Large model training method and device based on privacy protection and storage medium

Abstract

The invention provides a large model training method and device based on privacy protection and a storage medium. The method comprises the steps of splitting a large model into a plaintext domain model and a secret state domain model; receiving a private data ciphertext sent by at least one client; the private key ModelSK is utilized to decrypt the private data ciphertext in the TE to obtain private data; training the secret state domain model and the plaintext domain model by using the privacy data to obtain the trained secret state domain model and plaintext domain model; and encrypting the trained secret state domain model based on the determined client public key UserPK, and sending the trained plaintext domain model and the encrypted secret state domain model to the client. Therefore, according to the method and the device, the secret state domain model is trained in the TEE, so that the private data can be safely encrypted out of the domain and cannot be restored in a plaintext computing power environment, and the protection of the private data of the client is realized. Meanwhile, the large model is trained through the centralized outsourcing computing power of the server side, and it is guaranteed that centralized training is efficient.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a training method, device and storage medium for a large model based on privacy protection. Background Art

[0002] At present, domain or industry large models need to be trained or fine-tuned through industry privacy data so that the trained domain or industry large models can be applied to the corresponding fields or industries. Among them, the client may not have the computing power required for large model training, or require multiple parties' industry privacy data for joint training. Based on this, a server with an AI computing power center is required to centrally train the aggregated industry data. Therefore, it is necessary to ensure that industry data is not abused when the data is trained out of the domain.

[0003] Among the related technologies, multiple technical routes are adopted, such as Multi-party Computation (MPC), Trusted Execution Environment (TEE) and Federated Learning. However, the huge parameter scale of large models will lead to unacceptable performance of MPC, unsatisfactory specifications of TEE and unbearable bandwidth of Federated Learning. Therefore, there is an urgent need for a data privacy protection solution that meets the characteristics of large models. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides a training method, device and storage medium for a large model based on privacy protection.

[0005] According to a first aspect of an embodiment of the present disclosure, a training method for a large model based on privacy protection is provided, and the method is applied to a server, comprising:

[0006] Split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server;

[0007] Receive a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by TEE;

[0008] Decrypting the private data ciphertext using the private key ModelSK of the secret domain model in the TEE to obtain the private data;

[0009] Using the privacy data to train the secret domain model and the plaintext domain model to obtain trained secret domain model and plaintext domain model;

[0010] The trained secret domain model is encrypted based on the determined client public key UserPK, and the trained plaintext domain model and the encrypted secret domain model are sent to the client.

[0011] Optionally, in an embodiment of the present disclosure, the secret domain model includes a first model block and a second model block, and the using of the privacy data to train the secret domain model and the plaintext domain model to obtain the trained secret domain model and plaintext domain model includes:

[0012] Determine a random confusion low-rank matrix based on a true random number generator in the TEE;

[0013] Connecting the random confusion low-rank matrix in the TEE in parallel with the first model block to obtain a third model block;

[0014] Based on the private data, forward propagation is performed through the third model block, the plaintext domain model and the second model block to obtain prediction inference data;

[0015] Based on the predicted inference data, back propagation is performed through the third model block, the plaintext domain model and the second model block to adjust the model parameters in the third model block, the plaintext domain model and the second model block, and the above steps are repeated until the large model converges, or the number of iterations of the large model reaches a preset number, to obtain a trained dense domain model and a plaintext domain model.

[0016] Optionally, in the embodiment of the present disclosure, the step of performing forward propagation based on the privacy data through the third model block, the plaintext domain model and the second model block to obtain the predicted inference data includes:

[0017] In the TEE, inputting the private data into the third model block to obtain a first result;

[0018] Transmitting the first result to the plaintext computing environment, and performing data processing on the first result through the plaintext domain model to obtain a second result;

[0019] The second result is transmitted to the TEE, and the second result is processed by the second model block to obtain prediction and inference data.

[0020] Optionally, in the embodiment of the present disclosure, before receiving the ciphertext of private data sent by at least one client, the method further includes:

[0021] Obtaining a code measurement request sent by the client, and performing code measurement on the secret domain model based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, so as to derive a private key ModelSK, a public key ModelPK and a certification signature of the public key ModelPK of the secret domain model;

[0022] The public key ModelPK and the certification signature are sent to the client.

[0023] Optionally, in the embodiment of the present disclosure, the asymmetric root key pair based on the cryptographic algorithm preset in the trusted execution environment performs code measurement on the secret domain model to derive the private key ModelSK, the public key ModelPK and the certification signature of the public key ModelPK of the secret domain model, including:

[0024] Call the trusted execution environment code measurement interface and pass in the required secret domain model;

[0025] According to the input secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model;

[0026] Based on the root private key of the asymmetric root key pair of the cryptographic algorithm, the random number, and the fingerprint, a private key ModelSK of the secret domain model is derived through a cryptographic algorithm;

[0027] Generate a public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model;

[0028] The public key ModelPK is authenticated by a signature based on the root private key to obtain a certification signature of the public key ModelPK, wherein the certification signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

[0029] According to a second aspect of an embodiment of the present disclosure, a training method for a large model based on privacy protection is provided, and the method is applied to a client, comprising:

[0030] Send code metrics request to the server;

[0031] Obtain the public key ModelPK and proof signature sent by the server;

[0032] Verifying the public key ModelPK through the certification signature;

[0033] When the verification is successful, the private data is encrypted based on the public key ModelPK to obtain the private data ciphertext;

[0034] Send the private data ciphertext to the server.

