Large language model output protection method and device, storage medium and electronic equipment

Abstract

The invention discloses a large language model output protection method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining dimension information, an input vector and a first output vector of an original weight matrix corresponding to a language model head layer of a large language model from a cloud server side, the first output vector is determined based on the input vector and the original weight matrix; determining a first low-rank matrix and a second low-rank matrix based on the dimension information of the original weight matrix; determining a second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix; and determining a target word probability distribution vector output by the large language model based on the first output vector and the second output vector. The method can prevent the cloud from directly speculating the overall text output of the model according to the output of the language model header, enhances privacy protection, and also can reduce the storage and calculation overhead brought by deploying the complete language model header layer locally.

Description

Technical Field

[0001] The present application relates to the technical field of large language models, and in particular to a large language model output protection method, a large language model output protection device, a computer-readable storage medium, and an electronic device. Background Art

[0002] In recent years, Large Language Models (LLMs) have attracted widespread attention due to their outstanding performance in natural language processing tasks. These models are based on deep learning techniques, especially the Transformer architecture, and are capable of understanding and generating natural language. The training of LLMs usually relies on a large amount of text data. Through unsupervised or self-supervised learning, the model learns the structure, semantics, and contextual information of the language. With the improvement of computing power and the expansion of data sets, the scale of LLMs continues to increase, and the number of model parameters has reached hundreds of millions or even trillions, enabling them to demonstrate excellent performance in tasks such as text generation, question-answering systems, and translation. Language model head layer

[0003] However, as privacy and security issues become increasingly serious, when using cloud services for LLMs reasoning, the user's output may expose sensitive information. In particular, when the cloud can obtain the output probability distribution vector of the LM Head (language model head), it is possible to infer the output text of the large model. Therefore, how to protect the privacy of these outputs has become an important research topic.

[0004] At present, some related solutions mainly focus on input data encryption, model segmentation, etc., but some of these methods are not effective in protecting output privacy, while others require encryption and decryption and high network training costs, and other solutions require large local storage and computing overhead. The above solutions make it difficult for output privacy protection to be widely implemented. Summary of the invention

[0005] The present application aims to solve at least one of the technical problems in the related art to a certain extent. To this end, the first purpose of the present application is to propose a large language model output protection method, which obtains the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix, the first low-rank matrix and the second low-rank matrix are determined based on the dimension information of the original weight matrix, the second output vector is determined based on the input vector, the first low-rank matrix and the second low-rank matrix, and the target word probability distribution vector output by the large language model is determined based on the first output vector and the second output vector. Thus, it is possible to prevent the cloud from directly inferring the overall text output of the model based on the output of the language model head, enhance privacy protection, and at the same time reduce the storage and computing overhead caused by deploying the complete language model head layer locally, and improve the adaptability of the large language model to downstream tasks.

[0006] The second objective of this application is to propose a large language model output protection device.

[0007] The third object of the present application is to provide a computer-readable storage medium.

[0008] The fourth objective of the present application is to provide an electronic device.

[0009] To achieve the above-mentioned purpose, the first aspect embodiment of the present application proposes a large language model output protection method, which is applied to the local end, and the method includes: obtaining the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server end, wherein the first output vector is determined based on the input vector and the original weight matrix; determining the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix; determining the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix; determining the target word probability distribution vector output by the large language model based on the first output vector and the second output vector.

[0010] According to the large language model output protection method of the embodiment of the present application, the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model are obtained from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix, the first low-rank matrix and the second low-rank matrix are determined based on the dimension information of the original weight matrix, the second output vector is determined based on the input vector, the first low-rank matrix and the second low-rank matrix, and the target word probability distribution vector output by the large language model is determined based on the first output vector and the second output vector. Thus, the method can prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model head, enhance privacy protection, and at the same time reduce the storage and computing overhead caused by deploying the complete language model head layer locally, and can also improve the adaptability of the large language model to downstream tasks.

[0011] In addition, the large language model output protection method according to the above embodiment of the present application may also have the following additional technical features:

[0012] According to one embodiment of the present application, determining the target word probability distribution vector based on the first output vector and the second output vector includes: obtaining a target vector based on the sum of the first output vector and the second output vector; determining the target word probability distribution vector based on the target vector and an objective function, wherein the objective function is a softmax function.

[0013] According to one embodiment of the present application, determining a second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix includes: determining the second output vector based on the product of the input vector, the first low-rank matrix and the second low-rank matrix.

