A method and apparatus for protecting privacy in large models

Abstract

This invention relates to the fields of artificial intelligence and large model security, specifically providing a method and apparatus for protecting the privacy of large models, comprising the following steps: S1, multi-tenant permissions and environment initialization; S2, neuron localization for sensitive knowledge; S3, real-time forward propagation and dynamic activation inhibition; S4, secure response generation and leakage risk assessment; S5, optimization of inhibition strategies based on human feedback. Compared with existing technologies, this invention, through the organic combination of neuron-level knowledge localization and dynamic activation inhibition, achieves knowledge logic isolation when multiple departments share a large model, while maintaining the model's general capabilities. This effectively prevents unauthorized information acquisition through methods such as prompt word injection, meeting the dual needs of data security and knowledge sharing.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and large model security, specifically providing a method and apparatus for protecting the privacy of large models. Background Technology

[0002] Large language models, as a core infrastructure of artificial intelligence, are playing an increasingly important role in knowledge management and intelligent services at the government and enterprise levels. However, when multiple departments share the same large model, how to achieve strict knowledge isolation and data privacy protection, and prevent the cross-authority access to sensitive information through methods such as prompt word engineering, has become a key challenge restricting its large-scale commercial application.

[0003] The first type of approach relies on implementing external defense strategies based on a unified large model. This type of approach ensures data security by building security barriers at the input and output ends, but its protection mechanism has inherent limitations:

[0004] (1) Parameter sharing and knowledge coupling: All knowledge of a single model is deeply integrated and interconnected in the parameter space. Although the output is restricted by prompt word engineering or rule filters, the activation path inside the model may still be triggered by carefully constructed adversarial prompts, which may lead to the unauthorized extraction of sensitive knowledge injected during training during inference, resulting in a very high risk of prompt word injection bypass.

[0005] (2) Vulnerability of static defenses: Security gateways based on keyword filtering, regular expressions, or traditional classifiers have difficulty understanding complex and ambiguous semantic attacks. Attackers can easily bypass these static rules through strategies such as synonym substitution, context hiding, or segmented injection, making them difficult to defend against.

[0006] (3) Residual memory of fine-tuning data: Even if specific knowledge is forgotten in subsequent fine-tuning, the model parameters may still contain "memory traces" of the original data. These residual memories may still be recovered under certain triggering conditions, making it impossible to completely erase knowledge.

[0007] To overcome the isolation challenges of a unified model, the second approach employs a physical isolation scheme, deploying a dedicated model independently for each department. While this approach conceptually achieves data separation, it introduces new systemic problems.

[0008] (1) High resource costs: Deploying N independent models for N departments leads to linear or even exponential growth in computing resources, storage costs and operation and maintenance complexity, which seriously violates the original intention of the enterprise to reduce costs and increase efficiency, and is difficult to implement on a large scale.

[0009] (2) Knowledge silos and collaboration failure: The models of each department are completely independent and cannot share and utilize common and publicly available knowledge bases, resulting in redundant construction of model capabilities and the inability to conduct cross-departmental knowledge collaboration and value mining under the premise of compliance.

[0010] (3) Risk of model theft attack: Even if an independent model is deployed, attackers can still extract or infer the training data features of a specific model through a large number of query interactions, resulting in the indirect leakage of sensitive information.

[0011] Solving the above-mentioned technical problems is a matter that urgently needs to be addressed by those skilled in the art. Summary of the Invention

[0012] This invention addresses the shortcomings of the prior art by providing a highly practical method for protecting privacy in large models.

[0013] A further technical objective of this invention is to provide a reasonably designed, safe, and applicable large-scale model privacy protection device.

[0014] The technical solution adopted by this invention to solve its technical problem is:

[0015] A method for protecting privacy in large models includes the following steps:

[0016] S1. Multi-tenant permissions and environment initialization;

[0017] S2, Neuron localization for sensitive knowledge;

[0018] S3, Real-time forward propagation and dynamic activation inhibition;

[0019] S4. Security Response Generation and Leakage Risk Assessment;

[0020] S5. Optimization of inhibition strategies based on human feedback.

[0021] Furthermore, in step S1, a user query is received and the user's identity identifier is extracted; the data isolation domain to which the current user belongs is determined according to a predefined department permission mapping table; and the privacy neuron dictionary and suppression strategy corresponding to the isolation domain are loaded.

