A method for protecting cue words in large models based on differential privacy

Abstract

This application provides a method for protecting prompt words in large models based on differential privacy. By constructing a perturbation mapping table, differential privacy perturbation is applied only to the first token encountered in a multi-turn dialogue, and the mapping relationship is stored. Subsequent repeated tokens directly reuse the historical perturbation results, thus avoiding the accumulation of privacy budget with the increase of dialogue turns. Simultaneously, an attention-based context-aware utility function is combined to integrate the static embedding similarity of tokens with dynamic context similarity to maintain semantic consistency across turns. Finally, a two-stage bucketing index mechanism is adopted, first bucketing candidate tokens according to utility, and then fine-sampling within the selected buckets, effectively mitigating the long-tail effect under large vocabulary and improving the stability of perturbation selection. This application achieves a balance between privacy protection strength and semantic usability in multi-turn dialogues, and only requires perturbing the input prompt words without accessing the model's internal architecture, making it suitable for black-box large language model inference scenarios.

Description

Technical Field

[0001] This application belongs to the technical field of privacy protection of prompt words in multi-turn large language models, specifically involving a method for protecting prompt words in large models based on differential privacy. Background Technology

[0002] With the widespread application of Large Language Models (LLMs) in text understanding and generation, they are increasingly being deployed in real-world applications involving sensitive user input. In these applications, users interact with the model by providing cue words, which may contain sensitive information such as personal data, behavioral preferences, and proprietary data. This is especially problematic in black-box deployments or cloud inference scenarios, where users are unaware of how their input is stored and processed, posing significant privacy risks. To address this issue, Differential Privacy (DP) has been widely applied to cue word protection in large language model inference. However, most existing differential privacy methods typically assume single-turn interactions, while real-world large language model applications often involve multi-turn dialogues with strong contextual relevance. Therefore, single-turn interaction-based differential privacy methods cannot effectively address the issues of privacy budget accumulation and semantic consistency in multi-turn dialogues. To address this challenge, this paper proposes DP³, a differential privacy-based multi-turn dialogue cue word perturbation framework. It aims to improve the balance between privacy protection and practicality by reducing redundant privacy consumption in multi-turn dialogues and maintaining cross-turn semantic consistency, ensuring reliable privacy protection capabilities in large language model inference tasks under black-box inference environments.

[0003] To achieve privacy protection during the use of large models, existing work mainly focuses on privacy protection from three perspectives: cryptography, client-server hybrid architecture, and differential privacy technology.

[0004] Based on the cryptographic scheme CipherGPT (Hou X, Liu J, Li J, et al. Ciphergpt:Secure two-party gpt inference[J]. Cryptology ePrint Archive, 2023.), it combines homomorphic encryption with a Transformer-based large language model. Users encrypt their prompts before transmitting them to the server. The server can directly perform inference on the encrypted input and return the encrypted output, thus ensuring that the server can never obtain the plaintext prompt information. Based on a client-server hybrid architecture, TextObfuscator (Zhou X, Lu Y, MaR, et al. TextObfuscator: Making pre-trained language model a privacyprotector via obfuscating word representations[C]. Findings of the Association for Computational Linguistics: ACL 2023. 2023: 5459-5473.) perturbs the continuous spatial representation of the cue words and injects calibrated Gaussian or Laplacian noise into these continuous embeddings during forward propagation. This type of approach is more effective at preserving the semantic structure of the cue words than modifying or replacing discrete spatial perturbations of individual tokens, thereby improving usability—the server can still generate meaningful output by interpreting the perturbed embeddings.Based on differential privacy techniques: SANTEXT (Yue X, Du M, Wang T, et al. Differential privacy for text analytics via natural text sanitization[J]. arXiv preprint arXiv:2106.01221, 2021.) employs metric local differential privacy, using the entire vocabulary as the candidate space for each token. This results in an abnormally large sampling space, ultimately leading to a significant decrease in usability. CUSTEXT (Chen S, Mo F, Wang Y, et al. A customized text sanitization mechanism with differential privacy[C]. Findings of the Association for Computational Linguistics: ACL 2023.2023: 5747-5758.) and InferDPT (Tong M, Chen K, Qi Y, et al. Privacy-preservinginference for black-box large language model[J]. arXiv preprint arXiv:2310.12214, 2023.) While static or dynamic adjacency lists can narrow the candidate space, they come at the cost of weakened privacy protection. The CAPE (Wu H, Dai W, Wang L, et al. Cape: Context-Aware Prompt PerturbationMechanism with Differential Privacy[J]. arXiv preprint arXiv:2505.05922,2025.) method mitigates the long-tail effect by combining context-aware token-level perturbation with bucket-based sampling, thereby improving usability to some extent.

