of another privacy protection method based on a large model disclosed in an embodiment of the present application;

[0046] Figure 5 A flowchart of another privacy protection method based on a large model disclosed in an embodiment of the present application;

[0047] Figure 6 A schematic diagram of a privacy protection module disclosed in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the structure of a privacy protection system based on a large model disclosed in an embodiment of the present application;

[0049] Figure 8 This is a schematic diagram of the structure of a privacy protection device based on a large model disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] To solve the technical problems mentioned above, please refer to Figure 1 , Figure 1This is a diagram of a distributed reasoning architecture disclosed in the embodiment of the present application. It should be noted that the embodiment of the present application mainly adopts a distributed reasoning architecture, that is, the provider of a large language model (or described as a large model) reaches an agreement with the user to deploy a small part of the large model on the user side. Figure 1 As can be seen in (a), a small number of modules (a small number of modules include the embedding layer of the large language model and a small number of attention layers. By performing some subsequent operations on these modules, they become "privacy protection modules") are deployed on the user side to protect the user's privacy. Figure 1 (a) shows an example where a user uploads a "context" and gives a series of "instructions" to the big model to return some routes to city B. At this point, the big model should infer from the context that the user is currently in city A and provide the user with a route from city A to city B. Figure 1 (a) What users transmit to the big model is the hidden state after the privacy protection module. We assume that when a malicious service provider obtains the hidden state, even if an advanced reconstruction attack method is used, it is impossible to reconstruct the user's original data (such as Figure 1 The red box shows a failure of privacy protection because the service provider completely reconstructs the user’s original data. Figure 1 (b) demonstrates the goal of the present invention, that is, after passing through the privacy protection module designed by us, the big model service provider cannot reconstruct the user's original data, and at the same time the big model can return the correct response, that is, give the correct travel route from city A to city B.

[0054] See also Figure 2 , Figure 2 The flowchart of a privacy protection method based on a large model disclosed in an embodiment of the present application includes steps 201 to 203.

[0055] 201. Taking the first privacy protection submodule in the privacy protection module as a dividing point, divide the large language model into a first large language submodel and a second large language submodel.

[0056] It should be noted in advance that this embodiment is applied to the user end, wherein a large language model is running on the user end, and the user end can be referred to as a business server or a terminal cluster. Among them, the above-mentioned business server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud database, cloud service, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN, and big data and artificial intelligence platform. The terminal device can be a smart phone, tablet computer, laptop computer, desktop computer, PDA, mobile Internet device (MID, mobile internet device), wearable device (such as smart watch, smart bracelet, etc.), smart computer, smart car and other smart terminals.

[0057] In this embodiment, in order to design a reliable user-side privacy protection module, it is necessary to divide the privacy protection module in the large language model. Specifically, the large language model is divided into a first large language sub-model and a second large language sub-model with the first privacy protection sub-module in the privacy protection module as the dividing point. It should be noted that the privacy protection module includes multiple privacy protection sub-modules, and the first privacy protection sub-module is a privacy protection sub-module with a ranking order of the target ranking in the large language model.

[0058] In one specific embodiment, the first privacy protection submodule may be the second-to-last privacy protection submodule in the large language model. That is to say, the privacy protection submodule ranked last is located in the second largest language submodel, and the remaining privacy protection submodules are all located in the first largest language submodel. Furthermore, the first largest language submodel and the second largest language submodel described above can also be understood as dividing the large language model into submodels that perform different module functions, rather than splitting the large language model into two independent submodels. Furthermore, the privacy protection submodule is an understanding of each layer of privacy protection module in the large language model. For details, please refer to Figure 6 , Figure 6 Schematic diagram of a privacy protection module disclosed in the embodiment of this application. Figure 6 It can be seen that Figure 1 The privacy protection module in is composed of (m-1) layers Figure 6 Submodules and layer 1 in (a) Figure 6The submodules in (b) are connected in series (therefore, the privacy protection module on the user side has a total of m layers). In the first (m-1) layers, a privacy protection PrivScale operation is performed on the output of each layer (this operation will be described in detail later), that is, the PrivScale operation is performed on each i-th layer (i<m, and i and m are both positive integers), thereby achieving privacy protection. In the m-th layer, a CompScale operation is performed on the output of the m-th layer (CompScale combines the word compensation Compensation and the transformation scale, which can be understood as "scaling transformation for compensation". The specific operation will be described later, and it is roughly to amplify the output of the large language model in proportion) to compensate for performance. Finally, the output of the m-th layer is sent to the large model service provider as the final hidden state, and the response returned by the large model is obtained. In one of the feasible technical solutions, m can be set to 10, or 20, etc., and there is no specific limitation here.

