Method and device for carrying out privacy protection on data in large model reasoning

Abstract

The invention provides a method and device for carrying out privacy protection on data in large model reasoning, and relates to the technical field of computers.The method comprises the steps that a large model is divided into a secret state domain model and a plaintext domain model, and the secret state domain model is placed in a trusted execution environment of a server side to be isolated; privacy data is encrypted by using a derivative key generated by the trusted execution environment measurement secret state domain model, and can be transmitted into the trusted execution environment; inferring the privacy data through a secret state domain model and a random confusion low-rank matrix connected in parallel with the secret state domain model, and transmitting inferred inference data to a plaintext domain model for continuous inference to obtain target inference data; and based on the client public key UserPK and the client private key UserSK, returning an inference result plaintext of the private data to the client. Therefore, large model reasoning is realized by means of centralized outsourcing computing power of the server, and privacy data is protected from being leaked in the reasoning process.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for protecting data privacy in large model reasoning. Background Art

[0002] When using large models, they often need to use industry privacy data for inference, but the data owner often does not have the computing power required for large model inference, or many scenarios are closed-source models, and the model cannot be deployed to the data owner. At this time, the private data can only be transferred from the local domain to the large model computing power memory inference, which brings about the privacy protection problem of industry privacy data.

[0003] Among the related technologies, multiple technical routes are adopted, such as Multi-party Computation (MPC), Trusted Execution Environment (TEE) and Federated Learning. However, the huge parameter scale of large models will lead to unacceptable performance of MPC, unsatisfactory specifications of TEE and unbearable bandwidth of Federated Learning. Therefore, there is an urgent need for a data privacy protection solution that meets the characteristics of large models. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the first purpose of this application is to propose a method for protecting data privacy in large-model reasoning, which not only uses the centralized outsourced computing power of the server to achieve large-model reasoning, but also protects privacy data from being leaked during the reasoning process.

[0006] The second objective of this application is to propose a device for protecting data privacy in large model reasoning.

[0007] The third objective of the present application is to provide an electronic device.

[0008] A fourth object of the present application is to provide a non-transitory computer-readable storage medium storing computer instructions.

[0009] To achieve the above-mentioned purpose, the first aspect of the present application proposes a method for protecting data privacy in large model reasoning, the method comprising:

[0010] Split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in the trusted execution environment of the server, and the plaintext domain model is deployed in the plaintext computing environment of the server;

[0011] Based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, code measurement is performed on the secret domain model to derive a private key ModelSK and a public key ModelPK of the secret domain model;

[0012] The client uses the public key ModelPK to encrypt the private data, pushes the encrypted target private data to the trusted execution environment, and decrypts the target private data using the private key ModelSK to obtain the private data;

[0013] Inferring the private data through a secret domain model and a random confusion low-rank matrix connected in parallel with the secret domain model, and transmitting the inferred inference data to a plaintext domain model for further inference to obtain target inference data;

[0014] In the case where the inference model of the target inference data is a secret domain model, the target inference data is encrypted based on the client public key UserPK to obtain target encrypted inference data, and the target encrypted inference data is output to the client and decrypted using the client private key UserSK to obtain the plaintext inference result of the privacy data.

[0015] To achieve the above-mentioned purpose, the second aspect of the present application proposes a device for protecting data privacy in large model reasoning, the device comprising:

[0016] A splitting module, used to split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in a trusted execution environment of the server, and the plaintext domain model is deployed in a plaintext computing environment of the server;

[0017] A derivation module, used for performing code measurement on the secret domain model based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, so as to derive a private key ModelSK and a public key ModelPK of the secret domain model;

[0018] A push module, used to encrypt the private data by using the public key ModelPK through the client, push the encrypted target private data to the trusted execution environment, and decrypt the target private data by using the private key ModelSK to obtain the private data;

[0019] An inference module, used to infer the private data through a secret domain model and a random confusion low-rank matrix connected in parallel with the secret domain model, and transmit the inferred inference data to a plaintext domain model for further inference to obtain target inference data;

[0020] A generation module is used to encrypt the target inference data based on the client public key UserPK to obtain target encrypted inference data when the inference model of the target inference data is a secret domain model, and output the target encrypted inference data to the client, and decrypt it using the client private key UserSK to obtain the plaintext inference result of the privacy data.

[0021] To achieve the above-mentioned purpose, the third aspect embodiment of the present application proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect.

