Large language model-oriented sentence-level differential privacy cue word protection method and device

Abstract

The invention discloses a large language model-oriented sentence-level differential privacy cue word protection method and device. The method comprises the following steps of: obtaining an original cue word input into a large language model by a user; performing candidate replacement word retrieval on each token included in the original cue word to obtain a candidate replacement word set corresponding to each token; randomly selecting candidate replacement words from a candidate replacement word set corresponding to each token for combination to obtain a plurality of candidate disturbance cue words corresponding to the original cue word; and performing privacy and utility calculation on each candidate disturbance prompt word, and determining a target disturbance prompt word from the plurality of candidate disturbance prompt words. According to the method, the candidate replacement word set is screened for each token and combined into the sentence-level candidate disturbance cue word, the limitation of traditional token-level disturbance is broken through, a disturbance unit is upgraded into a complete sentence, the problems of excessive noise and semantic fracture caused by privacy budget fragmentation of long cue words are solved from the source, and the user experience is improved. And deep balance between privacy and effectiveness is realized.

Description

Technical Field

[0001] This invention belongs to the field of large language model technology, specifically relating to a sentence-level differential privacy prompt word protection method and device for large language models. Background Technology

[0002] Large Language Models (LLMs) have made significant progress in the field of natural language processing, supporting various tasks such as text generation, question answering, and dialogue systems. Users interact with the model by providing prompts, which not only convey user intent but also often contain sensitive information such as personal identifiers, behavioral preferences, and proprietary data. In black-box deployment or cloud inference scenarios, users have difficulty knowing how their input is stored and processed. Some publicly available language models have leaked sensitive information from past user inputs, posing a serious risk of privacy breaches.

[0003] Meanwhile, existing privacy protection methods have many limitations: cryptographic methods, while offering strong privacy protection, suffer from high computational costs and communication latency, making them unsuitable for real-time or large-scale scenarios; client-server hybrid architectures require partial access to the architecture or parameters of LLMs, limiting their applicability in black-box scenarios; differential privacy (DP) methods often employ token-level perturbation, leading to excessive noise in long prompts due to the allocation of the privacy budget among tokens, resulting in degraded output quality; and token-independent perturbation lacks context awareness, easily generating semantically incoherent or unnatural sentences, failing to balance privacy protection with the practicality of prompts. Against this backdrop, there is an urgent need for a prompt perturbation framework that can balance privacy protection and language quality to meet the requirements of trusted deployment in LLMs inference services. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides a sentence-level differential privacy prompt word protection method and apparatus for large language models.

[0005] The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides a sentence-level differential privacy cue word protection method for large language models, comprising: Obtain the original prompt words input by the user into the large language model; the original prompt words include multiple tokens; Candidate replacement words are retrieved for each token included in the original prompt words to obtain a set of candidate replacement words for each token; Randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word; The target perturbation cue word is determined from multiple candidate perturbation cue words by performing privacy and utility calculations on each candidate perturbation cue word.

[0006] Secondly, the present invention provides a sentence-level differential privacy prompt word protection device for large language models, comprising: The acquisition module is used to acquire the original prompt words input by the user into the large language model; the original prompt words include multiple tokens; The replacement word determination module is used to retrieve candidate replacement words for each token included in the original prompt words, and obtain a set of candidate replacement words corresponding to each token; The sentence-level perturbation construction module is used to randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word; The target perturbation cue word determination module is used to determine the target perturbation cue word from multiple candidate perturbation cue words by performing privacy and utility calculations on each candidate perturbation cue word.

[0007] This invention provides a sentence-level differential privacy-preserving tooltip protection method and apparatus for large language models. It overcomes the limitations of traditional token-level perturbation by upgrading the perturbation unit to a complete sentence, fundamentally solving the problems of excessive noise and semantic fragmentation caused by the fragmentation of privacy budgets in long tooltips. First, a set of candidate replacement words is selected for each token and combined into sentence-level candidate perturbation tooltips, ensuring semantic consistency of the perturbation basis. Second, by performing privacy and utility calculations on each candidate perturbation tooltip, the optimal perturbation tooltip is selected under differential privacy constraints. This satisfies the formal protection of differential privacy while maximizing the preservation of the core semantics of the original tooltips, achieving a deep balance between privacy and utility.