[0022] Furthermore, step S1 specifically includes:

[0023] S101. Parse the user identity from the input request. and session context The user identity identifier The session context is obtained via a security token or single sign-on system. It is composed of semantic embedding vectors of the current query text and the historical dialogue;

[0024] S102. Query the predefined department permission mapping table. M The department permission mapping table is a user identity identifier. To data isolation domain The set of mappings, i.e. ;pass Determine the isolation domain to which the current user belongs; the isolation domain is used to distinguish different knowledge access permissions between different departments.

[0025] S103, Isolate the data domain according to the determination Load the corresponding privacy neuron dictionary from secure storage. and suppression strategy parameter set The privacy neuron dictionary It stores the indexes and metadata of key neurons located within the encoding isolation domain for protected knowledge; the inhibition strategy parameter set Includes suppression strength coefficients that are preset or dynamically learned to balance the protection strength of the isolation domain with the utility of the model.

[0026] Furthermore, in step S2, during the offline phase, for the specific sensitive knowledge dataset that needs to be protected, a neuron contribution attribution algorithm based on integral gradient is used to locate the key neurons in the model that encode the sensitive knowledge and construct the privacy neuron dictionary.

[0027] Specifically, it includes:

[0028] S201. Construct a stimulus query set designed to maximize the activation of target-sensitive knowledge. Each query All are related to the departments that need protection A Strongly correlated with private data;

[0029] S202, For each sample in the stimulus query set Each neuron in the computational model Contribution of integral gradient to output sensitive knowledge :

[0030] ,

[0031] in, Neuron For query activation value, It is the activation value under the baseline input. It is conditional evaluation. It is a path scalar parameter that integrates within the interval [0, 1] to ensure that the integral gradient method can more fairly and smoothly distribute the contribution of each input feature to the final output, avoiding the instability of general gradient methods. It is the log probability function of the model output related to sensitive knowledge. These are answers to sensitive knowledge that we hope to protect. This refers to a safe, generic rejection or harmless response for the same query. Input in baseline ( =0) and target input ( A specific point on a linear interpolation path between (=1) and (i.e., the embedding vector of the actual query). Scaling It is a query Word embedding, It is the probability of generating a sensitive answer given input x. (This is the probability of generating a safe answer given input x).

[0032] S203. Aggregate the attribution results of all stimulus query samples and calculate the attribution for each neuron. Average absolute contribution Selecting entries with a contribution level higher than a preset threshold. The neurons that constitute the privacy neuron dictionary .

[0033] Furthermore, in step S3, during the online inference phase, the user query is input into the large language model; during the forward propagation of the model, the activation values ​​of neurons in each layer are monitored in real time; when the propagation reaches the neurons recorded in the privacy neuron dictionary, their activation values ​​are dynamically modified according to a preset inhibition strategy to block knowledge output.

[0034] The specific steps are as follows:

[0035] S301, for privacy neuron dictionary Each neuron in Associate with a learnable inhibition strength coefficient ∈[0,1], all coefficients constitute the suppression policy vector ;

[0036] S302. During forward propagation, when the calculation reaches the neuron... At that time, according to the inhibition intensity coefficient Modify activation value :

[0037] ,

[0038] in, These are the modified activation values, modified by methods including scaling and adding Gaussian noise. The intensity of noise and Positive correlation;

[0039] S303. Based on the semantic similarity between the current query's semantic embedding and the sensitive knowledge domain, dynamically adjust the global suppression strength, assuming the similarity is... s Then apply a dynamic scaling factor. arrive ,in This is a hyperparameter that makes the suppression stronger when the query intent is close to the sensitive domain.

[0040] Furthermore, in step S4, after completing the suppressed forward propagation, the final secure response text is generated; at the same time, based on the total intensity of the activation values ​​modified during the suppression process, the potential privacy leakage risk score of this inference is calculated.

[0041] Specifically, it includes:

[0042] S401. Based on the original activation and inhibition strengths of the suppressed neurons in this inference, calculate the potential privacy leakage risk score. :

[0043] ,

[0044] in, This represents the significance threshold for neuronal activation. ReLU The function ensures that only salient activations are considered, and the score is... The higher the value, the greater the risk that the original query will trigger sensitive information.

[0045] S402. Record the user identifier, query content, and risk score for this reasoning. The generated security response is recorded in the security log. Exceeding the high-risk threshold If so, the manual audit process will be automatically triggered.

[0046] Furthermore, in step S5, user satisfaction feedback on security responses and human audit results are collected as reward signals for reinforcement learning. The suppression strategy in step S3 is dynamically optimized through the policy gradient method to achieve an adaptive balance between privacy protection strength and model utility.

