Large Language Model Input Perturbation Method, Medium and System Based on Word Vectors

Abstract

The present invention discloses a large language model input perturbation method, medium and system based on word vectors. The method includes: obtaining text data to be processed and performing preprocessing to obtain a set of sensitive words; performing word vector representation on the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and inputting the benchmark word vector matrix into the large language model to obtain a corresponding benchmark output; fine-tuning the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and inputting the fine-tuned word vector matrix into the large language model to obtain a corresponding fine-tuned output; comparing the benchmark output and the fine-tuned output to determine the word vector perturbation range; perturbing the text data to be processed according to the word vector perturbation range to obtain the final large language model input; thereby effectively protecting the privacy of users, and at the same time, reducing the impact of privacy protection on the output results of the large language model.

Description

Technical Field

[0001] The present application relates to the technical field of large language model applications, and in particular to a large language model input perturbation method, medium and system based on word vectors. Background Art

[0002] With the rapid development of big data and artificial intelligence technology, the importance of data privacy protection has become increasingly prominent. Data encryption, differential privacy and other methods, as key technologies to protect data privacy, have been widely used in various fields.

[0003] In the related art, in the process of protecting the privacy of large language model inputs, a large amount of noise is often added to meet strict privacy protection requirements; and large language models usually need to parse and understand the input data to mine the features and patterns in the data for learning and reasoning. The addition of a large amount of noise makes it difficult for these inputs to be directly processed by the large language model, which greatly affects the accuracy of the large language model's output results and reduces the working efficiency of the large language model. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems in the related art to a certain extent. To this end, one purpose of the present invention is to propose a large language model input perturbation method based on word vectors, which can effectively protect the privacy of users and reduce the impact of privacy protection on the output results of the large language model.

[0005] In a first aspect, an embodiment of the present invention proposes a large language model input perturbation method based on word vectors, comprising the following steps: obtaining text data to be processed, and preprocessing the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; representing the text data to be processed by word vectors based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and inputting the benchmark word vector matrix into a large language model to obtain a corresponding benchmark output; fine-tuning the text data to be processed based on the sensitive word set to generate a fine-tuning word vector matrix, and inputting the fine-tuning word vector matrix into a large language model to obtain a corresponding fine-tuning output; comparing the benchmark output and the fine-tuning output to determine a word vector perturbation range; perturbing the text data to be processed according to the word vector perturbation range to obtain a final large language model input.

[0006] The large language model input perturbation method based on word vectors according to an embodiment of the present invention, first, obtains the text data to be processed, and preprocesses the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; then, represents the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and inputs the benchmark word vector matrix into the large language model to obtain a corresponding benchmark output; then, fine-tunes the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and inputs the fine-tuned word vector matrix into the large language model to obtain a corresponding fine-tuned output; then, compares the benchmark output and the fine-tuned output to determine the word vector perturbation range; then, perturbs the text data to be processed according to the word vector perturbation range to obtain the final large language model input, thereby effectively protecting the privacy of the user, and at the same time, reducing the impact of privacy protection on the output result of the large language model.

[0007] In some embodiments, comparing the benchmark output and the fine-tuned output to determine the word vector perturbation range includes: calculating the difference value between the benchmark output and the fine-tuned output; determining whether the difference value is greater than a preset difference threshold; if so, returning to the step of fine-tuning the text data to be processed based on the set of sensitive words; if not, taking the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and determining whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; if the number of compliance adjustment values is greater than the preset number threshold, ending the fine-tuning operation for the current fine-tuning vector, and returning to reselect the current fine-tuning vector based on the set of sensitive words.

[0008] In some embodiments, after comparing the benchmark output and the fine-tuned output to determine the word vector perturbation range, it further includes: calculating the cosine similarity between each word vector in the word vector perturbation range and the corresponding benchmark word vector in the benchmark word vector matrix; determining whether the cosine similarity is greater than a preset similarity threshold; if so, re-fine-tuning the word vector.

[0009] In some embodiments, preprocessing the text data to be processed includes: constructing a conditional random field model to identify the named entities corresponding to the text data to be processed through the conditional random field model, and obtaining a set of sensitive words corresponding to the text data to be processed based on the named entities;

[0010] Wherein, the conditional random field model determines the label corresponding to each word segment in the text data to be processed by maximizing the objective function;

[0011] The objective function is expressed by the following formula:

[0012] ;

[0013] Wherein, represents the objective function, represents the conditional probability, represents the th word segmentation, represents the th label of the word segmentation, represents the model parameter.

