Privacy risk measurement method and device for federated large language model fine-tuning

Abstract

The application provides a privacy risk measurement method and device for federal large language model fine-tuning, and relates to the technical field of privacy protection under a large language model. The method comprises: processing target gradient information according to the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model to generate an initial representation of a virtual input embedding; starting from the initial representation, performing multiple rounds of iterative optimization: in each round of optimization, gradient matching is performed in a continuous vector space to update the virtual input embedding, and the updated continuous vector representation is periodically mapped into the discrete word table space of the pre-trained large language model to correct the representation deviation, and the mapping result is taken as the input of the next round of optimization; generating a reconstructed text according to the target virtual input embedding finally output by the optimization, and measuring the privacy leakage risk of the target client according to the matching degree of the reconstructed text and the real text. In this way, the privacy leakage risk of the federal LoRA scene is comprehensively and effectively measured.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology under large language models, and in particular to a method and apparatus for measuring privacy risks for fine-tuning federated large language models. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, enables clients to collaboratively train models without sharing local data, and has been widely applied in natural language processing scenarios with high requirements for text content privacy. In recent years, with the increasing scale of large language models, the computational and storage overhead required for full parameter fine-tuning has surged. To address this issue, parameter-efficient fine-tuning (PEFT) methods have emerged. Among them, low-rank adaptation (LoRA) is widely used for federated fine-tuning of large language models due to its high training performance and low communication overhead, reducing computational and communication costs during training. However, federated learning requires sharing model updates in each training round, and these updates may contain private information, posing a potential data leakage risk. Therefore, appropriate privacy protection and risk assessment methods need to be designed.

[0003] Currently, existing privacy risk assessment methods typically use gradient inversion reconstruction results as a metric, that is, reconstructing training text by sharing gradients and measuring the risk of leakage based on the reconstruction quality. However, under the federated LoRA setting, existing privacy risk assessment methods are strictly limited to low-rank matrices for trainable parameters. LoRA training only updates the low-rank matrix, which significantly reduces the dimensionality of the uploaded gradients and the amount of information. In federated LoRA scenarios, it is generally difficult to consistently obtain high-quality text reconstruction results, and therefore, it is impossible to comprehensively, effectively, and reliably assess the privacy leakage risk in federated LoRA scenarios. Summary of the Invention

[0004] The purpose of this invention is to provide a method and apparatus for measuring privacy risks in federated large language model fine-tuning, thereby solving the problem that privacy leakage risks are difficult to measure comprehensively and effectively in federated LoRA fine-tuning scenarios.

[0005] To address the aforementioned technical problems, the embodiments of the present invention provide the following technical solutions:

[0006] The first aspect of this invention provides a privacy risk measurement method for fine-tuning federated large language models, comprising:

[0007] Receive target gradient information, which is the gradient information of the trainable low-rank matrix uploaded by the target client after training with Federated LoRA. The target gradient information is used to indicate and reflect the gradient of the LoRA module.

[0008] Based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, the target gradient information is processed to generate an initial representation of the virtual input embedding.

[0009] Starting with the initial representation, multiple rounds of iterative optimization are performed: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization.

[0010] Based on the target virtual input embedding optimized through multiple rounds of iterations, reconstructed text is generated, and the privacy leakage risk of the target client is measured based on the matching degree between the reconstructed text and the real text.

[0011] A second aspect of the present invention provides a privacy risk measurement device for fine-tuning federated large language models, comprising:

[0012] The receiving module is used to receive target gradient information, which is the gradient information of the trainable low-rank matrix uploaded by the target client after training with Federated LoRA. The target gradient information is used to indicate and reflect the gradient of the LoRA module.

[0013] The processing module is used to process the target gradient information based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, and generate the initial representation of the virtual input embedding.

[0014] The iterative optimization module is used to perform multiple rounds of iterative optimization starting from the initial representation: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization.

[0015] The metrics module is used to generate reconstructed text by optimizing the target virtual input embedding of the final output through multiple rounds of iterations, and to measure the privacy leakage risk of the target client based on the matching degree between the reconstructed text and the real text.

[0016] Compared to existing technologies, the privacy risk measurement method and apparatus for fine-tuning federated large language models provided by this invention receive target gradient information, which is used to indicate and reflect the gradient of the LoRA module. Based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, the target gradient information is processed to generate an initial representation of the virtual input embedding. Starting from the initial representation, multiple rounds of iterative optimization are performed: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, resulting in an updated continuous vector representation. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct representation bias, and the mapping result is used as the input for the next round of optimization. Based on the target virtual input embedding output by the final output of the multi-round iterative optimization, reconstructed text is generated, and the privacy leakage risk of the target client is measured based on the matching degree between the reconstructed text and the real text. In this way, by leveraging the linear relationship between the gradient of the LoRA module and the input embedding of the pre-trained large language model, an initialization representation strongly correlated with the real embedding is extracted from the target gradient information. This initialization representation is used as a high-quality initialization. Furthermore, by employing a mechanism that combines iterative optimization with periodic discrete mapping, the representation bias generated during the iterative optimization process is effectively corrected. This enables the stable recovery of high-precision reconstructed text in federated LoRA scenarios where gradient information is severely limited. Based on the high-precision reconstructed text, a comprehensive and effective measurement of the privacy leakage risk in federated LoRA scenarios can be achieved. Attached Figure Description

[0017] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:

[0018] Figure 1 A flowchart illustrating a privacy risk measurement method for fine-tuning a federated large language model is shown.

[0019] Figure 2 A schematic diagram illustrating the embedded discrete mapping process is shown.

[0020] Figure 3 This illustration schematically demonstrates the impact of initialization operations on the Recall-Oriented Understudy for Gisting Evaluation (ROUGE-1) score. Figure 1 ;

[0021] Figure 4This illustration schematically demonstrates the impact of initialization operations on the Recall-Oriented Understudy for Gisting Evaluation (ROUGE-2) score. Figure 1 ;

[0022] Figure 5 This illustration schematically shows the effect of initialization operations on the RecallOriented Understudy for Gisting Evaluation based on Longest Common Subsequence (ROUGE-L) score. Figure 1 ;

[0023] Figure 6 The diagram illustrates the effect of initialization operations on the ROUGE-1 score. Figure 2 ;

[0024] Figure 7 The diagram illustrates the effect of initialization operations on the ROUGE-2 score. Figure 2 ;

[0025] Figure 8 The diagram illustrates the effect of initialization operations on the ROUGE-L score. Figure 2 ;

[0026] Figure 9 The diagram illustrates the effect of the mapping operation on the ROUGE-1 score. Figure 1 ;

[0027] Figure 10 The diagram illustrates the effect of the mapping operation on the ROUGE-2 score. Figure 1 ;

[0028] Figure 11 The diagram illustrates the effect of the mapping operation on the ROUGE-L score. Figure 1 ;

[0029] Figure 12 The diagram illustrates the effect of the mapping operation on the ROUGE-1 score. Figure 2 ;

[0030] Figure 13 The diagram illustrates the effect of the mapping operation on the ROUGE-2 score. Figure 2 ;

[0031] Figure 14 The diagram illustrates the effect of the mapping operation on the ROUGE-L score. Figure 2;

[0032] Figure 15 A schematic diagram of the privacy risk measurement device for fine-tuning a federated large language model is shown. Detailed Implementation

[0033] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey the scope of the invention to those skilled in the art.