[0035] Optionally, in the embodiment of the present disclosure, the method further includes:

[0036] Receiving the trained plaintext domain model and the encrypted secret domain model sent by the server;

[0037] The encrypted secret domain model is decrypted using the client private key UserSK, and the trained large model is obtained based on the decrypted model and the trained plaintext domain model.

[0038] According to a third aspect of an embodiment of the present disclosure, a training device for a large model based on privacy protection is provided, and the device is applied to a server, comprising:

[0039] A splitting module is used to split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server;

[0040] A receiving module, used to receive a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by TEE;

[0041] A decryption module, used to decrypt the private data ciphertext in the TEE using the private key ModelSK of the secret domain model to obtain the private data;

[0042] A training module, used to train the secret domain model and the plaintext domain model using the privacy data to obtain a trained secret domain model and a plaintext domain model;

[0043] The sending module is used to encrypt the trained secret domain model based on the determined client public key UserPK, and send the trained plaintext domain model and the encrypted secret domain model to the client.

[0044] According to a fourth aspect of an embodiment of the present disclosure, a training device for a large model based on privacy protection is provided, and the device is applied to a client, comprising:

[0045] The sending module is used to send code measurement requests to the server;

[0046] An acquisition module, used to acquire the public key ModelPK and the certification signature sent by the server;

[0047] A verification module, used to verify the public key ModelPK through the certification signature;

[0048] An encryption module, used to encrypt the private data based on the public key ModelPK to obtain the private data ciphertext when the verification is passed;

[0049] The sending module is also used to send the private data ciphertext to the server.

[0050] According to a fifth aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0051] processor;

[0052] a memory for storing processor-executable instructions;

[0053] The processor is configured to implement the method described in the first aspect or the second aspect.

[0054] According to the sixth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is provided, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by a processor, the method described in the first aspect or the second aspect can be implemented.

[0055] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0056] The present disclosure proposes a training method, device and storage medium for a large model based on privacy protection, the method comprising: splitting the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; receiving a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by the TEE; decrypting the private data ciphertext in the TEE using the private key ModelSK of the secret domain model to obtain the private data; training the secret domain model and the plaintext domain model using the private data to obtain the trained secret domain model and the plaintext domain model; encrypting the trained secret domain model based on the determined client public key UserPK, and sending the trained plaintext domain model and the encrypted secret domain model to the client. Thus, the present disclosure can realize that the private data can be securely encrypted out of the domain by training the secret domain model in the TEE, and cannot be restored in the plaintext computing environment, thereby realizing the protection of the client's private data. At the same time, the centralized outsourced computing power on the server side is used to train large models, ensuring efficient centralized training.

[0057] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0059] Figure 1 is a flowchart of a training method for a large model based on privacy protection according to some embodiments of the present disclosure;

[0060] Figure 2 is a schematic diagram of splitting a large model according to some embodiments of the present disclosure;

[0061] Figure 3 is a schematic diagram of a trusted execution environment according to some embodiments of the present disclosure;

[0062] Figure 4 is a schematic diagram of a large model training method according to some embodiments of the present disclosure;

[0063] Figure 5 is a flowchart of a training method for a large model based on privacy protection according to some embodiments of the present disclosure;

[0064] Figure 6 is an interactive schematic diagram of a large model training method based on privacy protection according to some embodiments of the present disclosure;

[0065] Figure 7 is a structural schematic diagram of a large model training device based on privacy protection according to some embodiments of the present disclosure;

[0066] Figure 8 is a structural schematic diagram of a large model training device based on privacy protection according to some embodiments of the present disclosure;

[0067] Fig. 9 It is a block diagram of an electronic device suitable for executing a training method of a large model based on privacy protection according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0068] Some embodiments of the present disclosure will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. Various changes, modifications and equivalents of the methods, devices and / or systems described herein will become apparent after understanding the present disclosure. For example, the order of operations described herein is merely an example and is not limited to those orders set forth herein, but can be changed as becomes apparent after understanding the present disclosure, except for operations that must be performed in a specific order. In addition, for clarity and brevity, descriptions of features known in the art may be omitted.

[0069] The embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0070] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0071] The following describes the privacy protection-based large model training method and device of the embodiments of the present disclosure with reference to the accompanying drawings.

[0072] Figure 1 is a flowchart of a method for training a large model based on privacy protection according to some embodiments of the present disclosure, such as Figure 1 As shown, the method is applied to the server and may include the following steps:

[0073] Step 101: Split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server.

[0074] Among them, it should be noted that the executor of the above-mentioned big model training method based on privacy protection is the big model training device based on privacy protection, and the big model training device based on privacy protection can be implemented by software and / or hardware. The big model training device based on privacy protection in this embodiment can be configured in an electronic device.

