A method and apparatus for multi-party joint fine-tuning of language models based on data protection

Abstract

A method and apparatus for multi-party joint fine-tuning of a language model based on data protection are disclosed. The multi-party includes a first party holding a target language model and a second party providing computing power. The target language model includes an embedding table and serially configured multi-layer network layers. The first party determines multi-layer obfuscation layers and an obfuscation embedding table; at least the multi-layer obfuscation layers are sent to the second party. The obfuscation embedding table is obtained by performing a second obfuscation on the embedding table, and the obfuscation layers are obtained by performing a first obfuscation on the parameter matrices in the corresponding network layers. The first obfuscation method corresponds to the second obfuscation method. The second party obtains training samples including the target obfuscated word embedding sequence and its labels, which are determined based on the text and the obfuscation embedding table. Based on the target obfuscated word embedding sequence, a first output result is obtained through the multi-layer obfuscation layers. Based on the difference between the first output result and the labels, the multi-layer obfuscation layers are adjusted to achieve multi-party joint fine-tuning of the model while protecting model parameters and data privacy.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of artificial intelligence technology, and in particular relate to a method and device for multi-party joint fine-tuning of a language model based on data protection. Background Technology

[0002] Large language models have achieved great success in recent years and are widely used in various fields. In the application of large language models, the model owner (hereinafter referred to as the model owner), the user (i.e., the data owner) (hereinafter referred to as the data owner), and the computing power provider (hereinafter referred to as the computing power provider) are often different entities. Considering that the model parameters of large language models are often obtained by the model owner through significant investment of time, data, and computing power in training, the model owner wants their model parameters protected from theft during transmission, storage, and application. On the other hand, the data owner often possesses domain-specific data and wants their own data to remain confidential when fine-tuning and using the large language model.

[0003] In some example scenarios, suppose there is a three-party scenario: one party (the model party) has a large language model and can provide large language model inference services; one party (the computing power party) has powerful computing power and can provide large language model fine-tuning and deployment services; and one party (the data party) has data and wants to fine-tune the large language model for its own inference needs.

[0004] In response to the above scenario, the three parties can currently collaborate as follows: the model provider hands over its model to the computing power provider, the data provider sends its data to the computing power provider, and the computing power provider uses the data to fine-tune the model and deploy it.

[0005] The above scenario presents a serious problem of model parameter and data provider privacy leakage. Firstly, the data provider's data is private, and they do not want it directly exposed to others (such as computing power providers). Secondly, the model provider wants to protect the model parameters of their large language model from leakage. However, in the above scenario, deploying the large language model directly on the computing power provider would directly leak the model parameters, and the data provider sending its data directly to the computing power provider would also leak its data privacy. Therefore, there is an urgent need for a solution that can protect model parameters and data provider privacy in the above scenario to promote the further application of large language models. Summary of the Invention

[0006] The purpose of this invention is to provide a method and apparatus for multi-party joint fine-tuning of a language model based on data protection, so as to achieve joint fine-tuning of the language model while protecting the model parameters and data privacy.

[0007] This specification provides a method for multi-party joint fine-tuning of a language model based on data protection, wherein the multi-party includes a first party and a second party, the first party holding a target language model, the target language model including an embedding table and a serially configured multi-layer network, and the second party providing computing power, including:

[0008] The first party determines a multi-layer obfuscation layer and an obfuscation embedding table; at least the multi-layer obfuscation layer is sent to the second party; wherein, a single obfuscation layer is obtained by performing a first obfuscation on the parameter matrix in the corresponding network layer, the obfuscation embedding table is obtained by performing a second obfuscation on the embedding table, the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method, and the second obfuscation includes column permutation;

[0009] The second party obtains training samples, which include target obfuscated word embedding sequences and their corresponding labels; based on the target obfuscated word embedding sequences, a first output result is obtained through the multi-layer obfuscation layer; based on the difference between the first output result and the labels, the multi-layer obfuscation layer is adjusted, wherein the target obfuscated word embedding sequences and the labels are determined based on the text and the obfuscation embedding table.

[0010] A second aspect of this specification provides a method for multi-party joint fine-tuning of a language model based on data protection, wherein the multi-party includes a first party and a second party, the first party holding a target language model, the target language model including an embedding table and a serially configured multi-layer network, the second party providing computing power, and the method implemented in the second party, comprising:

[0011] A multi-layer obfuscation layer is obtained from the first party, wherein the multi-layer obfuscation layer is obtained by the first party performing a first obfuscation on the parameter matrix in the corresponding network layer, and the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method performed by the embedding table;

[0012] Obtain training samples, which include target obfuscated word embedding sequences and their corresponding labels. The target obfuscated word embedding sequences and the labels are determined based on text and an obfuscated embedding table. The obfuscated embedding table is obtained by performing the second obfuscation on the embedding table. The second obfuscation includes column permutation.

[0013] Based on the target obfuscated word embedding sequence, the first output result is obtained through the multi-layer obfuscation layer;

[0014] Based on the difference between the first output result and the label, the multi-layer obfuscation layer is adjusted.

[0015] A third aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in the second aspect.

[0016] A fourth aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the second aspect.

[0017] This specification provides a computer program product in a fifth aspect, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in the second aspect.

[0018] According to the data protection-based multi-party joint fine-tuning language model method and device provided in the embodiments of this specification, the first party determines multiple obfuscation layers and obfuscation embedding tables to obfuscate the parameters of the target language model, thereby preventing its network layer parameters and embedding tables from being exposed to other parties. The first obfuscation method of the obfuscation matrix in each obfuscation layer corresponds to the second obfuscation method of the obfuscation embedding table, ensuring that correct calculation can still be performed after obfuscation. Then, the first party sends at least multiple obfuscation layers to the second party, thus avoiding the exposure of model parameters at the second party while using the computing power service provided by the second party. The second party obtains training samples including the target obfuscated word embedding sequence and its corresponding labels, and the target obfuscated word embedding sequence and labels are based on text. The obfuscation embedding table, as determined by the obfuscation method, can prevent the plaintext of the text from being exposed by the second party. The second party obtains the first output result based on the target obfuscated word embedding sequence through multiple obfuscation layers. Since the first obfuscation method of the obfuscation matrix in each obfuscation layer corresponds to the second obfuscation method, including column permutation, in the obfuscation embedding table, the mutual cooperation of the obfuscation methods of the parameter matrices of each network layer can ensure that the obfuscation status of the output of the obfuscated model matches the obfuscation status of the labels determined based on the obfuscation embedding table. Based on the difference between the first output result and the labels, the multi-level obfuscation layers of the target language model can be adjusted to achieve multi-party joint fine-tuning of the language model while protecting model parameters and data privacy. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the implementation framework of one embodiment disclosed in this embodiment;

[0021] Figure 2A This is a schematic diagram of the implementation framework of yet another embodiment disclosed in one embodiment;

[0022] Figure 2B This is a schematic diagram of the implementation framework of yet another embodiment disclosed in one embodiment;

[0023] Figure 3 This is a flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection in one embodiment of this specification;

[0024] Figure 4 This is a schematic diagram of a network layer of the target language model in the embodiments of this specification;

[0025] Figure 5 This is another flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection, as described in one embodiment of this specification.

[0026] Figure 6 This is another flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection, as described in one embodiment of this specification.

[0027] Figure 7 This is another flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection, as described in one embodiment of this specification.

[0028] Figure 8 This is a schematic block diagram of a device for multi-party joint fine-tuning of a language model based on data protection, as described in one embodiment of this specification. Detailed Implementation

[0029] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0030] This specification discloses a method and apparatus for multi-party joint fine-tuning of a language model based on data protection. The application scenarios and technical concepts of the method are first introduced below:

[0031] As mentioned earlier, in a scenario where one party (the model provider) possesses a large language model and can provide large language model inference services, another party (the computing power provider) possesses powerful computing power and can provide large language model fine-tuning and deployment services, and a third party (the data provider) possesses data and wishes to fine-tune the model provider's large language model for its own inference needs, if the model provider deploys the large language model to the computing power provider, and the data provider sends its data in plaintext to the computing power provider in order to fine-tune the large language model deployed by the computing power provider through the data, there will be a problem that both the model provider's large language model and the data provider's data will be leaked to the computing power provider.

[0032] Alternatively, in a scenario where one party (referred to as the model data party) possesses a large language model and data for fine-tuning the large language model, but lacks sufficient computing power, it needs to rely on the powerful computing power provided by another party (the computing power party) for model fine-tuning and deployment. In this case, the model data party sends its large language model and data to the computing power party to utilize the computing power provided by the computing power party to fine-tune the large language model deployed by the computing power party through the data. However, the problem of the parameters and data of the large language model being leaked by the computing power party will also exist.

[0033] Therefore, there is an urgent need for a solution that can protect model parameters and data privacy in the above scenarios in order to promote the further application of large language models.

[0034] In the embodiments described in this specification, the inventors propose a method for multi-party joint fine-tuning of a language model based on data protection. Figure 1 This diagram illustrates an implementation scenario according to an embodiment disclosed in this specification. In this implementation scenario, the multiple parties include a first party A and a second party B. The first party A holds a target language model LM, which includes an embedding table and a serially configured multi-layer network. The second party B provides computing power to fine-tune the target language model LM and provides inference services based on the fine-tuned target language model LM. The second party can be referred to as the computing power provider.

[0035] The embedding table includes at least a word embedding sub-table, which contains the word embedding (or token) for each word, which can exist in vector form. In some cases, the embedding table may also include a position embedding sub-table, which contains the position embedding (or position_embedding) for each position, which can also exist in vector form and represents the position of each word in the text. The embedding table may also include a token type embedding sub-table, which may contain the token type embedding (or token_type_embedding) for each token type, which can also exist in vector form. Each token type is used to distinguish different types or parts of the input (e.g., marking different sentences, such as marking the beginning and end of a sentence).

[0036] The process of jointly fine-tuning a language model by multiple parties can include two stages: the model preprocessing stage and the actual model fine-tuning stage.

[0037] In the model preprocessing stage: First party A, based on its target language model LM, determines multiple obfuscation layers and obfuscation embedding tables. The i-th obfuscation layer is obtained by performing a first obfuscation on the parameter matrix of the i-th network layer. The obfuscation embedding table is obtained by performing a second obfuscation on the embedding table. This second obfuscation includes column permutations. The first and second obfuscation methods of the parameter matrices in each network layer correspond to each other. The coordination of the obfuscation methods of the parameter matrices in each network layer ensures that the obfuscation status of the output of the obfuscated model matches the obfuscation status of the labels determined based on the obfuscation embedding table. Here, i is a positive integer, with a maximum value being the total number of network layers.

[0038] It is understood that the "first" in the first obfuscation and the "second" in the second obfuscation in the embodiments of this specification are only for distinguishing obfuscation operations performed on different objects and do not have any other limiting meaning.

[0039] Next, Party A sends at least several layers of obfuscation to Party B, which then retrieves and deploys these layers. This leads to the actual model fine-tuning phase.

[0040] Specifically, during the model fine-tuning phase, the second party B obtains training samples, which include target obfuscated word embedding sequences and their corresponding labels. These target obfuscated word embedding sequences and labels are determined based on the text and the obfuscated embedding table. Consequently, the second party B can only obtain the obfuscated content of the text used to fine-tune the target language model LM, and cannot obtain the plaintext text, thus achieving privacy protection for the text, i.e., the data used to fine-tune the target language model LM.

