Large model privacy protection method based on differential privacy and privacy entity recognition replacement
Through the adaptive differential privacy algorithm and the end-side privacy entity identification replacement solution, gradient noise is dynamically adjusted, and privacy masking and restoration are combined with the end-side small model for privacy masking, which solves the problems of insufficient privacy protection and semantic consistency in fine-tuning of large models, and improves the convergence speed and privacy security of the model.
Patent Information
- Application Number
- CN202510498632.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-21
- Publication Date
- 2025-08-08
AI Technical Summary
The existing differential privacy technology fails to fully consider the privacy sensitivity of different user data during the fine-tuning of the big model, resulting in insufficient privacy protection and slow model convergence. Traditional privacy entity recognition technology cannot meet the needs of semantic consistency and privacy protection in large model application scenarios.
Adaptive differential privacy algorithm is adopted to dynamically adjust the gradient noise size based on the user's local privacy data proportion and model parameter information volume, and combine the end-side privacy entity identification and replacement scheme to identify privacy data through pre-training models and identification models, and use the end-side small model for privacy masking and restoration.
It realizes providing different levels of privacy protection according to user needs, improves model convergence speed and performance, avoids privacy information leakage, simplifies the privacy protection process, and enhances the privacy security of large-scale interactive scenarios.
Smart Images
Figure CN120449199A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of artificial intelligence, and in particular relates to a large-model privacy protection method based on differential privacy and privacy entity recognition replacement. Background Art
[0002] In recent years, the rapid development of large-scale language models, such as GLM-4, Llama 3, GPT-4, and DeepSeek, has marked significant breakthroughs in the field of artificial intelligence. These models, often based on deep neural network architectures like the Transformer, contain billions or even trillions of parameters. This massive number of parameters requires massive amounts of data to train the models and learn sufficiently rich knowledge and patterns. While these models have set new benchmarks in performance and security, their widespread adoption also presents significant data privacy challenges.
[0003] In practical applications, AI researchers often use their own private data to fine-tune these large models for various downstream tasks, such as text classification and text-to-image generation. However, this private data often contains a large amount of sensitive information, such as electronic medical records of different patients in the medical field and transaction data in the financial field. If this private data is leaked, it will not only seriously infringe on the user's personal privacy, but also may affect their normal life and even raise legal and ethical issues.
[0004] While large models trained with massive amounts of data offer excellent performance, recent research suggests that these models "memorize" their training data during training. This allows malicious attackers to infer or even recover the training data by analyzing the model's parameters, thereby infringing on user privacy. For example, by comparing changes in model parameters, attackers can infer patterns in the training data and even potentially recover portions of the original data through reverse engineering. These privacy attacks can compromise user data security, especially for models developed by independent researchers or small teams with relatively weak security measures. To address this issue, researchers have proposed various protection mechanisms, including differential privacy, a widely used technique suitable for fine-tuning large models. Furthermore, addressing data source control and masking user privacy information is also a common practice.
[0005] Differential privacy is primarily achieved through the following two key steps: (1) clipping the gradients of model updates; and (2) adding a certain percentage of noise to the clipped gradients. Through these two mechanisms, differential privacy can interfere with the model's parameters, thereby hiding the impact of local training data on the model. However, existing differential privacy techniques apply the same percentage of noise to all data and parameters, failing to fully consider the privacy sensitivity of different user data. This strategy may not only slow down the model's convergence rate but also lead to insufficient privacy protection, thus failing to provide users with more refined and stronger privacy guarantees.
[0006] Privacy entity recognition is mainly based on entity recognition technology in the field of natural language processing, which is achieved through methods such as keyword regularization matching and semantic similarity comparison. In the field of privacy protection, entity recognition technology generally exists in two links: (1) privacy encryption side, and (2) privacy restoration side. The former identifies the privacy entities in the information content on the end side before the private information is transmitted to the public domain, and masks or encrypts them; the latter usually appears in scenarios where privacy cracking and information interaction are required. Unlike the former, the content to be identified at this time becomes masked content or replaced entities, and it is restored to its original privacy. This method prevents private information from being leaked to the public domain from the source. However, in the current large-scale model application scenario, traditional methods can no longer meet existing needs. Such as intelligent replacement, semantic lossless protection, end-to-end semantic restoration, etc.
