A large model-oriented split privacy protection training method
By employing token importance annotation and noise calibration, the problem of balancing privacy protection and performance in large model training is solved. This approach achieves efficient privacy protection and model performance improvement under differential privacy constraints, making it suitable for the split learning architecture of large-scale language models.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG UNIV
- Filing Date
- 2026-01-26
- Publication Date
- 2026-05-01
AI Technical Summary
Existing split learning methods struggle to balance privacy protection and model performance in large model training scenarios, especially lacking targeted compensation after noise perturbations, leading to exacerbated performance loss. Furthermore, they lack deep structural and complex semantic modeling designs for large models.
By employing token importance injection and noise calibration, and combining the semantic influence and structural stability scores of tokens, we achieve a balance between differential privacy protection and model performance, adapting to the deep structure and complex semantic requirements of large models.
While satisfying differential privacy constraints, it preserves key semantic and structural information, significantly improves model fine-tuning accuracy, reduces attack risks, reduces computational and communication overhead, and adapts to large model scenarios with different network depths and hierarchical divisions.
Smart Images
Figure CN121561979B_ABST
Abstract
Description
A Decompositional Privacy-Preserving Training Method for Large Models Technical Field
[0001] This invention belongs to the field of privacy computing, specifically a decomposition-based privacy-preserving training method for large models. Background Technology
[0002] In the field of privacy-preserving computation, Split Learning, as a typical edge-cloud collaborative privacy training framework, is widely used in privacy-sensitive large-scale model training scenarios. By dividing the model into client-side and server-side components and exchanging only intermediate activations generated during training, it avoids the original input data leaving the client directly, thus aligning with the fundamental principle of "minimal data exposure" in privacy-preserving computation at the system architecture level. However, Split Learning does not achieve strict isolation of training data: research shows that intermediate activations still carry highly semantically related feature representations. Attackers can infer or even reconstruct user input content without accessing the original text, using attack methods such as activation inversion or data reconstruction. Existing methods attempt to introduce privacy enhancement techniques such as differential privacy denoising, data anonymization, or encrypted computation into the Split Learning framework. However, these methods generally involve an unavoidable trade-off between privacy and performance overhead. For example, noise perturbation methods typically apply uniform random noise to intermediate activations. Uniform perturbation can easily disrupt the representation structure of semantic key tokens, leading to a significant decrease in model performance. Data anonymization methods rely on heuristic rules, making it difficult to quantify privacy strength and lacking stability in complex semantic scenarios. While homomorphic encryption, multi-party secure computation, and other cryptographic computing technologies have high theoretical security, their enormous computational and communication overhead makes them difficult to directly apply to the training and inference processes of large-scale language models.
[0003] Existing technologies have significant limitations in split-type large model training scenarios, mainly in the difficulty of simultaneously ensuring privacy protection and model performance.
[0004] First, existing methods often suppress the risk of privacy leakage by adding noise to intermediate activations. However, there is a direct coupling relationship between noise intensity and privacy protection level, which often makes it difficult to maintain the effective representation of semantic key information by the model while satisfying privacy constraints, resulting in a significant decline in model performance.
[0005] Second, most solutions lack targeted compensation or calibration mechanisms after noise perturbation. The representation shift caused by noise continues to accumulate during subsequent training and inference, further amplifying the performance loss, especially in deep networks and large model scenarios.
[0006] Third, existing privacy enhancement methods for split learning are mostly derived from traditional neural networks or small-to-medium-scale model settings. They lack targeted design for the deep structure, context modeling characteristics, and token-level semantic differences of large models. When directly transferred to large model training scenarios, they are difficult to adapt to their high-dimensional representation and complex semantic modeling requirements, which further restricts the effectiveness and scalability of the methods. Summary of the Invention
[0007] To address the aforementioned issues, this invention provides a privacy-balancing large model splitting privacy training method based on token importance-based noise injection and noise calibration. Under the premise of satisfying differential privacy constraints, it achieves a trade-off between privacy protection and model performance through adaptive noise injection based on token importance and lightweight calibration of perturbed features.
[0008] This invention is achieved through the following technical solution:
[0009] This invention discloses a split-based privacy-preserving training method for large models, comprising:
[0010] The pre-trained large model is divided into the bottom and top layers of the client-side model and the middle layer of the cloud server-side model along the network depth direction. The client only processes local private data, and the client and cloud coordinate training through the middle activation.