[0022] In order to achieve the above-mentioned purpose, the fourth aspect of the present application proposes a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to enable the computer to execute the method described in the first aspect.

[0023] The method, device, electronic device, and storage medium for protecting data privacy in large model reasoning provided in the embodiments of the present application split the large model into a secret domain model and a plaintext domain model, and place the secret domain model in the trusted execution environment of the server for isolation; the privacy data is encrypted using the derived key generated by the trusted execution environment to measure the secret domain model, and can be transferred to the trusted execution environment; the privacy data is inferred through the secret domain model and the random confusion low-rank matrix connected in parallel with the secret domain model, and the inferred inference data is transmitted to the plaintext domain model for further inference to obtain the target inference data; and based on the client public key UserPK and the client private key UserSK, the inference result of the privacy data is returned to the client in plaintext. In this way, the centralized outsourced computing power of the server is used to realize large model reasoning, and the privacy data is protected from leakage during the reasoning process.

[0024] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a flowchart of a method for protecting data privacy in large model reasoning provided in an embodiment of the present application;

[0026] Figure 2 This is an example diagram of a large model splitting provided in an embodiment of the present application;

[0027] Figure 3 is an example diagram of a trusted execution environment provided by an embodiment of the present application;

[0028] Figure 4 It is an execution flow chart of a method for protecting data privacy in large model reasoning provided in an embodiment of the present application;

[0029] Figure 5 It is a schematic diagram of the structure of a device for protecting data privacy in large-model reasoning provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0031] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0032] The following describes a method and device for protecting data privacy in large model reasoning in an embodiment of the present application with reference to the accompanying drawings.

[0033] Figure 1 A flowchart of a method for protecting data privacy in large model reasoning provided in an embodiment of the present application.

[0034] like Figure 1 As shown, the method comprises the following steps:

[0035] Step 101, split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in the trusted execution environment of the server, and the plaintext domain model is deployed in the plaintext computing environment of the server.

[0036] In some embodiments, one implementation method for splitting a large model into a secret domain model for performing secret operations on private data and a plaintext domain model excluding the secret domain model can be that, when the large model has n layers of model blocks, the first model block in the n layers of model blocks that performs secret operations on private data is used as the secret domain model; and the second model block in the n layers of model blocks excluding the first model block is used as the plaintext domain model, wherein the secret domain model and the plaintext domain model contain at least one model block.

[0037] Optionally, a large model of a neural network model (Transformers) structure with a self-attention mechanism of a neural network model architecture (Decoder Only) can be used as an example for illustration. For example, an open source large model (Llama2) is a large model with 32 Decoder layers.

[0038] Further, Figure 2 This is a large model splitting example diagram provided in the embodiment of the present application. Figure 2 Take the Transformers large model of the DecoderOnly structure as an example. Assume that the large model has L1 to L n There are n layers of model (transformer) blocks. During the large model inference process, the only private data parts are the initial L1 layer and the final Ln layer loss function. These two parts are identified as the secret domain model. The rest of L2 to L n-1 The layer is the plaintext domain model. Whether the secret domain model has only one layer or multiple layers, the security assessment of privacy protection is not within the scope of this solution.

[0039] Secondly, the solution needs to physically split the plaintext domain model and the secret domain model identified above, so as to add privacy protection devices to the secret domain model later. Of course, the model blocks after the split are still treated as a whole in the inference. The split should not change the key structure and integrity of the original large model, nor will it change the output of the large model.

[0040] like Figure 2 As shown, the inference of the large model is a forward propagation process. The output x1=L1(x) of the front model block is used as the input of the backward model block. It is sent to the back-end model block by remote communication or cross-process communication. After receiving the front-end input, the back-end model block Recv(x1) continues to propagate backward and generates the output x2=L2(x). For subsequent convenience, the split dense domain model can be collectively referred to as Model Llama2-7B-Crypt .

[0041] Among them, the plaintext computing environment includes but is not limited to the graphics processing unit (GPU), tensor processing unit (TPU), and neural network processor (NPU) environment.

[0042] Step 102: Based on the asymmetric root key pair of the cryptographic algorithm preset in the trusted execution environment, code measurement is performed on the secret domain model to derive the private key ModelSK and the public key ModelPK of the secret domain model.

[0043] Optionally, a Trusted Execution Environment (TEE) is an independent processing environment with computing and storage functions that can provide security, integrity, and confidentiality protection. It can achieve confidential computing capabilities such as data confidentiality out of the domain, non-recoverable untrusted environments, and controllable out-of-domain data processing logic. This application is applicable to various TEE hardware implementations and is not limited to specific hardware.

