Model training method, information processing method and system, server and storage medium

Abstract

The present disclosure provides a model training method, an information processing method and system, a server and a storage medium. The model training method includes: obtaining a first sample feature of a first sample data; decomposing the first sample feature into a first sub-feature and a second sub-feature, and sending the second sub-feature to a client; performing security calculations with the client in a preset encryption space according to the first sub-feature, a third sub-feature sent by the client and a first linear layer parameter of a linear transformation module in a machine learning model with a self-attention mechanism to obtain security information, wherein the machine learning model is part of a large language model; inputting the security information into a self-attention module in the machine learning model, and converting a target feature output by the machine learning model into a target text; training the linear transformation module according to the target text and the annotation information of the first sample data.

Description

Technical Field

[0001] The present disclosure relates to the field of large language models, and in particular to a model training method, an information processing method and system, a server, and a storage medium. Background Art

[0002] A large language model (LLM) is a deep learning model trained using large amounts of text data. It can generate natural language text or understand the meaning of text. LLMs can handle a variety of natural language tasks, such as text classification, question answering, and conversation.

[0003] Currently, there are two main deployment options for large language models: 1) Deploy the large language model on the model provider side, and the application side (i.e., the customer) uploads questions and related data to the provider. 2) Deploy the large language model on the application side. Summary of the Invention

[0004] The inventors noted that in related technologies, if a large language model is deployed on the model provider, this solution can effectively protect the model provider's model intellectual property (IP), but this can lead to the leakage of application data to the model provider. If a large language model is deployed on the application side, this solution can effectively protect the application's data from being leaked, but the model provider's model IP cannot be protected.

[0005] Accordingly, the present disclosure provides a model training method, which utilizes the server and client of the model provider to jointly train the linear layer in a machine learning model with a self-attention mechanism, so that the server and the client only have partial information about the parameters of the linear layer. Then, the server and the client use the partial information of the linear layer parameters to perform secure calculations based on the self-attention module in an encrypted space, and the server uses the obtained security information to perform subsequent model calculations, thereby ensuring that when a large language model is deployed on the model provider, while effectively protecting the model intellectual property rights of the model provider, it can also effectively avoid the problem of data leakage on the application side. At the same time, the calculation rate is high and can be used in real application scenarios.

[0006] According to a first aspect of an embodiment of the present disclosure, a model training method is provided, which is executed by a server and includes: obtaining a first sample feature of first sample data; decomposing the above-mentioned first sample feature into a first sub-feature and a second sub-feature, and sending the above-mentioned second sub-feature to a client; performing a secure calculation with the above-mentioned client in a preset encryption space based on the above-mentioned first sub-feature, a third sub-feature sent by the above-mentioned client and a first linear layer parameter of a linear transformation module in a machine learning model with a self-attention mechanism to obtain security information, wherein the above-mentioned machine learning model is part of a large language model; inputting the above-mentioned security information into the self-attention module in the above-mentioned machine learning model, and converting the target feature output by the above-mentioned machine learning model into a target text; and training the above-mentioned linear transformation module based on the above-mentioned target text and the annotation information of the above-mentioned first sample data.

[0007] In some embodiments, performing secure computation with the client in an encrypted space includes: performing secure two-party computation with the client based on the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of security information; and obtaining the security information based on the first component of the security information and the second component of the security information sent by the client.

[0008] In some embodiments, performing secure two-party computation with the client includes: combining the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a multiplication triplet; using the first linear layer parameter as a first component of a second parameter in the multiplication triplet; performing secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the multiplication triplet; and using the first component of the third parameter as a first component of the security information.

[0009] In some embodiments, obtaining the security information according to the first component of the security information and the second component of the security information sent by the client includes: combining the first component of the security information and the second component of the security information to obtain the security information.

[0010] In some embodiments, training the linear transformation module according to the annotation information of the target text and the first sample data includes: determining a loss function according to the annotation information of the target text and the first sample data; and training the linear transformation module according to the descending gradient of the loss function.

[0011] In some embodiments, the large language model also includes multiple other machine learning models with self-attention mechanisms cascaded with the above-mentioned machine learning model. The above-mentioned conversion of the target features output by the above-mentioned machine learning model into the target text includes: inputting the target features output by the above-mentioned machine learning model into the first other machine learning model cascaded with the above-mentioned machine learning model, and inputting the output of the above-mentioned first other machine learning model into the next other machine learning model cascaded with the above-mentioned first other machine learning model, so as to obtain the features to be processed output by the last other machine learning model among the multiple other machine learning models; converting the above-mentioned features to be processed into the above-mentioned target text.

[0012] According to a second aspect of an embodiment of the present disclosure, a server is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute a method as described in any of the above embodiments based on instructions stored in the memory.

[0013] According to a third aspect of an embodiment of the present disclosure, a model training system is provided, comprising: a server as described in any of the above embodiments; and a client, configured to obtain a second sample feature of second sample data, decompose the second sample feature into a third sub-feature and a fourth sub-feature, and send the third sub-feature to the server, and perform secure calculations with the server in an encrypted space based on the fourth sub-feature, the second sub-feature sent by the server, and the second linear layer parameters of the linear transformation module in the machine learning model.

[0014] In some embodiments, the client is configured to perform a secure two-party computation with the server based on the fourth sub-feature, the second sub-feature, and the second linear layer parameter to obtain a second component of the security information, and send the second component of the security information to the server.

[0015] In some embodiments, the client is configured to combine the fourth sub-feature and the second sub-feature to obtain the second component of the first parameter in the multiplication triplet, use the second linear layer parameter as the second component of the second parameter in the multiplication triplet, perform a secure two-party computation with the server based on the second component of the first parameter and the second component of the second parameter to obtain the second component of the third parameter in the multiplication triplet, and use the second component of the third parameter as the second component of the security information.

[0016] According to a fourth aspect of an embodiment of the present disclosure, there is provided an information processing method, which is executed by a server and includes: obtaining first knowledge information corresponding to user query information from a first knowledge base; obtaining a first embedding feature of the above-mentioned first knowledge information; decomposing the above-mentioned first embedding feature into a first sub-feature and a second sub-feature, and sending the above-mentioned second sub-feature to a client; performing a secure calculation with the above-mentioned client in a first encryption space based on the above-mentioned first sub-feature, the third sub-feature sent by the above-mentioned client and the first linear layer parameter of the linear transformation module in the machine learning model with a self-attention mechanism to obtain a first component of the first security information, wherein the above-mentioned machine learning model is part of a large language model; performing a secure calculation with the above-mentioned client in a second encryption space based on the above-mentioned first component of the first security to obtain second security information; inputting the above-mentioned second security information into the self-attention module in the above-mentioned machine learning model so that the above-mentioned machine learning model outputs a target feature; and converting the above-mentioned target feature into a target text.

[0017] In some embodiments, performing secure calculations with the client in the first encryption space includes: performing a first secure two-party calculation with the client based on the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of the first security information.

[0018] In some embodiments, performing a first secure two-party computation with the client includes: combining the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a first multiplication triplet; using the first linear layer parameter as a first component of a second parameter in the first multiplication triplet; performing a first secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the first multiplication triplet; and using the first component of the third parameter as a first component of the first security information.