[0034] It should be noted that, unless otherwise stated, the technical or scientific terms used in this invention should have the ordinary meaning as understood by one of ordinary skill in the art.

[0035] The methods described in the embodiments of the present invention will be explained in detail below.

[0036] Specifically, the execution entity of the privacy risk measurement method for federated large language model fine-tuning in this invention is the server. The method involves a framework of LoRA fine-tuning, federated learning, federated low-rank adaptation (FedLoRA), and gradient inversion attacks. Specifically, LoRA fine-tuning is a parameter-efficient method for fine-tuning large language models; its core principle is to freeze the backbone weights of the pre-trained large language model. And inject a pair of trainable low-rank matrices into certain layers of the pre-trained large language model. and A full update of approximate parameters:

[0037] ;

[0038] in, This is the first matrix, which is the first low-rank matrix that can be trained. This is the second matrix, which is the second low-rank matrix that can be used for training. , ,and , Let be the rank of a pair of trainable low-rank matrices. To hide the state dimension, To hide the state dimension The rank of a pair of trainable low-rank matrices The set of real matrices, This is the fine-tuned weight matrix. This represents the weight update amount. First matrix. Typically initialized randomly, the second matrix Initialize to zero to ensure that the behavior of large language models remains unchanged at the start of training. LoRA significantly reduces computational and storage overhead by requiring only a small number of low-rank parameters to be trained and stored.

[0039] The specific operation of federated learning is as follows: Federated learning is a distributed machine learning paradigm. Its core idea is to have multiple clients collaboratively train a global model under the coordination of a central server, without uploading their respective private raw data to the server. In each round of communication, the clients... Receive global parameters and in its private dataset Perform local training to obtain the updated global model. Subsequently, the server aggregates local updates using the following formula:

[0040] ;

[0041] in, Indicates client The number of samples, It is the total number of samples from all clients. This represents the total number of clients participating in the aggregation.

[0042] The specific operation of FedLoRA is as follows: FedLoRA combines federated learning with LoRA, forming the system background of this invention. Within this framework, the client only needs to update its LoRA parameters locally. These low-rank updates are then uploaded to the server. The server then aggregates the LoRA parameters and updates the full LoRA parameters:

[0043] ;

[0044] in, This is the first low-rank global matrix after aggregation. For the client The first low-rank matrix uploaded. This is the second lowest-rank global matrix after aggregation. For the client The uploaded second low-rank matrix. FedLoRA's specific operations significantly reduce the communication burden during the federated learning process.

[0045] The specific operation of the gradient inversion attack is as follows: In the large language model considered by the method of this invention, it is assumed that the server is honest but curious. The server faithfully executes the federated learning protocol, but attempts to infer the client's private data using the updates it receives from the client. The client's information about the first matrix is ​​obtained in the FedLoRA scenario. The gradient is denoted as The client is concerned about the second matrix. The gradient is denoted as ,in, These are client-side private data pairs. For private input data, The corresponding labels for private input data. This is the loss function used for training. The goal of a gradient inversion attack is to recover the original private data from these shared gradients. The standard practice is to construct a dummy input-label pair. , For the constructed virtual input data, To construct virtual labels, and to optimize the gradient of the virtual input-label pairs. Compared with the actual observed gradient As close as possible. The mathematical formalization of the objective function is:

[0046] ;

[0047] in, It is about finding the virtual input-label pairs that minimize the objective function value. , It is a distance metric function used to measure the difference between gradients, for example, distance, Distance or cosine distance For Euclidean distance, For Manhattan distance, To add weights to the backbone of a pre-trained large language model The virtual input-label pairs obtained by calculation gradient, For the client's original private data The calculated gradient of the actual observations. The success of the reconstruction depends on finding a virtual input-label pair that minimizes the objective function. This makes it a private data pair for the client. Accurate reconstruction.

[0048] Figure 1 A flowchart illustrating a privacy risk measurement method for fine-tuning a federated large language model, as shown in this embodiment of the invention, is provided. Figure 1 As shown, this privacy risk measurement method for fine-tuning federated large language models may include:

[0049] S101, Receive target gradient information.

[0050] Among them, the target gradient information is the gradient information of the trainable low-rank matrix uploaded by the target client after the federated LoRA training. The target gradient information is used to indicate and reflect the gradient of the LoRA module.

[0051] The method of this invention is applied to a federated learning system that protects client-side private natural language text data. The target gradient information can specifically be the gradient information of the trainable low-rank matrix uploaded after federated LoRA training based on a pre-trained large language model.

[0052] For example, the method of the present invention will be illustrated by taking a sample from the Stanford Sentiment Treebank-2 (SST-2) dataset, “make personal velocity into an intricate, intimate and intelligent journey”, and the Generative Pre-trained Transformer-2 (GPT-2) model as examples.

[0053] For example, samples from the present invention could also be “The film is just a corny examination of a young actress trying to find her way” from SST-2, “A vivid, spicy footnote to history, and a movie that grips and holds you in rapt attention from start to finish”, and “Do you say “hi” to your lover when you wake up in the morning?” from the rottentomatoes dataset.

[0054] S102. Based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, process the target gradient information to generate an initial representation of the virtual input embedding.

[0055] Pre-trained large language models can be Generative Pre-trained Transformer (GPT) series models, Bidirectional Encoder Representations from Transformers (BERT) series models, or Meta AI Large Language Model (LLaMA) series models. The GPT series models include the GPT-2 model. There can be various types of pre-trained large language models, and no specific limitation is made here.

[0056] For example, to improve reconstruction efficiency and success rate, the linear relationship between the LoRA module gradient and the input embedding of the GPT-2 model is utilized to embed the virtual input. Provide a high-quality initialization, rather than a random initialization.

[0057] Theorem: Let For the first The input matrix of the LoRA module, where, For batch size, To hide the state dimension, For all dimensions The set of real matrices, For the first The first matrix in the LoRA module The weight matrix, For the rank, For all dimensions The set of real matrices. Regarding the first... The first matrix in the LoRA module gradient Each column vector can be represented as Linear combination of row vectors.

[0058] No. First layer matrix weight for:

[0059] ;

[0060] According to the chain rule, the first... Layer 1 matrix The gradient is:

[0061] ;

[0062] in, For the loss function on the th The first matrix in the LoRA module weight matrix gradient, For the first The transpose of the input matrix of the LoRA module. For the loss function on the th Layer 1 matrix weight The gradient.

[0063] therefore, Each column vector in is A linear combination of row vectors, with coefficients of... .

[0064] Specifically, based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, the target gradient information is processed to generate an initial representation of the virtual input embedding, including:

[0065] Step A1: Perform singular value decomposition on the gradient of the first matrix of any LoRA module in the target gradient information to obtain the corresponding right singular vector.