[0059] 202. Obtain the data to be analyzed input by the user in the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model.

[0060] Then, based on step 201, the data to be analyzed input by the user in the large language model can be obtained, so that the large language model inputs the data to be analyzed into the first large language sub-model to obtain intermediate output data; then, the intermediate output data is transmitted to the second large language sub-model to obtain model output data corresponding to the second large language sub-model.

[0061] In one specific embodiment, in combination Figure 1 As shown, the user can input various sentences, prompt words or instructions (taking English as an example) in the input interface of the user end provided with the large language model, for example, the travel route to a certain place. Thus, the large language model can recognize the various sentences, prompt words or instructions input by the user at this time, thereby generating data to be analyzed. Then, the data to be analyzed is input into the first large language sub-model (first input into the privacy protection sub-module corresponding to the first layer of the first large language sub-model, and then the output of the first layer is used as the input of the second layer, and analyzed one by one according to the ranking order), so as to obtain the data output by the privacy protection sub-module of the first large language sub-model, and then the PrivScale operation is performed on the data output by the privacy protection sub-module, so as to obtain the intermediate output data (the execution steps in the first large language sub-model are the same). It should be noted that the intermediate output data at this time can be understood as the data output by the layer corresponding to the first privacy protection sub-module.

[0062] Then, the intermediate output data is used as the input data of the second largest language sub-model, so that the intermediate output data is analyzed in the privacy protection sub-module of the second largest language sub-model to obtain the output data of the second largest language sub-model, that is, the model output data.

[0063] 203. Compensate the model output data according to the target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed, and send the hidden state data to a server equipped with a large language model to obtain analysis result data replied by the server after analyzing the hidden state data.

[0064] Then, the model output data is compensated according to the target compensation coefficient to obtain the hidden state data corresponding to the data to be analyzed. Then, the hidden state data is sent to the server equipped with a large language model, thereby obtaining the analysis result data replied by the server after analyzing the hidden state data.

[0065] In one specific embodiment, the model output data is subjected to a CompScale operation by screening the completed target compensation coefficient, thereby obtaining the hidden state data output by the second largest language sub-model. It should be noted that the hidden state data at this time corresponds to the data to be analyzed input by the user. Then, the large language model on the user side can send the hidden state data to the server side (the server side is also provided with a large language model similar to that of the user side), so that the server side uses the large language model to perform data analysis on the hidden state data and obtains the analysis result data. Thus, the user side can receive the analysis result data returned by the server side, wherein the analysis result data is a response to various sentences, prompt words or instructions input by the user.

[0066] The privacy protection method based on a large model disclosed in this embodiment can ensure that the server with a large language model cannot directly obtain the user's data, and can also compensate for the performance loss caused by the large language model in privacy protection. Through the combination of the two, it is ultimately possible to effectively protect the user's privacy without affecting the model performance.

[0067] For further explanation Figure 2 Step 201 is shown in FIG. Figure 3 , Figure 3 This is a flowchart of another privacy protection method based on a large model disclosed in an embodiment of the present application, including steps 301 to 303.

[0068] 301. Obtain the ranking order of all privacy protection sub-modules in the large language model, and set the privacy protection sub-module with the target ranking as the first privacy protection sub-module.

[0069] Corresponds to Figure 2As shown in step 201, in this embodiment, the ranking order of all privacy protection sub-modules in the large language model can be obtained first, and then the privacy protection sub-module with the target ranking can be set as the first privacy protection sub-module.

[0070] In one specific embodiment, it is necessary to first obtain the privacy protection module set in the large language model, and then determine all the privacy protection sub-modules contained in the privacy protection module and their ranking order, and then set the privacy protection sub-module with the target ranking as the first privacy protection sub-module. Then, the first privacy protection sub-module is used as the dividing point between the first large language sub-module and the second large language sub-model.

