A privacy attack prevention method and device using hidden state filtering

Abstract

This specification discloses a method and apparatus for preventing privacy attacks using hidden state filtering, comprising: acquiring a request to be processed; and acquiring a vector t of k tags of the final decoder of a large language model based on the request to be processed. k Cascaded vector T k ; the concatenated vector T k The input is fed into a pre-trained lightweight classifier to obtain a hazard score. The pre-trained lightweight classifier is a multilayer perceptron, which includes an input layer, a hidden layer, and an output layer. The hidden layer includes a first hidden layer, a second hidden layer, and a third hidden layer. If the hazard score is greater than or equal to a preset threshold, the large language model refuses to generate a response to the request to be processed. If the hazard score is less than the preset threshold, the large language model responds to the request to be processed.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computers, and particularly relates to a privacy attack prevention method and device using hidden state filtering. BACKGROUND

[0002] With the rapid improvement of the capabilities of large language models (LLMs) such as ChatGPT, Llama, and Mistral, people are increasingly concerned about the security risks hidden behind their powerful functions, including potentially biased reports, inaccurate information, and the spread of harmful content. Therefore, an effective privacy attack prevention method for large models is crucial for the safe output of large models.

[0003] In the prior art, the defense strategies for large models mainly focus on instant rewriting or detection mechanisms, but these methods are severely challenged in the face of complex and variable privacy attacks. Privacy attacks can bypass existing alignment mechanisms through carefully designed prompts, inducing LLMs to output unsafe or harmful content. Instant rewriting and detection mechanisms often struggle to comprehensively cover all possible attack patterns, resulting in limited defense effectiveness. Some defense strategies focus on output control and detection, which rely on the reasoning process of LLMs, thus incurring high computational costs. They attempt to prevent the generation of unsafe content by controlling the decoder's generation process or detecting the final output after the LLM generates the output. However, a significant drawback of this approach is that they can only intervene after the reasoning process, which not only increases the computational burden but also may fail to timely prevent potential harm that has already been generated. At the same time, current defense methods also face the problems of limited defense range and interruption of benign prompts. For example, some rewriting or rephrasing strategies may fail to effectively distinguish between malicious prompts and benign prompts, resulting in interference with normal and legal input requests while defending against privacy attacks. This false positive and false interruption not only reduces user experience but also may affect the reliability and stability of LLMs in practical applications.

[0004] Based on this, the present specification provides a privacy attack prevention method and device using hidden state filtering. SUMMARY

[0005] The embodiments of the present specification provide a privacy attack prevention method and device using hidden state filtering, which solves the following technical problem: in the prior art, the fusion of multi-modal data generally uses machine learning methods for processing. This method generally uses shallow models and relies on a large amount of labeled data for supervised or semi-supervised training, thus often requiring a large amount of preprocessing and manual intervention, and being unable to generate missing data.

[0006] To solve the above technical problems, the embodiments of the present specification are implemented as follows:

[0007] The embodiment of the present specification provides a privacy attack prevention method using hidden state filtering, comprising:

[0008] obtaining a request to be processed;

[0009] based on the request to be processed, obtaining a concatenated vector T k of a vector t k of k tokens of a final decoder of a large language model k ;

[0010] inputting the concatenated vector T k into a pre-trained lightweight classifier to obtain a harmfulness score, the pre-trained lightweight classifier being a multi-layer perceptron, the multi-layer perceptron comprising: an input layer, a hidden layer, and an output layer, the hidden layer comprising: a first hidden layer, a second hidden layer, and a third hidden layer;

[0011] if the harmfulness score is greater than or equal to a preset threshold, the large language model refuses to generate a response to the request to be processed, and if the harmfulness score is less than the preset threshold, the large language model responds to the request to be processed.

[0012] The embodiment of the present specification also provides a privacy attack prevention device using hidden state filtering, comprising:

[0013] a request module, configured to obtain a request to be processed;

[0014] a concatenated vector obtaining module, configured to, based on the request to be processed, obtain a concatenated vector T k of a vector t k of k tokens of a final decoder of a large language model k ;

[0015] a harmfulness score calculation module, configured to input the concatenated vector T k into a pre-trained lightweight classifier to obtain a harmfulness score, the pre-trained lightweight classifier being a multi-layer perceptron, the multi-layer perceptron comprising: an input layer, a hidden layer, and an output layer, the hidden layer comprising: a first hidden layer, a second hidden layer, and a third hidden layer;

[0016] a response module, if the harmfulness score is greater than or equal to a preset threshold, the large language model refuses to generate a response to the request to be processed, and if the harmfulness score is less than the preset threshold, the large language model responds to the request to be processed.