[0066] According to the theorem, gradient Each row vector is located in the input embedding In the row vector space. This indicates that its gradient contains important information about the true input direction. To extract meaningful initialization directions, the first matrix in a LoRA module is... Singular value decomposition of the gradient:

[0067] ;

[0068] in, For the first The first matrix in the LoRA module gradient transpose, It is a left singular matrix. It is a singular value matrix. It is a right singular matrix. This is the transpose of the right singular matrix. , , Let the first... The first matrix in the LoRA module gradient The rank is .forward A right singular vector Each non-zero singular value represents the most important direction in the gradient. This is the second right singular vector. To hide the state dimension The real vector space, The first matrix rank With the first matrix rank A set of real matrices of dimension 1. To hide the state dimension With the first matrix rank The set of real matrices, To hide the state dimension With hidden state dimension A set of real matrices of dimension 1. These singular vectors are used as the basis for initializing the virtual input. Let... Given the length of the target sequence, the initial embedding matrix is... The definition is as follows:

[0069] like : ;

[0070] like : (i.e., cyclic filling).

[0071] in, The length of the target sequence With hidden state dimension The set of real matrices, The length of the target sequence A right singular vector, The initial embedding matrix for cyclic filling. For right singular matrices Before the election A right singular vector, previously Each right singular vector is used as a row vector, and the hidden state dimension is used as the hidden state dimension. As a column vector.

[0072] Step A2: Utilize the distribution characteristics of word embeddings in the pre-trained large language model to normalize the right singular vectors and obtain the normalized initialization matrix.

[0073] Specifically, step A2 includes:

[0074] Step A21: Calculate the average norm of all word vectors in the word embedding matrix of the pre-trained large language model.

[0075] To align the initialization with the embedding distribution of the pre-trained large language model, the right singular vectors are further normalized. Let... Here is the word embedding matrix of the pre-trained large language model, where Given the set of real matrices consisting of the absolute values ​​of the number of all word embeddings and the dimension of the hidden states, we first calculate the average of all word embeddings, i.e., all word embeddings. Norm:

[0076] ;

[0077] in, The embedding vectors for all words are the average of all word vectors. Norm, The absolute value of the number of all word vectors. It is the word embedding matrix of a pre-trained large language model. The first in Word embedding vectors, Word embedding matrix The first in Word embedding vectors of Norm.

[0078] Step A22: Scale the right singular vectors according to the mean norm so that the norm of the scaled right singular vectors is consistent with the mean norm of all word vectors, thus obtaining the normalized initialization matrix.

[0079] Rescale each right singular vector to the average of all word vectors. norm :

[0080] ;

[0081] in, For the normalized first A right singular vector, For the first A right singular vector, For the first A right singular vector Norm.

[0082] The expression for the normalized initialization matrix is:

[0083] ;

[0084] in, For the normalized initialization matrix, In the normalized initialization matrix A normalized right singular vector, To start from the normalized initial moments Before the election A normalized right singular vector, previously Each normalized right singular vector is used as a row vector, and the hidden state dimension is used as the row vector. As a column vector.

[0085] Step A3: Based on the normalized initialization matrix, construct the initialization representation of the virtual input embedding to simulate the real input embedding.

[0086] The initialization of virtual input embedding is represented as follows: Using the gradient obtained from the above sample "make personal velocity into an intricate, intimate, and intelligent journey," the initialization representation is "make velocity intricate, velocity intelligent into an intricate journey an into an." This allows for the recovery of some tokens during the initialization phase. It not only captures the directional information of real input, but also aligns with the distribution of pre-trained large language models, outperforming random initialization both theoretically and experimentally.

[0087] S103. Starting from the initial representation, perform multiple rounds of iterative optimization: In each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization.

[0088] Specifically, step S103 includes:

[0089] Step B1: Using the initial representation as the input for the first round of iterative optimization, perform multiple rounds of iterative optimization in sequence: In each round of optimization, calculate the virtual gradient based on the virtual input embedding of the current round, and update the virtual input embedding of the current round with the goal of minimizing the difference between the virtual gradient and the target gradient information, to obtain the updated continuous vector representation of the current round.

[0090] Specifically, in each round of optimization, the virtual gradient is calculated based on the virtual input embedding of the current round, and the virtual input embedding of the current round is updated with the goal of minimizing the difference between the virtual gradient and the target gradient information, resulting in the updated continuous vector representation of the current round, including:

[0091] Step B11: In each round of optimization, calculate the virtual gradient based on the virtual input embedding of the current round.

[0092] Step B12: Calculate the reconstruction loss between the virtual gradient and the target gradient information.

[0093] In order to restore the real input, i.e., private input data We define a loss function to measure the distance between the gradient generated by the virtual input and the true gradient. We use a combination of cosine loss and norm regularization loss as a comprehensive metric.

[0094] Assume that the pre-trained large language model has The trainable parameters of a layer are denoted as follows: For the first The trainable parameters of the layer are denoted as follows: and These are the virtual gradient and the real gradient, respectively. Cosine distance is used as the metric for gradient matching.

[0095] ;

[0096] in, Embedding sequences for virtual input The reconstruction losses, For constructed virtual input data Corresponding tags for private input data The calculated first Virtual gradients of trainable parameters of the layer. For private input data Corresponding tags for private input data The calculated first The true gradient of the trainable parameters of the layer. For the first Virtual gradients of layer trainable parameters of Norm, For the first The true gradient of the layer's trainable parameters of Norm.

[0097] Minimizing this reconstruction loss ensures that the direction of the virtual gradient is aligned as closely as possible with the direction of the real gradient.

[0098] Step B13: Calculate the norm regularization loss.

[0099] Here, the norm regularization loss is the regularization loss between the average norm of the virtual input embedding in the current round and the average norm of the word embedding in the pre-trained large language model.

[0100] Matching only the gradient direction may cause the scale of the virtual input embedding to deviate from the word embedding space in the pre-trained large language model, thus impairing subsequent discretization. Therefore, a norm regularization term is introduced to constrain the average of the virtual input embedding. The norm matches the norm of the word embedding. Let... For virtual input embedding sequences, Given word embedding vectors, the norm regularization loss is... Defined as:

[0101] ;

[0102] in, The number of virtual input embedded sequences. For the first A virtual input embedding sequence, For the first A virtual input embedding sequence Norm, It is the word embedding matrix of a pre-trained large language model. The first in Word embedding vectors, Word embedding matrix The first in Word embedding vectors of Norm, This is the absolute value of the number of all word vectors.

[0103] Step B14: Construct the overall optimization objective based on the reconstruction loss and regularization loss.

[0104] The final overall optimization goal It is the weighted sum of two losses:

[0105] ;

[0106] in, It is a regularization hyperparameter that balances gradient alignment and embedding norm consistency.

[0107] Step B15: Based on minimizing the overall optimization objective, update the virtual input embedding for the current round to obtain the updated continuous vector representation.

[0108] For example, after a certain number of optimization steps, the initial expression "make velocity intricate velocityintelligent into intricate journey an into an" is optimized to "make personal intimate velocity, velocity into an intricate intelligent journey", which recovers more correct tokens.

[0109] Step B2: Based on the first preset period, determine whether to perform a mapping operation in the current round; if the mapping operation is performed, map the updated continuous vector representation of the current round to the discrete vocabulary space of the pre-trained large language model to obtain the corrected virtual input embedding, and use the corrected virtual input embedding as the input for the next round of iteration optimization; if the mapping operation is not performed, directly use the updated continuous vector representation of the current round as the input for the next round of iteration optimization.