[0014] According to one embodiment of the present application, the dimensional information includes the input dimension and vocabulary length of the language model head layer, and the determining of the first low-rank matrix and the second low-rank matrix based on the dimensional information of the original weight matrix includes: determining the target rank number of the first low-rank matrix or the second low-rank matrix based on the dimensional information of the original weight matrix; determining the first low-rank matrix based on the input dimension and the target rank number, wherein the number of rows of the first low-rank matrix corresponds to the input dimension, and the number of columns of the first low-rank matrix corresponds to the target rank number; determining the second low-rank matrix based on the target rank number and the vocabulary length, wherein the number of rows of the second low-rank matrix corresponds to the target rank number, and the number of columns of the second low-rank matrix corresponds to the vocabulary length, wherein the target rank number is less than the input dimension and the vocabulary length.

[0015] According to one embodiment of the present application, the method also includes: initializing the first low-rank matrix and the second low-rank matrix, wherein the initialization includes setting the initial parameters of the first low-rank matrix and the second low-rank matrix based on all-zero or random initialization; and adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on a target data set.

[0016] According to one embodiment of the present application, the parameters of the first low-rank matrix and the second low-rank matrix are adjusted based on the target data set, including: determining a loss function based on the target data set; calculating the gradient of the loss function to the first low-rank matrix and the second low-rank matrix based on a back-propagation algorithm; and adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on the gradient and an optimization algorithm to minimize the loss function, wherein the optimization algorithm includes an adaptive moment estimation optimization algorithm or a stochastic gradient descent optimization algorithm.

[0017] According to one embodiment of the present application, the first output vector and the second output vector have the same dimension.

[0018] To achieve the above-mentioned purpose, the second aspect embodiment of the present application proposes a large language model output protection device, which is applied to the local end, and the device includes: an acquisition module, which is used to obtain the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server end, wherein the first output vector is determined based on the input vector and the original weight matrix; a first determination module, which is used to determine the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix; a second determination module, which is used to determine the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix; a third determination module, which is used to determine the target word probability distribution vector output by the large language model based on the first output vector and the second output vector.

[0019] According to the large language model output protection device of the embodiment of the present application, the acquisition module is used to obtain the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix, the first determination module is used to determine the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix, the second determination module is used to determine the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix, and the third determination module is used to determine the target word probability distribution vector output by the large language model based on the first output vector and the second output vector. Thus, the device can prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model head, enhance privacy protection, and at the same time reduce the storage and computing overhead caused by deploying the complete language model head layer locally, and can also improve the adaptability of the large language model in downstream tasks.

[0020] To achieve the above-mentioned purpose, the third aspect of the present application proposes a computer-readable storage medium on which a program is stored, and when the program is executed by a processor, the above-mentioned large language model output protection method is implemented.

[0021] According to the computer-readable storage medium of the embodiment of the present application, by implementing the above-mentioned large language model output protection method during execution, it is possible to prevent the cloud from directly inferring the overall text output of the model based on the output of the language model header, thereby enhancing privacy protection. At the same time, it is also possible to reduce the storage and computing overhead brought about by deploying the complete language model header layer locally, and to improve the adaptability of the large language model to downstream tasks.

[0022] To achieve the above-mentioned purpose, an electronic device proposed in the fourth aspect of the present application includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the above-mentioned large language model output protection method is implemented.

[0023] According to the electronic device of the embodiment of the present application, by executing the above-mentioned large language model output protection method, it is possible to prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model header, thereby enhancing privacy protection. At the same time, it can also reduce the storage and computing overhead brought about by deploying the complete language model header layer locally, and can also improve the adaptability of the large language model in downstream tasks.

[0024] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a flow chart of a large language model output protection method according to an embodiment of the present application;

[0026] Figure 2 Schematic diagram of LM Head calculation principle according to an embodiment of the present application;

[0027] Figure 3 Schematic diagram of local-cloud distributed reasoning at the LM Head layer according to an embodiment of the present application;

[0028] Figure 4 A flowchart of a large language model output protection method according to a specific example of the present application;

[0029] Figure 5 Schematic diagram of a block diagram of a large language model output protection device according to an embodiment of the present application;

[0030] Figure 6 Schematic diagram of a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0032] The following describes the large language model output protection method, large language model output protection device, computer-readable storage medium and electronic device proposed in the embodiments of the present application with reference to the accompanying drawings.