[0044] In some embodiments, based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, code measurement is performed on a secret domain model to derive a private key ModelSK and a public key ModelPK of the secret domain model. One implementation method may be to call an interface for code measurement in a trusted execution environment and pass in the required secret domain model; based on the passed in secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as a fingerprint of the secret domain model; a root private key, a random number, and a fingerprint that are invisible to the outside world in the asymmetric root key pair of the cryptographic algorithm are used to derive the private key ModelSK of the secret domain model through a cryptographic algorithm; based on the private key ModelSK of the secret domain model, a public key ModelPK of the secret domain model is generated, thereby facilitating the subsequent addition of a privacy protection device to the secret domain model.

[0045] Optionally, after generating the public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model, it also includes: using the root private key of the cryptographic algorithm built into the trusted execution environment to prove the credibility of the public key ModelPK to obtain the proof signature of the public key ModelPK, wherein the content of the proof signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

[0046] The cryptographic algorithm may include but is not limited to SM2 / SM3, and this embodiment does not specifically limit this.

[0047] Further, Figure 3 This is an example diagram of a trusted execution environment provided by an embodiment of the present application, based on the aforementioned secret domain model Model Llama2-7B-Crypt For example, Figure 3 As shown in the figure, prepare the TEE trusted execution environment. The TEE is pre-set with SM2's asymmetric root key pair RootSK (RSK) and RootPK (RPK). RootSK is the root private key that is invisible to the outside world and is the trusted root of the entire TEE. The root public key RootPK can be made public. At the same time, TEE has built-in support for various cryptographic algorithms SM2 / SM3 of the national secret. This solution uses the secret domain model Model Llama2-7B-Crypt Perform code measurement and derive the Model in TEE Llama2-7B-CryptThe private key ModelSK and the public key ModelPK are as follows:

[0048] First, call the TEE code measurement interface and pass in the required parameters: the model to be measured (Model Llama2-7B-Crypt ), data party (client) public key UserPK.

[0049] ModelHash = SM3 (Model Llama2-7B-Crypt ), that is, the TEE hardware internally uses the secret domain model Model Llama2-7B-Crypt Use the SM3 algorithm to calculate the hash value ModelHash, which can be used as Model Llama2-7B-Crypt Fingerprint.

[0050] ModelSK = SM3 (ModelHash, RSK, Nonce), that is, using the root private key RootSK of TEE, the random number Nonce, and the fingerprint ModelHash, the root private key ModelSK of the secret domain model is derived through the SM3 algorithm. Llama2-7B-Crypt The root private key is used to decrypt confidential data. It is generated in the TEE hardware and cannot be obtained from outside the hardware without any export method.

[0051] ModelPK = SM2_GetPK (ModelSK), that is, use ModelSK to generate Model Llama2-7B-Crypt The public key ModelPK is used to encrypt private data in the future.

[0052] In addition, Signature = SM2_Sign (ModelHash | ModelPK | UserPK, RSK). At this time, the credibility of the ModelPK generated in the previous step has not been proven, so TEE needs to use the built-in root private key to sign it. The content of the proof signature includes the fingerprint ModelHash, the public key ModelPK and the client public key UserPK, and finally the proof signature Signature (Sign) is obtained.

[0053] Step 103: The client encrypts the private data using the public key ModelPK, pushes the encrypted target private data to the trusted execution environment, and decrypts the target private data using the private key ModelSK to obtain the private data.

[0054] In some embodiments, the client may also be referred to as the data local end, which generally has its own hardware infrastructure provided by the data party and is usually a weak computing facility.

[0055] Step 104, infer the private data through the secret domain model and the random confusion low-rank matrix connected in parallel with the secret domain model, and transmit the inferred inference data to the plaintext domain model for further inference to obtain the target inference data.

[0056] Optionally, the encrypted domain model communicates with each layer of model blocks in the plaintext domain model by remote communication or cross-process communication.

[0057] In some embodiments, high-speed networks such as IB and RoCE networks are generally used between plaintext computing environments, and ordinary Ethernet can also be used. Since model iteration requires continuous transmission of a large number of intermediate states between the plaintext computing environment and the trusted execution environment, the performance of Ethernet is slightly affected.

