Security assessment method, device, equipment and storage medium for multimodal large models

Abstract

The embodiments of the present application provide a security assessment method, apparatus, device and storage medium for a multimodal large model. The method includes the model owner performing quantization processing and nonlinear function approximation processing on the multimodal large model to obtain an initialized multimodal large model, and encrypting the weights of the initialized multimodal large model and sending them to different security agents. The client hierarchically vectorizes the constructed hybrid query data set, obtains the reasoning query data set, and encrypts and sends it to different security agents. Different security agents perform secure collaborative reasoning on the reasoning query data set and the weights of the initialized multimodal large model, obtain the reasoning results, and send the reasoning results to the client. The client decrypts and reconstructs the reasoning results sent by different security agents, obtains the reasoning prediction results and verifies them to determine whether the service provider is safe and available. In this way, the threat of malicious service providers can be effectively avoided.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of machine learning, and in particular to security assessment methods, devices, equipment, and storage media for multimodal large models. Background Art

[0002] In recent years, with the rise of the Transformer model architecture and the widespread adoption of the ubiquitous computing paradigm, large multimodal models (LMMs), with their powerful ability to process and understand multimodal data (such as text, images, video, and audio), have demonstrated tremendous potential and gained widespread application in areas such as image-text retrieval, speech recognition, and cross-domain predictive analytics. However, the power of LMMs also comes with increasingly severe privacy and security challenges. On the one hand, service providers may illegally collect and analyze user request data without explicit authorization, leading to the leakage of user privacy information. On the other hand, malicious attackers may attempt to steal or abuse LMM weight parameters to conduct inference attacks on user data, resulting in further privacy violations. In the context of ubiquitous computing, LMM inference services are often deployed on edge devices or in the cloud, further exacerbating the risk of privacy leakage. Furthermore, existing secure inference solutions primarily focus on single-modal scenarios, while directly migrating to multimodal inference faces computational incompatibility and significant inference overhead.

[0003] Therefore, there is an urgent need for a lightweight and secure multimodal large model security evaluation method to deal with the threat of malicious service providers and ensure the safe and reliable application of LMMs in ubiquitous computing environments. Summary of the Invention

[0004] According to the embodiments of the present application, a security assessment method, apparatus, device and storage medium for a multimodal large model are provided, which can effectively avoid threats from malicious service providers.

[0005] In a first aspect of the present application, a security assessment method for a multimodal large model is provided. The method comprises:

[0006] The model owner quantizes the multimodal large model to obtain a quantized multimodal large model, then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model, and encrypts the weights of the initialized multimodal large model and sends them to different security agents.

[0007] The client merges and shuffles the public dataset and the query dataset to construct a hybrid query dataset. It then performs hierarchical vectorization on the hybrid query dataset to obtain the inference query dataset, which it then encrypts and sends to different security agents.

[0008] Different security agents perform secure collaborative reasoning on the reasoning query dataset and the weights of the initialized multimodal large model, obtain the reasoning results, and send the reasoning results to the client;

[0009] The client decrypts and reconstructs the inference results sent by different security agents to obtain the inference prediction results, and then verifies the inference prediction results based on the real label values ​​in the inference query dataset to determine whether the service provider is safe and available.

[0010] In one possible implementation, the model owner performs quantization on the multimodal large model, including:

[0011] Quantize the weights of multimodal large models to float16.

[0012] In one possible implementation, nonlinear function approximation processing is performed on the quantized multimodal large model, including:

[0013] Replace the sigmoid function in the quantized multimodal large model with the Approxsigmoid function;

[0014] Replace the GeLU function in the quantized multimodal large model with the ApproxGeLU function;

[0015] Replace the Softmax function in the quantized multimodal large model with the ApproxSoftmax function.

[0016] In one possible implementation, the weights of the initialized multimodal large model are encrypted and sent to different security agents, including:

[0017] Secret sharing of weights for initializing large multimodal models;

[0018] The weights of the initialized multimodal large model are split and encrypted to obtain encrypted weight blocks;

[0019] The encryption weight blocks are sent separately to different security agents.

[0020] In one possible implementation, hierarchical vectorization is performed on the mixed query dataset to obtain an inference query dataset, including:

[0021] According to the modalities of the data in the mixed query dataset, different preprocessing methods are used to perform independent feature encoding on the data to obtain the inference query dataset.