[0110] The first preset period is denoted as ,Every The first preset period performs a mapping operation once, namely embedding discrete mapping. Gradient-based optimization continuously optimizes virtual embeddings, but these embeddings often deviate from the real token embedding space. To alleviate this problem, this invention introduces a step of embedding discrete mapping, namely step B2. This mechanism of embedding discrete mapping aligns the continuous embedding optimization space with the discrete token space of the pre-trained large language model, ensuring that the recovered embeddings always correspond to valid tokens.

[0111] Specifically, when performing a mapping operation, the updated continuous vector representation of the current round is mapped to the discrete vocabulary space of the pre-trained large language model to obtain the corrected virtual input embedding, including:

[0112] Step B21: When performing the mapping operation, for each continuous vector in the updated continuous vector representation of the current round, determine the target discrete word embedding vector with the highest cosine similarity from the word embedding matrix of the pre-trained large language model, and use the target discrete word embedding vector as the target vector.

[0113] The updated continuous vector representation of the current round is mapped to the word embedding matrix of the pre-trained large language model that is closest to the cosine distance. :

[0114] ;

[0115] in, The cosine similarity between two vectors is represented by the following expression: For the current round The updated continuous vector representation This represents the number of continuous vector representations updated in the current round. For the word embedding matrix of the pre-trained large language model, It is the word embedding matrix of a pre-trained large language model. The first in Word embedding vectors, Word embedding matrix The first in Word embedding vectors of Norm, For the current round The updated continuous vector representation Norm. This operation produces a discrete sequence of tokens, i.e., the target discrete token embedding vector. , For the first Target discrete word embedding vectors.

[0116] Step B22: Combine the target vectors corresponding to all continuous vectors in order to form the corrected virtual input embedding.

[0117] Replace the virtual input embedding with the corresponding real token embedding to align the space, thus forming the corrected virtual input embedding: , For the first A corrected virtual input embedding.

[0118] Specifically, before determining whether to perform the mapping operation in the current round based on the first preset period, the method also includes:

[0119] Step C1: Based on the second preset period, determine whether to perform sequence order optimization in the current round.

[0120] The second preset period is denoted as Determine whether the current round is the second preset cycle. If the result is an integer multiple of the given value, proceed to step C2; otherwise, proceed to step C5.

[0121] Step C2: If sequence order optimization is performed in the current round, the current basic word sequence is obtained based on the updated continuous vector representation of the current round.

[0122] Specifically, step C2 includes:

[0123] Step C21: Map each continuous vector in the updated continuous vector representation of the current round to the nearest neighbor word in the vocabulary of the pre-trained large language model through cosine similarity to obtain the mapped word.

[0124] Step C22: Combine the mapped lexical units into the current basic lexical unit sequence.

[0125] Step C3: Utilize the prior knowledge of the pre-trained large language model to optimize and score the current basic word sequence, thereby obtaining the optimized candidate word sequence.

[0126] Specifically, step C3 includes:

[0127] Step C31: Apply various order transformation operations to the current basic lexical sequence to generate multiple candidate lexical sequence variants.

[0128] After continuous space optimization, a sequence recovery method based on prior knowledge from a pre-trained large language model is employed to recover the token order. Multiple candidate token sequence variants are generated by applying a series of transformations to the current base lexical sequence, such as swapping two tokens or moving a consecutive token fragment to another position in the sequence.

[0129] Step C32: Calculate the joint score for each candidate lemma sequence variant.

[0130] The joint score is a weighted sum of the reconstruction loss for each candidate sequence variant and the language model loss calculated by the pre-trained large language model for each candidate sequence variant.

[0131] For each candidate lexical sequence variant The following joint scoring expression is used for evaluation:

[0132] ;

[0133] in, Embedding virtual input into a sequence using cosine similarity Each embedding in the dictionary is mapped to a sequence of nearest-neighbor tokens in the vocabulary. Each candidate lemma sequence variant is determined by cosine similarity. Each embedding in the vocabulary is mapped to the sequence of nearest neighbor tokens obtained from the vocabulary. This is the language model loss calculated from a pre-trained large language model, using perplexity as the loss parameter. Used to balance reconstruction losses and language model loss If the above inequality holds, then update the virtual input: Otherwise, the original virtual input embedding sequence is retained. This process is repeated after each second preset cycle. Execute after continuous optimization, performing the operation on each virtual input embedding sequence. The transformation gradually guides the order of the markings back to the order of the original input.

[0134] Step C33: Based on the joint score, select the optimal candidate lemma sequence variant from multiple candidate lemma sequence variants as the optimized candidate lemma sequence.

[0135] Step C4: Convert the optimized candidate word sequence into the corresponding continuous vector representation to obtain the sequentially optimized continuous vector representation, and replace the updated continuous vector representation of the current round with the sequentially optimized continuous vector representation.

[0136] Step C5: If sequence order optimization is not performed, then the updated continuous vector representation of the current round is retained.

[0137] For example, taking the optimized result "make personal intimate velocity, velocity into an intricate intelligent journey" as an example, the token will be randomly permuted to generate multiple candidate lemma sequence variants, such as "make personal velocity into an intricate, intimate velocity" and "intelligent personal intimate velocity, velocity into an intricate makejourney," etc. After generation, the one with the highest score will be selected, which in the above example is "make personal velocity into an intricate, intimate velocity."

[0138] The final generated language, "make personal velocity into an intricate, intimate velocity," is more fluent and closer to the target sample. This step incorporates language fluency in the selection process, and since the target sample must be fluent, it has a beneficial impact on the recovery.

[0139] S104. Based on the target virtual input embedding of the final output after multiple rounds of iterative optimization, generate reconstructed text, and measure the privacy leakage risk of the target client based on the matching degree between the reconstructed text and the real text.

[0140] This invention designs an evaluation process adapted to Federated LoRA (Gradient Inversion Assessment for LoRA, LoGIA) to stably recover key semantics of input text under conditions of limited gradient information, thereby forming an effective risk assessment benchmark. The LoGIA evaluation process includes the following core steps: high-quality initialization based on singular value decomposition; continuous space optimization with gradient matching as the objective; sequence order optimization based on prior knowledge from a pre-trained large language model; and embedding discrete mapping of the optimized continuous embeddings to discrete tokens.

[0141] Figure 2 A schematic diagram illustrating the embedded discrete mapping process is shown below. Figure 2 As shown, the core idea of ​​this invention is that an embedding optimized in a continuous space may be close to the token in terms of gradient similarity, but it does not necessarily correspond to a valid token representation. By periodically remapping these continuous virtual word embedding vectors to the real embedding vector space, the discrete embedding mapping effectively corrects the discretization bias accumulated during the optimization process. This has two key functions: first, it constrains the optimization within the effective subspace of linguistic meaning, preventing virtual embeddings from deviating to invalid regions; second, it provides high-quality reinitialization for subsequent optimization stages, thereby improving stability and convergence. To balance continuous optimization and discrete embedding mapping operations, each... Instead of performing the mapping operation once per first preset period, embedding the discrete mapping, this periodic mapping plays a crucial role in achieving robust and high-precision text reconstruction under LoRA fine-tuning.

