Data privacy protection method, system and device for large language model application

Abstract

The embodiment of the invention is suitable for the technical field of artificial intelligence, and provides a data privacy protection method, system and device for large language model application, the method is applied to client equipment, and the client equipment is deployed with an input layer and an output layer of a large language model. The method comprises the steps that text input data of the large language model is coded according to a vocabulary, a mark list represented by integers is obtained, and the vocabulary comes from a server; processing the mark list through the input layer to obtain intermediate input data; the intermediate input data is sent to the server; receiving intermediate output data returned by the server; and processing the intermediate output data based on the output layer and the vocabulary to obtain text output data. Through the method, the privacy protection of the input data can be realized while the output data is automatically obtained by using the large language model.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence, and particularly relates to a data privacy protection method, system and device for a large language model application. BACKGROUND

[0002] With the development of artificial intelligence, more and more artificial intelligence tools can be used by the public. For example, ChatGPT is a natural language processing tool driven by artificial intelligence technology. It can generate answers based on patterns and statistical laws seen in the pre-training stage, and can interact according to the context of the chat, truly like a human to chat and communicate, and even complete tasks such as writing papers, emails, scripts, copywriting, translation, and code.

[0003] However, when using artificial intelligence tools, the protection of user information is often neglected. For example, artificial intelligence tools may use user's sensitive input data for other commercial purposes without effective regulatory constraints. SUMMARY

[0004] Therefore, the embodiments of the present application provide a data privacy protection method, system and device for a large language model application, to protect privacy data while using a large language model.

[0005] The first aspect of the embodiments of the present application provides a data privacy protection method for a large language model application, applied to a client device, wherein the client device is deployed with an input layer and an output layer of a large language model, and the method comprises:

[0006] encoding text input data of the large language model according to a vocabulary table to obtain a token list represented by integers, wherein the vocabulary table is from a server;

[0007] processing the token list through the input layer to obtain intermediate input data;

[0008] sending the intermediate input data to the server;

[0009] receiving intermediate output data returned by the server;

[0010] processing the intermediate output data based on the output layer and the vocabulary table to obtain text output data.

[0011] The second aspect of the embodiments of the present application provides a data privacy protection method for a large language model application, applied to a server, wherein the server is deployed with an intermediate layer of a large language model, and the method comprises:

[0012] receiving intermediate input data from a client device;

[0013] generate, based on the intermediate input data, a word-by-word probability matrix that runs through the intermediate layer;

[0014] return the word-by-word probability matrix to the client device as intermediate output data.

[0015] A third aspect of the embodiments of the present application provides a data privacy protection device for application of a large language model, applied to a client device, wherein the client device is deployed with an input layer and an output layer of a large language model, and the device comprises:

[0016] an encoding module configured to encode text input data of the large language model according to a vocabulary table to obtain a token list represented by integers, wherein the vocabulary table is from a server;

[0017] an input data processing module configured to process the token list through the input layer to obtain intermediate input data;

[0018] an input data sending module configured to send the intermediate input data to the server;

[0019] an output data receiving module configured to receive intermediate output data returned by the server;

[0020] an output data processing module configured to process the intermediate output data based on the output layer and the vocabulary table to obtain text output data.

[0021] A fourth aspect of the embodiments of the present application provides a data privacy protection device for application of a large language model, applied to a server, wherein the server is deployed with an intermediate layer of a large language model, and the device comprises:

[0022] an intermediate input data receiving module configured to receive intermediate input data from a client device;

[0023] an intermediate output data generating module configured to generate, based on the intermediate input data, a word-by-word probability matrix that runs through the intermediate layer;

[0024] an intermediate output data sending module configured to return the word-by-word probability matrix to the client device as intermediate output data.

[0025] In a fifth aspect, the embodiments of the present application provide a data privacy protection system for a large language model, comprising a client device and a server, wherein the large language model comprises an adaptive split learning framework, the adaptive split learning framework is used to split the large language model into an input layer, an intermediate layer and an output layer, the client device is deployed with the input layer and the output layer, the server is deployed with the intermediate layer, the client device comprises a text encoding module, a privacy calculation module and an answer retrieval module, the server comprises an encryption module, a decryption module and an intermediate layer calculation module, and the text encoding module is configured to convert received text input data into intermediate input data.

[0026] The text encoding module is configured to convert received text input data into intermediate input data.

[0027] The privacy calculation module is configured to add noise to the intermediate input data.

[0028] The answer retrieval module is configured to receive intermediate output data returned by the server for the intermediate input data, and determine text output data according to the intermediate output data.

[0029] The encryption module is configured to homomorphically encrypt an initial embedding matrix, and send the encrypted initial embedding matrix to the client device.

[0030] The decryption module is configured to decrypt the intermediate input data from the client device.

[0031] The intermediate layer calculation module is configured to obtain intermediate output data according to the intermediate input data.