[0041] Then, the second party B obtains the first output result based on the target obfuscated word embedding sequence through multiple obfuscation layers. Since the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method, it can ensure that the output result of the multiple obfuscation layers matches the obfuscation situation of the labels determined based on the obfuscation embedding table. Accordingly, the second party B adjusts the multiple obfuscation layers based on the difference between the first output result and the labels, so as to achieve multi-party joint fine-tuning of the language model under the premise of protecting model parameters and data privacy.

[0042] Understandable, such as Figure 1As shown, in some possible examples, the text used to fine-tune the target language model (LM) can be held by a first party. In this case, the first party A can directly determine the training sample based on its obfuscated embedding table and the text, and then send it to the second party B so that the second party B can obtain the training sample. The aforementioned process by which the second party B adjusts the multiple obfuscation layers based on the difference between the first output and the label is as follows: Figure 1 As shown, the process includes: a second party B sending a first output result to a first party A; the first party A determining the obfuscated word embeddings corresponding to the generated words at each position in the first output result based on a series of probabilities and an obfuscation embedding table, thus obtaining a predicted obfuscated word embedding sequence; and then sending the predicted obfuscated word embedding sequence to the second party B. The second party B adjusting the multi-layer obfuscation layers based on the difference between the predicted obfuscated word embedding sequence and the aforementioned labels determined based on the obfuscation embedding table.

[0043] In the above process, the first party determines multiple obfuscation layers and obfuscation embedding tables to obfuscate the parameters of the target language model, thus preventing its network layer parameters and embedding tables from being exposed to other parties. The first obfuscation method of the obfuscation matrix in each obfuscation layer corresponds to the second obfuscation method of the obfuscation embedding table, ensuring that correct calculations can still be performed after obfuscation. Next, the first party sends at least multiple obfuscation layers to the second party, thus avoiding the exposure of model parameters at the second party while utilizing the computing power provided by the second party. The second party obtains training samples including the target obfuscated word embedding sequence and its corresponding labels. The target obfuscated word embedding sequence and labels are determined based on the text and the obfuscation embedding table. To avoid exposing plaintext text to the second party, the second party obtains the first output result through multiple obfuscation layers based on the target obfuscated word embedding sequence. Since the first obfuscation method of the obfuscation matrix in each obfuscation layer corresponds to the second obfuscation method of the obfuscation embedding table, including column permutation, the mutual cooperation of the obfuscation methods of the parameter matrices of each network layer can ensure that the obfuscation status of the output of the obfuscated model matches the obfuscation status of the labels determined based on the obfuscation embedding table. Therefore, based on the difference between the first output result and the labels, the multi-level obfuscation layers of the target language model can be adjusted to achieve multi-party joint fine-tuning of the language model while protecting model parameters and data privacy.

[0044] like Figure 2AThe diagram illustrates another implementation scenario according to an embodiment disclosed in this specification. In this scenario, the parties jointly fine-tuning the language model include a first party A, a second party B, and a third party C. First party A holds the target language model, which includes an embedding table and serially configured multi-layer network layers. The embedding table includes at least a word embedding sub-table. Second party B provides computing power. Third party C holds the text required for fine-tuning the target language model, as well as the text needed for subsequent inference. In this scenario, first party A can also be referred to as the model party, second party B as the computing power party, and third party C as the data party.

[0045] The process of jointly fine-tuning a language model by multiple parties can include two stages: the model preprocessing stage and the actual model fine-tuning stage.

[0046] In the model preprocessing stage: determine the multi-layer obfuscation layer and obfuscation embedding table; further, determine the first and second mapping relationships corresponding to the obfuscated word embedding sub-tables in the obfuscation embedding table, wherein the obfuscated word embedding sub-table is obtained by performing row permutation on the word embedding sub-table after column permutation; the first mapping relationship is the mapping relationship between each word in the obfuscated word embedding sub-table and its position identifier in the obfuscated word embedding sub-table, which can be represented as word->id; the second mapping relationship is the mapping relationship between the obfuscated word embedding of each word in the obfuscated word embedding sub-table and the position identifier of each word, which can be represented as id->embedding.

[0047] Understandably, performing column permutations on the word embeddings corresponding to each word in the word embedding sub-table of the embedding table yields the obfuscated word embeddings corresponding to each word, thus obfuscating the word embeddings of each word. Afterward, at least the row permutations are performed on the word embedding sub-table after the column permutations, that is, the row permutations are performed on each word and its obfuscated word embeddings in the word embedding sub-table, thereby obfuscating the position of each word and its obfuscated word embeddings in the word embedding sub-table. This can better avoid the exposure of the embedded text and better achieve the confidentiality of the text of the third party C.

[0048] Understandably, row permutations do not affect the correspondence between words and their spoofs; words and their spoofs always remain in the same row of the table. For example, before a row permutation, word C and its spoof embedding are in row 4 of the word embedding sub-table (i.e., in the embedding table), and their corresponding position identifiers are both id 4. After a row permutation, word C and its spoof embedding are moved to row 13 of the word embedding sub-table (i.e., in the embedding table), and their corresponding position identifiers are both id 13.

[0049] For the word embedding subtable before and after row replacement, its content—that is, the words and their confusion word embeddings—remains unchanged; only the positions of the words and their confusion word embeddings in the table change. This change in position does not affect the accuracy of determining the confusion word embeddings corresponding to the obtained words.

[0050] Next, Party A sends the multi-layer obfuscation layer and the aforementioned second mapping relationship id->embedding to Party B. Party B then retrieves and deploys the multi-layer obfuscation layer, and retrieves and stores the second mapping relationship id->embedding. Party A then sends the first mapping relationship word->id to Party C. Party C retrieves and stores the first mapping relationship word->id. After this, the actual model fine-tuning phase begins.

[0051] Specifically, during the model fine-tuning phase: Third party C determines the position identifier id corresponding to each word segment in the text based on the first mapping relationship word->id it has obtained, so as to obtain the target position identifier sequence; then, third party C sends the target position identifier sequence to second party B.

[0052] After obtaining the target location identifier sequence sent by the third party C, the second party B can determine the training sample, namely the target obfuscation word embedding sequence and its corresponding label, based on its second mapping relationship id->embedding and the target location identifier sequence.

[0053] Then, the second party B obtains the first output result based on the target obfuscated word embedding sequence through multiple obfuscation layers. Since the first obfuscation method and the second obfuscation method in the parameter matrix of each network layer correspond, it can be guaranteed that the output result of the multiple obfuscation layers matches the obfuscation situation of the labels determined based on the obfuscation embedding table. Accordingly, based on the difference between the first output result and the labels, the multiple obfuscation layers are adjusted to achieve multi-party joint fine-tuning of the language model while protecting model parameters and data privacy.

[0054] For example, the aforementioned process of adjusting the multi-layer confusion layer based on the difference between the first output result and the label may include: determining the position identifier corresponding to the generated word at each corresponding position in the first output result based on a series of probabilities and a second mapping relationship, thereby obtaining a predicted position identifier sequence; and then adjusting the multi-layer confusion layer based on the difference between the predicted position identifier sequence and the label (which is a series of position identifiers) determined at least based on the first mapping relationship.

[0055] In the above process, the first party determines the first and second mapping relationships corresponding to the multi-layer obfuscation layer, the obfuscation embedding table, and the obfuscated word embedding sub-table. Then, the first mapping relationship word->id is sent to the third party, which hides the original position of each word in the embedding table and prevents the third party from knowing the word embedding corresponding to each word, thus achieving the confidentiality of the target language model parameters at the third party. The first party sends the multi-layer obfuscation layer and the second mapping relationship id->embedding to the second party, which prevents the second party from knowing the real embedding of each word, the original position of each word in the embedding table, and the correspondence between each embedding and the word. This achieves the confidentiality of the target language model parameters at the second party. Moreover, the second party only obtains the second mapping relationship id->embedding and cannot deduce the plaintext of the third party's text, thus avoiding the leakage of the third party's private data, i.e., the text, at the second party's location. Furthermore, the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method of the obfuscation embedding table. The mutual cooperation of the obfuscation methods of the parameter matrix in each network layer can ensure that the obfuscation status of the output of the obfuscated model matches the obfuscation status of the label determined based on the obfuscation embedding table. Then, based on the difference between the first output result and the label, the multi-layer obfuscation layer of the target language model can be adjusted to achieve multi-party joint fine-tuning of the language model while protecting model parameters and data privacy.

[0056] like Figure 2B The diagram illustrates another implementation scenario of an embodiment disclosed in this specification. In a scenario where the parties jointly fine-tuning the language model include the aforementioned first party A, second party B, and third party C, after first party A determines the multi-layer obfuscation layer and obfuscation embedding table, it can send the multi-layer obfuscation layer to second party B and the obfuscation embedding table to third party C. Then, third party C, based on the obfuscation embedding table and the text it holds, determines the training samples, namely the target obfuscated word embedding sequence and its corresponding labels, and sends the training samples to second party B. Next, second party B, based on the target obfuscated word embedding sequence, obtains the first output result through the multi-layer obfuscation layer. Second party B adjusts the multi-layer obfuscation layer based on the difference between the first output result and the labels, thereby achieving multi-party joint fine-tuning of the language model while protecting model parameters and data privacy.

[0057] In this process, the aforementioned second party B adjusts the multi-layer obfuscation layers based on the differences between the first output and the labels, such as... Figure 2BAs shown, the process includes: a second party B sending a first output result to a third party C. Third party C, based on a series of probabilities and an obfuscation embedding table corresponding to each position in the first output result, determines the obfuscation word embedding corresponding to the generated word at each position in the first output result, thereby obtaining a predicted obfuscation word embedding sequence; then, the predicted obfuscation word embedding sequence is sent to the second party B. The second party B adjusts the multiple obfuscation layers based on the differences between the predicted obfuscation word embedding sequence and the aforementioned labels.

[0058] The following detailed description, with reference to specific embodiments, elaborates on the method for multi-party joint fine-tuning of language models based on data protection provided in this specification.

[0059] Figure 3 A flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection, according to one embodiment of this specification, is shown. The aforementioned parties may include a first party A and a second party B. The first party A holds the target language model, which includes an embedding table and a serially configured multi-layer network. The second party B provides computing power. In some possible examples, in the scenario where the first party A and the second party B jointly fine-tune the target language model, the data used to fine-tune the target language model, i.e., the text mentioned later, may be held by the first party A.

[0060] In some possible examples, the target language model is a network model based on a Transformer architecture. Multiple network layers can be referred to as Transformer layers. The network structures within these multiple layers are similar. For example, the target language model could be a BERT (Bidirectional Encoder Representations from Transformers) model or an improved version thereof, or a GPT (Generative Pre-trained Transformer) model or an improved version thereof, etc.

[0061] like Figure 3 As shown, the method for multi-party joint fine-tuning of the language model based on data protection includes the following steps S310-S360:

[0062] Considering that during the joint fine-tuning of the target language model by Party A and Party B, it is necessary to protect the model parameters of the target language model (including the embedding table and parameters in each network layer) to prevent leakage of these parameters at Party B, and also to protect the data used for fine-tuning the target language model—that is, the text it holds—to prevent leakage at Party B, Party A and Party B need to perform model preprocessing on the target language model before jointly fine-tuning it. This ensures that the model parameters of the target language model are not leaked at Party B, and that the text used for fine-tuning the target language model is not leaked at Party B.