[0075] In this example embodiment, the electronic device may include devices such as terminal devices and servers, and this embodiment does not limit the electronic device.

[0076] In the disclosed embodiment, part of the model in the large model that involves confidential operations on private data can be determined as confidential domain models, and part of the model other than the confidential domain model can be determined as plaintext domain models to protect the private data corresponding to the industry data.

[0077] Among them, in the disclosed embodiment, the large model can be a neural network model (Transformers) structure with a self-attention mechanism of a neural network model architecture (Decoder Only). For example, the open source large model (Llama2) is a large model with 32 Decoder layers.

[0078] And, in the embodiments of the present disclosure, Figure 2 This is a schematic diagram of a large model splitting provided by an embodiment of the present disclosure. Figure 2 As shown, assuming that the large model has L 1 To L n There are n layers of model (transformer) blocks, and the initial L in the large model training process 1 Layer and the final L n The layer loss function uses private data. Based on this, these two parts are determined as the secret domain model, and the remaining L 2 ~L n-1 The layer is determined to be a plaintext domain model. As for whether the secret domain model has only one layer or multiple layers, the assessment of the security of privacy protection is not within the scope of this solution.

[0079] Among them, in the embodiment of the present disclosure, after the secret domain model and the plaintext domain model of the large model are determined through the above steps, the above plaintext domain model and the secret domain model can be physically split so that the secret domain model can be deployed in the TEE of the server later. And, in the embodiment of the present disclosure, the various parts of the model after the above split will be used as a whole in training, and the split will not change the key structure and integrity of the large model, nor will it change the principle of model training.

[0080] Specifically, in the embodiments of the present disclosure, Figure 2 As shown in Figure 1, when the above large model is trained, each iteration includes forward propagation and backward propagation. In the forward propagation, the output x of the front model is 1 =L 1 (x) is used as the input of the backward model, and is sent by remote communication or cross-process communication. 1 ) is sent to the backend model, and the backend model Recv(x 1 ) After receiving the front-end input, it continues to propagate backward and obtains the output x 2 =L 2 (x 1 ).

[0081] And, in the embodiment of the present disclosure, when the parameters are adjusted later, the gradient can be calculated by the back propagation. By Send(g n ) is pushed to the front-end model, Recv(g n ) After receiving, continue forward propagation Based on this, the split secret domain model and plaintext domain model can be trained through the above process, and the split secret domain model is called Model Llama2-7B-Crypt .

[0082] Furthermore, in the disclosed embodiment, after the large model is split into a plaintext domain model and a secret domain model through the above steps, the plaintext domain model can be deployed in the plaintext computing environment of the server, and the secret domain model can be deployed in the TEE of the server.

[0083] Among them, in the embodiments of the present disclosure, the plaintext computing environment includes but is not limited to the graphics processing unit (GPU), tensor processing unit (TPU), and neural network processor (NPU) environment. And, in the embodiments of the present disclosure, the trusted execution environment (TEE) is an independent processing environment with computing and storage functions that can provide security, integrity, and confidentiality protection. It can realize confidential computing capabilities such as data confidentiality out of the domain, non-trusted environment cannot be restored, and out-of-domain data processing logic is controllable. The present disclosure is applicable to various hardware implementations of TEE, not limited to specific hardware.

[0084] Step 102: Receive ciphertext of private data sent by at least one client.

[0085] In the disclosed embodiment, the private data ciphertext of each client is encrypted by the public key ModelPK of the secret domain model returned by TEE. Also, in the disclosed embodiment, before receiving the private data ciphertext sent by at least one client, the method may further include the following steps:

[0086] Step a: Obtain the code measurement request sent by the client, and perform code measurement on the secret domain model based on the asymmetric root key pair of the cryptographic algorithm preset in the trusted execution environment to derive the private key ModelSK, the public key ModelPK and the proof signature of the public key ModelPK of the secret domain model;

[0087] Step b: Send the public key ModelPK and the proof signature to the client.

[0088] Among them, in the embodiment of the present disclosure, the method for performing code measurement on the secret domain model based on the asymmetric root key pair of the cryptographic algorithm preset in the trusted execution environment to derive the private key ModelSK, the public key ModelPK and the proof signature of the public key ModelPK of the secret domain model may include the following steps:

[0089] Step 1: Call the trusted execution environment code measurement interface and pass in the required secret domain model;

[0090] Step 2: According to the input secret domain model, a cryptographic algorithm is used to calculate the hash value of the secret domain model, and the hash value is used as the fingerprint of the secret domain model;

[0091] Step 3: Based on the root private key, random number, and fingerprint of the asymmetric root key pair of the cryptographic algorithm, derive the private key ModelSK of the secret domain model through the cryptographic algorithm;

[0092] Step 4: Generate the public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model;

[0093] Step 5: Based on the root private key, the public key ModelPK is authenticated by signature, and the authentication signature of the public key ModelPK is obtained, wherein the authentication signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

[0094] Among them, in the embodiment of the present disclosure, the above-mentioned cryptographic algorithms may include but are not limited to SM2 / SM3, and this embodiment does not make specific limitations on this.

