A privacy protection large model fine-tuning method and system based on differential privacy

Abstract

The application provides a privacy protection large model fine-tuning method and system based on differential privacy, comprising: obtaining user sensitive data to construct a fine-tuning data set and a verification set; performing low-rank decomposition on a target parameter matrix, inputting the fine-tuning data set into a large model, calculating the gradient of the large model on the low-rank parameter matrix and performing sparse processing; adding differential privacy noise after cutting the sparse gradient according to a gradient clipping threshold; based on the gradient with noise and the differential privacy parameter, correcting the variance estimated by the Adam optimizer, calculating the parameter step according to the corrected variance, and updating the target parameter; using the verification set to evaluate the optimization before and after the model is updated, and dynamically adjusting the gradient clipping threshold. The application can ensure that the large model fine-tuned has high utility while ensuring the strength of privacy protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy protection and machine learning, and in particular to a privacy protection large model fine-tuning method and system based on differential privacy. BACKGROUND

[0002] With the explosive growth of data volume and the significant improvement of computing power, large model technology represented by ChatGPT has developed rapidly and gradually integrated with government affairs, medical care, finance and other fields, promoting the intelligent and digital transformation of various industries. Currently, large model technology follows the new training paradigm of "base model pre-training-specific task fine-tuning", and using a small amount of task-related data, a pre-trained large model can be fine-tuned to quickly adapt to new application scenarios. For example, in the medical field, by fine-tuning the large model, an intelligent diagnosis system can be built to help doctors analyze medical images more efficiently; in the education field, the fine-tuned model can provide personalized learning suggestions for students to improve learning efficiency. Therefore, large models and fine-tuning technology have become the core direction of artificial intelligence research.

[0003] However, there is a significant risk of privacy leakage in the process of large model fine-tuning. Large model fine-tuning often requires the use of sensitive data in specific domains or users, such as personal information, behavior habits, health records, and other private content. During the training process, the large model may memorize these sensitive data, thereby causing serious privacy leakage problems. Through attacks on the large model, potential attackers can infer sensitive information about users and even reconstruct the original data. For example, in the medical field, attackers may obtain patients' disease information; in the financial field, users' transaction records and consumption preferences may be leaked. These privacy leaks not only lead to the loss of user trust, but also may cause legal and compliance problems. Therefore, how to effectively protect personal privacy in the process of large model fine-tuning has become an urgent problem to be solved.

[0004] Differential privacy technology provides support for privacy protection of large model fine-tuning. Unlike privacy protection technologies based on partitioning, such as k-anonymity and l-diversity, differential privacy provides a strict and quantifiable privacy protection method for individual sensitive data. Differential privacy ensures that the addition of appropriate noise to statistical results does not significantly affect the statistical results of a single individual record in the data set, thereby achieving privacy protection. Therefore, even if the attacker has information about all records in the data set except one record, differential privacy can still prevent the attacker from inferring the sensitive information of the individual corresponding to the record.

[0005] Existing privacy-preserving large-scale model fine-tuning techniques based on differential privacy include adding differential privacy noise to the gradient during the fine-tuning process. However, these techniques have fixed gradient pruning thresholds and a fixed noise addition scale, failing to flexibly adjust for gradual convergence during training. Furthermore, to accelerate the model fine-tuning process, low-rank approximations are used to reduce the gradient scale, and the Adam optimizer is employed for parameter fine-tuning. However, these approaches do not adequately consider the sparsity of the model gradients and the impact of differential privacy noise on the Adam optimizer. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a privacy-preserving large model fine-tuning method and system based on differential privacy, in order to eliminate or improve one or more defects existing in the prior art, and solve the problems of fixed gradient pruning threshold, low gradient processing efficiency, poor optimizer adaptability and poor static privacy protection capability in the prior art.

