Context learning method for protecting data privacy

Abstract

The invention discloses a context learning method for protecting data privacy. The context learning method comprises the following steps: in the pre-training process of a large language model, implementing adaptive noise adding processing on the gradient of training data; according to a large language model obtained through pre-training and a specified format instruction, a context example is constructed and generated Token by Token, and in the process of constructing and generating the context example, self-adaptive noise adding processing is implemented when Token is generated; in the big language model reasoning process, the context examples with privacy protection and the input content of the user are spliced and combined to form input with prompts, and the input with prompts is input into the big language model for prediction and reasoning. According to the context learning method, the noise adding scale is dynamically adjusted through the self-adaptive noise adding strategy, so that the influence on the model performance can be reduced while privacy is protected, and finally the technical effects of enhancing privacy protection and optimizing the model performance are achieved.

Description

Technical Field

[0001] The present invention relates to a large language model learning method, and in particular to a context learning method for protecting data privacy. Background Art

[0002] In the current digital age, artificial intelligence technology plays an important role in various industries and fields. Among them, large language models (LLMs) have become a striking technology with their excellent language generation capabilities. These large language models are developed on the basis of pre-trained language models (PLMs), and their performance improvement is due to the significant growth of data volume and computing power in the information age. Large language models show great potential in natural language understanding and generation tasks.

[0003] In-context learning (ICL) is a branch of large language model research that allows models to solve new problems by providing a small number of examples without any adjustments to the model weights. The key to this learning approach is learning from analogies, by constructing contextual demonstrations and combining them with query questions to form prompted inputs for model predictions.

[0004] The current problem is:

[0005] 1) Although contextual learning provides a low-cost fine-tuning training solution, it also has some risks of privacy leakage. Attackers may use prompt word injection attacks to induce the model to output the content of context examples, resulting in the leakage of private information in the examples. Today, when personal privacy security is increasingly valued, this privacy leakage problem cannot be ignored.

[0006] 2) Although differential privacy (DP) is considered the gold standard for protecting personal privacy, its noise addition process may reduce the accuracy of the model. How to minimize the impact on model performance while protecting privacy is a challenge faced by existing technologies.

[0007] To solve the above problems, a solution is needed that can effectively protect privacy while maintaining or improving model performance. Summary of the invention

[0008] The purpose of the present invention is to provide a contextual learning method for protecting data privacy, which can reduce the impact on model performance while protecting privacy.

[0009] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0010] A context learning method for protecting data privacy, the context learning method comprising:

[0011] During the pre-training of large language models, adaptive noise is applied to the gradients of the training data.

[0012] According to the pre-trained large language model and the specified format instructions, the context examples are constructed token by token. In the process of constructing the context examples, adaptive noise processing is implemented when the token is generated.

[0013] During the large language model inference process, the privacy-preserving context examples are concatenated with the user's input content to form an input with prompts, which is then input into the large language model for prediction and inference to obtain the prediction and inference results.

[0014] Furthermore, in the process of pre-training the large language model, the gradient of the training data is subjected to adaptive noise processing, and the specific implementation method thereof includes:

[0015] During the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of training data, and the gradient distortion is minimized according to the changes in training error by dynamically adjusting the noise scale.

[0016] Furthermore, differential privacy technology is used when implementing adaptive noise processing on the gradient of training data.

[0017] Furthermore, when implementing adaptive noise processing on the gradient of training data, when using differential privacy technology, the standard deviation σ of the added noise will be based on the loss value of each round of training For adaptive adjustment, the calculation formula of the standard deviation σ is:

[0018]

[0019] In the formula, σ0 is the initial noise standard deviation, and λ represents the influence of training loss on the noise standard deviation.

[0020] Furthermore, in the process of constructing the generation context example, adaptive noise processing is implemented when the token is generated, and the specific implementation method thereof includes:

[0021] S21, specifying the context example format to be generated for the large language model, and the large language model generates the next Token according to the specified context example format and the already generated content, and records the generation probability distribution of the Token;

[0022] S22, performing part-of-speech analysis on the generated Token, and then adding Gaussian noise of corresponding scale to the generation probability distribution of the Token according to a pre-defined noise adding strategy, and obtaining a noisy Token after regeneration;

[0023] S23, concatenating the noisy Token with the generated context content to update the generated context content;

[0024] S24, repeating the above steps S21 to S23 until a context example that meets the conditions is generated.