[0007] Differential privacy solutions in existing technologies:
[0008] To address the threat of malicious attackers stealing user local data by analyzing model parameters, researchers are attempting to enhance data protection using differential privacy techniques. Currently, the most widely used differential privacy algorithm for fine-tuning large models is Differentially Private Stochastic Gradient Descent (DP-SGD). DP-SGD is a classic algorithm for applying differential privacy in deep learning. Its core mechanism consists of the following two key steps:
[0009] 1. Gradient Clipping. Before each gradient update, the original gradient is clipped according to Formula 1 to ensure that the contribution of a single data sample to the model update is strictly limited. Here, g(x) is the gradient of sample x, and C is the gradient threshold. This gradient clipping method ensures that the gradient value does not exceed the pre-set threshold C, preventing certain data points from having an excessive impact on model training. This reduces the model's dependence on individual data points and improves overall privacy and robustness.
[0010]
[0011] 2. Add noise. After clipping the gradient, add noise to the clipped gradient according to Formula 2. In differential privacy, Gaussian noise is often used to achieve privacy protection. By adding Gaussian noise to the clipped gradient, the influence of individual data points on the model can be further obscured, thereby reducing their discernibility in the gradient. This process prevents attackers from inferring the original data by observing gradient changes, thus improving the privacy security of the model.
[0012]
[0013] Where σ is the standard deviation of the normal distribution, N(0,C 2 σ 2 ) means generating a normal distribution with a mean of 0 and a standard deviation of Cσ based on the threshold C.
[0014] Privacy entity identification and replacement solutions of existing technologies:
[0015] Entity recognition technology is an important field and research hotspot in natural language processing. It is mainly used in scenarios such as relationship extraction and information retrieval. It can be divided into two steps: (1) entity boundary detection, which identifies which parts of the text belong to the entity; (2) entity category classification, which classifies the entity into a specific category.
[0016] From early approaches based on lexicons and regular expressions to traditional machine learning techniques, they often rely on human prior knowledge. Currently, deep learning-based approaches have become mainstream, and the application of pre-trained models (such as BERT and ERNIE) has significantly improved the accuracy and generalization of entity recognition. Traditional rule-based and statistical methods (such as CRF) are gradually being replaced by neural network models. Hybrid models such as Bi-LSTM-CRF have performed well in sequence labeling tasks, and fine-tuning strategies for pre-trained models have further reduced data labeling costs.
[0017] Disadvantages of existing differential privacy technologies:
[0018] 1. Existing differential privacy methods require adding the same level of noise to all gradients, failing to account for the privacy needs of different users or datasets. For example, some users' data, even though it contains no sensitive information, is still subject to noise, which degrades model performance. Conversely, for users with a high proportion of private data, a uniform noise addition strategy may not provide adequate privacy protection, leaving these users' data at high risk of leakage.
[0019] 2. Uniformly adding noise of the same intensity to all gradients can also slow model convergence, especially when fine-tuning large models. During this process, model parameters are large, and training requires extremely expensive computing resources, such as GPUs and long training cycles. Adding noise to all gradients will significantly slow convergence, further increasing computational costs and time overhead. For users who don't have private data or have relatively small amounts of private data, appropriately reducing the amount of added noise can not only improve model performance, but also accelerate the training process and reduce computing resource consumption.
[0020] Shortcomings of Existing Technologies for Privacy Entity Recognition and Replacement
[0021] 1. For traditional recognition technologies based on manual rules and machine learning, complex rule-making and limited constraints have become significant obstacles to generalization and replicability. Furthermore, privacy recognition technologies based on Transformer architecture models like BERT still face bottlenecks. On the one hand, the massive amount of hidden samples required for model training is difficult to collect, and on the other hand, the resulting model performance is unstable in small sample and low-resource training scenarios.
[0022] 2. Single application scenario. Current privacy-preserving entity recognition technology fails to meet requirements for semantic consistency in human-computer interaction contexts, end-to-end masking, and restoration. Whether in large-scale model information interaction scenarios or in scenarios using private data for training, traditional methods focused on identification and extraction face the challenge of ensuring the integrity of key semantics in uploaded information and restoring the semantics of received information. Developing more intelligent semantic understanding has become an inevitable trend in entity recognition, including in privacy-preserving scenarios. Summary of the Invention
[0023] (1) Technical issues to be resolved
[0024] The technical problem to be solved by the present invention is how to provide a large-model privacy protection method based on differential privacy and privacy entity recognition and replacement to solve the shortcomings of differential privacy, privacy entity recognition and replacement in the existing technology.
