Prompt reasoning-oriented privacy protection language model reasoning system

Abstract

The invention discloses a privacy protection language model reasoning system facing prompt reasoning. The privacy protection language model reasoning system comprises an efficient parallel matrix multiplication subsystem and a distributed perception layering GeLU subsystem. The efficient parallel matrix multiplication subsystem is used for constructing a load balancing parallel matrix multiplication protocol so as to dynamically allocate calculation tasks according to the calculation capabilities of the client and the server; introducing a slot position rearrangement optimization mechanism to compress useful result slot positions through merging and recovery stages by utilizing a regular mode of coefficients in a result polynomial; and introducing a strategy selection framework to select an optimal decomposition strategy according to different matrix sharing modes, and the distribution perception layering GeLU subsystem is used for dividing a GeLU function into a plurality of segments, each segment adopts segment linear approximation with different precisions, and calculation precisions are adaptively distributed according to client activation value distribution characteristics.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a privacy-preserving language model reasoning system for prompt-based reasoning. Specifically, it relates to a language model reasoning system that supports long-sequence prompts, has low overhead, high accuracy, and simultaneously protects the privacy of service providers and users. Background Technology

[0002] Prompt-based reasoning has become an important application paradigm in modern artificial intelligence, enabling language models to provide advanced capabilities. However, this application paradigm faces serious privacy challenges because prompts contain user instructions, contextual data, and domain-specific knowledge, potentially revealing user intent, trade secrets, and proprietary information. For example, in a medical setting, a prompt might include "Generate treatment plans based on these patient symptoms [confidential medical history]," or in financial consulting, inquire about "Assessing the investment risks of [proprietary portfolio data]."

[0003] To protect privacy, existing privacy-preserving inference systems rely on homomorphic encryption and secure multi-party computation. While these cryptographic techniques provide strong privacy guarantees, they incur significant overhead. Existing solutions face two key bottlenecks: secure matrix multiplication based on homomorphic encryption dominates computational overhead, and activation functions based on secure multi-party computation dominate communication overhead. This overhead problem becomes more severe as the complexity and length of hints increase.

[0004] State-of-the-art privacy-preserving systems can only handle sequences with 128 tags, and processing cues with 1024 tags takes 6 to 37 hours. This represents a significant limitation, as real-world cue-based applications require hundreds to thousands of tags. Therefore, the main technical challenges facing existing technologies include: the computational complexity of matrix multiplication in homomorphic encryption increases dramatically with sequence length; existing methods are trapped in a one-sided computation paradigm, where one side performs all computation while the other remains idle; and activation function approximation methods allocate equal resources across all segments without considering data density distribution. Summary of the Invention

[0005] To overcome the shortcomings of the prior art, this invention provides a privacy-preserving language model reasoning system for prompt-based reasoning. Through the cooperation of an efficient parallel matrix multiplication subsystem and a distributed-aware hierarchical GeLU subsystem, it achieves language model reasoning that supports long-sequence prompts, has low overhead, high accuracy, and simultaneously protects the privacy of service providers and users.

[0006] According to one aspect of the present invention, a privacy-preserving language model reasoning system for prompting reasoning is provided, comprising an efficient parallel matrix multiplication subsystem and a distributed-aware hierarchical GeLU subsystem; The efficient parallel matrix multiplication subsystem is used to construct a load-balanced parallel matrix multiplication protocol to dynamically allocate computing tasks based on the computing capabilities of both the client and the server; it introduces a slot rearrangement optimization mechanism to utilize the regularity of coefficients in the result polynomial to compress useful result slots through merging and recovery phases; and it introduces a strategy selection framework to select the optimal decomposition strategy based on different matrix sharing modes. The distributed-aware hierarchical GeLU subsystem is used to divide the GeLU function into multiple segments, each segment adopts a segmented linear approximation with different precision, and adaptively allocates the calculation precision according to the distribution characteristics of client activation values.

[0007] The aforementioned system is applied between the client and the server to protect the privacy of both parties. The server possesses language model parameters and participates in inference calculations; these model parameters are the server's privacy. The client possesses input prompts containing sensitive information and inference outputs, which are considered private data.