[0033] In a large language model, LM Head (language model head) is one of the key components, responsible for converting the hidden state of the model into the output vocabulary probability distribution. Specifically, LM Head maps the last layer output of the model to the dimension of the vocabulary through a linear layer and applies the Softmax function to generate the probability of each word. Figure 2As shown, the process can be expressed as: logits = XW + b, P(Y|X) = Softmax(logits). Among them, X represents the hidden state of the model: the shape is (n, d), where n is the batch size and d is the dimension of the hidden layer. W is the word embedding matrix, with a shape of (d, v), where v is the dimension of the vocabulary. B is the bias term of the word embedding matrix, with a shape of (v,). Logits is the intermediate result after linear matrix operation, showing the relative probability of each word in the vocabulary. Y is the final output result of LM Head, that is, the probability distribution of each word in the vocabulary. In this way, LM Head can generate a probability distribution P(Y|X) for each input context. This probability distribution is a vector with a length of the vocabulary size, indicating the probability of generating each word. The subsequent large model determines the final output text based on this probability distribution vector. However, in order to avoid output privacy leakage caused by the cloud server obtaining the generated vocabulary probability distribution, the current solution is to download the LM Head in the pre-trained model to the local computer and perform fine-tuning training according to the downstream tasks, so that the cloud cannot know the final Y vector based on the input X vector, thus protecting the user's privacy. However, due to the large scale of LM Head, the main problems of this solution are two points. The first is that the local reasoning and training cost of LM Head is high, and the second is that the local storage cost of LM Head is high. Therefore, this application will use LoRA technology to solve the above two problems.

[0034] LoRA (Low-Rank Adaptation) fine-tunes by inserting low-rank matrices in specific layers of the model to reduce the complexity of training parameters. Assuming we have a linear layer with weight W, the basic idea of ​​LoRA is to decompose the weight into two low-rank matrices A and B: W′=W+AB, where A is of shape, where is the hidden layer dimension of the input, and r is the rank number of the low rank. The shape of B is, r is the rank number of the low rank, where is the hidden layer dimension of the output. In this case, the updated weight W′ consists of the product of the original weight W and the newly introduced low-rank matrix. In this way, only the smaller low-rank matrices A and B need to be updated instead of the entire weight matrix, which significantly reduces the number of parameters during training. Most of the current LoRAs are added to the Transformer Decoder of the large model, and there are few solutions that do not perform LoRA weight fine-tuning in the LM Head. For this reason, this application proposes a large language model output protection method to solve the problems of large model output privacy, reduce local computation, and reduce local storage overhead.

[0035] Figure 1 The present invention is a flowchart of a large language model output protection method according to an embodiment of the present application.

[0036] like Figure 1 As shown, the large language model output protection method of the embodiment of the present application may include the following steps:

[0037] S1, obtaining dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix;

[0038] S2, determining a first low-rank matrix and a second low-rank matrix based on dimension information of the original weight matrix;

[0039] S3, determining a second output vector based on the input vector, the first low-rank matrix, and the second low-rank matrix;

[0040] S4, determining a target word probability distribution vector output by the large language model based on the first output vector and the second output vector.

[0041] Specifically, on the local side, first obtain the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server side. For example, the dimension information of the original weight matrix W obtained by the cloud server side includes the input dimension d and the vocabulary length v. For example, the shape of W is (d, v), where d is the dimension of the hidden layer and v is the length of the vocabulary. Obtain the input vector H from the cloud server side, whose shape is (n, d), where n is the batch size and d is the dimension of the hidden layer. Obtain the first output vector X from the cloud server side, whose shape is (n, v). The first output vector X is calculated based on the product of the input vector H and the original weight matrix W, and may also include the bias term B of the word embedding matrix, which has a shape of (v,). The result of the product calculation plus the bias term B can obtain the first output vector.

[0042] Then, the first low-rank matrix and the second low-rank matrix are determined according to the dimensional information of the original weight matrix. That is, by decomposing the high-dimensional weight matrix into a low-rank matrix, the amount of parameters and the amount of calculation can be reduced. That is, the rank number r of the first low-rank matrix and the second low-rank matrix can be determined first, which determines the dimension of the low-rank matrix. The dimensional information of the original weight matrix may include the input dimension d and the vocabulary length v, r is much smaller than the input dimension d and the vocabulary length v of the original weight matrix, that is, choosing a suitable r can strike a balance between reducing the amount of parameters and maintaining model performance.