[0025] Furthermore, differential privacy technology is used when implementing adaptive noise processing during Token generation.

[0026] Furthermore, the noise adding strategy includes:

[0027] Add large-scale noise to nouns;

[0028] Add medium-scale noise to verbs, adjectives, and numerals;

[0029] Add small-scale noise to words of other parts of speech.

[0030] Furthermore, the context example with privacy protection is concatenated with the user's input content to form an input with prompts, which is input into a large language model for prediction and reasoning, thereby obtaining a prediction and reasoning result. The specific implementation method includes:

[0031] The large language model will present a series of privacy-preserving contextual demonstration examples Combine to generate the final contextual presentation It is concatenated with the user input and put into the large language model for inference to obtain:

[0032] output = LLM(·|Z, input)

[0033] Next, we will explain the privacy guarantee brought by the introduction of differential privacy;

[0034] First, let’s introduce the definition of differential privacy:

[0035] (∈,δ)-DP is defined as: for any two adjacent data sets D and D' (the two have only one data point different) and all possible outputs O, we have:

[0036]

[0037] in Represents the large language model algorithm after adding noise;

[0038] The Gaussian mechanism achieves differential privacy by adding Gaussian noise to sensitive data. In this mechanism, the standard deviation of the noise σ ICL There is the following relationship between the privacy parameter ∈,δ:

[0039] For a given dataset sensitivity Δ, the condition for the Gaussian mechanism to ensure (∈,δ)-DP is

[0040]

[0041] In the pre-training stage of the large language model, the overall privacy budget ∈ can be obtained as:

[0042]

[0043] In the stage of generating privacy-preserving contextual demonstration examples, the overall privacy budget ∈ can be obtained as:

[0044]

[0045] where σ i Indicates the standard deviation of the noise added to each token according to the part of speech.

[0046] Compared with the prior art, the context learning method of the present invention has the following beneficial effects:

[0047] In the contextual learning method of the present invention, a contextual learning method combined with differential privacy is adopted, and the scale of added noise is dynamically adjusted through an adaptive noise adding strategy. In this way, the impact on model performance can be reduced while protecting privacy, and ultimately the technical effect of enhancing privacy protection and optimizing model performance is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a logical framework diagram of the context learning method for protecting data privacy of the present invention, wherein the left half is the overall architecture of the large language model, and the right half is the context example generation architecture;

[0049] Figure 2 The pseudo code of the algorithm for implementing the context learning method of the present invention;

[0050] Figure 3 The flowchart of the algorithm for implementing the context learning method of the present invention. DETAILED DESCRIPTION

[0051] The present invention will be further described below with specific embodiments:

[0052] This embodiment provides a contextual learning method for protecting data privacy, which can reduce the impact on model performance while protecting privacy.

[0053] Before specifically introducing the context learning method of this embodiment, some related prior art knowledge is first explained (which can be understood as pre-knowledge):

[0054] In-context learning (ICL) is a task-adaptive learning method that does not rely on model parameter adjustment. The key idea is to learn from analogies. In-context learning builds a contextual demonstration by "combining examples related to the task", and then connects the question to be queried with this contextual demonstration to form an input with prompts, which is input into the language model for prediction. This method provides an effective and simple cross-task generalization method for model training. The knowledge obtained by "using model pre-training" combined with a small number of examples can enable the model to quickly adapt to new fields or concepts.

[0055] The context demonstrations in traditional contextual learning are written in natural language, and there are bound to be privacy issues when user information exists in the example content.

[0056] Malicious attackers can obtain the content of the contextual presentation through prompt word injection attacks, and unencrypted user information will be leaked.

[0057] Based on current technical means, we can add noise to the data by introducing differential privacy technology to generate contextual demonstrations with privacy protection, thereby effectively preventing privacy leakage problems.

