A large NLP language model privacy protection method based on differential privacy

Abstract

The application discloses a large NLP language model privacy protection method based on differential privacy, which replaces sensitive words in the original text data set to be input into the language model, and removes sensitive words irrelevant to the classification task in the original text data set. The MASK mechanism based on the Bert model is combined with a clustering method to obtain candidate words for replacing the sensitive words, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated. According to the layer-by-layer correlation propagation algorithm, the correlation of each dimension in the generated text embedding to the output result of the downstream modeling task is explained. The maximum privacy consumption threshold allowed is determined, and the privacy budget of each dimension in the text embedding is calculated based on the sensitivity and correlation. The Laplace mechanism is used to add noise to the text embedding; the text embedding with noise after adding noise is published and used in the downstream modeling task scene, so that the sensitive word inference attack of malicious attackers can be resisted, and the risk of sensitive information leakage is reduced.

Description

Technical Field

[0001] This invention relates to a privacy protection method for large-scale NLP language models based on differential privacy, belonging to the field of privacy protection in computer technology, which can reduce the risk of leakage of sensitive information in the original input text. Background Technology

[0002] In recent years, large general-purpose language models have been widely used in the field of natural language processing to extract text features and transform text into vectors for various downstream modeling tasks, such as sentence classification, question answering, and sentiment analysis. Typical examples of such models include Google's BERT and OpenAI's GPT-2.

[0003] However, text embeddings from large-scale general-purpose language models capture a lot of sensitive information from plain text. If an adversary successfully attacks the embeddings, this sensitive information is at risk of being leaked. Some researchers have studied the potential privacy risks of large-scale general-purpose language models in the NLP field, using advanced deep learning techniques to construct two feasible attack methods: pattern reconstruction attacks and keyword inference attacks. They evaluated eight mainstream NLP language models in four different privacy-critical domains—such as healthcare and genomics—revealing that such security vulnerabilities do indeed exist in text embeddings. Other researchers have drawn inspiration from existing attack methods such as embedding inversion attacks, attribute inference attacks, and membership inference attacks, systematically studying the information that may be leaked by text embeddings. This research has been validated on widely used word embedding and sentence embedding models, demonstrating that text embeddings contain information about the exact words in the input text, not just abstract semantics. Furthermore, research shows that based on general sampling strategies and evaluation model ranking, attackers can even extract key information from the language model's training set using only black-box query access, including personal identification information, IRC dialogues, codes, and 128-bit UUIDs. All of these studies confirm that there is a potential risk of sensitive information leakage for current mainstream text feature extraction methods.

[0004] Conversely, regarding the privacy leakage problem of text embeddings generated by large-scale general-purpose language models, and how to effectively protect these text embeddings, some research progress has been made in recent years. Some researchers have proposed adversarial training techniques to minimize information leakage through inversion and inference of sensitive attributes, and have experimentally demonstrated their feasibility in mitigating various attack methods. Other researchers have required all participants to add a simple encryption step to prevent malicious attackers from recovering private text data through eavesdropping, and have evaluated this scheme on the GLUE benchmark to confirm its effectiveness. In addition, there are methods such as using pre-trained convolutional neural networks to identify privacy-related entities closely related to individual user stories and provide alerts based on predefined privacy rules.

[0005] In the field of differential privacy, although many researchers have mentioned the possibility of using differential privacy techniques to solve this problem, no relatively complete defense method has yet been systematically proposed. Therefore, there is an urgent need for a method that uses differential privacy techniques to effectively protect the text embeddings generated by large NLP language models, while maintaining the usability of these text embeddings for downstream modeling tasks as much as possible. Summary of the Invention

[0006] The summary section of this application is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0007] To address the problems and shortcomings of existing technologies, this invention aims to provide a privacy protection method for large-scale NLP language models based on differential privacy. This method, implemented using a differential privacy mechanism, perturbs the text feature vectors extracted from a large-scale general-purpose NLP language model, ensuring the usability of the noisy text feature vectors for downstream modeling tasks. Simultaneously, it can resist sensitive word inference attacks by malicious attackers, thereby reducing the risk of sensitive information leakage. This addresses the problems mentioned in the background section.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] This invention discloses a privacy protection method for large-scale NLP language models based on differential privacy, comprising the following steps:

[0010] Step 1: Perform sensitive word replacement on the original text dataset to be input into the language model, removing sensitive words in the original text dataset that are irrelevant to the classification task;

[0011] Step 2: Based on the BERT model, the Mask mechanism is combined with clustering methods to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated.