[0032] In a sixth aspect, the embodiments of the present application provide a client device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of the first aspect.

[0033] In a seventh aspect, the embodiments of the present application provide a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of the second aspect.

[0034] In an eighth aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program, wherein the computer program is executable on a processor to implement the method of the first aspect or the second aspect.

[0035] The ninth aspect of the embodiment of the present application provides a computer program product, when the computer program product runs on a computer device, causes the computer device to execute the method in the first aspect or the second aspect.

[0036] Compared with the prior art, the embodiment of the present application has the following advantages:

[0037] In the embodiment of the present application, the input layer and the output layer of the large language model are deployed on the client device, and the middle layer of the large language model is deployed on the server. By applying the method in the embodiment of the present application, the text input data can be input on the client device, and the text input data is processed by the input layer of the client device to obtain the intermediate input data, and the intermediate input data is sent to the server. Since the intermediate input data is represented by an integer, the server cannot directly obtain the plaintext of the text input data, thereby ensuring the privacy and security of the text input data input by the client device. The server processes the intermediate text input data through the middle layer to obtain the intermediate output data, and sends the intermediate output data to the client device. The client device can convert the intermediate output data into text output data through the output layer. Since the intermediate output data is represented by a number, the server cannot directly obtain the intermediate output data, thereby achieving privacy protection of the text output data. The method in the embodiment of the present application can make the input and output data in the form of text only visible to the client device and invisible to the server, thereby achieving privacy protection of the user data. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced.

[0039] Figure 1 is a step flowchart of a data privacy protection method for a large language model application applied to a client device provided by the embodiment of the present application;

[0040] Figure 2 is a step flowchart of a data privacy protection method for a large language model application applied to a server provided by the embodiment of the present application;

[0041] Figure 3 is a step flowchart of another data privacy protection method for a large language model application applied to a client device provided by the embodiment of the present application;

[0042] Figure 4 is a step flowchart of another data privacy protection method for a large language model application applied to a server provided by the embodiment of the present application;

[0043] Figure 5FIG. 1 is a schematic diagram of a data privacy protection system for a large language model application according to an embodiment of the present application;

[0044] Figure 6 FIG. 2 is a schematic diagram of a data privacy protection method for a large language model application according to an embodiment of the present application;

[0045] Figure 7 FIG. 3 is a schematic diagram of another data privacy protection method for a large language model application according to an embodiment of the present application;

[0046] Figure 8 FIG. 4 is a schematic diagram of another data privacy protection method for a large language model application according to an embodiment of the present application;

[0047] Figure 9 FIG. 5 is a schematic diagram of a data privacy protection device for a large language model application according to an embodiment of the present application;

[0048] Figure 10 FIG. 6 is a schematic diagram of a data privacy protection device for a large language model application according to an embodiment of the present application;

[0049] Figure 11 FIG. 7 is a schematic diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0050] In the following description, specific details are set forth, such as particular system configurations, techniques, etc., in order to provide a thorough understanding of the present application. However, persons skilled in the art will understand that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.

[0051] A language model is a probability distribution over sequences of words. Given any sequence of words of length m, a language model assigns a probability to the entire sequence. Language models are generated by training on a corpus of text in one or more languages. Large language models (LLMs) are deep learning models trained on vast amounts of text data and have shown impressive capabilities in understanding complex textual data, recognizing entities and relationships between them, and generating coherent and grammatically correct new text.

[0052] Large language models represent significant opportunities across multiple industries, including content production and education. This opens up a range of prospects for partnerships with leading regional enterprises, particularly those sensitive to data privacy. By identifying and leveraging these promising areas, these collaborations can foster business transformation and maximize commercial advantage. The emergence and widespread use of large language models are crucial for modern enterprise transformation and upgrading. However, implementing privacy protection in the context of large language models is a major challenge. Both businesses and government agencies recognize the urgent need to implement effective data privacy protection in large language model scenarios. Balancing this transformative AI technology with strict privacy standards is one of the key issues of today's digital age. However, to date, large language model central servers have not provided any technical privacy protection guarantees, exposing users' sensitive and private data (e.g., uploaded documents, input queries) to the risk of leakage and malicious exploitation.

[0053] Currently, there is no systematic privacy protection solution for the emerging large-scale language model environment. Current privacy-preserving computing technologies are either insecure, slow, or inaccurate, making them difficult to directly apply to large-scale language model inference scenarios. Based on this, the embodiments of this application combine split learning with multiple cryptographic techniques to tailor large-scale language model settings for users and servers without adjusting any model parameters to protect data privacy, thereby achieving security, efficiency, and scalability.

[0054] In an embodiment of the present application, in order to achieve data protection in the process of applying a large language model, the user input data can be isolated from the model provider, so that the user's corresponding client device cannot read the model data of the model provider of the large language model; and the model provider cannot read the text data input by the user and the queried data.

