Large language model access security method based on federated learning and privacy computing

Abstract

This invention discloses a secure access method for large language models based on federated learning and privacy computing, comprising: deploying local sub-models of a large language model containing a selective state-space model on multiple edge client devices; forming an encrypted set of dynamic sensitive parameters, an encrypted set of linear projection parameters, and an encrypted time-scale gradient sensitivity index; obtaining a global set of linear projection parameters; combining it with the remaining parameters of the encrypted dynamic sensitive parameter set to generate an intermediate global dynamic sensitive parameter set; obtaining updated global time-scale parameters; obtaining an encrypted global model update package; completing the parameter update of the local sub-model of the large language model; repeating until a preset convergence condition is met to obtain a converged global Fed Mamba-TAS model parameter package and deploying it in the large language model access security control system. This invention improves the stability and reliability of large language models when processing long-sequence access requests at the edge.

Description

Technical Field

[0001] This invention relates to the field of large language model technology, and in particular to a secure access method for large language models based on federated learning and privacy computing. Background Technology

[0002] With the widespread deployment of large language models in intelligent customer service, intelligent office, mobile terminal interaction, and enterprise internal knowledge systems, how to achieve continuous updates and unified management of models while ensuring data privacy has become a key technical issue. In practical application scenarios, large language models are often deployed on multiple edge client devices. Each edge client device performs model fine-tuning or security policy training based on local access request log data. However, the original access request log data usually contains user privacy information or sensitive business information, which cannot be directly uploaded to the central server for centralized training.

[0003] Existing federated learning frameworks are mostly designed based on large language models using the Transformer architecture, and aggregate model parameters uploaded from various edge client devices using a weighted arithmetic average. However, the Transformer architecture exhibits quadratic complexity when processing long sequence data, resulting in high computational resource consumption and making it difficult to run efficiently on resource-constrained edge client devices. To reduce computational complexity, the Mamba architecture based on a selective state-space model has been proposed in recent years. It replaces the self-attention structure with a state-space computation mechanism of linear complexity, making it suitable for edge-side inference and training scenarios. However, existing federated learning frameworks still follow the traditional linear parameter averaging aggregation strategy and have not been specifically designed for the dynamic characteristics of state-space models.

[0004] In federated training scenarios based on selective state-space models, state-space matrix parameters are used to characterize the dynamic stability of the model. Existing techniques typically perform a weighted arithmetic mean of the state-space matrix parameters uploaded by each edge client device directly in Euclidean space. However, this ignores the stability constraints that the state-space matrix parameters must satisfy. When multiple state-space matrix parameters that meet the stability conditions are directly linearly averaged in Euclidean space, the aggregated result may no longer meet the stability conditions. This can lead to state divergence or gradient explosion problems in the global model during long-sequence inference, resulting in unstable dynamic characteristics of the model.

[0005] Regarding privacy protection, although some existing federated learning systems use encrypted transmission mechanisms to protect the parameter upload process, there are still cases where parameters are processed in plaintext on the server side, or there is a lack of a verifiable mechanism for the stability of the aggregated model parameters. After the server completes the aggregation operation, the edge client devices cannot verify whether the state space matrix parameters meet the stability constraints, which poses a risk of trust dependence. Summary of the Invention

[0006] One objective of this invention is to propose a secure access method for large language models based on federated learning and privacy computing. This invention improves the stability and reliability of large language models when processing long-sequence access requests at the edge.

[0007] A secure access method for large language models based on federated learning and privacy computing according to an embodiment of the present invention includes:

[0008] Deploy local sub-models of a large language model containing a selective state-space model on multiple edge client devices;

[0009] Each edge client device uses a privacy computing encryption mechanism to encrypt the parameter set in the local sub-model of the large language model, forming an encrypted dynamic sensitive parameter set, an encrypted linear projection parameter set, and an encrypted time-scale gradient sensitivity index, which are then sent to the federated aggregation server.