[0022] In one possible implementation, different security agents perform secure collaborative reasoning on the reasoning query dataset and the weights of the initialized multimodal large model, respectively, to obtain reasoning results, including:

[0023] Secure collaborative reasoning uses the MPC multi-party secure computing mechanism;

[0024] Different security agents perform security reasoning based on the reasoning query dataset and the weights of the initialized multimodal large model to obtain initial reasoning results;

[0025] Perform privacy encryption calculation based on the initial inference result and Beaver triples to obtain the inference result.

[0026] In one possible implementation, the inference prediction results are verified based on the true label values ​​in the inference query dataset to determine whether the service provider is safe and available, including:

[0027] Calculate the number of safe data in the inference prediction results that have the same true label value as the inference query dataset;

[0028] If the amount of security data is greater than the verification threshold, the service provider is safe and available;

[0029] If the amount of security data is less than or equal to the verification threshold, the service provider will not be adopted;

[0030] Service providers include different security agents and model owners.

[0031] In a second aspect of the present application, a security assessment device for a multimodal large model is provided. The device comprises:

[0032] In the model preprocessing module, the model owner quantizes the multimodal large model to obtain a quantized multimodal large model. The quantized multimodal large model is then approximated using nonlinear functions to obtain an initialized multimodal large model. The weights of the initialized multimodal large model are encrypted and sent to different security agents.

[0033] In the data preprocessing module, the client merges and shuffles the public dataset and the query dataset to construct a hybrid query dataset. The hybrid query dataset is then hierarchically vectorized to obtain the inference query dataset, which is then encrypted and sent to different security agents.

[0034] Inference model: Different security agents perform secure collaborative reasoning on the reasoning query dataset and the weights of the initialized multimodal large model, obtain the reasoning results, and send the reasoning results to the client;

[0035] In the verification module, the client decrypts and reconstructs the inference results sent by different security agents to obtain the inference prediction results, and then verifies the inference prediction results based on the real label values ​​in the inference query dataset to determine whether the service provider is safe and available.

[0036] In a third aspect of the present application, an electronic device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor implements the above method when executing the program.

[0037] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect of the present application is implemented.

[0038] The security assessment method for multimodal large models provided in the embodiment of the present application is as follows: first, the model owner quantizes the multimodal large model to obtain a quantized multimodal large model, and then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model, and encrypts the weights of the initialized multimodal large model and sends them to different security agents. Then, the client merges and scrambles the public data set and the query data set to construct a hybrid query data set, and then hierarchically vectorizes the hybrid query data set to obtain an inference query data set, and encrypts and sends it to different security agents. Secondly, different security agents perform secure collaborative inference on the inference query data set and the weights of the initialized multimodal large model, obtain inference results, and send the inference results to the client. Finally, the client decrypts and reconstructs the inference results sent by different security agents to obtain inference prediction results, and then verifies the inference prediction results based on the true label values ​​in the inference query data set to determine whether the service provider is safe and available. The model is compressed to half its size through quantization processing, and nonlinear function approximation processing is used to enable the model to adapt to different security computing requirements. At the same time, the data set is merged, shuffled and hierarchically vectorized to improve the reasoning accuracy of the model. Finally, the reasoning results are decrypted, reconstructed and verified, effectively realizing the identification of unreliable service providers and avoiding threats or attacks on clients by unreliable service providers.

[0039] It should be understood that the contents described in the Summary of the Invention are not intended to limit the key or important features of the embodiments of the present application, nor are they intended to limit the scope of the present application. Other features of the present application will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0041] Figure 1 Flowchart of a security assessment method for a multimodal large model according to an embodiment of the present application;

[0042] Figure 2A flowchart of secret sharing according to an embodiment of the present application;

[0043] Figure 3 A diagram of the system architecture involved in the method provided in the embodiments of this application;

[0044] Figure 4 is a block diagram of a security assessment device for a multimodal large model according to an embodiment of the present application;

[0045] Figure 5 A schematic diagram of the structure of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0046] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present disclosure.

[0047] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0048] Figure 1 A flowchart of a security assessment method for a multimodal large model according to an embodiment of the present disclosure is shown. Figure 1 shown.

[0049] S101, the model owner quantizes the multimodal large model to obtain a quantized multimodal large model, then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model, and encrypts the weights of the initialized multimodal large model and sends them to different security agents.