[0014] In some embodiments, perturbing the text data to be processed according to the word vector perturbation range includes:

[0015] Selecting a Gaussian function as a perturbation function to perturb the text data to be processed according to the word vector perturbation range;

[0016] Wherein, the Gaussian function is expressed by the following formula:

[0017] ;

[0018] Wherein, represents the Gaussian function, represents the input vector, represents the mean vector, represents the standard deviation, represents the vector dimension.

[0019] In some embodiments, perturbing the text data to be processed according to the word vector perturbation range includes: for each word vector within the word vector perturbation range, calculating a sensitivity value and a text importance value corresponding to the word vector; calculating a corresponding perturbation intensity value according to the sensitivity value and the text importance value to determine the perturbation intensity corresponding to each word vector.

[0020] In some embodiments, the method further includes: inputting the text data to be processed into a large language model so that the large language model outputs an original output corresponding to the text data to be processed and obtaining a corresponding first model performance; inputting the final large language model input into the large language model so that the large language model outputs a perturbed output corresponding to the final large language model input and obtaining a corresponding second model performance; comparing the original output and the perturbed output to calculate an effective protection value corresponding to the perturbation operation; comparing the first model performance and the second model performance to calculate a model performance impact value corresponding to the perturbation operation; evaluating the perturbation operation according to the effective protection value and the model performance impact value.

[0021] In a second aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a large language model input perturbation program based on word vectors is stored. When the large language model input perturbation program based on word vectors is executed by a processor, the above-mentioned large language model input perturbation method based on word vectors is implemented.

[0022] In a third aspect, an embodiment of the present invention provides a large language model input perturbation system based on word vectors, including: a preprocessing module, which is used to obtain the text data to be processed and preprocess the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; a word vector representation module, which is used to represent the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and input the benchmark word vector matrix into a large language model to obtain a corresponding benchmark output; a fine-tuning module, which is used to fine-tune the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and input the fine-tuned word vector matrix into a large language model to obtain a corresponding fine-tuned output; a comparison module, which is used to compare the benchmark output and the fine-tuned output to determine the word vector perturbation range; a perturbation module, which is used to perturb the text data to be processed according to the word vector perturbation range to obtain the final large language model input.

[0023] In some embodiments, comparing the benchmark word vector matrix and the fine-tuned word vector matrix to determine the word vector perturbation range includes: calculating the difference value between the benchmark word vector matrix and the fine-tuned word vector matrix; determining whether the difference value is greater than a preset difference threshold; if so, returning to the step of fine-tuning the text data to be processed based on the set of sensitive words; if not, taking the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and determining whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; if the number of compliance adjustment values is greater than the preset number threshold, ending the fine-tuning operation for the current fine-tuning vector, and returning to reselect the current fine-tuning vector based on the set of sensitive words.

[0024] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be understood through the practice of the present invention. Description of the Drawings

[0025] Figure 1 is a schematic flowchart of a large language model input perturbation method based on word vectors according to an embodiment of the present invention;

[0026] Figure 2It is a block diagram of a large language model input perturbation system based on word vectors according to an embodiment of the present invention. Detailed implementation manners

[0027] The embodiments of the present invention will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present invention, but should not be construed as limiting the present invention.

[0028] The following describes a word vector-based large language model input perturbation method according to an embodiment of the present invention with reference to the accompanying drawings.

[0029] Please refer to Figure 1 , Figure 1 which is a flowchart of a word vector-based large language model input perturbation method according to an embodiment of the present invention. As shown in Figure 1 , the word vector-based large language model input perturbation method includes the following steps:

[0030] S101, obtain the text data to be processed, and preprocess the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed.

[0031] In some embodiments, preprocessing the text data to be processed includes:

[0032] Construct a conditional random field model to identify the named entities corresponding to the text data to be processed through the conditional random field model, and obtain a set of sensitive words corresponding to the text data to be processed based on the named entities;

[0033] wherein, the conditional random field model determines the label corresponding to each word segment in the text data to be processed by maximizing the objective function;

[0034] The objective function is expressed by the following formula:

[0035] ;

[0036] wherein, represents the objective function, represents the conditional probability, represents the label of the th word segment, represents the th word segment, represents the model parameter.

