Recommendation system privacy memory forgetting method driven by large language model

Abstract

The invention discloses a recommendation system privacy memory forgetting method based on large language model driving, and belongs to the technical field of machine forgetting and intelligent recommendation. The method comprises the following steps: firstly, realizing semantic decoupling of privacy information and non-privacy information through comparative learning, and constructing distinguishable privacy feature subspaces; and then performing structured pruning or weight weakening on the positioned privacy-related parameters, and introducing a selective regulation and control mechanism to realize differentiated forgetting strength. A multi-index evaluation system including a privacy leakage rate, a privacy inference rate, a utility retention rate and a link exposure rate is constructed, quantitative detection is performed on a forgetting effect, a training-forgetting-evaluation closed loop is formed in combination with an iterative optimization strategy, and privacy removal and recommendation performance balance is realized. The privacy memory forgetting method can realize privacy memory forgetting without performing complete retraining on a large model, has the advantages of controllability, low cost and high universality, and can be applied to sensitive information management and model privacy security compliance requirements in scenes such as education, e-commerce and finance.

Description

Technical Field

[0001] This invention relates to the field of large language models and privacy-preserving recommendation algorithms, and more specifically to a method for achieving privacy-preserving memory forgetting through information decoupling and selective forgetting. Background Technology

[0002] With the rapid development of deep learning and Large Language Models (LLMs), recommender systems have been widely applied in e-commerce, education, and content distribution. Large language models possess powerful semantic understanding and knowledge reasoning capabilities, enabling deep modeling of user behavior and generating more accurate personalized recommendations. Compared to traditional collaborative filtering and feature engineering-driven methods, they offer higher generalization and content representation capabilities. However, while recommender systems rely on massive amounts of user data for training, the risk of privacy breaches increases significantly. Users have insufficient control over their own data, making it difficult to meet privacy compliance requirements.

[0003] Traditional recommendation models are typically trained on centralized data, with user behavior features embedded in the model parameters for permanent storage. This makes selective forgetting difficult when users request data deletion. Directly retraining the model is not only costly and time-consuming but also hinders rapid iteration in real-world business applications. With the 2024 Shanghai Declaration on Global Governance of Artificial Intelligence explicitly emphasizing "high importance to AI security and data privacy protection," there is a greater demand for recommendation models with privacy-preserving memory capabilities.

[0004] Existing forgetting methods mainly include gradient ascent, knowledge distillation, and parameter pruning, but they still have significant shortcomings: First, knowledge within LLMs is coupled in a distributed manner, and forgetting sensitive information often leads to the synchronous decay of related knowledge, resulting in a decline in recommendation performance; Second, existing methods usually use the criterion of successful forgetting of privacy memories by preventing the model from generating relevant answers in query scenarios involving privacy information; Third, parameter sharing is common in multi-domain recommendations, and privacy information may remain across domains along shared weights, lacking a controllable selective forgetting strategy.

[0005] Therefore, there is an urgent need for a privacy-preserving memory forgetting technique for large language model-driven recommendation systems, which can selectively forget information in a privacy-preserving manner, reduce interference with non-privacy knowledge and recommendation performance, and improve privacy security and controllability during model operation. Summary of the Invention

[0006] To address the challenges of selectively removing privacy information in existing large language model-driven recommender systems, the impact of forgetting operations on non-privacy knowledge structures and recommendation performance, and cross-domain privacy remnants caused by shared parameters across multiple tasks, this invention proposes a selective forgetting method for privacy memories in large language model-driven recommender systems. This method enables selective forgetting of privacy memories without retraining the entire model, reducing the risk of model leakage while maintaining stable recommender capabilities and model utility.

[0007] To achieve the above objectives, this invention provides a privacy-preserving memory forgetting method based on a large language model, comprising the following steps:

[0008] S1. Semantic decoupling of privacy and non-privacy information;

[0009] S2, Structured pruning selective forgetting strategy;

[0010] S3, Gradual forgetting mechanism in multi-domain recommendation scenarios;

[0011] S4. Evaluation and feedback optimization of privacy forgetting effect.

