Differential privacy method for preventing leakage of large model training data
By employing a three-dimensional collaborative differential privacy mechanism and dynamic adaptation, the problems of data leakage, privacy-performance conflict, and insufficient distributed collaboration in large model training are solved, achieving privacy protection and performance improvement throughout the entire process and in multiple scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING ADVANCED COMPUTING IND DEV CO LTD
- Filing Date
- 2025-12-12
- Publication Date
- 2026-05-12
AI Technical Summary
Existing technologies suffer from data leakage risks during large model training, have limited protection layers, exhibit significant conflicts between privacy protection and performance, lack cross-node collaboration in distributed scenarios, and have incomplete risk verification.
A three-dimensional collaborative differential privacy mechanism is adopted. Nodes are authenticated through the SM4 symmetric encryption algorithm, a global noise seed is generated, feature binning and sign-consistent Laplacian noise processing are performed, K-means clustering and Gaussian noise reduction are combined, privacy budget is dynamically allocated, and multimodal risk verification is carried out.
It achieves full-process, multi-scenario privacy protection, reduces data value destruction, improves model accuracy and convergence speed, reduces false judgment rate, and adapts to the needs of sensitive fields such as medical care and finance.
Smart Images
Figure CN122020701A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of large-scale artificial intelligence model security technology, and in particular to a differential privacy method for preventing the leakage of large-scale model training data. Background Technology
[0002] With the development of artificial intelligence technology, large models, represented by the Transformer and GPT series, rely on massive amounts of training data to achieve high performance. This data often contains sensitive information such as user privacy information (e.g., medical records, financial credit information) and core corporate data. However, there is a significant risk of data leakage during the training of large models. Attackers can use member inference attacks to determine whether a sample belongs to the training set, use model extraction attacks to infer training data features from parameters, and even use model inversion attacks to reconstruct the original input (e.g., medical images, facial data). Such leaks can easily lead to privacy and security incidents.
[0003] Current mainstream protection solutions are mainly based on traditional differential privacy (DP), but they have obvious limitations: First, the protection layer is single. Most solutions only apply DP at the data layer (such as adding noise to the original data) or the model layer (such as adding noise to the gradient), which cannot defend against multiple types of attacks at the same time. For example, protecting only the data layer is difficult to prevent leakage caused by back-inference of model parameters. Second, there is a prominent contradiction between privacy and performance. To meet the high privacy requirements, a lot of noise needs to be added, which leads to a 15%-30% decrease in model convergence speed and a significant reduction in prediction accuracy, making it difficult to adapt to the high performance requirements of large models. Third, the parameter settings are rigid. The definition of sensitive fields and the noise intensity are mostly fixed values, which cannot be dynamically adjusted according to the data characteristics, and are prone to "over-protection" or "under-protection".
[0004] The rise of distributed training scenarios (such as federated learning) has further exacerbated the protection challenges: existing solutions lack cross-node privacy collaboration mechanisms, gradient and parameter transmission between nodes are vulnerable to man-in-the-middle attacks, and the data distribution of different nodes varies greatly, making it difficult for a single noise mechanism to adapt to all nodes; at the same time, privacy budget allocation often adopts a fixed ratio (such as 40% for the data layer and 50% for the model layer), without considering the "dynamic changes in data sensitivity" (such as a batch containing a large number of sensitive samples) and "fluctuations in model training state" (such as large gradient magnitudes in the early stage) during training, resulting in insufficient budget in critical stages and wasted budget in non-critical stages, and risk verification only covers member inference and model extraction, without involving model inversion attacks, resulting in a high false positive rate.
[0005] To address this issue, we provide a differential privacy method to prevent the leakage of large model training data. Summary of the Invention
[0006] The purpose of this invention is to provide a differential privacy method to prevent the leakage of large model training data. By combining a three-dimensional collaborative differential privacy mechanism with dynamic adaptation and risk closed-loop verification, it solves the problems of single protection level, difficulty in balancing privacy protection and model performance, insufficient cross-node collaboration and incomplete risk verification in distributed scenarios in existing technologies.