[0050] In this embodiment, quantization reduces the size of the large multimodal model, lowering storage and transmission costs while also increasing the difficulty of reverse engineering. Nonlinear function approximation is then performed on the quantized large multimodal model, further obscuring the original model's structure and parameter information and providing a foundation for subsequent secure and private computations.

[0051] Optionally, the model owner performs quantization on the multimodal large model, including:

[0052] Quantize the weights of multimodal large models to float16.

[0053] In this embodiment, float16 is a 16-bit floating point format. Quantizing the weights of the multimodal large model to float16 can reduce the memory usage by half compared to the original 32-bit floating point format float32, thereby reducing storage and transmission costs.

[0054] Optionally, nonlinear function approximation processing is performed on the quantized multimodal large model, including:

[0055] Replace the sigmoid function in the quantized multimodal large model with the Approxsigmoid function;

[0056] Replace the GeLU function in the quantized multimodal large model with the ApproxGeLU function;

[0057] Replace the Softmax function in the quantized multimodal large model with the ApproxSoftmax function.

[0058] Among them, the Sigmoid function, GeLU function, and Softmax function, as three indispensable activation functions in large-scale multimodal models, play a vital role in the model training process to help the model learn and represent input data more accurately. Among them, the Sigmoid function mainly plays its unique role in gating mechanisms, binary classification tasks, and feature combination. The GeLU function was originally widely used in the Transformer model. With its excellent performance improvement and ability to combat gradient disappearance, it has become the key to improving model generalization and has gradually become popular in the field of multimodal models. The Softmax function performs outstandingly in multi-classification tasks and attention mechanisms. It can effectively convert model outputs into probability distributions, facilitating probabilistic interpretation and category decisions. The core of the multimodal large model LMMs in this application is the Transformer module. The Transformer module can capture and model the complex relationships between different modal features through the attention mechanism. The Transformer module includes an attention mechanism, a feedforward neural network, and a normalization layer. The Softmax function is used in the attention mechanism to calculate the similarity between the query value and the key value, and the GeLU function or Sigmoid function is used as the activation function in the feedforward neural network.

[0059] In the present invention, the sigmoid function calculation formula in the quantized multimodal large model is:

[0060] .

[0061] The input variable x of the sigmoid function is the output vector of the fully connected layer in the feedforward neural network. Then, the calculation formula of the Approxsigmoid function after the nonlinear function approximation is:

[0062] .

[0063] in, and is a preset hyperparameter with a value range of 1 to 10. The calculation formula of the GeLU function in the quantized multimodal large model is:

[0064] .

[0065] The input variable x of the GeLU function is also the output vector of the fully connected layer in the feedforward neural network. Then, the calculation formula of the ApproxGeLU function after the nonlinear function approximation is:

[0066] .

[0067] The calculation formula of the Softmax function in the quantized multimodal large model is:

[0068] .

[0069] The input variable x of the GeLU function is the dot product of the query value and the key value in the attention mechanism. Then, the calculation formula of the Approxsoftmax function after the nonlinear function approximation is:

[0070] .

[0071] in, is the mean of all variables x input into the multimodal large model in one round of training, It is a preset hyperparameter with a value ranging from 0 to 1.

[0072] In this embodiment, nonlinear function approximation processing can effectively protect the privacy and security of the model, prevent the model from being reverse engineered or illegally used, and provide a unified approximate calculation function for subsequent secure and private calculations.

[0073] Optionally, the weights of the initialized multimodal large model are encrypted and sent to different security agents, including:

[0074] Secret sharing of weights for initializing large multimodal models;

[0075] The weights of the initialized multimodal large model are split and encrypted to obtain encrypted weight blocks;

[0076] The encryption weight blocks are sent separately to different security agents.

[0077] Secret Sharing (SHS) is a cryptographic protocol whose core concept is to split a secret into multiple "shares" and distribute these shares to multiple participants. Only when a sufficient number of participants combine their shares can the original secret be recovered. Any combination of fewer than a sufficient number of shares cannot obtain any information about the secret.

[0078] Figure 2 Flowchart of secret sharing according to an embodiment of the present application, as shown in FIG. Figure 2 shown.

[0079] In one possible implementation, the weights of the initialized multimodal large model are split and encrypted into n encrypted weight blocks. Then, the initialization of the multimodal large model will first send the encrypted weight block to the service provider, and the service provider will Distribute to different security agents.