[0095] Specifically, Figure 3 is a schematic diagram of a trusted execution environment provided by an embodiment of the present disclosure, based on the above-mentioned secret domain model Model Llama2-7B-Crypt For example. Figure 3 As shown in the figure, the TEE trusted execution environment has preset SM2's asymmetric root key pair RootSK and RootPK. RootSK is the root private key that is invisible to the outside world and is the trusted root of the entire TEE. The root public key RootPK can be used publicly. Among them, TEE has built-in support for various cryptographic algorithms SM2 / SM3 of the national secret.

[0096] And, the above dense domain model Model Llama2-7B-Crypt Perform code measurement and derive the Model in TEE Llama2-7B-Crypt The process of private key ModelSK and public key ModelPK is as follows:

[0097] Call the TEE code measurement interface and pass in the required parameters: the model to be measured (Model Llama2-7B-Crypt ), the client public key UserPK; TEE hardware internally uses the passed-in secret domain model Model Llama2-7B-Crypt Use the SM3 algorithm to calculate the hash value ModelHash, that is, ModelHash = SM3 (Model Llama2-7B-Crypt ), ModelHash can be used as Model Llama2-7B-Crypt fingerprints;

[0098] The root private key ModelSK of the secret domain model is derived through the root private key RootSK of TEE, the random number Nonce, and the fingerprint ModelHash through the SM3 algorithm, that is, ModelSK = SM3 (ModelHash, RSK, Nonce). The root private key ModelSK of the secret domain model can be used to decrypt the ciphertext of the private data. The root private key ModelSK of the secret domain model is generated in the TEE hardware and cannot be exported by any method. Therefore, the root private key ModelSK of the secret domain model cannot be obtained from outside the hardware.

[0099] Through the above Model Llama2-7B-Crypt The root private key ModelSK generates the public key ModelPK, that is, ModelPK = SM2_GetPK (ModelSK). The public key ModelPK can be the key used to encrypt the private data of the client;

[0100] The above public key ModelPK is signed by the built-in root private key of TEE. The content of the signature may include the fingerprint ModelHash, the public key ModelPK and the client public key UserPK, that is, Signature = SM2_Sign (ModelHash | ModelPK | UserPK, RSK), and the signature Signature (Sign) is obtained.

[0101] Step 103: Decrypt the private data ciphertext in TEE using the private key ModelSK of the secret domain model to obtain the private data.

[0102] In the embodiment of the present disclosure, based on the above description, after receiving the privacy data ciphertext encrypted by the public key ModelPK of the secret domain model sent by at least one client, the privacy data ciphertext can be decrypted in the TEE using the private key ModelSK of the secret domain model to obtain the privacy data, so that the privacy data can be used to train the secret domain model and the plaintext domain model subsequently.

[0103] Step 104: Use the privacy data to train the secret domain model and the plaintext domain model to obtain trained secret domain model and plaintext domain model.

[0104] In the embodiment of the present disclosure, the dense domain model may include a first model block and a second model block.

[0105] Furthermore, in the embodiment of the present disclosure, the method of using privacy data to train the secret domain model and the plaintext domain model to obtain the trained secret domain model and the plaintext domain model may include the following steps:

[0106] Step 1041: Determine a random confusion low-rank matrix based on a true random number generator in the TEE;

[0107] Step 1042: connect the random confusion low-rank matrix in the TEE in parallel with the first model block to obtain a third model block;

[0108] Step 1043: Based on the private data, forward propagation is performed through the third model block, the plaintext domain model, and the second model block to obtain predicted inference data;

[0109] Step 1044: Based on the predicted inference data, backward propagation is performed through the third model block, the plaintext domain model and the second model block to adjust the model parameters in the third model block, the plaintext domain model and the second model block. The above steps are repeated until the large model converges, or the number of iterations of the large model reaches a preset number, to obtain a trained dense domain model and a plaintext domain model.

[0110] In the embodiment of the present disclosure, before training the secret domain model in the TEE, the random confusion low-rank matrix can be determined based on the true random number generator in the TEE. ′ , to enhance security and reduce the risk of privacy data (x, y) being restored. Specifically, in the embodiment of the present disclosure, in the scenario of fine-tuning based on the general pre-trained large model, the dense domain model Model Llama2-7B-Crypt The output of the model will be transmitted to an untrusted plaintext computing environment. When both the model and the output are known, the original private data can be restored to a certain extent through the inversion method. Based on this, a random confusion low-rank matrix needs to be initialized by the TEE in the initialization phase. ′ In parallel to the first model block, the general privacy data is protected. In the disclosed embodiment, the random confusion low-rank matrix can be generated by the true random number generator of TEE. The random confusion low-rank matrix can reduce the computing power consumption and avoid affecting the model training performance. The parallel connection can refer to the public Lora fine-tuning method to ensure that the model structure is not affected and the model training quality is guaranteed.

[0111] Among them, in the disclosed embodiment, the encrypted domain model and the model blocks of each layer in the plaintext domain model communicate with each other by remote communication or cross-process communication. In the disclosed embodiment, the plaintext computing environment generally uses a high-speed network such as IB and RoCE networks, and ordinary Ethernet can also be used. Since the model iteration requires the continuous transmission of a large number of intermediate states between the plaintext computing environment and the trusted execution environment, the use of Ethernet may be slightly affected.