[0019] In some embodiments, performing secure calculations with the client in the second encryption space includes: performing a second secure two-party calculation with the client using the first self-attention parameter and the second self-attention parameter included in the first component of the first security information to obtain first intermediate information; normalizing the first intermediate information to obtain second intermediate information; decomposing the second intermediate information into a first intermediate component and a second intermediate component, and sending the second intermediate component to the client; performing a third secure two-party calculation with the client using the first intermediate component and the third attention parameter included in the first component of the first security information to obtain the second security information.

[0020] In some embodiments, performing a second secure two-party calculation with the client includes: using the first self-attention parameter as the first component of the first parameter in the second multiplication triplet; using the second self-attention parameter as the first component of the second parameter in the second multiplication triplet; performing a second secure two-party calculation with the client based on the first component of the first parameter and the first component of the second parameter to obtain the first component of the third parameter in the second multiplication triplet; using the first component of the third parameter as the first component of the first intermediate information; obtaining the first intermediate information based on the first component of the first intermediate information and the second component of the first intermediate information sent by the client.

[0021] In some embodiments, obtaining the first intermediate information includes: combining the first component of the first intermediate information and the second component of the first intermediate information to obtain the first intermediate information.

[0022] In some embodiments, performing a third secure two-party calculation with the client includes: using the first intermediate component as the first component of the first parameter in the third multiplication triplet; using the third attention parameter as the first component of the second parameter in the third multiplication triplet; performing a third secure two-party calculation with the client based on the first component of the first parameter and the first component of the second parameter to obtain the first component of the third parameter in the third multiplication triplet; using the first component of the third parameter as the first component of the second security information; obtaining the second security information based on the first component of the second security information and the second component of the second security information sent by the client.

[0023] In some embodiments, obtaining the second security information includes: combining the first component of the second security information and the second component of the second security information to obtain the second security information.

[0024] In some embodiments, the large language model also includes multiple other machine learning models with self-attention mechanisms cascaded with the above-mentioned machine learning model, and converting the above-mentioned target features into target text includes: inputting the above-mentioned target features into the first other machine learning model cascaded with the above-mentioned machine learning model, and inputting the output of the above-mentioned first other machine learning model into the next other machine learning model cascaded with the above-mentioned first other machine learning model, so as to obtain the features to be processed output by the last other machine learning model among the multiple other machine learning models; converting the above-mentioned features to be processed into the above-mentioned target text.

[0025] In some embodiments, the first linear layer parameters are obtained by training using the model training method described in any of the above embodiments.

[0026] According to a fifth aspect of an embodiment of the present disclosure, a server is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute a method as described in any of the above embodiments based on instructions stored in the memory.

[0027] According to a sixth aspect of an embodiment of the present disclosure, an information processing system is provided, comprising: a server as involved in any of the above embodiments; a client, configured to obtain second knowledge information corresponding to user query information from a second knowledge base, obtain a second embedding feature of the above second knowledge information, decompose the above second embedding feature into a third sub-feature and a fourth sub-feature, and send the above third sub-feature to the above server, perform secure calculation with the above server in a first encryption space based on the above fourth sub-feature, the second sub-feature sent by the above server and the second linear layer parameter of the linear transformation module in the machine learning model to obtain a second component of the first security information, and perform secure calculation with the above server in a second encryption space based on the above first secure second component.

[0028] In some embodiments, the client is configured to perform a first secure two-party computation with the server based on the fourth sub-feature, the second sub-feature, and the second linear layer parameter to obtain the second component of the first security information.

[0029] In some embodiments, the client is configured to combine the fourth sub-feature and the second sub-feature to obtain the second component of the first parameter in the first multiplication triplet, use the second linear layer parameter as the second component of the second parameter in the first multiplication triplet, perform the first secure two-party calculation with the server based on the second component of the first parameter and the second component of the second parameter to obtain the second component of the third parameter in the first multiplication triplet, and use the second component of the third parameter as the second component of the first security information.

[0030] In some embodiments, the above-mentioned client is configured to use the fourth self-attention parameter and the fifth self-attention parameter included in the second component of the above-mentioned first security information to perform a second secure two-party calculation with the above-mentioned server to obtain the second component of the first intermediate information, and send the second component of the above-mentioned first intermediate information to the above-mentioned server, and use the second intermediate component sent by the above-mentioned server and the sixth attention parameter included in the second component of the above-mentioned first security information to perform a third secure two-party calculation with the above-mentioned server.

[0031] In some embodiments, the above-mentioned client is configured to use the above-mentioned fourth self-attention parameter as the second component of the first parameter in the second multiplication triplet, and use the above-mentioned fifth self-attention parameter as the second component of the second parameter in the above-mentioned second multiplication triplet, perform the above-mentioned second secure two-party calculation with the above-mentioned server based on the second component of the above-mentioned first parameter and the second component of the above-mentioned second parameter, obtain the second component of the third parameter in the above-mentioned second multiplication triplet, and use the second component of the above-mentioned third parameter as the second component of the above-mentioned first intermediate information.

[0032] In some embodiments, the above-mentioned client is configured to use the above-mentioned second intermediate component as the second component of the first parameter in the third multiplication triplet, and use the above-mentioned sixth attention parameter as the second component of the second parameter in the above-mentioned third multiplication triplet, perform the above-mentioned third secure two-party calculation with the above-mentioned server based on the second component of the above-mentioned first parameter and the second component of the above-mentioned second parameter, obtain the second component of the third parameter in the above-mentioned third multiplication triplet, use the second component of the above-mentioned third parameter as the second component of the above-mentioned second security information, and send the second component of the above-mentioned second security information to the above-mentioned server.

[0033] According to a seventh aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the method involved in any of the above embodiments is implemented.

[0034] According to an eighth aspect of the embodiments of the present disclosure, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, the method involved in any of the above embodiments is implemented.

[0035] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] Figure 1 This is a schematic diagram of the architecture of a large language model in the prior art;

[0038] Figure 2 Schematic diagram of the structure of the Transformer block in the prior art;

[0039] Figure 3A flowchart of a model training method according to an embodiment of the present disclosure;

[0040] Figure 4 This is a schematic diagram of the structure of a server according to an embodiment of the present disclosure;

[0041] Figure 5 This is a schematic diagram of the structure of a model training system according to an embodiment of the present disclosure;

[0042] Figure 6 A flowchart of a model training method according to another embodiment of the present disclosure;

[0043] Figure 7 A flowchart of an information processing method according to an embodiment of the present disclosure;

[0044] Figure 8 This is a schematic structural diagram of a server according to another embodiment of the present disclosure;

[0045] Figure 9 This is a schematic diagram of the structure of an information processing system according to an embodiment of the present disclosure;

[0046] Figure 10 This is a schematic structural diagram of an information processing system according to another embodiment of the present disclosure;

[0047] Figure 11 A flowchart of an information processing method according to another embodiment of the present disclosure;

[0048] Figure 12 A schematic diagram of matrix multiplication according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is in no way intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0050] Unless specifically stated otherwise, the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure.

[0051] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0052] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0053] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0054] It should be noted that like reference numerals and letters refer to like items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0055] Figure 1 This is a schematic diagram of the architecture of a large language model in the prior art. Figure 1 As shown, the large language model performs the following calculations based on the sentence input by the user:

[0056] 1) Through the token embedding layer, each word of the input sentence is converted into a corresponding token vector.

[0057] 2) Through the positional embeddings layer, the position of each word in the input sentence is converted into a position vector.

[0058] 3) After fusing the identification vector and the position vector, input them into the Transformer model. The Transformer model includes at least one Transformer block. For example, Figure 1 As shown in Figure 1, the Transformer model includes n+1 cascaded Transformer blocks.