[0011] The user's local private text data is preprocessed to generate a token sequence, and the first intermediate activation vector is obtained by forward calculation of the token sequence using the bottom layer of the client-side model.
[0012] The semantic influence score and structural stability score of the token are calculated based on the first intermediate activation vector, and then the token importance score is obtained by combining them.
[0013] Based on the token importance score, the first intermediate activation vector is subjected to token-level differential privacy noise injection to generate a perturbed first intermediate activation vector;
[0014] The perturbation of the first intermediate activation vector is sent to the cloud server, and the second intermediate activation vector is obtained through forward calculation of the model intermediate layer.
[0015] The second intermediate activation vector is calibrated on the client side using a lightweight noise calibration module;
[0016] The calibrated second intermediate activation vector is input into the top layer of the client-side model, the prediction result is output and the loss function is calculated.
[0017] Based on the loss function, the cloud-side collaborative backpropagation is performed to update the model parameters on both the client side and the cloud server side.
[0018] As a further improvement, the semantic influence score of a token calculated based on the first intermediate activation vector, as described in this invention, specifically involves aggregating the attention matrices of all model layers in the bottom layer of the client-side model for each token in the input sequence. And introduce residual connections to construct an aggregate attention matrix. ,in For a diagonal matrix, calculate the cumulative semantic influence of each token on other tokens and normalize it to obtain a proportional score representing the semantic contribution of that token in global context modeling. .
[0019] As a further improvement, the structural stability score of the token based on the first intermediate activation vector described in this invention specifically involves calculating the average norm of the token across activation vectors in different network layers. ,in It is the size of the hidden dimension of the model used. Indicates the first The token in the 1st The activation values on each hidden dimension are normalized to obtain the structural stability score. This is used to reflect the stability and supporting role of the token in the model structure representation.
[0020] As a further improvement, the token importance score obtained by jointly calculating the semantic influence score and the structural stability score as described in this invention is specifically: [The semantic influence score is then used to calculate the token importance score.] and structural stability score A linear weighted fusion is performed to obtain the token importance score. ,in This is an adjustable weighting parameter used to balance the impact of semantic influence score and structural stability score on token importance assessment.
[0021] As a further improvement, the token-level differential privacy noise injection of the first intermediate activation vector based on the token importance score described in this invention specifically involves: based on the token importance score... global budget Mapped to a token-level privacy budget: To satisfy the Gaussian combination formula constraints ,in accordance with Inject zero-mean Gaussian noise into the activation vector corresponding to each token. .
[0022] As a further improvement, the present invention calibrates the second intermediate activation vector on the client side using a lightweight noise calibration module; specifically, the lightweight noise calibration module consists of a two-layer attention structure, which is pre-trained using public or auxiliary data, and records clean activations during training. With perturbation activation This forms paired training samples to minimize the mean squared error loss between clean activations and module outputs. After training, the module is deployed on the client to perform online calibration of the second intermediate activation vector returned by the server to compensate for feature shifts introduced by noise.
[0023] The beneficial effects of this invention are as follows:
[0024] 1. Privacy protection for large models
[0025] 1) Privacy strategy adapted to the characteristics of large models: In view of the characteristics of large models such as large parameter scale, deep hierarchical representation and strong semantic sensitivity, a privacy protection strategy that matches the model structure and training process is designed to alleviate the problem of insufficient applicability of general privacy mechanisms in this scenario.
[0026] 2) Applicability across model architectures: The privacy protection strategy does not depend on a specific large model structure or task form. It can adapt to large model splitting and fine-tuning scenarios with different network depths and different layer partitioning methods, thereby improving the versatility of the solution in practical applications.
[0027] 2. Achieving a precise privacy-utility balance
[0028] 1) Token importance-aware noise injection: Under the premise of satisfying global differential privacy constraints, weak noise is injected into important tokens to retain key semantic and structural information, and strong noise is injected into unimportant tokens to meet the privacy budget. Compared with the uniform noise injection method, it can retain more effective semantic features and significantly improve the model fine-tuning accuracy under the same privacy constraints.
[0029] 2) Lightweight noise post-calibration: A pre-trained pluggable noise calibration module is used to adaptively calibrate and compensate for the perturbation features returned by the server, reducing the representation shift caused by noise introduction and further narrowing the performance gap with the model without privacy protection.
[0030] 3. Provide theoretically binding privacy guarantees
[0031] 1) Token-level differential privacy mechanism: It performs fine-grained modeling of privacy perturbations at the token level, and effectively reduces the potential risk of attackers inferring the original input information through activation inversion, data reconstruction and other methods while meeting the preset privacy constraints.