[0112] Further, in the embodiment of the present disclosure, after obtaining the private data through the above steps, forward propagation can be performed based on the private data through the third model block, the plaintext domain model and the second model block to obtain the predicted inference data. Specifically, in the embodiment of the present disclosure, the method for obtaining the predicted inference data through forward propagation based on the private data through the third model block, the plaintext domain model and the second model block may include the following steps:

[0113] Step 10431: In the TEE, input the private data into the third model block to obtain a first result;

[0114] Step 10432: Transmit the first result to the plaintext computing environment, and perform data processing on the first result through the plaintext domain model to obtain a second result;

[0115] Step 10433: transmit the second result to TEE, and process the second result through the second model block to obtain prediction and inference data.

[0116] Among them, in the embodiments of the present disclosure, the contents about forward propagation and backward propagation can refer to the detailed introduction in the above embodiments, and the embodiments of the present disclosure will not be described in detail here.

[0117] Based on the above description, Figure 4 Schematic diagram of a large model training method proposed in an embodiment of the present disclosure. Figure 4 As shown, the large model is divided into three parts, the first and last L 1 and L n The layer is deployed in TEE as a dense domain model, and the rest of L 2 ~L n-1 The layer is deployed in a plaintext computing environment as a plaintext domain model. Based on the decrypted privacy data (x, y), it can be obtained through L 1 Layer forward propagation, L 1 The output x of the layer 1 =L 1 (x) Through remote communication between the plaintext computing environment and the TEE environment, the output is transmitted from the TEE environment to the plaintext environment x 1 →L 2 Continue forward propagation, at this time x 1 By L 1 The calculation of the layer (including nonlinear activation function) is the hidden state hidden layer data, which cannot be obtained through x 1 The private data x is restored, thereby protecting the private data. And, the forward propagation of the plaintext computing environment is the same as the method in the above embodiment, and the embodiment of the present disclosure will not be repeated here.

[0118] Furthermore, in the disclosed embodiment, forward propagation to the last Ln layer can also be returned to the real data y in the TEE environment and the privacy data through remote communication, and the corresponding gradient g is calculated through the loss function, and then backward propagation is used to adjust the model parameters in the third model block, the plaintext domain model and the second model block. Among them, the backward propagation is the same as the method in the above embodiment, and the disclosed embodiment will not be repeated here.

[0119] Furthermore, in the disclosed embodiment, the above steps 1043 to 1044 are repeated until the large model converges, or the number of iterations of the large model reaches a preset number, to obtain a trained dense domain model and a plaintext domain model. The preset number can be set as needed.

[0120] Step 105: Encrypt the trained secret domain model based on the determined client public key UserPK, and send the trained plaintext domain model and the encrypted secret domain model to the client.

[0121] In the disclosed embodiment, after obtaining the trained plaintext domain model and secret domain model through the above steps, the trained secret domain model can be encrypted by the client public key UserPK, and the trained plaintext domain model and the encrypted secret domain model can be sent to the client.

[0122] The present disclosure proposes a training method for a large model based on privacy protection, which includes: splitting the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; receiving a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by the TEE; decrypting the private data ciphertext in the TEE using the private key ModelSK of the secret domain model to obtain the private data; training the secret domain model and the plaintext domain model using the private data to obtain the trained secret domain model and the plaintext domain model; encrypting the trained secret domain model based on the determined client public key UserPK, and sending the trained plaintext domain model and the encrypted secret domain model to the client. Therefore, the present disclosure can realize that the private data can be securely encrypted out of the domain by training the secret domain model in the TEE, and cannot be restored in the plaintext computing environment, thereby realizing the protection of the client's private data. At the same time, the centralized outsourced computing power on the server side is used to train large models, ensuring efficient centralized training.

[0123] Figure 5 is a flowchart of a method for training a large model based on privacy protection according to some embodiments of the present disclosure, such as Figure 5As shown, the method is applied to the client and may include the following steps:

[0124] Step 501: Send a code measurement request to the server;

[0125] Step 502: Obtain the public key ModelPK and the certification signature sent by the server;

[0126] Step 503: Verify the public key ModelPK by proving the signature;

[0127] Step 504: When the verification is successful, the private data is encrypted based on the public key ModelPK to obtain the private data ciphertext;

[0128] Step 505: Send the encrypted private data to the server.

[0129] In the embodiment of the present disclosure, after the client obtains the public key ModelPK and the proof signature sent by the server, the public key ModelPK can be verified by the proof signature to determine whether ModelPK is the correct key generated by the correct code measurement of the specified TEE environment, that is, the TEE environment (RootPK) and the computing model (ModelPK) generated by the proof signature. Llama2-7B-Crypt ), whether the client (UserPK) matches.

[0130] Specifically, in the embodiment of the present disclosure, the proof signature Signature can be sent to TEE, and the TEE can obtain the signature through Verify_Sign(Signature, Model Llama2-7B-Crypt ,UserPK,RootPK). If the verification result is passed, it means that the public key ModelPK is correct; otherwise, it means that the public key ModelPK is incorrect and encryption cannot be performed using the public key ModelPK.