[0059] Figure 2 This is a schematic diagram of the structure of the Transformer block in the prior art. Figure 2 As shown, the Transformer block includes Figure 2 The linear operations shown on the left and Figure 2 The non-linear operations section is shown on the right.

[0060] The linear operation part includes the layer normalization layer, the linear layer, and the self-attention (Attention) module. The attention module includes the matrix multiplication (Matmul) layer, the softmax layer, and the matrix multiplication layer. The nonlinear operation part includes the layer normalization layer and the feed forward neural network (FFN) module. The FFN module includes the linear layer, the Gaussian error linear unit (GeLu) layer, and the linear layer.

[0061] 4) The Linear layer performs a linear transformation on the output of the nth Transformer block (i.e., TransformerBlock-n) in the Transformer model.

[0062] 5) The Softmax layer processes the output of the Linear layer.

[0063] 6) Convert the output of step 5) into a corresponding word and output the word.

[0064] Repeat the above process to obtain the generated sentence.

[0065] Currently, large language models are being applied in fields such as recommendation systems, medical question-answering, and financial forecasting. However, these fields all involve sensitive personal information or private corporate data to a certain extent, and the application of large language models may lead to the leakage of user data.

[0066] In related technologies, there are mainly two deployment methods:

[0067] 1) Deploy the large language model on the model provider. This solution can effectively protect the model provider's model intellectual property rights, but it may cause the application's data to be leaked to the model provider.

[0068] 2) Deploy the large language model on the application side. This solution can effectively protect the application side's data from being leaked, but the model provider's model intellectual property rights cannot be guaranteed.

[0069] In order to protect the intellectual property rights of the model while effectively preventing the leakage of user sensitive information, relevant security solutions are adopted in the existing technology. The inventors have noticed that the existing solutions have the following shortcomings:

[0070] 1) The model owner’s intellectual property rights are not protected because in this case, users can simply run the model with the missing head and get the corresponding results at the cost of some accuracy, or get the corresponding results by training on the missing part.

[0071] 2) All related calculations are completed in an encrypted state, and the client finally decrypts the answer. Since the entire ciphertext calculation process is very time-consuming, these solutions are time-consuming and unsuitable for real-world application scenarios.

[0072] Accordingly, the present disclosure provides a model training method, which utilizes the server and client of the model provider to jointly train the linear layer in a machine learning model with a self-attention mechanism, so that the server and the client only have partial information about the parameters of the linear layer. Then, the server and the client use the partial information about the linear layer parameters to perform secure calculations based on the self-attention module in an encrypted space, and the server uses the obtained security information to perform subsequent model calculations, thereby ensuring that when a large language model is deployed on the model provider, while effectively protecting the model intellectual property rights of the model provider, it can also effectively avoid the problem of data leakage on the application side. At the same time, the calculation rate is high and can be used in real application scenarios.

[0073] Figure 3 Schematic diagram of a flow chart of a model training method according to an embodiment of the present disclosure. In some embodiments, the following model training method is executed by a server, including steps 31-35.

[0074] In step 31 , a first sample feature of first sample data is obtained.

[0075] For example, an embedding layer is used to obtain a first sample feature of the first sample data.

[0076] In step 32, the first sample feature is decomposed into a first sub-feature and a second sub-feature, and the second sub-feature is sent to the client.

[0077] It should be noted here that the client obtains the second sample feature of the second sample data, decomposes the second sample feature into a third sub-feature and a fourth sub-feature, and sends the third sub-feature to the server. Based on the fourth sub-feature, the second sub-feature sent by the server and the second linear layer parameter of the linear transformation module in the machine learning model, the client performs secure calculations with the server in the encrypted space.

[0078] In step 33, based on the first sub-feature, the third sub-feature sent by the client, and the first linear layer parameter of the linear transformation module in the machine learning model with the self-attention mechanism, a secure calculation is performed with the client in a preset encryption space to obtain security information.

[0079] It should be noted here that the above machine learning model is part of a large language model.

[0080] For example, the machine learning model is Figure 2 The Transformer Block-0 shown in the figure has a linear transformation module, which is the Linear layer in the linear operation part of Transformer Block-0.

[0081] In some embodiments, the above step 33 includes the following steps:

[0082] 1) Perform secure two-party computation with the client based on the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of the security information.

[0083] In some embodiments, performing secure two-party computation with a client includes:

[0084] a) Combining the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a Beaver triple.

[0085] b) The first linear layer parameter is used as the first component of the second parameter in the multiplication triplet.

[0086] c) Performing a secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain a first component of the third parameter in the multiplication triplet.

[0087] d) Using the first component of the third parameter as the first component of the security information.

[0088] 2) Obtain security information according to the first component of the security information and the second component of the security information sent by the client.

[0089] In some embodiments, the first component of the security information and the second component of the security information are combined to obtain the security information.

[0090] For example, the first component of the security information and the second component of the security information are concatenated to obtain the security information.

[0091] In step 34, the security information is input into the self-attention module in the machine learning model, and the target features output by the machine learning model are converted into target text.

[0092] It should be noted here that if Figure 2 As shown in Figure 2, the output information of the Linear layer is input into the Attention module, so that the Transformer block outputs the corresponding target features.

[0093] In some embodiments, the large language model further includes multiple other machine learning models with self-attention mechanisms cascaded with the above-mentioned machine learning model. Converting the target features output by the machine learning model into the target text includes: inputting the target features into the first other machine learning model cascaded with the machine learning model, and inputting the output of the first other machine learning model into the next other machine learning model cascaded with the first other machine learning model, so as to obtain the features to be processed output by the last other machine learning model in the multiple other machine learning models, and converting the features to be processed into the target text.

[0094] In step 35, a linear transformation module is trained based on the target text and the annotation information of the first sample data.

[0095] In some embodiments, a loss function is determined based on the target text and the annotation information of the first sample data, and a linear transformation module is trained based on the descending gradient of the loss function.

[0096] That is, by training the linear layer model, the trained first linear layer parameters are obtained.

[0097] In the model training method provided in the above-mentioned embodiment of the present disclosure, the linear layer in the machine learning model with the self-attention mechanism is jointly trained by the server and client of the model provider, so that the server and the client only have partial information about the parameters of the linear layer, and then the server and the client use the partial information of the linear layer parameters to perform secure calculations based on the self-attention module in the encrypted space, and the server uses the obtained security information to perform subsequent model calculations, thereby ensuring that when the large language model is deployed on the model provider, while effectively protecting the model intellectual property rights of the model provider, it can also effectively avoid the problem of data leakage of the application party, and at the same time, the calculation rate is high, and it can be used in real application scenarios.

[0098] Figure 4 A schematic diagram of the structure of a server according to an embodiment of the present disclosure.

[0099] like Figure 4 As shown, the server 40 is in the form of a general-purpose computing device. The server 40 includes a memory 41, a processor 42, and a bus 46 connecting different system components.

[0100] The memory 41 may include, for example, a system memory, a non-volatile storage medium, and the like. The system memory may store, for example, an operating system, an application, a boot loader, and other programs. The system memory may include a volatile storage medium, such as a random access memory (RAM) and / or a cache memory. The non-volatile storage medium may store, for example, instructions for the corresponding embodiment of at least one model training method being executed. The non-volatile storage medium includes, but is not limited to, a disk memory, an optical memory, a flash memory, and the like.