[0007] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:
[0008] This invention provides a differential privacy method to prevent leakage of large model training data, comprising the following steps: Step a: N nodes participating in the training complete key negotiation and generate unique identifiers through the SM4 symmetric encryption algorithm; only authenticated nodes access the training; the central server generates a global noise seed and distributes it to each authenticated node through a TLS 1.3 encrypted channel; each node generates local cooperative noise based on the seed, and the magnitude of the local noise is calculated according to the following formula:
[0009] = × ;
[0010] Step b: Perform feature binning on the data. Continuous features are divided into intervals according to semantics, while discrete features retain their original categories; calculate the dynamic sensitivity of each sample: ;
[0011] Step c: Add sign-consistent Laplacian noise to sample features to generate a privacy-preserving dataset; Step e: Train a large model based on the privacy-preserving dataset. In each training round, perform K-means clustering on the gradient set, replacing all gradients within the cluster with the gradient of the cluster center to achieve noise reduction; Perform L2 norm pruning on the denoised gradients according to a dynamic threshold, and add Gaussian noise to the pruned gradients. The noise variance is positively correlated with the pruning threshold and gradient magnitude, and negatively correlated with the budget; Update the model parameters through an adaptive optimizer; Step d: Allocate the total privacy budget to the data layer, model layer, federated layer, and risk validation layer, based on the data real-time sensitivity factor and the model training state factor; Step e: Calculate the member inference risk, model extraction risk, and model inversion risk every 50 rounds of training and after training, comprehensively evaluate the privacy risk, and adjust the parameters and retrain if the threshold is exceeded.
[0012] The present invention is further configured such that step a includes a global feature sensitivity, wherein the global feature sensitivity is the maximum value of the local feature sensitivity of each node.
[0013] The present invention is further configured such that the semantic interval division of the continuous feature includes age, income, and image grayscale value; the sensitive fields include medical record number, diagnosis result, credit record, and bank card number.
[0014] The present invention is further configured such that the initial cluster centers of the K-means clustering are determined by the elbow rule, and the adaptive optimizer is AdamW.
[0015] The present invention is further configured such that the budget allocation of the data layer and the model layer is dynamically adjusted according to the sensitivity factor, and the budget of the risk verification layer is not less than 5% of the total budget.
[0016] The present invention is further configured such that the model inversion risk is calculated according to multimodal adaptation rules, and the risk threshold is set according to scenario classification.
[0017] The present invention is further configured such that the large model trained on the privacy-preserving dataset includes Transformer, GPT-3 / GPT-4, BERT, ResNet-50 / ResNet-101, and ViT, and the initial pruning threshold is set. The parameter value is set according to the model parameter size: 1.2 when the parameter size is ≤100M, 1.0 when 100M < parameter size ≤1B, 0.9 when 1B < parameter size ≤10B, and 0.8 when the parameter size is >10B.
[0018] The present invention is further configured such that the federal layer privacy collaboration also includes a node anomaly detection mechanism to remove nodes with abnormal noise distribution or parameter updates.
[0019] The present invention further includes a time decay factor in the dynamic sensitivity calculation: when the sample acquisition time is more than one year from the current training time, Multiply by 1.0 if the data period is less than one year to avoid over-protection of historical data.
[0020] The present invention is further configured such that the failure probability of the Gaussian noise is... Detailed by scenario: Medical imaging model is Financial risk control model is The government data model is The ordinary text model is Total privacy budget Recommended values: 1.2-1.5 for sensitive scenarios (medical / financial), and 0.8-1.0 for general scenarios.