[0058] However, adding noise to the context demonstration will interfere with the model's understanding and processing of the data to a certain extent, which will affect the performance of the model.

[0059] Those skilled in the art can understand that the scale of noise determines the degree of its impact on model performance, and words of different parts of speech have different privacy information, which also means that different scales of noise can be added to words of different parts of speech. Parts of speech determine the function and usage of words in sentences, thereby affecting the amount and nature of information they carry. Nouns can directly point to specific people, places or things, and the amount of privacy information they contain is usually high, so large-scale noise needs to be added. It should be noted here that certificate numbers are also classified as nouns as unique identifiers; verbs, adjectives, and numerals do not leak privacy information themselves, but may cause information leakage when combined with other words. They contain medium amounts of privacy information and need to add medium-scale noise; words of other parts of speech (such as adverbs) also do not leak privacy information themselves, but more indirectly affect the amount of information, and have less privacy information, so only small-scale noise needs to be added.

[0060] It should be noted that, in this embodiment, all the added noises mentioned are Gaussian noises, and the formula is:

[0061]

[0062] In the formula, σ represents the standard deviation of the noise, I represents the unit matrix, Indicates that the mean is 0 and the covariance matrix is ​​σ 2 Multivariate normal distribution of I.

[0063] See also Figures 1 to 3 The context learning method of this embodiment mainly includes three major steps, namely steps S1 to S3, which can also be called three major stages:

[0064] S1, model pre-training stage: During the pre-training of the large language model, adaptive noise processing is performed on the gradient of the training data.

[0065] Specifically,

[0066] In the model pre-training stage, a large language model of the training object is pre-trained using a large-scale data set as training data to obtain a pre-trained large language model. During the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of the training data; and by dynamically adjusting the noise scale, the gradient distortion is minimized according to the change of the training error, thereby laying the foundation for subsequent context learning.

[0067] That is to say, in step S1, the Gaussian noise adding strategy adopted is "adding noise according to the training error (training loss value)".

[0068] In step S1, when adaptively adding noise to the gradient of the training data, differential privacy technology is used. The standard deviation σ of the added noise will be calculated based on the loss value of each round of training. For adaptive adjustment, the calculation formula of the standard deviation σ is:

[0069]

[0070] In the formula, σ0 is the initial noise standard deviation, and λ represents the influence of training loss on the noise standard deviation.

[0071] The complete process of step S1 is as follows:

[0072] The large language model first uses the formula

[0073]

[0074] Calculate the gradient g for each data sample i ,

[0075] In the formula, θ represents the model parameters, represents the loss function, x i represents the training data, y i Represents a data label.

[0076] In order to further improve the training stability and limit the contribution of each sample to the gradient, the sensitivity of the gradient is controlled by gradient clipping, and a fixed threshold is set to

[0077]

[0078] where ||g i ||2 represents the L2 norm of the gradient, and the calculation formula is:

[0079]

[0080] The gradients of all samples are then aggregated and Gaussian noise is added to obtain the gradient g:

[0081]

[0082] Finally, the model parameters are updated, where η represents the learning rate of the model:

[0083] θ'=θ-ηg

[0084] The large language model obtained by pre-training is denoted as LMM(·|·).

[0085] S2, the stage of generating context examples with privacy protection: Based on the previously pre-trained large language model and the specified format instructions, the generated context examples are constructed token by token. In the process of constructing the generated context examples, adaptive noise processing is implemented when the token is generated.

[0086] It should be noted that the previously mentioned "constructing context examples token by token" means that the generation of context examples requires multiple rounds of iterative training, and each round of iterative training will generate a token.

[0087] The process of “building a context example token by token” is common knowledge known to those skilled in the art.

[0088] Specifically,

[0089] In this stage, tokens are generated based on the pre-trained large language model obtained in step S1 and the specified format instructions, and part-of-speech discrimination is performed to determine the amount of privacy information of different parts of speech, and then noise of corresponding scales is added according to different parts of speech. Through an iterative process, the noisy tokens are concatenated with the existing context content to form a complete context example with privacy protection.