[0058] Furthermore, the random confusion low-rank matrix L' in parallel with the secret domain model is used in this application to enhance security and reduce the risk of privacy data (X) being restored. This is because, especially in the scenario of inference based on a general pre-trained large model, the secret domain model Model Llama2-7B-Crypt It is known or public, and its output x1 will be transmitted to an incompletely trusted plaintext computing environment. When both the secret domain model and x1 are known, the original private data can be restored to a certain extent through some inversion methods. Therefore, if you want to achieve general privacy data protection, you need to initialize a random confusion low-rank matrix L' in the TEE during the initialization phase and connect it in parallel to the L1 layer. Randomness is to ensure security, and the TEE's true random number generator is used to generate it to achieve the obfuscation effect. Of course, the parallel random confusion low-rank matrix L' must also be obtained through training.

[0059] Step 105, when the inference model of the target inference data is a secret domain model, the target inference data is encrypted based on the client public key UserPK to obtain the target encrypted inference data, and the target encrypted inference data is output to the client, and decrypted using the client private key UserSK to obtain the plain text of the inference result of the privacy data.

[0060] In some embodiments, when the inference model of the target inference data is a plaintext domain model, plaintext domain inference is directly performed to feed back the target inference data inferred from the plaintext domain to the client.

[0061] The method for protecting data privacy in the large model reasoning of the embodiment of the present application is to split the large model into a secret domain model and a plaintext domain model, and place the secret domain model in the trusted execution environment of the server for isolation; the private data is encrypted using the derived key generated by the trusted execution environment to measure the secret domain model, and can be passed into the trusted execution environment; the private data is inferred through the secret domain model and the random confusion low-rank matrix in parallel with the secret domain model, and the inferred inference data is transmitted to the plaintext domain model for further inference to obtain the target inference data; and based on the client public key UserPK and the client private key UserSK, the inference result of the private data is returned to the client in plaintext. In this way, the large model reasoning is realized with the help of the centralized outsourced computing power of the server, and the private data is protected from leakage during the reasoning process.

[0062] In summary, in order to better illustrate this application, this application also proposes an execution flow chart of a method for protecting data privacy in large model reasoning. Figure 4 As shown in the figure, the upper part is the server, where the plaintext computing environment (GPU, TPU, NPU) and the secret computing environment (TEE trusted execution environment) are deployed. The lower part is the client, which is the local domain of the data source. The split large model is deployed on the server, where the secret domain model (L1 to L n ) is deployed in the TEE trusted execution environment, the plaintext domain model (L2 to L n-1 ) is deployed in a plaintext computing environment.

[0063] Furthermore, if Figure 4 As shown, first the client uses the public key ModelPK of the secret domain model to encrypt the private data X to obtain the target private data [X], [X] = Encrypt (X, ModelPK). And before the client encrypts the data, an important prerequisite is that the ModelPK needs to be proved: to confirm that ModelPK is indeed the correct key generated by the correct code measurement of the specified TEE environment, that is, to prove that the TEE environment (RootPK) generated by ModelPK and the secret domain model ModelPK are the same as the private key of the client. Llama2-7B-Crypt , client public key UserPK, whether the three key information match. That is, according to the above-mentioned proof signature Signature, signature verification is performed, Verify_Sign(Signature,Model Llama2-7B-Crypt , UserPK, RootPK) == True. This step can also be assisted by remote proof provided by the TEE hardware manufacturer.

[0064] like Figure 4As shown, at the beginning of inference, the server uses the target private data [X] uploaded by the client and pushes it to the TEE trusted execution environment, while keeping the decryption key public key ModelPK of the private key ModelSK in the secure isolated storage in the TEE. At this time, ModelSK is used to decrypt the batch of [X] in the TEE into private data X = Decrypt ([X], ModelSK), and then X is sent to the secret domain model for inference.

[0065] Among them, the random confusion low-rank matrix L' (confusion matrix) in parallel with the dense domain model aims to enhance security and reduce the risk of privacy data (X) being restored.