[0080] In this embodiment, the weights of the initialized multimodal large model are encrypted and sent to different security agents through a secret sharing protocol, thereby ensuring the security and privacy of the weights of the initialized multimodal large model, and further ensuring the security of the transmission process.

[0081] In S102, the client merges and scrambles the public dataset and the query dataset to construct a hybrid query dataset. Then, the client performs hierarchical vectorization on the hybrid query dataset to obtain an inference query dataset, and encrypts and sends it to different security agents.

[0082] In one possible implementation, there is a public dataset , query the dataset , then the hybrid query dataset constructed by merging and shuffling the public dataset and the query dataset can be expressed as .

[0083] In this embodiment, the public dataset and the query dataset are merged and shuffled to construct a hybrid query dataset, which improves the robustness of model training and increases the difficulty for malicious service providers to infer client privacy data. In addition, data of different modalities are unified through hierarchical vectorization for model input and processing.

[0084] Optionally, hierarchical vectorization is performed on the mixed query dataset to obtain an inference query dataset, including:

[0085] According to the modalities of the data in the mixed query dataset, different preprocessing methods are used to perform independent feature encoding on the data to obtain the inference query dataset.

[0086] For example, for text modal data, preprocessing methods include but are not limited to word segmentation, stop word removal, and stemming; for image modal data, preprocessing methods include but are not limited to scaling, cropping, and flipping; and for speech modal data, preprocessing methods include but are not limited to silence detection and removal, sound enhancement, and normalization. Then, independent feature encoding is performed on the preprocessed text modal data, image modal data, and speech modal data to obtain an inference query dataset. Independent feature encoding includes but is not limited to text feature encoding, image feature encoding, and audio feature encoding. Text feature encoding includes but is not limited to bag-of-words models, TF-IDF, and Word2Vec; image feature encoding includes but is not limited to convolutional neural networks (CNN); and audio feature encoding includes but is not limited to extracting Mel Frequency Cepstral Coefficients (MFCC).

[0087] In this embodiment, by performing hierarchical vectorization on the mixed query dataset, key features of data of different modalities can be accurately captured, thereby improving the accuracy of reasoning queries.

[0088] In S103, different security agents perform secure collaborative reasoning on the reasoning query data set and the weights of the initialized multimodal large model, obtain reasoning results, and send the reasoning results to the client.

[0089] In this embodiment, the inference task is completed without exposing the original data and model parameters, further improving the security of the data and model.

[0090] Optionally, different security agents perform secure collaborative reasoning on the reasoning query dataset and the weights of the initialized multimodal large model to obtain reasoning results, including:

[0091] Secure collaborative reasoning uses the MPC multi-party secure computing mechanism;

[0092] Different security agents perform security reasoning based on the reasoning query dataset and the weights of the initialized multimodal large model to obtain initial reasoning results;

[0093] Perform privacy encryption calculation based on the initial inference result and Beaver triples to obtain the inference result.

[0094] Multi-party computation (MPC) allows multiple participants to jointly compute a function without disclosing their input data. The computation result is disclosed only with the consent of all participants, while their input data remains confidential. Beaver triples are an auxiliary method used to optimize computations in MPC. They consist of three secret shared values: a, b, and c, where a and b are two random numbers and c = a*b.

[0095] In one possible implementation, the security agent constructs a multimodal large model based on the weights of the initialized multimodal large model, and then inputs the inference query dataset into the pre-trained multimodal large model to obtain the initial inference results. , where i is the serial number of the security agent. There exists a Beaver triple , the formula for privacy encryption calculation based on Beaver triples and initial inference results can be:

[0096] ,

[0097] in, and As auxiliary calculation elements, , , and The calculation formulas are , . is the initial reasoning result of the i-th security agent, is the weight of the initial multimodal large model of the i-th security agent. Finally, the set of inference results of different security agents can be expressed as .

[0098] In this embodiment, through the MPC multi-party secure computing mechanism, each security agent only processes the local reasoning query data set and initializes the weights of the multimodal large model. The data does not need to leave its secure environment, thereby minimizing the risk of data leakage.

[0099] In S104, the client decrypts and reconstructs the inference results sent by different security agents to obtain the inference prediction results, and then verifies the inference prediction results based on the real label values ​​in the inference query data set to determine whether the service provider is safe and available.