[0055] To protect privacy data, this application separates users from model providers, thereby separating user data from model data. This prevents users from directly accessing model data, and prevents model providers from accessing users' private data. To achieve this isolation, this application uses Splitting Learning (SL) to segment large language models.

[0056] Split learning enables each participant to train a partial deep network until a specific layer, the cut layer. The output of the cut layer can be sent to another entity (server / another client device), which then completes the remaining computations without having to view the original data from any client device that holds the original data, thus ensuring data privacy.

[0057] In the embodiments of the present application, based on split learning, a large language model can be divided into an input layer, an intermediate layer, and an output layer. The input layer and the output layer can be deployed on a client device where a user is located, and the intermediate layer can be deployed on a server where a model provider is located.

[0058] The technical solutions of the present application will be described below through specific embodiments.

[0059] Referring to Figure 1 , a step flowchart diagram of a data privacy protection method for a large language model application applied to a client device is shown, which can specifically include the following steps:

[0060] S101, encode the text input data of the large language model according to a vocabulary table to obtain a token list represented by integers, the vocabulary table being from a server.

[0061] The execution subject of the present embodiment is a client device, which can be a device for inputting text data and obtaining output text data by a user, and the specific type of the client device is not limited in the present embodiment.

[0062] The above-mentioned vocabulary table can be from a server, and the vocabulary table can include an integer corresponding to each token. The server can send parameter information related to input layer processing to the client device in advance, and the parameter information can include the vocabulary table. The token can be the smallest semantic unit of the text input data.

[0063] The client device can split the text data input by the user into multiple tokens. Each token can determine the corresponding integer according to the vocabulary table, so that the client device can obtain the token list composed of integers corresponding to the text input data based on the vocabulary table. The token based on the text input data can be obtained by tokenization technology. For example, the tokenization technology used can be byte pair encoding (BPE). Byte pair encoding can create ssubword units from words in a corpus by iteratively replacing the most frequently occurring pair of bytes in the data set with a new byte representing the pair. After being decomposed into subword units, the text is converted into integers corresponding to each subword.

[0064] S102, process the token list through the input layer to obtain intermediate input data.

[0065] The input layer can include an initial embedding matrix, wherein the initial embedding matrix can be from the parameter information sent by the server.

[0066] The client device can perform a preset calculation on the token list and the initial embedding matrix through the input layer to obtain the intermediate input data. The intermediate input data can be matrix data composed of numbers.

[0067] In a possible implementation, to further protect the user privacy data, the intermediate input data can be encrypted, so that the server cannot reconstruct the text input data from the intermediate input data. For example, the client device can add noise to the intermediate input data using differential privacy technology (DP), to further protect the user privacy data. The differential privacy mechanism is a specific algorithm that provides differential privacy guarantee. The Gaussian mechanism of the general differential privacy technology can add noise. In the Gaussian mechanism, the client device can add random noise from a normal distribution to the calculation result from the input layer. The variance of the noise is determined by the privacy requirement and the function sensitivity.

[0068] Whether to add noise to the intermediate input data can be determined by the user according to the privacy requirement of the data.

[0069] S103, sending the intermediate input data to the server.

[0070] S104, receiving the intermediate output data returned by the server.

[0071] The server can process the intermediate input data through the intermediate layer to obtain the intermediate output data, and send the intermediate output data to the client device. The intermediate output data can be matrix data composed of numbers.

[0072] S105, processing the intermediate output data based on the output layer and the vocabulary table to obtain the text output data.

[0073] In a possible implementation, if the user adds noise to the intermediate input data when sending the intermediate input data, the client device can first perform de-noising processing on the intermediate output data based on the differential privacy technology after receiving the intermediate output data, to obtain the intermediate output data without added interference information.

[0074] The intermediate output data can be a probability matrix, and the data in the probability matrix can be translated based on the vocabulary table to obtain each word unit, and the corresponding text output data is obtained based on each word unit.

[0075] The text input data and the text output data of the client device can only be in the client device, and the server cannot obtain the text input data and the text output data. The server can only obtain the intermediate input data and the intermediate output data composed of numbers, so as to protect the user data from being obtained or utilized by the server.

[0076] In the embodiments of the present application, the learning framework can be adaptively split in the large language model setting, so that the large language model is split into an input layer, an intermediate layer and an output layer, only the input layer and the output layer are locally run on the client device, and the intermediate layer is run on the server side. The input layer and the output layer are lightweight computing layers, which can ensure user privacy protection based on relatively low computing cost, so that the large language model can be used by more users.

[0077] Referring to Figure 2 , a step flow diagram of a data privacy protection method applied to a large language model application of a server is shown, which can specifically include the following steps:

[0078] S201, receiving intermediate input data from a client device.

[0079] The execution subject of the embodiments of the present application is a server, which can be a device of a model provider. The server can include an intermediate layer of a large language model. The server can pre-send parameter information required by the input layer to the client device, which can include an initial embedding matrix, a vocabulary table, etc.