[0142] This invention successfully overcomes the limitation of insufficient information under conditions of extremely low rank and extremely weak gradient signals, achieving semantic recovery of the original input text. First, it utilizes the linear relationship between the gradient of the LoRA module and the input embedding of the pre-trained large language model to perform singular value decomposition on the gradient of the first matrix of any LoRA layer, extracting right singular vectors strongly correlated with the true embedding for high-quality initialization. It also designs an efficient embedding discrete mapping mechanism to accurately project the optimized continuous embedding back to the closest discrete token in the vocabulary embedding space, effectively correcting continuous optimization biases generated during the optimization process. Therefore, this invention can obtain reliable text reconstruction results even with limited gradient information in federated LoRA scenarios, and thereby achieve a comprehensive and effective measurement of privacy leakage risks in federated LoRA scenarios.

[0143] To verify the effectiveness, stability, and comparability of the method of this invention in actual training, this embodiment constructs a reconstruction evaluation process based on shared gradients on a typical text dataset and compares the method of this invention with existing representative gradient inversion attack methods. All experiments are implemented using the open-source deep learning (PyTorch) framework, demonstrating reconstruction results under different ranks and batch sizes.

[0144] Datasets: To comprehensively evaluate the applicability of the proposed method to data under different input lengths and task types, three binary classification datasets with progressively increasing complexity were selected: CoLA and SST-2 from the General Language Understanding Evaluation (GLUE) benchmark set, and the Rotten Tomatoes dataset. The Corpus of Linguistic Acceptability (CoLA) is a grammatical acceptability judgment task with relatively short sentences, averaging approximately 9 tokens; SST-2 is a movie review sentiment classification dataset with medium text length, averaging approximately 13 tokens; Rotten Tomatoes is also a movie review sentiment analysis dataset, but with longer texts and more complex semantics, averaging approximately 25 tokens.

[0145] Models: Experiments were conducted on two pre-trained large language models with different architectures and scales: a generative pre-trained Transformer2-Base (GPT-2-Base) (containing 12 layers, 768 hidden layers, 3072 feedforward network dimensions, and approximately 117 million parameters) and a lightweight Llama model (TinyLlama-1.1B) (containing 22 layers, 2048 hidden layers, 5636 feedforward network dimensions, and approximately 1.1 billion parameters). All pre-trained large language models were derived from the model platform and fine-tuned using LoRA based on their pre-trained weights to verify the applicability of LoGIA under different model scales and architectures.

[0146] Baseline methods: To comprehensively evaluate the effectiveness of the method of this invention, four representative gradient inversion attacks were selected as baseline methods, including Deep Leakage from Gradients (DLG) and Tag-based Attack on Gradient (TAG), as well as the current state-of-the-art methods Extracting text from gradients with Language Model Priors (LAMP) and Decoder-based Attack for Gradient Embedding Recovery (DAGER).

[0147] Evaluation Methods: To accurately evaluate the reconstruction performance of each method, the ROUGE series of indicators were used to assess the reconstruction results. The ROUGE-1, ROUGE-2, and ROUGE-L indicators were used to measure the matching degree between the reconstructed text and the original text at the untuple, bigtuple, and longest common subsequence levels, respectively.

[0148] With a batch size of 1, the performance of each method was comprehensively evaluated on GPT-2 and TinyLlama models under different rank and dataset conditions. The table below shows the reconstruction results of LoGIA and the four baseline methods on various datasets on different models:

[0149] Table 1 Reconstruction results of the CoLA dataset in the first batch

[0150]

[0151] Table 2 Reconstruction results of the SST-2 dataset in the first batch

[0152]

[0153] Table 3 Reconstruction results of the Rotten Tomatoes dataset in the first batch

[0154]

[0155] As shown in Table 1 (Reconstruction results of the CoLA dataset in the first batch), Table 2 (Reconstruction results of the SST-2 dataset in the first batch), and Table 3 (Reconstruction results of the Rotten Tomatoes dataset in the first batch), according to the ROUGE-1 metric, LoGIA reconstructs more labels than all baseline methods in all settings, demonstrating superior reconstruction capabilities. Furthermore, LoGIA also comprehensively outperforms DLG, TAG, and LAMP in both ROUGE-2 and ROUGE-L scores. LoGIA only shows a lower ROUGE-2 score than DAGER on the CoLA dataset with rank=16, but still maintains suboptimal performance. In addition, LoGIA maintains stable and excellent performance across all datasets and rank settings, achieving average improvements of 4.12%, 8.56%, and 4.92% over the suboptimal method LAMP on ROUGE-1, ROUGE-2, and ROUGE-L, respectively, demonstrating strong generalization ability and robustness across different model architectures. Therefore, LoGIA can provide more reliable, stable and comparable reconstruction results under the low-rank gradient sharing condition of federated LoRA, thus serving as a more comprehensive and effective benchmark for privacy risk measurement to characterize the level of privacy leakage risk under different training settings and protection strategies.

[0156] To verify the effectiveness of LoGIA with larger batch sizes, further experiments were conducted on the GPT-2 model with batch sizes of 1, 2, 4, and 32. The experimental results for different datasets are shown in the table below:

[0157] Table 4 Reconstruction results of the CoLA dataset in the second batch

[0158]

[0159] Table 5 Reconstruction results of the SST-2 dataset in the second batch.

[0160]

[0161] Table 6 Reconstruction results of the Rotten Tomatoes dataset in the second batch.

[0162]

[0163] As shown in Table 4 (Reconstruction results of the CoLA dataset in the second batch), Table 5 (Reconstruction results of the SST-2 dataset in the second batch), and Table 6 (Reconstruction results of the Rotten Tomatoes dataset in the second batch), the results indicate that although increasing the batch size expands the optimization space, LoGIA still achieves the best ROUGE-1, ROUGE-2, and ROUGE-L scores under all settings.

[0164] To better explore the impact of the core strategies in LoGIA, ablation experiments were conducted focusing on two aspects: the initialization step and the embedded discrete mapping step. Regarding initialization, the proposed singular value decomposition-based method was compared with standard random initialization. To evaluate the effect of the embedded discrete mapping step, the complete LoGIA method was compared with a variant that disables embedded discrete mapping. The results are shown in [Figure number missing]. Figures 3 to 14 .

[0165] Figure 3 This illustration schematically demonstrates the impact of initialization operations on the ROUGE-1 score of the surrogate-unigram in a recall-oriented summary evaluation. Figure 1 , Figure 4 This illustration schematically demonstrates the impact of initialization operations on the ROUGE-2 score of the surrogate-binary summaries used in recall-oriented summary evaluation. Figure 1 , Figure 5 This illustration schematically demonstrates the effect of initialization operations on the ROUGE-L score of the substitute in the summary evaluation based on the longest common subsequence. Figure 1 ; Figure 3 The x-axis represents the dataset, and the y-axis represents ROUGE-1. Under the condition of rank 8, the initialization method based on singular value decomposition has a significantly higher ROUGE-1 score than random initialization. This verifies that the initialization strategy can provide a high-quality starting point that is closer to the real input distribution for subsequent gradient matching optimization, thereby effectively improving the matching degree between the reconstructed text and the original text at the unit group level. Figure 4 The x-axis represents the dataset, and the y-axis represents ROUGE-2. Under the condition of rank 8, the initialization based on singular value decomposition not only improves the word recovery rate, but also significantly improves the reconstruction ability of continuous bigrams, indicating that the method captures richer local contextual structure information in the input. Figure 5 The x-axis represents the dataset, and the y-axis represents ROUGE-L. With a rank of 8, the ROUGE-L score reflects the degree of matching between the reconstructed text and the original text in terms of the longest common subsequence, and is an important indicator for measuring semantic coherence. Figure 5 The results clearly show that the initialization method based on singular value decomposition also has significant advantages in semantic coherence reconstruction.