[0008] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a sentence-level differential privacy prompt word protection method for large language models provided in an embodiment of the present invention; Figure 2A and Figure 2B This is a schematic diagram of experimental results for a sentence-level differential privacy prompt word protection method for large language models according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a sentence-level differential privacy prompt word protection device for large language models according to an embodiment of the present invention. Detailed Implementation

[0010] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0011] This invention provides a sentence-level differential privacy hint word protection method for large language models. See also... Figure 1 The method includes the following steps: S10. Obtain the original prompt words input by the user into the large language model.

[0012] The original prompt word consists of multiple tokens. Specifically, each token is a word element in the original prompt word text.

[0013] S20. Perform candidate replacement word retrieval on each token included in the original prompt words to obtain the candidate replacement word set corresponding to each token.

[0014] Optionally, step S20 may specifically include: S201. Generate the target embedding vectors of each token included in the original prompt word through a text embedding model.

[0015] S202. Based on the preset vocabulary in the text embedding model, calculate the Euclidean distance between the target embedding vector of each token and multiple replacement words in the preset vocabulary.

[0016] S203. Determine the set of candidate replacement words corresponding to each token based on the Euclidean distance between each token and multiple replacement words in the preset vocabulary and the preset distance threshold.

[0017] For example, the original prompt words can be represented as a token sequence. ,in This indicates the length of the original prompt word. A pre-defined vocabulary from the text embedding model can be used, such as the cl180_embeddings vocabulary, which can accommodate words of various sizes. The vocabulary is mapped to a 1536-dimensional vector space. For each token , First, the target embedding vectors of each token are obtained based on the text embedding model. Then, based on Euclidean distance and a preset distance threshold, the corresponding prefixes of each token are retrieved from the embedding space of a preset vocabulary. Given the nearest neighbor replacement tokens, we obtain multiple candidate replacement words corresponding to each token, among which... Determined by a preset distance threshold.

[0018] You can use tokens The set of candidate replacement words is denoted as Each replacement word satisfy:

[0019] in, This represents the embedding vector of the replacement word. The (·) function is used to select each token from a preset vocabulary. The smallest Euclidean distance A set of candidate replacement words is formed by several replacement words to ensure that the candidate replacement words match the token. Semantic similarity. This constraint helps reduce semantic shift and maintain semantic alignment between the perturbed cue and the original cue.

[0020] S30. Randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word.

[0021] Optionally, step S30 may specifically include: S301. Randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple initial candidate perturbation prompt words.

[0022] For example, after obtaining the set of candidate replacement words for each token, initial candidate perturbation cue words can be generated through random sampling. Specifically, for each token... From its set of candidate replacement words Randomly select a candidate replacement word Then, select the candidate replacement words corresponding to each token. By splicing together, initial candidate perturbation cue words are formed. This process is repeated. This can generate The initial candidate perturbation cue words are represented as follows:

[0023] in, The values ​​are preset and can be flexibly set by those skilled in the art according to the actual situation. This embodiment does not impose any restrictions on this.

[0024] This embodiment differs from methods that perturb only a single token at a time. Instead, it independently samples candidate replacement words from the candidate replacement word set of each token, combining them to form initial candidate perturbation prompts at the sentence level. This embodiment, by transitioning from token-level perturbation to sentence-level perturbation, achieves more coherent and semantically aligned text transformation. Furthermore, to avoid combinatorial explosion, this embodiment employs a constrained sampling strategy to limit the number of generated candidates to a fixed scale. The final result The initial candidate perturbation cue words constitute the initial perturbation space, which serves as the basic input for subsequent filtering and sampling stages.