[0047] Specifically, it includes:

[0048] S501. Collect human feedback from users and construct a composite reward function. :

[0049] ,

[0050] in, It is a weight that balances utility and safety. It is a strategy Entropy is used to encourage exploration. It is the entropy regularization coefficient;

[0051] S502. Update the suppression policy vector using the REINFORCE policy gradient algorithm. Parameters in :

[0052] ,

[0053] The state includes the semantic features of the user query and the current risk score. R Through continuous iteration, the suppression strategy is improved. Learn to adapt adaptively in different situations To achieve the optimal privacy-utility trade-off.

[0054] A large-scale model privacy protection device includes: at least one memory and at least one processor;

[0055] The at least one memory is used to store a machine-readable program;

[0056] The at least one processor is used to invoke the machine-readable program to execute a large model privacy protection method.

[0057] Compared with the prior art, the large-model privacy protection method and apparatus of the present invention have the following outstanding advantages:

[0058] This invention effectively solves the problems of limited protection and high resource costs caused by the reliance on external defense or physical isolation in traditional methods by constructing a complete technical closed loop from neuron-level knowledge localization, real-time dynamic inhibition to adaptive strategy optimization. It achieves knowledge logic isolation within a unified large model, fundamentally preventing unauthorized information acquisition through means such as prompt word injection.

[0059] By introducing integral gradient attribution and dynamic activation inhibition mechanisms, the method can accurately locate and control the neural pathways encoding specific knowledge in the model, achieving strict knowledge access control while maintaining the model's general capabilities. Experiments have verified that it can reduce the probability of unauthorized knowledge leakage to below 1% while maintaining more than 90% of the performance of general tasks.

[0060] By establishing a reinforcement learning optimization framework based on human feedback, the method possesses continuous adaptive adjustment capabilities, achieving an intelligent balance between privacy protection strength and model utility. User response quality satisfaction reaches 88%, an improvement of approximately 25% compared to traditional filtering methods. This effectively enhances the security and practicality of large-scale government and enterprise models in multi-departmental scenarios. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart illustrating a large-scale model privacy protection method.

[0063] Figure 2 This is a flowchart illustrating the process of locating privacy neurons in a large-scale model privacy protection method.

[0064] Figure 3 This is a flowchart illustrating the dynamic activation suppression process in a large-scale model privacy protection method. Detailed Implementation

[0065] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] The following is a preferred embodiment:

[0067] Example 1: As Figure 1-3 As shown, a large model privacy protection method in this embodiment has the following steps:

[0068] S1. Multi-tenant permissions and environment initialization:

[0069] Receive user queries and extract user identification; determine the data isolation domain to which the current user belongs based on a predefined department permission mapping table; load the privacy neuron dictionary and suppression strategy corresponding to the isolation domain.

[0070] Specifically, it includes:

[0071] S101. Parse the user identity from the input request. and session context User identification Obtained via security token or single sign-on system; session context. It is composed of semantic embedding vectors of the current query text and the historical dialogue;

[0072] S102. Query the predefined department permission mapping table. M This table contains user identification information. To data isolation domain The set of mappings, i.e. ;pass Determine the isolation domain to which the current user belongs. Isolation domains are used to distinguish different knowledge access permissions between different departments.

[0073] S103, Isolate the data domain according to the determination Load the corresponding privacy neuron dictionary from secure storage. and suppression strategy parameter set Privacy Neuron Dictionary It stores the indexes of key neurons located to encode protected knowledge within the domain and their metadata; the set of inhibition policy parameters. It includes the inhibition strength coefficients that are preset or dynamically learned to balance the protection strength of the domain with the utility of the model.

[0074] S2. Neuron localization for sensitive knowledge:

[0075] In the offline phase, for specific sensitive knowledge datasets that need protection, a neuron contribution attribution algorithm based on integral gradient is used to locate the key neurons in the model that encode the sensitive knowledge and construct a privacy neuron dictionary.