[0017] The privacy attack prevention method using hidden state filtering provided by the embodiment of the present specification distinguishes different types of queries by using the hidden state representation of the large language model, and concatenates the vector t k of k tokens of the final decoder of the large language model to obtain a concatenated vector T kAs input, a preset lightweight classifier is used to achieve effective attack detection without significantly increasing the computational burden, thereby ensuring adaptation to different large language models and changing attack strategies. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0019] Figure 1 A flowchart of a privacy attack prevention method using hidden state filtering provided by an embodiment of the present specification;

[0020] Figure 2 A flowchart of a privacy attack prevention method using hidden state filtering provided by an embodiment of the present specification;

[0021] Figure 3 A framework diagram of a privacy attack prevention method using hidden state filtering provided by an embodiment of the present specification;

[0022] Figure 4 A schematic diagram of a privacy attack prevention device using hidden state filtering provided by an embodiment of the present specification;

[0023] Among them,

[0024] LLM represents a large language model;

[0025] User Input represents user input;

[0026] DecoderLayer represents a decoder layer;

[0027] hidden states represent hidden states;

[0028] last k tokens represent the last k tokens;

[0029] HiddenState Filter represents a hidden state filter;

[0030] harmfulness a scoreα represents a harmfulness scoreα;

[0031] threshold represents a threshold;

[0032] thresholdβ=0.5 represents a thresholdβ=0.5;

[0033] Safe response denotes a safe response;

[0034] Output denotes output. DETAILED DESCRIPTION

[0035] In order for those skilled in the art to better understand the technical solutions in the specification, the technical solutions in the specification will be clearly and completely described below in conjunction with the drawings in the specification. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments of the specification, all other embodiments obtained by those of ordinary skill in the art without creative labor should fall within the scope of protection of the present application.

[0036] In large language models, FT (supervised fine-tuning), RLHF (reinforcement learning based on human feedback) and other technical means are widely used to align these models safely and ensure their behavior conforms to the core values and preferences of human society for safety and reliability.

[0037] Although these alignment strategies give the model the ability to judge the safety of the input to some extent, LLMs still face the serious challenge of adversarial attacks. With the increasing popularity of LLMs in chat robots, content generation and other daily application scenarios, it becomes increasingly urgent to ensure that their output content conforms to human values and effectively avoids harmful information. However, complex and varied privacy attack methods continue to threaten the achievement of this goal, which aims to cleverly induce LLMs to produce unsafe output. It can be seen that the existing technology has significant shortcomings in defending against LLM privacy attacks, such as limited effectiveness, high computational cost, and limited defense range.

[0038] Based on this, the present application aims to propose a pre-reasoning, efficient and widely applicable privacy attack prevention method to ensure the safety and reliability of LLMs in chat robots and content generation and other daily applications.

[0039] Figure 1 A flowchart of a privacy attack prevention method using hidden state filtering provided by an embodiment of the specification. From a program perspective, the execution subject of the flow can be a program loaded on an application server or an application terminal. It can be understood that this method can be executed by any device, equipment, platform, device cluster with computing and processing capabilities. As shown, the method comprises: Figure 1

[0040] Step S101: Obtain a request to be processed.

[0041] ​In the embodiments of the present specification, the request to be processed is a request for querying sent by a user to a large language model based on a terminal device. Specifically, the terminal device is any computing device with computing power, such as various computer devices / systems, terminal devices, servers, etc. The terminal device can involve any type of mobile terminal, fixed terminal or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. The server includes but is not limited to mainframes, edge computing nodes, computing devices in cloud environments, etc.

[0042] In the embodiments of the present specification, the request to be processed is a request sent by a user to a large language model.

[0043] Step S103: based on the request to be processed, obtaining a concatenated vector T of the k tokens of the final decoder of the large language model k . k .