[0063] Specifically, in step S310, the first party A determines a multi-layer obfuscation layer and an obfuscation embedding table. A single obfuscation layer is obtained by performing a first obfuscation on the parameter matrix of the corresponding network layer. The obfuscation embedding table is obtained by performing a second obfuscation on the embedding table. The second obfuscation includes column permutations. The first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method; that is, the first obfuscation method of the obfuscation matrix in each obfuscation layer corresponds to the second obfuscation method.

[0064] The embedding table is used to vectorize the input data of the model (e.g., text used to fine-tune the target language model, or other text that needs to be used for inference with the fine-tuned target language model). A row in the embedding table can represent a word embedding corresponding to a word (i.e., a word segment), a position embedding corresponding to a position, or a tag type embedding corresponding to a tag type. Each type of embedding can exist in vector form. Accordingly, the embedding table can be said to include at least a word embedding sub-table, which includes words (i.e., word segments) and their corresponding word embeddings. The embedding table can also have position embedding sub-tables and tag type embedding sub-tables. The position embedding sub-table includes each position and its corresponding position embedding, and the tag type embedding sub-table includes each tag type and its corresponding tag type embedding.

[0065] The aforementioned obfuscated embedded table is obtained by performing a second obfuscation on the embedded table. This second obfuscation includes at least column permutations, which can be understood as: the first party A performs at least column permutations on the embedded table to obtain the obfuscated embedded table. This column permutation of the embedded table can include performing column permutations on each embedding within the embedded table.

[0066] Each network layer may contain one or more parameter matrices. A single parameter matrix may contain at least a weight matrix and may also contain a bias matrix that corresponds to the weight matrix.

[0067] Understandably, the first party A obfuscates the model parameters (i.e., the embedding table and the parameter matrix of the multi-layer network) of the target language model. After obtaining the obfuscated model, it is also necessary to ensure that the obfuscation of the output obtained by using the obfuscated model for the input matches the obfuscation of the label corresponding to the input determined based on the obfuscated embedding table. Accordingly, when obfuscating the target language model, the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method of the embedding table.

[0068] In some possible examples, first party A can obtain the obfuscation embedding table and multi-layer obfuscation layer from its specified storage location. This obfuscation embedding table and multi-layer obfuscation layer are pre-generated by first party A for the target language model.

[0069] In some other possible examples, step S310 may include steps 11-13: In step 11, the first party A generates a first permutation matrix corresponding to the embedding table and a second permutation matrix corresponding to each parameter matrix in each network layer.

[0070] In this step, the first party A can randomly generate a corresponding permutation matrix based on the size (or shape) of the embedding table, which can be called the first permutation matrix π. e ; and based on the dimensions of each parameter matrix in each network layer, a permutation matrix corresponding to each parameter matrix is ​​randomly generated, which can be called the second permutation matrix π corresponding to each parameter matrix. name The "name" is related to the parameter matrix corresponding to the second permutation matrix.

[0071] Understandably, a permutation matrix (including the first and second permutation matrices, and the third permutation matrix mentioned later) can also be called a shuffle matrix or a permutation matrix. It is a special type of square matrix in which each row and each column contains exactly one element with a value of 1, and the remaining elements have a value of 0. A permutation matrix can rearrange the rows or columns of other matrices. A permutation matrix is ​​an orthogonal matrix, and its inverse matrix is ​​its transpose matrix.

[0072] In some examples, the first permutation matrix and each of the second permutation matrices can be used multiple times to obfuscate the target language model (including its embedding table and parameter matrix), or new first permutation matrices and each of the second permutation matrices can be generated each time obfuscation is required.

[0073] The second permutation matrix corresponding to the parameter matrices of different network layers can be the same or different; the second permutation matrix corresponding to different parameter matrices can be the same or different.

[0074] Each parameter matrix may include a weight matrix and a bias matrix corresponding to the weight matrix. The aforementioned random generation of the permutation matrix corresponding to each parameter matrix based on the dimensions of each parameter matrix in each network layer can refer to: randomly generating the permutation matrix corresponding to each parameter matrix based on the dimensions of the weight matrices included in each parameter matrix in each network layer. It is understood that the dimensions of the bias matrix corresponding to the weight matrix are the same as the dimensions of the weight matrix.

[0075] The permutation matrix is ​​randomly generated based on the size (or shape) of the embedding table. Alternatively, it can be generated randomly based on the size (or shape) of multiple embeddings in the embedding table.

[0076] Next, in step 12, the first party A multiplies the embedding table on the right by at least the first permutation matrix to obtain a confused embedding table.

[0077] In some possible examples, the aforementioned second obfuscation may at least include column permutations. Accordingly, in step 12, the first party may right-multiply the embedding table by the first permutation matrix to perform column permutations on the embedding table, that is, to perform column permutations on each embedding in the embedding table to obtain an obfuscated embedding table. In the case where the embedding table includes word embedding e1, position embedding e2, and tag type embedding e3, right-multiplying the embedding table by the first permutation matrix may include right-multiplying word embedding e1, position embedding e2, and tag type embedding e3 all by the first permutation matrix π. e .

[0078] In some other possible examples, the aforementioned second obfuscation may include column permutations and row permutations. Accordingly, step 12 may specifically include: the first party A multiplies the embedding table on the right by the first permutation matrix to obtain the embedding table after column permutations; then, the word embedding sub-table after column permutations in the embedding table is multiplied on the left by the third permutation matrix to obtain the obfuscated word embedding sub-table, and thus the obfuscated embedding table. Continuing with the previous example, in this step, the first permutation matrix π is multiplied on the right. e The word embedding e1 is then left-multiplied by the third permutation matrix π. w This allows us to obtain a sub-table of obfuscated word embeddings and perform row permutations on each word and its obfuscated word embeddings.

[0079] In step 13, the first party A processes each parameter matrix in each network layer using at least the second permutation matrix corresponding to the parameter matrix to obtain the confusion matrix corresponding to the parameter matrix, so as to obtain a multi-layer confusion layer.

[0080] The single parameter matrix may include a weight matrix and a bias matrix corresponding to the weight matrix. When the parameter matrix includes a weight matrix, in step 13, the first party A processes the weight matrix in each parameter matrix of each network layer using at least the second permutation matrix corresponding to the parameter matrix to obtain the confusion matrix corresponding to the parameter matrix. The confusion matrix corresponding to the parameter matrix includes the confused weight matrix (also called the column permutation weight matrix) to obtain a multi-layer confusion layer.

[0081] In some possible examples, in order to ensure that the target language model (i.e., multiple obfuscation layers) can correctly compute its input and that the output of the obfuscated target language model matches the obfuscation of the labels determined based on the obfuscated embedding table, the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method.

[0082] Based on the above, and considering that the row permutation performed by the obfuscated word embedding subtable only obfuscates the words and their positions in the table, it does not affect the subsequent vectorization of each word in the text. That is, the vectorization result of using the obfuscated word embedding subtable is consistent with that of using the word embedding subtable without row permutation (only column permutation is performed), and it has no impact on the intermediate processing of the target language model.

[0083] Accordingly, the embodiments of this specification also provide the following substitution idea to ensure that the obfuscated model (i.e., the obfuscated target language model) correctly processes the input and that its output matches the obfuscation of the tags determined based on the obfuscated embedding table.

[0084] Specifically, for the weight matrices in each parameter matrix, if a weight matrix needs to be multiplied by its input, its input (which has also undergone column permutation) can be restored by first performing column permutation, and then the output of the weight matrix (i.e., the result of matrix multiplication between the restored input and the weight matrix) can be permuted using the second permutation matrix corresponding to the weight matrix. If a weight matrix needs to be multiplied element-wise by its input (which has also undergone column permutation), the column permutation of the weight matrix must be consistent with that of its input. This ensures that during inference, the input to the j-th parameter matrix (i.e., the output of the (j-1)-th parameter matrix) is only permuted (i.e., obfuscated) based on the second permutation matrix corresponding to the (j-1)-th parameter matrix, compared to the plaintext input without column permutation.

[0085] Given the aforementioned permutation concept, in some possible examples, a single parameter matrix may include at least a weight matrix. For instance, the weight matrix may be a first weight matrix that needs to be element-wise multiplied with its input. Correspondingly, in step 13, the process of obtaining the confusion matrix corresponding to the parameter matrix may include: right-multiplying the first weight matrix by its corresponding second permutation matrix to obtain the confusion matrix corresponding to the first weight matrix, wherein the second permutation matrix corresponding to the first weight matrix ensures that the confusion state of the confusion matrix corresponding to the first weight matrix is ​​consistent with the confusion state of its input. Specifically, the second permutation matrix corresponding to the first weight matrix may be the same as the second permutation matrix corresponding to the preceding weight matrix of the first weight matrix.

[0086] In some possible examples, a single parameter matrix may include at least a weight matrix. For example, the weight matrix may be a second weight matrix that needs to be multiplied with its input. Accordingly, the process of obtaining the confusion matrix corresponding to the parameter matrix in step 13 may include: multiplying the second weight matrix on the left by the transpose of the second permutation matrix corresponding to the previous weight matrix, and multiplying it on the right by the corresponding second permutation matrix to obtain the confusion matrix corresponding to the second weight matrix.

[0087] In some possible examples, the target language model is a Transformer-based network model. Each network layer can include a self-attention-based sub-layer and a feedforward neural network sub-layer, where both the self-attention-based sub-layer and the feedforward neural network sub-layer include layer normalization. The aforementioned first weight matrix can include the weight matrix from the layer normalization. The aforementioned second weight matrix can include other weight matrices in the self-attention-based sub-layer besides the weight matrix from the layer normalization, and other weight matrices in the feedforward neural network sub-layer besides the weight matrix from the layer normalization.

[0088] In some examples, the final network layer of the target language model may include a dimension mapping sublayer, namely the LM_head (Language Model Head) layer, relative to other network layers. This dimension mapping sublayer can be placed after the feedforward neural network sublayer of this network layer. This dimension mapping sublayer is used to map the dimensions of its input to the word dimensions of the confusion word embedding subtable.

[0089] In some possible examples, a single parameter matrix may also include a bias matrix corresponding to the weight matrix. Accordingly, in step 13, obtaining the confusion matrix corresponding to the parameter matrix may also include: right-multiplying the bias matrix by its corresponding second permutation matrix to obtain the confused bias matrix, that is, the bias matrix after column permutation. The second permutation matrix corresponding to the bias matrix is ​​the same as the second permutation matrix corresponding to its weight matrix.

[0090] Understandably, during the processing, the bias matrix needs to be added to the product of its corresponding weight matrix and the input. For the bias matrix, it is sufficient to ensure that the column permutations of the obfuscated bias matrix are consistent with the column permutations of the product of its corresponding weight matrix and the input.

[0091] For example, for a second weight matrix W a1 For the weight matrix (which needs to be multiplied with its input) and its bias matrix, the second weight matrix W a1 The input is based on the second weight matrix W. a1 The previous weight matrix W a2 The corresponding second permutation matrix The second weight matrix W, after column permutation. a1 The input can be represented as @ denotes matrix multiplication, and H denotes the second weight matrix W. a1 The input plaintext.