[0080] Based on the input layer and the parameter information, the client device can obtain the intermediate input data based on the text input data, and send the intermediate input data to the server.

[0081] S202, generating a word-by-word probability matrix throughout the intermediate layer based on the intermediate input data.

[0082] The intermediate layer of the server can perform a series of conversions on the intermediate input data, thereby generating a word-by-word probability matrix throughout the intermediate layer, which is the intermediate output data. The process of obtaining the intermediate output data based on the intermediate input data is the original data processing flow in the large language model, which is not described here.

[0083] S203, returning the word-by-word probability matrix as the intermediate output data to the client device.

[0084] In the embodiments of the present application, the learning framework can be adaptively split in the large language model setting, so that the large language model is split into an input layer, an intermediate layer and an output layer, only the input layer and the output layer are locally run on the client device, and the intermediate layer is run on the server side. The input layer and the output layer are lightweight computing layers, which can ensure user privacy protection based on relatively low computing cost, so that the large language model can be used by more users.

[0085] Based on Figure 1 and Figure 2When the method in the method for applying a large language model, the text input data and the text output data of the client device can only be in the client device, and the server cannot obtain the text input data and the text output data; the server can only obtain the intermediate input data and the intermediate output data composed of numbers, so as to protect the user data from being obtained or utilized by the server.

[0086] Based on Figure 1 and Figure 2 The flow shown in the figure can avoid the text data input and output by the server being obtained by the server, thereby realizing privacy protection of user data. At the same time, in order to protect the model data of the server, the method shown in Figure 3 and Figure 4 The data processing method provided by the embodiment of the application is shown in the flowchart of the steps of the data processing method of the large language model, which can specifically include the following steps:

[0087] Referring to Figure 3 , a step flowchart of a data processing method of a large language model provided by an embodiment of the application is shown, which can specifically include the following steps:

[0088] S301, receiving an encrypted initial embedding matrix from a server, the encrypted initial embedding matrix being obtained by the server based on a target homomorphic encryption algorithm.

[0089] The execution subject of the embodiment is the client device described above. In order to better protect the model data of the server, the input layer parameters can be encrypted.

[0090] In order to make the encryption of the input layer parameters not affect the data processing process, homomorphic encryption (HE) can be used to encrypt the input layer parameters. Homomorphic encryption is an encryption method with special properties, which allows direct calculation on encrypted ciphertext. Homomorphic encryption technology can include Paillier cryptosystem, ElGamal homomorphic encryption, BGV scheme, GSW scheme, etc. A typical homomorphic scheme can be composed of a pair of secret keys and public keys. The public key is shared by all parties, while the secret key is maintained only by the server. The input data is encrypted using the public key, and the encrypted data is calculated. The obtained ciphertext can be decrypted by the server using the secret key to obtain the plaintext result.

[0091] The server can use a pre-set target homomorphic encryption algorithm to encrypt the initial embedding matrix, thereby obtaining the encrypted initial embedding matrix.

[0092] S302, encoding the text input data of the large language model according to a vocabulary table to obtain a token list represented by integers, the vocabulary table being from a server.

[0093] S303, performing homomorphic operation on the token list and the encrypted initial embedding matrix through the input layer to obtain intermediate input data.

[0094] The processing of the homomorphically encrypted data results in an output, which, when decrypted, is the same as the output that would have resulted from processing the unencrypted original data with the same method. Thus, the client device can perform homomorphic operations on the token list and the encrypted initial embedding matrix using the input layer to obtain intermediate input data. Illustratively, the client device can encrypt the token list based on a target homomorphic encryption algorithm, and thus perform homomorphic computations on the encrypted token list and the encrypted initial embedding matrix using the input layer such that the encryption process does not affect the computation process of the input layer.

[0095] S304, processing the token list by the input layer to obtain intermediate input data.

[0096] S305, sending the intermediate input data to the server.

[0097] S306, receiving the intermediate output data returned by the server.

[0098] S307, processing the intermediate output data based on the output layer and the vocabulary to obtain the text output data.

[0099] The server can send the intermediate output data in plaintext directly to the client device, or can send the encrypted intermediate output data to the client device. Based on whether the intermediate output data is encrypted, the client device can obtain the text output data in different ways.

[0100] The client device can determine whether the intermediate output data is encrypted data; if the intermediate output data is non-encrypted data, the client device can directly retrieve the text output data from the probability distribution by sampling using the output layer.

[0101] If the intermediate output data is encrypted data, the client device can obtain the text output data based on secure multi-party computation (MPC) technology. Secure multi-party computation ensures that multiple parties obtain the correct calculation result without obtaining any information other than the calculation result. Participants encrypt the data and then provide it to other parties. Thus, no participant can access the original data from other parties, and only the calculation logic is public. Secure multi-party computation allows the server and the user to jointly derive plaintext tokens while protecting the confidentiality of the user's denoising answers.