[0076] Specifically, it includes:

[0077] S201. Construct a stimulus query set designed to maximize the activation of target-sensitive knowledge. Each query All are related to the departments that need protection A Strongly correlated with private data;

[0078] S202, For each sample in the stimulus query set Each neuron in the computational model Contribution of integral gradient to output sensitive knowledge :

[0079] ,

[0080] in, Neuron For query activation value, It is its activation value under baseline input (such as the zero vector). It is conditional evaluation. It is a path scalar parameter that integrates within the interval [0, 1] to ensure that the integral gradient method can more fairly and smoothly distribute the contribution of each input feature to the final output, avoiding the instability of general gradient methods. It is the log probability function of the model output related to sensitive knowledge. These are answers to sensitive knowledge that we hope to protect. This refers to a safe, generic rejection or harmless response for the same query. Input in baseline ( =0) and target input ( A specific point on a linear interpolation path between (=1) and (i.e., the embedding vector of the actual query). Scaling It is a query Word embedding, It is the probability of generating a sensitive answer given input x. (This is the probability of generating a safe answer given input x).

[0081] S203. Aggregate the attribution results of all stimulus query samples and calculate the attribution for each neuron. Average absolute contribution Selecting entries with a contribution level higher than a preset threshold. The neurons that constitute the privacy neuron dictionary .

[0082] S3, Real-time forward propagation and dynamic activation inhibition:

[0083] During the online inference phase, user queries are input into the large language model; during the forward propagation of the model, the activation values ​​of neurons in each layer are monitored in real time; when the propagation reaches the neurons recorded in the privacy neuron dictionary, their activation values ​​are dynamically modified according to a preset inhibition strategy to block knowledge output.

[0084] Specifically, it includes:

[0085] S301, for privacy neuron dictionary Each neuron in Associate with a learnable inhibition strength coefficient ∈[0,1], all coefficients constitute the suppression policy vector ;

[0086] S302, Dynamic Activation Value Modification: During forward propagation, when the neuron is calculated... At that time, according to its inhibition intensity coefficient Modify its activation value :

[0087] ,

[0088] in, This is the modified activation value, and the modification methods include scaling (multiplying). ) and adding Gaussian noise The intensity of noise and Positive correlation;

[0089] S303. Dynamically adjust the global suppression strength based on the semantic similarity between the semantic embedding of the current query and the semantic similarity of the sensitive knowledge domain.

[0090] Let the similarity be... s Then apply a dynamic scaling factor. arrive ,in This is a hyperparameter that makes the suppression stronger when the query intent is close to the sensitive domain.

[0091] S4. Security Response Generation and Leakage Risk Assessment:

[0092] After completing the suppressed forward propagation, the final secure response text is generated; at the same time, based on the total strength of the activation values ​​modified during the suppression process, the potential privacy leakage risk score of this inference is calculated.

[0093] Specifically, it includes:

[0094] S401. Based on the original activation and inhibition strengths of the suppressed neurons in this inference, calculate the potential privacy leakage risk score. :

[0095] ,

[0096] in, This represents the significance threshold for neuronal activation. ReLU The function ensures that only salient activations are considered, and the score is... The higher the value, the greater the risk that the original query will trigger sensitive information.

[0097] S402. Record the user identifier, query content, and risk score for this reasoning. The generated security response is recorded in the security log. Exceeding the high-risk threshold If so, the manual audit process will be automatically triggered.

[0098] S5. Optimization of inhibition strategy based on human feedback:

[0099] We collect user satisfaction feedback on security responses and the results of manual audits, and use them as reward signals for reinforcement learning. We then dynamically optimize the inhibition policy in step S3 using the policy gradient method to achieve an adaptive balance between privacy protection strength and model utility.

[0100] Specifically, it includes:

[0101] S501, Collect human feedback from the user (such as a binary signal indicating whether the answer was helpful). and security feedback from the auditing end (such as binary signals indicating whether a leak has occurred). Construct a compound reward function :

[0102] ,

[0103] in, It is a weight that balances utility and safety. It is a strategy Entropy is used to encourage exploration. It is the entropy regularization coefficient;

[0104] S502. Update the suppression policy vector using the REINFORCE policy gradient algorithm. Parameters in :

[0105] ,

[0106] The state includes the semantic features of the user query and the current risk score. R Through continuous iteration, the suppression strategy is improved. Learn to adapt adaptively in different situations To achieve the optimal privacy-utility trade-off.

[0107] Example 2:

[0108] A method for protecting privacy in large models includes the following steps:

[0109] S1. Multi-tenant permissions and environment initialization:

[0110] The query received from user Zhang San in Department B, "Please summarize the core conclusions of Department A's financial analysis report for the previous quarter," has the following steps:

[0111] S101. Parse the user identity identifier User_B_Zhang from the security token, and use the BERT encoder to generate semantic embedding vectors for the current query and session history;

[0112] S102. Query the department permission mapping table to determine that the user's data isolation domain is "Domain_B";

[0113] S103. Load the privacy neuron dictionary Dict_A (containing 327 key neuron IDs and their contributions) and the inhibition strategy parameter set corresponding to Domain_B from secure storage. (Initial suppression strength coefficient) =0.8).