[0092] Second weight matrix W a1 Left-multiply by its preceding weight matrix W a2 The corresponding second permutation matrix transpose matrix Then, right-multiply by the second weight matrix W a1 The corresponding second permutation matrix This allows for the input of the second weight matrix. Perform column permutation recovery, then use the input H and the second weight matrix W for column permutation recovery. a1 The product of the two is then subjected to column permutation. Specifically, this process can be represented as follows: in It is the identity matrix, which can be simplified to:

[0093] At this point, the column permutation of the aforementioned multiplication result 1 is based on the second permutation matrix corresponding to the second weight matrix Wa1. Accordingly, the second weight matrix W can be used. a1 The corresponding bias matrix is ​​right-multiplied by its corresponding second permutation matrix. This ensures that the aforementioned multiplication result is consistent with the column permutation of the bias matrix after column permutation.

[0094] Similarly, for a first weight matrix W a3 For the weight matrix (which needs to be element-wise multiplied with its input) and its bias matrix, the first weight matrix W a3 The input is based on the first weight matrix W. a3 The previous weight matrix Wa4 The corresponding second permutation matrix The first weight matrix W, after column permutation. a3 The input can be represented as F represents the first weight matrix W. a3 The input plaintext.

[0095] To ensure the first weight matrix W a3 The result after column permutation is consistent with the input column permutation; this first weight matrix W a3 The corresponding second permutation matrix With the previous weight matrix W a4 The corresponding second permutation matrix If they are the same, then the first weight matrix W a3 Right-multiply by its second permutation matrix Afterwards, its column permutation is consistent with the column permutation of its input.

[0096] Subsequently, the first weight matrix W a3 Input With the first weight matrix W a3 Right-multiply by its second permutation matrix Element-wise multiplication of the result yields a product of 2, which can be represented as: * indicates element-wise multiplication. The column permutations of the multiplication result 2 are related to the first weight matrix W. a3 Right-multiply by its second permutation matrix (and the first weight matrix W) a3 Input The column permutations are consistent with those of the first weight matrix W. Correspondingly, the first weight matrix W can be... a3 The corresponding bias matrix is ​​right-multiplied by its corresponding second permutation matrix. This ensures that the aforementioned multiplication result 2 is consistent with the column permutation of the bias matrix after column permutation.

[0097] In summary, the bias matrix can be directly multiplied by its corresponding second permutation matrix. This avoids introducing errors into the output of the obfuscated target language model compared to the output obtained using the target language model itself.

[0098] In some possible examples, the self-attention-based sublayers of each network layer can be multi-head self-attention-based sublayers, and each self-attention-based sublayer includes multiple sets of query parameter matrices Q. W Key parameter matrix K W and the value parameter matrix V W .

[0099] At this point, it is necessary to address the query parameter matrix Q within each self-attention head. W Key parameter matrix K W and the value parameter matrix V W Generate the corresponding second permutation matrix for each. Then, for each self-attention head, utilize its query parameter matrix Q. W Key parameter matrix K W and the value parameter matrix V W The corresponding second permutation matrix, respectively, is used to perform a query parameter operation on the matrix Q. W Key parameter matrix K W and the value parameter matrix V W Permutations are performed to ensure that each permutation occurs only within each self-attention head and not between two self-attention heads. This ensures that subsequent processing remains correct even after permutations of multiple self-attention heads and does not introduce errors into the model output (which may be confusing).

[0100] Due to the computational method within each self-attention head, the query parameter matrix Q within each attention head... W Bond parameter matrix K W The same second permutation matrix can be represented as π. QK For example, for a multi-head, i.e., multi-group (e.g., n groups) query parameter matrix Q W Or multiple sets of key parameter matrices K W Generate the second permutation matrix π QK The second permutation matrix π QK It can be represented as in, Q represents the query parameter matrix within the k-th attention head. W Bond parameter matrix K W The corresponding second permutation matrix, each The dimension is equal to the dimension d corresponding to each attention head. `diag` represents arranging n second permutation matrices diagonally from top left to bottom right, padding the remaining positions with 0s to construct an nd-dimensional square matrix. For example, if n equals 3, the second permutation matrix π... QK , can be represented as follows:

[0101]

[0102] For a multi-head parameter matrix V, i.e., multiple sets (e.g., n sets), W Generate its corresponding second permutation matrix π V For the method of generating the second permutation matrix π, please refer to the documentation. QK The method will not be elaborated here.

[0103] In some possible examples, each network layer may also include a residual connection operation, the second permutation matrix corresponding to the preceding parameter matrix of which may be the same as the first permutation matrix.

[0104] Understandably, any network layer c in each network layer can include both a self-attention-based sub-layer and a feedforward neural network sub-layer. Both the self-attention-based sub-layer and the feedforward neural network sub-layer can include residual connection operations. For residual connection operations in self-attention-based sub-layers, it is necessary to consider the previous operation (e.g., ...). Figure 4 The output of the first linear transformation operation (dense linear) shown is added to the input of the network sublayer based on the self-attention mechanism. If the output of the previous operation and the input of the network sublayer based on the self-attention mechanism have undergone column permutation, it is necessary to ensure that the column permutation of the two is consistent in order to guarantee the accuracy of the result of the residual connection operation.

[0105] Furthermore, considering that when network layer c is the first network layer, the input of its self-attention mechanism-based sub-layer is the initial embedding sequence (i.e., the target confusing word embedding sequence obtained based on the confusing embedding table). When network layer c is not the first network layer, the input of its self-attention mechanism-based sub-layer is the output of its preceding network layer.

[0106] Therefore, if the target obfuscation word embedding sequence (or the result of the target obfuscation word embedding sequence after layer normalization) undergoes column permutation, the column permutation is based on the first permutation matrix corresponding to the obfuscation embedding table. Furthermore, combining the aforementioned permutation concept and the network structure of the network layers, if the outputs of each network layer undergo column permutation, the column permutation is also based on the first permutation matrix corresponding to the obfuscation embedding table. Correspondingly, the column permutation of the output of the operation preceding the residual connection operation (e.g., the first linear transformation operation) is also based on the first permutation matrix corresponding to the obfuscation embedding table. Therefore, the second permutation matrix corresponding to the previous parameter matrix of this residual connection operation is the same as the first permutation matrix.

[0107] Similarly, for the residual connection operation in the feedforward neural network sublayer, it is necessary to add the input of the feedforward neural network sublayer and the output of its previous operation. If both the input of the feedforward neural network sublayer and the output of its previous operation have undergone column permutation, it is necessary to ensure that the column permutation of the two is consistent in order to guarantee the accuracy of the result of the residual connection operation.

[0108] The input to the feedforward neural network sublayer can be the output of the residual connection operation in the self-attention mechanism-based sublayer of network layer c. The column permutation of the input to the feedforward neural network sublayer is based on the aforementioned first permutation matrix. To ensure the accuracy of the residual connection operation, the column permutation of the output of the previous operation in the feedforward neural network sublayer also needs to be based on the first permutation matrix. Correspondingly, the second permutation matrix corresponding to the previous parameter matrix of the residual connection operation in this feedforward neural network sublayer is also the same as the first permutation matrix.

[0109] In some possible examples, each network layer includes layer normalization, which requires element-wise multiplication of its input. The permutation of its parameter matrix after permutation must be consistent with the permutation of its input. Accordingly, based on the network layer structure, the second permutation matrix corresponding to the parameter matrix of the layer normalization is the same as the first permutation matrix to ensure correct computation.

[0110] Understandably, the network structures of multiple network layers in a target language model are similar. The following explanation uses any one of these network layers as an example to illustrate the process of obfuscating the parameter matrices within each layer. For example... Figure 4 As shown, the network structure of a single network layer, such as the i-th network layer, in a target language model is illustrated.

[0111] like Figure 4 As shown, the i-th network layer can include a network sub-layer based on a self-attention mechanism and a feedforward neural network sub-layer, wherein, as Figure 4 As shown, a network sublayer based on a self-attention mechanism may include a first-layer normalization (e.g., Figure 4 LayerNorm1 and QKV linear transformation operations (such as LayerNorm1) Figure 4 QKV Linear), attention value calculation operations (such as...) Figure 4 The attention operation shown), attention value multiplication operation (such as...) Figure 4 In the diagram A@V, @ represents matrix multiplication, A represents the output of the attention value calculation operation, and V represents the value matrix, which is the value parameter matrix V. W Input and value parameter matrix V W The result of multiplication), the first linear transformation operation (such as Figure 4 The dense linear operation and the first residual join operation Skip Add (as in the example) Figure 4 As shown ).

[0112] The first level of normalization includes a parameter matrix, namely the weight matrix L. w1 and bias matrix L bias1The second permutation matrix corresponding to the first level of normalization can be expressed as: Its corresponding confusion matrix can be represented as: confusion weight matrix Confusion bias matrix

[0113] The self-attention sublayer in the i-th network layer can be a multi-head (e.g., n-head) or single-head self-attention sublayer. When the self-attention sublayer in the i-th network layer is a multi-head self-attention sublayer, each self-attention head includes a QKV linear transformation operation (e.g., ...). Figure 4 QKV Linear), attention value calculation operations (such as...) Figure 4 The attention operation shown), attention value multiplication operation (such as...) Figure 4 As shown in A@V), each self-attention head is associated with the first linear transformation operation (e.g., Figure 4 (dense Linear) connection.

[0114] The attention value calculation operation for the k-th self-attention head is performed as follows: K represents the key parameter matrix of the k-th self-attention head. k The dimension. @ indicates matrix multiplication.

[0115] The QKV linear transformation operation of the k-th self-attention head includes three parameter matrices: the query parameter matrix and the query parameter matrix. (including query weight matrix Q) w-k and its corresponding query bias matrix Q bias-k ), key parameter matrix (including the key weight matrix K) w-k and its corresponding bond bias matrix K qbias-k ), and the value parameter matrix (including the value weight matrix V) w-k and its corresponding value bias matrix V bias-k ).

[0116] The query parameter matrix in the k-th self-attention head and bond parameter matrix The corresponding second permutation matrix is ​​the same, and can be represented as The query parameter matrix in the kth self-attention head The corresponding confusion matrix can be represented as:

[0117] Confusion weight matrix Confusion bias matrix π e TTo obfuscate the transpose of the first permutation matrix corresponding to the embedding table.

[0118] The key parameter matrix in the kth self-attention head The corresponding confusion matrix can be represented as:

[0119] Confusion weight matrix Confusion bias matrix

[0120] The value parameter matrix in the kth self-attention head The corresponding second permutation matrix can be expressed as Value parameter matrix The corresponding confusion matrix can be represented as:

[0121] Confusion weight matrix Confusion bias matrix

[0122] The attention value calculation operation and the attention value multiplication operation do not include the parameter matrix that needs to be permuted.

[0123] The first linear transformation operation may include a parameter matrix, which may include a weight matrix D. w and bias matrix D bias The second permutation matrix corresponding to the first linear transformation operation is the same as the first permutation matrix and can be represented as π. e The confusion matrix corresponding to the first linear transformation operation can be represented as: confusion weight matrix π V T @D w @π e Confusion bias matrix π V T @D bias @π e , where π V T Represents the value parameter matrix V W The corresponding second permutation matrix π V The transpose of .

[0124] The first residual join operation itself does not include the parameter matrix to be permuted, and its two inputs must ensure that the column permutations are consistent.