[0102] Exemplarily, the client device and the server can perform secure multi-party computation to obtain the plaintext intermediate output data. The client device can add a random number to each token data in the received encrypted intermediate output data to obtain a plurality of first digital markers; then send each first digital marker to the server, and after receiving each first digital marker, the server can decrypt the first digital marker to obtain a second digital marker. The client device receives each second digital marker from the server; then can subtract the random number from each second digital marker to obtain plaintext token data; and based on the vocabulary table, the client device can obtain the text output data by translating the plaintext token data.

[0103] With reference to Figure 4 , a step flow diagram of a data processing method of a large language model is shown, which can specifically include the following steps:

[0104] S401, encrypting the in-out layer parameters based on a target homomorphic encryption algorithm to obtain an encrypted initial embedding matrix, and sending the initial embedding matrix to a client device.

[0105] The execution subject of the embodiment is the server described above.

[0106] S402, receiving intermediate input data from the client device.

[0107] S403, decrypting the intermediate input data.

[0108] After the server receives the homomorphically encrypted intermediate input data, the server can decrypt the intermediate input data to obtain plaintext intermediate input data.

[0109] S404, generating a word-by-word probability matrix that penetrates through the intermediate layer based on the intermediate input data.

[0110] S405, returning the word-by-word probability matrix to the client device as intermediate output data.

[0111] In Figure 4 and Figure 5In the data processing procedure, the server can send the model data to the client device after encryption, and the client device cannot directly read the model data on the server, thereby protecting the achievements of the model provider. In addition, based on secure multi-party computation, the server can avoid information leakage and reconstruction attacks from a given probability distribution, thereby providing additional security for servers that are sensitive to privacy. In the embodiment, the client device can use the services provided by the large language model while ensuring the privacy of the data locally. The server can not disclose the model parameters, thereby protecting the commercial interests of the model provider. Based on this, the willingness of the model provider to open services and the willingness of users to use services can be improved, which is conducive to the popularization and application of large language models.

[0112] In addition, in the embodiment of the present application, no changes are needed to the large language model itself, only a component for encryption technology needs to be inserted into the large language model, and the privacy data protection can be completed. Thus, the method in the present application is conducive to the popularization and application of large language models.

[0113] Figure 5 is a schematic diagram of a data privacy protection system for application of a large language model provided by an embodiment of the present application. The system can include a client device and a server, and the large language model includes an adaptive split learning framework, which is used to split the large language model into an input layer, an intermediate layer, and an output layer. The client device is deployed with the input layer and the output layer, and the server is deployed with the intermediate layer. The client device includes a text encoding module, a privacy computing module, and an answer retrieval module, and the server includes an encryption module, a decryption module, and an intermediate layer computing module, wherein:

[0114] The text encoding module is configured to convert the received text input data into intermediate input data.

[0115] The privacy computing module is configured to add noise to the intermediate input data.

[0116] The answer retrieval module is configured to receive the intermediate output data returned by the server for the intermediate input data, and determine the text output data according to the intermediate output data.

[0117] The encryption module is configured to homomorphically encrypt the initial embedding matrix and send the encrypted initial embedding matrix to the client device.

[0118] The decryption module is configured to decrypt the intermediate input data from the client device.

[0119] The intermediate layer computing module is configured to obtain the intermediate output data according to the intermediate input data.

[0120] The answer retrieval module is configured to determine the text output data according to the intermediate output data.

[0121] As Figure 5 shown, each module can be executed in the order of the labels, so that the output data can be obtained based on the large language model. Among them:

[0122] The encryption module can be deployed on the server side of the service provider. The server can encrypt the parameters of the input layer (such as the vocabulary and position embedding matrix) based on the parameters before sending them to the user, so that the user can prevent the user from stealing the model of the server. Among them, homomorphic encryption algorithm can be used when encrypting.

[0123] The text encoding module can be on the client side of the user. The user can use tokenization techniques to convert text into a list of tokens represented by integers as valid input for the large language model. The token can be encrypted using the same homomorphic computation cryptography system as the encryption module. Of course, the encryption of the token is optional, which depends on the design of the homomorphic encryption operation.

[0124] The privacy computing module can be deployed on the client side of the user. In this module, the user performs homomorphic computation on the input layer, and applies the differential privacy mechanism to the computation result. The homomorphic computation technology ensures that the user is unaware of the model parameters, and the differential privacy mechanism protects the privacy of the user's input data. In this application, only a small part of the model is deployed on the client device of the user, so that the computation on the client device is lightweight and efficient. At the same time, the private intermediate results of the privacy computing module can be uploaded to the service provider in an encrypted form.