[0071] Furthermore, combined with Figure 6 As known, the first privacy protection submodule can be understood as the privacy protection submodule corresponding to the (m-1)th layer in the large language model, where m is the number of blocks of all privacy protection submodules included in the large language model.

[0072] 302. Set a preset number of privacy protection sub-modules in the first largest language sub-model, and set the first privacy protection sub-module as the last privacy protection sub-module in the first largest language sub-model.

[0073] Therefore, based on step 301, a preset number of privacy protection sub-modules can be set in the first large language sub-model, and the first privacy protection sub-module is set as the last privacy protection sub-module in the first large language sub-model.

[0074] In one specific embodiment, in combination Figure 6 As described in the aforementioned steps, the (m-1)-block privacy protection submodule can be set in the first large language submodel. Correspondingly, the first privacy protection submodule is the last privacy protection submodule in the first large language submodel.

[0075] 303. Set the privacy protection submodule ranked after the first privacy protection submodule in the second largest language submodel.

[0076] Combined with step 302, the privacy protection submodule ranked after the first privacy protection submodule can be set in the second largest language submodel.

[0077] In one specific embodiment, the privacy protection submodule ranked in the mth order is set in the second largest language submodel. Furthermore, the m blocks of privacy protection submodules are respectively deployed in the first largest language submodel and the second largest language submodel. Among them, the first (m-1) blocks of privacy protection submodules are located in the first largest language submodel, and the mth block of privacy protection submodule is located in the second largest language submodel.

[0078] In other feasible technical solutions, the privacy protection submodules may be set for the first largest language submodel and the second largest language submodel in other ways, and other numbers of privacy protection submodules may be set for the first largest language submodel and the second largest language submodel. For example, at least two privacy protection submodules may be set for the second largest language submodel. No specific limitation is made here.

[0079] Furthermore, to facilitate subsequent understanding, the division of privacy protection submodules

[0080] Through the privacy protection method based on a large model disclosed in this embodiment, a reliable user-side privacy protection module can be designed by splitting the privacy protection module into large language sub-models that implement different privacy protection operations. After the hidden state after passing through the module is transmitted to the service provider of the large language model, they cannot reconstruct the user's original data based on these hidden states.

[0081] For further explanation Figure 2 Steps 202 to 203 are shown in FIG. Figure 4 , Figure 4 This is a flowchart of another privacy protection method based on a large model disclosed in an embodiment of the present application, including steps 401 to 405.

[0082] 401. Input the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed.

[0083] It should be noted that, in this embodiment, steps 401 to 405 are mainly Figure 2 Detailed description of step 202-step 203 is shown. In this embodiment, the acquired data to be analyzed is first input into the second privacy protection submodule of the first large language submodel, so as to obtain the first vector data to be analyzed corresponding to the data to be analyzed. It should be noted that the second privacy protection submodule is the first privacy protection submodule in the first large language submodel, that is, the privacy protection submodule with the first ranking (i=1) in the first large language submodel.

[0084] In one specific embodiment, the data to be analyzed can be input into the second privacy protection submodule, and the data to be analyzed can be segmented to obtain a dimension matrix corresponding to the vector dimension of each segmentation length in the data to be analyzed. Specifically, the dimension matrix is ​​used to represent the first vector data to be analyzed. The dimension matrix is ​​h (i) ,h (i)=l×d formula (1), i is used to represent the ranking order of any privacy protection submodule in the first language submodel (that is, the layer number or the order in the ranking order of the privacy protection submodule at this time), l is used to represent the total length of all segmented words after the data to be analyzed is processed by segmentation, and d is the preset vector dimension. Furthermore, when any privacy protection submodule is the second privacy protection submodule, i=1.

[0085] Therefore, from the above description, it can be understood that for the first large language sub-model, let the original output of the i-th layer be h (i) , where h (i) is an l×d tensor (which can be understood as a matrix), l is the length of the prompt word entered by the user (which can be understood as the total length of the content output by the user after word segmentation, for example, the word "playing" will become "play" and "ing" after word segmentation. The word "play" is still "play" after word segmentation), d is the dimension of the intermediate state of each word tag token (which can be a preset vector dimension, for example, 4096 or 3028, etc.), because there are a total of l tokens, each token corresponds to an output d-dimensional vector, which together is an l×d h (i) It should be noted that large language models usually convert each segmented word into a vector and then perform calculations on the vector. Here we assume that the dimension of the vector is d-dimensional, and because there are a total of l segmented words, the final result is a 1*d matrix.