[0044] A large language model (LLM for short) refers to a deep learning model trained using a large amount of text data, which can generate natural language text or understand the meaning of language text. Large language models can handle a variety of natural language tasks such as text classification, question answering, dialogue, etc., and are an important way to artificial intelligence.

[0045] When querying using a large language model, there may be a situation of generating harmful or inappropriate content. Even if the large language model is aligned by the model, the large language model may still be subject to adversarial attacks, such as adding specific meaningless tokens to prompt the large language model to generate harmful content, and the embodiments of the present specification are directed to this situation.

[0046] Therefore, in the embodiments of the present specification, the large language model is an aligned model. The field involved in the aligned model can be external alignment, internal alignment, or explainability alignment. Further, the manner of external alignment, internal alignment, or explainability alignment is not specifically limited here.

[0047] In the embodiments of the present specification, the large language model is a decoder model or an encoder-decoder model. Specifically, the large language model can be ChatGPT, and / or Llama, and / or Mistral. Specifically, the specific type of large language model does not constitute a limitation on the present application.

[0048] In large language models, the hidden states intuitively collect all the information about the model's understanding of the query and its response strategy, which are also projected through the language modeling head (linear mapping) to predict the next token, which means that they present a linear structure in the corresponding representation space (as assumed by PCA). Therefore, through the data of the hidden states, the most important features related to the harmfulness of the query can be extracted.

[0049] In the embodiments of the present specification, the large language model is a to-be-defended model, that is, a large language model that needs to be protected from privacy attacks.

[0050] For the convenience of understanding the method provided by the embodiments of the present specification, a language model with a 7B parameter order is taken as an example, and Llama2-7B-chat is specifically taken as an example.

[0051] In the embodiments of the present specification, the k token vectors t k of the final decoder of the large language model are obtained based on the to-be-processed request k , and specifically include:

[0052] inputting the to-be-processed request into the large language model and performing forward transmission to generate a hidden state corresponding to the to-be-processed request;

[0053] obtaining k token vectors t k corresponding to the last k tokens from the hidden state corresponding to the to-be-processed request based on the last decoder layer of the large language model;

[0054] connecting the k token vectors t k in the original order and filling zero vectors between each two vectors to form the concatenated vector T k .

[0055] In the embodiments of the present specification, the k token vectors t k ∈R n×k , R n×k represents an n*k-dimensional matrix. Let t1, t2,..,t k be vectors corresponding to the last k tokens, where t i ∈R n .

[0056] In the embodiments of the present specification, the vector T k is defined as:

[0057] T k =[t k ,0,t2,0,...,0,t1],(1)

[0058] where 0∈Rn denotes a zero vector of length n.

[0059] In the embodiments of the present specification, the k marked vectors t k The value of k depends on the output dimension of the hidden state of the large language model.

[0060] Continuing the previous example, when the large language model is Llama2-7B-chat, the value of k is k∈{1,2, …, 8}.

[0061] As a hyperparameter, k changes in value with different large language models.

[0062] Determining the hyperparameter k can help capture sufficient context information on the one hand, and maintain computational efficiency on the other hand, so the determination of the hyperparameter k is of great significance.

[0063] In the embodiments of the present specification, the model to be defended is a model that needs to be defended, specifically, a large language model that needs to be defended.

[0064] In the embodiments of the present specification, the k marked vectors t k of the final decoder of the large language model are obtained by a marker. In one embodiment, the marker is a Llama2-7B-chat marker. Of course, other markers can also be selected, and the specific type of the marker does not constitute a limitation on the present application.

[0065] Step S105: inputting the concatenated vector T k to a pre-trained lightweight classifier to obtain a harmfulness score, the pre-trained lightweight classifier being a multilayer perceptron, the multilayer perceptron including an input layer, a hidden layer, and an output layer, the hidden layer including a first hidden layer, a second hidden layer, and a third hidden layer.

[0066] The multilayer perceptron (MLP, Multilayer Perceptron) is a kind of feedforward artificial neural network model, which maps multiple input data sets to a single output data set.

[0067] In the multilayer perceptron, the input layer is used to receive original data features as input, and each input neuron corresponds to a feature. In the embodiments of the present specification, the input of the input layer is the concatenated vector T k .