[0101] The processor 42 may be implemented as a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, or as discrete hardware components such as discrete gates or transistors. Accordingly, each module, such as the acquisition module, the calculation module, and the adjustment module, may be implemented by a central processing unit (CPU) executing instructions in a memory that execute corresponding steps, or by dedicated circuits that execute corresponding steps.

[0102] For example, the processor 42 is configured to execute instructions stored in the memory to implement the following Figure 3 The method according to any one of the embodiments.

[0103] The bus 46 may use any of a variety of bus architectures, including, but not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, and a Peripheral Component Interconnect (PCI) bus.

[0104] These interfaces 43, 44, and 45 of server 40, as well as memory 41 and processor 42, can be connected via bus 46. Input / output interface 43 provides a connection interface for input / output devices such as a display, mouse, and keyboard. Network interface 44 provides a connection interface for various networked devices. Storage interface 45 provides a connection interface for external storage devices such as floppy disks, USB flash drives, and SD cards.

[0105] Here, various aspects of the present disclosure are described with reference to flowcharts and / or block diagrams of methods, devices, and computer program products according to embodiments of the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks, can be implemented by computer-readable program instructions.

[0106] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable device to produce a machine, so that the processor executes the instructions to produce means for implementing the functions specified in one or more blocks in the flowcharts and / or block diagrams.

[0107] These computer-readable program instructions may also be stored in a computer-readable memory, which cause the computer to operate in a specific manner to produce an article of manufacture, including instructions for implementing the functions specified in one or more blocks in the flowcharts and / or block diagrams.

[0108] The present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.

[0109] The present disclosure also provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the following Figure 3 The method according to any one of the embodiments.

[0110] The present disclosure also provides a computer program product, including computer instructions, wherein when the computer instructions are executed by a processor, the following is achieved: Figure 3 The method according to any one of the embodiments.

[0111] Figure 5 This is a schematic diagram of the structure of a model training system according to an embodiment of the present disclosure. Figure 5 As shown, the model training system includes a server 51 and a client 52. The server 51 is Figure 4 The server involved in any embodiment.

[0112] The client 52 is configured to obtain the second sample feature of the second sample data, decompose the second sample feature into a third sub-feature and a fourth sub-feature, and send the third sub-feature to the server 51, and perform secure calculations with the server 51 in an encrypted space based on the fourth sub-feature, the second sub-feature sent by the server 51, and the second linear layer parameters of the linear transformation module in the machine learning model.

[0113] For example, the machine learning model is Figure 2 The Transformer Block-0 shown in the figure has a linear transformation module, which is the Linear layer in the linear operation part of Transformer Block-0.

[0114] In some embodiments, the client 52 is configured to perform a secure two-party calculation with the server based on the fourth sub-feature, the second sub-feature and the second linear layer parameter to obtain a second component of the security information, and send the second component of the security information to the server 51.

[0115] In some embodiments, the client 52 is configured to combine the fourth sub-feature and the second sub-feature to obtain the second component of the first parameter in the multiplication triplet, use the second linear layer parameter as the second component of the second parameter in the multiplication triplet, perform a secure two-party computation with the server 51 based on the second component of the first parameter and the second component of the second parameter to obtain the second component of the third parameter in the multiplication triplet, and use the second component of the third parameter as the second component of the security information.

[0116] For example, the client 52 is configured to concatenate the fourth sub-feature and the second sub-feature to obtain the second component of the first parameter in the multiplication triplet.

[0117] Figure 6 This is a flow chart of a model training method according to another embodiment of the present disclosure. This embodiment describes a process in which a server and a client jointly train the first linear layer parameter W1 of a linear transformation module in a machine learning model.

[0118] In step 60a, the first linear layer parameter W1 of the linear transformation module in the machine learning model is set on the server side.

[0119] In step 60b, the second linear layer parameter W2 of the linear transformation module in the machine learning model is set on the client side.

[0120] For example, the machine learning model is Figure 2 The Transformer Block-0 shown in the figure has a linear transformation module, which is the Linear layer in the linear operation part of Transformer Block-0.

[0121] In step 61a, the server obtains the first sample feature E1 of the first sample data.

[0122] In step 61b, the client obtains the second sample feature E2 of the second sample data.

[0123] In step 62a, the server decomposes the first sample feature E1 into a first sub-feature E11 and a second sub-feature E12, that is, E1=E11+E12.

[0124] In step 62b, the client decomposes the second sample feature E2 into a third sub-feature E21 and a fourth sub-feature E22, that is, E2=E21+22.

[0125] In step 63a, the server sends the second sub-feature E12 to the client.

[0126] In step 63b, the client sends the third sub-feature E21 to the server.

[0127] In step 64a, the server concatenates the first sub-feature E11 and the third sub-feature E21 to obtain a first component SE1 of the first parameter SE in the multiplication triple. For example, the server concatenates the first sub-feature E11 and the third sub-feature E21 up and down to obtain the first component SE1.

[0128] In step 64b, the client concatenates the fourth sub-feature E22 and the second sub-feature E12 to obtain the second component SE2 of the first parameter SE in the multiplication triple. For example, the fourth sub-feature E22 and the second sub-feature E12 are concatenated vertically to obtain the second component SE2.

[0129] In step 65a, the server uses the first linear layer parameter W1 as the first component of the second parameter W in the multiplication triplet, performs a secure two-party calculation with the client based on the first component SE1 of the first parameter and the first component W1 of the second parameter, and obtains the first component EW1 of the third parameter EW in the multiplication triplet, which is used as the first component of the security information.

[0130] In step 65b, the client uses the second linear layer parameter W2 as the second component of the second parameter W in the multiplication triplet, and performs a secure two-party calculation with the server based on the second component SE2 of the first parameter and the second component W2 of the second parameter to obtain the second component EW2 of the third parameter EW in the multiplication triplet, and uses it as the second component of the security information.

[0131] It should be noted that the three parameters in the multiplication triple are SE, W, and EW. The server has the first component SE1 of the first parameter SE and the first component W1 of the second parameter W, and the client has the second component SE2 of the first parameter SE and the second component W2 of the second parameter W. The multiplication corresponding to the multiplication triple is shown in formula (1).

[0132] (SE1+SE2)(W1+W2)=(EW1+EW2) (1)

[0133] Based on secure two-party computation between the server and the client, the server obtains a first component EW1 of the third parameter EW in the multiplication triplet, and the client obtains a second component EW2 of the third parameter EW in the multiplication triplet.

[0134] In step 66 , the client sends the second component EW2 of the security information to the server.

[0135] In step 67, the server concatenates the first component EW1 of the security information and the second component EW2 of the security information to obtain the security information EW. For example, the server concatenates the first component EW1 and the second component EW2 vertically to obtain the security information EW.

[0136] In step 68, the server inputs the security information EW into subsequent modules, such as Figure 2 The Attention module in the linear operation part of TransformerBlock-0 is shown to obtain the output result of the large language model.

[0137] In step 69, the output result of the large language model is used to train the first linear layer parameter W1 of the linear transformation module.

[0138] It should be noted that the linear transformation module's parameters W consist of two parts: the first linear layer parameters W1 held by the server and the second linear layer parameters W2 held by the client. Therefore, the above process integrates client and server knowledge into the linear transformation module's parameters W, thereby improving the large language model's inference accuracy for both server- and client-side data. Furthermore, neither the server nor the client can understand the complete contents of the parameters W, effectively enhancing the security of the large language model.