[0012] Preferably, step S1 includes the following steps:

[0013] S1-1. Distinguish between privacy and non-privacy attribute samples in the training corpus, input them into the large language model for encoding, and construct corresponding privacy feature vectors and non-privacy feature vectors.

[0014] S1-2. Construct a separable semantic space for privacy and non-privacy features through contrastive learning, so that privacy features form a localizable independent subspace in the model to support the selective forgetting of privacy memories in the future.

[0015] Preferably, by introducing privacy feature contrast constraints during the training phase, the model can form identifiable and pruneable privacy representation weight blocks. This allows for targeted suppression or removal of target weights during privacy forgetting, enabling selective forgetting of privacy memories without requiring full retraining of the model.

[0016] Preferably, step S2 includes the following steps:

[0017] S2-1. Analyze the importance of parameters and locate privacy-related parameters based on the semantic decoupling results;

[0018] S2-2. Perform structured pruning or weight reduction on privacy-related parameters while keeping non-privacy parameters stable.

[0019] S2-3, thereby enabling selective forgetting of privacy memories and mitigating the disruption to recommendation performance.

[0020] Preferably, step S3 includes the following steps:

[0021] S3-1. Construct a shared parameter contribution and sensitivity assessment model;

[0022] S3-2. Set forgetting intensity strategy based on sensitivity results;

[0023] S3-3, Gradually reduce the weight of privacy in stages and achieve a smooth forgetting.

[0024] Preferably, step S4 includes the following steps:

[0025] S4-1. Construct an evaluation system that includes privacy leakage rate, privacy inference rate, link exposure rate, and utility retention rate to evaluate the forgotten model;

[0026] S4-2. Regarding the privacy leakage rate, first construct a vector containing real privacy attributes for each user, for example:

[0027] During the evaluation phase, the model is presented with queries or requests for explanations regarding privacy exposures, and its text output is collected. Subsequently, a separate privacy information extractor automatically converts the model's responses into a structured set of privacy attributes, denoted as:

[0028]

[0029] Next, we define the "privacy leakage rate" to quantify how much private information the model reveals in its output. This metric calculates the proportion of correctly disclosed private attributes in the model output out of all truly sensitive attributes:

[0030]

[0031] Where I represents the user's true privacy set; Î represents the privacy set extracted from the model output; I∩Î represents the privacy-related information correctly stated by the model; and |∙| represents the number of elements in the set, not its absolute value. The privacy leakage rate measures whether the model still leaks sensitive user information that should have been forgotten.

[0032] S4-3. Regarding the privacy inference rate, the model's response, after being processed by an independent privacy extractor, yields a set of privacy attributes that it actively provides, denoted as:

[0033]

[0034] These attributes are not in the real privacy set I, therefore they belong to the model's inference.

[0035] Then, divide the number of all privacy attributes inferred by the model by the total number of query rounds that could lead to the inference to obtain the privacy inference rate:

[0036]

[0037] in, This represents the set of privacy inferences given by the model in the absence of evidence; This indicates the total number of test queries. The privacy inference rate assessment evaluates whether the model actively guesses about user privacy when lacking evidence, by providing the model with queries that do not contain sensitive information or deliberately omit privacy clues.

[0038] S4-4. For the link exposure rate, input the recommendation explanation text or inference link given by the model into an independent privacy extractor to extract the set of indirect privacy clues that may be contained therein, denoted as:

[0039]

[0040] in, This represents the set of privacy-related fragments exposed by the model in the explanation link or recommendation reason. These clues can point to the user's privacy attributes through semantic association, context inference or implicit hints. Although they do not appear directly in the real privacy set I, they may still be used to infer sensitive information from external sources and belong to potential link exposure.

[0041] Subsequently, the link exposure rate is calculated as the ratio of the number of exposed clues to the total number of explained link outputs, using the following formula:

[0042]

[0043] in, This indicates the number of privacy-exposure clues that appear in the recommendation text or inference chain of the model. This indicates the number of times all detected explanation links or reasoning outputs are displayed. The link exposure rate reflects the risk of implicit privacy leaks by the model in the inference chain, and is used to determine whether the model still indirectly exposes user privacy through explained text or logical paths.