[0008] In the above technical solution, the efficient parallel matrix multiplication subsystem performs matrix multiplication operations through a bilateral collaborative computing paradigm, achieving load-balanced parallel computing while protecting the server's language model parameters and the client's input data. The distributed-aware hierarchical GeLU subsystem adaptively allocates computational precision based on the distribution characteristics of activation values, protecting client activation values. It uses fine-grained segmentation approximation for high-density regions and coarse-grained segmentation approximation for low-density regions, minimizing communication overhead while maintaining computational accuracy.

[0009] Furthermore, the efficient parallel matrix multiplication subsystem includes: a load-balanced parallel matrix multiplication protocol, a slot reordering optimization mechanism, and a strategy selection framework. The load-balanced parallel matrix multiplication protocol involves the client inputting a matrix. Server input matrix Based on the computing power of both parties and Dynamically allocate computational tasks and output secret sharing shares.<A·B> The slot rearrangement optimization mechanism utilizes the regularity of coefficients in the result polynomials to compress useful result slots through merging and recovery phases, reducing the number of polynomials and thus lowering communication overhead. The strategy selection framework selects the optimal decomposition strategy based on different matrix sharing modes: columnar decomposition is selected for left matrix sharing scenarios, row-matrix decomposition for right matrix sharing scenarios, and dynamic selection based on parameter relationships for no-sharing scenarios.

[0010] For a load-balanced parallel matrix multiplication protocol, given a matrix (Holded by the client) and (Holded by the server), calculate C = A·B. Existing methods divide the input into smaller chunks using a one-sided computation paradigm, then one party encrypts and sends it to the other, while the receiver performs all homomorphic operations while the other remains idle. This invention proposes a parallel perceptual matrix multiplication protocol that decomposes the ⊠ operation into parallelizable subtasks, allowing both parties to compute in parallel to reduce runtime.

[0011] As a further technical solution, the load-balanced parallel matrix multiplication protocol employs a balanced task allocation strategy in a homogeneous computing environment, including three decomposition methods: row-based decomposition, column-based decomposition, and depth-based decomposition. Represent homomorphic addition, homomorphic multiplication, and homomorphic subtraction respectively: Row-wise decomposition: Vertical partitioning enables parallel row block computation, server computation α> ⌈m' / 2⌉; Client-side calculation , α ≤ ⌈m' / 2⌉; Column decomposition: Horizontal partitioning enables parallel column block computation, server computation , γ> ⌈k' / 2⌉; Client-side calculation , γ ≤ ⌈k' / 2⌉; Depth decomposition: Inner dimension partitioning enables parallel reduction across contraction metrics, server computation Client-side computing .

[0012] As a further technical solution, the load-balanced parallel matrix multiplication protocol adopts a load-balanced parallel execution mechanism in a heterogeneous computing environment.

[0013] Preferably, the load balancing parallel execution mechanism includes two components: real-time capacity reporting and adaptive task scheduling. The client and server continuously report the current computing speed. and According to the agreement and The ratio dynamically adjusts the matrix multiplication task allocation. Specifically, the client and server adaptively allocate computation tasks by adjusting the polynomials that need to be encrypted and transmitted, with a total of m'n'k' operations, allocated proportionally: the client executes... The specific calculation steps for proportions include: Step A1: The client and server divide and encode the input matrix; Step A2: Based on real-time computing power ratio and Determine the task allocation ratio, encrypt and send the ciphertext; Step A3: Both parties perform homomorphic multiplication in parallel, and the server calculates... , For matrix A, the first... Block matrix, Client-side computing

[0014] Step A4: Both parties add random masks to the calculation results and send them to each other; the server sends... The client sends the masked ciphertext result. , A random mask polynomial generated for the server; Step A5: Both parties decrypt and combine the mask to recover the final secret sharing result. and .