[0131] Furthermore, in the embodiment of the present disclosure, the above method may further include: receiving the trained plaintext domain model and the encrypted secret domain model sent by the server, decrypting the encrypted secret domain model through the client private key UserSK, and obtaining the trained large model based on the decrypted model and the trained plaintext domain model.

[0132] The present disclosure proposes a training method for a large model based on privacy protection, which includes: splitting the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; receiving a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by the TEE; decrypting the private data ciphertext in the TEE using the private key ModelSK of the secret domain model to obtain the private data; training the secret domain model and the plaintext domain model using the private data to obtain the trained secret domain model and the plaintext domain model; encrypting the trained secret domain model based on the determined client public key UserPK, and sending the trained plaintext domain model and the encrypted secret domain model to the client. Therefore, the present disclosure can realize that the private data can be securely encrypted out of the domain by training the secret domain model in the TEE, and cannot be restored in the plaintext computing environment, thereby realizing the protection of the client's private data. At the same time, the centralized outsourced computing power on the server side is used to train large models, ensuring efficient centralized training.

[0133] Based on the above description, Figure 6 The interactive schematic diagram of a large model training method based on privacy protection proposed in an embodiment of the present disclosure, the method may include the following steps:

[0134] Step 601: The server splits the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server;

[0135] Step 602: The client sends a code measurement request to the server;

[0136] Step 603: The server receives the code measurement request sent by the client, performs code measurement on the secret domain model based on the asymmetric root key pair of the cryptographic algorithm preset in the trusted execution environment, so as to derive the private key ModelSK, the public key ModelPK and the proof signature of the public key ModelPK of the secret domain model, and sends the public key ModelPK and the proof signature to the client;

[0137] Step 604: The client receives the public key ModelPK and the certification signature sent by the server, and verifies the public key ModelPK through the certification signature;

[0138] Step 605: When the verification is successful, the private data is encrypted based on the public key ModelPK to obtain the private data ciphertext;

[0139] Step 606: The client sends the encrypted private data to the server.

[0140] Step 607: The server receives the ciphertext of the private data sent by at least one client, decrypts the ciphertext of the private data using the private key ModelSK of the secret domain model in the TEE to obtain the private data, and trains the secret domain model and the plaintext domain model using the private data to obtain the trained secret domain model and the plaintext domain model;

[0141] Step 608: Encrypt the trained secret domain model based on the determined client public key UserPK, and send the trained plaintext domain model and the encrypted secret domain model to the client;

[0142] Step 609: The client receives the trained plaintext domain model and the encrypted secret domain model sent by the server, decrypts the encrypted secret domain model using the client private key UserSK, and obtains the trained large model based on the decrypted model and the trained plaintext domain model.

[0143] In the embodiment of the present disclosure, for other contents of the above steps 601 to 608, reference may be made to the detailed description in the above embodiment, and the embodiment of the present disclosure will not be elaborated here.

[0144] Figure 7 is a structural diagram of a large model training device based on privacy protection according to some embodiments of the present disclosure, which is applied to the server, such as Figure 7 As shown, the device may include:

[0145] Splitting module 701, used to split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server;

[0146] The receiving module 702 is used to receive the private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is encrypted by the public key ModelPK of the secret domain model returned by the TEE;

[0147] The decryption module 703 is used to decrypt the private data ciphertext using the private key ModelSK of the secret domain model in the TEE to obtain the private data;

[0148] The training module 704 is used to train the secret domain model and the plaintext domain model using the privacy data to obtain the trained secret domain model and the plaintext domain model;

[0149] The sending module 705 is used to encrypt the trained secret domain model based on the determined client public key UserPK, and send the trained plaintext domain model and the encrypted secret domain model to the client.

[0150] In the embodiment of the present disclosure, the dense domain model includes a first model block and a second model block, and the training module 704 is specifically used for:

[0151] Based on the true random number generator in TEE, a random confusion low-rank matrix is ​​determined;

[0152] The random confusion low-rank matrix in TEE is connected in parallel with the first model block to obtain the third model block;

[0153] Based on the private data, forward propagation is performed through the third model block, the plaintext domain model, and the second model block to obtain the predicted inference data;

[0154] Based on the predicted inference data, back propagation is performed through the third model block, the plaintext domain model and the second model block to adjust the model parameters in the third model block, the plaintext domain model and the second model block. The above steps are repeated until the large model converges or the number of iterations of the large model reaches a preset number, thereby obtaining the trained dense domain model and plaintext domain model.

[0155] Optionally, in the embodiment of the present disclosure, the training module 704 is further used to:

[0156] In TEE, the private data is input into the third model block to obtain the first result;

[0157] The first result is transmitted to the plaintext computing environment, and the first result is processed by the plaintext domain model to obtain a second result;

[0158] The second result is transmitted to TEE, and the second result is processed by the second model block to obtain prediction and inference data.