[0037] As an example, first, parse the text data to be processed, and use a named entity recognition algorithm to identify the named entities in the text data to be processed by constructing a conditional random field model. Assume that the text data to be processed consists of a series of word segments It consists of. The conditional random field model determines the label corresponding to each word segmentation in the text data to be processed by maximizing the following objective function:

[0038] ;

[0039] where, denotes the objective function, denotes the conditional probability (that is, the probability that the \(i\)-th word segmentation is the label \(y_i\) under the condition of the given entire text data sequence \(\mathbf{x}\) and the model parameters \(\theta\)); the \(i\)-th word segmentation is the label \(y_i\); \(y_i\) represents the label of the \(i\)-th word segmentation, which is used to indicate whether the word segmentation is a sensitive word; specifically, it can take values according to the model setting. For example, it can use 1 to represent a sensitive word and 0 to represent a non-sensitive word), \(x_i\) represents the \(i\)-th word segmentation, and \(\theta\) represents the model parameters. At the same time, combining the part-of-speech tagging technology, based on the pre-trained part-of-speech tagging model, each word segmentation is tagged with a part of speech, and by integrating the results of the named entity recognition algorithm and POS, the vocabulary set that may contain sensitive information in the text data to be processed is identified, that is, the sensitive word set.

[0040] S102. Represent the text data to be processed based on the word vector model to obtain the corresponding benchmark word vector matrix of the text data to be processed, and input the benchmark word vector matrix into the large language model to obtain the corresponding benchmark output.

[0041] As an example, first, according to the specific application scenario and the characteristics of the large language model, a suitable word vector model is selected. For example, Word2Vec, whose Skip - Gram model learns word vectors by maximizing the following objective function:

[0042] ;

[0043] where, \(w_i\) is the center word, \(w_j\) is the context word within the window, \(C_i\) is the set of context words of \(w_i\), and \(\theta\) is the model parameter. Set the window size to \(m\) (when processing each center word \(w_i\), the words \(m\) words to the left and right of \(w_i\) are considered as context words. When \(m\) is odd, one side has one more word than the other side), and the vector dimension is ​, train the text to obtain each central word The corresponding word vector.

[0044] S103, fine-tune the text data to be processed based on the sensitive word set to generate a fine-tuned word vector matrix, and input the fine-tuned word vector matrix into the large language model to obtain the corresponding fine-tuned output.

[0045] S104, compare the baseline output and the fine-tuned output to determine the word vector perturbation range.

[0046] In some embodiments, comparing the baseline output and the fine-tuned output to determine the word vector perturbation range includes: calculating the difference value between the baseline output and the fine-tuned output; determining whether the difference value is greater than a preset difference threshold; if so, returning to the step of fine-tuning the text data to be processed based on the sensitive word set; if not, taking the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and determining whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; if the number of compliance adjustment values is greater than the preset number threshold, ending the fine-tuning operation for the current fine-tuning vector, and returning to reselect the current fine-tuning vector based on the sensitive word set.

[0047] In some embodiments, after comparing the baseline output and the fine-tuned output to determine the word vector perturbation range, it further includes: calculating the cosine similarity between each word vector in the word vector perturbation range and the corresponding baseline word vector in the baseline word vector matrix; determining whether the cosine similarity is greater than a preset similarity threshold; if so, re-fine-tuning the word vector.

[0048] As an example, first, input the baseline word vector matrix corresponding to the text data to be processed into the large language model to obtain the corresponding baseline output; then, select a word vector as the current fine-tuning vector based on the sensitive word set, and fine-tune the current fine-tuning vector to generate a fine-tuned word vector matrix; then, input the fine-tuned word vector matrix into the large language model to obtain the corresponding fine-tuned output; then, calculate the difference value between the baseline output and the fine-tuned output; then, determine whether the difference value is greater than a preset difference threshold, if so, return to the step of fine-tuning the current fine-tuning vector; if not, taking the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and determining whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; if the number of compliance adjustment values is greater than the preset number threshold, it means that the perturbation range corresponding to the current fine-tuning vector has been determined, ending the fine-tuning operation for the current fine-tuning vector, and returning to the step of selecting a word vector as the current fine-tuning vector based on the sensitive word set until each word vector in the sensitive word set has been traversed.