[0021] The present invention has the following beneficial effects:
[0022] 1. The federated layer of this invention solves the problem of cross-node leakage in distributed training through node authentication and noise collaboration, ensuring that data between nodes is not back-introduced; the data layer uses dynamic sensitivity calculation and sign consistency noise to preserve sample semantics while protecting privacy and reducing damage to data value; the model layer uses gradient clustering noise reduction and dynamic pruning to reduce noise interference with model training, achieving comprehensive protection throughout the entire process and in multiple scenarios, and adapting to the needs of sensitive fields such as medical and financial fields.
[0023] 2. The dual-factor budget allocation of this invention dynamically adjusts the budget based on data sensitivity and model training status, avoiding resource waste while ensuring the protection strength of key links; gradient clustering noise reduction and adaptive learning rate design reduce model accuracy loss compared to traditional solutions and improve convergence speed; multimodal risk verification covers three types of core attacks, and comprehensive weighted scoring reduces the false positive rate, ensuring that the model meets compliance requirements. Attached Figure Description
[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below.
[0025] Figure 1 A flowchart illustrating the overall process of a differential privacy method to prevent leakage of training data for large models;
[0026] Figure 2 This is a flowchart of the LDP protection sub-process in a differential privacy method to prevent leakage of training data for large models.
[0027] Figure 3 This is a flowchart of the GDP protection sub-process in a differential privacy method to prevent leakage of training data of large models.
[0028] Figure 4 This is a flowchart of a multimodal privacy risk verification sub-process in a differential privacy method to prevent leakage of large model training data. Detailed Implementation
[0029] The technical solutions of the present invention will be described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, and not all embodiments. Specific Implementation Example 1
[0031] Please see Figures 1-4This invention provides a differential privacy method to prevent leakage of large model training data, comprising the following steps: Step a: N nodes participating in the training complete key negotiation and generate unique identifiers through the SM4 symmetric encryption algorithm; only authenticated nodes access the training; the central server generates a global noise seed and distributes it to each authenticated node through a TLS 1.3 encrypted channel; each node generates local cooperative noise based on the seed, and the magnitude of the local noise is calculated according to the following formula:
[0032] = × Step a also includes global feature sensitivity, the global features
[0033] The sensitivity is the maximum value of the local feature sensitivity of each node;
[0034] Step b: Perform feature binning on the data. Continuous features are divided into intervals according to semantics, while discrete features retain their original categories. The semantic interval division for continuous features includes age, income, and image grayscale values. Sensitive fields include medical record number, diagnosis result, credit record, and bank card number. Calculate the dynamic sensitivity for each sample.
[0035] ;
[0036] Add sign-consistent Laplacian noise to sample features to generate a privacy-preserving dataset; Step c: Train a large model based on the privacy-preserving dataset. In each training round, perform K-means clustering on the gradient set, replacing all gradients within a cluster with the gradient of the cluster center to achieve noise reduction. The initial cluster centers of K-means clustering are determined by the elbow rule. The adaptive optimizer is AdamW. The large model trained on the privacy-preserving dataset includes Transformer, GPT-3 / GPT-4, BERT, ResNet-50 / ResNet-101, and ViT, with an initial pruning threshold. The parameters are set according to the model parameter size: 1.2 for parameter size ≤ 100M, 1.0 for 100M < parameter size ≤ 1B, 0.9 for 1B < parameter size ≤ 10B, and 0.8 for parameter size > 10B. The L2 norm is applied to the denoised gradient using a dynamic threshold, and Gaussian noise is added to the clipped gradient. The noise variance is positively correlated with the clipping threshold and gradient magnitude, and negatively correlated with the budget. The failure probability of Gaussian noise is... Detailed by scenario: Medical imaging model is Financial risk control model is The government data model is The ordinary text model is Total privacy budget Recommended values: 1.2-1.5 for sensitive scenarios, 0.8-1.0 for ordinary scenarios; update model parameters using an adaptive optimizer; Step d: allocate the total privacy budget to the data layer, model layer, federated layer, and risk validation layer, based on the real-time data sensitivity factor and the model training state factor. The budget allocation for the data layer and model layer is dynamically adjusted according to the sensitivity factor, and the budget for the risk validation layer is no less than 5% of the total budget. The dynamic sensitivity calculation also introduces a time decay factor: when the sample collection time is more than 1 year from the current training time, ... Multiply by 1.0 if the data is less than 1 year old to avoid overprotection of historical data; Step e: After every 50 rounds of training and after training, calculate the member inference risk, model extraction risk and model inversion risk, and comprehensively assess the privacy risk. If the threshold is exceeded, adjust the parameters and retrain. The model inversion risk is calculated according to the multimodal adaptation rule. The risk threshold is set according to the scenario level. The federal layer privacy collaboration also includes a node anomaly detection mechanism to remove nodes with abnormal noise distribution or parameter updates. Specific Implementation Example 2