[0100] In this embodiment, it is possible to determine whether the service provider is safe and available, estimate whether it may engage in malicious behavior in the future, and avoid security risks in a timely manner.

[0101] Optionally, verify the inference prediction results based on the true label values ​​in the inference query dataset to determine whether the service provider is safe and available, including:

[0102] Calculate the number of safe data in the inference prediction results that have the same true label value as the inference query dataset;

[0103] If the amount of security data is greater than the verification threshold, the service provider is safe and available;

[0104] If the amount of security data is less than or equal to the verification threshold, the service provider will not be adopted;

[0105] Service providers include different security agents and model owners.

[0106] For example, the total amount of data in the inference query dataset is 50,000. Through statistics, the number of safe data in the inference prediction results that has the same true label value as the inference query dataset is 35,000. The verification threshold is 40,000. If the number of safe data is less than or equal to the verification threshold, the service provider is considered unsafe and unreliable and will not be adopted.

[0107] In this embodiment, by determining whether the service provider is safe and available, the security and reliability of the service provider in multimodal large model reasoning is ensured.

[0108] Figure 3 This is a system architecture diagram of the method provided in the embodiment of the present application, such as Figure 3 As shown:

[0109] First, the model owner sequentially performs quantization and nonlinear function approximation on the multimodal large model to generate an initial multimodal large model. The model weights are then encrypted and securely transmitted to the various secure proxy nodes within the service provider. Next, the client merges and shuffles the public dataset with the query dataset to construct a hybrid query dataset. The hybrid query dataset undergoes hierarchical vectorization and is converted into an inference query dataset, which is then sent to each secure proxy in encrypted form. Each secure proxy then performs secure collaborative inference on the encrypted inference query dataset and the weights of the initial multimodal large model. After inference is complete, the inference results are sent back to the client. Finally, the client decrypts and reconstructs these inference results to obtain inference predictions. Furthermore, the client verifies the inference predictions against the ground-truth label values ​​contained in the inference query dataset to assess the security and availability of the service provider, prevent malicious attacks on the client, and protect client data security.

[0110] According to the embodiments of the present disclosure, the following technical effects are achieved:

[0111] 1. Protects the privacy and security of the client's query dataset, while keeping the weights of the multimodal large model confidential.

[0112] 2. Optimizes unnecessary computational overhead, laying the foundation for deploying secure reasoning of large multimodal models on resource-constrained servers.

[0113] 3. Effectively prevents untrusted service providers from attacking clients or maliciously providing incorrect inference results.

[0114] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0115] The above is an introduction to the method embodiment. The following is a device embodiment to further illustrate the solution described in this application.

[0116] Figure 4 FIG shows a block diagram of a security assessment device for a multimodal large model according to an embodiment of the present application, as shown in FIG. Figure 4 Shown include:

[0117] In the model preprocessing module 401, the model owner quantizes the multimodal large model to obtain a quantized multimodal large model, then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model. The weights of the initialized multimodal large model are encrypted and sent to different security agents.

[0118] In the data preprocessing module 402 , the client merges and shuffles the public dataset and the query dataset to construct a hybrid query dataset. The hybrid query dataset is then hierarchically vectorized to obtain an inference query dataset, which is then encrypted and sent to different security agents.

[0119] Inference model 403, different security agents perform secure collaborative reasoning on the reasoning query dataset and the weights of the initialized multimodal large model, obtain the reasoning results, and send the reasoning results to the client;

[0120] Verification module 404, in which the client decrypts and reconstructs the inference results sent by different security agents, obtains the inference prediction results, and then verifies the inference prediction results based on the real label values ​​in the inference query data set to determine whether the service provider is safe and available.

[0121] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0122] Figure 5 A schematic diagram of the structure of a terminal device or server suitable for implementing an embodiment of the present application is shown.

[0123] like Figure 5 As shown, the terminal device or server includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 into the random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the terminal device or server are also stored. The CPU 501, ROM 502 and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0124] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, and the like; an output section 507 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 508 including a hard disk; and a communication section 509 including a network interface card such as a LAN card or a modem. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 510 as needed, so that computer programs read therefrom can be installed into the storage section 508 as needed.

[0125] In particular, according to an embodiment of the present application, the above method flow steps can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present application are executed.