[0025] S302. Calculate the perplexity of multiple initial candidate perturbation prompts to obtain the perplexity of each initial candidate perturbation prompt.

[0026] For example, to ensure that the initial candidate perturbation prompts are structurally sound and semantically coherent, a lightweight local language model (such as GPT-2) can be used to calculate the perplexity level (PPL) of each initial candidate perturbation prompt, thereby achieving language plausibility filtering. The perplexity level can serve as a proxy indicator of text fluency; a lower perplexity value indicates that the text conforms more closely to natural language expression habits and is more fluent; a higher perplexity value means that the text is semantically chaotic and difficult to understand.

[0027] Optionally, the perplexity of the initial candidate perturbation cue words can be expressed as:

[0028] in, Indicates initial candidate perturbation cue words The level of confusion, Indicates initial candidate perturbation cue words The included first 10 candidate replacement words , Indicates candidate replacement words The conditional probability.

[0029] Specifically, the negative mean log-likelihood value It is a standard indicator for measuring sentence fluency.

[0030] S303. Based on a preset perplexity threshold, filter initial candidate perturbation prompts with perplexity less than the preset perplexity threshold to obtain multiple candidate perturbation prompts corresponding to the original prompts.

[0031] For example, based on a preset perplexity threshold Remove all cases where the perplexity exceeds the preset perplexity threshold. The initial candidate perturbation prompts are selected, and only those with a perplexity level below a preset perplexity threshold are retained. The initial candidate perturbation prompts are used to obtain multiple candidate perturbation prompts corresponding to the original prompts. A preset perturbation threshold is used. It can be determined in advance through iterative validation on the dataset to balance text fluency and candidate coverage.

[0032] Set of candidate perturbation cue words It can be represented as:

[0033]

[0034] In the formula, Indicates the first One candidate perturbation cue word, .

[0035] This embodiment ensures that the filtered candidate perturbation prompts are all grammatically correct texts that retain the core semantics of the original prompts, thus improving the quality of the subsequent output text. In addition, it reduces the risk of a "long tail effect" in the subsequent application of the "exponential mechanism," that is, the risk of low-quality candidate words interfering with the selection results.

[0036] S40. By performing privacy and utility calculations on each of the candidate perturbation prompts, a target perturbation prompt is determined from multiple candidate perturbation prompts.

[0037] Optionally, step S40 may specifically include: S401. Calculate the cosine similarity between the original prompt word and each candidate perturbation prompt word to obtain the utility function value corresponding to each candidate perturbation prompt word.

[0038] For example, after linguistic plausibility filtering, a target perturbation word needs to be selected from the candidate perturbation words that satisfies differential privacy requirements while preserving the semantics of the original word to the greatest extent. An exponential mechanism can be used to balance privacy protection and utility optimization.

[0039] To measure the semantic consistency between each candidate perturbation prompt and the original prompt, the cosine similarity between the original prompt and each candidate perturbation prompt can be defined as a utility function, and the utility function value corresponding to each candidate perturbation prompt can be calculated.

[0040] Optionally, the utility function value corresponding to each candidate perturbation cue word is expressed as:

[0041] in, Indicates candidate perturbation cue words The corresponding utility function value, Indicates the original prompt word, Indicates the first One candidate perturbation cue word, It is an embedded vector representation.

[0042] S402. Based on the preset privacy budget, perform an exponential calculation on the utility function value corresponding to each candidate perturbation prompt word to obtain the utility index value corresponding to each candidate perturbation prompt word.

[0043] For example, the exponential mechanism selects target perturbation cue words by converting utility function values ​​into sampled probabilities. Assume the resulting set of candidate perturbation cue words is... Then select a candidate perturbation prompt word. The probability formula is as follows:

[0044] in, Indicates target perturbation cue words, It is a probability symbol. It is a proportional sign.

[0045] Optionally, the utility index value corresponding to each candidate perturbation cue word is expressed as:

[0046] in, Indicates candidate perturbation cue words The corresponding utility index value, This indicates the preset privacy budget. The sensitivity of the utility function is represented. This represents an exponential function.