[0038] Please see Figures 1-4 This invention provides a differential privacy method to prevent leakage of large model training data, comprising the following steps: Step a: N nodes participating in the training complete key negotiation and generate unique identifiers through the SM4 symmetric encryption algorithm; only authenticated nodes access the training; the central server generates a global noise seed and distributes it to each authenticated node through a TLS 1.3 encrypted channel; each node generates local cooperative noise based on the seed, and the magnitude of the local noise is calculated according to the following formula:
[0039] = × ;
[0040] in, This refers to the local cooperative noise of the nodes. The global fundamental noise follows a Laplace distribution, and its distribution parameters are determined by the global feature sensitivity and the privacy budget of the federal layer. For nodes Sample size The total sample size across all nodes; this formula ensures that local noise is positively correlated with the node sample size, avoiding excessive noise in small sample nodes; Step b: Local Differential Privacy (LDP) protection for dynamic sensitivity of the data layer: feature binning is performed on the data, continuous features are divided into multiple intervals according to semantics, and discrete features retain their original categories; calculate the dynamic sensitivity of each sample:
[0041] ;
[0042] in, For the dynamic sensitivity of sample x, The feature is based on basic sensitivity (based on historical data statistics). Sen(x) is the sensitivity adjustment coefficient, and Sen(x) is the proportion of sensitive fields in sample x (number of sensitive fields / total number of fields). Sign-consistent Laplacian noise is added to the sample features to generate a privacy-preserving dataset.
[0043] ;
[0044] in, For the first time after adding noise One characteristic, Original features For the first The global mean of each feature. Ensure that the direction of the noise is consistent with the direction of the feature deviation from the mean. For data layer privacy budget, Lap The Laplace distribution function is used; Step c: Model layer gradient clustering for denoising and gradient difference privacy (GDP) protection: A large model is trained based on a privacy-preserving dataset. In each training round, K-means clustering (with 5 clusters) is performed on the gradient set, and the gradients of the cluster centers are used to replace all gradients within the cluster to achieve denoising; L2 norm clipping is performed on the denoised gradients according to a dynamic threshold. The dynamic threshold formula is:
[0045] ;
[0046] in, For the first The cutting threshold of the wheel, The initial threshold (determined by the model parameter scale) is used. For the current training round, For the total number of rounds, The attenuation coefficient is used; Gaussian noise is added to the clipped gradient, and the noise variance is determined according to the following rules:
[0047] ;
[0048] in, The variance is Gaussian noise. Let L2 norm be the gradient after clipping. For model layer privacy budgeting; this rule ensures that noise is positively correlated with the pruning threshold and gradient magnitude, and negatively correlated with the budget; model parameters are updated through an adaptive optimizer, with the optimizer learning rate as follows: ( (Total privacy budget), convergence is accelerated when the budget is sufficient; Step d: "Data-Model" two-factor privacy budget allocation: Calculate the real-time data sensitivity factor (the average proportion of sensitive fields in the current training batch samples) and the model training state factor. (The ratio of the current round's loss value to the initial loss value, with a maximum value of 1); allocate the total budget according to the following formula:
[0049] ;
[0050] ;
[0051] in, For data layer budget, For the model layer budget; for the federal layer budget... (Distributed scenario enabled), the remaining budget is used as the risk verification layer budget, and the budget for each layer is greater than 0; Step e: Multimodal privacy risk verification: Every 50 rounds of training and after training, calculate three types of attack risks: member inference risk (determined by the average accuracy of the judgment of the FGSM adversarial example (perturbation amplitude 0.01) by 3 shadow models); model extraction risk (calculated by weighting the similarity between the attacker's reverse-inferred parameters and the real parameters, and the similarity between the output of the reverse-inferred model and the real model, with each weight being 0.5); model inversion risk (the image modality is determined by the pixel difference rate between the restored image and the original image); the comprehensive risk is calculated according to the following formula:
[0052] ;
[0053] in, For comprehensive risk scoring, Assess risks for members. Extracting risks for the model, For model inversion risk; if (Sensitive scenes) ordinary scenarios After adjusting the weights of the two factors, S1-S4 are re-executed until the risk target is met.