[0125] The decryption module is deployed on the server side of the service provider. When receiving the intermediate input data of the input layer, the decryption module can use its private key to decrypt the intermediate output data. In order to improve efficiency, the server will perform computation on plaintext data rather than encrypted numbers, so the intermediate input data can be decrypted using the decryption module first. At the same time, the decryption of the decryption module cannot remove the noise of the privacy computing module, so as to protect the server from obtaining the user's private data.

[0126] The intermediate layer computation module is deployed on the server side of the service provider. The server performs a series of transformations on the intermediate input data and returns the intermediate output data to the user, for example, the intermediate output data can be a probability matrix on the vocabulary. According to the privacy requirements of the system, the server can send the user plaintext intermediate output data or encrypted intermediate output data. If the server is willing to provide the user with the intermediate output data, it can send the plaintext output. However, if the server only wants to provide the final text answer without providing any intermediate results, the intermediate output data can be sent in an encrypted form.

[0127] The answer retrieval module is deployed on the user's client. The client device obtains the final textual answer based on the server's intermediate output. This module can be composed of three steps. First, the client device applies denoising techniques to the server's intermediate output data. Because the user perturbs the input layer representation using differential privacy mechanisms, the model's output may be negatively impacted. The client device can use denoising methods to mitigate these negative effects by leveraging its knowledge of the text and the differentially private input data. Second, the answer is retrieved from the denoised result. If the server sends the intermediate output data in encrypted form, the client device can use homomorphic encryption to compute an encrypted integer representation of the textual answer. Otherwise, the client device can derive the final answer from the plaintext result. If the intermediate output data is an encrypted integer representation, the client device can interact with the server to decrypt the tokens using secure multi-party computation. Secure multi-party computation allows the user to obtain the plaintext tokens while keeping the server's answer confidential.

[0128] Figure 6 This is a schematic diagram of a data privacy protection method for a large language model application provided in an embodiment of the present application. Figure 5 The system shown in Figure 6 The data were processed by the method described above. Figure 6 As shown, the server can send encrypted parameters for the input layer to the client device. The client can then tokenize the input text into integers. The client can also choose whether to tokenize the data. The client device can then use homomorphic encryption to perform computations on the private layer and apply differential privacy mechanisms to the computation results, thereby adding noise to the intermediate structure. The client device can then send the noisy, perturbed intermediate results to the server.

[0129] Upon receiving the intermediate results, the server can decrypt them, improving computational efficiency. Based on the decrypted intermediate results, the server can then use the intermediate layer to process the data, generating the intermediate output data. If the server makes the intermediate layer output public, it can directly send the intermediate output to the client device. The client device can then apply denoising techniques to the intermediate output and retrieve the textual answer from the denoised output.

[0130] If the server does not disclose the output of the intermediate layer, it can encrypt the output of the intermediate layer using the public key and send it to the client device. After applying denoising techniques to the intermediate output, the client device can use homomorphic encryption to retrieve the encrypted word and exchange it with the server using secure multi-party encryption to obtain the final text answer.

[0131] Figure 7 This is a schematic diagram of another data privacy protection method for a large language model application provided in an embodiment of the present application. Figure 7To illustrate the overall architecture in this application, the GPT-2 model is taken as an example. As shown in Figure 7 the server first encrypts the word and position embedding layers in the model and sends the encrypted parameters of the input layer to the client device along with the vocabulary. Then, the client device uses the vocabulary to encode the original input text into tokens by byte pair encoding and encrypts the tokens. The encrypted tokens are fed into the encrypted word and position layers for homomorphic encryption operations. To satisfy the differential privacy guarantee, the client device then adds noise to the token embeddings and sends the perturbed output to the server side. The server first decrypts the tokens using the key and then feeds the plaintext noise-processed tokens into the main part of the large language model, which contains 12 blocks for inference. These blocks consist of 1D convolutional layers, multi-head attention layers, and positional multi-layer perception (MLP). Based on the above calculations, the server obtains the perturbed probability matrix and sends it back to the client device. In Figure 7 the example, it is assumed that the server is willing to share the probability matrix in plaintext form and the client device does not need to perform further decryption. Then, the client device can denoise the perturbed probability matrix and retrieve the final output text by sampling from the probability distribution.

[0132] Figure 8 is a schematic diagram of another data privacy protection method for large language model application provided by the embodiments of the present application. Figure 8 An example is provided in which the server only provides the intermediate encrypted output to the client device. The text result is obtained from the encrypted tokens using secure multi-party computation. From the encrypted tokens, the client device can interact with the server using secure multi-party computation techniques to obtain the plaintext answer. In this example, the client device can randomize the tokens before sending them to the server for decryption. The server decrypts the randomized tokens and does not learn the information of the actual answer. After receiving the decrypted tokens from the server, the client device can subtract the random number and obtain the final text answer. In the above process, neither the client device nor the server obtains the privacy data of the other party, but the client device can obtain the final text answer.