[0012] Step 3: Generate the correlation between each dimension of the text embedding and the output of the downstream modeling task according to the layer-by-layer correlation propagation algorithm;

[0013] Step 4: Determine the maximum allowable privacy consumption threshold and calculate the allocatable privacy budget for each dimension of the text embedding based on sensitivity and relevance;

[0014] Step 5: Add noise to the text embedding using the Laplace mechanism of differential privacy;

[0015] Step 6: Publish the text embedding with added noise for use in downstream modeling tasks.

[0016] Furthermore, in step 1, sensitive word replacement is performed on the original text dataset to be input into the language model. This sensitive word replacement can be divided into the following two cases:

[0017] If the sensitive words are only related to the user's privacy and have little impact on the output of the downstream modeling task, they are replaced with other words that do not affect the semantic fluency of the sentence before the text embedding is generated by the NPL language model; if the sensitive words are related to both the user's privacy and the output of the downstream modeling task, then step 2 is used to select the candidate words to replace the sensitive words in the replacement word set.

[0018] Furthermore, in step 2, the MASK mechanism based on the BERT model, combined with clustering methods, is used to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated. The specific steps include:

[0019] Step 2.1: Combine a subset of sensitive words from the original text dataset to form a masked text dataset.

[0020] Step 2.2, using the masked text dataset Train a sensitive word selection model;

[0021] Step 2.3: The sensitive word selection model selects sensitive words for each input sentence in the original text dataset, and then performs masking processing to obtain the masked text dataset S. m ;

[0022] Step 2.4, fine-tune the NLP language model for the masked text dataset S. mPredicting all words in the set and generating several new sentences to form a new sentence set S. p ;

[0023] Step 2.5, for the new statement set S p Perform k-medoid clustering algorithm, and then calculate the sensitivity Δf for the category of sensitive words in the original text dataset.

[0024] Furthermore, in step 2.5, for the new statement set S p Perform k-medoid clustering algorithm, and then calculate the sensitivity Δf for the categories of sensitive words in the original text dataset. The specific steps include the following:

[0025] Step 2.5.1, for the new statement set S p The sentence vectors are subjected to k-medoid clustering algorithm to make sensitive words in the original text dataset indistinguishable to attackers in their corresponding categories.

[0026] Step 2.5.2: Calculate the sensitivity of each dimension in the text embedding generated by the NLP language model from the input statement in the original text dataset, as well as the upper and lower limits of sensitivity within the range of replaceable words.

[0027] Furthermore, in step 3, the relevance of each dimension in the text embedding to the output of the downstream modeling task is interpreted and generated according to the layer-by-layer relevance propagation algorithm. Based on the backpropagation rule of the layer-by-layer relevance propagation algorithm, the propagation process terminates after reaching the input node in the reverse direction. Therefore, the relevance score of each dimension in the input to the output of the downstream task can be obtained, expressed as...

[0028]

[0029] Among them, z jk The product of neuron j and the weight between neuron j and neuron k, ∑ j R is the sum of all neurons in layer j. k Let ∑ be the relevance score of neuron k to the model output. k It is the sum of all neurons in layer k.

[0030] Furthermore, the formula for calculating the allocatable privacy budget in step 4 is expressed as follows:

[0031]

[0032] Where P is the specified confidence level, wc is the noise range, and Δf is the sensitivity.

[0033] Furthermore, the noise interval wc used in the calculation of the allocatable privacy budget is adjusted according to the relevance score and sensitivity, and the noise interval wc can be expressed as follows:

[0034]

[0035] Where R is the correlation score and Δf is the sensitivity.

[0036] Furthermore, in step 5, the Laplace mechanism is used to add noise to the text embedding, adding noise conforming to a Laplace distribution for each dimension of the sentence vector. The added noise must satisfy...

[0037]

[0038] Where Δf is the sensitivity, ∈ is the allocatable privacy budget, and λ is the scale parameter.