[0054] Specifically, a three-dimensional collaborative protection system of "federation layer + data layer + model layer" is constructed to solve the problem of cross-node leakage in distributed training and to cover the entire process of data preprocessing and model training. This avoids the limitations of single-layer protection in existing solutions. The dynamic sensitivity of the data layer, the dynamic pruning threshold of the model layer, and the two-factor budget allocation can all be adjusted according to data characteristics (proportion of sensitive fields) and training status (loss changes), avoiding "overprotection / underprotection" caused by fixed parameters. The noise of the federation layer is positively correlated with the sample size, the gradient clustering noise reduction of the model layer, and the correlation between the learning rate and the budget reduce the impact of noise on model accuracy and convergence speed. This resolves the contradiction of "privacy improvement must sacrifice performance" in traditional differential privacy. It covers three core attack types: member inference, model extraction, and model inversion. The comprehensive weighted scoring reduces the false positive rate and ensures privacy compliance in sensitive scenarios (medical / financial). Specific Implementation Example 3
[0056] Please see Figures 1-4 Global feature sensitivity:
[0057] ;
[0058] in, For nodes Local feature sensitivity (node) (Maximum feature difference between any two samples in the dataset) The Laplace distribution parameters are ( For the federal layer privacy budget), the calculation rules for global feature sensitivity are clearly defined (taking the maximum local sensitivity of each node), ensuring that the distribution parameters of global basic noise are adapted to the data characteristics of all nodes, avoiding the failure of protection for some nodes due to sensitivity calculation deviations. Global noise is directly linked to the federal layer budget, allowing the federal layer protection strength to be quantitatively adjusted, facilitating flexible setting of protection levels based on the privacy needs of cross-node collaboration. The semantic interval division rules for continuous features are as follows: age is divided into [0-18, 19-35, 36-60, 61+], income is divided into [0-5k, 5k-15k, 15k-30k, 30k+] (unit: yuan / month), and image grayscale values are divided into [0-25, 26-50, ...]. ..., 226-255]; Sensitive fields include medical record number, diagnosis result, credit record, and bank card number; non-sensitive fields include gender and occupation category. Clearly define semantic binning rules for continuous features (e.g., age and income are divided into intervals according to actual business scenarios) to avoid irregular binning disrupting feature correlation and reducing noise interference on sample semantics. Clearly define the specific categories of sensitive / non-sensitive fields (e.g., medical record number and credit record are sensitive fields) to ensure a unified standard for calculating the proportion of sensitive fields, ensuring consistency in dynamic sensitivity calculation and avoiding judgment bias in different scenarios. The initial cluster centers of K-means clustering are determined using the "elbow rule," and the clustering iteration terminates when the L2 distance between the cluster centers of two adjacent rounds is less than... The adaptive optimizer is AdamW, and the weight decay coefficient is... ;then Gradient after clipping:
[0059] , ( To address the issue of gradient denoising after noise reduction, the initial center determination method (elbow rule) and iteration termination condition for K-means clustering are clearly defined to avoid fluctuations in denoising performance caused by random clustering results. This ensures consistency in gradient denoising across each training round. The AdamW optimizer and weight decay coefficient are specified, and combined with gradient clipping rules, the impact of gradient anomalies (such as gradient explosion) on model parameter updates is reduced, making the training process smoother. Specific calculation rules for gradient clipping are added (scaling proportionally when exceeding a threshold) to ensure the effective implementation of dynamic thresholds and avoid protection failures caused by simply setting thresholds without