[0005] Cryptographic methods have significant limitations in practical deployments. Homomorphic encryption requires complex mathematical operations that lead to extremely high computational costs, and the massive volume of encrypted data increases communication latency. These drawbacks make them unsuitable for real-time scenarios or large-scale deployments. Client-server hybrid architectures face key constraints in black-box large-scale model scenarios: if service providers only provide inference APIs without sharing model details, these methods, requiring partial access to the architecture or parameters of the large language model, are often difficult to implement due to commercial constraints and intellectual property protection limitations. Therefore, their applicability is limited to open-source or white-box large language model scenarios. Differential privacy-based schemes are all designed for single-turn dialogue prompt word protection. Directly applying them to multi-turn dialogues results in repeated tokens being independently perturbed, causing the privacy budget to be gradually consumed with each dialogue turn, potentially exceeding acceptable privacy loss limits. Furthermore, because each turn's perturbation is independent, the lack of consideration for historical context leads to the disruption of cross-turn semantic consistency, thus affecting the inference quality and consistency of subsequent turns. Summary of the Invention

[0006] To address the aforementioned problems in the existing technology, this application provides a method for protecting large model cue words based on differential privacy. The technical problem to be solved by this application is achieved through the following technical solution: A method for protecting cue words in large models based on differential privacy includes: S100: Construct a perturbation mapping table; the perturbation mapping table is used to provide tokens for prompt words during multi-turn dialogues, and only performs differential privacy perturbation on the tokens that appear for the first time, and stores the perturbed tokens and their corresponding original tokens in the perturbation mapping table; S200: Based on the attention mechanism, it combines the dialogue history and the current prompt word to generate a context-aware utility function for each token in the current prompt word, which is used to evaluate the semantic similarity between the token and the candidate tokens; S300: A two-stage bucket index mechanism is adopted. The candidate tokens in the vocabulary are divided into multiple buckets according to the utility function. First, a target bucket is selected based on the bucket-level utility. Then, the final perturbation token is sampled in the target bucket to replace the original token in the current prompt word.

[0007] Beneficial effects: This application provides a method for protecting prompt words in large-scale multi-turn language models based on differential privacy, belonging to the technical field of prompt word privacy protection in multi-turn large-scale language models. This application constructs a perturbation mapping table, performing differential privacy perturbation on only the first token encountered in a multi-turn dialogue and storing the mapping relationship. Subsequent repeated tokens directly reuse the historical perturbation results, thus avoiding the accumulation of privacy budget with increasing dialogue turns. Simultaneously, it combines an attention-based context-aware utility function, fusing the static embedding similarity and dynamic context similarity of tokens to maintain semantic consistency across turns. Finally, a two-stage bucketing index mechanism is adopted, first bucketing candidate tokens according to utility, and then fine-sampling within the selected buckets, effectively mitigating the long-tail effect under large vocabulary and improving the stability of perturbation selection. This application achieves a balance between privacy protection strength and semantic usability in multi-turn dialogues, and only requires perturbing the input prompt words without accessing the model's internal architecture, making it suitable for black-box large-scale language model inference scenarios.

[0008] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a method for protecting large model cue words based on differential privacy provided in this application; Figure 2 This is a privacy-utility trade-off diagram of the five differential privacy methods provided in this application; Figure 3 This application provides a fixed privacy budget. A diagram illustrating the privacy-utility trade-off across different rounds of conversation. Figure 4 This is a graph showing the results of the ablation test provided in this application. Detailed Implementation

[0010] The present application will be described in further detail below with reference to specific embodiments, but the implementation of the present application is not limited thereto.