[0139] Figure 7 Schematic diagram of the information processing method according to an embodiment of the present disclosure. In some embodiments, the following information processing method is executed by a server and includes steps 71-77.

[0140] In step 71, first knowledge information corresponding to user query information is acquired from a first knowledge base.

[0141] In step 72, a first embedded feature of the first knowledge information is obtained.

[0142] For example, an embedding layer is used to obtain a first embedding feature of the first knowledge information.

[0143] In step 73 , the first embedded feature is decomposed into a first sub-feature and a second sub-feature, and the second sub-feature is sent to the client.

[0144] It should be noted here that the client obtains the second knowledge information corresponding to the user query information from the second knowledge base, obtains the second embedding feature of the second knowledge information, decomposes the second embedding feature into a third sub-feature and a fourth sub-feature, and sends the third sub-feature to the server. Based on the fourth sub-feature, the second sub-feature sent by the server and the second linear layer parameter of the linear transformation module in the machine learning model, the client performs a secure calculation with the server in the first encryption space to obtain the second component of the first security information, and performs a secure calculation with the server in the second encryption space based on the first secure second component.

[0145] In step 74, based on the first sub-feature, the third sub-feature sent by the client, and the first linear layer parameter of the linear transformation module in the machine learning model with the self-attention mechanism, a secure calculation is performed with the client in the first encryption space to obtain a first component of the first security information.

[0146] It should be noted here that the above machine learning model is part of a large language model.

[0147] For example, the machine learning model is Figure 2 The Transformer Block-0 shown in the figure has a linear transformation module, which is the Linear layer in the linear operation part of Transformer Block-0.

[0148] It should be noted here that the first linear layer parameters are Figure 3 The model is obtained by training using the model training method involved in any one of the embodiments.

[0149] In some embodiments, a first secure two-party computation is performed with the client based on the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of the first security information.

[0150] In some embodiments, performing a first secure two-party computation with the client includes the following steps:

[0151] 1) Combine the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a first multiplication triplet.

[0152] For example, the first sub-feature and the third sub-feature are concatenated to obtain the first component of the first parameter in the first multiplication triplet.

[0153] 2) The first linear layer parameter is used as the first component of the second parameter in the first multiplication triplet.

[0154] 3) Perform a first secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain the first component of the third parameter in the first multiplication triplet.

[0155] 4) Using the first component of the third parameter as the first component of the first security information.

[0156] In step 75, a secure calculation is performed with the client in a second encryption space based on the first secure first component to obtain second secure information.

[0157] In some embodiments, performing secure computation with the client in the second encryption space includes the following steps:

[0158] 1) Using the first self-attention parameter and the second self-attention parameter included in the first component of the first security information, perform a second secure two-party calculation with the client to obtain first intermediate information.

[0159] For example, the first self-attention parameter is the query vector Q, and the second self-attention parameter is the key vector K.

[0160] In some embodiments, performing a second secure two-party computation with the client includes:

[0161] a) Add the first self-attention parameter as the first component of the first parameter in the second multiplication triplet.

[0162] b) Add the second self-attention parameter as the first component of the second parameter in the second multiplication triplet.

[0163] c) Performing a second secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain a first component of the third parameter in the second multiplication triplet.

[0164] d) Using the first component of the third parameter as the first component of the first intermediate information.

[0165] e) Obtain the first intermediate information according to the first component of the first intermediate information and the second component of the first intermediate information sent by the client.

[0166] In some embodiments, the first component of the first intermediate information and the second component of the first intermediate information are combined to obtain the first intermediate information.

[0167] For example, the first component of the first intermediate information and the second component of the first intermediate information are concatenated to obtain the first intermediate information.

[0168] 2) Normalizing the first intermediate information to obtain second intermediate information.

[0169] For example, the first intermediate information is input into the Softmax layer to obtain the second intermediate information.

[0170] 3) Decomposing the second intermediate information into a first intermediate component and a second intermediate component, and sending the second intermediate component to the client.

[0171] 4) Using the first intermediate component and the third attention parameter included in the first component of the first security information, perform a third secure two-party calculation with the client to obtain the second security information.

[0172] For example, the third self-attention parameter is a value vector V.

[0173] In some embodiments, performing a third-party secure two-party computation with the client includes the following steps:

[0174] 1) Using the first intermediate component as the first component of the first parameter in the third multiplication triplet.

[0175] 2) Take the third attention parameter as the first component of the second parameter in the third multiplication triplet.

[0176] 3) Perform a third secure two-party computation with the client based on the first component of the first parameter and the first component of the second parameter to obtain the first component of the third parameter in the third multiplication triplet.

[0177] 4) Using the first component of the third parameter as the first component of the second security information.

[0178] 5) Obtain the second security information according to the first component of the second security information and the second component of the second security information sent by the client.

[0179] In some embodiments, the first component of the second security information and the second component of the second security information are combined to obtain the second security information.

[0180] For example, the first component of the second security information and the second component of the second security information are concatenated to obtain the second security information.

[0181] In step 76, the second security information is input into a self-attention module in the machine learning model so that the machine learning model outputs target features.

[0182] For example, Figure 2 As shown, the second security information is input into the FFN module, so that the Transformer block outputs the corresponding target features.

[0183] In step 77, the target features are converted into target text.

[0184] In some embodiments, the large language model also includes multiple other machine learning models with self-attention mechanisms cascaded with the above-mentioned machine learning model, and converting the target feature into a target text includes: inputting the target feature into the first other machine learning model cascaded with the machine learning model, and inputting the output of the first other machine learning model into the next other machine learning model cascaded with the first other machine learning model, so as to obtain the feature to be processed output by the last other machine learning model among the multiple other machine learning models, and converting the feature to be processed into the target text.

[0185] Figure 8 This is a schematic structural diagram of a server according to another embodiment of the present disclosure.

[0186] like Figure 8 As shown, the server 80 includes a memory 81 , a processor 82 , a bus 86 , and interfaces 83 , 84 , and 85 . Figure 8 and Figure 4 The difference is that in Figure 8 In the illustrated embodiment, the processor 82 is configured to execute instructions stored in the memory to implement the following Figure 7 The method according to any one of the embodiments.

[0187] The present disclosure also provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the following Figure 7 The method according to any one of the embodiments.

[0188] The present disclosure also provides a computer program product, including computer instructions, wherein when the computer instructions are executed by a processor, the following is achieved: Figure 7 The method according to any one of the embodiments.

[0189] Figure 9 FIG. 1 is a schematic diagram of the structure of an information processing system according to an embodiment of the present disclosure. Figure 9 As shown, the information processing system includes a server 91 and a client 92. The server 91 is Figure 8 The server shown in any embodiment.

[0190] The client 92 is configured to obtain second knowledge information corresponding to the user query information from the second knowledge base, obtain a second embedding feature of the second knowledge information, decompose the second embedding feature into a third sub-feature and a fourth sub-feature, and send the third sub-feature to the server, perform a secure calculation with the server in the first encryption space based on the fourth sub-feature, the second sub-feature sent by the server and the second linear layer parameter of the linear transformation module in the machine learning model to obtain the second component of the first security information, and perform a secure calculation with the server in the second encryption space based on the first secure second component.

[0191] In some embodiments, the client 92 is configured to perform a first secure two-party computation with the server based on the fourth sub-feature, the second sub-feature, and the second linear layer parameter to obtain a second component of the first security information.