[0025] (2) Technical solution
[0026] In order to solve the above technical problems, the present invention proposes a large model privacy protection method based on differential privacy and privacy entity recognition replacement, the method comprising: a differential privacy scheme and a privacy entity recognition replacement scheme;
[0027] The differential privacy solution includes: the user downloads a pre-trained model G and a recognition model P. The pre-trained model G is used to output the correct category corresponding to the input text, and the recognition model P is used to identify private data in the user's local private data. The local private data is used as the input of the recognition model P, which outputs private data. The recognition model P then calculates the proportion of private data in the local private data. The user fine-tunes the pre-trained model G locally, clips the gradient of the pre-trained model G, and calculates the Fisher matrix of the parameters of the pre-trained model G. Noise is added to the gradient based on the proportion of private data and the Fisher matrix.
[0028] The privacy entity recognition replacement solution includes: using the privacy data reuse method to create a training data set, using the training data set to jointly train the privacy replacement and privacy restoration tasks to obtain a small end-side model; using the small end-side model, on the privacy mask end, the text content containing the privacy data is privacy-replaced and the replaced masked data is output, and the masked data is uploaded to the network or made public; on the privacy decoding end, the masked data that needs to be restored is privacy-restored and the restored text containing the real privacy data is output.
[0029] (3) Beneficial effects
[0030] This invention proposes a large-model privacy protection method based on differential privacy and private entity recognition replacement. The technical effects of this invention are:
[0031] 1. By adding an adaptive differential privacy algorithm to the fine-tuning process of large models, malicious attackers can be prevented from stealing model parameters to infer the user's local private data, thereby avoiding local data leakage and protecting the user's privacy.
[0032] 2. This invention dynamically adjusts the amount of noise added to the gradient based on the proportion of private data in the user's local data and the amount of information contained in the model parameters, thereby providing stronger privacy protection. This reduces the amount of noise added to users with a low proportion of local private data or a small amount of model parameter information, thereby mitigating the interference of noise on model training. Compared to traditional differential privacy algorithms, this invention improves model convergence speed and performance while providing different levels of privacy protection based on user needs.
[0033] 3. The end-to-end private entity identification and replacement solution in this invention prevents the leakage of private information from the source while preserving the overall semantically valid information. The end-to-end training and deployment process simplifies the formulation of regularization and expands the potential space for privacy constraints. The private data production and reuse method of this invention can also be applied to the production of private data in all entity recognition scenarios, greatly unlocking the value of existing private data.
[0034] 4. The proposed on-device privacy entity recognition and replacement solution targets large-scale model interaction scenarios, creating a lightweight and efficient model algorithm and training scheme that balances deployment cost and performance. This end-to-end training unifies the concepts of privacy protection and privacy restoration, simplifying the on-device privacy protection framework while achieving consistent, real-time interactive contextual privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 This is the adaptive differential privacy flow chart of the present invention;
[0036] Figure 2 This is a flowchart of the privacy entity identification and replacement of the present invention. DETAILED DESCRIPTION
[0037] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.
[0038] The present invention provides a large model privacy protection method based on differential privacy and private entity recognition replacement. The technical solution of the present invention is described as follows:
[0039] 1. Introduction to the differential privacy solution design model
[0040] This solution mainly designs two models, namely the pre-training model G and the recognition model P.
[0041] The output of the pre-trained model G (such as GLM-49B) is adaptively adjusted based on the needs of different users. If the user's requirement is a text classification task, when fine-tuning the pre-trained model G using local private data, the user needs to set the output of the pre-trained model G to the category by setting the system-prompt. The pre-trained model G is optimized during the fine-tuning process using the gradient descent algorithm to ensure that the pre-trained model G eventually converges. After training is complete, the user inputs a text into the pre-trained model G, and the pre-trained model G can output the correct category corresponding to the text.