[0166] Figure 6 The diagram illustrates the effect of initialization operations on the ROUGE-1 score. Figure 2 , Figure 7 The diagram illustrates the effect of initialization operations on the ROUGE-2 score. Figure 2 , Figure 8 The diagram illustrates the effect of initialization operations on the ROUGE-L score. Figure 2 , Figure 6 The x-axis represents the dataset, and the y-axis represents ROUGE-1. Figure 7 The x-axis represents the dataset, and the y-axis represents ROUGE-2. Figure 8 The x-axis represents the dataset, and the y-axis represents ROUGE-L. Under the condition of rank 16, the initialization method based on singular value decomposition consistently maintains a leading advantage on all evaluation metrics. This demonstrates that the high-quality initialization strategy proposed in this invention is robust and effective under different low-rank constraints, and can stably provide excellent initialization directions for text reconstruction tasks.

[0167] Figure 9 The diagram illustrates the effect of the mapping operation on the ROUGE-1 score. Figure 1 , Figure 9 The x-axis represents the dataset, and the y-axis represents ROUGE-1. This compares the ROUGE-1 scores of LoGIA method variants with and without the embedded discrete mapping step, assuming a LoRA rank of 8. Figure 9 The bar chart clearly shows that periodically performing the embedded discrete mapping operation can significantly improve the ROUGE-1 score of the reconstructed text.

[0168] Figure 10 The diagram illustrates the effect of the mapping operation on the ROUGE-2 score. Figure 1 , Figure 11 The diagram illustrates the effect of the mapping operation on the ROUGE-L score. Figure 1 , Figure 10 The x-axis represents the dataset, and the y-axis represents ROUGE-2. Figure 11 The x-axis represents the dataset, and the y-axis represents ROUGE-L. See [link / reference]. Figure 10 and Figure 11 As shown, the impact of the embedded discrete mapping operation on ROUGE-2 and ROUGE-L scores is investigated under the condition of rank 8. The results show that enabling this mapping operation significantly improves the tuple matching degree and semantic coherence of the reconstructed text. This confirms that the embedded discrete mapping mechanism can effectively correct the semantic drift generated during continuous optimization, projecting the virtual embedding back into the valid discrete token space, thereby ensuring the semantic rationality and accuracy of the reconstruction results.

[0169] Figure 12 The diagram illustrates the effect of the mapping operation on the ROUGE-1 score. Figure 2 , Figure 13 The diagram illustrates the effect of the mapping operation on the ROUGE-2 score. Figure 2 , Figure 14 The diagram illustrates the effect of the mapping operation on the ROUGE-L score. Figure 2 ; Figure 12 The x-axis represents the dataset, and the y-axis represents ROUGE-1. Figure 13 The x-axis represents the dataset, and the y-axis represents ROUGE-2. Figure 14 The x-axis represents the dataset, and the y-axis represents ROUGE-L. Under a rank of 16, the influence of the embedded discrete mapping operation on the ROUGE-1, ROUGE-2, and ROUGE-L scores is shown. Even with more complex parameter settings, the performance gain from the embedded discrete mapping remains significant. The illustrated data demonstrates that the mechanism of this embedded discrete mapping operation is a core component of the method in this invention, playing a crucial role in achieving stable and high-precision text reconstruction in the low-dimensional gradient environment of Federated LoRA.

[0170] See above Figures 3 to 14 The initialization step and the embedded discrete mapping step both significantly improve the reconstruction results, with the embedded discrete mapping bringing the most significant improvement. Compared with the baseline without mapping, the average reconstruction accuracy is improved by more than 10%.

[0171] To further verify the applicability and effectiveness of the method of this invention under actual privacy-preserving training conditions, this embodiment conducts evaluations under various commonly used defense mechanisms, including differential privacy, gradient sparsity, and gradient quantization. These defense techniques are widely used in federated training and privacy-preserving fine-tuning, aiming to reduce sensitive information carried in shared updates. This embodiment characterizes the privacy leakage risk under defense mechanisms and quantifies the risk level by performing a LoGIA reconstruction evaluation process under different defense strengths and strategies and comparing it with existing solutions. For the differential privacy experiment, since the gradient amplitude of the classification head is relatively large, it leads to an increase in the overall gradient norm. Therefore, a high pruning threshold C=10 is set, and different noise multipliers are set. The values ​​were set as follows: For the gradient sparsity experiment, three sparsity ratios were set: 30%, 50%, and 70%, which represent the proportion of the gradient parameter with the smallest absolute value that is set to zero; For the gradient quantization experiment, two commonly used quantization schemes, float16 and bfloat16, were used. The experimental results are shown in the table below:

[0172] Table 7 Experimental results of the CoLA dataset under differential privacy.

[0173]

[0174] Table 8 Experimental results of the SST-2 dataset under differential privacy.

[0175]

[0176] Table 9 Experimental results of the Rotten Tomatoes dataset under differential privacy.

[0177]

[0178] Table 10 Experimental results of the CoLA dataset under gradient sparsity.

[0179]

[0180] Table 11 Experimental results of the SST-2 dataset under gradient sparsity.

[0181]

[0182] Table 12 Experimental results of the Rotten Tomatoes dataset under gradient sparsity.

[0183]

[0184] Table 13 Experimental results of the CoLA dataset under gradient quantization

[0185]

[0186] Table 14 Experimental results of the SST-2 dataset under gradient quantization

[0187]

[0188] Table 15 Experimental results of the Rotten Tomatoes dataset under gradient quantization

[0189]

[0190] See Tables 7 through 15. This represents the gradient sparsity ratio. For quantitative strategies, For 16-bit floating-point quantization, Using 16-bit floating-point quantization for brain data, experiments show that LoGIA achieves the best attack performance in all configurations across three defense scenarios. Particularly in the differential privacy defense experiment, LoGIA outperforms the suboptimal method LAMP by an average of 9.34%, 7.18%, and 8.60% on ROUGE-1, ROUGE-2, and ROUGE-L metrics, respectively. This demonstrates that the method of this invention can consistently produce high-quality reconstruction results under various defense conditions, revealing the privacy leakage risk in federated LoRA scenarios.

[0191] By introducing a high-quality initialization strategy based on singular value decomposition, this invention effectively utilizes the linear dependency between LoRA gradients and input embeddings, providing crucial directional guidance for the optimization process. Simultaneously, it innovatively designs an embedding discrete mapping mechanism, periodically projecting the deviated embedding vectors from continuous optimization back into the discrete token space, effectively correcting semantic biases. Experimental results on real-world text datasets such as CoLA, SST-2, and Rotten Tomatoes demonstrate that even with extremely low rank and multiple privacy defense mechanisms, LoGIA still achieves significantly superior text reconstruction accuracy and semantic coherence compared to existing methods. This reveals previously underestimated privacy risks in federated LoRA systems and provides crucial quantitative evidence for evaluating and enhancing the practical security of such systems.