[0043] After determining the first low-rank matrix and the second low-rank matrix, the second output vector can be determined according to the input vector, the first low-rank matrix and the second low-rank matrix, that is, in the large language model, the LoRA (Low-Rank Adaptation) technology inserts a low-rank matrix in a specific layer of the model for fine-tuning to reduce the complexity of the training parameters. Specifically, LoRA represents the update of the original weight matrix W as the product of two low-rank matrices, thereby reducing the amount of parameters that need to be trained. For example, the second output vector can be determined by a pre-set correspondence relationship, for example, the relationship between the input vector, the first low-rank matrix, the second low-rank matrix and the second output vector is pre-determined. After the input vector, the first low-rank matrix and the second low-rank matrix are determined, the second output vector can be obtained by directly calling the correspondence relationship.

[0044] After determining the second output vector, the target word probability distribution vector output by the large language model can be determined locally based on the first output vector and the second output vector. For example, the target word probability distribution vector can be determined based on the sum of the first output vector and the second output vector through a corresponding function, such as a Softmax function, a LogSumExp function, etc., which is used to convert a real number vector into a probability distribution vector. In this way, it is possible to obtain the necessary information from the cloud server, determine the low-rank matrix, calculate the second output vector, and finally generate the target word probability distribution vector. This process not only improves the adaptability and performance of the model, but also significantly reduces the local computing and storage overhead, while protecting the privacy of users.

[0045] According to one embodiment of the present application, a target word probability distribution vector is determined based on a first output vector and a second output vector, including: obtaining a target vector by summing the first output vector and the second output vector; and determining the target word probability distribution vector based on the target vector and an objective function, wherein the objective function is a softmax function.

[0046] Specifically, when determining the target word probability distribution vector based on the first output vector and the second output vector, the target vector can be obtained by first summing the first output vector and the second output vector. For example, the first output vector is logits1, the second output vector is logits2, and the target vector logits = logits1 + logits2. That is, this target vector logits combines the original output of cloud computing and the result of local LoRA fine-tuning, retaining the advantages of both while enhancing privacy protection.

[0047] After determining the target vector, the target word probability distribution vector can be determined according to the target vector and the target function, where the target function is the softmax function. That is, the target vector logits can be converted into the target word probability distribution vector Y by using the softmax function, that is, Y = softmax (logits). Specifically, the calculation formula of the softmax function is: Among them, Yi is the probability of the i-th word in the vocabulary, logitsi is the i-th element in the target vector logits, and v is the dimensionality of the vocabulary. Therefore, the final output word can be selected according to a specific strategy. For example, according to the target word probability distribution vector Y, the word with the highest probability can be selected as the final output. For example, the word with the highest probability is selected as the final output. Therefore, through the above steps, the present application realizes the use of cloud and local collaborative computing while protecting user privacy, generating the final word probability distribution vector, and selecting the most appropriate output word. This method not only improves the adaptability and performance of the model, but also significantly reduces local computing and storage overhead.

[0048] According to one embodiment of the present application, determining a second output vector based on an input vector, a first low-rank matrix and a second low-rank matrix includes: determining the second output vector based on the product of the input vector, the first low-rank matrix and the second low-rank matrix.

[0049] Specifically, when determining the second output vector according to the input vector, the first low-rank matrix and the second low-rank matrix, the second output vector can be determined according to the product of the input vector, the first low-rank matrix and the second low-rank matrix. For example, the input vector is a vector output by the hidden layer of the model, denoted by X. Its shape is (n, d), where n is the batch size and d is the dimension of the hidden layer. The first low-rank matrix: denoted by A, with a shape of d, r), where r is the rank number of the low rank, the second low-rank matrix is ​​denoted by B, with a shape of (r, v), where v is the dimension size of the vocabulary, thus, the second output vector logits2 is calculated by multiplying the input vector X with the first low-rank matrix A and the second low-rank matrix B, and the specific calculation process is as follows: logits2 = X*A*B. Thus, the second output vector is calculated by multiplying the input vector, the first low-rank matrix and the second low-rank matrix. This process not only reduces the amount of parameters that need to be trained, but also maintains the prediction performance of the model, while fine-tuning locally, significantly reducing the local calculation and storage overhead.

