Contextual learning method for protecting data privacy

Abstract

The application discloses a context learning method for protecting data privacy. The context learning method comprises the following steps: in the pre-training process of a large language model, adaptive noise addition is performed on the gradient of training data; according to the large language model obtained through pre-training and specified format instructions, a generated context example is constructed token by token, and in the process of constructing the generated context example, adaptive noise addition is performed when a token is generated; in the inference process of the large language model, the context example with privacy protection is spliced with input content of a user to form an input with a prompt, and the input is input into the large language model for prediction and inference. In the context learning method, the scale of added noise is dynamically adjusted through an adaptive noise addition strategy, so that the influence on the performance of the model can be reduced while the privacy is protected, and finally the technical effects of enhancing privacy protection and optimizing the performance of the model are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to a large language model learning method, in particular to a context learning method for protecting data privacy. BACKGROUND

[0002] In the current digital era, artificial intelligence technology plays an important role in various industries. Large language models (LLMs) have become a remarkable technology due to their excellent language generation capabilities. These large language models are developed based on pre-trained language models (PLMs), and their performance has been improved thanks to the significant growth of data volume and computing power in the information age. Large language models have shown great potential in natural language understanding and generation tasks.

[0003] Context learning (ICL) is a branch of research on large language models that allows the model to solve new problems by providing a small number of examples without any adjustment to the model weights. The key to this learning method is to learn from analogy by constructing a context demonstration and combining it with a query problem to form an input with a prompt, and then making a model prediction.

[0004] The current problem is that:

[0005] 1) Although context learning provides a low-cost fine-tuning training solution, it also has some risks of privacy leakage. Attackers may induce the model to output the content of the context example through prompt injection attacks, leading to the leakage of private information in the example. In today's growing emphasis on personal privacy security, this privacy leakage problem cannot be ignored.

[0006] 2) Although differential privacy (DP) is considered the gold standard for protecting personal privacy, the noise addition process may reduce the accuracy of the model. How to protect privacy while minimizing the impact on model performance is a challenge faced by existing technologies.

[0007] In order to solve the above problems, a solution is needed that can effectively protect privacy while maintaining or improving model performance. SUMMARY

[0008] The purpose of the present application is to provide a context learning method for protecting data privacy, which can reduce the impact on model performance while protecting privacy.

[0009] In order to achieve the above technical purpose, the present application adopts the following technical solutions:

[0010] A context learning method for protecting data privacy, the context learning method comprising:

[0011] In the pre-training process of the large language model, adaptive noise is added to the gradient of the training data;

[0012] According to the pre-trained large language model and the specified format instruction, a Token is generated to construct a generation context example, and in the process of constructing the generation context example, adaptive noise is added to the Token generation;

[0013] In the inference process of the large language model, the context example with privacy protection is combined with the input content of the user to form an input with a prompt, which is input into the large language model for prediction and inference, so as to obtain the prediction and inference result.

[0014] Further, the adaptive noise is added to the gradient of the training data in the pre-training process of the large language model, and the specific implementation method includes:

[0015] In the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of the training data, and by dynamically adjusting the noise scale, the gradient distortion is minimized according to the change of the training error.

[0016] Further, when the adaptive noise is added to the gradient of the training data, the differential privacy technology is used.

[0017] Further, when the adaptive noise is added to the gradient of the training data, the differential privacy technology is used, and the standard deviation σ of the added noise will be adjusted according to the loss value of each training round. The calculation formula of the standard deviation σ is:

[0018]

[0019] In the formula, σ0 is the initial noise standard deviation, and λ represents the influence degree of the training loss on the noise standard deviation.

[0020] Further, the adaptive noise is added to the Token generation in the process of constructing the generation context example, and the specific implementation method includes:

[0021] S21, the large language model is specified to generate a context example format, and the large language model generates the next Token according to the specified context example format and the generated content, and records the generation probability distribution of the Token;

[0022] S22, the generated Token is analyzed for part of speech, and then the noise adding strategy is added to the generated probability distribution of the Token to add Gaussian noise of a corresponding scale, and the Token after regeneration is obtained;

[0023] S23, concatenate the noisy Token with the already generated context content, update the already generated context content;

[0024] S24, repeat the above steps S21 to S23 until the context example that meets the condition is generated.