[0192] Based on the above Figure 1 As can be seen from the implementation method, the embodiments of the present invention receive target gradient information, which is used to indicate and reflect the gradient of the LoRA module; based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, the target gradient information is processed to generate an initial representation of the virtual input embedding; starting from the initial representation, multiple rounds of iterative optimization are performed: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained; the updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input of the next round of optimization; based on the target virtual input embedding finally output by the multi-round iterative optimization, reconstructed text is generated, and the privacy leakage risk of the target client is measured based on the matching degree between the reconstructed text and the real text. In this way, by leveraging the linear relationship between the gradient of the LoRA module and the input embedding of the pre-trained large language model, an initialization representation strongly correlated with the real embedding is extracted from the target gradient information. This initialization representation is used as a high-quality initialization. Furthermore, by employing a mechanism that combines iterative optimization with periodic discrete mapping, the representation bias generated during the iterative optimization process is effectively corrected. This enables the stable recovery of high-precision reconstructed text in federated LoRA scenarios where gradient information is severely limited. Based on the high-precision reconstructed text, a comprehensive and effective measurement of the privacy leakage risk in federated LoRA scenarios can be achieved.

[0193] Based on the same inventive concept, as an implementation of the above-mentioned privacy risk measurement method for fine-tuning of federated large language models, this embodiment of the invention also provides a privacy risk measurement device for fine-tuning of federated large language models. Figure 15 This is a structural diagram of the privacy risk measurement device for fine-tuning a federated large language model in an embodiment of the present invention. See also... Figure 15 As shown, this privacy risk measurement device for fine-tuning a federated large language model may include:

[0194] The receiving module 1501 is used to receive target gradient information, which is the gradient information of the trainable low-rank matrix uploaded by the target client after training with Federated LoRA. The target gradient information is used to indicate and reflect the gradient of the LoRA module.

[0195] The processing module 1502 is used to process the target gradient information based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, and generate an initial representation of the virtual input embedding.

[0196] The iterative optimization module 1503 is used to perform multiple rounds of iterative optimization starting from the initial representation: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization.

[0197] The measurement module 1504 is used to generate reconstructed text by optimizing the target virtual input embedding of the final output through multiple rounds of iterations, and to measure the privacy leakage risk of the target client based on the matching degree between the reconstructed text and the real text.

[0198] The processing module 1502 is specifically used to perform singular value decomposition on the gradient of the first matrix of any layer of LoRA module in the target gradient information to obtain the corresponding right singular vector; to normalize the right singular vector by utilizing the distribution characteristics of word embeddings of the pre-trained large language model to obtain a normalized initialization matrix; and to construct an initialization representation of virtual input embedding to simulate real input embedding based on the normalized initialization matrix.

[0199] In processing module 1502, the distribution characteristics of word embeddings in the pre-trained large language model are used to normalize the right singular vectors to obtain a normalized initialization matrix. This includes: calculating the average norm of all word vectors in the word embedding matrix of the pre-trained large language model; scaling the right singular vectors according to the average norm so that the norm of the scaled right singular vectors is consistent with the average norm of all word vectors, thus obtaining a normalized initialization matrix.

[0200] The iterative optimization module 1503 is specifically used to perform multiple rounds of iterative optimization sequentially, using the initial representation as the input for the first round of iterative optimization: In each round of optimization, the virtual gradient is calculated based on the virtual input embedding of the current round, and the virtual input embedding of the current round is updated with the goal of minimizing the difference between the virtual gradient and the target gradient information, resulting in the updated continuous vector representation of the current round; according to the first preset period, it is determined whether to perform a mapping operation in the current round; if the mapping operation is performed, the updated continuous vector representation of the current round is mapped to the discrete vocabulary space of the pre-trained large language model to obtain the corrected virtual input embedding, and the corrected virtual input embedding is used as the input for the next round of iterative optimization; if the mapping operation is not performed, the updated continuous vector representation of the current round is directly used as the input for the next round of iterative optimization.

[0201] The device may further include: a sequence order optimization module, used to determine whether to perform sequence order optimization in the current round according to a second preset period, before determining whether to perform mapping operation in the current round according to a first preset period; if sequence order optimization is performed in the current round, then the current basic word sequence is obtained according to the updated continuous vector representation of the current round; the current basic word sequence is optimized and scored using the prior knowledge of the pre-trained large language model to obtain an optimized candidate word sequence; the optimized candidate word sequence is converted into a corresponding continuous vector representation to obtain an ordered optimized continuous vector representation, and the updated continuous vector representation of the current round is replaced with the ordered optimized continuous vector representation; if sequence order optimization is not performed, then the updated continuous vector representation of the current round is retained.

[0202] In the sequence order optimization module, prior knowledge from a pre-trained large language model is used to optimize and score the current basic lexical sequence to obtain optimized candidate lexical sequences. This includes: applying multiple order transformation operations to the current basic lexical sequence to generate multiple candidate lexical sequence variants; calculating a joint score for each candidate lexical sequence variant, which is a weighted sum of the reconstruction loss corresponding to each candidate lexical sequence variant and the language model loss calculated by the pre-trained large language model for each candidate lexical sequence variant; and selecting the optimal candidate lexical sequence variant from the multiple candidate lexical sequence variants as the optimized candidate lexical sequence based on the joint score.

[0203] In the sequence order optimization module, if sequence order optimization is performed in the current round, the current basic word sequence is obtained based on the updated continuous vector representation of the current round. This includes: mapping each continuous vector in the updated continuous vector representation of the current round to the nearest neighbor word in the vocabulary of the pre-trained large language model through cosine similarity to obtain the mapped word; and forming the current basic word sequence with the mapped word.

[0204] In the iterative optimization module 1503, if a mapping operation is performed, the updated continuous vector representation of the current round is mapped to the discrete word space of the pre-trained large language model to obtain the corrected virtual input embedding. This includes: if a mapping operation is performed, for each continuous vector in the updated continuous vector representation of the current round, the target discrete word embedding vector with the highest cosine similarity is determined from the word embedding matrix of the pre-trained large language model, and the target discrete word embedding vector is used as the target vector; the target vectors corresponding to all continuous vectors are combined in order to form the corrected virtual input embedding.

[0205] In the iterative optimization module 1503, in each round of optimization, the virtual gradient is calculated based on the virtual input embedding of the current round, and the virtual input embedding of the current round is updated with the goal of minimizing the difference between the virtual gradient and the target gradient information, to obtain the updated continuous vector representation of the current round. This includes: in each round of optimization, calculating the virtual gradient based on the virtual input embedding of the current round; calculating the reconstruction loss between the virtual gradient and the target gradient information; calculating the norm regularization loss, which is the regularization loss between the average norm of the virtual input embedding of the current round and the average norm of the word embeddings in the pre-trained large language model; constructing the overall optimization objective based on the reconstruction loss and the regularization loss; and updating the virtual input embedding of the current round with the criterion of minimizing the overall optimization objective to obtain the updated continuous vector representation.

[0206] It should be noted that the above description of the privacy risk measurement device embodiment for fine-tuning of federated large language models is similar to the description of the privacy risk measurement method embodiment for fine-tuning of federated large language models, and has similar beneficial effects. For any technical details not disclosed in the embodiments of the privacy risk measurement device for fine-tuning of federated large language models of the present invention, please refer to the description of the privacy risk measurement method embodiment for fine-tuning of federated large language models of the present invention for understanding.