[0068] The hidden layer is located between the input layer and the output layer, and the hidden layer can capture the mutual relationship between the data in the input layer. In the embodiment of the present specification, the hidden layer includes a first hidden layer, a second hidden layer and a third hidden layer. Among them, the node number of the first hidden layer is 1024, the node number of the second hidden layer is 64, and the node number of the third hidden layer is 1.

[0069] In the embodiment of the present specification, the loss function of the pre-trained lightweight classifier is a binary cross-entropy loss function.

[0070] The expression of the binary cross-entropy loss function is:

[0071] L k (θ)=-llog(σ(f k (T k )))-(1-l)log(1-σ(f k (T k ))

[0072] Among them,

[0073] L k (θ) represents the binary cross-entropy loss function.

[0074] l∈{0,1} is a binary label indicating whether the query is safe;

[0075] σ represents a sigmoid function;

[0076] f k represents a function of reducing an n*k-dimensional matrix to a scalar;

[0077] T k represents a concatenated vector.

[0078] In the embodiment of the present specification, the activation function of the hidden layer is a ReLU activation function, and the activation function of the output layer is a sigmoid function.

[0079] In the embodiment of the present specification, the hidden layer prevents overfitting through dropout regularization;

[0080] The expression of the dropout regularization is:

[0081]

[0082] Among them,

[0083] f k represents a function of reducing an n*k-dimensional matrix to a scalar;

[0084] R n×k represents an n*k-dimensional matrix;

[0085] R represents a real number space;

[0086] w k ∈R n×k and b k ∈R are parameters to be fitted by the logistic regression model;

[0087] represents a hidden layer weight;

[0088] b k represents a bias value.

[0089] In an embodiment of the present specification, the dropout ratio is preferably 0.2 when dropout regularization is used.

[0090] In an embodiment of the present specification, the first hidden layer reduces the input dimension to 1024 dimensions, the second hidden layer reduces the 1024 dimensions to 64 dimensions, and the third hidden layer reduces the 64 dimensions to 1 dimension.

[0091] Harmful query data refers to data that does not conform to human values, and benign query data refers to data that conforms to human values. For example, How to make a bomb? is harmful query data, and How to make a cake? is benign query data. In an embodiment of the present specification, the pre-trained lightweight classifier constructs a training sample set using harmful query data and benign query data during the training process, and the training sample set can be data from one large language model or data from multiple large language models. When constructing the training sample set, the harmful query data and the benign query data should meet a certain ratio, for example, harmful query data: benign query data = 1:2.

[0092] It should be particularly noted that if the model alignment degree of multiple large language models is inconsistent, a preset proportion of samples in the constructed training sample set are randomly extracted as a new training sample set. The selection of the preset proportion can be determined according to the specific business scenario, and in an embodiment of the present specification, the preset proportion is 10%.

[0093] In an embodiment of the present specification, Llama2-7B-chat and Mistral-instrct-v0.2 are used as example models, 3000 samples are collected from the UltraSafety and PKU SafeRLHF prompt datasets as the harmful query dataset respectively, and 6000 sample datasets are collected as the benign query dataset. For the mistral-instrct-v0.2 model with inconsistent model alignment, 750 queries are extracted from the harmful and benign datasets constructed by us and an attack paradigm is added, which is used as the dataset for model training to perform model training.

[0094] In an embodiment of the present specification, the concatenated vector T k of the k token vectors t k of the final decoder of the large language model (i.e., the last decoder) is input into a pre-trained lightweight classifier to obtain a harmfulness score, so as to identify and reject potential attacks. Since the concatenated vector T k of the k token vectors t k is obtained through the hidden state of the final decoder, the method provided by the embodiment of the present specification can identify attack patterns in the hidden state representation space of the large language model, thereby achieving the purpose of preventing privacy attack attacks. Therefore, the pre-trained lightweight classifier is also called a hidden state filter (HSF).

[0095] The pre-trained lightweight classifier provided by the embodiment of the present specification can obtain a harmfulness score, and based on the harmfulness score, determine the response of the large language model to the request to be processed.

[0096] Step S107: If the harmfulness score is greater than or equal to a preset threshold, the large language model rejects to generate a response to the request to be processed, and if the harmfulness score is less than the preset threshold, the large language model responds to the request to be processed.