[0042] The main task of the recognition model P is to learn the mapping relationship between raw data and private data. Raw data refers to private data collected by the server, and private data refers to private data contained in private data (such as user name, ID number, and other privacy-sensitive information). Private data can be generated using manual annotation or existing large models. Manual annotation refers to manually extracting private data from private data. Large model generation means using existing advanced large models such as GPT-4o or DeepSeek-V3, etc., through prompt engineering, so that the large model can generate a batch of raw data and corresponding private data. Afterwards, the raw data is used as the input of the recognition model P, and the private data is used as the output of the recognition model P. The recognition model P is trained and optimized by the gradient descent algorithm so that the recognition model P finally converges, which can achieve the purpose of the recognition model P being able to return private data when the input is raw data.
[0043] 2. The specific process of the adaptive differential privacy algorithm is as follows:
[0044] S1. Server training recognition model P:
[0045] The present invention assumes the existence of a trusted server responsible for training a recognition model P. The input to recognition model P is raw data, and the output of the model is private data (such as user names, ID numbers, and other privacy-sensitive information). The server constructs a dataset containing raw data and its corresponding private data using either manual annotation or large-scale model generation. Manual annotation involves manually extracting private data from private data. Large-scale model generation involves using existing advanced large-scale models such as GPT-4o or DeepSeek-V3, through prompt engineering, to generate a batch of raw data and corresponding private data. The server then divides the dataset into a training set and a test set in an 8:2 ratio, with the raw data serving as input text and the corresponding private data serving as target output text. On the training set, a gradient descent algorithm is used to update the parameters of recognition model P. Training of recognition model P is terminated when recognition model P converges and performs well on the test set. After training is complete, when the input is raw data, recognition model P can output private data. For example, when the input is "Zhang San is a lawyer," recognition model P outputs "Zhang San" (name).
[0046] S2. The user downloads the pre-trained model G and the recognition model P:
[0047] The user downloads the pre-trained model G and recognition model P locally. The pre-trained model G is fine-tuned locally based on the private data of different users, and the recognition model P is used to identify private data in the user's local private data.
[0048] S3. The user calculates the proportion of private data in local private data:
[0049] After the user downloads the recognition model P, they first use the local private data as the input of the recognition model P to obtain the private data output by the recognition model P. They then calculate the size of the private data (e.g., the length of the text) and finally divide the size of the private data by the total size of the local private data (i.e., the total length of the original text) to obtain the private data ratio.
[0050] S4. User local fine-tuning of pre-trained model G:
[0051] The user first adjusts the system-prompt of the pre-trained model G based on the downstream task to be completed locally (such as text classification, question-and-answer dialogue, etc.). Then, the local private data can be divided into a training set and a test set in an 8:2 ratio. The user then uses the gradient descent algorithm to optimize the parameters of the pre-trained model G on the training set until the pre-trained model G converges on the test set. For example, if the downstream task is text classification, after training is completed, a text is input, and the pre-trained model G can output the corresponding category of the text.
[0052] S5. The user clips the gradient of the pre-trained model G:
[0053] When users use gradient descent to optimize the parameters of the pre-trained model G, the gradient of the pre-trained model G calculated in each epoch is clipped according to Formula 3 to ensure that the norm of the gradient does not exceed the threshold C. The threshold C is a hyperparameter, usually set to 1, 0.1, etc.
[0054]
[0055] Here, g(x) is the gradient of sample x.
[0056] S6. The user calculates the Fisher matrix of the pre-trained model G parameters:
[0057] Before updating the parameters of the pre-trained model G in each round, the user calculates the Fisher matrix of the parameters of the pre-trained model G according to Formula 4, where p(x|θ) is a probability density function, θ is a parameter, x is an observed data point, x|θ represents the value of x given θ, and logp(x|θ) is its log-likelihood function. The diagonal elements I in the Fisher matrix are ii (θ) represents θ i The amount of information allows the subsequent algorithm to adaptively adjust the size of the added noise according to the parameter information.
[0058]
[0059] S7. The user adds adaptive noise based on the proportion of private data and the Fisher matrix:
[0060] After calculating the Fisher matrix for the parameters of the pre-trained model G, the user adaptively adjusts the amount of noise added to the gradient based on the ratio of the Fisher matrix to the private data. If the model parameters calculated using the Fisher matrix contain a large amount of information or if the proportion of private data in the user's local data is too high, the user adds more noise to the gradient to provide stronger privacy protection. Conversely, the amount of noise is reduced to accelerate the convergence of the pre-trained model G.