[0086] 402. Perform privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule.

[0087] Then, based on step 401, the first vector data to be analyzed may be subjected to privacy protection processing according to the privacy parameter, thereby obtaining first output data corresponding to the second privacy protection submodule.

[0088] In one specific embodiment, the first vector data to be analyzed can be input into a privacy protection function calculation formula to obtain first output data. It should be noted that the privacy protection function calculation formula is: Formula (2), It is used to represent the output data of any privacy protection submodule in the first language submodel, where p is a vector of dimension l, and any element p in p i is sampled from the interval set U[1,1+δ], where δ is the privacy parameter, is a vector of all 1s of dimension d d The transpose of , ⊙ is the Hadamard product.

[0089] Therefore, from the above description, it can be understood that after obtaining the first vector data to be analyzed of the second privacy protection submodule, a PrivScale operation can be performed on the first vector data to be analyzed, thereby obtaining the first output data output by the privacy protection submodule of the first layer. Furthermore, for the privacy protection submodules of other layers of the first large language submodel, combined with step 402, it is assumed that after the PrivScale operation, the new i-th layer output is as follows: In other words, the output of layer i is h (i) After PrivScale operation, we get Where p is an l-dimensional vector (p times It is a 1*d matrix, with dimension h (i) Same as and, we can multiply), each p in p i The elements are sampled from the uniform distribution U[1,1+δ], where δ is the privacy parameter set by the user. The larger the δ, the stronger the privacy protection, and the smaller the δ, the weaker the privacy protection. Furthermore, U[1,1+δ] is a random sampling, which means randomly selecting a number from 1 to 1+δ. is a d-dimensional all-1 vector1 d The transpose of It is a h (i) and the same l×d matrix, ⊙ is the Hadamard product. Note that this method preserves the dimension reduction in the direction because for h (i) Each d-dimensional vector in After the above operations, the direction of the vector will not change, only the scale will change.

[0090] From this, it can be understood that if it is layer 3, then the output is

[0091] 403. Use the first output data as input data of the next privacy protection submodule of the second privacy protection submodule, and in accordance with the ranking order, until the first privacy protection submodule of the first large language submodel receives the input data of the third privacy protection submodule and outputs the intermediate output data.

[0092] Thus, based on step 402, the first output data can be used as input data of the next privacy protection submodule of the second privacy protection submodule, and according to the ranking order, until the first privacy protection submodule of the first large language submodel receives the input data of the third privacy protection submodule and outputs the intermediate output data. It should be noted that the third privacy protection submodule is the previous privacy protection submodule of the first privacy protection submodule.

[0093] In one specific embodiment, the first output data output by the second privacy protection submodule located in the first layer of the first large language submodel is used as the input data of the privacy protection submodule located in the next layer of the second privacy protection submodule, and then the operations of formula (1) and formula (2), i.e., PrivScale operation, are performed in sequence according to step 401-step 402. Then, according to the ranking order, the first privacy protection submodule of the first large language submodel receives the input data of the privacy protection submodule located in the previous layer of the first privacy protection submodule and outputs the intermediate output data.

[0094] Furthermore, assuming that the first output data of the first layer is Then it can be understood that at this time, As the input data of the second-layer privacy protection submodule, h (2) and Until the first privacy protection submodule receives the input data of the privacy protection submodule located in the upper layer of the first privacy protection submodule Then, the first privacy protection submodule can output the intermediate output data, which is

[0095] 404. Transmit the intermediate output data to the second largest language sub-model to obtain model output data corresponding to the second largest language sub-model.

[0096] In this embodiment, step 404 is similar to the above Figure 2 The step 202 in the example is similar and will not be described in detail here. However, it should be noted that in this embodiment, the intermediate output data is Will Input to the privacy protection submodule (block m) of the second largest language submodel, thus, the privacy protection submodule of the second largest language submodel uses formula (1) to achieve , and thus obtain h (m) , which is the model output data described above.