[0025] Further, when the Token generation implements adaptive noise processing, differential privacy technology is adopted.

[0026] Further, the noise adding strategy includes:

[0027] Adding large-scale noise to nouns;

[0028] Adding medium-scale noise to verbs, adjectives and numerals;

[0029] Adding small-scale noise to words of other parts of speech.

[0030] Further, the context example with privacy protection is spliced and combined with the input content of the user to form an input with a prompt, which is input into a large language model for prediction and reasoning, so as to obtain a prediction and reasoning result, and the specific implementation method includes:

[0031] The large language model combines a series of context demonstration examples with privacy protection to generate the final context demonstration Spliced with the user input input, put into the large language model for reasoning to obtain:

[0032] output=LLM(·|Z, input)

[0033] Next, the privacy guarantee brought about by the introduction of differential privacy is described.

[0034] First, the definition of differential privacy is introduced:

[0035] The (∈, δ)-DP is defined as for any two adjacent data sets D and D' (only one data point is different) and all possible outputs O, there are:

[0036]

[0037] where represents the large language model algorithm after adding noise;

[0038] The Gaussian mechanism realizes differential privacy by adding Gaussian noise to sensitive data. In this mechanism, the standard deviation σ ICL There is a relationship between the privacy parameter ∈, δ and the following:

[0039] For a given data set sensitivity Δ, the condition for the Gaussian mechanism to guarantee (ε, δ)-DP is

[0040]

[0041] In the large language model pre-training stage, the overall privacy budget ε obtained is:

[0042]

[0043] In the context demonstration example generation stage with privacy protection, the overall privacy budget ε obtained is:

[0044]

[0045] Where σ i represents the standard deviation of the noise added according to the part of speech of each token.

[0046] The context learning method of the present application has the beneficial effects that:

[0047] In the context learning method of the present application, a context learning method combined with differential privacy is adopted, and the scale of adding noise is dynamically adjusted through an adaptive noise adding strategy, so that the privacy can be protected while reducing the impact on the model performance, and finally the technical effects of enhancing privacy protection and optimizing model performance are realized. BRIEF DESCRIPTION OF DRAWINGS

[0048] Fig. 1 The left half is the overall architecture of the large language model, and the right half is the architecture of the context example generation.

[0049] Fig. 2 The algorithm pseudocode of the context learning method of the present application is shown in the following table:

[0050] Fig. 3 The algorithm flowchart of the context learning method of the present application is shown in the following table: DETAILED DESCRIPTION

[0051] The present application will be further described below with specific embodiments:

[0052] The present application provides a context learning method for protecting data privacy, which can protect privacy while reducing the impact on model performance.

[0053] Before specifically introducing the context learning method of the present application, some related prior art knowledge will be described (which can be understood as prior knowledge):

[0054] In-context learning (ICL) is a task-adaptive learning method that does not rely on model parameter adjustment, and the key idea is to learn from analogy. In-context learning constructs a context demonstration by "combining task-related examples", and then connects the question to be queried with this context demonstration to form a prompt-containing input, which is input into the language model for prediction. This method provides an effective and simple cross-task generalization method for model training, and through the knowledge obtained by "model pre-training", the model can quickly adapt to new domains or concepts with a small amount of examples.

[0055] The context demonstration in traditional in-context learning is written in natural language, and when there is user information in the example content, there is a privacy problem.

[0056] A malicious attacker can obtain the content of the context demonstration through a prompt injection attack, at which time the user information that has not been encrypted is leaked.

[0057] Based on the current technical means, differential privacy technology can be introduced to add noise to the data to generate a context demonstration with privacy protection, thereby effectively preventing privacy leakage.

[0058] However, after adding noise to the context demonstration, it will interfere with the model's understanding and processing of the data to some extent, which will affect the performance of the model.