[0049] As another example, in order to further improve the accuracy of determining the word vector perturbation range, after comparing the baseline output and the fine-tuned output to determine the word vector perturbation range, the final word vector perturbation range is also determined by calculating the cosine similarity between word vectors; First, for any two word vectors, the cosine similarity is defined as:

[0050] ;

[0051] where, represents the dot product of vector and vector . and respectively represent the norms of vector and vector (here it is the two-norm, that is, the length of the vector). Set a cosine similarity threshold . For the sensitive word vector , filter out the vector set with a similarity higher than to to determine the final word vector perturbation range.

[0052] S105, Perturb the text data to be processed according to the word vector perturbation range to obtain the final input of the large language model.

[0053] In some embodiments, perturbing the text data to be processed according to the word vector perturbation range includes:

[0054] Select the Gaussian function as the perturbation function according to the word vector perturbation range to perturb the text data to be processed;

[0055] where, the Gaussian function is expressed by the following formula:

[0056] ;

[0057] where, represents the Gaussian function, represents the input vector, represents the mean vector, represents the standard deviation, represents the vector dimension.

[0058] As an example, first, select the Gaussian function as the perturbation function according to the word vector perturbation range, and the Gaussian function is expressed by the following formula:

[0059] ;

[0060] where, represents the Gaussian function, represents the input vector, denotes the mean vector, denotes the standard deviation, denotes the vector dimension.

[0061] In this way, according to the requirements of the word vector perturbation range and the privacy protection strength, the Gaussian function parameters can be adjusted. If stronger privacy protection is needed, can be appropriately increased; if it is desired to minimize the impact on the data, then can be decreased. Let the privacy protection strength parameter be , and through experiments, establish and relationship, such as , where is a function obtained by experimental fitting.

[0062] In some embodiments, perturbing the text data to be processed according to the word vector perturbation range includes: for each word vector within the word vector perturbation range, calculating the sensitivity value and the text importance value corresponding to the word vector; calculating the corresponding perturbation strength value according to the sensitivity value and the text importance value to determine the perturbation strength corresponding to each word vector.

[0063] That is to say, in order to improve the accuracy of perturbation, not all word vectors in the sensitive word set are perturbed to the same degree. Instead, different degrees of perturbation are performed according to the sensitivity and text importance.

[0064] Specifically, for calculating the sensitivity value: construct a sensitivity evaluation system and assign corresponding weights according to the sensitive word type. For example, sensitive words involving personal identity information such as ID numbers and names are assigned high weights; relatively less important sensitive words such as general industry terms containing business sensitive information are assigned low weights. The weight system is determined with reference to industry standards, laws and regulations, and actual application scenarios.

[0065] For calculating the text importance value: starting from the text semantic structure and logical relationship, with the help of natural language processing techniques (such as dependency syntax analysis), analyze the dependency relationship between the sensitive word and other words to judge its importance in the text. If the sensitive word is in the core position of the sentence and plays a key role in semantic expression, its importance is high; otherwise it is low. For example, in the text describing an event, the importance of the core participant (sensitive word) of the event is higher than that of the modifying sensitive word.

[0066] Calculation of perturbation intensity value: Integrate the sensitivity value and the text importance value, and calculate the comprehensive score for each sensitive word through weighted summation. For example: Perturbation intensity value = Sensitivity weight × Sensitivity value + Text importance weight × Text importance value. Set a threshold accordingly. For the sensitive word vector with a perturbation intensity value greater than the threshold, it is regarded as the key perturbation object and a larger perturbation intensity is adopted; for the sensitive word vector with a perturbation intensity value less than or equal to the threshold, the perturbation intensity is reduced or even not perturbed, so as to balance privacy protection and the processing effect of the large language model. Alternatively, preset the perturbation intensity corresponding to the reference perturbation intensity value, and further determine the final perturbation intensity according to the ratio between the perturbation intensity value and the reference perturbation intensity value.