[0050] According to one embodiment of the present application, the dimensional information includes the input dimension and vocabulary length of the language model head layer, and the first low-rank matrix and the second low-rank matrix are determined based on the dimensional information of the original weight matrix, including: determining the target rank number of the first low-rank matrix or the second low-rank matrix based on the dimensional information of the original weight matrix; determining the first low-rank matrix based on the input dimension and the target rank number, wherein the number of rows of the first low-rank matrix corresponds to the input dimension, and the number of columns of the first low-rank matrix corresponds to the target rank number; determining the second low-rank matrix based on the target rank number and the vocabulary length, wherein the number of rows of the second low-rank matrix corresponds to the target rank number, and the number of columns of the second low-rank matrix corresponds to the vocabulary length, wherein the target rank number is smaller than the input dimension and the vocabulary length.

[0051] Specifically, the dimensional information includes the input dimension and vocabulary length of the language model head layer, wherein the hidden layer is connected to the language model head layer, the input dimension of the language model head layer is the output dimension of the hidden layer, and v is the length of the vocabulary. When determining the first low-rank matrix and the second low-rank matrix according to the dimensional information of the original weight matrix, the target rank of the first low-rank matrix or the second low-rank matrix can be determined according to the dimensional information of the original weight matrix, wherein the target rank is less than the input dimension and the vocabulary length. For example, the target rank is expressed as r, which is a positive integer less than the input dimension d and the vocabulary length v. The target rank r is selected to reduce the number of parameters while maintaining the predictive performance of the model. For example, r can be a smaller fraction of d or v, such as r=d / 16 or r=v / 16, etc.

[0052] Therefore, the first low-rank matrix can be determined according to the input dimension and the target rank number, that is, the first low-rank matrix can be expressed as A, with a shape of (d, r), where the number of rows of the first low-rank matrix corresponds to the input dimension d, and the number of columns of the first low-rank matrix corresponds to the target rank number r, and the second low-rank matrix can be determined according to the target rank number and the vocabulary length, that is, the second matrix can be expressed as B, with a shape of (r, v), where the number of rows of the second low-rank matrix corresponds to the target rank number r, and the number of columns of the second low-rank matrix corresponds to the vocabulary length v.

[0053] Through the above steps, the first low-rank matrix A and the second low-rank matrix B are determined based on the dimensional information of the original weight matrix. This process not only reduces the number of parameters that need to be trained, but also maintains the predictive performance of the model, while fine-tuning locally, significantly reducing local computational and storage overhead. Specifically, the number of parameters of the original weight matrix is ​​d×v, while the number of parameters of the low-rank matrices A and B is d×r and r×v respectively, and the total number of parameters is d×r+r×v, which is significantly less than d×v.

[0054] According to one embodiment of the present application, the large language model output protection method also includes: initializing the first low-rank matrix and the second low-rank matrix, wherein the initialization setting includes setting the initial parameters of the first low-rank matrix and the second low-rank matrix based on all-zero or random initialization; adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on the target data set.

[0055] Further, according to an embodiment of the present application, parameters of the first low-rank matrix and the second low-rank matrix are adjusted based on the target data set, including: determining a loss function based on the target data set; calculating the gradient of the loss function to the first low-rank matrix and the second low-rank matrix based on a back-propagation algorithm; adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on a gradient and an optimization algorithm to minimize the loss function, wherein the optimization algorithm includes an adaptive moment estimation optimization algorithm or a stochastic gradient descent optimization algorithm.

[0056] Specifically, when implementing a large language model with output privacy protection, the first low-rank matrix and the second low-rank matrix need to be initialized. The initialization setting includes setting the initial parameters of the first low-rank matrix and the second low-rank matrix based on all-zero or random initialization. For example, all elements of the first low-rank matrix A and the second low-rank matrix B can be initialized to zero, which is a relatively simple method. Alternatively, the first low-rank matrix A and the second low-rank matrix B are initialized using a normal distribution or a uniform distribution. Random initialization helps the model converge faster. For example, the standard normal distribution N(0, 1) or the uniform distribution Uniform(-0.1, 0.1) can be used for initialization.

[0057] After initialization, the parameters of the first low-rank matrix and the second low-rank matrix need to be adjusted according to the target data set. This process usually includes the following steps: prepare the target data set, that is, select a data set related to a specific downstream task for fine-tuning the model. This data set should contain enough samples to ensure that the model can learn task-related features. During the fine-tuning process, the original weight W of the LM Head layer (language model head layer) remains unchanged, and only the parameters of the first low-rank matrix A and the second low-rank matrix B are adjusted. The difference between the output of the model and the label of the target data set can be measured by using an appropriate loss function (such as cross entropy loss). Among them, the loss function is used to measure the difference between the predicted results of the model and the true results. Then the gradient of the loss function to the first low-rank matrix A and the second low-rank matrix B is calculated by the back-propagation algorithm, where the back-propagation algorithm is the key step in automatically finding the gradient. It starts from the loss function node through the calculation graph and the chain rule, and back-propagates to calculate the gradient of each node. And use an optimization algorithm (such as the adaptive moment estimation optimization algorithm Adam or the stochastic gradient descent optimization algorithm SGD) to update the parameters of the first low-rank matrix A and the second low-rank matrix B according to the calculated gradient. In addition, you can also use the validation set to regularly evaluate the performance of the model to ensure the effectiveness of the fine-tuning process. If the performance does not improve significantly, you can adjust the learning rate or other hyperparameters.