[0090] It should be noted that differential privacy technology is also used when implementing adaptive noise processing during Token generation.

[0091] In this embodiment, step S2 specifically includes steps S21 to S12:

[0092] S21, Token generation.

[0093] Specifically,

[0094] The pre-trained large language model obtained in step S1 is specified with the context example format to be generated. The pre-trained large language model generates the next Token according to the "specified context example format" and the "generated content", and records the generation probability distribution of the Token, thereby laying the foundation for subsequent context learning.

[0095] S22, for the Token generated in step S21, perform part-of-speech analysis on the Token, then add Gaussian noise of corresponding scale to the probability distribution of the Token according to a pre-established noise adding strategy, and regenerate the Token to obtain the noisy Token; in this way, differentiated protection of privacy information can be achieved.

[0096] The pre-defined noise adding strategy includes:

[0097] Add large-scale noise to the nouns. Specifically, set the noise standard deviation σ ICL ∈[0.3,0.5];

[0098] Add medium-scale noise to verbs, adjectives, and numerals. Specifically, set the noise standard deviation σ ICL ∈[0.1,0.3];

[0099] Add small-scale noise to words of other parts of speech except nouns, verbs, adjectives and numerals. Specifically, set the noise standard deviation σ ICL ∈[0.01,0.1].

[0100] S23, for the noisy Token obtained in step S22, the noisy Token is concatenated with the already generated context content, the already generated context content is updated, and preparation is made for generating the next Token.

[0101] S24, repeating the above steps S21 to S23 until a context example that meets the conditions is generated.

[0102] The "satisfying conditions" mentioned here means that "the pre-trained large language model has reached the limit of the maximum number of generated words (number of tokens), or the generation has been completed (that is, the generated token is the terminator)".

[0103] At this point, the generated context example is a privacy-preserving context example.

[0104] In this embodiment, the overall process of step S2 is as follows:

[0105] The model records the generated content as z, and the initial state of z is empty. In each round of Token generation, the next Tokenx is generated based on the generated content z and the task instruction description instruction i And record its generation probability distribution p i :

[0106] x i =LLM(·|instruction,z)

[0107] Perform part-of-speech discrimination on the generated Tokens and set the corresponding noise scale according to different parts of speech. Specifically:

[0108] Add large-scale noise to nouns and set the noise standard deviation σ ICL ∈[0.3,0.5]

[0109] Add medium-scale noise to verbs, adjectives, and numerals, and set the noise standard deviation σ ICL ∈[0.1,0.3]

[0110] Add small-scale noise to words of other parts of speech and set the noise standard deviation σ ICL ∈[0.01,0.1]

[0111] σ ICL The specific value is determined according to the size of the privacy budget. The probability distribution of the token after adding Gaussian noise is expressed as:

[0112]

[0113] It can also be written as:

[0114]

[0115] Regenerate token content:

[0116]

[0117] Update the generated content z, z=(z1,z2,z3…z L ), where z i Represents the i-th token in the sequence:

[0118]

[0119] This process continues until the maximum number of generated words is reached or the sentence generation is completed. The final generated content This is an example of a privacy-preserving contextual demonstration.

[0120] S3, model reasoning stage: During the reasoning process of the large language model, the privacy-protected context examples are concatenated with the user's input content to form an input with prompts, which is then input into the large language model for prediction and reasoning to obtain the prediction reasoning results.

[0121] Specifically,

[0122] In this stage, the privacy-protected context example generated in step S2 is concatenated with the user's input content to form an input with prompts, which is then input into the "large language model after pre-training in step S1 and adaptive noise addition in step S2" for prediction and reasoning, thereby obtaining the prediction and reasoning results.

[0123] Differential privacy technology is used in steps S1 and S2, so that the model itself does not remember private information and the input with prompts does not contain private information. This ensures that "even in the output results, it is difficult for attackers to exploit to obtain sensitive information", thereby improving the security of the entire model reasoning process.