[0044] S4-5. Regarding utility retention rate, let the recommended performance metric before forgetting be: The indicators after forgetting treatment are The utility retention rate is defined as the ratio of the two:

[0045]

[0046] Utility retention rate measures how much effective recommendation ability a model can retain after forgetting privacy memories;

[0047] S4-6. Based on the constructed indicator system, test and quantitatively analyze the model after the execution forgetting to determine whether the privacy forgetting is sufficient and whether the recommendation performance remains stable.

[0048] S4-7. When the detected index is within the set threshold range, the model is further adjusted through local pruning or parameter rollback strategies to achieve closed-loop optimization of the forgetting effect.

[0049] Through the above steps, this invention can accurately and securely remove private knowledge while ensuring the core recommendation capabilities of the model, thereby achieving regulatory and traceable privacy control capabilities.

[0050] The beneficial effects of this invention are:

[0051] 1) By using privacy feature decoupling and structured pruning strategies, this invention effectively reduces the residual degree of privacy memory within the model, avoids the superficial forgetting phenomenon caused by relying solely on output behavior suppression, and achieves substantial forgetting of the representation layer within the model;

[0052] 2) Compared with gradient ascent or distillation methods, this invention can keep the recommendation effect stable before and after forgetting by using local parameter pruning and non-privacy knowledge preservation mechanism, thereby improving utility retention rate and model robustness.

[0053] 3) By constructing a shared weight influence model, this invention can achieve hierarchical forgetting of cross-domain privacy information in multiple domains and recommendation systems, thus avoiding the spread of privacy across different domain scenarios;

[0054] 4) Through indicator feedback and dynamic adjustment mechanisms, this invention can achieve the verifiability, repeatability and traceability of forgetting effects, providing a technical foundation for the compliant deployment of recommendation systems. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the overall process of the privacy memory forgetting method for a recommendation system driven by a large language model according to the present invention;

[0056] Figure 2 This is a schematic diagram of the privacy and non-privacy semantic decoupling structure of the large language model of this invention;

[0057] Figure 3 This is a schematic diagram of the privacy parameter location and structured pruning module of the present invention;

[0058] Figure 4 This is a structural diagram of the progressive forgetting strategy in the multi-domain recommendation scenario of the present invention;

[0059] Figure 5 This is a schematic diagram of the training-forgetting-evaluation closed-loop feedback mechanism of the present invention. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] Please see Figures 1-5 This invention provides a technical solution: a method for selective forgetting of privacy-preserving memories in a large language model-driven recommendation system, such as... Figure 1 As shown, the method consists of three parts: a privacy information decoupling stage, a multi-domain progressive forgetting stage, and a privacy forgetting effect evaluation stage. This is used to achieve the ability to locate, operate, and evaluate privacy knowledge within the model, and to complete the forgetting of privacy memories without completely retraining the model.

[0062] 1) Privacy-prepared phase based on semantic decoupling.

[0063] In this stage, the present invention adjusts the representation learning process of the large language model to create separable privacy feature representation regions within the model, thereby supporting subsequent selective privacy memory forgetting. The specific implementation process is as follows:

[0064] 1-1) Establish privacy-related and non-privacy-related feature representation constraints and update the parameters of the model's encoding layer: During training, the data structure itself is not modified. Instead, the training corpus is input into the model, and the initial semantic representation is generated through the model's existing encoding structure. Then, based on the predefined privacy label, differential constraints are applied to the model's hidden layer activation and gradient update process, so that the model gradually forms an internal representation structure that distinguishes between privacy and non-privacy features during the optimization process.