[0032] 2) Parametric Adjustable Privacy Constraints: Parametric privacy constraints are used to model the strength of privacy protection, so that the level of privacy can be adjusted according to needs, enhancing the interpretability and controllability of the privacy protection mechanism.
[0033] 4. Optimize deployment feasibility and system efficiency
[0034] 1) Low additional computing and storage overhead: The relevant modules only bring limited additional computing and storage overhead, which can adapt to resource-constrained client or edge deployment environments and improve the feasibility of the solution in actual systems.
[0035] 2) Compatible parameter high-efficiency fine-tuning technology: While ensuring privacy protection, it significantly reduces communication and computing requirements, and supports efficient and practical privacy fine-tuning of large-scale models under split learning architecture. Attached Figure Description
[0036] Figure 1 is an overall flowchart of a split-based privacy-preserving training method for large models;
[0037] Figure 2 is a detailed schematic diagram of the token importance assessment and adaptive noise injection provided in the embodiment of the present invention. Detailed Implementation
[0038] This invention discloses a split-based privacy-preserving training method for large models. Figure 1 shows the overall flow of this split-based privacy-preserving training method for large models, and Figure 2 is a detailed schematic diagram of the token importance evaluation and adaptive noise injection provided in an embodiment of this invention. The technical solution of this invention will be further described below with reference to the accompanying drawings and specific embodiments: The specific implementation steps are as follows:
[0039] 1) Construct a U-shaped split learning architecture and perform data preprocessing.
[0040] The client deploys the bottom layer (including the embedding layer and the first few Transformer layers) and top layer (including the last few model layers and task-specific output headers) of the large model that requires pre-training. The middle layer of the model is deployed on the cloud server. The client loads local private text data, segments it using a tokenizer matched to the large model, and unifies the sequence to a fixed length L by truncation or padding (e.g., using a special token [PAD]). Subsequently, the token sequence is converted into embedding vectors by the client-side embedding layer and input into the bottom layer of the model for forward computation to obtain the first intermediate activation vector. This activation vector will serve as the basis for subsequent token importance assessments and privacy protection processes.
[0041] 2) Token Importance Assessment
[0042] For the first intermediate activation vector Each corresponding token position ( =1,2,…,L), and perform importance assessment, which includes the following three calculation steps: First, calculate the semantic influence score; second, aggregate the attention weight matrices of each layer in the bottom layer of the client-side model; and third, construct a cross-layer aggregated attention matrix by introducing residual connections. ,in It is the identity matrix. For the first The attention matrix of the layer is normalized to obtain the semantic influence score. This is used to reflect the token's contribution to global context modeling; secondly, a structural stability score is calculated for each token. Average norm of activation values across all hidden dimensions ,in It is the size of the hidden dimension of the model used. Indicates the first The token in the 1st The activation values on each hidden dimension are normalized to obtain the structural stability score. This is used to reflect the stability and supporting role of the token in the model's structural representation. (This is related to the semantic influence score.) and structural stability score A linear weighted fusion is performed to obtain the token importance score. ,in The weight parameter is adjustable and can be determined a priori in the range [0,1] by grid search on the public validation set. For example, it can be initially set to 0.7.
[0043] 3) Adaptive Differential Privacy Noise Injection
[0044] 1. Based on token importance score Global privacy budget Non-uniformly distributed among tokens, with a privacy budget for each token being [missing information]. Ensure that the privacy budget meets the constraints of the Gaussian combination formula. ,in accordance with Inject zero-mean Gaussian noise into the activation vector corresponding to each token. The noise level is related to The relationship is inversely proportional. Tokens of higher importance receive less noise, while tokens of lower importance receive relatively stronger noise. This results in the perturbated first intermediate activation vector. It is then sent to the server for further processing.
[0045] 4) Server-side forward computation
[0046] The client will perturb the first intermediate activation vector The data is sent to the cloud server. The server performs forward computation on the intermediate layer of the deployed model to obtain the second intermediate activation vector. Throughout the process, the server can only access and process privacy-protected perturbation activations and cannot directly obtain any raw input data or label information.