[0007] On the one hand, this invention provides a method for fine-tuning a privacy-preserving large model based on differential privacy, the method comprising:

[0008] Acquire sensitive user data and construct a fine-tuning dataset and a validation set;

[0009] The target parameter matrix is ​​decomposed into a low-rank matrix to obtain a low-rank parameter matrix; the fine-tuning dataset is input into the pre-trained large model, the gradient of the fine-tuning dataset on the low-rank parameter matrix is ​​calculated and sparsified; the sparsified gradient is clipped and aggregated according to the gradient clipping threshold, and differential privacy noise is added to obtain the noise gradient; wherein, the target parameter matrix is ​​composed of the target parameters that need to be fine-tuned.

[0010] Based on the noise gradient and differential privacy parameters, the variance estimate of the Adam optimizer is corrected, and the parameter step size is calculated based on the corrected variance to update the target parameters;

[0011] The validation set is input into the large models before and after the target parameter update, respectively. The change in loss of the two large models before and after the update is calculated, and the gradient clipping threshold is adjusted based on the change.

[0012] In some embodiments of the present invention, the target parameter matrix is ​​decomposed into a low-rank matrix to obtain a low-rank parameter matrix, including:

[0013] The target parameter matrix is ​​divided into a frozen residual matrix and a trainable low-rank matrix; wherein the frozen residual matrix remains unchanged during fine-tuning.

[0014] The trainable low-rank matrix can be approximated as the product of a pair of low-rank parameter matrices, expressed as:

[0015] WWfreeze =W′=LR;

[0016] wherein, W represents the target parameter matrix; W freeze represents the frozen residual matrix; W′ represents the trainable low-rank matrix; L and R represent low-rank parameter matrices decomposed from the trainable low-rank matrix.

[0017] In some embodiments of the present application, the gradient of the fine-tuning data set on the low-rank parameter matrix is sparsified, including:

[0018] The importance scores of the rows and columns of the low-rank parameter matrix are calculated respectively;

[0019] The gradient of the fine-tuning data set on the low-rank parameter matrix is sparsified, and the calculation formula is:

[0020]

[0021] wherein, represents the gradient of the sparsified low-rank parameter matrix L; represents the gradient of the sparsified low-rank parameter matrix R; I i represents the importance score of the i-th row; O j represents the importance score of the j-th column; p% represents the sparsification ratio; r represents the rank of the low-rank parameter matrix.

[0022] In some embodiments of the present application, the gradient after sparsification is clipped according to a gradient clipping threshold, including:

[0023] The joint gradient norm is calculated, and the calculation formula is:

[0024]

[0025] wherein, g k represents the gradient of the k-th sample in the fine-tuning data set; ‖·‖ F represents the Frobenius norm; represents the gradient of the k-th sample on the sparsified low-rank parameter matrix L; represents the gradient of the k-th sample on the sparsified low-rank parameter matrix R;

[0026] Based on the joint gradient norm, the gradient is clipped according to a gradient clipping threshold, and the calculation formula is:

[0027]

[0028] wherein, represents the clipped gradient; denotes the clipped gradient of the k-th sample in the sparse low-rank parameter matrix R; denotes the clipped gradient of the k-th sample in the sparse low-rank parameter matrix R; C denotes the clipping threshold.

[0029] In some embodiments of the present application, the clipped gradient is aggregated and added with differential privacy noise to obtain a noisy gradient, and the calculation formula is:

[0030]

[0031] wherein, denotes the noisy gradient; B denotes the batch size; denotes that the noise is subject to a Gaussian distribution with a mean of 0 and a covariance of 2 ,C 2 ,I, wherein σ denotes the standard deviation of the noise; C denotes the clipping threshold; and I denotes the unit matrix.

[0032] In some embodiments of the present application, based on the noisy gradient and a differential privacy parameter, the variance estimation of an Adam optimizer is corrected, including:

[0033] The mean and variance of the noisy gradient are calculated, and the calculation formula is:

[0034]

[0035] The unbiased estimate of the corrected mean and variance is calculated, and the calculation formula is:

[0036]

[0037]

[0038] The variance is corrected, and the calculation formula is:

[0039]

[0040] wherein, m t denotes the mean of the noisy gradient at the t-th time step; v t denotes the variance of the noisy gradient at the t-th time step; β1 and β2 denote the decay rate of Adam; denotes the noisy gradient; denotes the unbiased estimate of the corrected mean; denotes the unbiased estimate of the corrected variance; denotes the corrected variance; σ denotes the standard deviation of the noise; C denotes the clipping threshold; and B denotes the batch size.