[0126] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the aforementioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0128] The units or modules involved in the embodiments described in this application may be implemented in software or hardware. The units or modules described may also be provided in a processor. The names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0129] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not be incorporated into the electronic device. The computer-readable storage medium stores one or more programs, which, when used by one or more processors, execute the method described in the present application.

[0130] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of application involved in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the aforementioned application concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions applied for in this application.

Claims

1. A security assessment method for multimodal large models, characterized by: include: The model owner quantizes the multimodal large model to obtain a quantized multimodal large model, then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model, and encrypts the weights of the initialized multimodal large model and sends them to different security agents; The client merges and scrambles the public dataset and the query dataset to construct a hybrid query dataset, then performs hierarchical vectorization on the hybrid query dataset to obtain an inference query dataset, and encrypts and sends the inference query dataset to the different security agents. The different security agents perform secure collaborative reasoning on the reasoning query data set and the weight of the initialized multimodal large model, obtain reasoning results, and send the reasoning results to the client; The client decrypts and reconstructs the inference results sent by the different security agents to obtain the inference prediction results, and then verifies the inference prediction results according to the real label values ​​in the inference query data set to determine whether the service provider is safe and available.

2. The security assessment method for multimodal large models according to claim 1 is characterized in that: The model owner performs quantization processing on the multimodal large model, including: The weights of the multimodal large model are quantized to float16.

3. The security assessment method for multimodal large models according to claim 1 is characterized in that: The performing nonlinear function approximation processing on the quantized multimodal large model includes: Replacing the sigmoid function in the quantitative multimodal large model with the Approxsigmoid function; Replacing the GeLU function in the quantized multimodal large model with the ApproxGeLU function; The Softmax function in the quantitative multimodal large model is replaced by the ApproxSoftmax function.

4. The security assessment method for multimodal large models according to claim 1 is characterized in that: The step of encrypting and sending the weights of the initialized multimodal large model to different security agents includes: Secretly sharing the weights of the initialized multimodal large model; Splitting and encrypting the weights of the initialized multimodal large model to obtain encrypted weight blocks; The encryption weight blocks are sent to the different security agents respectively.

5. The security assessment method for multimodal large models according to claim 1 is characterized in that: The step of performing hierarchical vectorization on the mixed query dataset to obtain the inference query dataset includes: Different preprocessing methods are used to perform independent feature encoding on the data according to the modalities of the data in the mixed query dataset to obtain the inference query dataset.

6. The security assessment method for multimodal large models according to claim 1 is characterized in that: The different security agents respectively perform secure collaborative reasoning on the reasoning query data set and the weight of the initialized multimodal large model to obtain reasoning results, including: The secure collaborative reasoning adopts the MPC multi-party secure computing mechanism; The different security agents respectively perform security reasoning based on the reasoning query data set and the weights of the initialized multimodal large model to obtain initial reasoning results; A privacy encryption calculation is performed based on the initial inference result and the Beaver triplet to obtain the inference result.

7. The security assessment method for multimodal large models according to claim 1 is characterized in that: The verifying the inference prediction result according to the true label value in the inference query data set to determine whether the service provider is safe and available includes: Calculating the number of safety data in the inference prediction result that have the same true label value as that in the inference query dataset; If the amount of the security data is greater than the verification threshold, the service provider is safe and available; If the amount of security data is less than or equal to the verification threshold, the service provider will not be adopted; The service providers include different security agents and model owners.

8. A security assessment device for multimodal large models, characterized by: include: A model preprocessing module, in which the model owner quantizes the multimodal large model to obtain a quantized multimodal large model, then performs nonlinear function approximation on the quantized multimodal large model to obtain an initialized multimodal large model, and encrypts the weights of the initialized multimodal large model and sends them to different security agents; In the data preprocessing module, the client merges and shuffles the public dataset and the query dataset to construct a hybrid query dataset. The hybrid query dataset is then hierarchically vectorized to obtain the inference query dataset, which is then encrypted and sent to different security agents. Inference model, different security agents perform secure collaborative reasoning on the reasoning query data set and the weights of the initialized multimodal large model, obtain reasoning results, and send the reasoning results to the client; The verification module is used by the client to decrypt and reconstruct the inference results sent by the different security agents, obtain the inference prediction results, and then verify the inference prediction results based on the real label values ​​in the inference query data set to determine whether the service provider is safe and available.

9. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images