[0061] 3. Replacement of private entity recognition with small models on the client side
[0062] With the diversification of large-scale model application scenarios and the reduction of deployment costs, user privacy security issues are no longer solely associated with data during the large-scale model training phase. In addition to the memory of user privacy by model parameters, the interaction between the large-scale model deployment side and the user's local side poses a serious challenge to privacy security. On the one hand, the deployment interaction scenario itself has the characteristic of inevitably exposing user information to the network. On the other hand, extensive user information collection and subsequent learning have become common practices in the commercial large-scale model field. In the aforementioned solution, the privacy of the training data source is effectively protected with the help of differential privacy technology. However, only when privacy solutions are designed and implemented simultaneously in the subsequent large-scale model application chain can true and comprehensive large-scale model privacy protection be achieved.
[0063] 1) Design of the solution
[0064] Privacy entity recognition and replacement aims to implement end-side privacy masking before exposing private information to the public domain, and perform end-side privacy decoding and restoration of the portion of the received data that contains the privacy mask. The implementation solution is to train and deploy a lightweight large end-side model that integrates privacy masking and privacy restoration, namely the end-side small model. Both privacy masking and privacy restoration tasks can be viewed as identifying and replacing existing private content in the text. The former replaces the actual private information with a similar semantic object, while the latter detects the replaced private entity and replaces it with the original semantic object. It is worth noting that when masking and restoring private text with contextual background, the end-side small model needs to consider whether to perform targeted replacement based on contextual information.
[0065] Specifically, the final implemented end-side small model has the following functions: (1) On the privacy mask end-side, the input text content including the privacy data is used as the end-side small model input one, and the previous privacy replacement correspondence relationship is used as the input two. After being processed by the end-side small model, the replaced mask data is finally output, and this content is uploaded to the network or made public; (2) On the privacy decoding end-side, the mask data to be restored and the previous context privacy restoration relationship are used as the end-side small model input. Finally, after being processed by the end-side small model, the restored text containing the real privacy data is output.
[0066] 2) Preparation of training dataset
[0067] As we all know, private data is generally difficult to collect and its use is restricted due to laws, regulations, and security considerations. Furthermore, private entities in text data are typically distributed at a low density. To address this issue, we designed an efficient data reuse method based on these characteristics.
[0068] Taking legal documents with a large number of privacy entities as an example, the present invention collected 5,000 trial documents from the public China Legal Documents Network. By making a suitable mask prompt ptompt template and using GPT-4o-mini, the corresponding privacy entity recognition results and the expected replacement output can be obtained. As mentioned above, there is no essential difference between privacy replacement and privacy restoration. Based on this set of mask data samples one, namely the input text and output text, and the corresponding entity replacement relationship, the present invention can expand a new set of mask data samples two by exchanging the input and output content and reversing the entity replacement relationship. In addition, based on the same set of input and output texts, by setting the mask prompt and the restoration prompt, they can be designed into a mask task and a restoration task respectively. Therefore, mask data samples one and two can replace the mask prompt with the restoration prompt, thereby deriving mask data samples three and four. Therefore, by making one data sample, four data of two task types can be obtained, which greatly improves the utilization rate of data and reduces the cost of data production. If we consider the scenario of contextual interaction, by fixing some entity replacement relationships, each sample can further derive several privacy masked data samples and privacy restored data samples with partial context replacement relationships.
[0069] 3) Obtaining a small model on the client side
[0070] To enable the deployment of small models on-device, this paper selected Phi-3.5-mini, a 3.8B parameter-heavy framework supporting a 128K token context window. During training, a supervised fine-tuning strategy (SFT) was employed to jointly train privacy replacement (forward replacement) and privacy restoration (reverse replacement) tasks, balancing loss weights through gradient accumulation.
[0071] Technical effects of the present invention:
[0072] 1. By adding an adaptive differential privacy algorithm to the fine-tuning process of large models, malicious attackers can be prevented from stealing model parameters to infer the user's local private data, thereby avoiding local data leakage and protecting the user's privacy.
[0073] 2. This invention dynamically adjusts the amount of noise added to the gradient based on the proportion of private data in the user's local data and the amount of information contained in the model parameters, thereby providing stronger privacy protection. This reduces the amount of noise added to users with a low proportion of local private data or a small amount of model parameter information, thereby mitigating the interference of noise on model training. Compared to traditional differential privacy algorithms, this invention improves model convergence speed and performance while providing different levels of privacy protection based on user needs.