[0039] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0040] This invention conducts research on privacy protection of text embeddings based on differential privacy technology. It mainly includes three parts: the first part involves finding the necessary set of sensitive replacement words in the original text dataset and calculating the sensitivity; the second part involves obtaining the relevance scores of each dimension of the text embedding to the downstream output; and the third part involves combining the relevance scores and sensitivity to perform noise addition processing on the generated text embedding using a Laplacian mechanism based on differential privacy. The perturbed text embedding can then be fed into various downstream task models to complete the service. This invention, based on the Laplacian mechanism of differential privacy, perturbs the text feature vectors extracted from large-scale general-purpose NLP models, ensuring that the noise-added text embedding still achieves good accuracy after passing downstream modeling tasks, and maintaining the usability of the text feature vectors for downstream modeling tasks. Simultaneously, it can resist the possibility of malicious attacks using sensitive words, thereby reducing the risk of sensitive information leakage. Attached Figure Description

[0041] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application.

[0042] In the attached diagram:

[0043] Figure 1 : This is a schematic diagram of the overall architecture in an embodiment of the present invention;

[0044] Figure 2 This is a flowchart illustrating the overall steps in an embodiment of the present invention.

[0045] Figure 3 This is a schematic diagram illustrating the structure for obtaining candidate words and calculating sensitivity in an embodiment of the present invention.

[0046] Figure 4 This is a flowchart illustrating the steps of obtaining candidate words and calculating sensitivity in an embodiment of the present invention.

[0047] Figure 5 : This is a schematic diagram illustrating the execution structure of the layer-by-layer correlation propagation algorithm in an embodiment of the present invention;

[0048] Figure 6 : This is a schematic diagram of the Laplacian mechanism for differential privacy in this embodiment of the invention, used for text embedding and adding noise. Detailed Implementation

[0049] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0050] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0051] This invention discloses a privacy protection method for large-scale NLP language models based on differential privacy. The following will describe this disclosure in detail with reference to the accompanying drawings and embodiments.

[0052] Reference Figures 1 to 2 As shown, the present invention mainly includes the following steps:

[0053] Step 1: Perform sensitive word replacement on the original text dataset to be input into the language model, removing sensitive words in the original text dataset that are irrelevant to the classification task;

[0054] Step 2: Based on the BERT model, the MASK mechanism is combined with clustering methods to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated.

[0055] Step 3: Interpret the relevance of each dimension in the generated text embedding to the output of the downstream modeling task based on the layer-by-layer relevance propagation algorithm;

[0056] Step 4: Determine the maximum allowable privacy consumption threshold and calculate the allocated privacy budget for each dimension in the text embedding based on sensitivity and relevance;

[0057] Step 5: Add noise to the text embedding using the Laplace mechanism of differential privacy;

[0058] Step 6: Embed the text with added noise and publish it for use in downstream modeling tasks.

[0059] Specifically, this invention can be divided into three parts. The first part is to find the set of sensitive replacement words needed in the original text dataset and to calculate the sensitivity. The second part is to obtain the relevance scores of each dimension of the text embedding to the downstream output. The third part is to combine the relevance scores and the sensitivity to perform noise processing on the generated text embedding based on the differential privacy Laplacian mechanism. The perturbed text embedding can be sent to various downstream task models to complete the service.

[0060] In scenarios where NLP language models generate text embeddings for various downstream tasks, downstream service providers may be semi-honest. This is because they attempt to deduce useful information from text vectors, such as sensitive personal information like body parts, addresses, and ages. To prevent such privacy leaks, this invention uses differential privacy technology to protect the generated text embeddings, ensuring usability for downstream tasks while mitigating potential attackers' sensitive information inference attacks. Considering that sentence vectors generated by large-scale general-purpose NLP language models like BERT are often highly dimensional, directly calculating sensitivity based on adjacent sentences and adding noise would lead to excessive privacy consumption if we want to maintain high usability for downstream tasks after perturbation. This is unacceptable in practical applications. To achieve a balance between usability and security, we need to identify those dimensions in the sentence vectors that contribute more to the output of downstream tasks and selectively allocate more privacy budget to these dimensions (i.e., adding less perturbation), and vice versa.

[0061] In step 1, sensitive words are replaced in the original text dataset to be input into the language model. Sensitive word replacement can be divided into the following two cases: if the sensitive words are only related to the user's privacy and have little impact on the output of the downstream modeling task, they are replaced with other words that do not affect the semantic fluency of the sentence before the text embedding is generated by the NPL language model; if the sensitive words are related to both the user's privacy and the output of the downstream modeling task, then step 2 is used to select candidate words for the replacement word set of the sensitive words.