[0207] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A privacy risk measurement method for fine-tuning federated large language models, characterized in that, include: Receive target gradient information, which is the gradient information of the trainable low-rank matrix uploaded by the target client after training with Federated LoRA. The target gradient information is used to indicate and reflect the gradient of the LoRA module. Based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model, the target gradient information is processed to generate an initial representation of the virtual input embedding; Starting from the initial representation, multiple rounds of iterative optimization are performed: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, and the updated continuous vector representation is obtained. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization. Based on the target virtual input embedding of the final output after multiple rounds of iterative optimization, reconstructed text is generated, and the privacy leakage risk of the target client is measured based on the matching degree between the reconstructed text and the real text.

2. The privacy risk measurement method for fine-tuning of federated large language models according to claim 1, characterized in that, The step of processing the target gradient information based on the linear relationship between the LoRA module gradient and the input embedding of the pre-trained large language model to generate an initial representation of the virtual input embedding includes: Singular value decomposition is performed on the gradient of the first matrix of any LoRA module in the target gradient information to obtain the corresponding right singular vector. By utilizing the distribution characteristics of the word embeddings in the pre-trained large language model, the right singular vector is normalized to obtain a normalized initialization matrix; Based on the normalized initialization matrix, an initialization representation of the virtual input embedding is constructed to simulate the real input embedding.

3. The privacy risk measurement method for fine-tuning of federated large language models according to claim 2, characterized in that, The step of normalizing the right singular vectors using the distribution characteristics of the word embeddings in the pre-trained large language model to obtain a normalized initialization matrix includes: Calculate the average norm of all word vectors in the word embedding matrix of the pre-trained large language model; Based on the average norm, the right singular vector is scaled so that the norm of the scaled right singular vector is consistent with the average norm of all word vectors, thus obtaining the normalized initialization matrix.

4. The privacy risk measurement method for fine-tuning of federated large language models according to claim 1, characterized in that, Starting with the initial representation, multiple rounds of iterative optimization are performed: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding, resulting in an updated continuous vector representation. The updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct representation bias, and the mapping result is used as the input for the next round of optimization, including: Using the initial representation as the input for the first round of iterative optimization, multiple rounds of iterative optimization are performed sequentially: In each round of optimization, the virtual gradient is calculated based on the virtual input embedding of the current round, and the virtual input embedding of the current round is updated with the goal of minimizing the difference between the virtual gradient and the target gradient information, so as to obtain the updated continuous vector representation of the current round. According to the first preset period, it is determined whether to perform a mapping operation in the current round; if the mapping operation is performed, the updated continuous vector representation of the current round is mapped to the discrete vocabulary space of the pre-trained large language model to obtain the corrected virtual input embedding, and the corrected virtual input embedding is used as the input for the next round of iteration optimization; if the mapping operation is not performed, the updated continuous vector representation of the current round is directly used as the input for the next round of iteration optimization.

5. The privacy risk measurement method for fine-tuning of federated large language models according to claim 4, characterized in that, Before determining whether to perform a mapping operation in the current round according to a first preset period, the method further includes: Based on the second preset period, determine whether to perform sequence order optimization in the current round; If sequence order optimization is performed in the current round, the current basic word sequence is obtained based on the updated continuous vector representation of the current round; Using the prior knowledge of the pre-trained large language model, the current basic word sequence is optimized and scored to obtain an optimized candidate word sequence; The optimized candidate word sequence is converted into a corresponding continuous vector representation to obtain a sequentially optimized continuous vector representation, and the updated continuous vector representation of the current round is replaced with the sequentially optimized continuous vector representation. If sequence order optimization is not performed, the updated continuous vector representation of the current round is retained.

6. The privacy risk measurement method for fine-tuning of federated large language models according to claim 5, characterized in that, The process of optimizing and scoring the current basic word sequence using the prior knowledge of the pre-trained large language model to obtain an optimized candidate word sequence includes: Multiple sequence transformation operations are applied to the current basic lexical sequence to generate multiple candidate lexical sequence variants; For each candidate lemma sequence variant, a joint score is calculated, which is a weighted sum of the reconstruction loss corresponding to each candidate sequence variant and the language model loss calculated by the pre-trained large language model for each candidate sequence variant; Based on the joint score, the optimal candidate lemma sequence variant is selected from the plurality of candidate lemma sequence variants as the optimized candidate lemma sequence.

7. The privacy risk measurement method for fine-tuning of federated large language models according to claim 5, characterized in that, If sequence order optimization is performed in the current round, the current basic word sequence is obtained based on the updated continuous vector representation of the current round, including: Each continuous vector in the updated continuous vector representation of the current round is mapped to the nearest neighbor word in the vocabulary of the pre-trained large language model through cosine similarity to obtain the mapped word. The mapped lexical units are used to form the current basic lexical unit sequence.

8. The privacy risk measurement method for fine-tuning of federated large language models according to claim 4, characterized in that, If the mapping operation is performed, the updated continuous vector representation of the current round is mapped to the discrete vocabulary space of the pre-trained large language model to obtain the corrected virtual input embedding, including: When performing the mapping operation, for each continuous vector in the updated continuous vector representation of the current round, the target discrete word embedding vector with the highest cosine similarity is determined from the word embedding matrix of the pre-trained large language model, and the target discrete word embedding vector is used as the target vector. The target vectors corresponding to all continuous vectors are combined in order to form the corrected virtual input embedding.

9. The privacy risk measurement method for fine-tuning of federated large language models according to claim 4, characterized in that, In each round of optimization, a virtual gradient is calculated based on the virtual input embedding of the current round. The virtual input embedding of the current round is updated with the objective of minimizing the difference between the virtual gradient and the target gradient information, resulting in an updated continuous vector representation for the current round, including: In each round of optimization, the virtual gradient is calculated based on the virtual input embedding of the current round. Calculate the reconstruction loss between the virtual gradient and the target gradient information; Calculate the norm regularization loss, which is the regularization loss between the average norm of the virtual input embedding in the current round and the average norm of the word embedding in the pre-trained large language model; Based on the reconstruction loss and the regularization loss, an overall optimization objective is constructed; The virtual input embedding for the current round is updated based on minimizing the overall optimization objective, resulting in the updated continuous vector representation.

10. A privacy risk measurement device for fine-tuning a federated large language model, characterized in that, include: The receiving module is used to receive target gradient information, which is the gradient information of the trainable low-rank matrix uploaded by the target client after the federated LoRA training. The target gradient information is used to indicate and reflect the gradient of the LoRA module. The processing module is used to process the target gradient information according to the linear relationship between the gradient of the LoRA module and the input embedding of the pre-trained large language model, and generate an initial representation of the virtual input embedding. The iterative optimization module is used to perform multiple rounds of iterative optimization starting from the initial representation: in each round of optimization, gradient matching is performed in the continuous vector space to update the virtual input embedding to obtain the updated continuous vector representation, and the updated continuous vector representation is periodically mapped to the discrete vocabulary space of the pre-trained large language model to correct the representation bias, and the mapping result is used as the input for the next round of optimization. The measurement module is used to generate reconstructed text based on the target virtual input embedding of the final output after multiple rounds of iterative optimization, and to measure the privacy leakage risk of the target client based on the matching degree between the reconstructed text and the real text.

Images