[0047] Specifically, It can be flexibly configured by those skilled in the art according to the actual situation, for example, in this embodiment It can be set to 1.

[0048] S403. Based on the utility index value corresponding to each candidate perturbation cue, determine the target perturbation cue from multiple candidate perturbation cues.

[0049] Specifically, by using the utility index value corresponding to each candidate perturbation prompt, a balance can be achieved between "privacy protection" and "actual utility": when When the value is small (strong privacy protection), the probability distribution is more uniform, and the probability difference between the selected candidate perturbation prompts is small, thus reducing the risk of attackers inferring the original prompts through the output; when When the size is large (with weak privacy protection), the probability of selecting candidate perturbation prompts with high semantic similarity increases significantly, and the usability of the selected target perturbation prompts is higher.

[0050] The index mechanism calculates the utility index value corresponding to each candidate perturbation cue word. The probability of selecting each candidate perturbation cue word is determined based on its utility index value, with higher utility index values ​​assigning a higher selection probability. By eliminating candidate perturbation cue words with extremely low utility, the probability distribution is concentrated on meaningful candidate perturbation cue words, thus enhancing the stability and usability of the target perturbation cue words while satisfying differential privacy requirements. The final target perturbation cue words are selected through the index mechanism. The input will be submitted to black-box LLMs for inference, thereby protecting the privacy of user prompts while ensuring the semantic rationality of the output.

[0051] This embodiment provides a sentence-level differential privacy cue word protection method for large language models (LLMs). Addressing the limitations of existing token-level differential privacy methods in LLM cue word protection, such as fragmented privacy budgets, poor semantic coherence, and the efficiency or black-box applicability of other privacy protection schemes, this embodiment proposes a sentence-level differential privacy cue word perturbation framework. This elevates the perturbation unit from the token level to the sentence level and employs a three-level process: semantic alignment perturbation space construction, language rationality filtering, and semantically aware perturbation selection. It uses embedding similarity to filter candidate replacement word sets corresponding to each token to ensure semantic foundation, perplexity filtering to ensure text fluency, and finally, an exponential mechanism to balance semantic fidelity and privacy protection under differential privacy constraints. This effectively solves the core problem of traditional methods struggling to balance privacy strength and cue word utility. Furthermore, this embodiment's method does not require access to the LLM architecture or parameters; it can adapt to black-box inference scenarios solely through front-end cue word perturbation, overcoming the application limitations of hybrid architecture methods in commercial LLM services.

[0052] The following simulation experiment further illustrates the sentence-level differential privacy prompt word protection method for large language models provided by this invention.

[0053] To verify the effectiveness and superiority of this invention, multiple sets of comparative and ablation experiments were conducted. This invention uses the PyTorch framework to implement the scheme, and under different privacy budgets, the performance of this invention is compared with existing token-level differential privacy methods in terms of privacy protection strength, semantic fidelity, and language fluency. Furthermore, by adjusting core parameters, the impact of the internal modules of this invention on the overall effect is verified.

[0054] Other similar methods used for comparison with this invention include token-level differential privacy methods (SANTEXT, SANTEXT+, CUSTEXT, CUSTEXT+, INFERDPT) and context-aware token-level perturbation methods (CAPE). In addition, to verify the practicality of this invention in black-box LLMs inference scenarios, zero-shot learning test experiments were also set up for text classification tasks to demonstrate its semantic preservation ability and privacy protection effect in real inference scenarios.

[0055] This experiment uses two standard datasets from GLUE, the SST-2 dataset and the RottenTomatoes movie review dataset, to evaluate the performance of this invention. The SST-2 dataset is a commonly used sentiment analysis dataset, derived from a movie review corpus; each sample contains a short review text and its corresponding sentiment label. The RottenTomatoes dataset is also used for sentiment analysis, with samples from movie reviews by professional film critics or general audiences. Both datasets are used to test the invention's ability to preserve the semantics of cue words and its privacy protection effect in text classification tasks. The privacy budget is a key indicator for evaluating the strength of differential privacy, determined by parameters... definition, A smaller value indicates a higher level of privacy protection, but may reduce the semantic utility of the prompt. To evaluate the impact of perturbed prompts on LLM inference results, classification accuracy was used as the core metric. The accuracy of the qwen3-max-preview model based on perturbed prompts in completing a text classification task was tested. The Rouge-L F1 score was also used to measure the semantic similarity between the original and perturbed prompts; a higher score indicates better semantic preservation.