[0125] The feedforward neural network sublayer in the i-th network layer includes a second normalization layer (such as...). Figure 4 LayerNorm2 shown), the second linear transformation operation (as shown) Figure 4 Linear1 shown), activation function (such as...) Figure 4 The ReLU (Rectified Linear Unit) and the third linear transformation operation (as shown) are illustrated. Figure 4 The Linear2 shown), the second residual join operation Skip Add (as shown) Figure 4 As shown ) and third-level normalization (such as Figure 4 LayerNorm3 (as shown).

[0126] The second-level normalization includes a parameter matrix, which includes the weight matrix L. w2 and bias matrix L bias2 The second permutation matrix corresponding to the second level of normalization is the same as the first permutation matrix and can be represented as π. e The corresponding confusion matrix can be represented as: confusion weight matrix L w2 @π e Confusion bias matrix L bias2 @π e .

[0127] The second linear transformation operation includes a parameter matrix, which includes the weight matrix L. w3 and bias matrix L bias3 The second permutation matrix corresponding to the second linear transformation operation can be expressed as: Its corresponding confusion matrix can be represented as: confusion weight matrix Confusion bias matrix

[0128] The activation function and the second residual join operation themselves do not include the parameter matrix that needs to be permuted, and the two inputs of the second residual join operation need to keep the column permutations consistent.

[0129] The third linear transformation operation includes a parameter matrix, which includes the weight matrix L. w4 and bias matrix L bias4 The second permutation matrix corresponding to the third linear transformation operation can be expressed as: Its corresponding confusion matrix can be represented as: confusion weight matrix Confusion bias matrix

[0130] The third-level normalization includes a parameter matrix, which includes the weight matrix L. w5 and bias matrix L bias5 The second permutation matrix corresponding to the second level of normalization is the same as the first permutation matrix and can be represented as π. e The corresponding confusion matrix can be represented as: confusion weight matrix L w5 @π e Confusion bias matrix L bias5 @π e .

[0131] For example, in the case where the i-th network layer is the last network layer of the target language model, the i-th network layer may also include a dimension mapping sublayer, namely LM_head, which is used to map the dimension of its input to the dimension of the word embedding subtable, which is also equivalent to the dimension of the obfuscated word embedding subtable; the embedding table includes the word embedding subtable.

[0132] As mentioned earlier, when processing the input based on the confusion matrices in the confusion layer, the permutation or confusion approach is as follows: On the one hand, for parameter matrices that need to be multiplied with their inputs, the column permutations of the inputs are first restored, and then the column permutations of the processing result are performed based on the corresponding permutation matrix, such as the second weight matrix and its bias matrix. On the other hand, for parameter matrices that need to be multiplied element-wise with their inputs, their column permutations need to be consistent with the permutations of their inputs, such as the first weight matrix and its bias matrix. This ensures that the permutation of the corresponding output obtained through each confusion matrix is ​​only related to the permutation of that confusion matrix. In other words, the output corresponding to each confusion matrix is ​​only permuted based on the second permutation matrix corresponding to that confusion matrix itself.

[0133] Correspondingly, for this dimension-mapping sublayer, its input is only a column permutation based on the second permutation matrix corresponding to the parameter matrix in the previous sublayer. Considering that the weight matrix in the parameter matrix of this dimension-mapping sublayer is the second weight matrix that needs to be multiplied with its input, the weight matrix in this dimension-mapping sublayer needs to be left-multiplied by the transpose of the second permutation matrix corresponding to the parameter matrix in the previous sublayer in order to recover the column permutation of its input, that is, to recover its input plaintext.

[0134] Subsequently, considering that the purpose of the dimension mapping sublayer, i.e., the LM head, is to map its input dimension to the word dimension of the word embedding subtable, the corresponding word is determined based on the output of the dimension mapping sublayer and the word embedding subtable. The output of this dimension mapping sublayer can include a series of probabilities corresponding to each position predicted by the model, representing the probability that the position corresponds to a word in the word embedding subtable. These positions can refer to various locations within the output sequence predicted by the model.

[0135] Understandably, the size of the parameter matrix of the obfuscated dimension mapping sublayer is still equal to the parameter matrix LM of the unobfuscated dimension mapping sublayer. wThe size of the hidden layer can be represented as (hidden_size, vocab_size). Here, hidden_size is the number of hidden layer dimensions. Assuming the input size of the dimension mapping sub-layer is represented as (seq_length (maximum sequence length), hidden_dim (number of hidden layer dimensions)), the aforementioned hidden_size value is equal to the hidden_dim value. vocab_size represents the word dimension of the obfuscated word embedding sub-table, i.e., its value is equal to the total number of words in the obfuscated word embedding sub-table. For example, if the obfuscated word embedding sub-table includes 30,000 obfuscated word embeddings, then vocab_size can be 30,000. The value of hidden_dim is equal to the number of dimensions (i.e., the vector length of a single obfuscated word embedding) of each word in the obfuscated word embedding sub-table. The size of the output of the dimension mapping sub-layer can be represented as (seq_length, vocab_size). seq_length represents the sequence length of the output sequence corresponding to the model output.

[0136] Understandably, before obfuscation, the order of probabilities at each position in the output of this dimension mapping sublayer—that is, the probabilities of each word in the word embedding subtable at each position—is related to the order of words in the original word embedding subtable; for example, they may be in the same order. For instance, the m-th probability at position p in the output of this dimension mapping sublayer could correspond to the word in the m-th row of the word embedding subtable.

[0137] Because the order of words and their corresponding obfuscated word embeddings in the obfuscated word embedding sub-table changes based on the aforementioned third permutation matrix compared to the words and their obfuscated word embeddings in the word embedding sub-table after column permutation, the second permutation matrix corresponding to the parameter matrix of the obfuscated dimensional mapping sub-layer must guarantee that the obfuscation of the output of the obfuscated dimensional mapping sub-layer matches the obfuscation of the obfuscated word embedding sub-table. That is, the order of the series probabilities corresponding to each position in the output of the obfuscated dimensional mapping sub-layer must still be related to the order of the words (and their obfuscated word embeddings) in the obfuscated word embedding sub-table, for example, the order must be the same.

[0138] Continuing with the previous example, suppose that the word in the m-th row of the word embedding sub-table after column permutation and its obfuscated word embedding are permuted to the o-th row of the obfuscated word embedding sub-table after processing by the third permutation matrix; then the second permutation matrix corresponding to the parameter matrix in the obfuscated dimension mapping sub-layer needs to guarantee that the o-th probability in the series of probabilities corresponding to each position in the output of the obfuscated dimension mapping sub-layer is the m-th probability in the series of probabilities corresponding to each position in the output of the unobfuscated dimension mapping sub-layer.

[0139] By considering the dimensions of the parameter matrix and the output of the aforementioned dimensionality mapping sub-layer, we can determine the row order of the word embedding sub-table (each row represents a word embedding) and its corresponding column order in the output of the dimensionality mapping sub-layer (each column contains the probabilities of each word in the word embedding sub-table). This can be proven as follows:

[0140] Dimension Mapping Sublayer Parameter Matrix LM w The size of the word embedding subtable can be represented as (hidden_size, vocab_size), and the size of the word embedding subtable can be represented as (vocab_size, hidden_size), which is the word embedding subtable W after column permutation. v The size can also be represented as (vocab_size, hidden_size). When focusing only on the size of each element and disregarding the values ​​of its individual elements, the following holds true: LM w =Wv T ;

[0141] And it exists: Where, π w @W v This indicates the use of the third permutation matrix π w Word embedding subtable W after column permutation v Perform row replacement. Represents the transpose of the matrix using the third permutation matrix. The parameter matrix LM of the dimension mapping sublayer w Perform column permutation.

[0142] Given the above, the second weight matrix in this dimensional mapping sublayer is left-multiplied by the transpose of the second permutation matrix corresponding to the parameter matrix in the previous sublayer to recover the column permutations of its input. Then, it needs to be right-multiplied by its own corresponding second permutation matrix. Furthermore, the second permutation matrix corresponding to the second weight matrix (i.e., the parameter matrix) in this dimensional mapping sublayer is related to the third permutation matrix corresponding to the obfuscated word embedding subtable. This third permutation matrix is ​​used to perform row permutations on the word embedding subtable after column permutations. This ensures that the obfuscation of the output of the obfuscated dimensional mapping sublayer matches the row permutation of the obfuscated word embedding subtable. In some examples, where the second obfuscation includes both column and row permutations (i.e., performing row permutations on the column-permutated word embedding subtable based on the aforementioned third permutation matrix), the second permutation matrix corresponding to this dimensional mapping sublayer is the transpose of this third permutation matrix.

[0143] For example, the layer preceding this dimension mapping sublayer can be a feedforward neural network sublayer in the last layer of the network. The parameter matrix in the dimension mapping sublayer can include the second weight matrix LM. w The second permutation matrix corresponding to the dimension mapping sublayer can be represented as π. w T The corresponding confusion matrix can be expressed as: confusion weight matrix π e T @LM w @π w T .

[0144] In some other examples, where the second obfuscation includes column permutations (i.e., only column permutations are performed on the embedded table), the second permutation matrix corresponding to this dimension mapping sublayer can be an identity matrix. Correspondingly, the obfuscation matrix corresponding to this dimension mapping sublayer can be represented as: obfuscation weight matrix π. e T @LM w In some other examples, to better protect the privacy of the first-party model parameters and text, the confusion matrix corresponding to this dimension mapping sublayer can also be represented as: confusion weight matrix π e T @LM w @π x To perform row permutation on the output of the dimension mapping sublayer, where π x It can be the output permutation matrix set by the first party A.

[0145] Next, the second party B sends the row permutation output of the dimensional mapping sublayer back to the first party A. The first party can decrypt the row permutation output of the dimensional mapping sublayer based on the decryption matrix corresponding to the output permutation matrix, obtaining the row permutation-restored output of the dimensional mapping sublayer. This ensures that the row order of a series of probabilities at each position in the row permutation-restored output of the dimensional mapping sublayer is consistent with the row order of each word in the word embedding table and its corresponding confusion word embedding in the column permutation-restored embedding table. Then, the first party A can determine the generated word at each position based on the words in the word embedding table and their corresponding confusion word embeddings, and the row permutation-restored output of the dimensional mapping sublayer. Based on the difference between the generated word at each position and the corresponding label word in the label, the first party A determines the model loss and sends the model loss to the second party B. The second party B adjusts the multi-layer confusion layer to minimize the model loss.

[0146] First Party A can obtain multiple obfuscation layers and an obfuscation embedding table using the above method. Then, with the data (text) used for fine-tuning the target language model, in step S320, First Party A determines training samples based on the text and the obfuscation embedding table. The training samples include target obfuscated word embedding sequences and their corresponding labels.

[0147] The obfuscation embedding table can include obfuscation word embedding sub-table, obfuscation position embedding sub-table, and obfuscation tag type embedding sub-table. Based on these three and each word segment in the text, the corresponding target obfuscation word embedding sequence and its corresponding label can be obtained, and the training samples can be remembered.

[0148] For example, the specific form of the text is related to the services provided by the target language model. In some possible examples, the target language model can be a generative model. Accordingly, the text can include a first text, and the target obfuscation word embedding sequence can be directly determined based on the first text and the obfuscation embedding table. Furthermore, the target obfuscation word embedding sequence is used as the label corresponding to the target obfuscation word embedding sequence to obtain training samples. In this example, the first text can be any type of text, such as, but not limited to, news articles, scientific articles, or medical articles. The type of the first text is related to the specific needs of the first party A.