[0159] Optionally, in the embodiment of the present disclosure, the above device is also used for:

[0160] Obtain the code measurement request sent by the client, and perform code measurement on the secret domain model based on the asymmetric root key pair of the cryptographic algorithm preset in the trusted execution environment to derive the private key ModelSK, the public key ModelPK and the proof signature of the public key ModelPK of the secret domain model;

[0161] Send the public key ModelPK and the proof signature to the client.

[0162] Optionally, in the embodiment of the present disclosure, the above device is also used for:

[0163] Call the trusted execution environment code measurement interface and pass in the required secret domain model;

[0164] According to the input secret domain model, the hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model;

[0165] Based on the root private key, random number, and fingerprint of the asymmetric root key pair of the cryptographic algorithm, the private key ModelSK of the secret domain model is derived through the cryptographic algorithm;

[0166] Generate the public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model;

[0167] The public key ModelPK is authenticated by a signature based on the root private key to obtain the authentication signature of the public key ModelPK, where the authentication signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

[0168] In one or more embodiments of the present disclosure, the large model is split into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; the private data ciphertext sent by at least one client is received, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by the TEE; the private data ciphertext is decrypted in the TEE using the private key ModelSK of the secret domain model to obtain the private data; the secret domain model and the plaintext domain model are trained using the private data to obtain the trained secret domain model and the plaintext domain model; the trained secret domain model is encrypted based on the determined client public key UserPK, and the trained plaintext domain model and the encrypted secret domain model are sent to the client. Therefore, the present disclosure can realize that the private data can be securely encrypted out of the domain by training the secret domain model in the TEE, and cannot be restored in the plaintext computing environment, thereby realizing the protection of the client's private data. At the same time, the centralized outsourced computing power on the server side is used to train large models, ensuring efficient centralized training.

[0169] Figure 8 A training device based on a privacy-preserving large model is shown according to some embodiments of the present disclosure, and is applied to a client, such as Figure 8 As shown, the device may include:

[0170] A sending module 801 is used to send a code measurement request to a server;

[0171] The acquisition module 802 is used to obtain the public key ModelPK and the certification signature sent by the server;

[0172] Verification module 803, used to verify the public key ModelPK by proving the signature;

[0173] The encryption module 804 is used to encrypt the private data based on the public key ModelPK to obtain the private data ciphertext when the verification is passed;

[0174] The sending module 801 is also used to send the private data ciphertext to the server.

[0175] In the embodiment of the present disclosure, the above device is also used for:

[0176] Receive the trained plaintext domain model and encrypted secret domain model sent by the server;

[0177] The encrypted secret domain model is decrypted using the client private key UserSK, and the trained large model is obtained based on the decrypted model and the trained plaintext domain model.

[0178] In one or more embodiments of the present disclosure, the large model is split into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; the private data ciphertext sent by at least one client is received, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by the TEE; the private data ciphertext is decrypted in the TEE using the private key ModelSK of the secret domain model to obtain the private data; the secret domain model and the plaintext domain model are trained using the private data to obtain the trained secret domain model and the plaintext domain model; the trained secret domain model is encrypted based on the determined client public key UserPK, and the trained plaintext domain model and the encrypted secret domain model are sent to the client. Therefore, the present disclosure can realize that the private data can be securely encrypted out of the domain by training the secret domain model in the TEE, and cannot be restored in the plaintext computing environment, thereby realizing the protection of the client's private data. At the same time, the centralized outsourced computing power on the server side is used to train large models, ensuring efficient centralized training.

[0179] like Fig. 9 As shown, the electronic device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the electronic device 900 can also be stored. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0180] A number of components in the electronic device 900 are connected to the I / O interface 905, including: an input unit 908, such as a keyboard, a mouse, etc.; an output unit 907, such as various types of displays, speakers, etc.; a storage unit 908, such as a disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the electronic device 900 to exchange information / data with other electronic devices through a computer network such as the Internet and / or various telecommunication networks.

[0181] The computing unit 901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 901 performs the various methods and processes described above, such as a training method for a large model based on privacy protection. For example, in some embodiments, a training method for a large model based on privacy protection may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 908. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the training method for the large model based on privacy protection described above may be performed. Alternatively, in other embodiments, the computing unit 901 may be configured to perform a privacy-preserving large model training method in any other appropriate manner (e.g., by means of firmware).

[0182] Various embodiments of the devices and techniques described above herein can be implemented in digital electronic circuit devices, integrated circuit devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), devices on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable device including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage device, at least one input device, and at least one output device, and transmit data and instructions to the storage device, the at least one input device, and the at least one output device.

[0183] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0184] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution device, device, or electronic device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor devices, devices, or electronic devices, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage electronic device, a magnetic storage electronic device, or any suitable combination of the foregoing.

[0185] To provide interaction with a user, the devices and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0186] The apparatus and techniques described herein may be implemented in a computing device including backend components (e.g., as a data server), or a computing device including middleware components (e.g., an application server), or a computing device including frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the apparatus and techniques described herein), or a computing device including any combination of such backend components, middleware components, or frontend components. The components of the apparatus may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0187] A computer device may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed device, or a server combined with a blockchain.