[0062] Specifically, for a set of alternative words to find sensitive words, simple random replacement is not feasible. For example, using all words in the dictionary as candidates would result in excessive sensitivity and require too much perturbation, leading to poor usability of the text embedding input into the downstream task model. Similarly, too few alternative words would compromise privacy protection; therefore, a comprehensive consideration of both scenarios is necessary.

[0063] If sensitive words are only related to the user's privacy and have little impact on the output of downstream modeling tasks, then it's advisable to replace them with other words that don't affect the semantic fluency of the sentences before generating text embeddings through the NLP language model, thereby eliminating the potential for privacy leaks. For example, in a collection of airline reviews, the downstream service categorizes these reviews into positive and negative categories. The sensitive words we are concerned with are mostly concentrated on private information such as the user's residential address mentioned in the reviews, rather than emotional words related to specific categories.

[0064] If sensitive words are not only related to user privacy but also to the output of downstream modeling tasks, then protection cannot be achieved through simple random replacement. For example, in a medical referral system, users upload their symptom descriptions to a local NLP language model. The generated text embeddings are then classified by a third-party medical referral server to indicate which department the user should consult. In this scenario, downstream tasks heavily rely on words related to specific body parts in the user's uploaded symptom descriptions. These words are often considered sensitive and should not be inferred by attackers through text embeddings. In such cases, the BERT model can be fine-tuned, utilizing its masking mechanism to mask the sensitive words to be protected and predicting new words to fill in the corresponding positions, thus generating several adjacent sentences. Then, clustering analysis is performed on these new sentence vectors, selecting the TOPK candidate words as replacements for the sensitive word—this is step 2.

[0065] Reference Figures 3 to 4 As shown, in step 2, the MASK mechanism based on the BERT model combined with clustering methods is used to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated. The specific steps include:

[0066] Step 2.1: Combine a subset of sensitive words from the original text dataset to form a masked text dataset.

[0067] Step 2.2, using the masked text dataset Train a sensitive word selection model;

[0068] Step 2.3: The sensitive word selection model selects sensitive words for each input sentence in the original text dataset and performs masking to obtain the masked text dataset S. m ;

[0069] Step 2.4, fine-tune the NLP language model on the masked text dataset S. m Predicting all words in the set and generating several new sentences to form a new sentence set S. p ;

[0070] Step 2.5, for the new statement set S p Perform k-medoid clustering algorithm, and then calculate the sensitivity Δf for the category of sensitive words in the original text dataset.

[0071] Specifically, a small masked text dataset was created by manually selecting words that were subjectively most likely to leak user privacy and were highly relevant to downstream modeling tasks. Then, a sensitive word selection model is trained based on this vocabulary dataset, which is highly relevant to user privacy and downstream modeling tasks. The obtained sensitive word selection model is then used to select and mask sensitive words for each input sentence in the original text dataset, resulting in a larger-scale masked text dataset S. m Next, we fine-tuned an NLP language model on the masked text dataset S. m Predict a set of candidate words for each masked word, and simultaneously generate several new sentences to form a new sentence set S. p .

[0072] Furthermore, in step 2.5, for the new statement set S p Perform k-medoid clustering algorithm, and then calculate the sensitivity Δf for the category of sensitive words in the original text dataset. The specific steps include the following:

[0073] Step 2.5.1, for the new statement set S p The sentence vectors are subjected to k-medoid clustering algorithm to make sensitive words in the original text dataset indistinguishable to attackers in their corresponding categories;

[0074] Step 2.5.2: Calculate the sensitivity of each dimension in the text embedding generated by the NLP language model from the input sentences in the original text dataset, as well as the upper and lower limits of sensitivity within the range of replaceable words.