[0067] Next, select the Gaussian perturbation function to process the selected sensitive word vector . The Gaussian perturbation function can flexibly control the degree and range of perturbation by adjusting parameters to balance the requirements of privacy protection and semantic preservation. Substitute the selected sensitive word vector into the Gaussian perturbation function to obtain the perturbed word vector . That is:

[0068] ;

[0069] Among them, is a random vector sampled from the Gaussian distribution . Here, represents the zero vector, indicating that the center of perturbation is around the original word vector; is the variance of the Gaussian distribution, which determines the amplitude of perturbation. The larger the variance, the greater the amplitude of perturbation; is the identity matrix with the same dimension as the word vector, ensuring that the sampled random vector has the same dimension as the word vector , so that operations can be performed. For example, if the word vector is a -dimensional vector, then the identity matrix is also a matrix, and the random vector sampled from the Gaussian distribution is also a -dimensional vector, which ensures the consistency and feasibility of mathematical operations.

[0070] At the same time, considering the semantic coherence of the text, if a certain sensitive word plays a key semantic connection role in the text, its perturbation degree should be carefully evaluated to avoid causing great damage to the text semantics due to excessive perturbation. At this time, the variance , the sensitive word vectors at different positions in the text are perturbed to different degrees to obtain an ideal perturbation result.

[0071] Finally, the perturbed word vectors are used to replace the word vectors corresponding to the sensitive words in the original text, forming perturbed text data. During the replacement process, the structural rules of the text are strictly followed to ensure that the word order and part-of-speech collocations meet the grammatical requirements, and to ensure that the structure and basic semantics of the text remain relatively intact after replacement for the subsequent normal processing of the large language model.

[0072] As an example, before inputting the final large language model into the large language model, the perturbed text data to be processed is also formatted to meet the input requirements of the large language model. For example, the text is tokenized to obtain the corresponding sub-sequence, and it is converted into a tensor form acceptable to the model, such as adding position encoding, segment encoding, etc. operations to obtain the input tensor.

[0073] Finally, the prepared input tensor is input into the large language model , and the model performs calculations through a series of neural network layers. For example, a large language model composed of multiple Transformer blocks, each Transformer block contains a self-attention mechanism and a feed-forward neural network. Taking the self-attention mechanism as an example, its calculation process is as follows:

[0074] ;

[0075] Among them, , , are the query matrix, the key matrix, and the value matrix respectively, which jointly determine the focus of the model's attention to the input information and the feature extraction direction. is the key matrix 's dimension, which is used to scale the calculation result of to make the input of the function within a suitable range, thereby avoiding problems such as gradient vanishing or explosion during the calculation of the function. After the above calculation process, the model can generate a weighted output based on the input query, key, and value matrices. This output integrates the feature information at different positions to help the model better capture the long-range dependencies in the sequence. After layer-by-layer calculations through multiple Transformer blocks, the final inference result is output .

[0076] In some embodiments, the method further includes: inputting the text data to be processed into a large language model so that the large language model outputs the original output corresponding to the text data to be processed, and obtaining the corresponding first model performance; inputting the final large language model input into the large language model so that the large language model outputs the perturbed output corresponding to the final large language model input, and obtaining the corresponding second model performance; comparing the original output and the perturbed output to calculate the effective protection value corresponding to the perturbation operation; comparing the first model performance and the second model performance to calculate the model performance impact value corresponding to the perturbation operation; and evaluating the perturbation operation according to the effective protection value and the model performance impact value.

[0077] That is to say, further analyze the impact of the perturbed data on the model performance and whether it effectively protects privacy, so as to adjust the perturbation process according to the analysis results.

[0078] Specifically, first, input the text data to be processed and the perturbed text data to be processed into a privacy detection model The privacy detection model evaluates the privacy risk by calculating the sensitive information leakage index and measures it by calculating the entropy difference of sensitive information in the original text and the perturbed text:

[0079] ;

[0080] where is the information entropy, which is used to measure the uncertainty or chaos degree of text information. For the text , the calculation formula of its information entropy is , where represents the word in the text , and by summing and taking the negative of each word in the text , the information entropy of the text is obtained, which reflects the information chaos degree of the text , and then the sensitive information leakage index is obtained by taking the difference from .

[0081] Alternatively, it can be evaluated manually: that is, invite professionals to review the perturbed text to judge whether the sensitive information is effectively protected and whether there is a potential privacy leakage risk.