[0011] like Figure 1 As shown, this application provides a method for protecting large model cue words based on differential privacy, including: S100: Construct a perturbation mapping table; the perturbation mapping table is used to provide tokens for prompt words during multi-turn dialogues, and only performs differential privacy perturbation on the tokens that appear for the first time, and stores the perturbed tokens and their corresponding original tokens in the perturbation mapping table; In multi-turn dialogues, single-turn dialogues are applied directly in each round. -LDP perturbations lead to the accumulation of privacy budgets. When the cue words in each round of dialogue are perturbed independently, repeated tokens will be repeatedly randomized in multiple rounds of dialogue. According to the sequential synthesis theorem of differential privacy, if the dialogue lasts for T rounds, each round applies... With the LDP mechanism, the overall privacy budget is capped at [a certain value]. In long dialogues, this may quickly exceed acceptable limits. To address this issue, this application introduces a first-emergence perturbation scheme based on a perturbation map (PMT).

[0012] In one specific embodiment of this application, S100 includes: S110: For the prompt words of the current round, determine one by one whether each token already exists in the disturbance mapping table; S120: If the token already exists in the perturbation mapping table, then directly read from the perturbation mapping table and reuse its corresponding historical perturbation result; S130: If the token is appearing for the first time and does not exist in the perturbation mapping table, a random perturbation mechanism that satisfies differential privacy is applied to the token to generate a perturbation result, and the correspondence between the token and the perturbation result is stored in the perturbation mapping table.

[0013] DP³ does not perturb every token in every round. Instead, it perturbs the token upon its first appearance in the dialogue and stores the perturbation result in the PMT. In subsequent rounds, recurring tokens directly reuse their stored mappings, while only newly introduced tokens are perturbed and added to the PMT. This design avoids the repeated privacy overhead of overlapping content and decouples privacy loss from the number of dialogue rounds. Formally, for tokens in the current prompt... The perturbated output is determined by the following formula:

[0014] Among them, R( This indicates the application when the token first appears. -LDP random perturbation mechanism. The privacy cost of the first token is the same as the standard single-round perturbation. For tokens that appear repeatedly in multiple rounds, only one perturbation is performed, and subsequent reuse does not introduce additional randomization. Therefore, the privacy loss for each token is R( The single-application limitation means that the overall privacy budget depends on the number of different tokens that are disturbed in the conversation, rather than the number of rounds.

[0015] The perturbation mapping table in this application is cleared after the conversation ends, or reset after a preset conversation round or token limit is reached, in order to control the long-term accumulation of the privacy budget.

[0016] S200: Based on the attention mechanism, it combines the dialogue history and the current prompt word to generate a context-aware utility function for each token in the current prompt word, which is used to evaluate the semantic similarity between the token and the candidate tokens; In multi-turn dialogues, the semantics of tokens are inherently context-dependent and may change across different turns. However, many existing candidate generation strategies rely solely on static embedding similarity, which is insufficient to maintain semantic consistency across turns. To address this issue, this application introduces an attention-weighted, context-aware candidate generation mechanism that leverages Transformer-based contextual representations.

[0017] In one specific embodiment of this application, S200 includes: S210: Concatenate the dialogue history with the current prompt to form a contextualized input sequence, and input the input sequence into a lightweight local Transformer encoder to obtain the contextual aggregated representation of each token; In the dialogue round j In the middle, we will have a dialogue with history. This is combined with the current prompt word to form a contextualized input sequence. Then, we obtain the context token representation through a lightweight local Transformer encoder and extract the attention tensor of the last layer. Where H represents the number of attention heads, and n is the sequence length. To obtain a stable measure of context relevance, we average and normalize the attention weights of each head, resulting in the following formula:

[0018] Based on normalized attention weights, this application is a token. Construct a context aggregation representation ,

[0019] In the formula, Context aggregation representation, Represents the attention tensor of the last layer The normalized value, H represents the number of attention heads, and n is the sequence length. Indicates the first One token, Indicates token The hidden state; unlike static token embedding, this representation captures the contextual semantics that the model focuses on when interpreting tokens, thus reflecting dependencies in cross-turn dialogue.

[0020] S220: Calculate the static embedding similarity between the original token and the candidate token, and the dynamic context similarity between the context aggregation representation of the original token and the context aggregation representation of the candidate token, using the context aggregation representation of each token; the dynamic context similarity is calculated through attention-based context aggregation representation; specifically, the hidden states of each token are weighted and summed using the attention weights of the last layer of the Transformer to capture the contextual dependencies of the tokens in the multi-turn dialogue history.