[0149] In some other possible examples, the target language model can be a seq2seq model. In this case, the aforementioned text includes the input text and its corresponding target text. Accordingly, the target obfuscation word embedding sequence corresponding to the input text and the label corresponding to the target text can be determined separately based on the obfuscation embedding table. When first party A needs to fine-tune the target language model to build a question-answering system, the input text can be a question, and its corresponding target text can be the answer to that question. When first party A needs to fine-tune the target language model to build a translation system, the input text can be the text to be translated, and its corresponding target text can be the translation of that text.

[0150] After receiving the training samples, in step S330, Party A sends the aforementioned training samples and multi-layer obfuscation layer to Party B. Correspondingly, in step S340, Party B obtains the training samples and multi-layer obfuscation layer.

[0151] Party A can send the aforementioned training samples and multi-layer obfuscation layer to Party B via network or other data transmission methods. Party B then obtains the training samples and multi-layer obfuscation layer, deploys the multi-layer obfuscation layer, and fine-tunes the multi-layer obfuscation layer based on the training samples.

[0152] Specifically, in step S350, the second party B obtains the first output result based on the target obfuscated word embedding sequence through multiple obfuscation layers. In this step, the second party B inputs the target obfuscated word embedding sequence into multiple obfuscation layers to process the target obfuscated word embedding sequence through multiple obfuscation layers and obtain the first output result.

[0153] When the target language model is a generative model, the first output result can include at least the probabilities of each word in the obfuscated word embedding sub-table at each position corresponding to one or more words in the target obfuscated word embedding sequence. Then, for each position, the word corresponding to the highest probability at that position can be used as the generated word at that position p.

[0154] When the target language model is a seq2seq model, the first output result can include the probability of each word in the confusion word embedding sub-table at each position in the output sequence predicted by the multi-layer confusion layer. Then, for each position, the word corresponding to the highest probability at that position can be used as the generated word at that position p.

[0155] Next, in step S360, the second party B adjusts the multi-layer obfuscation layer based on the difference between the first output result and the label.

[0156] In this step, since the second party B has not obtained the obfuscation embedding table, it cannot determine the corresponding generated word at the corresponding position based on the first output result. At this time, the second party B will send the first output result it obtained to the first party A. The first party A determines the obfuscation word embedding corresponding to the generated word at the corresponding position based on the first output result and the obfuscation word embedding sub-table. Then, it sends the obfuscation word embedding corresponding to the generated word at the corresponding position that it has determined to the second party B.

[0157] Next, when the target language model is a generative model, the obfuscated word embeddings corresponding to the generated words at the corresponding positions obtained from the first party A are the obfuscated word embeddings corresponding to the generated words at the positions corresponding to one or more occluded words. At this time, the second party B can determine the model loss based on the difference between the obfuscated word embeddings corresponding to the generated words at the positions corresponding to one or more occluded words and the obfuscated word embeddings at the positions corresponding to one or more occluded words in the label, i.e., the target obfuscated word embedding sub-table. With the goal of minimizing the model loss, the parameters of the multi-layer obfuscation layer are adjusted.

[0158] The following example demonstrates that the confusion matrices in a multi-layer confusion layer can still maintain the correspondence between the parameter matrices in the original network layers. In other words, it proves that the difference between the output result obtained from processing text based on multi-layer confusion layers and confusion embedding tables and its label is equivalent to the difference between the output result obtained from processing text based on multi-layer network layers and embedding tables and its label, and the effect of fine-tuning multi-layer network layers.

[0159] Taking the derivative of matrix multiplication as an example, in the case of processing text based on the original embedding table and multiple network layers, assuming that the model input X is obtained based on the text and the original embedding table, the plaintext representation of the output result obtained based on the original multi-layer network layer and the model input X is D, where D = XW. all Among them, W all This represents the set of parameters for each layer of a multi-layered network, i.e., all its parameter matrices. Assuming the model loss is represented in plaintext as L, the derivative formula, i.e., the gradient formula, can be expressed as follows:

[0160]

[0161] Based on the above permutation idea, it can be seen that the permutations (column permutations) between the intermediate parameter matrices in the parameter matrix of the multi-layer permutation layer have been mutually eliminated. Correspondingly, the overall permutation method of the permutation matrix of the multi-layer permutation layer is related to the second permutation method corresponding to the embedded table, such as being related to the aforementioned first and third permutation matrices. Accordingly, continuing the above example, the overall permutation result of the permutation matrix of the multi-layer permutation layer can be represented as: in, The parameter set represents the parameters of the multi-layer confusion layer, which is the overall confusion matrix.

[0162] Furthermore, based on the aforementioned permutation concept, it can be understood that the obfuscation method of the output obtained from text processing based on multi-layer obfuscation layers and obfuscated embedding tables is only related to the second permutation matrix corresponding to the last obfuscation matrix of the last layer in that multi-layer obfuscation layer. In other words, the output obtained from text processing based on multi-layer obfuscation layers and obfuscated embedding tables, compared to the plaintext output obtained from text processing based on multi-layer network layers and embedding tables, is only permuted based on the second permutation matrix corresponding to the last obfuscation matrix of the last layer in that multi-layer obfuscation layer. Continuing the above example, the output D' obtained from the obfuscated model input X' based on multi-layer obfuscation layers can be expressed as D'=D@π w T .

[0163] Understandably, performing row permutations on the word embedding subtable after column permutations does not affect the correspondence between words and their corresponding obfuscated word embeddings. Accordingly, the obfuscated model input X′ obtained based on the text and the obfuscated embedding table can be expressed as X′=X@π e Assuming the model loss (confusion) is denoted as L′, its derivative, i.e., its gradient formula, can be expressed as follows when processing text based on a confusion embedding table and multiple confusion layers:

[0164]

[0165] From the derivative formulas in the two cases above, we can see that the gradient obtained when processing text based on obfuscated embedding tables and multi-layer obfuscation layers is... The obfuscation situation and the parameters of multiple obfuscation layers. The confusion is consistent, i.e., gradient. And the parameter W of the multi-layer confusion layer a '' ll The same permutation was performed. When updating the parameters of the multi-layer confusion layer, the update method is to add the gradient to the corresponding positions of the multi-layer confusion layer's parameters. Therefore, it can be understood that the parameters updated by the multi-layer confusion layer, relative to the parameters updated by the original multi-layer network layers, have undergone corresponding permutations, i.e., confusion. Therefore, it is only necessary to ensure that the plaintext model loss L and the model loss (confusion) L′ are consistent, or identical.

[0166] For the target language model, its output is the probability of each word appearing in the word embedding sub-table (or confusion word embedding sub-table) at each predicted position; then, for each position, the word with the highest probability value at that position is found from the corresponding word embedding sub-table (or confusion word embedding sub-table) and used as the generated word for that position.

[0167] Based on the aforementioned example, when obfuscating the multi-layer network and embedding table, the obfuscation of the output of the multi-layer obfuscation layer was maintained, consistent with the obfuscation of the obfuscated word embedding sub-table. Therefore, it can be considered that in the case of processing text based on obfuscated embedding tables and multi-layer obfuscation layers, compared to the case of processing text based on embedding tables and multi-layer network layers, the two processes only change one word embedding sub-table. The correspondence between each word in the word embedding sub-table and its corresponding word embedding remains unchanged in both processes; only the row where each word in the word embedding sub-table and its corresponding word embedding are located changes. This does not affect the result of finding the corresponding generated word based on the probability of each word in the word embedding sub-table (or obfuscated word embedding sub-table) appearing at each position in the model output. The difference is that a generated word YY is in row A in the word embedding sub-table, while in the obfuscated word embedding sub-table, the generated word YY is in row B. Therefore, the model loss (obfuscation) L′ obtained from the output result and its label obtained based on multi-layer obfuscation layers and obfuscated embedding tables is the same as the plaintext model loss L obtained from the difference between the output result and its label obtained based on multi-layer network layers and embedding tables.

[0168] Correspondingly, the effect of fine-tuning the multi-layer obfuscation layer is equivalent to the effect of fine-tuning the multi-layer network layer when the output of the text processed based on the multi-layer obfuscation layer and the obfuscated embedding table differs from that of fine-tuning the multi-layer network layer when the output of the text processed based on the multi-layer network layer and the embedding table differs from that of fine-tuning the multi-layer network layer.

[0169] The above process enables multi-party joint fine-tuning of the target language model while protecting model parameters and text privacy.

[0170] The above process describes only the fine-tuning of a target language model using a single text. In some examples, multiple texts can be used, and the target language model can be iterated multiple times based on the aforementioned multi-party joint fine-tuning process until the target language model reaches a preset convergence condition, at which point the fine-tuning of the target language model is considered complete. This preset convergence condition may include, but is not limited to, the number of iterations exceeding a specified number, the fine-tuning time exceeding a specified time, or the aforementioned model loss falling below a specified threshold.

[0171] After fine-tuning the target language model, the second party B can deploy the fine-tuned target language model to provide data inference services for the first party A. The specific data inference process is similar to the process of fine-tuning the target language model, and will not be elaborated here.

[0172] Figure 5A flowchart of a method for multi-party joint fine-tuning of a language model based on data protection, according to another embodiment of this specification, is shown. The aforementioned multi-party group includes a first party A, a second party B, and a third party C. The first party A holds a target language model, which includes an embedding table and a serially configured multi-layer network layer. The embedding table includes a word embedding sub-table. The second party B provides computing power, and the third party C holds text used for fine-tuning the target language model.

[0173] In some possible examples, the target language model is a network model based on a Transformer architecture. Multiple network layers can be referred to as Transformer layers. The network structures within these multiple layers are similar. For example, the target language model could be a BERT (Bidirectional Encoder Representations from Transformers) model or an improved version thereof, or a GPT (Generative Pre-trained Transformer) model or an improved version thereof, etc.

[0174] like Figure 5 As shown, the method for multi-party joint fine-tuning of the language model based on data protection includes the following steps S510-S580:

[0175] In step S510, the first party A determines the first mapping relationship and the second mapping relationship corresponding to the multi-layer obfuscation layer, the obfuscation embedding table, and the obfuscated word embedding sub-table. Specifically, a single obfuscation layer is obtained by performing a first obfuscation on the parameter matrix in the corresponding network layer; the obfuscation embedding table is obtained by performing a second obfuscation on the embedding table, the second obfuscation including column permutations, and the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method; the obfuscated word embedding sub-table is obtained by performing row permutations on the word embedding sub-table after column permutations; the first mapping relationship is the mapping relationship between each word in the obfuscated word embedding sub-table and its position identifier in the obfuscated word embedding sub-table; and the second mapping relationship is the mapping relationship between the obfuscated word embedding of each word in the obfuscated word embedding sub-table and the position identifier of each word.

[0176] The process by which the first party A determines the implementation of the multi-layer obfuscation layer and the obfuscation embedding table can be found in the foregoing embodiments, and will not be repeated here.