[0097] The harmfulness score is an evaluation result of the potential harm of the request to be processed, or an evaluation result of the potential harm of the request to be processed. According to the harmfulness score, the harmfulness attack of the request to be processed can be identified, and the privacy attack can be prevented. Therefore, the harmfulness score is of great significance.

[0098] In an embodiment of the present specification, the harmfulness score is a value between 0 and 1, and the preset threshold is 0.5.

[0099] It should be particularly noted that, in the embodiment of the present specification, the concatenated vector T k of the k token vectors t kThe hidden state is obtained from a large language model and is strictly dependent on the large language model. Therefore, the method provided in the specification embodiment is specific to a large language model and needs to be trained separately for different large language models. Because of this, the privacy attack prevention method provided in the specification embodiment is more accurate.

[0100] Figure 2 A flow framework diagram of the privacy attack prevention method using hidden state filtering provided in the specification embodiment is shown in FIG. 1. Figure 2 As shown in FIG. 1, the user terminal sends a data processing request (i.e., a request to be processed) to a server where the large language model is located. After the large language model obtains the request to be processed, the large language model forwards the obtained concatenated vector T k As the input of the pre-trained lightweight encoder, the harm score a is obtained. If the harm score a is greater than or equal to a preset threshold value b, the server where the large language model is located rejects the request to be processed. If the harm score a is less than the preset threshold value b, the server where the large language model is located responds to the request to be processed and performs output.

[0101] In the specification embodiment, the user terminal can be a smartphone, a notebook computer, a tablet computer, etc. The product type of the user terminal is not specifically limited in the application embodiment.

[0102] The server is a background server of the large language model. The server can be a standalone physical server, a server cluster composed of multiple physical servers, or a distributed system. The application embodiment does not specifically limit this. The large language model can be directly deployed on the server or deployed on other servers. The server can call the large language model by interacting with other servers.

[0103] To further understand the privacy attack prevention method using hidden state filtering provided in the specification embodiment, the framework of the privacy attack prevention method using hidden state filtering will be described below.

[0104] Figure 3 A framework diagram of the privacy attack prevention method using hidden state filtering provided in the specification embodiment is shown in FIG. 1. Figure 3 As shown in FIG. 1, after the large language model receives the request to be processed, the large language model forwards the hidden state from the final decoder to the pre-trained HSF. The harm score a is obtained by using the sigmoid function. The harm score a is compared with the preset threshold value to determine the response of the large language model, so as to ensure that the request to be processed can be safely and reliably output.

[0105] The method for preventing privacy attacks by using hidden state filtering provided by the embodiments of the present specification uses the concatenated vector T k of the vector t k of k tokens of the final decoder of the large language model as input, uses a preset lightweight classifier, and realizes effective attack detection without significantly increasing the computational burden, thereby being able to adapt to different large language models and changing attack strategies.

[0106] The above describes a method for preventing privacy attacks by using hidden state filtering, and the present specification also provides a device for preventing privacy attacks by using hidden state filtering, as shown in Figure 4 . Figure 4 A schematic diagram of a device for preventing privacy attacks by using hidden state filtering provided by the embodiments of the present specification, the device for preventing privacy attacks by using hidden state filtering comprises:

[0107] The request module 401 acquires a request to be processed.

[0108] The concatenated vector acquisition module 403 acquires the concatenated vector T k of the vector t k of k tokens of the final decoder of the large language model based on the request to be processed.

[0109] The harmfulness score calculation module 405 inputs the concatenated vector T k into a pre-trained lightweight classifier to obtain a harmfulness score, the pre-trained lightweight classifier being a multilayer perceptron, the multilayer perceptron comprising an input layer, a hidden layer, and an output layer, the hidden layer comprising a first hidden layer, a second hidden layer, and a third hidden layer.

[0110] The response module 407, if the harmfulness score is greater than or equal to a preset threshold, the large language model refuses to generate a response to the request to be processed, and if the harmfulness score is less than the preset threshold, the large language model responds to the request to be processed.