[0047] 5) Lightweight noise calibration
[0048] The client deploys a lightweight noise calibration module C, which, in practice, consists of a two-layer attention network or a Transformer, has few parameters, and is suitable for resource-constrained environments. This lightweight noise calibration module can be pre-trained using public or auxiliary data, with clean activations recorded during training. With perturbation activation This forms paired training samples to minimize the mean squared error loss between clean activations and module outputs. The module is trained using the Adam optimizer. After training, the module's parameters are fixed and it is deployed on the client side to perform online calibration on the second intermediate activation vector returned by the server to compensate for feature shifts introduced by noise.
[0049] 6) Top-level computation and backpropagation
[0050] The calibrated activation is input into the top layer of the subsequent model to complete the forward computation and obtain the model output. The client calculates the loss (such as cross-entropy and mean squared error) according to the task type (such as classification and regression) and calculates the gradient for backpropagation to drive the model parameter update. In this process, common parameter fine-tuning techniques such as LoRA can be adapted to reduce the computational cost by updating only some model parameters.
[0051] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.
[0052] The above are merely preferred embodiments of the present invention. Although the preferred embodiments have been disclosed above, they are not intended to limit the present invention. Any person skilled in the art can make many possible variations and modifications to the technical solutions of the present invention using the methods and techniques disclosed above, or modify them into equivalent embodiments with equivalent changes, without departing from the scope of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the present invention's technical solutions still fall within the protection scope of the present invention.
Claims
1. A decomposed privacy-preserving training method for large models, characterized in that, include: The pre-trained large model is divided into the bottom and top layers of the client-side model and the middle layer of the cloud server-side model along the network depth direction. The client only processes local private data, and the client and cloud are trained together through intermediate activation. The local private text data on the user side is preprocessed to generate a token sequence, and the bottom layer of the client-side model is used to forward compute the token sequence to obtain the first intermediate activation vector. The semantic influence score and structural stability score of the token are calculated based on the first intermediate activation vector, and then the token importance score is obtained by combining them. Based on the token importance score, token-level differential privacy noise is injected into the first intermediate activation vector to generate a perturbed first intermediate activation vector; the perturbed first intermediate activation vector is sent to the cloud server side, and the second intermediate activation vector is obtained through forward calculation of the model intermediate layer; On the client side, the second intermediate activation vector is calibrated using a lightweight noise calibration module. The calibrated second intermediate activation vector is then input into the top layer of the client-side model, outputting the prediction result and calculating the loss function. Based on the loss function, edge-cloud collaborative backpropagation is performed to update the model parameters on both the client side and the cloud server side. Specifically, the semantic influence score of the token is calculated based on the first intermediate activation vector by aggregating the attention matrices of all model layers in the bottom layer of the client-side model for each token in the input sequence. And introduce residual connections to construct an aggregate attention matrix. ,in For a diagonal matrix, calculate the cumulative semantic influence of each token on other tokens and normalize it to obtain a proportional score representing the semantic contribution of that token in global context modeling. The calculation of the token's structural stability score based on the first intermediate activation vector specifically involves calculating the average norm of the token across activation vectors in different network layers. ,in It is the size of the hidden dimension of the model used. Indicates the first The token in the 1st Activation values on each hidden dimension; After normalization, the structural stability score is obtained. This is used to reflect the stability and supporting role of the token in the model structure representation.
2. The decomposition-based privacy-preserving training method for large models according to claim 1, characterized in that, The method of calculating the semantic influence score and structural stability score of the token based on the first intermediate activation vector, and jointly obtaining the token importance score, specifically involves: [The text abruptly ends here, so the translation stops as well.] and structural stability score A linear weighted fusion is performed to obtain the token importance score. ,in This is an adjustable weighting parameter used to balance the impact of semantic influence score and structural stability score on token importance assessment.
3. The decomposition-based privacy-preserving training method for large models according to claim 2, characterized in that, The aforementioned token-level differential privacy noise injection of the first intermediate activation vector based on token importance score specifically involves: based on the token importance score... global budget Mapped to a token-level privacy budget: To satisfy the Gaussian combination formula constraints ,in accordance with Inject zero-mean Gaussian noise into the activation vector corresponding to each token. 。 4. The decomposition-based privacy-preserving training method for large models according to claim 3, characterized in that, The aforementioned calibration of the second intermediate activation vector on the client side using a lightweight noise calibration module specifically involves: the lightweight noise calibration module consisting of a two-layer attention structure, which is pre-trained using public or auxiliary data, and records clean activations during training. With perturbation activation This forms paired training samples to minimize the mean squared error loss between clean activations and module outputs. ； After training, the module is deployed on the client to perform online calibration of the second intermediate activation vector returned by the server to compensate for feature shifts introduced by noise.