[0010] Perform a weighted arithmetic aggregation with a weight equal to the number of client samples on the received set of encrypted linear projection parameters to obtain the global set of linear projection parameters;

[0011] The state space matrix parameters in the received encrypted dynamic sensitive parameter set are subjected to cryptographic domain weighted aggregation in a log-Euclidean manifold to obtain aggregated state space matrix parameters, which are then combined with the remaining parameters of the encrypted dynamic sensitive parameter set to generate an intermediate global dynamic sensitive parameter set.

[0012] Decrypt the encrypted timescale gradient sensitivity index, perform gradient sensitivity weighted aggregation on the timescale parameters in the intermediate global dynamic sensitive parameter set, and obtain the updated global timescale parameters.

[0013] The updated global timescale parameters are merged with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set. This set is then encapsulated with the global linear projection parameter set into a global Fed Mamba-TAS model parameter package and encrypted to obtain the encrypted global model update package.

[0014] After verifying the zero-knowledge proof, decrypt the encrypted global model update package, replace the corresponding local parameter set with the final global dynamic sensitive parameter set and global linear projection parameter set, and complete the parameter update of the local large language model and local sub-model.

[0015] Repeatedly update the parameters of the local sub-models of the local large language model until the preset convergence condition is met, obtain the converged global Fed Mamba-TAS model parameter package, and deploy it in the large language model access security control system.

[0016] Optionally, the local sub-model of the large language model consists of a set of dynamic sensitive parameters and a set of linear projection parameters. Each edge client device trains the local sub-model of the large language model using access request log data under the protection of a trusted execution environment, and obtains the updated set of dynamic sensitive parameters, the updated set of linear projection parameters, and gradient information corresponding to the time scale parameters. Each edge client device performs parameter decoupling operation on the updated set of dynamic sensitive parameters and the updated set of linear projection parameters to obtain the set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded. At the same time, it calculates the time scale gradient sensitivity index based on the gradient information.

[0017] Optionally, the process of forming the encrypted dynamic sensitive parameter set, the encrypted linear projection parameter set, and the encrypted time-scale gradient sensitivity index includes:

[0018] The privacy computing encryption mechanism is initialized, the security parameters of the privacy computing encryption mechanism are set, the public key and private key corresponding to the edge client device are generated, and the encryption operator based on the public key and the decryption operator based on the private key are determined.

[0019] The set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded are mapped into fixed-length plaintext vectors, while the time-scale gradient sensitivity index is preserved as a scalar plaintext form.

[0020] By using public-key cryptographic operators, the set of dynamic sensitive parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of dynamic sensitive parameters, the set of linear projection parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of linear projection parameters, and the time-scale gradient sensitivity index in the form of scalar plaintext is converted into an encrypted time-scale gradient sensitivity index.

[0021] The encrypted dynamic sensitive parameter set, encrypted linear projection parameter set, encrypted time-scale gradient sensitivity index, security parameters of privacy computing encryption mechanism, edge client device identifier, and current federated training round are packaged together to construct an upload message, which is then sent to the federated aggregation server through a secure upload channel.

[0022] Optionally, the federated aggregation server performs weighted arithmetic aggregation on the received set of encrypted linear projection parameters, with a weight equal to the number of client samples, including:

[0023] The federated aggregation server receives upload messages from multiple edge client devices in a single federated training round, and parses each upload message to obtain the set of encrypted linear projection parameters corresponding to the upload message.

[0024] For each set of encrypted linear projection parameters, obtain the corresponding number of client samples and the total number of client samples;

[0025] By dividing the number of kth client samples by the total number of client samples, a corresponding weighting coefficient is assigned to each set of encrypted linear projection parameters.

[0026] By performing weighted arithmetic aggregation on each set of encrypted linear projection parameters using weighted coefficients, the global linear projection parameter set of the ciphertext domain is obtained.

[0027] Within a single federated training round, the set of global linear projection parameters in the ciphertext domain is decrypted using a private key decryption operator to restore the set of global linear projection parameters in the ciphertext domain to its plaintext representation.