[0041] In some embodiments of the present application, the parameter step size is calculated according to the corrected mean and variance, and the calculation formula is:

[0042]

[0043] wherein, Δt represents a parameter step; represents a bias estimation of the corrected mean value; represents a corrected variance; γ is a stability constant.

[0044] In some embodiments of the present application, the change amount of the loss of the two large models before and after updating is calculated, and the gradient clipping threshold is adjusted based on the change amount, comprising:

[0045] The calculation formula of the change amount is:

[0046]

[0047] wherein, represents the change amount; represents a loss function; w t-1 and w t respectively represent the model parameters of the t-1 round and the t round; D v represents the validation set;

[0048] If the change amount is less than a preset change threshold, the gradient clipping threshold remains unchanged; if the change amount is not less than the change threshold, the gradient clipping threshold is adjusted, and the adjustment rule satisfies the following formula:

[0049]

[0050] wherein, C' represents the adjusted gradient clipping threshold; C represents the gradient clipping threshold before adjustment; ρ represents a descending factor.

[0051] On the other hand, the present application also provides a private large model fine-tuning system based on differential privacy, which comprises a data set construction module, a gradient clipping and noise introduction module, an Adam optimization module and a clipping threshold dynamic adjustment module, and the system realizes the steps of the method according to any one of the above-mentioned methods when executed.

[0052] On the other hand, the present application also provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction realizes the steps of the method according to any one of the above-mentioned methods when executed by a processor.

[0053] The application provides a privacy protection large model fine-tuning method and system based on differential privacy, comprising: obtaining user sensitive data to construct a fine-tuning data set and a verification set; performing low-rank decomposition on a target parameter matrix, inputting the fine-tuning data set into a large model, calculating the gradient of the large model on the low-rank parameter matrix and performing sparse processing; adding differential privacy noise after cutting the sparse gradient according to a gradient clipping threshold; based on the gradient with noise and the differential privacy parameter, correcting the variance estimated by the Adam optimizer, and calculating the parameter step according to the corrected variance to update the target parameter; using the verification set to evaluate the optimization before and after the model is updated, and dynamically adjusting the gradient clipping threshold. The application can ensure that the large model fine-tuned has high utility while ensuring the strength of privacy protection.

[0054] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0055] It will be understood by those skilled in the art that the objects and advantages of the present application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:

[0057] Figure 1 A schematic diagram of the steps of the privacy protection large model fine-tuning method based on differential privacy in an embodiment of the application.

[0058] Figure 2 A model diagram of the privacy protection large model fine-tuning method based on differential privacy in an embodiment of the application.

[0059] Figure 3 An architecture diagram of the large model fine-tuning management system based on differential privacy in an embodiment of the application. DETAILED DESCRIPTION

[0060] In order to make the objects, technical solutions and advantages of the application clearer, the application will be further described in detail below in combination with embodiments and drawings. Herein, the illustrative embodiments of the application and their descriptions are used to explain the application, but are not limiting to the application.

[0061] It is also noted herein that, while the above describes example embodiments, there are several variations and modifications which can be made to the disclosed solution without departing from the scope of the application as defined by the appended claims.

[0062] It should be emphasized that the term "comprises / comprising" when used in this text, refers to the presence of the stated features, elements, steps or components, but does not preclude the presence or addition of one or more other features, elements, steps or components.

[0063] It is also noted herein that, if not otherwise specified, the term "connected" in this text can refer not only to direct connections, but also to indirect connections via an intermediate.

[0064] In the following, embodiments of the application will be described with reference to the accompanying drawings. In the drawings, like reference numerals designate identical or similar parts or identical or similar steps.

[0065] It is emphasized here that the step designations mentioned in the following are not a limitation of the order of the steps, but it is to be understood that the steps can be performed in the order mentioned in the embodiments, but also differently from the order in the embodiments, or several steps can be performed simultaneously.