[0021] In addition to contextual relevance, this application also calculates tokens. and candidate tokens The static embedding similarity between the tokens is calculated using the Euclidean distance between their embeddings. In other words, the static embedding similarity between the original token and the candidate token is expressed by the formula:

[0022] In the formula, Indicates token and candidate tokens Static embedding similarity, Indicates token static embedding vector, Indicates candidate token The static embedding vector.

[0023] Further define a context-aware similarity score, i.e., dynamic context similarity, expressed by the formula:

[0024] S230: The static embedding similarity and the dynamic context similarity are linearly weighted by a balancing factor and fused to generate the final utility function value. The balancing factor is a preset value between 0 and 1, used to adjust the weights of static semantics and dynamic context in perturbation selection according to specific task requirements.

[0025] Finally, this application combines static semantic similarity and dynamic contextual relevance into a unified utility function, the value of which is expressed by the formula:

[0026] In the formula, This represents a balance factor between the semantics of the embedding layer and the contextual information. This design ensures semantic consistency perturbations and maintains consistency across turns in multi-turn dialogues.

[0027] Traditional differential privacy methods typically perturb each token independently in each round of dialogue, leading to repeated consumption of the privacy budget across multiple rounds. Furthermore, inconsistent token perturbations can disrupt semantic coherence across rounds. DP³, however, introduces a Perturbation Map (PMT) to perturb only the first token encountered and stores the perturbation result in the table. If the token reappears in subsequent rounds, the previous perturbation result is used directly without consuming the privacy budget again. This design avoids the accumulation of privacy losses caused by repeated token perturbations across multiple rounds, effectively reducing privacy consumption. Simultaneously, by reusing the same perturbation, DP³ maintains semantic consistency across rounds, thus resolving the issues of privacy budget accumulation and semantic consistency that traditional methods may encounter in multi-round dialogues.

[0028] S300: A two-stage bucket index mechanism is adopted. The candidate tokens in the vocabulary are divided into multiple buckets according to the utility function. First, a target bucket is selected based on the bucket-level utility. Then, the final perturbation token is sampled in the target bucket to replace the original token in the current prompt word.

[0029] When the candidate space covers the entire vocabulary, directly applying the exponential mechanism (EM) can lead to a decrease in utility due to the long-tail effect. In this case, the individual probabilities of many inefficient candidate tokens may be negligible, but their overall probability quality may be high, resulting in probability allocation to semantically unreasonable candidate tokens and reducing the expected utility of the sampled output. This is a common problem in large-vocabulary LLM inference. To address this challenge, we employ a two-stage segmented exponential mechanism, which first selects a candidate bucket and then samples from it, limiting the cumulative effect of inefficient candidate tokens while maintaining semantic reasonableness.

[0030] In one specific embodiment of this application, S300 includes: S310: Divide the range of the utility function into multiple consecutive intervals, each interval corresponding to a bucket, and assign all candidate tokens in the vocabulary to the corresponding buckets according to their utility values; For tokens x This application is based on its utility value The value range is used to divide the candidate tokens into K buckets. Specifically, the value range [ , The candidate token is uniformly divided into K intervals, and each candidate token is ranked according to its utility score. y Assign to a bucket In this way, binning provides a coarse-grained organization of the candidate space, separating high-efficiency regions from long-tail effects.

[0031] S320: In the first stage, calculate the average utility of all tokens in each bucket as the bucket-level utility, and apply an exponential mechanism to select a bucket as the target bucket based on the bucket-level utility; For each bucket Define a bucket-level utility, which is the average utility of all tokens within the bucket:

[0032] This application selects a target bucket based on bucket-level utility. :

[0033] in, This indicates the privacy budget allocated to the bucket selection. This is a global sensitivity of the bucket utility function. This stage focuses the probability quality on semantically reasonable regions in the candidate space, reducing the cumulative effect of low-utility candidate tokens.

[0034] S330: In the second stage, within the target bucket, the exponential mechanism is applied again to sample based on the original utility function value of each candidate token to obtain the final perturbation token; and the final perturbation token is used to replace the original token in the current prompt word.

[0035] In this mechanism, a privacy budget is maintained during target bucket selection in the first stage and during sampling in the second stage. The total privacy budget allocation of the two-stage bucketing index mechanism is the sum of the privacy budget for bucket selection in the first stage and the privacy budget for sampling within the bucket in the second stage, thus satisfying the sequential synthesis property of differential privacy. The number of buckets is a preset hyperparameter, and adjusting the number of buckets controls the granularity of the candidate space to balance the semantic rationality of perturbation selection with computational efficiency.