[0015] As a further technical solution, the three strategies for implementing the load balancing parallel execution mechanism are as follows: LPEE1 strategy: When determining the task allocation ratio based on real-time computing capacity, and encrypting and sending ciphertext, the client sends... ( ) to the server, the server sends all For the client; when both sides perform homomorphic multiplication operations in parallel, the server calculates... Scope, client-side computation Scope; When both parties decrypt and combine the mask to recover the final secret sharing result, a vertically spliced ​​recovery matrix is ​​used; LPEE2 strategy: When both parties perform homomorphic multiplication in parallel, the client sends all... Send to the server, the server sends ( The server calculates the result and sends it to the client; when both parties add a random mask to the calculation result and send it to each other, the server calculates the result. Scope, client-side computation Scope; When both parties decrypt and combine the mask to recover the final secret sharing result, a horizontally spliced ​​recovery matrix is ​​used; LPEE3 strategy: When both parties are performing homomorphic multiplication in parallel, the client sends... ( ) to the server, the server sends ( The server calculates the result and sends it to the client; when both parties add a random mask to the calculation result and send it to each other, the server calculates the result. Scope, client-side computation Scope: When both parties decrypt and combine the mask to recover the final secret sharing result, an additive merging recovery matrix is ​​used.

[0016] As a further technical solution, the slot rearrangement optimization mechanism, in the merging stage, interleaves the useful values ​​of multiple sparse ciphertexts to fill the gaps and generate gapless dense ciphertexts; in the recovery stage, the matrix is ​​correctly recovered through the designed decoding algorithm.

[0017] Preferably, the slot rearrangement mechanism addresses the problem of increased communication costs caused by sparse useful coefficients and gaps in the resulting polynomial. By observing that the gap between slots for each pair of useful coefficients is always the same, two main stages are designed: merging and recovery. The merging stage interleaves the useful values ​​of multiple sparse ciphertexts to fill the gaps and generate gapless dense ciphertext. The recovery stage correctly recovers the matrix using a specially designed decoding algorithm. The specific implementation steps include: Step B1: Identify sparsity patterns and observe that there are fixed gaps between the useful coefficients in the resulting polynomials. Each polynomial is only in position This contains useful values. Size of the column block window; Step B2: Perform the merge operation, and... Sparse and dense text by size Grouping, Let these represent the number of rows and columns of the input matrix, respectively. A recursive merge function is then applied. :when Time return , This indicates the first ciphertext; otherwise, it is calculated. and , Indicate the slot ciphertext interval parameter, and then output. It is a homomorphic automorphism function; Step B3: Perform the recovery operation, recovering the original matrix from the merged dense polynomial using a specialized decoding algorithm for each block. and matrix position Calculate the index From polynomial coefficients China Resumption , Representing a polynomial middle The coefficient of the power. Let represent the i-th row and j-th column of the t-th block in matrix C.

[0018] As a further technical solution, the strategy selection framework selects the optimal decomposition strategy based on different matrix sharing modes and computational environment parameters. Specific implementation steps include: Step C1: Matrix sharing pattern recognition, analyze the matrix reuse pattern of the current computing task: left matrix sharing scenario (multiplication of the same input matrix with multiple weight matrices), right matrix sharing scenario (multiplication of multiple input matrices with the same weight matrix), and no sharing scenario (dynamic matrix changes). Step C2: Evaluate environmental parameters, measure and record the real-time computing capabilities of the client and server. and Computing power is higher than ; Step C3: Policy cost analysis, calculate the communication overhead of the three policies: LPEE1 cost is The cost of LPEE2 is The cost of LPEE3 is ; Step C4: Optimal strategy selection. Determine the strategy based on the sharing mode: LPEE2 is selected for the left matrix sharing scenario, LPEE1 is selected for the right matrix sharing scenario, and the critical point is compared for the no-sharing scenario. , , Choose the optimal strategy.

[0019] As a further technical solution, in scenarios without data sharing, When choosing the LPEE1 strategy, When choosing the LPEE3 strategy, Choose the LPEE2 strategy.

[0020] As a preferred approach, for the distributed-aware hierarchical GeLU protocol, it was observed that the GeLU input values ​​exhibit a highly non-uniform distribution and sharp concentration, with most activation values ​​clustered in the central segment while extrema are sparse. Based on this, a multi-segment hierarchical structure is designed, assigning a fine-grained linear approximation to high-density segments to maximize accuracy, and using a coarse-grained linear approximation for sparse segments to minimize communication costs. This is achieved by dividing the GeLU function into five segments, each employing a segmental linear approximation of varying precision: Segment 5 (extreme negative interval): use ,because For extremely negative values; Segmentation 3 (Outer Interval): Sparse Segmentation A coarse-grained approximation using the precision parameter s_3; Segment 2 (Middle Section): Medium-Density Segmentation Use precision parameters The medium-grain size approximation; Segment 1 (Core Area): High-Density Segmentation Use precision parameters The fine granularity approximation; Segmentation 4 (near-linear interval): Use y = x because GeLU(x) ≈ x for large positive values.