[0097] 405. Input the model output data into the compensation function calculation formula to obtain hidden state data, and send the hidden state data to the server end provided with a large language model to obtain the analysis result data returned by the server end after analyzing the hidden state data.

[0098] Based on step 405, the model output data is input into the compensation function calculation formula to obtain the hidden state data, and the hidden state data is sent to the server end provided with the large language model to obtain the analysis result data returned by the server end after analyzing the hidden state data. It should be noted that the compensation function calculation formula is It is used to represent the hidden state data obtained after compensation processing in the second largest language sub-model, m is used to rank the last privacy protection sub-module in the second largest language sub-model, and h (m) It is used to represent the output data of the last privacy protection submodule in the second largest language submodel, C = c 1 l , c is the target compensation coefficient, and C is a l-dimensional vector whose elements are all c.

[0099] Therefore, from the above description, it can be understood that the model output data h of the mth layer needs to be (m) Perform the CompScale operation. Specifically, after the (m-1) consecutive layers of PrivScale operations, the original output h of the mth layer (m) , the following formula (3) is used for compensation, where C = c·1 l is an l-dimensional vector whose elements are all c, and c is the compensation coefficient. It should be added that the compensation coefficient is a constant, such as 1, 2, 3, etc. It is equivalent to multiplying the output of the mth layer by c.

[0100] The privacy protection method based on a large model disclosed in this embodiment firstly adopts direction-preserving hidden state random scale shrinkage, which can protect user privacy data while having a small impact on the availability of the model; at the same time, a direction-preserving adaptive hidden state compensation technology is proposed afterwards, which can further alleviate the performance degradation problem caused by the previous operation. By combining the two, privacy protection can be achieved without affecting the availability of the large model.

[0101] For other possible technical solutions, please refer to Figure 5 , Figure 5 This is a flow chart of another privacy protection method based on a large model disclosed in an embodiment of the present application, including steps 501 to 504.

[0102] 501. Set initial training data and multiple initial compensation coefficients.

[0103] It should be noted that the present embodiment mainly describes the strategy for obtaining the compensation coefficient. Specifically, it is necessary to first set initial training data and a plurality of initial compensation coefficients.

[0104] In one of the specific embodiments, several math problems are first selected from the math calculation data set GSM8K. GSM8K is a data set with many math problems. For example, Xiao Ming has two apples. He eats one and has several left (of course, it will be more difficult than this example in reality). Then, this problem is input into the model and the model is asked to answer it to see if it can answer it correctly. We keep adjusting the compensation coefficient c until the model answers the most questions correctly. Then, the above selected math problems are used as the initial training data, and multiple and different compensation coefficients are set as the initial compensation coefficients.

[0105] 502. Input the initial training data into all privacy protection submodules in the first largest language submodel, and based on different initial compensation coefficients, obtain the to-be-trained output data corresponding to the initial training data output by the first largest language submodel.

[0106] Then, the initial training data is input into all privacy protection submodules in the first largest language submodel, and based on different initial compensation coefficients, the to-be-trained output data corresponding to the initial training data output by the first largest language submodel are obtained respectively.

[0107] In one specific embodiment, please refer to the above Figure 2 , Figure 3 and Figure 4 In the illustrated embodiment, the initial training data is used as the input data of the large language model (understood as the data to be analyzed), and these mathematical problems are input into the privacy protection submodule of the first (m-1) layer (using formula (1) and formula (2)) to obtain the output data to be trained of the initial training data output by the first large language submodel.

[0108] 503. Perform compensation processing on the output data to be trained to obtain hidden state data to be trained corresponding to the initial training data, and send the hidden state data to be trained to the large language model to obtain the training result data returned by the large language model.

[0109] Then, the output data to be trained is compensated to obtain hidden state data to be trained corresponding to the initial training data, so as to send the hidden state data to be trained to the large language model to obtain the training result data returned by the large language model.