[0177] After obtaining the obfuscation embedding table, an obfuscation word embedding sub-table is determined from it. Based on each word in the obfuscation word embedding sub-table and its position within the sub-table, a first mapping relationship and a second mapping relationship are determined. The first mapping relationship is the mapping between each word in the obfuscation word embedding sub-table and its position identifier within the sub-table, which can be represented as word->id. The second mapping relationship is the mapping between the obfuscation word embedding of each word in the obfuscation word embedding sub-table and the position identifier of each word, which can be represented as id->embedding.

[0178] Next, in step S520, the first party A sends the multi-layer obfuscation layer and the second mapping relationship to the second party B. In step S530, the first party A sends the first mapping relationship to the third party C.

[0179] In some possible examples, the embedded table may also include a positional embedded sub-table and a type embedded sub-table; the first party A further determines and sends the obfuscated positional embedded sub-table and obfuscated type embedded sub-table to the second party B, which are obtained by performing column permutations on the positional embedded sub-table and the type embedded sub-table. Correspondingly, the second party B also obtains the obfuscated positional embedded sub-table and the obfuscated type embedded sub-table.

[0180] In step S540, the third party C determines the position identifiers corresponding to each word segment in the text it holds based on the first mapping relationship, so as to obtain the target position identifier sequence.

[0181] For example, the specific form of the text is related to the services provided by the target language model. In some possible examples, the target language model can be a generative model, i.e., the target language model needs to provide text generation services. Accordingly, the text may include a first text, in which case the position identifiers corresponding to each word in the first text can be determined directly based on the first mapping relationship to obtain the target position identifier sequence. Specifically, a third party C processes the first text it holds, obtains each word, matches each word with the words in the first mapping relationship, and determines the position identifiers corresponding to each word from the first mapping relationship based on the matching results; based on the order of each word in the text, the position identifiers corresponding to each word are combined to form the target position identifier sequence.

[0182] In this example, the first text can be of any type, such as, but not limited to, news articles, science and technology articles, or medical articles. The type of the first text is related to the specific needs of the first party A.

[0183] In some other possible examples, the target language model can be a seq2seq model. In this case, the aforementioned text includes the input text and its corresponding target text. Accordingly, based on the first mapping relationship and the input text, the position identifiers corresponding to each segment of the input text can be determined to obtain the first position identifier sequence; and based on the first mapping relationship and the target text, the position identifiers corresponding to each segment of the target text can be determined to obtain the second position identifier sequence. Both the first position identifier sequence and the second position identifier sequence are then included in the target position identifier sequence.

[0184] In some examples, when first party A needs to fine-tune the target language model to build a question-answering system, the input text can be a question, and the corresponding target text can be the answer to that question. When first party A needs to fine-tune the target language model to build a translation system, the input text can be the text to be translated, and the corresponding target text can be the translated version of that text.

[0185] Next, in step S550, third party C sends the target location identifier sequence to second party B. Accordingly, second party B obtains the target location identifier sequence sent by third party C. Then, in step S560, second party B determines training samples based on the obtained target location identifier sequence and the second mapping relationship.

[0186] In some possible implementations, when the target language model provides text generation services, the target location identifier sequence is the location identifier sequence corresponding to the aforementioned first text. Accordingly, the second party B determines the obfuscated word embedding corresponding to each location identifier in the target location identifier sequence based on each location identifier in the target location identifier sequence and the mapping relationship between each location identifier and the obfuscated word embedding in the second mapping relationship, so as to obtain the target obfuscated word embedding sequence, and uses the target obfuscated word embedding sequence as its corresponding label to obtain training samples.

[0187] In some possible implementations, when the target language model is a seq2seq model, the target position identifiers include the first position identifier sequence corresponding to the input text and the second position identifier sequence corresponding to the target text. Subsequently, the second party B can determine the obfuscation word embeddings corresponding to each position identifier in the first position identifier sequence based on each position identifier in the first position identifier sequence and the mapping relationship between each position identifier and the obfuscation word embedding in the second mapping relationship, so as to obtain the target obfuscation word embedding sequence.

[0188] In one scenario, the second position identifier sequence can be directly used as the target obfuscated word embedding sequence as its corresponding label to obtain training samples. In another scenario, based on each position identifier in the second position identifier sequence and the mapping relationship between each position identifier and the obfuscated word embedding in the second mapping relationship, the obfuscated word embedding corresponding to each position identifier in the second position identifier sequence can be determined to obtain the label corresponding to the target obfuscated word embedding sequence. In this case, the label is the obfuscated word embedding sequence corresponding to the aforementioned target text, thus obtaining training samples.

[0189] In some possible examples, the second party B also obtains the aforementioned obfuscated location embedding sub-table and obfuscated type embedding sub-table from the first party A. The second party B can determine the training samples based on the obfuscated location embedding sub-table and obfuscated type embedding sub-table, the target location identifier sequence, and the second mapping relationship.

[0190] Next, in step S570, the second party B obtains the first output result based on the target obfuscated word embedding sequence through multiple obfuscation layers. The implementation principle of step S570 is similar to that of step S350 mentioned above, and its implementation process can be found in the implementation process of step S350 mentioned above.

[0191] Then, in step S580, the second party B adjusts the multi-layer obfuscation layer based on the difference between the first output result and the label.

[0192] In this step, the first output result may include a series of probabilities corresponding to each position, wherein the series of probabilities corresponding to each position represents the probability that the position is a word in the confusion word embedding sub-table, and the order of the series of probabilities corresponding to a single position corresponds to the order of the words in the confusion word embedding sub-table.

[0193] For each position, the position identifier and / or obfuscation word embedding of the generated word corresponding to that position are determined from the second mapping relationship based on the highest probability among its corresponding series of probabilities. Then, the model loss is determined based on the difference between the position identifier and / or obfuscation word embedding of the generated word corresponding to each position and the label. The multi-layer obfuscation layer is adjusted with the goal of minimizing the model loss.

[0194] In some specific examples, the label can be the target location identifier sequence of the aforementioned first text. Correspondingly, the second party B can obtain the first predicted location identifier sequence predicted by the model based on the first output and its acquired second mapping relationship. Then, based on the difference between the target location identifier sequence and the first predicted location identifier sequence, the multi-layer confusion layers are adjusted. Alternatively, the label can be the target confusion word embedding sequence of the aforementioned first text. Correspondingly, the second party B can obtain the generated word embedding sequence predicted by the model based on the first output and its acquired second mapping relationship. Then, based on the difference between the target confusion word embedding sequence and the generated word embedding sequence, the multi-layer confusion layers are adjusted.

[0195] In some specific examples, the label can be the aforementioned second position identifier sequence. Accordingly, the second party B can obtain the second predicted position identifier sequence predicted by the model based on the first output result and its obtained second mapping relationship. Then, based on the difference between the second position identifier sequence and the second predicted position identifier sequence, the multi-layer confusion layer is adjusted.

[0196] In some specific examples, the label can be the label confusion word embedding sequence determined based on the aforementioned second position identifier sequence and second mapping relationship. Accordingly, the second party B can obtain the predicted confusion word embedding sequence predicted by the model based on the first output result and its obtained second mapping relationship. Then, based on the difference between the label confusion word embedding sequence and the predicted confusion word embedding sequence, the multi-layer confusion layer is adjusted.

[0197] In the above process, the obfuscated word embedding sub-table after the second obfuscation is split into a first mapping relationship and a second mapping relationship. The first mapping relationship is sent to the third party C, so that the third party C can only obtain each word and its position identifier in the obfuscated word embedding sub-table, but cannot obtain the obfuscated word embedding corresponding to the word. This can better protect the privacy of the model parameters of the first party A, and does not affect the model fine-tuning process. The second mapping relationship is sent to the second party B, so that the second party B can only obtain the obfuscated word embedding corresponding to each word and its position identifier in the obfuscated word embedding sub-table, but cannot obtain the specific word plaintext. This can protect the privacy of the model parameters of the first party A, and also protect the privacy of the text of the third party C, without affecting the model fine-tuning process.

[0198] In the embodiments described in this specification, the security of the target language model is guaranteed after obfuscation, making it difficult to be maliciously cracked. Taking a target language model with a dimension of 768 as an example, if brute-force search is used to crack it, 768! cracking operations are required for the parameter matrix of a non-multi-head target language model (i.e., the network sub-layer based on the self-attention mechanism includes one self-attention head), while 64!^12 cracking operations are required for a multi-head target language model.

[0199] Additionally, it should be noted that for non-linear layers in the target language model, since non-linear operations are often performed on a single row of its input, the parameter matrix is ​​obfuscated through column permutation, and after column permutation of the embedding table, row permutation of the word embedding sub-table is performed. The setting of the second permutation matrix corresponding to the last parameter matrix of the last network layer will not affect the calculation results.

[0200] Model obfuscation through permutation is computationally inexpensive, has no impact on model performance or size, and only increases the communication cost of transmitting the decryption matrix and the computational cost of generating the permutation matrix and permuting the parameters. It is very user-friendly and versatile.

[0201] After fine-tuning the target language model using the above method, the second party B can directly deploy the multi-layer obfuscation layer of the fine-tuned target language model to provide data inference services to the third party C. During the inference process, the third party C can obtain the position identifier sequence corresponding to the text to be inferred based on its acquired first mapping relationship; and send the position identifier sequence to the second party B; the second party B, based on the position identifier sequence and its acquired second mapping relationship, determines the obfuscated word embedding sequence corresponding to the text to be inferred; and inputs the obfuscated word embedding sequence into the multi-layer obfuscation layer to process the obfuscated word embedding sequence and obtain the inference result; then, based on a series of probabilities and the second mapping relationship corresponding to each position in the inference result, the second party B determines the position identifier corresponding to the generated word at each position in the inference result; subsequently, the second party B sends the position identifier corresponding to the generated word at each position in the inference result to the third party C; the third party C, based on the position identifier corresponding to the generated word at each position in the inference result and its held first mapping relationship, obtains the output sequence corresponding to the inference result, thus obtaining the output sequence corresponding to the text to be inferred. This enables multi-party collaborative data processing while protecting model parameters and third-party data privacy.

[0202] Corresponding to the above method embodiments, Figure 6 A flowchart illustrating a method for multi-party joint fine-tuning of a language model based on data protection, according to another embodiment of this specification, is shown. The aforementioned multi-party components include a first party A, a second party B, and a third party C. The first party A holds the target language model, which includes an embedding table and serially configured multi-layer network layers. The embedding table includes a word embedding sub-table. The second party B provides computing power, and the third party C holds text used for fine-tuning the target language model. Figure 6 As shown, the method may include the following steps S610-S670:

[0203] In step S610, the first party A determines a multi-layer obfuscation layer and an obfuscation embedding table. A single obfuscation layer is obtained by performing a first obfuscation on the parameter matrix of the corresponding network layer. The obfuscation embedding table is obtained by performing a second obfuscation on the embedding table. The second obfuscation includes column permutations, and the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method.

[0204] In step S620, the first party A sends the multi-layer obfuscation layer to the second party B. In step S630, the first party A sends the obfuscation embedding table to the third party C. In step S640, the third party C determines training samples based on the obfuscation embedding table and the text it holds, wherein the training samples include the target obfuscated word embedding sequence and its corresponding labels. In step S650, the third party C sends the training samples to the second party B. In step S660, the second party B, based on the target obfuscated word embedding sequence, obtains a first output result through the multi-layer obfuscation layer.

[0205] The implementation principle of steps S610-S660 is similar to that of steps S310-S350 mentioned above. The implementation process can be found in the implementation process of steps S310-S350 mentioned above, and will not be repeated here.