[0058] Thus, the initialization and fine-tuning of the first low-rank matrix and the second low-rank matrix are achieved, ensuring that the model can adapt to specific downstream tasks while protecting user privacy. This method not only reduces the number of parameters that need to be trained, but also maintains the predictive performance of the model, while fine-tuning locally, significantly reducing local computational and storage overhead.

[0059] According to one embodiment of the present application, the first output vector and the second output vector have the same dimension.

[0060] Specifically, the dimensions of the first output vector and the second output vector are the same. This design ensures that the two vectors can be directly added to generate the final output vector. That is, in order to be able to add the first output vector and the second output vector, their dimensions must be the same, and the two vectors can be added element by element to generate the final output vector. This design not only improves the adaptability and performance of the model, but also significantly reduces local computing and storage overhead, while protecting user privacy.

[0061] In summary, combined Figure 3As shown in the figure, in the actual calculation process, first, the input vector X of the large model on the cloud server is not only normally passed back to the LM Head layer of the cloud model, but also a copy is sent to the local. The cloud X vector is calculated by the original weight of the LM Head on the cloud to obtain logits1 and downloaded to the local. On the local side, by decomposing the weight matrix of the LM Head layer into two low-rank matrices A and B, only these two small-scale matrices need to be stored and fine-tuned locally. The low-rank adaptation characteristics of LoRA ensure the consistency of the input and output dimensions of the model without affecting the prediction performance of the model. The local X is calculated by the LoRA matrix to obtain logits2. Next, the two vectors of local logits1 and logits2 are summed to obtain logits, and finally the final word probability distribution vector Y is obtained by softmax calculation locally, and then the final output word can be selected according to a specific strategy. In addition, secondly, during the fine-tuning process, the original weight of the LM Head layer remains unchanged, and only the weight of LoRA is adjusted. This greatly reduces the number of parameters that need to be trained, which significantly reduces the local training and fine-tuning costs. At the same time, the adaptability of the model to specific downstream tasks has been improved. In addition, during the inference process, the cloud only obtains the output information of the original weight part of the model, and the final word probability distribution is calculated locally. By combining the calculation results of the cloud with the local LoRA calculation results, the final output is generated locally, which effectively prevents the cloud from inferring the output text and enhances the privacy protection of users.

[0062] Combine the following Figure 4 To describe the method of the present application.

[0063] As a specific example, the large language model output protection method of the present application may include the following steps:

[0064] S101, obtaining dimension information, an input vector, and a first output vector of an original weight matrix corresponding to a language model head layer of a large language model from a cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix.

[0065] S102, determining target ranks of the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix.

[0066] S103, determining a first low-rank matrix based on the input dimension and the target rank number, wherein the number of rows of the first low-rank matrix corresponds to the input dimension, and the number of columns of the first low-rank matrix corresponds to the target rank number, and determining a second low-rank matrix based on the target rank number and the vocabulary length, wherein the number of rows of the second low-rank matrix corresponds to the target rank number, and the number of columns of the second low-rank matrix corresponds to the vocabulary length, wherein the target rank number is smaller than the input dimension and the vocabulary length.

[0067] S104, determining a second output vector based on the product of the input vector, the first low-rank matrix, and the second low-rank matrix.

[0068] S105, obtaining a target vector by summing the first output vector and the second output vector.

[0069] S106, determining a target word probability distribution vector based on the target vector and the target function, wherein the target function is a softmax function.

[0070] In summary, according to the large language model output protection method of the embodiment of the present application, the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model are obtained from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix, the first low-rank matrix and the second low-rank matrix are determined based on the dimension information of the original weight matrix, the second output vector is determined based on the input vector, the first low-rank matrix and the second low-rank matrix, and the target word probability distribution vector output by the large language model is determined based on the first output vector and the second output vector. As a result, this method can prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model head, enhance privacy protection, and at the same time reduce the storage and computing overhead caused by deploying the complete language model head layer locally, and can also improve the adaptability of the large language model to downstream tasks.