[0110] In one specific embodiment, the output data to be trained output by the first privacy protection submodule is again subjected to formula (2), and then the data obtained according to formula (2) is compensated with different c values. It should be noted that, in the mth layer, one c is used for compensation, for example, c is increased by 0.5 from 1 to 5 at a time. Then, the hidden state data to be trained corresponding to different c can be obtained respectively, that is, In short, the following simplified steps describe the input of mathematical problems into the model and obtain h (m) Then use c to h (m) To compensate for Then Transmit it to the server and obtain the results returned by the server's large language model, that is, the training result data.

[0111] 504. Determine the target result data with the highest accuracy among all the training result data, and use the initial compensation coefficient corresponding to the target result data as the target compensation coefficient.

[0112] Then, the target result data with the highest accuracy among all the training result data can be determined, and the initial compensation coefficient corresponding to the target result data is used as the target compensation coefficient.

[0113] In one specific embodiment, when the result returned by the large language model has the highest accuracy among the several mathematical problems, the c value at this time is selected as the final compensation coefficient, that is, the target compensation coefficient.

[0114] Through the privacy protection method based on a large model disclosed in this embodiment, the compensation value in the large language model can be effectively adjusted, so that the result returned by the large language model has the highest accuracy, thereby improving the feasibility of the solution.

[0115] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0116] See also Figure 7 , Figure 7 A schematic diagram of the structure of a privacy protection system based on a large model disclosed in an embodiment of the present application.

[0117] A segmentation unit 701 is used to segment the large language model into a first large language sub-model and a second large language sub-model with the first privacy protection sub-module in the privacy protection module as a segmentation point; wherein the privacy protection module includes a plurality of privacy protection sub-modules, and the first privacy protection sub-module is a privacy protection sub-module with a ranking order of the target ranking in the large language model;

[0118] The acquisition unit 702 is used to acquire the data to be analyzed input by the user in the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model;

[0119] The sending unit 703 is used to compensate the model output data according to the target compensation coefficient to obtain the hidden state data corresponding to the data to be analyzed, and send the hidden state data to the server end provided with a large language model to obtain the analysis result data returned by the server end after analyzing the hidden state data.

[0120] Exemplarily, the system further includes: a setting unit 704;

[0121] The obtaining unit 702 is specifically used to obtain the ranking order of all privacy protection submodules in the large language model, and set the privacy protection submodule with the target ranking as the first privacy protection submodule;

[0122] A setting unit 704, configured to set a preset number of privacy protection submodules in the first large language submodel, and set the first privacy protection submodule as the last privacy protection submodule in the first large language submodel;

[0123] The setting unit 704 is further configured to set the privacy protection submodule ranked after the first privacy protection submodule in the second largest language submodel.

[0124] Exemplarily, the system includes:

[0125] The acquisition unit 702 is specifically configured to input the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed; wherein the second privacy protection submodule is the first privacy protection submodule in the first large language submodel;

[0126] The acquisition unit 702 is further configured to perform privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule;

[0127] The setting unit 704 is specifically used to use the first output data as the input data of the next privacy protection submodule of the second privacy protection submodule, and according to the ranking order, until the first privacy protection submodule of the first large language sub-model receives the input data of the third privacy protection submodule and outputs the intermediate output data; wherein the third privacy protection submodule is the previous privacy protection submodule of the first privacy protection submodule.

[0128] Exemplarily, the system further includes: an input unit 705;

[0129] An input unit 705 is used to input the data to be analyzed into the second privacy protection submodule, perform word segmentation processing on the data to be analyzed, and obtain a dimension matrix corresponding to the vector dimension of each word segmentation length in the data to be analyzed; wherein the dimension matrix is ​​used to represent the first vector data to be analyzed;

[0130] Among them, the dimension matrix is ​​h (i) ,h (i) =l×d, i is used to represent the ranking order of any privacy protection submodule in the first language submodel, l is used to represent the total length of all word segmentations after the word segmentation of the data to be analyzed, and d is the preset vector dimension; when any privacy protection submodule is the second privacy protection submodule, i=1.

[0131] Exemplarily, the system includes:

[0132] The input unit 705 is specifically used to input the first vector data to be analyzed into the privacy protection function calculation formula to obtain the first output data; wherein the privacy protection function calculation formula is It is used to represent the output data of any privacy protection submodule in the first language submodel, where p is a vector of dimension l, and any element p in p i is sampled from the interval set U[1,1+δ], where δ is the privacy parameter, is a vector of all 1s of dimension d d The transpose of , ⊙ is the Hadamard product.