[0075] Reference Figure 5As shown, in step 3, the relevance of each dimension of the text embedding to the output of the downstream modeling task is generated according to the layer-wise relevance propagation algorithm. Specifically, the layer-wise relevance propagation algorithm is also known as the LRP algorithm. The LRP algorithm is a technique that incorporates interpretability into deep learning neural networks, identifying which pixels in the input are more important to the output by performing backpropagation in the neural network. Therefore, in this invention, we use the LRP algorithm to analyze which dimensions in the text embedding generated by a large-scale NLP general language model contribute significantly to the output of the downstream task. Figure 5 This demonstrates the main idea of ​​the LRP algorithm. The propagation process implemented by the LRP algorithm follows the conservation property, meaning that the neurons receiving data must be redistributed to lower layers in equal numbers. This satisfies f(x) = ... = ∑ k R k =∑ j R j =…=∑1R1, where R j The ∑ represents the degree of contribution of neuron j to the model output, which is the correlation score. j R is the sum of all neurons in layer j. k R1 represents the relevance score of neuron j to the model output, while R1 represents the relevance score of the first neuron to the model output.

[0076] If z jk This represents the product of neuron j and the weight between neuron j and neuron k, i.e., z. jk =x j w jk Therefore, the vector of neuron k can be represented as the z-axis of all neurons in the previous layer leading to neuron k. jk The sum (i.e. ∑ j z jk Adding a bias, i.e., z k =∑ j z jk +b j After processing by the activation function g, the next layer neuron x is obtained. k , that is, x k =g(z) k Since backpropagation follows the conservation property, the propagation process terminates after reaching the input node. Therefore, we can obtain the relevance score of each dimension of the input to the downstream task output, denoted as...

[0077]

[0078] Among them, z jk The product of neuron j and the weight between neuron j and neuron k, ∑ j R is the sum of all neurons in layer j.k Let ∑ be the relevance score of neuron k to the model output. k R is the sum of all neurons in layer k. j denoted as the relevance score of neuron j to the model output.

[0079] Through steps 2 and 3, we can obtain the sensitivity and relevance of each dimension of the text embedding. However, since the LRP algorithm requires knowledge of the output result f(x) of the downstream task, and considering the practical application scenario where the output result cannot be obtained in advance before inputting into the downstream task model, a regression model is trained based on the LRP algorithm and downstream modeling to predict the relevance score based on the text embedding.

[0080] Consider the Laplace cumulative distribution function Where μ is the location parameter and λ>0 is the scale parameter. Now, assuming μ is a true value c, and noise n = ±wc is added, where w>0 is the ratio parameter, then the probability of the actual value falls within the Laplace distribution interval [c–wc, c+wc], and P is the specified confidence level. We can then derive...

[0081]

[0082] For the Laplace distribution mechanism Lap(μ, λ), the sensitivity Δf and privacy budget ∈ must satisfy the relationship Δf = λ ∈. However, to ensure data availability, we want the added noise to have an expected value of 0, meaning the actual noise conforms to... Combining the above formula, we can derive the formula for calculating the allocatable privacy budget as follows:

[0083]

[0084] The noise interval wc is adjusted based on the correlation score and sensitivity, and it is necessary to determine the maximum privacy consumption threshold ∈ [missing information]. max Under the premise of maximizing the usability of text embedding, a non-linear relation is proposed, in which a simple representation is as follows:

[0085]

[0086] The values ​​of coefficients a and b can be fixed by plotting the relationship curve between model evaluation metrics such as AUC and a and b, selecting a and b that maximize the AUC. For the correlation score R, a larger R value indicates a greater contribution of that dimension to the model output. To ensure usability, less perturbation should be added, i.e., the narrower the noise interval wc, the larger ∈. For the sensitivity Δf, it reflects the maximum change in model output caused by changing that dimension, and in the relational expression, it mainly plays a role in further adjusting two dimensions with close correlation. Of these two, the correlation score R should play a dominant role in shrinking the noise interval wc, while simultaneously fine-tuning it through Δf.

[0087] It should be noted that the representation of this nonlinear relationship is not fixed and should be adjusted for different application scenarios. For example, when the relationship curve between the model evaluation index and a and b changes relatively smoothly, R or Δf in the relationship can be raised to an exponent, such as R0. 1.5 Once the form of this nonlinear relationship is determined, the size of the privacy budget that can be allocated to each dimension of the sentence vector can be obtained through the calculation formula of the allocable privacy budget ∈.

[0088] After determining the allocatable privacy budget for each dimension, a differential privacy-based Laplace mechanism is used to add noise to the sentence vector, specifically for each dimension of the sentence vector. Noise conforming to a Laplace distribution is added, satisfying the following condition: Where Δf represents sensitivity, ∈ represents the allocable privacy budget, and λ>0 represents the scale parameter. The noisy text embedding is then published for use in downstream modeling tasks.