[0133] It should be noted that the size of the serial number of each step in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0134] Referring to Figure 9, shows a schematic diagram of a data privacy protection device for a large language model application provided by an embodiment of the present application. The device is applied to a client device, and the client device is deployed with an input layer and an output layer of a large language model. Specifically, it can include an encoding module 91, an input data processing module 92, an input data sending module 93, an output data receiving module 94, and an output data processing module 95, wherein:

[0135] The encoding module 91 is configured to encode text input data of the large language model according to a vocabulary table to obtain a token list represented by an integer, and the vocabulary table is from a server;

[0136] The input data processing module 92 is configured to process the token list through the input layer to obtain intermediate input data;

[0137] The input data sending module 93 is configured to send the intermediate input data to the server;

[0138] The output data receiving module 94 is configured to receive intermediate output data returned by the server;

[0139] The output data processing module 95 is configured to process the intermediate output data based on the output layer and the vocabulary table to obtain text output data.

[0140] In a possible implementation, the input data processing module 92 includes:

[0141] The receiving sub-module is configured to receive an encrypted initial embedding matrix from the server, and the encrypted initial embedding matrix is obtained by the server based on a target homomorphic encryption algorithm;

[0142] The encryption sub-module is configured to perform homomorphic operations on the token list and the encrypted initial embedding matrix through the input layer to obtain the intermediate input data.

[0143] In a possible implementation, the device further includes:

[0144] The noise adding module is configured to add noise to the intermediate input data based on a differential privacy algorithm;

[0145] The denoising module is configured to perform denoising operations on the intermediate output data.

[0146] In a possible implementation, the output data processing module 95 includes:

[0147] The judgment sub-module is configured to determine whether the intermediate output data is encrypted data;

[0148] The first determining sub-module is configured to, if the intermediate output data is non-encrypted data, retrieve text output data by sampling from a probability distribution through the output layer.

[0149] The second determining sub-module is configured to, if the intermediate output data is encrypted data, obtain the text output data based on multi-party secure encryption technology.

[0150] In a possible implementation, the second determining sub-module includes:

[0151] A random number adding unit is configured to add a random number to each word unit data in the intermediate output data to obtain a plurality of first digital markers.

[0152] A digital marker sending unit is configured to send each first digital marker to the server, and the server is configured to decrypt the first digital marker to obtain a second digital marker.

[0153] A digital marker receiving unit is configured to receive each second digital marker from the server.

[0154] A plaintext data obtaining unit is configured to subtract the random number from each second digital marker to obtain plaintext word unit data.

[0155] A text output data determining unit is configured to translate the plaintext word unit data based on the vocabulary table to obtain the text output data.

[0156] Reference Figure 10 FIG. 1 shows a schematic diagram of a data privacy protection device for a large language model application according to an embodiment of the present application. The device is applied to a server, and the server is deployed with an intermediate layer of a large language model. Specifically, the device can include an intermediate input data receiving module 1001, an intermediate output data generating module 1002, and an intermediate output data sending module 1003. The intermediate input data receiving module 1001 is configured to receive intermediate input data from a client device.

[0157] The intermediate input data receiving module 1001 is configured to receive intermediate input data from a client device.

[0158] The intermediate output data generating module 1002 is configured to generate a word-by-word probability matrix throughout the intermediate layer based on the intermediate input data.

[0159] The intermediate output data sending module 1003 is configured to return the word-by-word probability matrix as intermediate output data to the client device.

[0160] For the device embodiment, it is basically similar to the method embodiment, so it is described more simply. For relevant parts, refer to the description in the method embodiment.

[0161] Figure 11 A structural schematic diagram of a computer device is provided for an embodiment of the present application. As shown in the figure, the computer device 110 of the embodiment includes at least one processor 1100 (only one processor is shown in the figure), a memory 1101, and a computer program 1102 stored in the memory 1101 and executable on the at least one processor 1100, wherein the processor 1100 implements the steps in any of the method embodiments described above when executing the computer program 1102. Figure 11 Figure 11 The computer device can be the client device or the server described above. The computer device can include, but is not limited to, the processor 1100 and the memory 1101. Those skilled in the art can understand that the computer device 110 is only an example and does not constitute a limitation on the computer device 110, and the computer device 110 can include more or fewer components than those shown in the figure, or combine certain components, or include different components, for example, the computer device 110 can also include an input / output device, a network access device, etc.

[0162] The computer device can be the client device or the server described above. The computer device can include, but is not limited to, the processor 1100 and the memory 1101. Those skilled in the art can understand that the computer device 110 is only an example and does not constitute a limitation on the computer device 110, and the computer device 110 can include more or fewer components than those shown in the figure, or combine certain components, or include different components, for example, the computer device 110 can also include an input / output device, a network access device, etc. Figure 11 The processor 1100 can be a central processing unit (CPU), and the processor 1100 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0163]

[0164] ​​The memory 1101 may, in some embodiments, be an internal storage unit of the computer device 110, such as a hard disk or a memory of the computer device 110. The memory 1101 may, in other embodiments, also be an external storage device of the computer device 110, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, and the like, equipped on the computer device 110. Further, the memory 1101 may also include both an internal storage unit and an external storage device of the computer device 110. The memory 1101 is used to store an operating system, application programs, a BootLoader, data, and other programs, such as program codes of the computer program, and the like. The memory 1101 may also be used to temporarily store data that has been output or is to be output.