[0082] Then, perform model performance evaluation:

[0083] First, perform metric selection: Select appropriate performance metrics according to the application scenarios of large language models. In text generation tasks, the perplexity (PP) metric can be used to evaluate the quality of the generated text. The perplexity is defined as:

[0084] ;

[0085] where represents the total number of words in the generated text, is the probability of generating the -th word. The lower the perplexity, the relatively better the quality of the text generated by the model. In text classification tasks, metrics such as accuracy, recall, and F1-score are used to evaluate performance.

[0086] As a specific embodiment of the present invention, the large language model input perturbation method based on word vectors includes the following steps:

[0087] S201, Obtain the text data to be processed, and preprocess the text data to be processed to obtain the set of sensitive words corresponding to the text data to be processed.

[0088] S202, Perform word vector representation on the text data to be processed based on the word vector model to obtain the benchmark word vector matrix corresponding to the text data to be processed, and input the benchmark word vector matrix into the large language model to obtain the corresponding benchmark output.

[0089] S203, Randomly select an unfinely-tuned word vector from the set of sensitive words as the current fine-tuning vector.

[0090] S204, Randomly fine-tune the current fine-tuning vector to generate a fine-tuned word vector matrix.

[0091] S205, Input the fine-tuned word vector matrix into the large language model to obtain the corresponding fine-tuned output.

[0092] S206, Calculate the difference value between the benchmark output and the fine-tuned output.

[0093] S207, Determine whether the difference value is greater than the preset difference threshold; if so, execute step S204; if not, execute step S208.

[0094] S208, Take the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector.

[0095] S209, Determine whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than the preset number threshold; if so, execute step S210; if not, execute step S204.

[0096] S210, Determine whether the word vectors in the sensitive word set have all been fine-tuned; if so, execute step S211; if not, execute step S203.

[0097] S211, Output the preselected word vector perturbation range.

[0098] S212, Randomly select any word vector within the preselected word vector perturbation range as the current matching vector.

[0099] S213, Calculate the cosine similarity between the current matching vector and the benchmark word vector corresponding to this word vector in the benchmark word vector matrix.

[0100] S214; Determine whether the cosine similarity is greater than the preset similarity threshold; if so, use the current matching vector as the current fine-tuned vector and return to step S204; if not, execute step S215.

[0101] S215, Determine whether all the word vectors within the preselected word vector perturbation range have been traversed; if so, execute step S216; if not, execute step S212.

[0102] S216, Output the final word vector perturbation range.

[0103] S217, For each word vector within the final word vector perturbation range, calculate the sensitivity value and text importance value corresponding to the word vector.

[0104] S218, Calculate the corresponding perturbation intensity value based on the sensitivity value and text importance value to determine the perturbation intensity corresponding to each word vector.

[0105] S219, Perturb the benchmark word vector based on the determined perturbation intensity to obtain the final input for the large language model.

[0106] In summary, according to the method for perturbing the input of a large language model based on word vectors according to an embodiment of the present invention, first, obtain the text data to be processed, and preprocess the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; then, perform word vector representation on the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and input the benchmark word vector matrix into the large language model to obtain a corresponding benchmark output; then, fine-tune the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and input the fine-tuned word vector matrix into the large language model to obtain a corresponding fine-tuned output; then, compare the benchmark output and the fine-tuned output to determine the word vector perturbation range; then, perturb the text data to be processed according to the word vector perturbation range to obtain the final input of the large language model, thereby effectively protecting the privacy of users. At the same time, the impact of privacy protection on the output results of the large language model is reduced.

[0107] In a second aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a program for perturbing the input of a large language model based on word vectors is stored. When the program for perturbing the input of a large language model based on word vectors is executed by a processor, the method for perturbing the input of a large language model based on word vectors as described above is implemented.

[0108] In a third aspect, an embodiment of the present invention provides a system for perturbing the input of a large language model based on word vectors, as Figure 2 shown. The system for perturbing the input of a large language model based on word vectors includes a preprocessing module 10, a word vector representation module 20, a fine-tuning module 30, a comparison module 40, and a perturbation module 50.