[0188] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0189] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A training method for a large model based on privacy protection, characterized in that: The method is applied to the server, and includes: Split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; Receive a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by TEE; Decrypting the private data ciphertext using the private key ModelSK of the secret domain model in the TEE to obtain the private data; Using the privacy data to train the secret domain model and the plaintext domain model to obtain trained secret domain model and plaintext domain model; The trained secret domain model is encrypted based on the determined client public key UserPK, and the trained plaintext domain model and the encrypted secret domain model are sent to the client.

2. The method according to claim 1, characterized in that The secret domain model includes a first model block and a second model block, and the secret domain model and the plaintext domain model are trained by using the privacy data to obtain the trained secret domain model and the plaintext domain model, including: Determine a random confusion low-rank matrix based on a true random number generator in the TEE; Connecting the random confusion low-rank matrix in the TEE in parallel with the first model block to obtain a third model block; Based on the private data, forward propagation is performed through the third model block, the plaintext domain model and the second model block to obtain prediction inference data; Based on the predicted inference data, back propagation is performed through the third model block, the plaintext domain model and the second model block to adjust the model parameters in the third model block, the plaintext domain model and the second model block, and the above steps are repeated until the large model converges, or the number of iterations of the large model reaches a preset number, to obtain a trained dense domain model and a plaintext domain model.

3. The method according to claim 2, characterized in that The step of performing forward propagation based on the privacy data through the third model block, the plaintext domain model, and the second model block to obtain prediction inference data includes: In the TEE, inputting the private data into the third model block to obtain a first result; Transmitting the first result to the plaintext computing environment, and performing data processing on the first result through the plaintext domain model to obtain a second result; The second result is transmitted to the TEE, and the second result is processed by the second model block to obtain prediction and inference data.

4. The method according to claim 1, characterized in that Before receiving the ciphertext of private data sent by at least one client, the method further includes: Obtaining a code measurement request sent by the client, and performing code measurement on the secret domain model based on an asymmetric root key pair of a cryptographic algorithm preset in a trusted execution environment, so as to derive a private key ModelSK, a public key ModelPK and a certification signature of the public key ModelPK of the secret domain model; The public key ModelPK and the certification signature are sent to the client.

5. The method according to claim 4, characterized in that The asymmetric root key pair based on the cryptographic algorithm preset in the trusted execution environment performs code measurement on the secret domain model to derive the private key ModelSK, the public key ModelPK and the certification signature of the public key ModelPK of the secret domain model, including: Call the trusted execution environment code measurement interface and pass in the required secret domain model; According to the input secret domain model, a hash value of the secret domain model is calculated using a cryptographic algorithm, and the hash value is used as the fingerprint of the secret domain model; Based on the root private key of the asymmetric root key pair of the cryptographic algorithm, the random number, and the fingerprint, a private key ModelSK of the secret domain model is derived through a cryptographic algorithm; Generate a public key ModelPK of the secret domain model based on the private key ModelSK of the secret domain model; The public key ModelPK is authenticated by a signature based on the root private key to obtain a certification signature of the public key ModelPK, wherein the certification signature includes the fingerprint, the public key ModelPK and the client public key UserPK.

6. A training method for a large model based on privacy protection, characterized in that: The method is applied to a client and includes: Send code metrics request to the server; Obtain the public key ModelPK and proof signature sent by the server; Verifying the public key ModelPK through the certification signature; When the verification is passed, the private data is encrypted based on the public key ModelPK to obtain the private data ciphertext; Send the private data ciphertext to the server.

7. The method according to claim 6, characterized in that The method further comprises: Receiving the trained plaintext domain model and the encrypted secret domain model sent by the server; The encrypted secret domain model is decrypted using the client private key UserSK, and the trained large model is obtained based on the decrypted model and the trained plaintext domain model.

8. A training device for a large model based on privacy protection, characterized in that: The device is applied to a server, and includes: A splitting module is used to split the large model into a plaintext domain model and a secret domain model, wherein the plaintext domain model is deployed in the plaintext computing environment of the server, and the secret domain model is deployed in the TEE of the server; A receiving module, used to receive a private data ciphertext sent by at least one client, wherein the private data ciphertext of each client is obtained by encrypting the public key ModelPK of the secret domain model returned by TEE; A decryption module, used to decrypt the private data ciphertext in the TEE using the private key ModelSK of the secret domain model to obtain the private data; A training module, used to train the secret domain model and the plaintext domain model using the privacy data to obtain a trained secret domain model and a plaintext domain model; The sending module is used to encrypt the trained secret domain model based on the determined client public key UserPK, and send the trained plaintext domain model and the encrypted secret domain model to the client.

9. A training device for a large model based on privacy protection, characterized in that: The device is applied to a client and includes: The sending module is used to send code measurement requests to the server; An acquisition module, used to acquire the public key ModelPK and the certification signature sent by the server; A verification module, used to verify the public key ModelPK through the certification signature; An encryption module, used to encrypt the private data based on the public key ModelPK to obtain the private data ciphertext when the verification is passed; The sending module is also used to send the private data ciphertext to the server.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-5 or 6-7.

Images