[0028] The federated aggregation server writes the plaintext representation of the global linear projection parameter set into the corresponding linear projection parameter set storage area in the global Fed Mamba-TAS model structure.

[0029] Optionally, the federated aggregation server performs cryptographic domain-weighted aggregation on the state space matrix parameters in the received set of cryptographically sensitive dynamic parameters in a log-Euclidean manifold, including:

[0030] Each uploaded message is parsed to obtain the set of encrypted dynamic sensitive parameters corresponding to the uploaded message, and the ciphertext representation of the state space matrix parameters is extracted from the set of encrypted dynamic sensitive parameters.

[0031] Perform a logarithmic field transformation and weighted arithmetic aggregation based on the logarithmic Euclidean manifold on the ciphertext representation of each state space matrix parameter to obtain the logarithmic field representation of the k-th state space matrix parameter;

[0032] A weighted arithmetic aggregation is performed on the logarithmic field representation of the state space matrix parameters corresponding to all edge client devices to obtain the aggregated logarithmic matrix;

[0033] Perform matrix exponentiation on the aggregated logarithmic matrix to restore the parameters of the aggregated state space matrix;

[0034] Extract the remaining parameters except for the aggregated state space matrix parameters from the encrypted dynamic sensitive parameter set, decrypt them to obtain the plaintext representation of the remaining parameters corresponding to the k-th edge client device, and perform weighted arithmetic aggregation based on the weighting coefficients to obtain the aggregation result of the remaining parameters;

[0035] The aggregated state space matrix parameters that satisfy the Hurwitz stability condition are combined with the aggregated results of other parameters to form an intermediate global dynamic sensitive parameter set.

[0036] Optionally, the federated aggregation server decrypts the encrypted time-scale gradient sensitivity index and calculates normalized gradient weights based on the number of samples from each client and the time-scale gradient sensitivity index, including:

[0037] The federated aggregation server parses the encrypted time-scale gradient sensitivity index carried in each uploaded message to obtain the encrypted time-scale gradient sensitivity index corresponding to the kth edge client device, and performs decryption processing through the decryption operator based on the private key to obtain the kth time-scale gradient sensitivity index.

[0038] Multiply the number of samples from the kth client by the gradient sensitivity index at the kth time scale to calculate the weighted gradient sensitivity at the kth time scale.

[0039] The total weighted amount of time-scale gradient sensitivity is obtained by summing the weighted amounts of the time-scale gradient sensitivity for all edge client devices.

[0040] Divide the gradient sensitivity weight of the kth time scale by the total gradient sensitivity weight of the time scale to obtain the normalized gradient weight of the kth time scale.

[0041] The time-scale parameter is located from the intermediate global dynamic sensitive parameter set. Based on the normalized gradient weights, the time-scale parameter is subjected to gradient sensitivity weighted aggregation in one federated training round to obtain the updated global time-scale parameter.

[0042] Optionally, the federated aggregation server merges the updated global timescale parameters with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set, including:

[0043] Write the updated global timescale parameters into the corresponding timescale parameter positions in the intermediate global dynamic sensitive parameter set to obtain the final global dynamic sensitive parameter set;

[0044] The plaintext representation of the global linear projection parameter set and the final global dynamic sensitive parameter set are structurally encapsulated to construct the global Fed Mamba-TAS model parameter package;

[0045] Perform Hurwitz stability verification on the state space matrix parameters in the final global dynamic sensitive parameter set, and generate Hurwitz stability zero-knowledge proof based on the Hurwitz stability verification results;

[0046] The global Fed Mamba-TAS model parameter package and the Hurwitz stability zero-knowledge proof are encrypted to obtain an encrypted global model update package.

[0047] Optionally, the step of replacing the local corresponding parameter set with the final global dynamic sensitive parameter set and the global linear projection parameter set to complete the parameter update of the local sub-model of the local large language model includes:

[0048] Within the current federated training round, the federated aggregation server distributes encrypted global model update packages to each edge client device via a secure distribution channel.