[0059] As can be understood by those skilled in the art, the scale of the noise determines the degree of its impact on the performance of the model, and different parts of speech have different privacy information, which means that different scales of noise can be added to different parts of speech. The part of speech determines the function and usage of the word in the sentence, thereby affecting the amount and nature of the information it carries. Nouns can directly point to specific people, places or things, and usually contain a large amount of privacy information, so a large scale of noise needs to be added. It should be noted here that the certificate number, as a unique identifier, is also classified as a noun; verbs, adjectives and numerals, which do not leak privacy information themselves, may leak information when combined with other words, and contain a moderate amount of privacy information, so a moderate scale of noise needs to be added; other parts of speech (such as adverbs) do not leak privacy information themselves, but indirectly affect the amount of information, have less privacy information, and only need to add a small scale of noise.

[0060] It should be noted that in the present embodiment, all the added noise mentioned is Gaussian noise, and its formula is:

[0061]

[0062] In the formula, σ represents the standard deviation of the noise, and I represents the identity matrix, represents a mean of 0 and a covariance matrix of 2 I multivariate normal distribution.

[0063] Referring to Figs. 1 to 3 In the context of the present embodiment, the context learning method mainly includes three major steps, i.e., steps S1 to S3, which can also be referred to as three major stages.

[0064] S1, model pre-training stage: adaptive noise is added to the gradient of the training data during the pre-training of the large language model.

[0065] Specifically,

[0066] In this model pre-training stage, a large language model for a training object is pre-trained using a large-scale data set as training data to obtain a pre-trained large language model. In the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of the training data. Furthermore, by dynamically adjusting the noise scale, the gradient distortion is minimized according to the change of the training error, thereby laying a foundation for subsequent context learning.

[0067] That is, in step S1, the Gaussian noise strategy used is "noise addition according to training error (training loss value)".

[0068] In this step S1, when adaptive noise is added to the gradient of the training data, differential privacy technology is used. The standard deviation σ of the added noise will be adaptively adjusted according to the loss value of each round of training The calculation formula of the standard deviation σ is as follows:

[0069]

[0070] In the formula, σ0 is the initial noise standard deviation, and λ represents the influence degree of the training loss on the noise standard deviation.

[0071] The complete process of this step S1 is as follows:

[0072] The large language model first calculates the gradient g

[0073]

[0074] of each data sample according to the formula i ,

[0075] In the formula, θ represents the model parameters, represents the loss function, x i represents the training data, and y i represents the data label.

[0076] To further improve the stability of training and limit the contribution of each sample to the gradient, the sensitivity of the gradient is controlled by gradient clipping, and a fixed threshold is set as

[0077]

[0078] where ||g i ||2 represents the L2 norm of the gradient, and the calculation formula is:

[0079]

[0080] Then the gradients of all samples are aggregated and Gaussian noise is added to obtain the gradient g:

[0081]

[0082] Finally, the parameter update of the model is performed, where η represents the learning rate of the model:

[0083] θ' = θ - ηg

[0084] The pre-trained large language model is denoted as LMM(·|·).

[0085] S2, context example generation phase with privacy protection: according to the pre-trained large language model and the specified format instruction, the context examples are constructed Token by Token. During the construction of the context examples, adaptive noise processing is implemented when generating the Token.

[0086] It should be noted that the "context examples are constructed Token by Token" mentioned earlier means that the generation of context examples requires multiple rounds of iterative training, and each round of iterative training will produce a Token.

[0087] The process of "constructing context examples Token by Token" is common knowledge to those skilled in the art.

[0088] Specifically,

[0089] In this phase, Tokens are generated according to the pre-trained large language model obtained in step S1 and the specified format instruction, and part-of-speech discrimination is performed to determine the amount of privacy information of different parts of speech, and then noise of corresponding scales is added according to different parts of speech. Through the iterative process, the noise-added Token is concatenated with the existing context content to form a complete context example with privacy protection.