[0114] S2, Neuron localization for sensitive knowledge;

[0115] To protect the financial data of Department A, privacy neurons are constructed and located. The specific steps are as follows:

[0116] S201. Prepare a set of stimulating queries containing 5,000 financial data related to Department A, such as "How much revenue did Department A generate in Q3?" and "Show Department A's profit and loss statement".

[0117] S202. Using the integral gradient algorithm, calculate the contribution of each neuron to the output financial knowledge on the LLaMA-2-13B model. Set the baseline input to a zero vector and the integration step size to 50.

[0118] S203, Set contribution threshold 327 key privacy neurons were selected, and a dictionary Dict_A was constructed, containing neurons... u _1532 had the highest contribution ( =0.92).

[0119] S3, Real-time forward propagation and dynamic activation inhibition;

[0120] Dynamic suppression is implemented when processing user queries. The specific steps are as follows:

[0121] S301. Read the inhibition strength coefficients of neurons in Dict_A, where... u _1532 _1532=0.85;

[0122] S302, forward propagation to u At _1532, the original activation value a _1532=4.72, applying the suppression formula: a '_1532=4.72×(1-0.85)+ ,in ~N(0,0.15);

[0123] S303. Calculate the semantic similarity between the query and the financial knowledge domain. s =0.88, applying dynamic scaling factor =1.32, final a '_1532=0.71.

[0124] S4. Security Response Generation and Leakage Risk Assessment;

[0125] The specific steps for generating a secure response and assessing the risks are as follows:

[0126] S401. After completing the suppressed forward propagation, generate a security response: "I cannot provide details of the financial information of other departments. I suggest you contact the relevant departments to obtain authorized access."

[0127] S402, Calculate the leakage risk score R =0.127, based on the original activation intensity and inhibition intensity of the inhibited neuron, which is below the high-risk threshold. _high=0.6, logs information but does not trigger auditing.

[0128] S5. Optimization of inhibition strategies based on human feedback;

[0129] The specific steps for collecting feedback and optimizing the system are as follows:

[0130] S501, User Zhang San gave feedback to the answer: "The answer is safe but useless." =-0.5), the auditor confirmed no leakage ( =+1.0), set the balancing weight. α =0.7, entropy regularization coefficient =0.01;

[0131] S502. The suppression strategy is updated using the REINFORCE algorithm. u Suppression intensity coefficient of _1532 The value of _1532 was adjusted from 0.85 to 0.78, which moderately improves the effectiveness while maintaining safety.

[0132] Example 3: A large model privacy protection device in this example includes: at least one memory and at least one processor;

[0133] At least one memory for storing machine-readable programs;

[0134] At least one processor is used to invoke the machine-readable program to execute a large-model privacy protection method.

[0135] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can be a microprocessor or any conventional processor.