execution logic. The two-factor adjustment constraint is supplemented as follows: when... hour, ;when hour, And the risk verification layer budget For highly sensitive data ( Unstable training phase ( Increase the budget coefficient of the corresponding level (data layer / model layer) to ensure that the core links in key scenarios are more protected. Make sure that the budget for the risk verification layer is no less than 5% of the total budget to avoid insufficient resources for risk verification due to excessive allocation of the total budget to other levels, and ensure the effective operation of the "training and verification at the same time" mechanism. Specific Implementation Example 4
[0061] Please see Figures 1-4 The multimodal adaptation rule for model inversion risk is: text modality ( To restore the text, (For the original text, the higher the BLEU similarity, the higher the risk); audio modality. ( For MFCC feature extraction function, To restore the audio, (Original audio); Risk threshold The risk thresholds are tiered by scenario: 0.08 for financial / medical scenarios, 0.1 for government scenarios, and 0.12 for general internet scenarios. For text and audio modalities, supplementary calculation rules for model inversion risk (BLEU similarity, MFCC feature similarity) are added, allowing the method to cover mainstream large model types such as image, text, and audio. This overcomes the limitation of existing solutions that only adapt to a single modality. The risk thresholds are refined according to scenario (finance / medical, government, general internet), ensuring that the risk assessment criteria align with the privacy requirements of different scenarios (e.g., lower thresholds and stricter requirements in medical scenarios), improving the practicality of the solution. Large models, including Transformer, GPT-3 / GPT-4, BERT, ResNet-50 / ResNet-101, and ViT, are trained on privacy-preserving datasets, with initial cropping thresholds. The pruning threshold is set according to the model parameter size: 1.2 for parameter size ≤ 100M, 1.0 for 100M < parameter size ≤ 1B, 0.9 for 1B < parameter size ≤ 10B, and 0.8 for parameter size > 10B. This explicitly covers mainstream large models such as Transformer, GPT, BERT, ResNet, and ViT, eliminating the need to modify core logic for different models and reducing the cost of cross-model deployment. The initial pruning threshold is set according to the model parameter size (≤ 100M, 100M-1B, etc.) to avoid threshold mismatch caused by parameter size differences (e.g., thresholds that are too high for small-parameter models are meaningless, while thresholds that are too low for large-parameter models lead to over-pruning), ensuring that the pruning effect matches the model type. The federated layer privacy collaboration also includes a node anomaly detection mechanism: the central server monitors each node in real time. Distribution and parameter update magnitude ,like The standard deviation from the mean exceeds 3 times, or Nodes identified as abnormal are removed, and a supplementary node anomaly detection mechanism (monitoring noise distribution and parameter update amplitude) is implemented. This mechanism can promptly identify abnormal nodes (such as malicious nodes tampering with noise or transmitting abnormal parameters), preventing them from disrupting the federated layer's collaborative protection, reducing the risk of cross-node attacks, and removing abnormal nodes in real time. This prevents erroneous data / parameters from abnormal nodes from affecting the training of other nodes, ensuring the continuous and stable operation of the federated training cluster. The dynamic sensitivity calculation also introduces a time decay factor: when the sample collection time is more than one year from the current training time, [the factor is applied]. Multiply by 1.0 for data less than one year old to avoid over-protection of historical data. Introduce a time decay factor (reducing dynamic sensitivity for samples older than one year) to avoid over-protection of historical data with low timeliness. This reduces the amount of noise added to historical data (reducing performance loss) while retaining necessary privacy protection, balancing the "value of historical data" and the "need for privacy protection." Consider the impact of data timeliness on the importance of privacy (e.g., user