[0089] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A privacy protection method for large-scale NLP language models based on differential privacy, characterized in that, Includes the following steps: Step 1: Perform sensitive word replacement on the original text dataset to be input into the language model, removing sensitive words in the original text dataset that are irrelevant to the classification task; Step 2: Based on the BERT model, the Mask mechanism is combined with clustering methods to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated. Step 3: Generate the correlation between each dimension of the text embedding and the output of the downstream modeling task according to the layer-by-layer correlation propagation algorithm; Step 4: Determine the maximum allowable privacy consumption threshold and calculate the allocatable privacy budget for each dimension of the text embedding based on sensitivity and relevance; Step 5: Add noise to the text embedding using the Laplace mechanism of differential privacy; Step 6: Publish the text embedding with added noise for use in downstream modeling tasks. The formula for calculating the allocatable privacy budget in step 4 is expressed as follows: = in, To specify the confidence level, Noise range For sensitivity; The noise interval used in the calculation of the allocatable privacy budget The adjustment is made based on the correlation score and sensitivity, while the noise interval... It can be represented as, = + b in, The correlation score is... The sensitivity mentioned above; In step 5, the Laplace mechanism is used to add noise to the text embedding, adding noise conforming to a Laplace distribution for each dimension of the sentence vector. The added noise must satisfy the following conditions: = in, For sensitivity, For the allocated privacy budget, This is the scale parameter.

2. The privacy protection method for large-scale NLP language models based on differential privacy according to claim 1, characterized in that: In step 1, sensitive word replacement is performed on the original text dataset to be input into the language model. The sensitive word replacement can be divided into the following two cases: If the sensitive words are only related to the user's privacy and have little impact on the output of the downstream modeling task, they are replaced with other words that do not affect the semantic fluency of the sentence before the text embedding is generated by the NLP language model; if the sensitive words are related to both the user's privacy and the output of the downstream modeling task, then step 2 is used to select the candidate words to replace the sensitive words in the replacement word set.

3. The privacy protection method for large-scale NLP language models based on differential privacy according to claim 2, characterized in that, In step 2, the MASK mechanism based on the BERT model, combined with clustering methods, is used to obtain candidate words for sensitive words that need to be replaced, and the sensitivity of each dimension in the text embedding generated by the NLP language model is calculated. The specific steps include: Step 2.1: Combine a subset of sensitive words from the original text dataset to form a masked text dataset. ; Step 2.2, using the masked text dataset Train a sensitive word selection model; Step 2.3: The sensitive word selection model selects sensitive words for each input sentence in the original text dataset and performs masking processing to obtain the masked text dataset. ; Step 2.4: Fine-tune the NLP language model for the masked text dataset. Predicting all words in the dataset and generating several new sentences to form a new sentence set. ; Step 2.5, for the new statement set Perform k-medoid clustering algorithm, and then calculate the sensitivity for the categories of sensitive words in the original text dataset. .

4. The privacy protection method for large-scale NLP language models based on differential privacy according to claim 3, characterized in that, In step 2.5, for the new statement set Perform k-medoid clustering algorithm, and then calculate the sensitivity for the categories of sensitive words in the original text dataset. Specifically, it includes the following steps: Step 2.5.1, for the new statement set The sentence vectors are subjected to k-medoid clustering algorithm to make sensitive words in the original text dataset indistinguishable to attackers in their corresponding categories. Step 2.5.2: Calculate the sensitivity of each dimension in the text embedding generated by the NLP language model from the input statement in the original text dataset, as well as the upper and lower limits of sensitivity within the range of replaceable words.

5. A privacy protection method for large-scale NLP language models based on differential privacy according to claim 3, characterized in that: In step 3, the relevance of each dimension in the text embedding to the output of the downstream modeling task is interpreted and generated according to the layer-by-layer relevance propagation algorithm. Based on the backpropagation rule of the layer-by-layer relevance propagation algorithm, the propagation process terminates after reaching the input node in the reverse direction. Therefore, the relevance score of each dimension in the input to the output of the downstream task can be obtained, expressed as follows: = in, This is the product of neuron j and the weight between neuron j and neuron k. The sum of all neurons in layer j. denoted as the relevance score of neuron k to the model output.

Images