[0136] Memory is used to store computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, at least one application program required for a function, etc.; the data storage area can store data created based on the use of the terminal, etc. In addition, memory can also include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart memory cards (SMC), secure digital cards (SD cards), flash memory cards, at least one disk storage device, flash memory devices, or other volatile solid-state storage devices.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for protecting privacy in large models, characterized in that, It has the following steps: S1. Multi-tenant permissions and environment initialization; S2, Neuron localization for sensitive knowledge; In the offline phase, for specific sensitive knowledge datasets that need protection, a neuron contribution attribution algorithm based on integral gradient is used to locate the key neurons in the model that encode the sensitive knowledge and construct the privacy neuron dictionary. Specifically, it includes: S201. Construct a stimulus query set designed to maximize the activation of target-sensitive knowledge. Each query All are related to the departments that need protection A Strongly correlated with private data; S202, For each sample in the stimulus query set Each neuron in the computational model Contribution of integral gradient to output sensitive knowledge : ； in, Neuron For query activation value, It is the activation value under the baseline input. It is conditional evaluation. It is a path scalar parameter that integrates within the interval [0, 1] to ensure that the integral gradient method can more fairly and smoothly distribute the contribution of each input feature to the final output, avoiding the instability of general gradient methods. It is the log probability function of the model output related to sensitive knowledge. These are answers to sensitive knowledge that we hope to protect. This refers to a safe, generic rejection or harmless response for the same query. Input in baseline =0 and target input A specific point on a linear interpolation path between 1 and 1, i.e., the embedding vector of the actual query. Scaling It is the probability of generating a sensitive answer given input x. It is the probability of generating a safe answer given input x; S203. Aggregate the attribution results of all stimulus query samples and calculate the attribution for each neuron. Average absolute contribution Selecting entries with a contribution level higher than a preset threshold. The neurons that constitute the privacy neuron dictionary ; S3, Real-time forward propagation and dynamic activation inhibition; During the online inference phase, user queries are input into the large language model; during the forward propagation of the model, the activation values ​​of neurons in each layer are monitored in real time; when the propagation reaches the neurons recorded in the privacy neuron dictionary, their activation values ​​are dynamically modified according to a preset inhibition strategy to block knowledge output. The specific steps are as follows: S301, for privacy neuron dictionary Each neuron in Associate with a learnable inhibition strength coefficient ∈[0,1], all coefficients constitute the suppression policy vector ; S302. During forward propagation, when the calculation reaches the neuron... At that time, according to the inhibition intensity coefficient Modify activation value : ； in, These are the modified activation values, modified by methods including scaling and adding Gaussian noise. The intensity of noise and Positive correlation; S303. Based on the semantic similarity between the current query's semantic embedding and the sensitive knowledge domain, dynamically adjust the global suppression strength, assuming the similarity is... s Then apply a dynamic scaling factor. arrive ,in This is a hyperparameter that makes the suppression stronger when the query intent is close to the sensitive domain; S4. Security Response Generation and Leakage Risk Assessment; S5. Optimization of inhibition strategies based on human feedback.

2. The method for protecting privacy of large models according to claim 1, characterized in that, In step S1, a user query is received and the user's identity identifier is extracted; the data isolation domain to which the current user belongs is determined according to a predefined department permission mapping table; and the privacy neuron dictionary and suppression strategy corresponding to the isolation domain are loaded.

3. The method for protecting privacy of large models according to claim 2, characterized in that, Step S1 specifically includes: S101. Parse the user identity from the input request. and session context The user identity identifier The session context is obtained via a security token or single sign-on system. It is composed of semantic embedding vectors of the current query text and the historical dialogue; S102. Query the predefined department permission mapping table. M The department permission mapping table is a user identity identifier. To data isolation domain The set of mappings, i.e. ;pass Determine the isolation domain to which the current user belongs; the isolation domain is used to distinguish different knowledge access permissions between different departments. S103, Isolate the data domain according to the determination Load the corresponding privacy neuron dictionary from secure storage. and suppression strategy parameter set The privacy neuron dictionary It stores the indexes and metadata of key neurons located within the encoding isolation domain for protected knowledge; the inhibition strategy parameter set Includes suppression strength coefficients that are preset or dynamically learned to balance the protection strength of the isolation domain with the utility of the model.

4. The method for protecting privacy of large models according to claim 3, characterized in that, In step S4, after the suppressed forward propagation is completed, the final security response text is generated; Meanwhile, based on the total intensity of the activation values ​​modified during the suppression process, the potential privacy leakage risk score for this inference is calculated; Specifically, it includes: S401. Based on the original activation and inhibition strengths of the suppressed neurons in this inference, calculate the potential privacy leakage risk score. : ; in, This represents the significance threshold for neuronal activation. ReLU The function ensures that only salient activations are considered, and the score is... The higher the value, the greater the risk that the original query will trigger sensitive information. S402. Record the user identifier, query content, and risk score for this reasoning. The generated security response is recorded in the security log. Exceeding the high-risk threshold If so, the manual audit process will be automatically triggered.

5. A method for protecting privacy in large models according to claim 4, characterized in that, In step S5, user satisfaction feedback on security responses and human audit results are collected as reward signals for reinforcement learning. The suppression strategy in step S3 is dynamically optimized through the policy gradient method to achieve an adaptive balance between privacy protection strength and model utility. Specifically, it includes: S501. Collect human feedback from users and construct a composite reward function. : ; in, It is a weight that balances utility and safety. It is a strategy Entropy is used to encourage exploration. It is the entropy regularization coefficient; S502. Update the suppression policy vector using the REINFORCE policy gradient algorithm. Parameters in : ; The state includes the semantic features of the user query and the current risk score. R Through continuous iteration, the suppression strategy is improved. Learn to adapt adaptively in different situations To achieve the optimal privacy-utility trade-off.

6. A large model privacy protection device, characterized in that, include: At least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to invoke the machine-readable program to perform the method according to any one of claims 1 to 5.

Images