[0066] In order to solve the problems of fixed gradient clipping threshold, low gradient processing efficiency, poor optimizer adaptability and poor static privacy protection capability in the prior art, the present application provides a privacy protection fine-tuning method for large models based on differential privacy, as shown in Figure 1 The method comprises the following steps S101-S104:

[0067] Step S101: Obtain user sensitive data, construct a fine-tuning data set and a verification set.

[0068] Step S102: Perform low-rank decomposition on the target parameter matrix to obtain a low-rank parameter matrix; input the fine-tuning data set into a pre-trained large model, calculate the gradient of the fine-tuning data set on the low-rank parameter matrix and perform sparsification; clip, aggregate and add differential privacy noise to the gradient after sparsification according to the gradient clipping threshold, to obtain a noise gradient. The target parameter matrix is composed of target parameters that need to be fine-tuned.

[0069] Step S103: Based on the noise gradient and the differential privacy parameter, correct the variance estimation of the Adam optimizer, and calculate the parameter step size according to the corrected variance to update the target parameters.

[0070] Step S104: Input the verification set into the large model before and after the target parameter update respectively, calculate the change of the loss of the two large models before and after the update, and adjust the gradient clipping threshold based on the change.

[0071] AsFigure 2 FIG. 1 shows a model diagram of the privacy protection large model fine-tuning method based on differential privacy.

[0072] In step S101, user sensitive data is obtained, and a fine-tuning dataset for model fine-tuning and a verification set for verifying the optimization after updating the model parameters are constructed according to the user sensitive data. The user sensitive data refers to any data that can directly or indirectly identify the identity of a specific individual, reflect the privacy attributes of the individual, or involve the rights and interests of the individual. Once such data is leaked, misused, or illegally accessed, it may result in damage to the privacy of the user, loss of property, or legal risks.

[0073] In step S102, the fine-tuning dataset is used to fine-tune part of the model parameters of the pre-trained large model, and gradient clipping and noise introduction are performed based on the differential privacy technology to protect the sensitive data.

[0074] Considering the strict protection requirements of differential privacy, the limitation of computing resources, and the efficiency of model training, the fine-tuning dataset is sampled in small batches to generate multiple groups of small batch data, so as to control the influence range of a single data, optimize the size of noise addition, and support dynamic gradient adjustment, thereby ensuring user privacy while achieving effective model fine-tuning.

[0075] The low-rank property of a neural network reflects the existence of a large number of linearly dependent parts in the parameter matrix of the neural network, and the parameter amount can be significantly reduced through low-rank decomposition. The sparsity indicates that many elements in the parameter matrix have little contribution to the model performance, and the model can be further compressed through sparsification. These two characteristics are complementary to each other. Therefore, in the present application, low-rank decomposition and sparsification are applied together in the optimization process of the differential privacy stochastic gradient descent algorithm to reduce the size of the gradient to be clipped.

[0076] In some embodiments, the target parameter matrix is first decomposed into a low-rank parameter matrix.

[0077] Specifically, the target parameter matrix includes a frozen residual matrix and a trainable low-rank matrix. The frozen residual matrix is fixed and unchanged during the fine-tuning process, and is usually initialized as a pre-training value or a zero matrix.

[0078] The trainable low-rank matrix is further decomposed, as shown in formula (1), the trainable low-rank matrix can be approximated as the product of a pair of L and R low-rank parameter matrices with rank r:

[0079] W-W freeze =W′=LR; (1)

[0080] wherein, W represents the target parameter matrix; W freezedenotes the frozen residual matrix; W' denotes the trainable low-rank matrix; L and R denote the low-rank parameter matrices decomposed from the trainable low-rank matrix, wherein, denotes the left matrix that compresses the input features (m-dimensional) to the low-rank space (r-dimensional), denotes the right matrix that maps the low-rank space (r-dimensional) to the output features (n-dimensional).

[0081] Based on formula (1), the trainable low-rank matrix W' contains mn parameters, and the low-rank parameter matrices L and R contain r(m+n) parameters in total. By setting r « min(m, n), the low-rank approximation can greatly reduce the number of parameters required for training.

[0082] The small batch data is input into the pre-trained large model, and the gradient of the small batch data on the low-rank parameter matrix is calculated.