[0049] Each edge client device receives the encrypted global model update packet from the secure delivery channel, and performs data structure parsing on the encrypted global model update packet to separate the encrypted model parameter data and the encrypted proof data.

[0050] Each edge client device performs decryption processing on the proof ciphertext data using the decryption operator corresponding to the private key, to obtain the plaintext representation of the Hurwitz stability zero-knowledge proof, and performs verification processing on the plaintext representation of the Hurwitz stability zero-knowledge proof.

[0051] After the Hurwitz stability zero-knowledge proof verification is passed, each edge client device performs decryption processing on the encrypted data of the model parameters using the decryption operator corresponding to the private key, to obtain the plaintext representation of the global Fed Mamba-TAS model parameter packet, and parses the plaintext representation of the global Fed Mamba-TAS model parameter packet to obtain the final global dynamic sensitive parameter set and the global linear projection parameter set.

[0052] Each edge client device writes the final global dynamic sensitive parameter set obtained from parsing into the dynamic sensitive parameter set storage area in the local sub-model of the large language model, and writes the global linear projection parameter set obtained from parsing into the linear projection parameter set storage area in the local sub-model of the large language model, replacing the corresponding local parameter set, thus completing the parameter update of the local sub-model of the large language model.

[0053] The beneficial effects of this invention are:

[0054] (1) This invention introduces a state space matrix parameter aggregation mechanism based on log-Euclidean manifold in the federated aggregation stage, which constrains the dynamic stability of the selective state space model. This significantly overcomes the dynamic characteristic collapse problem caused by the traditional Euclidean linear averaging. Furthermore, the aggregation process is completed in the log-Euclidean manifold, ensuring that the aggregation result maintains stable matrix characteristics in structure. In the long text access request scenario, compared with the traditional FedAvg aggregation method, the stability index of the model after the same number of training rounds does not show an increase in spectral radius. The gradient norm fluctuation range is reduced during long sequence inference, which improves the stability and reliability of the large language model when processing long sequence access requests at the edge.

[0055] (1) This invention addresses the performance trade-off caused by the simple averaging of time-scale parameters under heterogeneous data distribution conditions by introducing a normalized gradient weighting mechanism based on time-scale gradient sensitivity to perform differentiated aggregation of time-scale parameters. By calculating the L2 norm of the gradient vector of the training loss of each edge client device with respect to the time-scale parameters as a time-scale gradient sensitivity index, and combining this with the number of client samples to construct normalized gradient weights, the time-scale parameters that are more sensitive to changes in training loss receive higher weights in the aggregation. In scenarios with obvious Non-IID data distribution, the time-scale parameter aggregation strategy of this invention, compared with the traditional sample number weighting method, improves the detection accuracy of the global model in the abnormal access behavior identification task, while reducing the false alarm rate and enhancing the model's adaptability to diverse access request patterns.

[0056] (1) The invention combines Hurwitz stability zero-knowledge proof and privacy computing encryption mechanism in the model parameter encapsulation and distribution stage, which realizes the verifiable guarantee of global model stability without disclosing the specific values ​​of dynamic sensitive parameters, and enhances the overall credibility of the Fed Mamba-TAS model access security system. By constructing Hurwitz stability zero-knowledge proof when generating global Fed Mamba-TAS model parameter package, and encrypting and encapsulating the model parameters and proof data respectively, each edge client device can verify the stability conditions of the state space matrix parameters after decryption without obtaining the specific parameter values. This effectively prevents model instability caused by errors or abnormal aggregation, and ensures that the original access request log data and model intermediate values ​​are not disclosed during the parameter update process, thereby improving the compliance and security level of the system. Attached Figure Description

[0057] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0058] Figure 1 This is a flowchart of a secure access method for large language models based on federated learning and privacy computing proposed in this invention. Detailed Implementation

[0059] Example 1: Reference Figure 1 A secure access method for large language models based on federated learning and privacy computing includes:

[0060] Deploy local sub-models of a large language model containing a selective state-space model on multiple edge client devices;

[0061] In this embodiment, the local sub-model of the large language model consists of a set of dynamic sensitive parameters and a set of linear projection parameters. Each edge client device trains the local sub-model of the large language model using access request log data under the protection of a trusted execution environment, and obtains the updated set of dynamic sensitive parameters, the updated set of linear projection parameters, and gradient information corresponding to the time scale parameters. Each edge client device performs parameter decoupling operation on the updated set of dynamic sensitive parameters and the updated set of linear projection parameters to obtain the set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded. At the same time, it calculates the time scale gradient sensitivity index based on the gradient information.