[0036] After selecting the target bucket B Subsequently, this application applies the exponential mechanism again within the bucket to the final perturbation token. y Perform sampling:

[0037] in, It's about the privacy budget for in-bucket sampling. This is a global sensitivity parameter. Restricting sampling to only one bucket helps maintain fine semantic relevance while avoiding interference from long-tail regions.

[0038] Overall, this two-stage process mitigates the utility degradation caused by the long-tailed candidate distribution through stratified sampling. This is achieved by allocating the privacy budget to... T, where T is the number of dialogue turns. This mechanism satisfies the sequential composition property of differential privacy.

[0039] This application's DP³ introduces a context-aware utility function, combining token embedding distance and attention-based contextual representation. This allows perturbation selection to consider not only the semantics of the token itself but also adjustments based on preceding contextual information, thus better maintaining semantic consistency. Furthermore, DP³ employs a two-stage bucketing index mechanism to handle perturbation selection in a large candidate space. This mechanism first divides candidate tokens into multiple buckets based on their utility scores, and then selects the most suitable perturbation candidate from these. This design effectively avoids the long-tail effect, reduces the negative impact of low-utility candidate tokens on the overall perturbation selection, and maintains the semantic consistency of the perturbations. The two-stage bucketing mechanism further enhances the stability of perturbation selection, ensuring differential privacy protection without affecting semantic quality in multi-turn dialogues.

[0040] To verify the effectiveness and superiority of the differential privacy cue word perturbation framework DP³ in multi-turn dialogue scenarios, multiple sets of comparative and ablation experiments were conducted. The algorithm was implemented using the PyTorch framework. Under different privacy budgets, the performance of DP³ was compared with existing token-level differential privacy methods in terms of privacy protection strength, semantic fidelity, and language fluency. Furthermore, the impact of DP³'s internal modules on the overall performance was verified by adjusting core parameters. Other similar methods used for comparison include token-level differential privacy methods (SANTEXT, CUSTEXT, inferDPT) and context-aware token-level perturbation methods (CAPE). In addition, to verify the practicality of DP³ in black-box LLMs inference scenarios, zero-shot learning tests were conducted for multi-turn dialogue inference tasks, demonstrating its semantic preservation capabilities and privacy protection effects in real-world inference scenarios.

[0041] This application uses two standard multi-turn dialogue datasets, MT-Bench-101 and hCHARP, to evaluate the performance of DP³. The MT-Bench-101 benchmark includes mathematical reasoning (MR) and general reasoning (GR) tasks, designed to evaluate the collaborative problem-solving capabilities of large language models in multi-turn dialogues. CHAP is a more challenging version of CHAP, used to evaluate the model's ability to utilize historical information and mitigate illusions in dialogues. Both datasets are used to test DP³'s ability to preserve cue word semantics and its privacy protection effectiveness in multi-turn dialogue reasoning tasks. Privacy budget is a key metric for evaluating the strength of differential privacy, determined by parameters... definition, A smaller value indicates a higher level of privacy protection, but may reduce the semantic utility of the prompt. To evaluate the impact of perturbed prompts on LLM inference results, Qwen3-Max was used to assess the semantic consistency between the model's response and the standard answer. The Qwen3-Max model was used to complete multi-turn dialogue inference based on the perturbed prompts, supplemented by the Rouge-LF1 score to measure the semantic similarity between the original and perturbed prompts. A higher score indicates better semantic preservation.

[0042] In the privacy protection strength assessment experiment, the attack success rate This is a key metric, quantified using both KNN and BERT inference attacks. In a KNN inference attack, the attacker calculates the embedding distance between the perturbed token and all other tokens in the vocabulary, selecting the 10 tokens with the smallest distances. If the original token appears in this set, the attack is successful. The privacy protection level is defined as the average attack success rate of all tokens. In BERT inference attacks, attackers use a pre-trained BERT model to predict the original token in a perturbation prompt by modeling masked language, and use the Rouge-L F1 score to evaluate the similarity between the predicted prompt and the original prompt. The privacy protection level is also defined as the success rate of attacks. Furthermore, in the ablation experiments, the balance factor was adjusted. We analyze the impact of core parameters on the privacy-utility tradeoff of DP³, along with bucket size K, to verify the necessity of each module in the framework.