[0066] like Figure 4 As shown, the entire large model is divided into three parts, L1 and L n The layer is deployed in TEE as a secret domain model. Therefore, the decrypted private data X is first forward propagated through the L1 layer. The output of the L1 layer, X1=L1(x), is transmitted from the TEE to the plaintext computing environment through remote communication. X1→L2 continues to propagate forward. Here, X1 has been calculated by the L1 layer (including nonlinear activation functions) and turned into hidden state data. It is difficult to restore the plaintext X through X1, so as to achieve the purpose of data privacy protection. The forward propagation of the plaintext domain model is very direct. It can be accelerated using various GPUs, TPUs, and NPUs, and parallel algorithm strategies such as tensor parallelism can also be applied. Finally, it is forward propagated to the final L n The layer finally generates output y. Then it is encrypted by the client public key UserPK [y] = Encrypt (y, UserPK), and [y] is output to the client and decrypted using the client private key UserSK to obtain the inferred result plaintext y of the private data, y = Decrypt ([y], UserSK).

[0067] In order to implement the above embodiments, the present application also proposes a device for protecting data privacy in large model reasoning.

[0068] Figure 5 A schematic diagram of the structure of a device for protecting data privacy in large-model reasoning provided in an embodiment of the present application.

[0069] like Figure 5 As shown, the device 50 for protecting data privacy in the large model reasoning includes: a splitting module 51, a derivation module 52, a push module 53, an inference module 54, and a generation module 55.

[0070] A splitting module 51 is used to split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in a trusted execution environment of the server, and the plaintext domain model is deployed in a plaintext computing environment of the server;

[0071] A derivation module 52, configured to perform code measurement on the secret domain model based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, so as to derive a private key ModelSK and a public key ModelPK of the secret domain model;

[0072] The push module 53 is used to encrypt the private data by using the public key ModelPK through the client, push the encrypted target private data to the trusted execution environment, and decrypt the target private data by using the private key ModelSK to obtain the private data;

[0073] An inference module 54 is used to infer the private data through a secret domain model and a random confusion low-rank matrix connected in parallel with the secret domain model, and transmit the inferred inference data to a plaintext domain model for further inference to obtain target inference data;

[0074] The generation module 55 is used to encrypt the target inference data based on the client public key UserPK to obtain target encrypted inference data when the inference model of the target inference data is a secret domain model, and output the target encrypted inference data to the client, and decrypt it using the client private key UserSK to obtain the plain text of the inference result of the privacy data.

[0075] Furthermore, in a possible implementation of the embodiment of the present application, the splitting module 51 is specifically used to:

[0076] When the large model has n layers of model blocks, the first model block in the n layers of model blocks that performs secret operations on private data is used as the secret domain model;

[0077] The second model block except the first model block in the n-layer model block is used as the plaintext domain model, wherein the dense domain model and the plaintext domain model at least contain one model block. Further, in a possible implementation of the embodiment of the present application,

[0078] Furthermore, in a possible implementation of the embodiment of the present application, the encrypted domain model communicates with the model blocks of each layer in the plaintext domain model by means of remote communication or cross-process communication.

[0079] Furthermore, in a possible implementation of the embodiment of the present application, the derivation module 53 is specifically used to:

[0080] Call the trusted execution environment code measurement interface and pass in the required secret domain model;

[0081] According to the input secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model;

[0082] Use the root private key, a random number, and the fingerprint in the asymmetric root key pair of the cryptographic algorithm, which is invisible to the outside, to derive the private key ModelSK of the secret domain model through the cryptographic algorithm;

[0083] Based on the private key ModelSK of the secret domain model, the public key ModelPK of the secret domain model is generated.

[0084] Furthermore, in a possible implementation of the embodiment of the present application, the derivation module 53 is further specifically configured to:

[0085] The public key ModelPK is authenticated by a root private key of a cryptographic algorithm built into a trusted execution environment to obtain a certification signature of the public key ModelPK, wherein the content of the certification signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

[0086] The device for protecting data privacy in the large model reasoning of the embodiment of the present application splits the large model into a secret domain model and a plaintext domain model, and places the secret domain model in the trusted execution environment of the server for isolation; the privacy data is encrypted using the derivative key generated by the trusted execution environment to measure the secret domain model, and can be transferred to the trusted execution environment; the privacy data is inferred through the secret domain model and the random confusion low-rank matrix in parallel with the secret domain model, and the inferred inference data is transmitted to the plaintext domain model for further inference to obtain the target inference data; and based on the client public key UserPK and the client private key UserSK, the inference result of the privacy data is returned to the client in plaintext. In this way, the centralized outsourced computing power of the server is used to realize the large model reasoning, and the privacy data is protected from leakage during the reasoning process.

[0087] In order to implement the above embodiment, the present application also proposes an electronic device, including:

[0088] at least one processor; and

[0089] a memory communicatively connected to the at least one processor; wherein,

[0090] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the aforementioned method.