[0090] It should be noted that when the adaptive noise processing is implemented during Token generation, differential privacy technology is also used.

[0091] In this embodiment, step S2 specifically includes steps S21 to S12:

[0092] S21, Token generation.

[0093] Specifically,

[0094] The pre-trained large language model obtained in step S1 is specified with a context example format that needs to be generated, and the pre-trained large language model then generates the next Token according to the "specified context example format" and the "already generated content", and records the generation probability distribution of the Token, thereby laying a foundation for subsequent context learning.

[0095] S22, for the Token generated in step S21, the Token is analyzed for part of speech, and then the corresponding scale of Gaussian noise is added to the probability distribution of the Token according to the pre-prepared noise addition strategy, and the Token is regenerated to obtain the noisy Token; in this way, the differential protection of private information can be realized.

[0096] The pre-prepared noise addition strategy includes:

[0097] A large scale of noise is added to the noun, specifically, the noise standard deviation σ ICL ∈[0.3,0.5];

[0098] A medium scale of noise is added to the verb, adjective and numeral, specifically, the noise standard deviation σ ICL ∈[0.1,0.3];

[0099] A small scale of noise is added to the words of other parts of speech except nouns, verbs, adjectives and numerals, specifically, the noise standard deviation σ ICL ∈[0.01,0.1].

[0100] S23, for the noisy Token obtained in step S22, the noisy Token is concatenated with the already generated context content, the already generated context content is updated, and preparation is made for generating the next Token.

[0101] S24, repeat the above steps S21 to S23 until a context example that meets the conditions is generated.

[0102] The "meets the conditions" described herein refers to "the pre-trained large language model reaches the limit of the maximum number of generated words (Token number), or has completed generation (i.e., the generated token is a terminator)".

[0103] At this point, the generated context example is a context example with privacy protection.

[0104] In the embodiment, the overall process of step S2 is as follows:

[0105] The model records the generated content as z, and z is initially empty. In each round of token generation, the next token x is generated according to the generated content z and the task instruction description instruction. i And record its generation probability distribution p i :

[0106] x i = LLM(·|instruction, z)

[0107] The generated Token is subjected to part-of-speech identification, and corresponding noise scales are set according to different parts of speech. Specifically:

[0108] For nouns, a large-scale noise is added, and the noise standard deviation σ ICL ∈ [0.3, 0.5]

[0109] For verbs, adjectives, and numerals, a medium-scale noise is added, and the noise standard deviation σ ICL ∈ [0.1, 0.3]

[0110] For other words, a small-scale noise is added, and the noise standard deviation σ ICL ∈ [0.01, 0.1]

[0111] σ ICL According to the size of the privacy budget, the specific value is determined, and the probability distribution of the Token after adding Gaussian noise is represented as:

[0112]

[0113] It can also be recorded as:

[0114]

[0115] The content of the regenerated token is:

[0116]

[0117] Update the generated content z, z = (z1, z2, z3…z L ), where z i represents the i-th token in the sequence:

[0118]

[0119] This process continues until the maximum number of generated characters is reached or the sentence generation is completed, and the finally generated content is the context demonstration example with privacy protection.

[0120] S3, model inference stage: in the large language model inference process, the context example with privacy protection is spliced and combined with the input content of the user to form an input with a prompt, which is input into the large language model for prediction and inference, so as to obtain the prediction and inference result.

[0121] Specifically,

[0122] In this stage, the context example with privacy protection generated in step S2 is spliced and combined with the input content of the user to form an input with a prompt, which is then input into the "large language model after pre-training in step S1 and adaptive noise addition in step S2" for prediction and inference, so as to obtain the prediction and inference result.

[0123] In the two stages of steps S1 and S2, differential privacy technology is used, so that the model itself does not remember the privacy information and the input with a prompt does not contain privacy information, so as to ensure that "even in the output result, it is difficult for attackers to use to obtain sensitive information", thereby improving the security of the entire model inference process.