data from one year ago has lower privacy sensitivity than recent data), making the calculation of dynamic sensitivity more in line with business realities and avoiding a "one-size-fits-all" protection logic. Also consider the failure probability of Gaussian noise. Detailed by scenario: Medical imaging model is Financial risk control model is The government data model is The ordinary text model is Total privacy budget Recommended values: 1.2-1.5 for sensitive scenarios (medical / financial), 0.8-1.0 for general scenarios. Further refine the failure probability by model type (medical imaging, financial risk control, etc.) (minimum value for medical scenarios is...). This allows the "tolerance rate" of privacy protection to be adapted to the risk tolerance of different scenarios (such as medical scenarios where privacy protection cannot fail, and the tolerance rate is even lower), and provides a suggested range of total budget for different scenarios (sensitive / ordinary), so as to avoid users setting the budget too high (large performance loss) or too low (insufficient protection) due to the lack of reference values, and lowers the threshold for using the solution. Specific Implementation Example 5
[0063] Workflow of a differential privacy method to prevent leakage of large model training data
[0064] Federal-level privacy collaboration:
[0065] First, node identity authentication is completed through the SM4 algorithm to select legitimate nodes to access training and prevent illegal nodes from stealing data. The central server generates a global noise seed and distributes it in encrypted form. Each legitimate node generates local noise according to its own sample size ratio (the more samples, the greater the noise) to ensure noise coordination between nodes. This avoids performance loss caused by excessive noise from small sample nodes and prevents cross-node data distribution from being inferred through noise differences, thus blocking cross-node leakage paths.
[0066] Data layer privacy protection:
[0067] First, the data is semantically binned (e.g., age is divided into age groups) to preserve feature correlation. The dynamic sensitivity of each sample is calculated (the higher the proportion of sensitive fields and the higher the basic sensitivity, the greater the dynamic sensitivity). Noise that deviates from the mean in the same direction as the feature is added to the sample features (e.g., for samples whose age is higher than the mean, the noise still makes them retain the semantic meaning of "above the mean") to generate a privacy-preserving dataset, avoiding the risk of leakage caused by directly using the original data for training.
[0068] Model layer privacy protection:
[0069] In each training round, K-means clustering is performed on the gradient set. Gradients of the same type are replaced with the gradients of the cluster centers to reduce gradient fluctuations (noise reduction). Gradients are pruned according to a dynamic threshold that decays with each training round to avoid abnormal gradients (such as gradient explosion) that cause noise failure. Gaussian noise is added to the pruned gradients (the noise magnitude is positively correlated with the pruning threshold and gradient magnitude, and negatively correlated with the model layer budget) to ensure that the parameter update process satisfies differential privacy. The parameters are updated with an adaptive learning rate associated with the model layer budget. When the budget is sufficient, convergence is accelerated, balancing privacy protection and training efficiency.
[0070] Two-factor privacy budget allocation:
[0071] Two core factors are calculated in real time: the real-time data sensitivity factor (the average proportion of sensitive fields in the current batch of samples) and the model training state factor (the ratio of current loss to initial loss). The total budget is allocated according to the factors: the budget for the data layer increases with the increase of the proportion of sensitive fields, the budget for the model layer increases with the instability of training (high loss), and the budget for the federated layer takes the larger value between the "base value" and the "sensitive factor correlation value". The remaining budget is used for risk verification to ensure that the budget is tilted towards the core protection links and to avoid waste.