[0124] In this embodiment, the overall process of step S3 is as follows:

[0125] The model presents a series of privacy-preserving contextual demonstration examples Combine to generate the final contextual presentation It is concatenated with the user input and put into the model for inference to obtain:

[0126] output = LLM(·|Z, input)

[0127] Next, we will explain the privacy guarantee brought about by the introduction of differential privacy.

[0128] First, let’s introduce the definition of differential privacy:

[0129] (∈,δ)-DP is defined as: for any two adjacent data sets D and D' (the two have only one data point different) and all possible outputs O, we have:

[0130]

[0131] in Represents the model algorithm after adding noise.

[0132] The Gaussian mechanism achieves differential privacy by adding Gaussian noise to sensitive data. In this mechanism, the standard deviation of the noise σ ICL There is the following relationship between the privacy parameter ∈,δ:

[0133] For a given dataset sensitivity Δ, the condition for the Gaussian mechanism to ensure (∈,δ)-DP is

[0134]

[0135] In the model pre-training stage, the overall privacy budget ∈ can be obtained as:

[0136]

[0137] In the stage of generating privacy-preserving contextual demonstration examples, the overall privacy budget ∈ can be obtained as:

[0138]

[0139] where σ i Indicates the standard deviation of the noise added to each token according to the part of speech.

[0140] The following is an introduction to the overall technical concept of the context learning method of this embodiment:

[0141] Before context learning is performed in the system, the pre-training of the large language model must be completed first.

[0142] The dataset used in the pre-training phase is denoted as The large language model obtained after training is denoted as LMM(·|·).

[0143] The privacy protection of training data is also taken into consideration in the pre-training stage, and an adaptive Gaussian noise strategy is adopted.

[0144] Considering that adding noise of the same scale to the gradient update of each round of training may cause gradient loss, we choose to dynamically adjust the noise scale according to the change of training error. When the error change increases, the noise scale will decrease; when the error change decreases, the noise scale will increase, thereby minimizing the gradient distortion.

[0145] Then, the pre-trained model is used to generate privacy-preserving context examples in the specified format. The instructions describing the specific format are recorded as instruction, and the generated privacy-preserving context examples are recorded as z (whose initial state is empty). In this process, considering that words of different parts of speech can provide different privacy information, a strategy of adding noise adaptively according to the part of speech is adopted, where σ represents the noise scaling factor. Large-scale noise is added to nouns with high privacy information (including numeric nouns such as certificate numbers), medium-scale noise is added to verbs, adjectives, and numerals with medium privacy information, and small-scale noise is added to other parts of speech with less privacy information.

[0146] Finally, in the model inference phase, the generated contextual examples with privacy protection are combined with the questions to be queried, and the input with prompts is put into the language model for prediction.

[0147] In the contextual learning method of this embodiment, a contextual learning method combined with differential privacy is adopted, and the scale of added noise is dynamically adjusted through an adaptive noise adding strategy. In this way, the impact on model performance can be reduced while protecting privacy, ultimately achieving the technical effect of enhancing privacy protection and optimizing model performance.

[0148] In the contextual learning method of this embodiment, an adaptive Gaussian noise addition strategy is introduced in the model pre-training stage, and the noise scale is dynamically adjusted according to the training error. In this way, the need for privacy protection can be taken into account in the pre-training process, and the model performance loss caused by noise addition can be reduced, ultimately achieving the technical effect of building a privacy protection mechanism in the model pre-training stage.

[0149] In the context learning method of this embodiment, the technical means of Token generation and part-of-speech discrimination are adopted in the process of generating context examples with privacy protection. Noise of corresponding scale is added to the generated Token according to its part of speech. In this way, the privacy protection level of different words can be controlled more accurately, and finally the differentiated privacy protection technical effect of different words in the context examples is achieved.

[0150] In the context learning method of this embodiment, a technical means is adopted to combine the generated context examples with privacy protection with user input for model reasoning. In this way, effective context learning can be performed while ensuring privacy, and ultimately the technical effect of avoiding the leakage of privacy information due to prompt word injection attacks in the model reasoning stage is achieved.