[0124] In this embodiment, the overall process of step S3 is as follows:

[0125] The model combines a series of context demonstration examples with privacy protection to generate the final context demonstration Splice with user input input, put into the model for inference to get:

[0126] output=LLM(·|Z,input)

[0127] Next, the privacy guarantee brought about by the introduction of differential privacy is described.

[0128] First, the definition of differential privacy is introduced:

[0129] (∈,δ)-DP is defined as for any two adjacent data sets D and D'(only one data point is different) and all possible outputs O, there is:

[0130]

[0131] where represents the model algorithm after adding noise.

[0132] The Gaussian mechanism realizes differential privacy by adding Gaussian noise to sensitive data. In this mechanism, the standard deviation σ ICL There is the following relationship between the privacy parameter ∈,δ:

[0133] For a given data set sensitivity Δ, the Gaussian mechanism guarantees the condition of (ε, δ)-DP is

[0134]

[0135] In the model pre-training stage, the overall privacy budget ε is obtained as:

[0136]

[0137] In the generation of context demonstration examples with privacy protection, the overall privacy budget ε is obtained as:

[0138]

[0139] where σ i represents the standard deviation of noise added to each token according to the part of speech.

[0140] The following introduces the overall technical concept of the context learning method of the embodiment:

[0141] Before performing context learning in the system, the pre-training work of the large language model is completed.

[0142] The data set used in the pre-training stage is denoted as The large language model obtained after training is denoted as LMM(·|·).

[0143] In the pre-training stage, privacy protection of the training data is also considered, and an adaptive Gaussian noise addition strategy is adopted.

[0144] Considering that adding noise of the same scale to each round of gradient update may cause gradient loss, the noise scale is dynamically adjusted according to the change of training error. When the error change increases, the noise scale will decrease; when the error change decreases, the noise scale will increase, thereby minimizing the gradient distortion.

[0145] Then, the pre-trained model is used to generate context examples with privacy protection according to the specified format. The instructions describing the specific format are denoted as instruction, and the generated context examples with privacy protection are denoted as z (its initial state is empty). In this process, considering that different parts of speech can provide different amounts of privacy information, an adaptive noise addition strategy according to the part of speech is adopted, where σ represents the scaling factor of noise. Large-scale noise is added to nouns (including digital nouns such as ID numbers) with high privacy information, medium-scale noise is added to verbs, adjectives, and numerals with medium privacy information, and small-scale noise is added to other words with less privacy information.

[0146] Finally, in the model inference stage, the generated context examples with privacy protection are combined with the question to be queried to obtain an input with a prompt, which is put into the language model for prediction.

[0147] In the context learning method of the embodiment, a context learning method combined with differential privacy is adopted, and the scale of added noise is dynamically adjusted by an adaptive noise adding strategy, so that the influence on the model performance can be reduced while protecting privacy, and finally the technical effects of enhancing privacy protection and optimizing model performance are realized.

[0148] In the context learning method of the embodiment, an adaptive Gaussian noise adding strategy is introduced in the model pre-training stage, and the noise scale is dynamically adjusted according to the training error, so that the demand for privacy protection can be considered in the pre-training process, and the model performance loss caused by noise addition can be reduced, and finally the technical effect of starting to build a privacy protection mechanism in the model pre-training stage is realized.

[0149] In the context learning method of the embodiment, the technical means of Token generation and part-of-speech discrimination are adopted in the process of generating context examples with privacy protection, and noise of a corresponding scale is added to the generated Token according to its part of speech, so that the privacy protection level of different words can be more accurately controlled, and finally the technical effect of differentiated privacy protection of different words in the context example is realized.

[0150] In the context learning method of the embodiment, the technical means of combining the generated context examples with privacy protection with user input for model inference is adopted, so that effective context learning can be performed while ensuring privacy, and finally the technical effect of avoiding prompt word injection attacks to cause privacy information leakage in the model inference stage is realized.

[0151] In the context learning method of the embodiment, the technical means of calculating the overall privacy budget and ensuring that each step of noise addition meets the differential privacy requirement is adopted, so that the algorithm can meet the privacy protection standard in the entire context learning process, and finally the technical effect of ensuring the privacy compliance of the algorithm and enhancing user trust is realized.