[0021] The specific implementation steps include three stages: Phase 1: Data preparation, local computation on the client and server ,in For domain offset boundary parameters, This is the input value of the d-th GeLU (after domain shifting). , This represents the i-th segment boundary of the d-th GeLU layer; Stage 2: Linear approximation calculation, extracting for each segment i∈[3] low Position obtained , Extracting high using the truncation protocol Position obtained The slope and intercept values ​​are obtained through a secure lookup table protocol. And <η_i>, calculate the linear approximation This is the linear approximation result for the i-th segment. Let be the slope of the i-th approximate straight line. Let be the intercept of the i-th approximate straight line; Phase 3: Security Determination, using a secure comparison protocol for calculation. Determine the position of the input relative to each boundary, and generate a mutual exclusion segmentation indicator through an XOR operation. Use the secure multiplexer protocol Choose an appropriate approximation value and output the GeLU result. , This represents the comparison result bit at the i-th boundary. This is the output result of the multiplexer for the i-th segment.

[0022] As a further technical solution, the system adopts a two-way secure computation model, where the client holds a prompt input X containing sensitive information, and the server holds language model parameters M, through an inference protocol. The generated prediction result y is delivered to the client, ensuring that the client's input sequence is kept confidential from the server during the inference process, and that the server's model parameters are kept confidential from the client. This means the server does not retrieve information other than the inference result. This indicates the inference protocol.

[0023] According to one aspect of the present invention, a client or server is provided, configured with the aforementioned privacy-preserving language model reasoning system for prompt-based reasoning.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention designs a privacy-preserving cue word inference system, in which the client's input data and the server's model parameters are protected, and it overcomes the sequence length limitation: through efficient parallel computing and communication optimization, the supported sequence length can be extended from 128 tags to much longer. The system incorporates an efficient parallel matrix multiplication protocol and a secure Gaussian error linearization protocol. Compared with previous technologies, this invention achieves privacy-preserving cue word inference with low time overhead, low communication overhead, and high accuracy.

[0025] 2. The system of this invention supports hinted reasoning that extends from 128 tags to longer sequences. It breaks through the sequence length limitation of existing privacy-preserving inference systems through parallel computing paradigms and communication optimization techniques, achieving a 2.7x improvement in runtime performance and a 3.5x reduction in communication overhead, while maintaining a plaintext baseline accuracy of 93-99% in standard natural language processing benchmark tests. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is an overall framework diagram of the privacy-preserving language model reasoning system for prompt-based reasoning according to an embodiment of the present invention;

[0028] Figure 2 This is a theoretical runtime analysis diagram of the load balancing parallel processing and the traditional one-sided method in an embodiment of the present invention;

[0029] Figure 3 This is an example diagram of the slot rearrangement method according to an embodiment of the present invention;

[0030] Figure 4 This is a distribution diagram of activation values ​​in the distributed sensing hierarchical GeLU protocol according to an embodiment of the present invention. Detailed Implementation

[0031] The terms “comprising” and “having”, and any variations thereof, in the specification, claims, and accompanying drawings of this invention are intended to cover a non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form new technical solutions. Such combinations are not bound by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0033] Please see Figure 1 This embodiment provides a privacy-preserving language model inference system for prompt-based inference, applied between a client and a server. The server possesses the language model parameters and keeps them confidential from the client; the client provides prompt input containing sensitive information and keeps it confidential from the server. During the inference phase of the system, the client encrypts the prompt input containing sensitive information and sends it to the server. The server performs inference calculations using a privacy-preserving protocol, and the resulting inference is delivered to the client. The entire process protects the privacy data of both parties.