[0083] The gradient of the small batch data on the low-rank parameter matrix is sparsified to reduce the number of gradients that need to be calculated and protected, thereby reducing the computational overhead and the size of the privacy noise.

[0084] In some embodiments, the importance scores of each row and column of the trainable low-rank matrix W' are calculated, as shown in formulas (2) and (3):

[0085]

[0086] wherein, I i denotes the importance score of the i-th row; O j denotes the importance score of the j-th column; W' ij denotes the element of the i-th row and the j-th column of the trainable low-rank matrix W'.

[0087] The gradient of each sample on the low-rank parameter matrices L and R is sparsified, and only the top importance scores I i , O i are retained, and the remaining gradients are set to zero, as shown in formulas (4) and (5):

[0088]

[0089] wherein, denotes the gradient of the sparsified low-rank parameter matrix L; denotes the gradient of the sparsified low-rank parameter matrix R; I i denotes the importance score of the i-th row; O j denotes the importance score of the j-th column; p% denotes the sparsification ratio; r denotes the rank of the low-rank parameter matrix.

[0090] The sparsified gradient is clipped according to a gradient clipping threshold.

[0091] In some embodiments, the gradient norm of a single sample is first calculated, specifically, the sparse gradient of the kth sample And The joint gradient norm thereof is calculated, as shown in formula (6):

[0092]

[0093] Wherein, g k represents the sparse gradient of the kth sample; ‖·‖ F represents the Frobenius norm; represents the gradient of the low-rank parameter matrix L of the kth sample after sparsification; represents the gradient of the low-rank parameter matrix R of the kth sample after sparsification.

[0094] In some embodiments, based on the joint gradient norm, the sparse gradient is clipped according to a gradient clipping threshold, as shown in formula (7):

[0095]

[0096] Wherein, represents the clipped gradient; represents the clipped gradient of the low-rank parameter matrix R of the kth sample after sparsification; represents the clipped gradient of the low-rank parameter matrix R of the kth sample after sparsification; C represents the clipping threshold.

[0097] In some embodiments, the clipped gradient is aggregated and added with differential privacy noise to obtain a noisy gradient, as shown in formula (8):

[0098]

[0099] Wherein, represents the noisy gradient; B represents the batch size; represents that the noise is subject to a Gaussian distribution with a mean of 0 and a covariance of σ 2 ,C 2 ,I, wherein σ represents the standard deviation of the noise; C represents the clipping threshold; I represents the unit matrix.

[0100] The noisy gradient is used to update the target parameter.

[0101] In step S103, considering that the Adam optimizer estimates the mean and variance of the overall gradient through the historical gradient, but the addition of the differential privacy noise has an impact on the variance of the gradient, which destroys the sign descent property of Adam and reduces the performance of Adam, so it is necessary to correct the gradient estimation.

[0102] Specifically, the mean and variance of the noise gradient are calculated, as shown in equations (9) and (10):

[0103]

[0104] where m t is the first moment estimation of the gradient, an exponential moving average (EMA) of the gradient, reflecting the long-term trend direction of the gradient, where represents the mean of the noise gradient at the t-th time step; v t is the second moment estimation of the gradient, an EMA of the square of the gradient, reflecting the fluctuation amplitude of the gradient, where represents the variance of the noise gradient at the t-th time step; β1 and β2 represent the decay rates of Adam.

[0105] The unbiased estimates of the corrected mean and variance are calculated, as shown in equations (11) and (12):

[0106]

[0107] where represents the unbiased estimate of the corrected mean; represents the unbiased estimate of the corrected variance.

[0108] Based on the differential privacy parameter and the unbiased estimate of the corrected variance, the variance is corrected, where the differential privacy parameter includes the noise standard deviation and the gradient clipping threshold, and the correction method is shown in equation (13):

[0109]

[0110] where represents the corrected variance; σ represents the standard deviation of the noise, calculated from the preset privacy budget and the number of training iterations; C represents the gradient clipping threshold; B represents the batch size.