[0151] In the contextual learning method of this embodiment, a technical means is adopted to calculate the overall privacy budget and ensure that each step of noise addition meets the differential privacy requirements. In this way, it can ensure that the algorithm meets the privacy protection standards throughout the contextual learning process, and ultimately achieve the technical effect of ensuring the privacy compliance of the algorithm and enhancing user trust.

[0152] The above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A contextual learning method for protecting data privacy, characterized by: The context learning method comprises: During the pre-training of large language models, adaptive noise is applied to the gradients of the training data. According to the pre-trained large language model and the specified format instructions, the context examples are constructed token by token. In the process of constructing the context examples, adaptive noise processing is implemented when the token is generated. During the large language model inference process, the privacy-preserving context examples are concatenated with the user's input content to form an input with prompts, which is then input into the large language model for prediction and inference to obtain the prediction and inference results.

2. The context learning method for protecting data privacy according to claim 1, characterized in that: In the process of pre-training the large language model, the gradient of the training data is subjected to adaptive noise processing, and the specific implementation method thereof includes: During the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of training data, and the gradient distortion is minimized according to the changes in training error by dynamically adjusting the noise scale.

3. The context learning method for protecting data privacy according to claim 2, characterized in that: Differential privacy technology is used when implementing adaptive noise processing on the gradients of training data.

4. The context learning method for protecting data privacy according to claim 3, characterized in that: When implementing adaptive noise processing on the gradient of training data, when using differential privacy technology, the standard deviation σ of the added noise will be based on the loss value of each round of training For adaptive adjustment, the calculation formula of the standard deviation σ is: In the formula, σ0 is the initial noise standard deviation, and λ represents the influence of training loss on the noise standard deviation.

5. The context learning method for protecting data privacy according to claim 1, characterized in that: In the process of constructing the context generation example, adaptive noise processing is implemented when the token is generated, and the specific implementation method includes: S21, specifying the context example format to be generated for the large language model, and the large language model generates the next Token according to the specified context example format and the already generated content, and records the generation probability distribution of the Token; S22, performing part-of-speech analysis on the generated Token, and then adding Gaussian noise of corresponding scale to the generation probability distribution of the Token according to a pre-defined noise adding strategy, and obtaining a noisy Token after regeneration; S23, concatenating the noisy Token with the generated context content to update the generated context content; S24, repeating the above steps S21 to S23 until a context example that meets the conditions is generated.

6. The context learning method for protecting data privacy according to claim 5, characterized in that: Differential privacy technology is used when implementing adaptive noise processing in Token generation.

7. The context learning method for protecting data privacy according to claim 6, characterized in that: The noise adding strategy includes: Add large-scale noise to nouns; Add medium-scale noise to verbs, adjectives, and numerals; Add small-scale noise to words of other parts of speech.

8. The context learning method for protecting data privacy according to claim 1, characterized in that: The context example with privacy protection is concatenated with the user's input content to form an input with prompts, which is input into the large language model for prediction and reasoning, thereby obtaining a prediction and reasoning result. The specific implementation method includes: The large language model will present a series of privacy-preserving contextual demonstration examples Combine to generate the final contextual presentation It is concatenated with the user input and put into the large language model for inference to obtain: output=LLM(·|Z,input) Next, we will explain the privacy guarantee brought by the introduction of differential privacy; First, let’s introduce the definition of differential privacy: (∈,δ)-DP is defined as for any two adjacent data sets D and D' (the two have only one data point different) and all possible outputs O, we have: in Represents the large language model algorithm after adding noise; The Gaussian mechanism achieves differential privacy by adding Gaussian noise to sensitive data. In this mechanism, the standard deviation of the noise σ ICL There is the following relationship between the privacy parameter ∈,δ: For a given dataset sensitivity Δ, the condition for the Gaussian mechanism to ensure (∈,δ)-DP is In the pre-training stage of the large language model, the overall privacy budget ∈ can be obtained as: In the stage of generating privacy-preserving contextual demonstration examples, the overall privacy budget ∈ can be obtained as: where σ i Indicates the standard deviation of the noise added to each token according to the part of speech.

Images