[0034] This embodiment describes a privacy-preserving language model reasoning system for prompt-based reasoning, which includes an efficient parallel matrix multiplication subsystem and a distributed-aware hierarchical GeLU subsystem.

[0035] The efficient parallel matrix multiplication subsystem redesigns the coordination of cryptographic primitives and computational resources through a bilateral collaborative computing paradigm, allocating computational tasks between the two parties to achieve parallelization and reduce overall runtime. For homogeneous computing environments, three load balancing strategies are proposed: row-matrix, column-matrix, and deep partitioning matrix operations. For heterogeneous environments, a load balancing execution mechanism with real-time capability reporting and dynamic task scheduling is proposed. To reduce communication overhead, a slot rearrangement optimization mechanism and a strategy selection framework are proposed.

[0036] The distributed-aware hierarchical GeLU subsystem utilizes the flexibility of piecewise linear approximation and the distribution characteristics of GeLU to employ fine-grained short segments for high-density regions to maximize overall accuracy, and coarse-grained long segments for sparse, low-density regions to minimize communication overhead. The protocol also includes layer-specific adaptive parameters that automatically adjust the segmentation strategy based on the distribution characteristics at different network depths.

[0037] Please see Figure 2In one implementation, this embodiment provides an efficient parallel matrix multiplication subsystem, which includes: a load-balanced parallel matrix multiplication protocol, a slot reordering optimization mechanism, and a strategy selection framework.

[0038] In one implementation, for a load-balanced parallel matrix multiplication protocol, the client inputs a matrix... Server input matrix Based on the computing power of both parties and Dynamically allocate computational tasks and output secret sharing shares.<A·B> This agreement breaks through the limitations of the existing unilateral computing paradigm and proposes a bilateral collaborative computing paradigm.

[0039] In one implementation, the protocol provides three load balancing strategies for homogeneous computing environments: Row-based decomposition: Parallel row block computation is achieved through vertical partitioning. The server is responsible for the computation of α > ⌈m' / 2⌉, and the client is responsible for the computation of α ≤ ⌈m' / 2⌉. Column decomposition: Parallel column block computation is achieved through horizontal partitioning. The server is responsible for the computation of γ > ⌈k' / 2⌉, and the client is responsible for the computation of γ ≤ ⌈k' / 2⌉. Deep decomposition: Parallel reduction across contraction metrics is achieved through internal dimension partitioning, with the server and client handling different β ranges respectively.

[0040] In one implementation, the protocol employs a load balancing execution mechanism for heterogeneous computing environments: Real-time capability reports: Clients and servers continuously report current computing speed. and ; Adaptive task scheduling: the protocol is based on and The ratio is dynamically adjusted to allocate tasks, ensuring that both sides complete the calculation simultaneously to minimize the total running time. Specific calculation steps include: Step A1: The client and server divide and encode the input matrix; Step A2: Based on real-time computing power ratio and Determine the task allocation ratio, encrypt and send the ciphertext; Step A3: Both parties perform homomorphic multiplication in parallel, and the server calculates... Client-side computing

[0041] Step A4: Both parties add random masks to the calculation results and send them to each other; the server sends... The client sends ; Step A5: Both parties decrypt and combine the mask to recover the final secret sharing result. and .

[0042] The load balancing execution mechanism includes three specific algorithm implementations: LPEE1 algorithm: In step A2, the client sends... ( ) to the server, the server sends all For the client; in step A3, the server calculates... Scope, client-side computation Scope; Vertical stitching is used to recover the matrix in step A6; LPEE2 algorithm: In step A3, the client sends all Send to the server, the server sends ( (To the client); in step A4, the server calculates...) Scope, client-side computation Scope; Horizontal stitching is used to recover the matrix in step A6; LPEE3 algorithm: In step A3, the client sends... ( ) to the server, the server sends ( (To the client); in step A4, the server calculates...) Scope, client-side computation Range; in step A6, the matrix is ​​recovered by addition.

[0043] Please see Figure 3 This embodiment provides a slot rearrangement optimization mechanism to address the problem of sparse useful coefficients in the result polynomial. Through two stages of merging and restoring, the useful result slots of multiple sparse ciphertexts are compactly rearranged into a gapless dense format, reducing the number of polynomials and thus reducing communication overhead.