[0111] The parameter step is calculated based on the corrected mean and variance, as shown in equation (14):

[0112]

[0113] where Δt represents the parameter step; γ is a stability constant to avoid division by 0.

[0114] The target parameter is updated based on the parameter step.

[0115] ​​In step S104, the gradient clipping threshold is dynamically reduced in the training process to reduce the noise scale, so that the gradient clipping threshold and the scale of the added noise are matched with the gradient size each time, so that the convergence process of the model training is more stable, and the model utility is improved.

[0116] Specifically, after each model parameter update is completed, a small batch of data is obtained by Poisson sampling from the user sensitive data as a validation set. After a new round of model parameters is obtained through iteration, the model obtained in this round and the model in the last round are evaluated on the validation set, and the losses of the two models before and after the update are calculated.

[0117] In order to determine whether the model becomes better, the losses of the two models are processed by difference to obtain the change amount of the loss, as shown in formula (15):

[0118]

[0119] Wherein, represents the change amount of the loss; represents the loss function; w t-1 and w t respectively represent the model parameters of t-1 round and t round; D v represents the validation set.

[0120] If the model does change in the direction of performance improvement, the loss should decrease.

[0121] The change amount of the loss is compared with a preset change threshold, if the change amount is less than the change threshold, it is considered that the current update will not cause the gradient norm to change greatly, and the gradient clipping threshold is not updated; if the change amount is greater than or equal to the change threshold, it is considered that the current update will cause the gradient norm to decrease obviously, and the gradient clipping threshold needs to be updated.

[0122] In some embodiments, the updating rule of the gradient clipping threshold is as shown in formula (16):

[0123]

[0124] Wherein, C' represents the adjusted gradient clipping threshold; C represents the gradient clipping threshold before adjustment; and p represents a decrease factor.

[0125] Corresponding to the privacy protection large model fine-tuning method based on differential privacy, the present application also provides a privacy protection large model fine-tuning system based on differential privacy, which comprises:

[0126] A data set construction module is configured to obtain user sensitive data, construct a fine-tuning data set and a validation set.

[0127] The gradient clipping and noise introduction module is configured to perform low-rank decomposition on the target parameter matrix to obtain a low-rank parameter matrix; input the fine-tuning dataset into the pre-trained large model, calculate the gradient of the fine-tuning dataset on the low-rank parameter matrix and perform sparsification; clip, aggregate and add differential privacy noise to the gradient after sparsification according to the gradient clipping threshold to obtain a noise gradient.

[0128] The Adam optimization module is configured to correct the variance estimation of the Adam optimizer based on the noise gradient and the differential privacy parameter, and calculate the parameter step based on the corrected variance to update the target parameter.

[0129] The clipping threshold dynamic adjustment module is configured to input the verification set into the large model before and after the target parameter update, calculate the change of the loss of the two large models before and after the update, and adjust the gradient clipping threshold based on the change.

[0130] Based on the above-mentioned differential privacy-based private large model fine-tuning method and system, the present application further provides a differential privacy-based large model fine-tuning management system, which comprises a model fine-tuning system module and a permission management system module, and the system comprises three types of users, namely administrators, model fine-tuners and model users.

[0131] The model fine-tuning system module is configured to enable the model fine-tuner to upload a fine-tuning dataset containing user sensitive data, configure model fine-tuning related information, including pre-trained large model parameters, differential privacy parameters, fine-tuning process parameters, etc., submit a model fine-tuning task, and confirm model information and submit model introduction information after fine-tuning is completed.

[0132] In some embodiments, during the model fine-tuning process, the model fine-tuner selects waiting, restarting, and deleting tasks according to the model fine-tuning task state to achieve task management.

[0133] The permission management system module is configured to enable the model user to log in to the system after the model fine-tuning is completed, view the introduction information of the fine-tuned model and send a model use request; the model fine-tuner processes the use request and provides feedback of passing or rejection; the model user confirms the model use permission according to the feedback, and the model user with the model use permission can download and use the model.

[0134] In some implementations, the system has a permission management recovery function.