[0043] Example 1: Privacy-Utility Comparison Experiment on MT-Bench-101 and hCHARP Datasets For the MT-Bench-101 and hCHARP datasets, this application uses Qwen3-Max as a black-box inference model and employs zero-shot testing to evaluate the semantic fidelity of the perturbation cues. During testing, only perturbation cues containing task instructions are input into the model without parameter updates or fine-tuning. Figure 2 and Figure 3 As shown, in different privacy budgets Below, we present the model test accuracy and privacy protection level of five differential privacy methods, including DP³, on the MT-Bench-101 and hCHARP datasets. The model test accuracy reflects "utility," while the privacy protection level reflects "privacy." Figure 2 The privacy-utility trade-offs of five differential privacy methods are demonstrated. Figure 3 Demonstrates a fixed privacy budget In this context, the privacy-utility trade-off effect at different rounds of dialogue.

[0044] Example 2: Privacy Budget Comparison Experiment Rouge-L F1 scores were calculated between the original prompts and the perturbated prompts on the hCHARP dataset. This metric is used to evaluate sentence semantic similarity. The experimental results are shown in the table below.

[0045]

[0046] The results in the table above show that the Rouge-L F1 value of all methods increases with privacy budget. The performance improves with increasing privacy. Among the three comparison methods, DP³ achieves the best overall performance. Specifically, the privacy budget relationships of the methods are as follows: for methods that depend on... - SANTEXT, a metric for local differential privacy, where the actual privacy budget... ,and In InferDPT, a random adjacency list is generated using Laplace noise, with a default budget of approximately 9, resulting in an actual privacy budget of... The operation of CAPE is as follows: In contrast, DP3 distributes the privacy budget evenly between bucket sampling and in-bucket sampling, resulting in an effective privacy budget. ,in CUSTEXT uses a static adjacency list of size 20, which makes it difficult to quantify the actual privacy budget, and therefore it was excluded from the comparison.

[0047] Example 3: Ablation Test To further verify the necessity of each core module of the DP³ framework and the impact of key parameters, we designed an ablation experiment on the MT-Bench-101 dataset, focusing on analyzing the "balance factor in the utility function". The experiment examined the effect of "bucket size K" on the privacy-utility tradeoff of the model, using privacy budget and the accuracy of Qwen3-Max model semantic consistency assessment as evaluation metrics. In this group of experiments, we fixed K and discussed the balance factor. The impact on experimental results, and through fixation And change To evaluate the effect of different bucket sizes on the experimental results. The experimental results are as follows: Figure 4 As shown.

[0048] To address the privacy budget accumulation and semantic consistency issues inherent in existing differential privacy methods for protecting prompts in multi-turn dialogue large language models (LLMs), as well as the limitations of other privacy protection schemes in terms of efficiency or applicability to black-box scenarios, this application proposes the DP³ framework. This framework innovatively solves the privacy budget accumulation problem and the cross-turn semantic consistency challenge of differential privacy mechanisms in multi-turn dialogues. Unlike existing single-turn dialogue methods, DP³ introduces a perturbation map to ensure the reusability of perturbations for duplicate tokens in multi-turn dialogues, thereby reducing redundant privacy consumption. Simultaneously, the framework incorporates an attention-based context-aware utility function to maintain cross-turn semantic consistency and enhances the stability of perturbation selection through a two-stage bucketing exponential mechanism. Experimental results show that DP³ achieves a better privacy utility balance than existing methods in multi-turn dialogue tasks and exhibits stronger resistance to inference attacks. Furthermore, the DP³ scheme proposed in this patent does not require access to the architecture or parameters of LLMs; it can adapt to black-box inference scenarios solely through front-end prompt perturbations, overcoming the application limitations of hybrid architecture methods in commercial LLMs services.

[0049] It is worth noting that the terms "first" and "second" in this application are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0050] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of this application and should not be construed as limiting the specific implementation of this application to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of this application, and all such modifications or substitutions should be considered within the scope of protection of this application.

Claims

1. A large model prompt word protection method based on differential privacy, characterized in that, include: S100: Construct the perturbation mapping table; The perturbation map is used to provide tokens for prompts during multi-turn dialogues, and only performs differential privacy perturbation on the tokens that appear for the first time, and stores the perturbed tokens and their corresponding original tokens in the perturbation map. S200: Based on the attention mechanism, it combines the dialogue history and the current prompt word to generate a context-aware utility function for each token in the current prompt word, which is used to evaluate the semantic similarity between the token and the candidate tokens; S300: A two-stage bucket index mechanism is adopted. The candidate tokens in the vocabulary are divided into multiple buckets according to the utility function. First, a target bucket is selected based on the bucket-level utility. Then, the final perturbation token is sampled in the target bucket to replace the original token in the current prompt word.