[0192] In some embodiments, the client 92 is configured to combine the fourth sub-feature with the second sub-feature to obtain the second component of the first parameter in the first multiplication triplet, use the second linear layer parameter as the second component of the second parameter in the first multiplication triplet, perform a first secure two-party computation with the server based on the second component of the first parameter and the second component of the second parameter to obtain the second component of the third parameter in the first multiplication triplet, and use the second component of the third parameter as the second component of the first security information.

[0193] In some embodiments, the client 92 is configured to perform a second secure two-party calculation with the server using the fourth self-attention parameter and the fifth self-attention parameter included in the second component of the first security information to obtain the second component of the first intermediate information, and send the second component of the first intermediate information to the server, and perform a third secure two-party calculation with the server using the second intermediate component sent by the server and the sixth attention parameter included in the second component of the first security information.

[0194] For example, the fourth self-attention parameter is the query vector Q, the fifth self-attention parameter is the key vector K, and the sixth self-attention parameter is the value vector V.

[0195] In some embodiments, the client 92 is configured to use the fourth self-attention parameter as the second component of the first parameter in the second multiplication triplet, and the fifth self-attention parameter as the second component of the second parameter in the second multiplication triplet, perform a second secure two-party calculation with the server based on the second component of the first parameter and the second component of the second parameter, obtain the second component of the third parameter in the second multiplication triplet, and use the second component of the third parameter as the second component of the first intermediate information.

[0196] In some embodiments, the client 92 is configured to use the second intermediate component as the second component of the first parameter in the third multiplication triplet, and the sixth attention parameter as the second component of the second parameter in the third multiplication triplet, perform a third secure two-party calculation with the server based on the second component of the first parameter and the second component of the second parameter, obtain the second component of the third parameter in the third multiplication triplet, use the second component of the third parameter as the second component of the second security information, and send the second component of the second security information to the server.

[0197] Figure 10 This is a structural diagram of an information processing system according to another embodiment of the present disclosure.

[0198] like Figure 10 As shown in Figure 2, the main part of the large language model is set on the server side. Figure 1 The difference is that in Figure 10 In the illustrated embodiment, the linear operation portion of Transformer Block-0 is set in the ciphertext space.

[0199] For example, when a user asks "I'm looking for a brand A smartwatch suitable for outdoor sports. Do you have any recommendations?", the server retrieves the models, relevant parameters and user reviews of brand A smartwatches suitable for outdoor sports that have relatively high sales on the platform through its own first knowledge base. The client of the company that produces brand A smartwatches retrieves several models and relevant parameters of smartwatches suitable for outdoor sports through its own second knowledge base.

[0200] The server inputs the queried information into its own embedding layer to obtain a first embedding feature. The client inputs the queried information into its own embedding layer to obtain a second embedding feature. The server and client respectively input the obtained first embedding feature and second embedding feature into the ciphertext space to complete the linear transformation and corresponding calculations in the Attention module in the ciphertext space. The server provides the calculation results of the ciphertext space to the FFN module in Transformer Block-0, and inputs the output information of the FFN module into the main model to obtain the final result. It should be noted here that the main model is the other parts of the large language model except Transformer Block-0.

[0201] It should be noted here that, Figure 10 In the information processing system shown, the linear transformation in Transformer Block-0 and the calculation of the Attention module are both performed in the ciphertext space, while the main part of the large language model is still set on the server side. This ensures that when the large language model is deployed on the model provider's server side, it can effectively protect the model provider's model intellectual property rights while effectively preventing the application party's data from being leaked. At the same time, the calculation rate is high and can be used in real application scenarios.

[0202] Figure 11 This is a flowchart of an information processing method according to another embodiment of the present disclosure. This embodiment describes how a server and a client implement computational processing in a ciphertext space.

[0203] In step 111a, the server obtains first knowledge information corresponding to the user query information from the first knowledge base.

[0204] In step 111b, the client obtains second knowledge information corresponding to the user query information from the second knowledge base.

[0205] In step 112a, the server obtains the first embedded feature E1 of the first knowledge information.

[0206] In step 112b, the client obtains the second embedded feature E2 of the second knowledge information.

[0207] In step 113a, the server decomposes the first embedded feature E1 into a first sub-feature E11 and a second sub-feature E12, that is, E1=E11+E12.

[0208] In step 113b, the client decomposes the second embedded feature E2 into a third sub-feature E21 and a fourth sub-feature E22, that is, E2=E21+22.

[0209] In step 114a, the server sends the second sub-feature E12 to the client.

[0210] In step 114b, the client sends the third sub-feature E21 to the server.

[0211] In step 115a, the server concatenates the first sub-feature E11 and the third sub-feature E21 to obtain a first component SE1 of the first parameter SE in the multiplication triple. For example, the server concatenates the first sub-feature E11 and the third sub-feature E21 up and down to obtain the first component SE1.

[0212] In step 115b, the client concatenates the fourth sub-feature E22 and the second sub-feature E12 to obtain the second component SE2 of the first parameter SE in the first multiplication triple. For example, the fourth sub-feature E22 and the second sub-feature E12 are concatenated vertically to obtain the second component SE2.

[0213] In step 116a, the server uses the first linear layer parameter W1 as the first component of the second parameter W in the first multiplication triplet, performs a secure two-party calculation with the client based on the first component SE1 of the first parameter and the first component W1 of the second parameter, and obtains the first component EW1 of the third parameter EW in the first multiplication triplet, which is used as the first component of the first security information.

[0214] In some embodiments, the first linear layer parameters W1 are used Figure 3 The model training method shown is trained.

[0215] In step 116b, the client uses the second linear layer parameter W2 as the second component of the second parameter W in the first multiplication triplet, performs a secure two-party calculation with the server based on the second component SE2 of the first parameter and the second component W2 of the second parameter, and obtains the second component EW2 of the third parameter EW in the first multiplication triplet, which is used as the second component of the security information.

[0216] It should be noted that the three parameters in the first multiplication triple are SE, W, and EW. The server has the first component SE1 of the first parameter SE and the first component W1 of the second parameter W, and the client has the second component SE2 of the first parameter SE and the second component W2 of the second parameter W. The multiplication corresponding to the first multiplication triple is shown in formula (2).

[0217] (SE1+SE2)(W1+W2)=(EW1+EW2) (2)

[0218] Based on secure two-party computation between the server and the client, the server obtains a first component EW1 of the third parameter EW in the first multiplication triplet, and the client obtains a second component EW2 of the third parameter EW in the first multiplication triplet.

[0219] It should also be noted here that EW1 = Q1||K1||V1, EW2 = Q2||K2||V2.

[0220] In step 117a, the server uses Q1 as the first component of the first parameter W in the second multiplication triplet, and uses K1 as the first component of the second parameter K in the second multiplication triplet. Based on the first component Q1 of the first parameter and the first component K1 of the second parameter, the server performs a secure two-party calculation with the client to obtain the first component S1 of the third parameter S in the second multiplication triplet, and uses it as the first component of the first intermediate information.

[0221] In step 117b, the client uses Q2 as the second component of the first parameter W in the second multiplication triplet, and uses K2 as the second component of the second parameter K in the second multiplication triplet. Based on the second component Q2 of the first parameter and the second component K2 of the second parameter, the client performs a secure two-party calculation with the server to obtain the second component S2 of the third parameter S in the second multiplication triplet, and uses it as the second component of the first intermediate information.