[0072] Multimodal risk verification:
[0073] Every 50 rounds of training and after training, three types of risks are detected: member inference risk is detected using shadow models and adversarial examples, model extraction risk is detected using parameter / output similarity, and model inversion risk is detected using pixel / BLEU / MFCC similarity. A comprehensive risk score is calculated. If it exceeds the threshold corresponding to the scenario (e.g., 0.08 in medical scenarios), the weights of the two factors are adjusted (e.g., increasing the data layer budget coefficient when the proportion of sensitive fields is high), and the previous steps are repeated until the risk reaches the target, ensuring that the final trained model has no hidden data leakage.
[0074] The preferred embodiments of the present invention disclosed above are only for the purpose of illustrating the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation described herein. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can better understand and utilize the present invention.
Claims
1. A differential privacy method to prevent leakage of large model training data, characterized in that: Includes the following steps: Step a: The N nodes participating in the training complete key negotiation and generate unique identifiers using the SM4 symmetric encryption algorithm. Only nodes that pass authentication can access the training. The central server generates a global noise seed and distributes it to each authenticated node through a TLS 1.3 encrypted channel. Each node generates local cooperative noise based on this seed, and the magnitude of the local noise is calculated using the following formula: = × ； Step b: Perform feature binning on the data. Continuous features are divided into intervals according to semantics, while discrete features retain their original categories; calculate the dynamic sensitivity of each sample: ； Add sign-consistent Laplacian noise to sample features to generate a privacy-preserving dataset; Step c: Train a large model based on a privacy-preserving dataset. In each training round, perform K-means clustering on the gradient set and replace all gradients within the cluster with the gradient of the cluster center to achieve noise reduction. Perform L2 norm clipping on the denoised gradients according to a dynamic threshold and add Gaussian noise to the clipped gradients. The noise variance is positively correlated with the clipping threshold and gradient magnitude, and negatively correlated with the budget. Update the model parameters through an adaptive optimizer. Step d: Allocate the total privacy budget to the data layer, model layer, federation layer, and risk verification layer, based on the data real-time sensitivity factor and the model training state factor; Step e: Every 50 rounds of training and after the training ends, calculate the member inference risk, model extraction risk, and model inversion risk, comprehensively assess the privacy risk, and adjust the parameters and retrain if the threshold is exceeded.
2. The differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: Step a also includes global feature sensitivity, which is the maximum value of the local feature sensitivity of each node.
3. The differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The semantic interval division of the continuous features includes age, income, and image grayscale value; sensitive fields include medical record number, diagnosis result, credit record, and bank card number.
4. The differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The initial cluster centers of the K-means clustering are determined by the elbow rule, and the adaptive optimizer is AdamW.
5. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The budget allocation for the data layer and model layer is dynamically adjusted based on the sensitivity factors, and the budget for the risk verification layer is no less than 5% of the total budget.
6. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The model inversion risk is calculated according to multimodal adaptation rules, and the risk threshold is set according to scenario classification.
7. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The large models trained on the privacy-preserving dataset include Transformer, GPT-3 / GPT-4, BERT, ResNet-50 / ResNet-101, and ViT, with an initial pruning threshold. The value is set according to the model parameter size: 1.2 when the parameter size is ≤100M, 1.0 when 100M < parameter size ≤1B, 0.9 when 1B < parameter size ≤10B, and 0.8 when the parameter size >10B.
8. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The federal layer privacy collaboration also includes a node anomaly detection mechanism to remove nodes with abnormal noise distribution or parameter updates.
9. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The dynamic sensitivity calculation also incorporates a time decay factor: when the sample collection time is more than one year from the current training time... Multiply by 1.0 if the data period is less than one year to avoid over-protection of historical data.
10. A differential privacy method for preventing leakage of large model training data according to claim 1, characterized in that: The failure probability of the Gaussian noise Detailed by scenario: Medical imaging model is Financial risk control model is The government data model is The ordinary text model is Total privacy budget Recommended values: 1.2-1.5 for sensitive scenarios, 0.8-1.0 for ordinary scenarios.