2. The method for protecting large model cue words based on differential privacy according to claim 1, characterized in that, S100 includes: S110: For the prompt words of the current round, determine one by one whether each token already exists in the disturbance mapping table; S120: If the token already exists in the perturbation mapping table, then directly read from the perturbation mapping table and reuse its corresponding historical perturbation result; S130: If the token is appearing for the first time and does not exist in the perturbation mapping table, a random perturbation mechanism that satisfies differential privacy is applied to the token to generate a perturbation result, and the correspondence between the token and the perturbation result is stored in the perturbation mapping table.

3. The method for protecting large model cue words based on differential privacy according to claim 1, characterized in that, S200 includes: S210: Concatenate the dialogue history with the current prompt to form a contextualized input sequence, and input the input sequence into a lightweight local Transformer encoder to obtain the contextual aggregated representation of each token; S220: Calculate the static embedding similarity between the original token and the candidate token, and the dynamic context similarity between the context aggregation representation of the original token and the context aggregation representation of the candidate token, using the context aggregation representation of each token. S230: The static embedding similarity and the dynamic context similarity are linearly weighted by a balancing factor and fused to generate the final utility function value.

4. The method for protecting large model cue words based on differential privacy according to claim 3, characterized in that, The dynamic context similarity is calculated through attention-based context aggregation representation; specifically, the hidden states of each token are weighted and summed using the attention weights of the last layer of the Transformer to capture the contextual dependencies of the tokens in the multi-turn dialogue history.

5. The method for protecting large model cue words based on differential privacy according to claim 3, characterized in that, The context aggregation representation of each token in S210 is expressed by the formula: In the formula, Context aggregation representation, Represents the attention tensor of the last layer The normalized value, H represents the number of attention heads, and n is the sequence length. Indicates the first One token, Indicates token The hidden state; The static embedding similarity between the original token and the candidate token is expressed by the formula: In the formula, Indicates token and candidate tokens Static embedding similarity, Indicates token static embedding vector, Indicates candidate token The static embedding vector; The dynamic context similarity is expressed by the formula: The utility function value is expressed by the formula: In the formula, This represents the balance factor between the semantics of the embedding layer and the contextual information.

6. The method for protecting large model cue words based on differential privacy according to claim 3, characterized in that, The balance factor is a preset value between 0 and 1, used to adjust the weights of static semantics and dynamic context in perturbation selection according to specific task requirements.

7. The method for protecting large model cue words based on differential privacy according to claim 1, characterized in that, The S300 includes: S310: Divide the range of the utility function into multiple consecutive intervals, each interval corresponding to a bucket, and assign all candidate tokens in the vocabulary to the corresponding buckets according to their utility values; S320: In the first stage, calculate the average utility of all tokens in each bucket as the bucket-level utility, and apply an exponential mechanism to select a bucket as the target bucket based on the bucket-level utility; S330: In the second stage, within the target bucket, the exponential mechanism is applied again to sample based on the original utility function value of each candidate token to obtain the final perturbation token; and the final perturbation token is used to replace the original token in the current prompt word.

8. The method for protecting large model cue words based on differential privacy according to claim 7, characterized in that, In the first stage, a privacy budget is stored when selecting a target bucket, and a privacy budget is also stored when sampling in the second stage. The total privacy budget allocation of the two-stage bucket indexing mechanism is the sum of the privacy budget for bucket selection in the first stage and the privacy budget for sampling within the bucket in the second stage, so as to satisfy the sequential synthesis property of differential privacy.

9. The method for protecting large model cue words based on differential privacy according to claim 2, characterized in that, The perturbation mapping table is cleared after the conversation ends, or reset after a preset conversation round or token limit is reached, in order to control the long-term accumulation of the privacy budget.

10. The method for protecting large model cue words based on differential privacy according to claim 7, characterized in that, The number of buckets is a preset hyperparameter. Adjusting the number of buckets controls the granularity of the candidate space to balance the semantic rationality of perturbation selection with computational efficiency.

Images