[0222] It should be noted that the three parameters in the second multiplication triple are Q, K, and S. The server has the first component Q1 of the first parameter Q and the first component K1 of the second parameter K, and the client has the second component Q2 of the first parameter Q and the second component K2 of the second parameter K. The multiplication corresponding to the second multiplication triple is shown in formula (3).

[0223] (Q1+Q2)(K1+K2)=(S1+S2) (3)

[0224] Based on secure two-party computation between the server and the client, the server obtains a first component S1 of the third parameter S in the second multiplication triplet, and the client obtains a second component S2 of the third parameter S in the second multiplication triplet.

[0225] In step 118 , the client sends the second component S2 of the first intermediate information to the server.

[0226] In step 119 , the server concatenates the first component S1 of the first intermediate information and the second component S2 of the first intermediate information to obtain the first intermediate information S. For example, the first component S1 and the second component S2 are concatenated vertically to obtain the first intermediate information S.

[0227] In step 1110 , the server inputs the first intermediate information S into the Softmax layer to obtain the second intermediate information S′.

[0228] For example, the calculation formula used by the Softmax layer is shown in formula (4), where d is a preset parameter.

[0229]

[0230] In step 1111 , the server decomposes the second intermediate information S′ into a first intermediate component S′ 1 and a second intermediate component S′ 2 .

[0231] In step 1112 , the server sends the second intermediate component S′ 2 to the client.

[0232] In step 1113a, the server uses the first intermediate component S′1 as the first component of the first parameter S′ in the third multiplication triplet, and uses V1 as the first component of the second parameter V in the third multiplication triplet. Based on the first component S′1 of the first parameter and the first component V1 of the second parameter, the server performs a secure two-party calculation with the client to obtain the first component Y1 of the third parameter Y in the third multiplication triplet, and uses it as the first component of the second security information.

[0233] In step 1113b, the client uses the second intermediate component S′2 as the second component of the first parameter S′ in the third multiplication triplet, and uses V2 as the second component of the second parameter V in the third multiplication triplet. Based on the second component S′2 of the first parameter and the second component V2 of the second parameter, the client performs a secure two-party calculation with the server to obtain the second component Y2 of the third parameter Y in the third multiplication triplet, and uses it as the second component of the second security information.

[0234] It should be noted that the three parameters in the third multiplication triple are S', V, and Y. The server has the first component S'1 of the first parameter S' and the first component V1 of the second parameter V, and the client has the second component S'2 of the first parameter S' and the second component V2 of the second parameter V. The multiplication corresponding to the third multiplication triple is shown in formula (5).

[0235] (S′1+ S′2)(V1+V2)=(Y1+Y2) (5)

[0236] Based on secure two-party computation between the server and the client, the server obtains a first component Y1 of the third parameter Y in the third multiplication triplet, and the client obtains a second component Y2 of the third parameter Y in the third multiplication triplet.

[0237] In step 1114 , the client sends the second component Y2 of the second security information to the server.

[0238] In step 1115 , the server concatenates the first component Y1 of the second security information and the second component Y2 of the second security information to obtain the second security information Y. For example, the first component Y1 and the second component Y2 are concatenated vertically to obtain the second security information Y.

[0239] In step 1116, the server inputs the second security information Y into the FFN module in Transformer Block-0 so that the large language model inputs the final result.

[0240] Figure 12 A schematic diagram of matrix multiplication according to an embodiment of the present disclosure.

[0241] like Figure 12 As shown, during the secure two-party computation between the server and client based on formula (5), the server calculates the first component Y1 of the second security information, and the client calculates the second component Y2 of the second security information. Since the client sends the second component Y2 of the second security information to the server in step 1414, the server has both the first component Y1 and the second component Y2 of the second security information. In addition, according to step 1410, the server also has both the first intermediate component S′1 and the second intermediate component S′2.

[0242] The above formula (5) is transformed into formula (6).

[0243] (S′1+ S′2) -1 (S′1+ S′2)(V1+V2)=(S′1+ S′2) -1 (Y1+Y2) (6)

[0244] Since the server has S′1, S′2, V1, Y1, and Y2, the server can obtain V2 using formula (6). Since V2 is included in EW2, and EW2 is calculated using formula (2), and the server only has parameter W1 and not W2, the server cannot use V2 to infer the client's relevant data. Therefore, the solution provided by the present disclosure improves computing efficiency while effectively preventing data leakage.

[0245] In some embodiments, the functional modules described above can be implemented as a general-purpose processor, a programmable logic controller (PLC), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component or any appropriate combination thereof for performing the functions described in the present disclosure.

[0246] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0247] The description of the present disclosure is provided for purposes of illustration and description and is not intended to be exhaustive or to limit the disclosure to the disclosed form. Many modifications and variations will be apparent to those skilled in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present disclosure and to enable those skilled in the art to understand the present disclosure and design various embodiments with various modifications suitable for specific applications.

Claims

1. A model training method, executed by a server, comprising: Obtaining a first sample feature of the first sample data; Decomposing the first sample feature into a first sub-feature and a second sub-feature, and sending the second sub-feature to a client; Performing secure computation with the client in a preset encryption space according to the first sub-feature, the third sub-feature sent by the client, and a first linear layer parameter of a linear transformation module in a machine learning model with a self-attention mechanism to obtain security information, wherein the machine learning model is a part of a large language model; Inputting the security information into a self-attention module in the machine learning model, and converting the target features output by the machine learning model into target text; Training the linear transformation module according to the target text and the annotation information of the first sample data; The performing of secure computing with the client in the encrypted space includes: Performing secure two-party computation with the client according to the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of security information; The security information is obtained according to the first component of the security information and the second component of the security information sent by the client, wherein the client decomposes the second sample feature of the second sample data into a third sub-feature and a fourth sub-feature, and sends the third sub-feature to the server, performs a secure two-party calculation with the server according to the fourth sub-feature, the second sub-feature and a second linear layer parameter of a linear transformation module in a machine learning model to obtain the second component of the security information, and sends the second component to the server; The performing of secure two-party computing with the client includes: combining the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a multiplication triple; Using the first linear layer parameter as a first component of a second parameter in the multiplication triplet; Performing secure two-party computation with the client according to the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the multiplication triplet; The first component of the third parameter is used as the first component of the security information.

2. The method according to claim 1, wherein: The obtaining the security information according to the first component of the security information and the second component of the security information sent by the client comprises: The first component of the security information and the second component of the security information are combined to obtain the security information.

3. The method according to any one of claims 1 to 2, wherein: The training of the linear transformation module according to the target text and the annotation information of the first sample data comprises: Determine a loss function according to the target text and the annotation information of the first sample data; The linear transformation module is trained according to the descending gradient of the loss function.

4. The method according to any one of claims 1 to 2, wherein: The large language model also includes a plurality of other machine learning models with self-attention mechanisms cascaded with the machine learning model, and the step of converting the target features output by the machine learning model into the target text includes: Input the target feature output by the machine learning model into the first other machine learning model cascaded with the machine learning model, and input the output of the first other machine learning model into the next other machine learning model cascaded with the first other machine learning model, so as to obtain the to-be-processed feature output by the last other machine learning model among the multiple other machine learning models; The to-be-processed features are converted into the target text.

5. A server, comprising: Memory; A processor is coupled to the memory, and the processor is configured to execute the method according to any one of claims 1 to 4 based on instructions stored in the memory.

6. A model training system, comprising: The server as claimed in claim 5; The client is configured to obtain a second sample feature of second sample data, decompose the second sample feature into a third sub-feature and a fourth sub-feature, and send the third sub-feature to the server, and perform secure calculations with the server in an encrypted space based on the fourth sub-feature, the second sub-feature sent by the server, and the second linear layer parameters of the linear transformation module in the machine learning model.