[0152] The above is only a preferred embodiment of the present application, and is not used to limit the protection scope of the present application, therefore, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A contextual learning method for protecting data privacy, characterized by: The context learning method includes: During the pre-training of large language models, adaptive noise processing is performed on the gradients of the training data; Based on the pre-trained large language model and the specified format instructions, the generated context examples are constructed token by token. In the process of constructing the generated context examples, adaptive noise processing is implemented when the token is generated. During the large language model inference process, the privacy-protected context examples are concatenated with the user's input content to form an input with prompts, which is then input into the large language model for prediction and inference, thereby obtaining the predicted inference results.

2. The contextual learning method for protecting data privacy according to claim 1, characterized in that: In the process of pre-training the large language model, adaptive noise processing is performed on the gradient of the training data, and the specific implementation method includes: During the pre-training process, an adaptive Gaussian noise strategy is introduced to protect the privacy of training data, and the gradient distortion is minimized according to the change of training error by dynamically adjusting the noise scale.

3. The contextual learning method for protecting data privacy according to claim 2, characterized in that: Differential privacy technology is used when implementing adaptive noise processing on the gradient of training data.

4. The contextual learning method for protecting data privacy according to claim 3, characterized in that: When implementing adaptive noise processing on the gradient of training data, when using differential privacy technology, the standard deviation σ of the added noise will be based on the loss value of each round of training. For adaptive adjustment, the calculation formula of the standard deviation σ is: Where σ0 is the initial noise standard deviation, and λ represents the influence of training loss on the noise standard deviation.

5. The contextual learning method for protecting data privacy according to claim 1, characterized in that: In the process of constructing the context generation example, adaptive noise processing is implemented when the token is generated. The specific implementation method includes: S21, specify the context example format to be generated for the large language model. The large language model generates the next token based on the specified context example format and the already generated content, and records the probability distribution of the token generation; S22, performing part-of-speech analysis on the generated token, and then adding Gaussian noise of corresponding scale to the generation probability distribution of the token according to a pre-defined noise addition strategy, and regenerating the noisy token; S23, concatenate the noisy token with the generated context content to update the generated context content; S24, repeating the above steps S21 to S23 until a context example that meets the conditions is generated.

6. The contextual learning method for protecting data privacy according to claim 5, characterized in that: Differential privacy technology is used when implementing adaptive noise processing in token generation.

7. The contextual learning method for protecting data privacy according to claim 6, characterized in that: The noise addition strategy includes: Add large-scale noise to nouns; Add medium-scale noise to verbs, adjectives, and numerals; Add small-scale noise to words of other parts of speech.

8. The contextual learning method for protecting data privacy according to claim 1, characterized in that: The privacy-preserving context example is combined with the user's input content to form a prompt input, which is input into the large language model for prediction and inference, thereby obtaining a prediction and inference result. The specific implementation method includes: The large language model will present a series of privacy-preserving contextual demonstration examples Combine to generate the final contextual presentation It is concatenated with the user input and put into the large language model for inference to obtain: output=LLM(·|Z,input) Next, we will explain the privacy guarantees brought about by the introduction of differential privacy; First, let’s introduce the definition of differential privacy: (∈,δ)-DP is defined as for any two adjacent data sets D and D' and all possible outputs O, we have: in Represents the large language model algorithm after adding noise; The Gaussian mechanism achieves differential privacy by adding Gaussian noise to sensitive data, where the standard deviation of the noise σ ICL There is the following relationship between it and the privacy parameter ∈,δ: For a given dataset sensitivity Δ, the condition for the Gaussian mechanism to guarantee (∈,δ)-DP is During the large language model pre-training phase, the overall privacy budget ∈ can be obtained as: In the stage of generating privacy-preserving contextual demonstration examples, the overall privacy budget ∈ can be obtained as: where σ i Indicates the standard deviation of the noise added to each token according to the part of speech.

Images