[0062] Each edge client device uses a privacy computing encryption mechanism to encrypt the set of dynamic sensitive parameters to be uploaded, the set of linear projection parameters to be uploaded, and the time-scale gradient sensitivity index in the local sub-model of the large language model, forming an encrypted set of dynamic sensitive parameters, an encrypted set of linear projection parameters, and an encrypted time-scale gradient sensitivity index, which are then sent to the federated aggregation server through a secure upload channel.

[0063] In this embodiment, an encrypted dynamic sensitive parameter set, an encrypted linear projection parameter set, and an encrypted time-scale gradient sensitivity index are formed, including:

[0064] The privacy computing encryption mechanism is initialized, the security parameters of the privacy computing encryption mechanism are set, the public key and private key corresponding to the edge client device are generated, and the encryption operator based on the public key and the decryption operator based on the private key are determined.

[0065] Any plaintext data to be encrypted can be first encrypted using a public-key encryption operator, and then decrypted using a private-key decryption operator to recover the original plaintext data. Security parameters are used to limit the security strength of the privacy computing encryption mechanism. The public-key encryption operator is used to convert the plaintext data to be encrypted into ciphertext data, and the private-key decryption operator is used to recover the ciphertext data from the original plaintext data to be encrypted.

[0066] The set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded are mapped into fixed-length plaintext vectors, while the time-scale gradient sensitivity index is preserved as a scalar plaintext form.

[0067] By using public-key cryptographic operators, the set of dynamic sensitive parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of dynamic sensitive parameters, the set of linear projection parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of linear projection parameters, and the time-scale gradient sensitivity index in the form of scalar plaintext is converted into an encrypted time-scale gradient sensitivity index.

[0068] The encrypted dynamic sensitive parameter set, encrypted linear projection parameter set, encrypted time-scale gradient sensitivity index, security parameters of privacy computing encryption mechanism, edge client device identifier, and current federated training round are packaged together to construct an upload message, which is then sent to the federated aggregation server through a secure upload channel.

[0069] The uploaded message is used to uniquely identify the encrypted dynamic sensitive parameter set, encrypted linear projection parameter set, and encrypted time-scale gradient sensitivity index to be uploaded in a federated training round.

[0070] The federated aggregation server performs weighted arithmetic aggregation on the received encrypted linear projection parameter set, with the weight being the number of client samples, to obtain the global linear projection parameter set, and temporarily stores the global linear projection parameter set in the global FedMamba-TAS model structure;

[0071] In this embodiment, the federated aggregation server performs weighted arithmetic aggregation on the received set of encrypted linear projection parameters, with the weight being the number of client samples, including:

[0072] The federated aggregation server receives upload messages from multiple edge client devices in a single federated training round, and parses each upload message to obtain the set of encrypted linear projection parameters corresponding to the upload message.

[0073] For each set of encrypted linear projection parameters, obtain the corresponding number of client samples and the total number of client samples;

[0074] The number of client samples corresponding to the access request log data of the k-th edge client device used to train the local sub-model of the large language model in this federated training round is recorded as the number of client samples of the k-th edge client device. The total number of client samples is obtained by summing the number of client samples of all edge client devices in this federated training round. The total number of client samples is used to represent the sum of the number of client samples of all edge client devices in this federated training round.

[0075] By dividing the number of kth client samples by the total number of client samples, a corresponding weighting coefficient is assigned to each set of encrypted linear projection parameters.