[0133] Exemplarily, the system includes:

[0134] The input unit 705 is specifically used to input the model output data into the compensation function calculation formula to obtain the hidden state data; wherein the compensation function calculation formula is It is used to represent the hidden state data obtained after compensation processing in the second largest language sub-model, m is used to rank the last privacy protection sub-module in the second largest language sub-model, and h (m) It is used to represent the output data of the last privacy protection submodule in the second largest language submodel, C = c 1 l , c is the target compensation coefficient, and C is a l-dimensional vector whose elements are all c.

[0135] Exemplarily, the system further includes: a setting unit 706 and a determining unit 707;

[0136] A setting unit 706, used to set a plurality of initial compensation coefficients and initial training data;

[0137] The input unit 705 is further used to input the initial training data into all the privacy protection submodules in the first largest language submodel, and obtain the to-be-trained output data corresponding to the initial training data output by the first largest language submodel based on different initial compensation coefficients;

[0138] The acquisition unit 702 is further used to perform compensation processing on the output data to be trained to obtain the hidden state data to be trained corresponding to the initial training data, so as to send the hidden state data to be trained to the large language model to obtain the training result data returned by the large language model;

[0139] The determination unit 707 is used to determine the target result data with the highest accuracy among all the training result data, and use the initial compensation coefficient corresponding to the target result data as the target compensation coefficient.

[0140] See below Figure 8 , a structural diagram of a privacy protection device based on a large model disclosed in an embodiment of the present application includes:

[0141] CPU 801, memory 805, input / output interface 804, wired or wireless network interface 803 and power supply 802;

[0142] The memory 805 is a temporary storage memory or a permanent storage memory;

[0143] The CPU 801 is configured to communicate with the memory 805 and execute the instructions in the memory 805 to perform the aforementioned Figures 2 to 5 A privacy protection method based on a large model in any of the illustrated embodiments.

[0144] The embodiment of the present application also provides a chip system, the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or instruction to execute the aforementioned Figures 2 to 5 A privacy protection method based on a large model in any of the illustrated embodiments.

[0145] The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium includes instructions, when the instructions are executed on a computer, the computer executes the aforementioned Figures 2 to 5 A privacy protection method based on a large model in any of the illustrated embodiments.

[0146] The present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the aforementioned Figures 2 to 5 A privacy protection method based on a large model in any of the illustrated embodiments.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0148] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0151] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A privacy protection method based on a large model, characterized in that: Applied to a user terminal, a large language model is run on the user terminal, the large language model includes a privacy protection module, and the method includes: Taking the first privacy protection submodule in the privacy protection module as a dividing point, the large language model is divided into a first large language submodel and a second large language submodel; wherein the privacy protection module includes a plurality of privacy protection submodules, and the first privacy protection submodule is a privacy protection submodule with a ranking order of the target ranking in the large language model; Acquire the data to be analyzed input by the user in the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model; The model output data is compensated according to a target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed, and the hidden state data is sent to a server provided with the large language model to obtain analysis result data returned by the server after analyzing the hidden state data.

2. The privacy protection method based on a large model according to claim 1, characterized in that: The method of dividing the large language model into a first large language sub-model and a second large language sub-model by taking the first privacy protection sub-module in the privacy protection module as a dividing point comprises: Obtaining the ranking order of all privacy protection submodules in the large language model, and setting the privacy protection submodule with the target ranking as the first privacy protection submodule; Setting a preset number of privacy protection submodules in the first large language submodel, and setting the first privacy protection submodule as the last privacy protection submodule in the first large language submodel; The privacy protection submodule ranked after the first privacy protection submodule is set in the second largest language submodel.

3. The privacy protection method based on a large model according to claim 1, characterized in that: The step of inputting the data to be analyzed into the first large language sub-model to obtain intermediate output data includes: Inputting the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed; wherein the second privacy protection submodule is the first privacy protection submodule in the first large language submodel; Performing privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule; The first output data is used as input data of the next privacy protection submodule of the second privacy protection submodule, and according to the ranking order, until the first privacy protection submodule of the first large language sub-model receives the input data of the third privacy protection submodule and outputs the intermediate output data; wherein the third privacy protection submodule is the previous privacy protection submodule of the first privacy protection submodule.