[0135] In some embodiments, as shown in Figure 3 FIG. 1 is an architectural diagram of the differential privacy-based large model fine-tuning management system. In this embodiment, the system is designed and implemented using a web system architecture, and the service application layer, the business logic layer and the storage management layer are arranged from top to bottom.

[0136] The present application will be further described below in conjunction with a specific embodiment.

[0137] T5-base is used as a pre-training large model, and real data sets SST-2 and QQP are used to construct fine-tuning data sets for experimental verification. The SST-2 data set contains 68223 movie review data, and the QQP data set contains 404301 question pair data.

[0138] The experiment uses the accuracy index to evaluate the performance of the model. As shown in Table 1, when T5-base is used as a pre-training large model, the accuracy results of the models obtained by applying different fine-tuning algorithms on the SST-2 and QQP data sets are shown. The fine-tuning algorithms include SGD (Stochastic Gradient Descent), DPSGD (Differentially Private SGD), RPG (Low-Rank Projected Gradient) and PTLS (Proposed Privacy-Aware Tunable Low-Rank Sparsification), PTLS is the privacy protection large model fine-tuning method based on differential privacy proposed by the present application,

[0139] Table 1

[0140]

[0141] Wherein, ε represents the privacy budget parameter.

[0142] Based on Table 1, it can be seen that:

[0143] Under the condition of high privacy budget, the model fine-tuned by the PTLS method proposed in the embodiment has higher accuracy on the SST-2 and QQP data sets than the RPG using only low-rank approximation optimization, and is significantly higher than the traditional DPSGD.

[0144] Under the condition of low privacy budget, the model fine-tuned by the PTLS method proposed in the embodiment has significantly higher accuracy on the SST-2 and QQP data sets than the RPG using only low-rank approximation optimization and the traditional DPSGD, because in the high noise environment, the fixed threshold and the noise scale will significantly reduce the model performance.

[0145] In summary, the present application can reduce the noise addition amount by more than 60% under the premise of strictly meeting differential privacy through low-rank approximation and gradient sparsification. Experiments show that on the SST-2 and QQP data sets, compared with the traditional DPSGD method, the model accuracy is improved by 3-10% under the same privacy budget, especially in the high noise scenario, which effectively solves the problem of utility decline in privacy protection large model fine-tuning.

[0146] Corresponding to the above method, the present application also provides an electronic device, comprising a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, and the processor being configured to execute the computer instructions stored in the memory, and the electronic device implements the steps of the method as described above when the computer instructions are executed by the processor.

[0147] The present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the edge computing server deployment method as described above. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0148] Those of ordinary skill in the art should understand that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. The specific implementation details are dependent on the particular application and design constraints of the technical solution. Skilled professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link.

[0149] It should be clear that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0150] In the present application, the features described and / or exemplified for one embodiment can be used in the same way or in a similar way in one or more other embodiments, and / or in combination with or instead of the features of other embodiments.

[0151] The above merely illustrates the preferred embodiments of the present application, and is not used to limit the present application. The embodiments of the present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of protection of the present application.

Claims

1. A method for fine-tuning a privacy-preserving large-scale model based on differential privacy, characterized in that, The method includes: Acquire sensitive user data and construct a fine-tuning dataset and a validation set; The target parameter matrix is ​​decomposed into a low-rank matrix to obtain a low-rank parameter matrix; the fine-tuning dataset is input into the pre-trained large model, the gradient of the fine-tuning dataset on the low-rank parameter matrix is ​​calculated and sparsified; the sparsified gradient is clipped and aggregated according to the gradient clipping threshold, and differential privacy noise is added to obtain the noise gradient; wherein, the target parameter matrix is ​​composed of the target parameters that need to be fine-tuned. Based on the noise gradient and differential privacy parameters, the variance estimate of the Adam optimizer is corrected, including: The mean and variance of the noise gradient are calculated using the following formula: ； ； The unbiased estimates of the corrected mean and variance are calculated using the following formula: ； ； Correction for variance is performed using the following formula: ； in, express The mean of the noise gradient at each time step; express The variance of the noise gradient at each time step; and This indicates Adam's decay rate; Indicates the noise gradient; This represents an unbiased estimate of the corrected mean. This represents an unbiased estimate of the corrected variance; Indicates the corrected variance; The standard deviation of noise; Indicates the clipping threshold; Indicates batch size; The target parameter is updated based on the parameter step size calculated according to the corrected variance; wherein the formula for calculating the parameter step size is: ； in, Indicates the parameter step size; This represents an unbiased estimate of the corrected mean. Indicates the corrected variance; It is the stability constant; The validation set is input into the large models before and after the target parameter update, respectively. The change in loss of the two large models before and after the update is calculated, and the gradient clipping threshold is adjusted based on the change.