[0109] Among them, the preprocessing module 10 is used to obtain the text data to be processed and preprocess the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed;

[0110] The word vector representation module 20 is used to perform word vector representation on the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and input the benchmark word vector matrix into the large language model to obtain a corresponding benchmark output;

[0111] The fine-tuning module 30 is used to fine-tune the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and input the fine-tuned word vector matrix into the large language model to obtain a corresponding fine-tuned output;

[0112] The comparison module 40 is used to compare the benchmark output and the fine-tuned output to determine the word vector perturbation range;

[0113] The perturbation module 50 is used to perturb the to-be-processed text data according to the word vector perturbation range to obtain the final input for the large language model.

[0114] In some embodiments, comparing the baseline output and the fine-tuned output to determine the word vector perturbation range includes: calculating the difference value between the baseline output and the fine-tuned output; determining whether the difference value is greater than a preset difference threshold; if so, returning to the step of fine-tuning the to-be-processed text data based on the sensitive word set; if not, taking the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and determining whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; if the number of compliance adjustment values is greater than the preset number threshold, ending the fine-tuning operation for the current fine-tuning vector and returning to reselect the current fine-tuning vector based on the sensitive word set.

[0115] It should be noted that the above description of the large language model input perturbation method based on word vectors also applies to this large language model input perturbation system based on word vectors and will not be elaborated here.

[0116] It should be noted that the logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or used in combination with these instruction execution systems, apparatuses, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion having one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other appropriate processing as necessary, and then stored in a computer memory.

[0117] It should be understood that each part of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following technologies well known in the art can be used: discrete logic circuits with logic gate circuits for implementing logical functions on data signals, application specific integrated circuits with appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), and the like.

[0118] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0119] In the description of the present invention, it should be understood that the orientation or positional relationship indicated by the terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be understood as a limitation of the present invention.

[0120] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, the meaning of "a plurality" is at least two, such as two, three, etc., unless otherwise specifically and clearly defined.

[0121] In the present invention, unless otherwise clearly defined or limited, terms such as "installed", "connected", "coupled", "fixed", etc. shall be construed broadly. For example, it may be a fixed connection, a detachable connection, or integrated; it may be a mechanical connection or an electrical connection; it may be directly connected or indirectly connected through an intermediate medium, and it may be the internal communication of two components or the interaction relationship between two components, unless otherwise clearly defined. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0122] In the present invention, unless otherwise clearly defined or limited, the first feature being "on" or "under" the second feature may be that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, the first feature being "above", "over" and "on top of" the second feature may be that the first feature is directly above or obliquely above the second feature, or merely indicates that the first feature has a higher horizontal height than the second feature. The first feature being "under", "beneath" and "underneath" the second feature may be that the first feature is directly below or obliquely below the second feature, or merely indicates that the first feature has a lower horizontal height than the second feature.

[0123] Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for perturbing the input of a large language model based on word vectors, characterized in that It includes the following steps: Obtain the text data to be processed, and preprocess the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; Perform word vector representation on the text data to be processed based on a word vector model to obtain a benchmark word vector matrix corresponding to the text data to be processed, and input the benchmark word vector matrix into a large language model to obtain a corresponding benchmark output; Fine-tune the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix, and input the fine-tuned word vector matrix into a large language model to obtain a corresponding fine-tuned output; Compare the benchmark output and the fine-tuned output to determine the word vector perturbation range; Perturb the text data to be processed according to the word vector perturbation range to obtain the final input for the large language model; Among them, comparing the benchmark output and the fine-tuned output to determine the word vector perturbation range includes: Calculate the difference value between the benchmark output and the fine-tuned output; Judge whether the difference value is greater than a preset difference threshold; If so, return to the step of fine-tuning the text data to be processed based on the set of sensitive words; If not, take the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector, and judge whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; If the number of compliance adjustment values is greater than the preset number threshold, end the fine-tuning operation for the current fine-tuning vector, and return to reselect the current fine-tuning vector based on the set of sensitive words; After comparing the benchmark output and the fine-tuned output to determine the word vector perturbation range, it further includes: Calculate the cosine similarity between each word vector in the word vector perturbation range and the corresponding benchmark word vector in the benchmark word vector matrix; Judge whether the cosine similarity is greater than a preset similarity threshold; If so, re-fine-tune the word vector; Perturb the text data to be processed according to the word vector perturbation range, including: For each word vector within the word vector perturbation range, calculate the sensitivity value and text importance value corresponding to the word vector; Calculate the corresponding perturbation force value according to the sensitivity value and the text importance value to determine the perturbation force corresponding to each word vector.