4. The privacy protection method based on a large model according to claim 3 is characterized in that: The step of inputting the data to be analyzed into the second privacy protection submodule of the first large language submodel to obtain first vector data to be analyzed corresponding to the data to be analyzed includes: Input the data to be analyzed into the second privacy protection submodule, perform word segmentation processing on the data to be analyzed, and obtain a dimension matrix corresponding to the vector dimension of each word segmentation length in the data to be analyzed; wherein the dimension matrix is ​​used to represent the first vector data to be analyzed; Among them, the dimension matrix is ​​h (i) , the h (i) =l×d, wherein i is used to represent the ranking order of any privacy protection submodule in the first large language submodel, l is used to represent the total length of all word segments after the word segmentation of the data to be analyzed, and d is a preset vector dimension; when any privacy protection submodule is the second privacy protection submodule, i=1.

5. The privacy protection method based on a large model according to claim 4, characterized in that: The performing privacy protection processing on the first vector data to be analyzed according to the privacy parameter to obtain first output data corresponding to the second privacy protection submodule includes: The first vector data to be analyzed is input into a privacy protection function calculation formula to obtain the first output data; wherein the privacy protection function calculation formula is: Said It is used to represent the output data of any privacy protection submodule in the first language submodel, where p is a vector of dimension l, and any element p in p i is sampled from the interval set U[1,1+δ], where δ is the privacy parameter, is a vector of all 1s of dimension d d is the transpose of , and the ⊙ is the Hadamard product.

6. The privacy protection method based on a large model according to claim 4, characterized in that: The compensating the model output data according to the target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed includes: The model output data is input into the compensation function calculation formula to obtain the hidden state data; wherein the compensation function calculation formula is Said is used to represent the hidden state data obtained after compensation processing in the second largest language sub-model, the m is used for the ranking order of the last privacy protection sub-module in the second largest language sub-model, and the h (m) It is used to represent the output data of the last privacy protection submodule in the second largest language submodel, where C = c·1 l , c is the target compensation coefficient, and C is an l-dimensional vector whose elements are all c.

7. The privacy protection method based on a large model according to claim 3, characterized in that: Before compensating the model output data according to the target compensation coefficient, the method further includes: Setting initial training data and multiple initial compensation coefficients; Inputting the initial training data into all privacy protection submodules in the first large language submodel, and obtaining the to-be-trained output data corresponding to the initial training data output by the first large language submodel based on different initial compensation coefficients; Performing compensation processing on the output data to be trained to obtain hidden state data to be trained corresponding to the initial training data, so as to send the hidden state data to be trained to the large language model to obtain training result data returned by the large language model; The target result data having the highest accuracy rate among all the training result data are determined, and the initial compensation coefficient corresponding to the target result data is used as the target compensation coefficient.

8. A privacy protection system based on a large model, characterized in that: Applied to a user terminal, a large language model is run on the user terminal, the large language model includes a privacy protection module, and the method includes: A segmentation unit, configured to segment the large language model into a first large language sub-model and a second large language sub-model with the first privacy protection sub-module in the privacy protection module as a segmentation point; wherein the privacy protection module includes a plurality of privacy protection sub-modules, and the first privacy protection sub-module is a privacy protection sub-module with a ranking order of the target ranking in the large language model; an acquisition unit, configured to acquire data to be analyzed input by a user into the large language model, input the data to be analyzed into the first large language sub-model to obtain intermediate output data; transmit the intermediate output data to the second large language sub-model to obtain model output data corresponding to the second large language sub-model; A sending unit is used to compensate the model output data according to a target compensation coefficient to obtain hidden state data corresponding to the data to be analyzed, and send the hidden state data to a server provided with the large language model to obtain analysis result data returned by the server after analyzing the hidden state data.

9. A privacy protection device based on a large model, characterized in that: The device comprises: CPU, memory, input and output interfaces, wired or wireless network interfaces, and power supply; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instruction operations in the memory to perform the large model-based privacy protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer executes the privacy protection method based on a large model as described in any one of claims 1 to 7.

Images