[0111] The above describes a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0112] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, for the device, electronic device, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0113] The device, electronic device, and non-volatile computer storage medium provided by the embodiments of the specification are corresponding to the method, so the device, electronic device, and non-volatile computer storage medium also have similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding device, electronic device, and non-volatile computer storage medium will not be described here.

[0114] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device that includes a list of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article, or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or device that includes the element.

[0115] The specification can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The specification can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0116] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0117] The above only describes the embodiments of the specification, and is not used to limit the present application. The present application can have various changes and modifications for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A privacy attack resistant method using hidden state filtering, characterized by, The methods for preventing privacy attacks include: Get pending requests; Based on the request to be processed, obtain a concatenated vector of k tokens of a final decoder of a large language model , specifically comprising: inputting the request to be processed into the large language model and performing forward transmission to generate a hidden state corresponding to the request to be processed; based on the last decoder layer of the large language model, obtaining a vector of k tokens corresponding to the last k tokens from the hidden state corresponding to the request to be processed ; connect the vector of k tokens in the original order, fill a zero vector between each two vectors, and form the concatenated vector ;​ The concatenated vector The input is fed into a pre-trained lightweight classifier to obtain a hazard score. The pre-trained lightweight classifier is a multilayer perceptron, which includes an input layer, a hidden layer, and an output layer. The hidden layer includes a first hidden layer, a second hidden layer, and a third hidden layer. If the hazard score is greater than or equal to a preset threshold, the large language model refuses to generate a response to the pending request; if the hazard score is less than the preset threshold, the large language model responds to the pending request.

2. The privacy protection method as described in claim 1, characterized in that, The vector of the k tags k in the equation depends on the output dimension of the hidden state of the large language model.

3. The privacy protection method as described in claim 1, characterized in that, The loss function of the pre-trained lightweight classifier is the binary cross-entropy loss function; The expression for the binary cross-entropy loss function is: in, Represents the two-cross-entropy loss function; l∈{0,1} is a binary label indicating whether the query is safe; Represents the sigmoid function; This represents a function that reduces an n*k dimension matrix to a scalar. This represents a cascaded vector.

4. The privacy protection method as described in claim 1, characterized in that, The activation function of the hidden layer is the ReLU activation function, and the activation function of the output layer is the sigmoid function.

5. The privacy protection method as described in claim 1, characterized in that, The hidden layer prevents overfitting through dropout regularization; The dropout regularization expression is: in, This represents a function that reduces an n*k dimension matrix to a scalar. Represents an n*k dimension matrix; R represents the real number space; ∈ and ∈R are the parameters that the logistic regression model is to fit; Indicates the hidden layer weights; This represents the bias value.

6. The privacy protection method as described in claim 1, characterized in that, The first hidden layer reduces the input dimension to 1024 dimensions, the second hidden layer reduces the 1024 dimensions to 64 dimensions, and the third hidden layer reduces the 64 dimensions to 1 dimension.

7. The privacy attack prevention method as described in claim 1, characterized in that, The large language model is an alignment model.

8. The privacy protection method as described in claim 1, characterized in that, The hazard score is a value between 0 and 1, and the preset threshold is 0.

5.

9. A privacy-prevention device utilizing hidden state filtering, characterized in that, The privacy protection device includes: The request module retrieves requests to be processed. The cascaded vector acquisition module, based on the request to be processed, acquires the vectors of k tags from the final decoder of the large language model. Cascaded vectors Specifically, this includes: inputting the request to be processed into the large language model and performing a forward pass to generate a hidden state corresponding to the request; and, based on the last decoder layer of the large language model, obtaining a vector of k tags corresponding to the last k tags from the hidden state corresponding to the request. ; the vector of the k marked items Connect the vectors in their original order, and fill the gaps between each pair of vectors with zero vectors to form the concatenated vectors. ; The hazard score calculation module calculates the cascaded vectors. The input is fed into a pre-trained lightweight classifier to obtain a hazard score. The pre-trained lightweight classifier is a multilayer perceptron, which includes an input layer, a hidden layer, and an output layer. The hidden layer includes a first hidden layer, a second hidden layer, and a third hidden layer. The response module determines whether the hazard score is greater than or equal to a preset threshold, in which case the large language model refuses to generate a response to the pending request; or whether the hazard score is less than the preset threshold, in which case the large language model responds to the pending request.

Images