2. The method for perturbing the input of a large language model based on word vectors according to claim 1, wherein, Preprocessing the text data to be processed includes: Construct a conditional random field model to identify the named entities corresponding to the text data to be processed through the conditional random field model, and obtain a set of sensitive words corresponding to the text data to be processed based on the named entities; Among them, the conditional random field model determines the label corresponding to each word segment in the text data to be processed by maximizing the objective function; The objective function is expressed by the following formula: ； in, represents the objective function, represents the conditional probability, Indicates The tag of the word segmentation, Indicates participle, Represents model parameters.

3. The method for perturbing the input of a large language model based on word vectors according to claim 1, wherein Perturb the text data to be processed according to the word vector perturbation range, including: According to the word vector perturbation range, select a Gaussian function as the perturbation function to perturb the text data to be processed; Among them, the Gaussian function is expressed by the following formula: ； Among them, represents the Gaussian function, represents the input vector, represents the mean vector, represents the standard deviation, represents the vector dimension.

4. The method for perturbing the input of a large language model based on word vectors according to claim 1, wherein It also includes: Input the text data to be processed into a large language model so that the large language model outputs the original output corresponding to the text data to be processed and obtain the corresponding first model performance; Input the input of the final large language model into a large language model so that the large language model outputs the perturbed output corresponding to the input of the final large language model and obtain the corresponding second model performance; Compare the original output and the perturbed output to calculate the effective protection value corresponding to the perturbation operation; Compare the first model performance and the second model performance to calculate the model performance impact value corresponding to the perturbation operation; Evaluate the perturbation operation according to the effective protection value and the model performance impact value.

5. A computer-readable storage medium, characterized in that, Stored thereon is a large language model input perturbation program based on word vectors, and when the large language model input perturbation program based on word vectors is executed by a processor, it implements the large language model input perturbation method based on word vectors as described in any one of claims 1-4.

6. A large language model input perturbation system based on word vectors, characterized in that, Comprising: A preprocessing module for obtaining text data to be processed and preprocessing the text data to be processed to obtain a set of sensitive words corresponding to the text data to be processed; A word vector representation module for representing the text data to be processed based on a word vector model to obtain a reference word vector matrix corresponding to the text data to be processed and inputting the reference word vector matrix into a large language model to obtain a corresponding reference output; A fine-tuning module for fine-tuning the text data to be processed based on the set of sensitive words to generate a fine-tuned word vector matrix and inputting the fine-tuned word vector matrix into a large language model to obtain a corresponding fine-tuned output; A comparison module for comparing the reference output and the fine-tuned output to determine the word vector perturbation range; A perturbation module for perturbing the text data to be processed according to the word vector perturbation range to obtain the input of the final large language model; Comparing the reference output and the fine-tuned output to determine the word vector perturbation range, including: Calculating the difference value between the reference output and the fine-tuned output; Judging whether the difference value is greater than a preset difference threshold; If so, return to the step of fine-tuning the text data to be processed based on the set of sensitive words; If not, use the fine-tuning operation corresponding to the current fine-tuning vector as the compliance adjustment value of the current fine-tuning vector and judge whether the number of compliance adjustment values corresponding to the current fine-tuning vector is greater than a preset number threshold; If the number of compliance adjustment values is greater than the preset number threshold, end the fine-tuning operation for the current fine-tuning vector and return to reselect the current fine-tuning vector based on the set of sensitive words; After comparing the reference output and the fine-tuned output to determine the word vector perturbation range, further comprising: Calculating the cosine similarity between each word vector in the word vector perturbation range and the corresponding reference word vector in the reference word vector matrix; Judging whether the cosine similarity is greater than a preset similarity threshold; If so, re-fine-tune the word vector; Perturb the text data to be processed according to the word vector perturbation range, including: For each word vector within the word vector perturbation range, calculate the sensitivity value and text importance value corresponding to the word vector; Calculate the corresponding perturbation intensity value according to the sensitivity value and the text importance value to determine the perturbation intensity corresponding to each word vector.

Images