[0065] 1-2) Introducing contrastive loss to adjust model parameters, causing privacy features to converge towards specific regions in the representation space: By introducing a contrastive loss constraint conditioned on privacy labels, the model automatically increases the distance between privacy feature vectors and non-privacy feature vectors in the representation space during each backpropagation. This operation is directly reflected in the adjustment of the model parameter update direction, causing parameters related to privacy features to exhibit clustering during the optimization process, thereby forming an identifiable privacy feature subspace;

[0066] 1-3) Forming an operable privacy feature set region within the model to provide parameter localization basis for subsequent targeted forgetting: After completing the above training, the model forms a stable privacy feature set region in the hidden layer activation distribution, parameter gradient distribution and feature clustering structure in the high-dimensional representation space. The parameter weights corresponding to this region have consistent sensitivity characteristics in the model and can be used as the direct target for subsequent pruning, suppression or deletion operations.

[0067] This invention does not rely on additional processing of training data. Instead, it optimizes the path by adjusting the internal parameters of the model and constructs a separable privacy representation region in the representation layer. This makes privacy knowledge identifiable, locatable, and operable, providing an effective basis for subsequent machine forgetting.

[0068] 2) Gradual forgetting execution phase in multi-domain recommendation scenarios.

[0069] Based on the privacy representation localization capability obtained in step 1), this stage utilizes a structured pruning strategy to selectively remove privacy parameters, allowing the model to forget privacy content while maintaining stable general capabilities. The specific execution process is as follows:

[0070] 2-1) Conduct an importance analysis on the parameters related to the privacy subspace to determine the set of parameters where privacy features are dominant;

[0071] 2-2) While keeping the non-privacy parameters stable or fine-tuning with a low learning rate, perform structured pruning or weight reduction on the privacy parameters to gradually decay the privacy memory.

[0072] 2-3) In the multi-domain recommendation framework, a phased and gradual forgetting method is adopted according to the degree of dependence of different domains on shared parameters to avoid a cliff-like drop in task performance caused by a large-scale pruning at once;

[0073] 2-4) When insufficient forgetting effect is detected in a certain domain, a cross-domain weight adjustment mechanism can be triggered to make the forgetting process proceed smoothly.

[0074] This stage enables the model to achieve controllable, targeted, and gradual privacy forgetting, strengthens the ability to withdraw privacy, and retains effective recommendation performance.

[0075] 3) Evaluation and closed-loop optimization of privacy forgetting effects.

[0076] To verify whether privacy memories have been completely erased, this embodiment constructs a multi-indicator comprehensive evaluation system, including but not limited to:

[0077] 3-1) Privacy Leakage Rate (PLR): This measures the probability that private content will be explicitly present in the model output;

[0078] 3-2) Privacy Inference Rate (IPR): This assesses whether the model will actively guess or recover private information when privacy input is lacking;

[0079] 3-3) Link Exposure Rate (CER): Detects whether there are hidden privacy leakage risks remaining in the explanation links or reasoning of model recommendations;

[0080] 3-4) Utility retention rate (UR): measures the retention of recommendation performance and the original model's capabilities after forgetting.

[0081] When the evaluation results show privacy residue or a decrease in utility exceeding the threshold, this invention can automatically perform local weight rollback or secondary pruning to form a closed-loop optimization path of forgetting-evaluation-iteration, achieving coexistence of privacy memory forgetting and performance stability.

[0082] The specific structure of the privacy information decoupling phase is as follows: Figure 2 As shown, the privacy semantic decoupling module provided by this invention mainly includes an input sample module, a large language model encoding module, a contrastive learning module, and a semantic vector space module.

[0083] 1) The input sample module receives the training corpus of the recommendation system, which includes privacy samples and non-privacy samples after privacy recognition processing. Privacy samples refer to training segments containing user-sensitive attributes, while non-privacy samples are regular training segments that do not involve sensitive content. These two types of samples are respectively input into the large language model encoding module to obtain the corresponding privacy feature vector and non-privacy feature vector.

[0084] 2) The large language model encoding module generates semantic representations of the input text, forms preliminary feature embeddings through the encoding structure of the pre-trained model, and sends the embedding results to the contrastive learning module. The contrastive learning module constructs privacy and non-privacy sample pairs and uses a contrastive loss function to train the semantic distance stretching of the two types of features, so that privacy features and non-privacy features gradually develop a discriminatory relationship in the semantic space.