[0071] Corresponding to the above embodiment, the present application also proposes a large language model output protection device.

[0072] like Figure 6 As shown, the large language model output protection device 100 of the embodiment of the present application includes: an acquisition module 110, a first determination module 120, a second determination module 130 and a third determination module 140.

[0073] Among them, the acquisition module 110 is used to obtain the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix. The first determination module 120 is used to determine the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix; the second determination module 130 is used to determine the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix. The third determination module 140 is used to determine the target word probability distribution vector output by the large language model based on the first output vector and the second output vector.

[0074] According to one embodiment of the present application, the third determination module 140 determines the target word probability distribution vector based on the first output vector and the second output vector, and is specifically used to: obtain the target vector based on the sum of the first output vector and the second output vector; determine the target word probability distribution vector based on the target vector and the objective function, wherein the objective function is a softmax function.

[0075] According to one embodiment of the present application, the second determination module 130 determines the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix, and is specifically used to determine the second output vector based on the product of the input vector, the first low-rank matrix and the second low-rank matrix.

[0076] According to one embodiment of the present application, the dimensional information includes the input dimension and vocabulary length of the language model head layer. The first determination module 120 determines the first low-rank matrix and the second low-rank matrix based on the dimensional information of the original weight matrix, and is specifically used to: determine the target rank number of the first low-rank matrix or the second low-rank matrix based on the dimensional information of the original weight matrix; determine the first low-rank matrix based on the input dimension and the target rank number, wherein the number of rows of the first low-rank matrix corresponds to the input dimension, and the number of columns of the first low-rank matrix corresponds to the target rank number; determine the second low-rank matrix based on the target rank number and the vocabulary length, wherein the number of rows of the second low-rank matrix corresponds to the target rank number, and the number of columns of the second low-rank matrix corresponds to the vocabulary length, wherein the target rank number is less than the input dimension and the vocabulary length.

[0077] According to one embodiment of the present application, the first determination module 120 is also used to: initialize the first low-rank matrix and the second low-rank matrix, wherein the initialization setting includes setting the initial parameters of the first low-rank matrix and the second low-rank matrix based on all-zero or random initialization; and adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on the target data set.

[0078] According to one embodiment of the present application, the first determination module 120 adjusts the parameters of the first low-rank matrix and the second low-rank matrix based on the target data set, and is specifically used to: determine the loss function based on the target data set; calculate the gradient of the loss function to the first low-rank matrix and the second low-rank matrix based on the back propagation algorithm; adjust the parameters of the first low-rank matrix and the second low-rank matrix based on the gradient and optimization algorithm to minimize the loss function, wherein the optimization algorithm includes an adaptive moment estimation optimization algorithm or a stochastic gradient descent optimization algorithm.

[0079] According to one embodiment of the present application, the first output vector and the second output vector have the same dimension.

[0080] It should be noted that for details not disclosed in the large language model output protection device of the embodiment of the present application, please refer to the details disclosed in the large language model output protection method of the embodiment of the present application, and the details will not be repeated here.

[0081] According to the large language model output protection device of the embodiment of the present application, the acquisition module is used to obtain the dimension information, input vector and first output vector of the original weight matrix corresponding to the language model head layer of the large language model from the cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix, the first determination module is used to determine the first low-rank matrix and the second low-rank matrix based on the dimension information of the original weight matrix, the second determination module is used to determine the second output vector based on the input vector, the first low-rank matrix and the second low-rank matrix, and the third determination module is used to determine the target word probability distribution vector output by the large language model based on the first output vector and the second output vector. Thus, the device can prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model head, enhance privacy protection, and at the same time reduce the storage and computing overhead caused by deploying the complete language model head layer locally, and can also improve the adaptability of the large language model in downstream tasks.

[0082] Corresponding to the above embodiments, the present application also proposes a computer-readable storage medium.

[0083] The computer-readable storage medium of the embodiment of the present application stores a program thereon, which, when executed by a processor, implements the above-mentioned large language model output protection method.

[0084] According to the computer-readable storage medium of the embodiment of the present application, by executing the above-mentioned large language model output protection method, it is possible to prevent the cloud from directly inferring the text output of the entire model based on the output of the language model header, thereby enhancing privacy protection. At the same time, it can also reduce the storage and computing overhead brought about by deploying the complete language model header layer locally, and can also improve the adaptability of the large language model in downstream tasks.