[0056] In the privacy protection strength assessment experiment, the attack success rate This is a key metric, quantified using both KNN and BERT inference attacks. In a KNN inference attack, the attacker calculates the embedding distance between the perturbed token and all other tokens in the vocabulary, selecting the 10 tokens with the smallest distances. If the original token appears in this set, the attack is successful. The privacy protection level is defined as the average attack success rate of all tokens. In BERT inference attacks, attackers use a pre-trained BERT model to predict the original token in a perturbation prompt by modeling masked language, and use the Rouge-L F1 score to evaluate the similarity between the predicted prompt and the original prompt. The privacy protection level is also defined as the success rate of attacks. Furthermore, in the ablation experiments, the number of initial candidate perturbation cue words was adjusted. Compared with the preset confusion threshold The impact of core parameters on the privacy-utility trade-off of this invention is analyzed to verify the necessity of each module in the framework.

[0057] Experiment 1: Privacy-Utility Comparison Experiment on SST-2 and RottenTomatoes Datasets For the SST-2 and RottenTomatoes datasets, this invention uses qwen3-max-preview as a black-box inference model and employs a zero-shot testing method to evaluate the semantic fidelity of the perturbation prompts—during testing, only perturbation prompts containing task instructions are input into the model without parameter updates or fine-tuning. Figure 2A In different privacy pre Below, the model test accuracy and privacy protection level of seven differential privacy methods, including the present invention (SPERT in the figure), on the SST-2 and RottenTomatoes datasets are presented. The model test accuracy reflects "utility" and the privacy protection level reflects "privacy", thus presenting the privacy-utility trade-off effect of each method.

[0058] Experiment 2: Privacy Budget Comparison Experiment Rouge-L F1 scores were calculated on the SST-2 dataset between the original and perturbed prompts, and this metric was used to evaluate sentence semantic similarity. Experimental results are shown in Table 1 below. The results indicate that the Rouge-L F1 scores of all methods increase with privacy budget. The increase is due to the increase. In these methods, even when... At the same time, SANTEXT+ and CUSTEXT+ can also achieve relatively high scores. This phenomenon can be explained as follows: In SANTEXT+, the most frequent token (previous...) It is considered a non-sensitive token and has only a probability. Stop words will be replaced; in CUSTEXT+, on the one hand, stop words are treated as non-sensitive words and therefore will not be replaced; on the other hand, each token has a predefined list of token adjacencies. This makes it highly probable that a token will either remain unchanged or be replaced by a synonym, resulting in higher semantic similarity. However, this also explains why their privacy protection against attacks is relatively weak. Among the four comparison methods, this invention achieves the best overall performance. Specifically, when the actual privacy budget is aligned to... At that time, the privacy budget and F1 score for each method are as follows: SANTEXT's privacy budget is The F1 score is 0.87; both InferDPT and Cape have privacy budgets of 0.87. The F1 scores are 16.48 and 46.58, respectively; for this invention, the privacy budget is... (in This refers to the original prompt word length, i.e., the sentence length. Since the sentence length for different prompt words cannot be determined, we assume the sentence length... At this point, its privacy budget is 14, and its F1 score is 72.90. Under this alignment condition, the Rouge-L F1 score of this invention is significantly higher than the other three methods.