2. The method for fine-tuning a privacy-preserving large model based on differential privacy according to claim 1, characterized in that, The target parameter matrix is ​​decomposed into a low-rank matrix to obtain a low-rank parameter matrix, including: The target parameter matrix is ​​divided into a frozen residual matrix and a trainable low-rank matrix; wherein the frozen residual matrix remains unchanged during fine-tuning. The trainable low-rank matrix can be approximated as the product of a pair of low-rank parameter matrices, expressed as: ； in, Represents the target parameter matrix; This represents the frozen residual matrix; This represents the trainable low-rank matrix; and This represents the low-rank parameter matrix obtained by the decomposition of the trainable low-rank matrix.

3. The method for fine-tuning a privacy-preserving large model based on differential privacy according to claim 1, characterized in that, The gradient of the fine-tuned dataset on the low-rank parameter matrix is ​​sparsified, including: Importance scores are calculated for the rows and columns of the low-rank parameter matrix, respectively. The gradient of the fine-tuned dataset on the low-rank parameter matrix is ​​sparsified, and the calculation formula is as follows: ； ； in, Represents the low-rank parameter matrix after sparsification The gradient; Represents the low-rank parameter matrix after sparsification The gradient; Indicates the first Importance rating of the line; Indicates the first Importance rating of the column; Indicates the sparsity ratio; This represents the rank of the low-rank parameter matrix.

4. The method for fine-tuning a privacy-preserving large model based on differential privacy according to claim 1, characterized in that, The gradients that have been sparsified are pruned according to a gradient pruning threshold, including: The joint gradient norm is calculated as follows: ； in, Indicates the first in the fine-tuning dataset Gradient of each sample; Denotes the Frobenius norm; Indicates the first The low-rank parameter matrix of each sample after sparsification The gradient; Indicates the first The low-rank parameter matrix of each sample after sparsification The gradient; Based on the joint gradient norm, gradient clipping is performed according to the gradient clipping threshold, calculated as follows: ； in, Indicates the gradient after clipping; Indicates the first The low-rank parameter matrix of each sample after sparsification The clipped gradient; Indicates the first The low-rank parameter matrix of each sample after sparsification The clipped gradient; This indicates the clipping threshold.

5. The method for fine-tuning a privacy-preserving large model based on differential privacy according to claim 4, characterized in that, The clipped gradients are aggregated, and differential privacy noise is added to obtain the noise gradient, calculated as follows: ； in, Indicates the noise gradient; Indicates batch size; This indicates that the noise follows a mean of 0 and a covariance of . , where, The standard deviation of noise; Indicates the clipping threshold; Represents the identity matrix.

6. The method for fine-tuning a privacy-preserving large model based on differential privacy according to claim 1, characterized in that, Calculate the change in loss between the two large models before and after the update, and adjust the gradient pruning threshold based on the change, including: The formula for calculating the change is: ； in, This indicates the amount of change; Represents the loss function; and They represent rounds and Model parameters for each round; This refers to the verification set; If the change is less than a preset change threshold, the gradient clipping threshold remains unchanged; if the change is not less than the change threshold, the gradient clipping threshold is adjusted according to the following formula: ； in, This indicates the adjusted gradient clipping threshold; This indicates the gradient clipping threshold before adjustment; This indicates the decreasing factor.

7. A privacy-preserving large-scale model fine-tuning system based on differential privacy, characterized in that, The system includes a dataset construction module, a gradient pruning and noise introduction module, an Adam optimization module, and a pruning threshold dynamic adjustment module. When the system is executed, it implements the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 6.

Images