7. The system according to claim 6, wherein: The client is configured to perform a secure two-party computation with the server according to the fourth sub-feature, the second sub-feature and the second linear layer parameter to obtain a second component of security information, and send the second component of the security information to the server.

8. The system according to claim 7, wherein: The client is configured to combine the fourth sub-feature and the second sub-feature to obtain a second component of a first parameter in a multiplication triplet, use the second linear layer parameter as a second component of a second parameter in the multiplication triplet, perform a secure two-party computation with the server based on the second component of the first parameter and the second component of the second parameter to obtain a second component of a third parameter in the multiplication triplet, and use the second component of the third parameter as a second component of the security information.

9. An information processing method, executed by a server, comprising: Acquire first knowledge information corresponding to the user query information from the first knowledge base; Acquire a first embedded feature of the first knowledge information; Decomposing the first embedded feature into a first sub-feature and a second sub-feature, and sending the second sub-feature to a client; Performing secure calculation with the client in a first encryption space according to the first sub-feature, the third sub-feature sent by the client, and a first linear layer parameter of a linear transformation module in a machine learning model with a self-attention mechanism to obtain a first component of first security information, wherein the machine learning model is a part of a large language model, and wherein the first linear layer parameter is obtained by training through the model training method according to any one of claims 1 to 4; performing a security calculation with the client in a second encryption space according to the first component of the first security to obtain second security information; Inputting the second security information into a self-attention module in the machine learning model so that the machine learning model outputs a target feature; The target features are converted into target text.

10. The method according to claim 9, wherein: The performing secure computing with the client in the first encryption space includes: A first secure two-party calculation is performed with the client according to the first sub-feature, the third sub-feature, and the first linear layer parameter to obtain a first component of the first security information.

11. The method according to claim 10, wherein: The performing a first secure two-party computation with the client comprises: combining the first sub-feature and the third sub-feature to obtain a first component of a first parameter in a first multiplication triplet; applying the first linear layer parameter as a first component of a second parameter in the first multiplication triplet; Performing a first secure two-party calculation with the client according to the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the first multiplication triplet; The first component of the third parameter is used as the first component of the first security information.

12. The method according to claim 9, wherein: The performing secure computing with the client in the second encryption space includes: Using the first self-attention parameter and the second self-attention parameter included in the first component of the first security information, perform a second secure two-party calculation with the client to obtain first intermediate information; Normalizing the first intermediate information to obtain second intermediate information; Decomposing the second intermediate information into a first intermediate component and a second intermediate component, and sending the second intermediate component to the client; Using the first intermediate component and the third attention parameter included in the first component of the first security information, a third secure two-party calculation is performed with the client to obtain the second security information.

13. The method according to claim 12, wherein: The performing a second secure two-party computation with the client comprises: applying the first self-attention parameter as a first component of a first parameter in a second multiplication triplet; applying the second self-attention parameter as a first component of a second parameter in the second multiplication triplet; Performing a second secure two-party computation with the client according to the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the second multiplication triplet; Using the first component of the third parameter as the first component of the first intermediate information; The first intermediate information is obtained according to the first component of the first intermediate information and the second component of the first intermediate information sent by the client.

14. The method according to claim 13, wherein: Obtaining the first intermediate information includes: The first component of the first intermediate information and the second component of the first intermediate information are combined to obtain the first intermediate information.

15. The method according to claim 12, wherein: The performing a third secure two-party computation with the client comprises: using the first intermediate component as a first component of a first parameter in a third multiplication triplet; applying the third attention parameter as a first component of a second parameter in the third multiplication triplet; performing a third secure two-party computation with the client according to the first component of the first parameter and the first component of the second parameter to obtain a first component of a third parameter in the third multiplication triplet; Using the first component of the third parameter as the first component of the second security information; The second security information is obtained according to the first component of the second security information and the second component of the second security information sent by the client.

16. The method according to claim 15, wherein: Obtaining the second security information includes: The first component of the second security information and the second component of the second security information are combined to obtain the second security information.

17. The method according to any one of claims 9 to 16, wherein: The large language model also includes a plurality of other machine learning models with self-attention mechanisms cascaded with the machine learning model, and the converting of the target features into target text includes: Input the target feature into the first other machine learning model cascaded with the machine learning model, and input the output of the first other machine learning model into the next other machine learning model cascaded with the first other machine learning model, so as to obtain the to-be-processed feature output by the last other machine learning model among the multiple other machine learning models; The to-be-processed features are converted into the target text.

18. A server, comprising: Memory; A processor is coupled to the memory, and the processor is configured to execute the method according to any one of claims 9 to 17 based on instructions stored in the memory.

19. An information processing system comprising: The server as claimed in claim 18; The client is configured to obtain second knowledge information corresponding to the user query information from a second knowledge base, obtain a second embedded feature of the second knowledge information, decompose the second embedded feature into a third sub-feature and a fourth sub-feature, and send the third sub-feature to the server, perform secure calculations with the server in a first encryption space based on the fourth sub-feature, the second sub-feature sent by the server, and the second linear layer parameters of the linear transformation module in the machine learning model to obtain a second component of the first secure information, and perform secure calculations with the server in a second encryption space based on the first secure second component.

20. The system of claim 19, wherein: The client is configured to perform a first secure two-party calculation with the server according to the fourth sub-feature, the second sub-feature and the second linear layer parameter to obtain a second component of the first security information.

21. The system of claim 20, wherein: The client is configured to combine the fourth sub-feature and the second sub-feature to obtain a second component of the first parameter in the first multiplication triplet, use the second linear layer parameter as the second component of the second parameter in the first multiplication triplet, perform the first secure two-party calculation with the server according to the second component of the first parameter and the second component of the second parameter to obtain a second component of the third parameter in the first multiplication triplet, and use the second component of the third parameter as the second component of the first security information.

22. The system of claim 19, wherein: The client is configured to perform a second secure two-party calculation with the server using the fourth self-attention parameter and the fifth self-attention parameter included in the second component of the first security information to obtain the second component of the first intermediate information, and send the second component of the first intermediate information to the server, and perform a third secure two-party calculation with the server using the second intermediate component sent by the server and the sixth attention parameter included in the second component of the first security information.

23. The system of claim 22, wherein: The client is configured to use the fourth self-attention parameter as the second component of the first parameter in the second multiplication triplet, and use the fifth self-attention parameter as the second component of the second parameter in the second multiplication triplet, perform the second secure two-party calculation with the server according to the second component of the first parameter and the second component of the second parameter, obtain the second component of the third parameter in the second multiplication triplet, and use the second component of the third parameter as the second component of the first intermediate information.

24. The system of claim 22, wherein: The client is configured to use the second intermediate component as the second component of the first parameter in a third multiplication triplet, use the sixth attention parameter as the second component of the second parameter in the third multiplication triplet, perform the third secure two-party calculation with the server based on the second component of the first parameter and the second component of the second parameter to obtain the second component of the third parameter in the third multiplication triplet, use the second component of the third parameter as the second component of the second security information, and send the second component of the second security information to the server.

25. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the method according to any one of claims 1-4 and 9-17 is implemented.

26. A computer program product, comprising computer instructions, wherein when the computer instructions are executed by a processor, the method according to any one of claims 1-4, 9-17 is implemented.

Images