[0059] Table 1

[0060] Experiment 3: Ablation Test To further verify the necessity of each core module and the impact of key parameters in this method, an ablation experiment was designed on the RottenTomatoes dataset, focusing on analyzing the number of initial candidate prompts during the perturbation space construction stage. "and the preset perplexity threshold of the language rationality filtering stage" "To assess the effect of the model's privacy-utility trade-off, the experiment used the success rate of KNN attacks and the accuracy of text classification as evaluation metrics. In this set of experiments, a fixed preset perplexity threshold was used." By adjusting the number of initial candidate prompts generated during the perturbation space construction phase The values ​​were set to 1000, 5000, and 10000, and their impact on the experimental results was observed. This was to evaluate the preset perplexity threshold for the language rationality filtering stage. Its function is to fix the number of initial candidate prompts. ,Will The values ​​were set to 25%, 50%, and 75%, and the experimental results were referenced. Figure 2B .

[0061] Corresponding to the above-described sentence-level differential privacy cue word protection method for large language models, this invention also provides a sentence-level differential privacy cue word protection device for large language models; such as Figure 3 As shown, the device may include: The acquisition module 301 is used to acquire the original prompt words input by the user into the large language model; the original prompt words include multiple tokens; The replacement word determination module 302 is used to retrieve candidate replacement words for each token included in the original prompt words, and obtain a set of candidate replacement words corresponding to each token; The sentence-level perturbation construction module 303 is used to randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word; The target perturbation cue word determination module 304 is used to determine the target perturbation cue word from multiple candidate perturbation cue words by performing privacy and utility calculations on each candidate perturbation cue word.

[0062] For details regarding the device, please refer to the steps of the sentence-level differential privacy hint word protection method for large language models provided in the first aspect; it will not be repeated here.

[0063] This embodiment provides a sentence-level differential privacy hint word protection device for large language models, which has the following advantages: 1. Breaking through the limitations of traditional token-level perturbation, this approach upgrades the perturbation unit to a complete sentence, fundamentally solving the problems of excessive noise and semantic fragmentation caused by the fragmentation of privacy budgets in long prompt words. It achieves a deep balance between privacy and utility: First, based on the semantic similarity of the text embedding model, a set of candidate replacement words is selected for each token and combined into sentence-level candidate perturbation prompt words, ensuring the semantic consistency of the perturbation basis; second, through a perplexity level (PPL) filtering mechanism, candidate perturbation prompt words with chaotic syntax and incoherent semantics are strictly eliminated, retaining only high-quality text with fluent language; finally, using cosine similarity as the utility function, combined with an exponential mechanism, the optimal perturbation prompt word is selected under differential privacy constraints, satisfying both the formal protection of differential privacy and maximizing the preservation of the core semantics of the original prompt words.

[0064] 2. This invention does not rely on the architecture, parameters, or intermediate outputs of Large Language Models (LLMs). It can be adapted to black-box inference scenarios simply through front-end cue word preprocessing, perfectly meeting the practical application needs of commercial LLMs that only open APIs. It solves the industry pain points of high computational overhead in cryptographic methods and reliance on white-box access to models in hybrid architecture methods. From a protection perspective, the "sentence-level differential privacy" cue word protection technology combination has significant originality: on the one hand, it achieves formal differential privacy protection through the combination of sentence-level perturbation and exponential mechanisms; on the other hand, it performs outstandingly in semantic fidelity and language fluency. Experimental data on Rouge-L F1 scores and perplexity demonstrate that its semantic preservation ability during privacy budget alignment far exceeds that of similar methods, providing an efficient and practical technical solution for cue word privacy protection in black-box LLMs inference scenarios.

[0065] It should be noted that the device is basically similar to the method embodiment, so the description is relatively simple. For relevant parts, please refer to the description of the method embodiment.

[0066] It should be noted that the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention.

[0067] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0068] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings and the disclosure in carrying out the claimed invention. In the description of the invention, the word "comprising" does not exclude other components or steps, "a" or "an" does not exclude a plurality, and "a plurality" means two or more, unless otherwise explicitly specified. Furthermore, while different embodiments may describe certain measures, this does not mean that these measures cannot be combined to produce good results.