[0076] By performing weighted arithmetic aggregation on each set of encrypted linear projection parameters using weighted coefficients, the global linear projection parameter set of the ciphertext domain is obtained.

[0077] Weighted arithmetic aggregation is obtained by multiplying each encrypted linear projection parameter set by its corresponding weighting coefficient and then summing them in the encrypted domain to obtain the global linear projection parameter set in the encrypted domain. This set is used to represent the aggregation result of all encrypted linear projection parameter sets in this federated training round under the constraint of the proportion of client sample quantity.

[0078] Within a single federated training round, the set of global linear projection parameters in the ciphertext domain is decrypted using a private key decryption operator to restore the set of global linear projection parameters in the ciphertext domain to its plaintext representation.

[0079] The federated aggregation server writes the plaintext representation of the global linear projection parameter set into the corresponding linear projection parameter set storage area in the global Fed Mamba-TAS model structure.

[0080] The global Fed Mamba-TAS model is a complete model instance built by writing the final global dynamic sensitive parameter set and the global linear projection parameter set into the preset model structure template. The model structure template is consistent with the local sub-model structure of the large language model in the edge client device. The current federated training round is associated with the plaintext representation of the global linear projection parameter set, and the global linear projection parameter set is temporarily stored.

[0081] The federated aggregation server performs cryptographic domain weighted aggregation on the state space matrix parameters in the received cryptographic dynamic sensitive parameter set in a log-Euclidean manifold to obtain aggregated state space matrix parameters that satisfy Hurwitz stability, and combines them with the remaining parameters in the cryptographic dynamic sensitive parameter set to generate an intermediate global dynamic sensitive parameter set.

[0082] In this embodiment, the federated aggregation server performs cryptographic domain weighted aggregation on the state space matrix parameters in the received set of encrypted dynamic sensitive parameters within a logarithmic Euclidean manifold, including:

[0083] Each uploaded message is parsed to obtain the set of encrypted dynamic sensitive parameters corresponding to the uploaded message, and the ciphertext representation of the state space matrix parameters is extracted from the set of encrypted dynamic sensitive parameters.

[0084] The encrypted representation of the state space matrix parameters uploaded by the kth edge client device is denoted as the encrypted representation of the kth state space matrix parameters. The state space matrix parameters are used to characterize the dynamic properties of the selective state space model.

[0085] Perform a logarithmic field transformation and weighted arithmetic aggregation based on the logarithmic Euclidean manifold on the ciphertext representation of each state space matrix parameter to obtain the logarithmic field representation of the k-th state space matrix parameter;

[0086] The logarithmic field transformation and weighted arithmetic are aggregated as follows: the ciphertext representation of the k-th state space matrix parameter is decrypted in the decryption environment to obtain the plaintext representation of the k-th state space matrix parameter. The plaintext representation of the k-th state space matrix parameter is then subjected to negative matrix construction. The plaintext representation of the k-th state space matrix parameter is multiplied by negative one to obtain the negative state space matrix. The negative state space matrix is ​​then subjected to eigenvalue decomposition, decomposing it into the product of an eigenvector matrix and an eigenvalue diagonal matrix. The natural logarithm is then performed on each eigenvalue of the eigenvalue diagonal matrix to obtain the logarithmic eigenvalue diagonal matrix. The matrix is ​​then reconstructed using the eigenvector matrix, the logarithmic eigenvalue diagonal matrix, and the inverse of the eigenvector matrix to obtain the logarithmic field representation of the k-th state space matrix parameter.

[0087] A weighted arithmetic aggregation is performed on the logarithmic field representation of the state space matrix parameters corresponding to all edge client devices to obtain the aggregated logarithmic matrix;

[0088] Weighted arithmetic aggregation involves multiplying the logarithmic field representations of the state space matrix parameters corresponding to all edge client devices by the corresponding k-th weighting coefficient, and then performing matrix addition to accumulate the logarithmic field representations of each state space matrix parameter after multiplying them by the corresponding k-th weighting coefficient, to obtain the aggregated logarithmic matrix. The aggregated logarithmic matrix is ​​used to represent the logarithmic field aggregation result of all state space matrix parameters under the sample proportion weight constraint in this federated training round.