[0085] 3) In the semantic vector space, two relatively independent feature regions are formed through contrastive learning constraints: a privacy feature subspace and a non-privacy feature subspace. The privacy feature subspace contains vector representations strongly associated with sensitive user information, while the non-privacy feature subspace corresponds to the semantic representations of the model's general knowledge and recommendation capabilities. This differentiated structure allows privacy features within the model to be independently located, thus providing clear operational boundaries for subsequent targeted pruning or parameter deletion of privacy memories.

[0086] Through the above steps, this invention achieves the decoupling of privacy information and non-privacy information in the semantic representation structure within a large language model, avoids the uncontrollability caused by the mixed storage of privacy features and general knowledge, and establishes an implementable foundation for selective forgetting at the model level.

[0087] Immediately afterwards, Figure 3 The privacy parameter localization and structured pruning process in this embodiment of the invention is described below. The selective privacy memory forgetting module in this embodiment of the invention consists of a pre-pruning model module, a privacy parameter localization module, a structured pruning module, and a post-pruning model module.

[0088] 1) Model construction before pruning

[0089] 1-1) Load a pre-trained or fine-tuned large language model, the model including a multi-layer self-attention structure and a feedforward network structure;

[0090] 1-2) Obtain the complete parameter weight matrix W corresponding to the model, which serves as the basis for privacy parameter localization and pruning operations;

[0091] 2) Location of privacy-related parameters

[0092] 2-1) Based on the obtained privacy feature subspace, map the privacy feature vectors to the model parameter space;

[0093] 2-2) Based on the gradient distribution, parameter sensitivity distribution, or semantic contribution of privacy features, perform correlation analysis on the weight matrix W;

[0094] 2-3) Identify the set of parameters highly correlated with privacy features from the weight matrix W, and label them as the privacy-related parameter subset. ;

[0095] 2-4) As the target for subsequent targeted amnesia operations;

[0096] 3) Implementation of structured pruning and weight reduction

[0097] 3-1) To Perform structured pruning operations, including but not limited to channel pruning, attention head pruning, hierarchical pruning, or matrix block pruning, or... The weighting of execution is weakened, which reduces the effective contribution of privacy-related parameters;

[0098] 3-2) Keep non-privacy-related parameters stable or fine-tune them only with a very low learning rate during the pruning process to reduce the impact on the model's general reasoning ability and recommendation performance;

[0099] 4) Obtain the privacy forgetting model after pruning.

[0100] 4-1) The parameters after pruning or weight reduction are reintegrated into the model structure to form a pruned large language model (LLM).

[0101] 4-2) While retaining the recommendation system's functionality and non-privacy semantic capabilities, the pruned model's privacy feature memory is significantly weakened or removed;

[0102] 4-3) Achieve selective privacy memory forgetting effect without full retraining.

[0103] Through the above steps, this invention enables the location-based and controllable removal of privacy-related parameters within the model, avoiding the limitations of traditional data deletion that cannot reach the model representation layer, and providing recommendation systems with efficient, secure, and verifiable privacy forgetting capabilities.

[0104] Then, the following combination Figure 4 The multi-domain progressive forgetting mechanism in the embodiments of the present invention will be described. For example... Figure 4 As shown, the multi-domain progressive forgetting mechanism of this invention mainly includes a multi-domain task input module, a shared parameter layer, a sensitivity evaluation module, a forgetting strategy decision module, and a domain-specific forgetting execution module. It is used to perform differentiated forgetting processing on privacy-related parameters in a multi-domain recommendation system to avoid the uniformity of performance across different domains caused by a single forgetting strategy.

[0105] 1) Obtain multi-domain tasks and determine shared parameters;

[0106] 2) Calculate the sensitivity of the shared parameters and generate a sensitivity matrix;

[0107] 3) Divide parameters according to sensitivity and formulate a graded forgetting strategy;

[0108] 4) Implement differentiated pruning or weight reduction for different domains;

[0109] 5) Achieve smooth and gradual privacy forgetting of shared parameters through multiple rounds of iteration.