[0069] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A sentence-level differential privacy hint word protection method for large language models, characterized in that, include: Obtain the original prompt words input by the user into the large language model; The original prompt word includes multiple tokens; Candidate replacement words are retrieved for each token included in the original prompt words to obtain a set of candidate replacement words corresponding to each token; Randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word; The target perturbation cue word is determined from multiple candidate perturbation cue words by performing privacy and utility calculations on each of the candidate perturbation cue words.

2. The sentence-level differential privacy hint word protection method for large language models according to claim 1, characterized in that, The step of determining the target perturbation cue word from multiple candidate perturbation cue words by performing privacy and utility calculations on each of the candidate perturbation cue words includes: Calculate the cosine similarity between the original prompt word and each candidate perturbation prompt word to obtain the utility function value corresponding to each candidate perturbation prompt word; Based on a preset privacy budget, the utility function value corresponding to each candidate perturbation prompt is calculated exponentially to obtain the utility index value corresponding to each candidate perturbation prompt. The target perturbation cue word is determined from the plurality of candidate perturbation cue words based on the utility index value corresponding to each candidate perturbation cue word.

3. The sentence-level differential privacy hint word protection method for large language models according to claim 1, characterized in that, The step of randomly selecting candidate replacement words from the candidate replacement word set corresponding to each token and combining them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word includes: Randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple initial candidate perturbation prompt words; The perplexity of each initial candidate perturbation prompt is calculated by performing perplexity calculation on the plurality of initial candidate perturbation prompts. Based on a preset perplexity threshold, initial candidate perturbation prompts with perplexity less than the preset perplexity threshold are selected to obtain multiple candidate perturbation prompts corresponding to the original prompt.

4. The sentence-level differential privacy hint word protection method for large language models according to claim 1, characterized in that, The step of retrieving candidate replacement words for each token included in the original prompt words to obtain a set of candidate replacement words corresponding to each token includes: The target embedding vectors of each token included in the original prompt words are generated using a text embedding model; Based on the preset vocabulary in the text embedding model, calculate the Euclidean distance between the target embedding vector of each token and multiple replacement words in the preset vocabulary; Based on the Euclidean distance between each token and multiple replacement words in the preset vocabulary and the preset distance threshold, the set of candidate replacement words corresponding to each token is determined.

5. A sentence-level differential privacy hint word protection method for large language models according to claim 2, characterized in that, The utility function value corresponding to each candidate perturbation cue word is expressed as follows: in, Indicates candidate perturbation cue words The corresponding utility function value, Indicates the original prompt word, Indicates the first One candidate perturbation cue word, It is an embedded vector representation.

6. The sentence-level differential privacy hint word protection method for large language models according to claim 5, characterized in that, The utility index value corresponding to each candidate perturbation cue word is expressed as follows: in, Indicates candidate perturbation cue words The corresponding utility index value, This indicates the preset privacy budget. The sensitivity of the utility function is represented. This represents an exponential function.

7. The sentence-level differential privacy hint word protection method for large language models according to claim 3, characterized in that, The perplexity of the initial candidate perturbation cue words is expressed as: in, Indicates initial candidate perturbation cue words The level of confusion, Indicates initial candidate perturbation cue words The included first 10 candidate replacement words , Indicates candidate replacement words The conditional probability.

8. A sentence-level differential privacy warning word protection device for large language models, characterized in that, include: The acquisition module is used to acquire the original prompt words input by the user into the large language model; The original prompt word includes multiple tokens; The replacement word determination module is used to retrieve candidate replacement words for each token included in the original prompt words, and obtain a set of candidate replacement words corresponding to each token; The sentence-level perturbation construction module is used to randomly select candidate replacement words from the candidate replacement word set corresponding to each token and combine them to obtain multiple candidate perturbation prompt words corresponding to the original prompt word; The target perturbation cue word determination module is used to determine the target perturbation cue word from the plurality of candidate perturbation cue words by performing privacy and utility calculations on each of the candidate perturbation cue words.

Images