[0206] In step S670, the second party B adjusts the multi-layer obfuscation layer based on the difference between the first output result and the label. Specifically, in step S670, the second party B can send the first output result to the third party C. The third party C, based on a series of probabilities corresponding to each position in the first output result, determines the obfuscated word embeddings of the generated words corresponding to each position in the first output result from the obfuscation embedding table, obtains the inferred obfuscated word embedding sequence, and feeds it back to the second party B. The second party B then jointly infers the difference between the obfuscated word embedding sequence and the label to adjust the multi-layer obfuscation layer. The process by which the second party B jointly infers the difference between the obfuscated word embedding sequence and the label to adjust the multi-layer obfuscation layer can be referred to in the aforementioned step S360 for the process of adjusting the multi-layer obfuscation layer, and will not be elaborated here.

[0207] In the above process, the first party determines multiple obfuscation layers and obfuscated embedding tables to obfuscate the parameters of the target language model, thereby preventing its network layer parameters and embedding tables from being exposed to other parties. The first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method of the obfuscated embedding table, ensuring that the two can still be correctly calculated after obfuscation. The multiple obfuscation layers are sent to the second party, which can prevent the model parameters from being exposed at the second party while using the computing power service provided by the second party. The obfuscated embedding table is sent to the third party, which can prevent the true embedding of each word in the obfuscated embedding table from being exposed at the third party. Next, the third party determines training samples, including the target obfuscated word embedding sequence and its corresponding labels, based on the obfuscated embedding table and text it has obtained, and sends them to the second party. This protects the privacy and security of the text, ensuring that the plaintext is not exposed to the second party. After the second party obtains the training samples, it obtains the first output result through multiple obfuscation layers based on the target obfuscated word embedding sequence. Since the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method, including column permutation, in the obfuscation embedding table, the mutual cooperation of the obfuscation methods of the parameter matrix in each network layer makes the obfuscation situation of the output of the multiple obfuscation layers match the obfuscation situation of the labels determined based on the obfuscation embedding table. Based on the difference between the first output result and the labels, the multi-level obfuscation layers of the target language model can be adjusted to achieve joint fine-tuning of the language model by multiple parties while protecting model parameters and data privacy.

[0208] After fine-tuning the target language model using the methods described above, the second party B can directly deploy the multi-layer obfuscation layer of the fine-tuned target language model to provide inference services to the third party C. The process of providing inference services to the third party C can be seen in the previous example of the multi-party joint fine-tuning of the target language model, and will not be elaborated upon here.

[0209] Corresponding to the above method embodiments, Figure 7 A flowchart of a method for multi-party joint fine-tuning of a language model based on data protection, according to another embodiment of this specification, is shown. The multi-party method includes a first party and a second party. The first party holds a target language model, which includes an embedding table and a serially configured multi-layer network. The second party provides computing power, and the method is implemented in the second party, as follows: Figure 7 As shown, the method for multi-party joint fine-tuning of a language model based on data protection may include steps S710-S740:

[0210] In step S710, a multi-layer obfuscation layer is obtained from the first party, wherein the multi-layer obfuscation layer is obtained by the first party performing a first obfuscation on the parameter matrix in the corresponding network layer, and the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method performed by the embedding table.

[0211] In step S720, a training sample is obtained, which includes a target obfuscated word embedding sequence and its corresponding label. The target obfuscated word embedding sequence and the label are determined based on the text and the obfuscated embedding table. The obfuscated embedding table is obtained by performing the second obfuscation on the embedding table. The second obfuscation includes column permutation.

[0212] In step S730, based on the target obfuscated word embedding sequence, the first output result is obtained through multiple obfuscation layers;

[0213] In step S740, the multi-layer obfuscation layer is adjusted based on the difference between the first output result and the label.

[0214] The foregoing description describes specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than those shown in the embodiments, and the desired result may still be achieved. Furthermore, the processes depicted in the drawings do not necessarily need to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0215] Corresponding to the above method embodiments, this specification provides an apparatus 800 for multi-party joint fine-tuning of a language model based on data protection. The multi-party includes a first party and a second party. The first party holds a target language model, which includes an embedding table and a serially configured multi-layer network layer. The second party provides computing power. The apparatus is deployed on the second party, as shown in the schematic block diagram below. Figure 8 As shown, it includes: a first acquisition module 810, configured to acquire a multi-layer obfuscation layer from the first party, wherein the multi-layer obfuscation layer is obtained by the first party performing a first obfuscation on the parameter matrix in the corresponding network layer, and the first obfuscation method of the parameter matrix in each network layer corresponds to the second obfuscation method performed by the embedding table; a second acquisition module 820, configured to acquire training samples, the training samples including target obfuscated word embedding sequences and their corresponding labels, the target obfuscated word embedding sequences and the labels being determined based on text and an obfuscated embedding table, the obfuscated embedding table being obtained by performing a second obfuscation on the embedding table, the second obfuscation including column permutation; an output module 830, configured to obtain a first output result based on the target obfuscated word embedding sequence through the multi-layer obfuscation layer; and an adjustment module 840, configured to adjust the multi-layer obfuscation layer based on the difference between the first output result and the labels.

[0216] The above-described apparatus embodiments correspond to the method embodiments, and detailed descriptions can be found in the description of the method embodiments section, which will not be repeated here. The apparatus embodiments are derived based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments; detailed descriptions can be found in the corresponding method embodiments.

[0217] This specification also provides a computer-readable storage medium storing a computer program that, when executed in a computer, causes the computer to perform the method for multi-party joint fine-tuning of a data protection-based language model provided in this specification.

[0218] This specification also provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method for multi-party joint fine-tuning of a language model based on data protection provided in this specification.

[0219] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0220] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0221] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0222] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0223] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0224] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0225] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0226] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0227] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0228] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0229] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0230] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0231] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0232] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0233] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method of federated fine-tuning of a language model by multiple parties based on data protection, wherein, The multiple parties include a first party and a second party, the first party holds a target language model, the target language model includes an embedding table and a plurality of serially arranged network layers, and the second party is configured to provide computing power, including: The first party determines a plurality of layers of confusion layers and a confusion embedding table, and at least sends the plurality of layers of confusion layers to the second party; wherein a single confusion layer is obtained by performing first confusion on a parameter matrix in a corresponding network layer, and the confusion embedding table is obtained by performing second confusion on the embedding table, and the second confusion includes column permutation, and the first confusion manner of the parameter matrix in each network layer corresponds to the second confusion manner; The second party obtains training samples, the training samples include a target confusion word embedding sequence and a corresponding label; based on the target confusion word embedding sequence, a first output result is obtained through the plurality of layers of confusion layers; and based on the difference between the first output result and the label, the plurality of layers of confusion layers are adjusted, wherein the target confusion word embedding sequence and the label are determined based on a text and the confusion embedding table.

2. The method of claim 1, the multiple parties further include a third party holding the text, and the embedding table includes a word embedding sub-table; The first party also determines a first mapping relationship and a second mapping relationship corresponding to the obfuscated word embedding sub-table, and sends the first mapping relationship to the third party. The second mapping relationship is sent to the second party; wherein the confusion word embedding sub-table is obtained by performing row permutation on the word embedding sub-table after the column permutation; the first mapping relationship is a mapping relationship between each word in the confusion word embedding sub-table and a position identifier of each word in the confusion word embedding sub-table, and the second mapping relationship is a mapping relationship between a confusion word embedding of each word in the confusion word embedding sub-table and the position identifier of each word; The third party determines the position identifier corresponding to each word in the text based on the first mapping relationship to obtain a target position identifier sequence, and sends the target position identifier sequence to the second party; The second party obtains training samples, including: The second party determines the training samples based on the target position identifier sequence and the second mapping relationship.

3. The method of claim 1, wherein, The multiple parties further include a third party holding the text; The third party obtains the confusion embedding table from the first party, and determines the training samples based on the text and the confusion embedding table; And sends the training samples to the second party.

4. The method of claim 1, wherein, The target language model is a generative model, the text includes a first text, and the label is the target confusion word embedding sequence itself; or the target language model is a seq2seq model, the text includes an input text and a corresponding target text, and the label is determined based on the target text and the confusion embedding table; and the target confusion word embedding sequence is determined based on the input text and the confusion embedding table.

5. The method of any one of claims 1-4, wherein, The determination of the plurality of layers of confusion layers and the confusion embedding table includes: The first party generates a first permutation matrix corresponding to the embedding table, and a plurality of second permutation matrices corresponding to a plurality of parameter matrices in each network layer; At least right multiplies the embedding table by the first permutation matrix to obtain a confusion embedding table; The parameter matrix in each network layer is processed by at least a second permutation matrix corresponding to the parameter matrix to obtain a confusion matrix corresponding to the parameter matrix, so as to obtain the multi-layer confusion layer.

6. The method of claim 5, wherein, The parameter matrix includes a first weight matrix which needs to perform element multiplication with an input thereof; The confusion matrix corresponding to the parameter matrix is obtained by: The first weight matrix is right multiplied by a second permutation matrix corresponding to the first weight matrix to obtain a confusion matrix corresponding to the first weight matrix, wherein the second permutation matrix corresponding to the first weight matrix is such that the confusion of the confusion matrix corresponding to the first weight matrix is consistent with the confusion of the input thereof.

7. The method of claim 5, wherein, The parameter matrix includes a second weight matrix which needs to perform matrix multiplication with an input thereof; The confusion matrix corresponding to the parameter matrix is obtained by: The second weight matrix is left multiplied by a transpose of a second permutation matrix corresponding to a previous weight matrix of the second weight matrix and right multiplied by a second permutation matrix corresponding to the second weight matrix to obtain a confusion matrix corresponding to the second weight matrix.

8. The method of claim 5, wherein, The last network layer further includes a dimension mapping sub-layer, the dimension mapping sub-layer is configured to map a dimension of an input thereof to a word dimension of a word embedding sub-table; the embedding table includes a word embedding sub-table; The second permutation matrix corresponding to the dimension mapping sub-layer is a transpose of a third permutation matrix corresponding to a confused word embedding sub-table, wherein the confused word embedding sub-table is obtained by performing row permutation on the word embedding sub-table after column permutation, and the third permutation matrix is configured to perform row permutation on the word embedding sub-table after column permutation.

9. A method of fine-tuning a multi-party joint language model based on data protection, wherein, The plurality of parties includes a first party and a second party, the first party holds a target language model, the target language model includes an embedding table and a plurality of network layers arranged in series, and the second party is configured to provide computing power, and the method is implemented in the second party and includes: obtaining a multi-layer confusion layer from the first party, wherein the multi-layer confusion layer is obtained by the first party performing first confusion on parameter matrices in corresponding network layers, and a first confusion manner of the parameter matrices in each network layer corresponds to a second confusion manner performed on the embedding table; obtaining a training sample, the training sample includes a target confused word embedding sequence and a corresponding label, the target confused word embedding sequence and the label are determined based on a text and a confused embedding table, the confused embedding table is obtained by performing the second confusion on the embedding table, and the second confusion includes column permutation; obtaining a first output result by the multi-layer confusion layer based on the target confused word embedding sequence; adjusting the multi-layer confusion layer based on a difference between the first output result and the label.

10. A computing device comprising a memory and a processor, the memory storing executable code, and the processor executes the executable code to implement the method of claim 9.

Images