[0110] pass Figure 4 The multi-domain progressive forgetting mechanism shown in this invention enables a controllable, hierarchical, and smooth privacy forgetting process under a shared parameter structure. While ensuring the elimination of sensitive information, it minimizes the impact on recommendation performance in non-target domains, further enhancing the interpretability, security, and usability of the recommendation system.

[0111] Finally, as Figure 5 As shown, this invention constructs a closed-loop mechanism of training-forgetting-evaluation to achieve gradual weakening and convergent forgetting of privacy representations within a large language model. This closed-loop process consists of four stages: semantically decoupled training, targeted forgetting execution, forgetting effect evaluation, and backoff optimization.

[0112] 1) Semantic decoupling: Constructing a privacy subspace;

[0113] 2) Targeted forgetting: Pruning or weakening privacy-related parameters;

[0114] 3) Effectiveness evaluation: Evaluate privacy wipe and performance retention using multiple indicators;

[0115] 4) Rollback optimization: If the target is not met, adjust the parameters and forget the previous settings again;

[0116] 5) Convergence Output: The final forgetting model is generated after the indicators meet the requirements.

[0117] pass Figure 5 The closed-loop feedback structure shown in this invention realizes an iterative privacy elimination path of "training-forgetting-evaluation-re-forgetting", so that the forgetting of privacy memories no longer depends on a one-time large-scale deletion or overall retraining, ensuring that the privacy weakening process is controllable, stable and verifiable.

[0118] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0119] Technical effects achieved by the present invention

[0120] Compared to traditional model retraining or output masking methods, this invention can:

[0121] 1) Enables selective removal of privacy memories within the model without retraining the entire model;

[0122] 2) Control the scope and intensity of forgetting to avoid inadvertently damaging general knowledge and maintain stable recommendation effectiveness;

[0123] 3) The forgetting effect is quantified through a multi-indicator system, making the removal of private memories verifiable, measurable, and traceable;

[0124] 4) Supports cross-domain recommendation applications, suitable for scenarios such as education, e-commerce, and content platforms.

[0125] This invention has significant operability, scalability, and privacy governance implications.

Claims

1. A large language model driven recommendation system private memory selective forgetting method, characterized in that, The method comprises the following steps: S1, privacy and non-privacy information semantic decoupling processing; S2, structured pruning selective forgetting strategy; S3, progressive forgetting mechanism in multi-domain recommendation scenarios; S4, privacy forgetting effect evaluation and feedback optimization.

2. The large language model driven recommendation system privacy memory forgetting method according to claim 1, characterized in that: The step S1 comprises the following steps: S1-1, distinguishing privacy samples and non-privacy samples in the training corpus; S1-2, inputting the privacy samples and non-privacy samples into a large language model for encoding to obtain corresponding privacy feature and non-privacy feature representations; S1-3, based on contrastive learning, the privacy features and non-privacy features are semantically trained to make the privacy features form an independent privacy feature subspace.

3. The large language model driven recommendation system private memory forgetting method of claim 1, wherein: The step S2 comprises the following steps: S2-1, according to the privacy feature subspace, the importance of the model parameters is analyzed to determine a privacy-related parameter subset; S2-2, under the condition of keeping the non-privacy parameters stable, the privacy-related parameter subset is executed structured pruning or weight weakening; S2-3, generating an updated model with weakened privacy memory.

4. The large language model driven recommendation system private memory forgetting method of claim 1, wherein: The step S3 comprises the following steps: S3-1, domain sensitivity evaluation of shared parameters; S3-2, determining the forgetting strength of different domains based on sensitivity classification; S3-3, performing progressive forgetting update for each domain according to the forgetting strength.

5. The large language model driven recommendation system private memory forgetting method of claim 1, wherein: The step S4 comprises the following steps: S4-1, evaluating the degree of privacy leakage, privacy inference tendency and link exposure risk; S4-2, calculating the utility retention rate of recommendation performance; S4-3, determining whether to perform rollback and re-forgetting according to the evaluation results.

Images