[0044] In one implementation, the merging process will Each ciphertext (obtained by the client or server) is first sorted by size. The blocks are grouped. To eliminate gaps between useful values, the number of ciphertexts in each block is equal to the gap size. Specifically, in the input ciphertext, each ciphertext contains... The slots represent the useful values ​​at intervals, leaving space between each pair of useful slots. Each block has a gap. For each block, the MERGETOSINGLE merge function is applied to interleave the useful values ​​of the sparse ciphertext, using the remaining... Fill the slot for the encrypted text A gap is generated, and the output is a gapless dense ciphertext.

[0045] Please see Figure 4This embodiment provides a distributed-aware hierarchical GeLU subsystem, which divides the GeLU function into five segments, each segment using a piecewise linear approximation of different precision: Segment 5 (extreme negative interval): For Use y = 0; Segmentation 3 (Outer Interval): Sparse Segmentation Use coarse-grained approximation; Segment 2 (Middle Section): Medium-Density Segmentation Use a medium-grained approximation; Segment 1 (Core Area): High-Density Segmentation Use fine-grained approximation; Segmentation 4 (near-linear interval): For Use y = x.

[0046] In one implementation, the distributed-aware hierarchical GeLU protocol is implemented through three phases: Phase 1: Data preparation, using domain offsets to avoid negative indexes. Adjust the input; Phase 2: Linear approximation calculation, performing a safe lookup table operation on each segment to obtain an approximate value; Phase 3: Safety determination, the final output is determined through safety comparison and multiplexers.

[0047] In one implementation, the system was comprehensively evaluated on the GPT-2 model, covering three standard datasets: WNLI, CoLA, and SST-2. Experimental results show that SecurePrompt achieves significant performance improvements on input sequences from 128 to longer: a 2.7x speedup compared to Iron, and 3.1x and 3.6x speedups compared to Bumblebee and Bolt, respectively; communication overhead is reduced by 3.5x compared to Iron, and by 3.0-3.2x compared to other baselines; accuracy remains at 93-99% of plaintext baselines.

[0048] Based on the same inventive concept as the foregoing embodiments, this embodiment of the invention also provides a client or server configured with the aforementioned privacy-preserving language model reasoning system for prompt-based reasoning.

[0049] In summary, the present invention can provide:

[0050] 1. Supports privacy-preserving inference with long sequence hints: Breaks through the existing 128-mark limit and supports practical application scenarios with hundreds to thousands of marks.

[0051] 2. Efficient bilateral collaborative computing paradigm: Make full use of the computing resources of both parties to achieve true load-balanced parallel computing.

[0052] 3. Distribution-aware adaptive precision allocation: Intelligent allocation of computing resources based on the distribution characteristics of activation values, minimizing communication overhead while ensuring accuracy.

[0053] It should be understood that any parts not described in detail in this specification belong to the prior art.

[0054] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A privacy-preserving language model reasoning system for prompt-based reasoning, characterized in that, Includes a high-efficiency parallel matrix multiplication subsystem and a distributed-aware hierarchical GeLU subsystem; The high-efficiency parallel matrix multiplication subsystem is used to construct a load-balanced parallel matrix multiplication protocol to dynamically allocate computing tasks based on the computing capabilities of both the client and the server. A slot rearrangement optimization mechanism is introduced to utilize the regularity pattern of coefficients in the result polynomial and compress useful result slots through merging and recovery phases. Furthermore, a strategy selection framework is introduced to select the optimal decomposition strategy based on different matrix sharing patterns; The distributed-aware hierarchical GeLU subsystem is used to divide the GeLU function into multiple segments, each segment adopts a segmented linear approximation with different precision, and adaptively allocates the calculation precision according to the distribution characteristics of client activation values.

2. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 1, characterized in that, The load-balanced parallel matrix multiplication protocol adopts a balanced task allocation strategy in a homogeneous computing environment, including three decomposition methods: row decomposition, column decomposition, and depth decomposition.

3. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 2, characterized in that, The load-balanced parallel matrix multiplication protocol employs a load-balanced parallel execution mechanism in a heterogeneous computing environment.

4. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 3, characterized in that, The three strategies for implementing the load balancing parallel execution mechanism are as follows: LPEE1 strategy: When determining the task allocation ratio based on real-time computing power, and encrypting and sending ciphertext, the encrypted polynomial block sent by the client to the server is... , , is the row block index of the block in matrix A. It is the index of the intermediate dimension of the matrix partition. It's client-side encryption. It is the size of the block window of matrix A. This is the total number of rows and blocks in matrix A. The server sends all... For the client; when both sides perform homomorphic multiplication operations in parallel, the server calculates... Scope, client calculate Scope; When both parties decrypt and combine the mask to recover the final secret sharing result, a vertically spliced ​​recovery matrix is ​​used; LPEE2 strategy: When both parties perform homomorphic multiplication in parallel, the client sends all... The encrypted polynomial block sent by the server to the client is... , It is the column block index of the matrix partitioning. It's server-side encryption. When both parties add a random mask to the calculation results and send them to each other, the server calculates... scope, This is the total number of column blocks in matrix B, calculated by the client. Scope; When both parties decrypt and combine the mask to recover the final secret sharing result, a horizontally spliced ​​recovery matrix is ​​used; LPEE3 strategy: When both parties are performing homomorphic multiplication in parallel, the client sends... Give to the server, , This represents the common parameters of the block windows for matrices A and B. It is the number of common dimension blocks of matrices A and B, sent by the server. For the client, When both parties add a random mask to the calculation results and send them to each other, the server calculates... Scope, client-side computation Scope: When both parties decrypt and combine the mask to recover the final secret sharing result, an additive merging recovery matrix is ​​used.

5. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 1, characterized in that, The slot rearrangement optimization mechanism, in the merging stage, interleaves the useful values ​​of multiple sparse ciphertexts to fill the gaps and generate gapless dense ciphertexts; in the recovery stage, the matrix is ​​correctly recovered through the designed decoding algorithm.

6. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 4, characterized in that, The implementation of the strategy selection framework is as follows: Analyze the matrix reuse patterns of the current computing task: left matrix sharing scenario, right matrix sharing scenario, or no sharing scenario; Measure and record the real-time computing power of the client and server. and Computing power is higher than ; Calculate the communication overhead for the three strategies: the cost of strategy LPEE1 is... Let m, n, and k represent the number of rows in matrix A, the number of rows in matrix B, and the number of columns in matrix B, respectively. Given the block window size, the cost of the LPEE2 strategy is... The cost of the LPEE3 strategy is ; The strategy is determined based on the sharing pattern: LPEE2 strategy is selected for left matrix sharing scenarios, LPEE1 strategy is selected for right matrix sharing scenarios, and critical points are compared for no sharing scenarios. , , Choose the optimal strategy.

7. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 6, characterized in that, In scenarios without sharing, When choosing the LPEE1 strategy, When choosing the LPEE3 strategy, Choose the LPEE2 strategy.

8. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 1, characterized in that, The distributed sensing hierarchical GeLU subsystem divides the GeLU function into five segments, where: It is the upper boundary of the extreme negative value segment; The lower boundary of the outer sparse segment, It is the lower boundary of the middle layer and the upper boundary of the core layer; It is the upper boundary of the core segment and the upper boundary of the middle segment; It is the upper boundary of the outer sparse segment; It represents the lower boundary of the extreme positive value segment; y is the output of the GeLU function; x is the input of the GeLU function; the five segments include: Extreme negative interval: for use ; Outer interval: sparse segmentation Use coarse-grained approximation; Middle section: Medium-density segmentation Use a medium-grained approximation; Core area: High-density segmentation Use fine-grained approximation; Nearly linear intervals: for Use y = x.

9. The privacy-preserving language model reasoning system for prompt-based reasoning according to claim 1, characterized in that, The system employs a two-way secure computation model. The client holds a prompt input containing sensitive information, while the server holds language model parameters. The system generates a prediction result through an inference protocol and delivers it to the client. During the inference process, the client's input sequence is kept confidential from the server, and the server's model parameters are kept confidential from the client.

10. A client or server, characterized in that, A privacy-preserving language model reasoning system configured with prompt-oriented reasoning as described in any one of claims 1-8.

Images