[0091] In order to implement the above embodiment, the present application also proposes a non-transitory computer-readable storage medium storing computer instructions, where the computer instructions are used to enable the computer to execute the above method.

[0092] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0093] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0094] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0095] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0096] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0097] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0098] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0099] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for protecting data privacy in large model reasoning, characterized in that: The method comprises: Split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in the trusted execution environment of the server, and the plaintext domain model is deployed in the plaintext computing environment of the server; Based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, code measurement is performed on the secret domain model to derive a private key ModelSK and a public key ModelPK of the secret domain model; The client uses the public key ModelPK to encrypt the private data, pushes the encrypted target private data to the trusted execution environment, and decrypts the target private data using the private key ModelSK to obtain the private data; Inferring the private data through a secret domain model and a random confusion low-rank matrix connected in parallel with the secret domain model, and transmitting the inferred inference data to a plaintext domain model for further inference to obtain target inference data; In the case where the inference model of the target inference data is a secret domain model, the target inference data is encrypted based on the client public key UserPK to obtain target encrypted inference data, and the target encrypted inference data is output to the client and decrypted using the client private key UserSK to obtain the plaintext inference result of the privacy data.

2. The method according to claim 1, characterized in that The method of splitting the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model includes: When the large model has n layers of model blocks, the first model block in the n layers of model blocks that performs secret operations on private data is used as the secret domain model; The second model block except the first model block in the n-layer model blocks is used as a plaintext domain model, wherein the dense domain model and the plaintext domain model at least contain one model block.

3. The method according to claim 1, characterized in that The encrypted domain model communicates with each layer of model blocks in the plaintext domain model by remote communication or cross-process communication.

4. The method according to claim 1, characterized in that The asymmetric root key pair based on the cryptographic algorithm preset in the trusted execution environment performs code measurement on the secret domain model to derive the private key ModelSK and the public key ModelPK of the secret domain model, including: Call the trusted execution environment code measurement interface and pass in the required secret domain model; According to the input secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model; Use the root private key, a random number, and the fingerprint in the asymmetric root key pair of the cryptographic algorithm, which is invisible to the outside, to derive the private key ModelSK of the secret domain model through the cryptographic algorithm; Based on the private key ModelSK of the secret domain model, the public key ModelPK of the secret domain model is generated.

5. The method according to claim 4, characterized in that After generating the public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model, the method further includes: The public key ModelPK is authenticated by a root private key of a cryptographic algorithm built into a trusted execution environment to obtain a certification signature of the public key ModelPK, wherein the content of the certification signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

6. A device for protecting data privacy in large model reasoning, characterized in that: The device comprises: A splitting module, used to split the large model into a secret domain model for performing secret operations on private data and a plaintext domain model other than the secret domain model, wherein the secret domain model is deployed in a trusted execution environment of the server, and the plaintext domain model is deployed in a plaintext computing environment of the server; A derivation module, used for performing code measurement on the secret domain model based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, so as to derive a private key ModelSK and a public key ModelPK of the secret domain model; A push module, used to encrypt the private data by using the public key ModelPK through the client, push the encrypted target private data to the trusted execution environment, and decrypt the target private data by using the private key ModelSK to obtain the private data; An inference module, used to infer the private data through a secret domain model and a random confusion low-rank matrix connected in parallel with the secret domain model, and transmit the inferred inference data to a plaintext domain model for further inference to obtain target inference data; A generation module is used to encrypt the target inference data based on the client public key UserPK to obtain target encrypted inference data when the inference model of the target inference data is a secret domain model, and output the target encrypted inference data to the client, and decrypt it using the client private key UserSK to obtain the plaintext inference result of the privacy data.

7. The device according to claim 6, characterized in that The derivative module is specifically used for: Call the trusted execution environment code measurement interface and pass in the required secret domain model; According to the input secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model; Use the root private key, a random number, and the fingerprint in the asymmetric root key pair of the cryptographic algorithm, which is invisible to the outside, to derive the private key ModelSK of the secret domain model through the cryptographic algorithm; Based on the private key ModelSK of the secret domain model, the public key ModelPK of the secret domain model is generated.

8. The device according to claim 7, characterized in that The derivative module is also specifically used for: The public key ModelPK is authenticated by a root private key of a cryptographic algorithm built into a trusted execution environment to obtain a certification signature of the public key ModelPK, wherein the content of the certification signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5.

Images