[0085] Corresponding to the above embodiment, the present application also proposes an electronic device.

[0086] like Figure 6 As shown, the electronic device 200 of the embodiment of the present application may include: a memory 210, a processor 220, and a program stored in the memory 210 and executable on the processor 220. When the processor 220 executes the program, the above-mentioned large language model output protection method is implemented.

[0087] According to the electronic device of the embodiment of the present application, by executing the above-mentioned large language model output protection method, it is possible to prevent the cloud from directly inferring the text output of the model as a whole based on the output of the language model header, thereby enhancing privacy protection. At the same time, it can also reduce the storage and computing overhead brought about by deploying the complete language model header layer locally, and can also improve the adaptability of the large language model in downstream tasks.

[0088] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0089] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0090] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0091] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0092] In this application, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0093] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A large language model output protection method, applied to a local end, characterized in that: The method comprises: Acquire dimension information, an input vector, and a first output vector of an original weight matrix corresponding to a language model head layer of the large language model from a cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix; Determine a first low-rank matrix and a second low-rank matrix based on the dimension information of the original weight matrix; determining a second output vector based on the input vector, the first low-rank matrix, and the second low-rank matrix; A target word probability distribution vector output by the large language model is determined based on the first output vector and the second output vector.

2. The large language model output protection method according to claim 1, characterized in that: The determining the target word probability distribution vector based on the first output vector and the second output vector includes: Obtaining a target vector by summing the first output vector and the second output vector; The target word probability distribution vector is determined based on the target vector and the target function, wherein the target function is a softmax function.

3. The large language model output protection method according to claim 1, characterized in that: Determining a second output vector based on the input vector, the first low-rank matrix, and the second low-rank matrix includes: The second output vector is determined based on a product of the input vector, the first low-rank matrix, and the second low-rank matrix.

4. The large language model output protection method according to claim 1, characterized in that: The dimensional information includes the input dimension and vocabulary length of the language model head layer, and the determining of the first low-rank matrix and the second low-rank matrix based on the dimensional information of the original weight matrix includes: Determine a target rank number of the first low-rank matrix or the second low-rank matrix based on dimensional information of the original weight matrix; Determine a first low-rank matrix based on the input dimension and the target rank number, wherein the number of rows of the first low-rank matrix corresponds to the input dimension, and the number of columns of the first low-rank matrix corresponds to the target rank number; A second low-rank matrix is ​​determined based on the target rank number and the vocabulary length, wherein the number of rows of the second low-rank matrix corresponds to the target rank number, and the number of columns of the second low-rank matrix corresponds to the vocabulary length, wherein the target rank number is smaller than the input dimension and the vocabulary length.

5. The large language model output protection method according to claim 1, characterized in that: The method further comprises: Initializing the first low-rank matrix and the second low-rank matrix, wherein the initialization includes setting initial parameters of the first low-rank matrix and the second low-rank matrix based on all-zero or random initialization; Parameters of the first low-rank matrix and the second low-rank matrix are adjusted based on a target data set.

6. The large language model output protection method according to claim 5, characterized in that: The adjusting the parameters of the first low-rank matrix and the second low-rank matrix based on the target data set includes: Determining a loss function based on the target data set; Calculate the gradient of the loss function with respect to the first low-rank matrix and the second low-rank matrix based on a back-propagation algorithm; Based on the gradient and an optimization algorithm, parameters of the first low-rank matrix and the second low-rank matrix are adjusted to minimize a loss function, wherein the optimization algorithm comprises an adaptive moment estimation optimization algorithm or a stochastic gradient descent optimization algorithm.

7. The large language model output protection method according to any one of claims 1 to 6, characterized in that: The first output vector and the second output vector have the same dimension.

8. A large language model output protection device, applied to a local end, characterized in that: The device comprises: An acquisition module, used to acquire dimension information, an input vector, and a first output vector of an original weight matrix corresponding to a language model head layer of the large language model from a cloud server, wherein the first output vector is determined based on the input vector and the original weight matrix; A first determining module, used to determine a first low-rank matrix and a second low-rank matrix based on the dimension information of the original weight matrix; A second determining module, configured to determine a second output vector based on the input vector, the first low-rank matrix, and the second low-rank matrix; A third determination module is used to determine a target word probability distribution vector output by the large language model based on the first output vector and the second output vector.

9. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, the large language model output protection method according to any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the large language model output protection method according to any one of claims 1 to 7 is implemented.

Images