[0074] 3. The end-to-end private entity identification and replacement solution in this invention prevents the leakage of private information from the source while preserving the overall semantically valid information. The end-to-end training and deployment process simplifies the formulation of regularization and expands the potential space for privacy constraints. The private data production and reuse method of this invention can also be applied to the production of private data in all entity recognition scenarios, greatly unlocking the value of existing private data.
[0075] 4. The proposed on-device privacy entity recognition and replacement solution targets large-scale model interaction scenarios, creating a lightweight and efficient model algorithm and training scheme that balances deployment cost and performance. This end-to-end training unifies the concepts of privacy protection and privacy restoration, simplifying the on-device privacy protection framework while achieving consistent, real-time interactive contextual privacy protection.
[0076] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A large-model privacy protection method based on differential privacy and private entity recognition substitution, characterized in that: The method includes: a differential privacy scheme and a privacy entity identification replacement scheme; The differential privacy solution includes: the user downloads a pre-trained model G and a recognition model P. The pre-trained model G is used to output the correct category corresponding to the input text, and the recognition model P is used to identify private data in the user's local private data. The local private data is used as the input of the recognition model P, which outputs private data. The recognition model P then calculates the proportion of private data in the local private data. The user fine-tunes the pre-trained model G locally, clips the gradient of the pre-trained model G, and calculates the Fisher matrix of the parameters of the pre-trained model G. Noise is added to the gradient based on the proportion of private data and the Fisher matrix. The privacy entity recognition replacement solution includes: using the privacy data reuse method to create a training data set, using the training data set to jointly train the privacy replacement and privacy restoration tasks to obtain a small end-side model; using the small end-side model, on the privacy mask end, the text content containing the privacy data is privacy-replaced and the replaced masked data is output, and the masked data is uploaded to the network or made public; on the privacy decoding end, the masked data that needs to be restored is privacy-restored and the restored text containing the real privacy data is output.
2. The large model privacy protection method based on differential privacy and private entity recognition replacement as claimed in claim 1, characterized in that: The output of the pre-trained model G is adaptively adjusted according to the needs of different users. If the user's need is a text classification task, when the user uses local private data to fine-tune the pre-trained model G, the output of the pre-trained model G is set to the category by setting the system-prompt, and the pre-trained model G is optimized during the fine-tuning process through the gradient descent algorithm, so that the pre-trained model G can eventually converge; after the training is completed, the user inputs a text into the pre-trained model G, and the pre-trained model outputs the correct category corresponding to the text.
3. The large-model privacy protection method based on differential privacy and private entity recognition replacement according to claim 1, characterized in that: The task of the recognition model P is to learn the mapping relationship between original data and private data, where original data refers to private data collected by the server, and private data refers to the private data contained in the private data. The original data is used as the input of the recognition model P, and the private data is used as the output of the recognition model P. The recognition model P is trained and optimized using the gradient descent algorithm, so that the recognition model P finally converges, achieving the goal of being able to return private data when the input is original data.
4. The large-model privacy protection method based on differential privacy and private entity recognition replacement according to claim 3, characterized in that: Privacy data is generated using manual annotation or existing large models. Manual annotation refers to manually extracting privacy data from private data. Large model generation uses existing advanced large models and prompt engineering to enable the large model to generate a batch of raw data and corresponding privacy data.