[0165] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps in each of the above-mentioned method embodiments.

[0166] The embodiments of the present application provide a computer program product. When the computer program product is run on a computer device, the computer device is caused to execute to implement the steps in each of the above-mentioned method embodiments.

[0167] The above-described embodiments are only used to illustrate the technical solutions of the present application, but not limit the same. Even though the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A data privacy protection method for a large language model application, characterized in that: Applied to a client device, the client device being deployed with an input layer and an output layer of a large language model, the method comprising: Encoding the text input data of the large language model according to a vocabulary table to obtain a list of tokens represented by integers, wherein the vocabulary table comes from a server; Processing the tag list through the input layer to obtain intermediate input data; sending the intermediate input data to the server; receiving intermediate output data returned by the server; The intermediate output data is processed based on the output layer and the vocabulary to obtain text output data.

2. The method according to claim 1, wherein The processing of the tag list by the input layer to obtain intermediate input data includes: receiving an encrypted initial embedding matrix from the server, where the encrypted initial embedding matrix is ​​obtained by the server based on a target homomorphic encryption algorithm; A homomorphic operation is performed on the tag list and the encrypted initial embedding matrix through the input layer to obtain the intermediate input data.

3. The method according to claim 1, wherein Before sending the intermediate input data to the server, the method further includes: Adding noise to the intermediate input data based on a differential privacy algorithm; After receiving the intermediate output data returned by the server, the method further includes: A denoising operation is performed on the intermediate output data.

4. The method according to any one of claims 1 to 3, wherein The processing of the intermediate output data based on the output layer and the vocabulary to obtain text output data includes: determining whether the intermediate output data is encrypted data; If the intermediate output data is non-encrypted data, sampling and retrieving the text output data from the probability distribution through the output layer; If the intermediate output data is encrypted data, the text output data is obtained based on multi-party security encryption technology.

5. The method according to claim 4, wherein The text output data includes a plurality of word metadata, and the text output data is obtained based on the multi-party security encryption technology, including: adding a random number to each word element in the intermediate output data to obtain a plurality of first digital tags; Sending each of the first digital tokens to the server, and the server being configured to decrypt the first digital token to obtain a second digital token; receiving each of the second digital tokens from the server; Subtract the random number from each of the second digital marks to obtain plaintext word metadata; The plaintext word metadata is translated based on the vocabulary to obtain the text output data.

6. A data privacy protection method for a large language model application, characterized in that: Applied to a server, the server being deployed with an intermediate layer of a large language model, the method comprising: receiving intermediate input data from a client device; generating a word-by-word probability matrix across the intermediate layers based on the intermediate input data; The word-by-word probability matrix is ​​returned to the client device as intermediate output data.

7. A data privacy protection system for large language model applications, characterized in that: The system comprises a client device and a server, wherein a large language model comprises an adaptive split learning framework, wherein the adaptive split learning framework is used to split the large language model into an input layer, an intermediate layer, and an output layer. The client device is deployed with the input layer and the output layer, and the server is deployed with the intermediate layer. The client device comprises a text encoding module, a privacy computing module, and an answer retrieval module, and the server comprises an encryption module, a decryption module, and an intermediate layer computing module, wherein: The text encoding module is used to convert the received text input data into intermediate input data; The privacy computing module is used to add noise to the intermediate input data; The answer retrieval module is configured to receive intermediate output data returned by the server for the intermediate input data, and determine text output data based on the intermediate output data; The encryption module is used to homomorphically encrypt the initial embedding matrix and send the encrypted initial embedding matrix to the client device; The decryption module is configured to decrypt the intermediate input data from the client device; The intermediate layer calculation module is used to obtain intermediate output data according to the intermediate input data; The answer retrieval module is used to determine text output data based on the intermediate output data.

8. A data privacy protection device for a large language model application, characterized in that: Applied to a client device, the client device is deployed with an input layer and an output layer of a large language model, and the apparatus comprises: an encoding module, configured to encode text input data of the large language model according to a vocabulary table to obtain a token list represented by integers, wherein the vocabulary table comes from a server; An input data processing module, configured to process the tag list through the input layer to obtain intermediate input data; An input data sending module, configured to send the intermediate input data to the server; An output data receiving module, configured to receive the intermediate output data returned by the server; An output data processing module is used to process the intermediate output data based on the output layer and the vocabulary to obtain text output data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 5 or 6 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 or 6 is implemented.

Images