5. The large model privacy protection method based on differential privacy and private entity recognition replacement according to any one of claims 1 to 4, characterized in that: The differential privacy scheme specifically includes the following steps: S1. Server training recognition model P: Assume that there is a trusted server that is responsible for training the recognition model P. The input of the recognition model P is the original data, and the output is the private data. The server constructs a batch of datasets using manual annotation or large-scale model generation, which contains the original data and its corresponding private data. The server divides the dataset into a training set and a test set in an 8:2 ratio, with the original data as the input text and the corresponding private data as the target output text. On the training set, the server uses the gradient descent algorithm to update the parameters of the recognition model P. When the recognition model P converges and performs well on the test set, the server stops training the recognition model P. S2. The user downloads the pre-trained model G and the recognition model P: The user downloads the pre-trained model G and the recognition model P locally. The pre-trained model G is fine-tuned locally based on the private data of different users, and the recognition model P is used to identify the privacy data in the user's local private data. S3. The user calculates the proportion of private data in local private data: After the user downloads the recognition model P, they first use the local private data as the input of the recognition model P to obtain the private data output by the recognition model P. Then, they calculate the size of the private data and finally divide the size of the private data by the total size of the local private data to obtain the proportion of private data. S4. User local fine-tuning of pre-trained model G: The user first adjusts the system-prompt of the pre-trained model G based on the downstream task to be completed locally. Then, the local private data is divided into a training set and a test set in an 8:2 ratio. The user then uses the gradient descent algorithm to optimize the parameters of the pre-trained model G on the training set until the pre-trained model G converges on the test set. S5. The user clips the gradient of the pre-trained model G: When the user uses gradient descent to optimize the parameters of the pre-trained model G, the gradient of the pre-trained model G calculated in each epoch is clipped according to formula (3) to ensure that the norm of the gradient does not exceed the threshold C; Where g(x) is the gradient of sample x; S6. The user calculates the Fisher matrix of the pre-trained model G parameters: Before updating the parameters of the pre-trained model G in each round, the user calculates the Fisher matrix of the parameters of the pre-trained model G according to formula (4), where p(x|θ) is a probability density function, θ is a parameter, x is an observed data point, x|θ represents the value of x under a given θ, and logp(x|θ) is its log-likelihood function; the diagonal elements I in the Fisher matrix are ii (θ) represents θ i The amount of information; S7. The user adds adaptive noise based on the proportion of private data and the Fisher matrix: After calculating the Fisher matrix of the pre-trained model G parameters, the user adaptively adjusts the amount of noise added to the gradient based on the ratio of the Fisher matrix to the private data. If the model parameters calculated using the Fisher matrix contain a large amount of information or the proportion of private data in the user's local data is too large, the user will add more noise to the gradient accordingly to provide stronger privacy protection. Otherwise, the amount of noise will be reduced, thereby accelerating the convergence of the pre-trained model G.
6. The large model privacy protection method based on differential privacy and private entity recognition replacement according to claim 5, characterized in that: The threshold C is a hyperparameter and is set to 1 or 0.
1.
7. The large model privacy protection method based on differential privacy and private entity recognition replacement according to claim 1, characterized in that: When masking and restoring private text with contextual background, the client-side mini-model considers whether to perform targeted replacement based on the contextual information.
8. The large model privacy protection method based on differential privacy and private entity recognition replacement as claimed in claim 1, characterized in that: On the privacy masking end side, the end-side small model takes the input text content containing private data as the end-side small model input one, and the previous privacy replacement correspondence relationship as input two. After processing by the end-side small model, it finally outputs the replaced masked data, and uploads this content to the network or makes it public; on the privacy decoding end side, the end-side small model takes the masked data to be restored and the previous contextual privacy restoration relationship as the end-side small model input, and finally outputs the restored text containing the real private data through processing by the end-side small model.
9. The large model privacy protection method based on differential privacy and private entity recognition replacement according to claim 8, characterized in that: The use of the privacy data reuse method to produce a training dataset includes: based on this set of masked data samples one, namely the input text and output text, and the corresponding entity replacement relationship, by exchanging the input and output content, and reversing the entity replacement relationship, a new set of masked data samples two is augmented; based on the same set of input and output texts, by setting a mask prompt and a restoration prompt, they are designed into a masking task and a restoration task respectively, so the masked data samples one and two replace the mask prompt with the restoration prompt respectively, thereby deriving masked data samples three and four; therefore, four data of two task types are obtained by producing one data sample; if the scenario of contextual interaction is considered, some entity replacement relationships are fixed, and each sample further derives several privacy masked data samples and privacy restoration data samples with partial contextual replacement relationships.
10. The large model privacy protection method based on differential privacy and private entity recognition replacement according to claim 9, characterized in that: The training dataset is used to jointly train the privacy replacement and privacy restoration tasks to obtain a small end-side model. To achieve the deployment of the small end-side model, the Phi-3.5-mini model with a parameter size of 3.8B and a context window supporting 128K tokens was selected as the model architecture. The supervised fine-tuning strategy SFT was used during training to jointly train the privacy replacement and privacy restoration tasks, and the loss weight was balanced through gradient accumulation.