[0089] Perform matrix exponentiation on the aggregated logarithmic matrix to restore the parameters of the aggregated state space matrix;

[0090] The matrix exponentiation operation includes: performing eigenvalue decomposition on the aggregated logarithmic matrix, representing the aggregated logarithmic matrix as a decomposition consisting of an eigenvector matrix, an eigenvalue diagonal matrix, and the inverse of the eigenvector matrix; performing exponentiation on each eigenvalue of the eigenvalue diagonal matrix to obtain an exponential eigenvalue diagonal matrix; reconstructing the matrix using the eigenvector matrix, the exponential eigenvalue diagonal matrix, and the inverse of the eigenvector matrix to obtain the matrix exponentiation result matrix; and taking the negative to obtain the aggregated state space matrix parameters. The aggregated state space matrix parameters are used as state space matrix parameters in the intermediate global dynamic sensitive parameter set. The aggregated state space matrix parameters satisfy the Hurwitz stability condition, which is defined as the real part of all eigenvalues ​​of the aggregated state space matrix parameters being less than zero.

[0091] Extract the remaining parameters except for the aggregated state space matrix parameters from the encrypted dynamic sensitive parameter set, decrypt them to obtain the plaintext representation of the remaining parameters corresponding to the k-th edge client device, and perform weighted arithmetic aggregation based on the weighting coefficients to obtain the aggregation result of the remaining parameters;

[0092] In Example 1, the ciphertext representations of the parameters other than the state space matrix parameters are extracted from the set of encrypted dynamic sensitive parameters. In the decryption environment, the ciphertext representations of the remaining parameters corresponding to the kth edge client device are decrypted to obtain the plaintext representation of the kth remaining parameter. The plaintext representation of the kth remaining parameter is multiplied by the corresponding kth weighting coefficient. The plaintext representations of the remaining parameters corresponding to all edge client devices are multiplied by the corresponding kth weighting coefficient and then accumulated by vector or matrix addition to obtain the aggregated result of the remaining parameters.

[0093] The aggregated state space matrix parameters that satisfy the Hurwitz stability condition are combined with the aggregated results of other parameters to form an intermediate global dynamic sensitive parameter set.

[0094] In Example 1, the aggregated state space matrix parameters that satisfy the Hurwitz stability condition are written into the dynamic sensitive parameter set structure as the update values ​​of the state space matrix parameter positions. The aggregated results of the remaining parameters are written into the dynamic sensitive parameter set structure as the update values ​​of the dynamic sensitive parameter positions other than the state space matrix parameters. The parameter writing is completed by replacing the corresponding parameter values ​​in turn according to the original index positions of each parameter in the dynamic sensitive parameter set structure. The parameters after writing constitute an intermediate global dynamic sensitive parameter set. The current federated training round is associated with the intermediate global dynamic sensitive parameter set.

[0095] The federated aggregation server decrypts the encrypted time-scale gradient sensitivity index, calculates the normalized gradient weight based on the number of samples from each client and the time-scale gradient sensitivity index, and performs gradient sensitivity weighted aggregation on the time-scale parameters in the intermediate global dynamic sensitive parameter set to obtain the updated global time-scale parameters.

[0096] In this embodiment, the federated aggregation server decrypts the encrypted time-scale gradient sensitivity index and calculates the normalized gradient weight based on the number of samples from each client and the time-scale gradient sensitivity index, including:

[0097] The federated aggregation server parses the encrypted time-scale gradient sensitivity index carried in each uploaded message to obtain the encrypted time-scale gradient sensitivity index corresponding to the kth edge client device, and performs decryption processing through the decryption operator based on the private key to obtain the kth time-scale gradient sensitivity index.

[0098] The gradient sensitivity index for the k-th time scale is obtained by calculating the gradient vector of the training loss of the k-th edge client device with respect to the parameters of the k-th time scale, squaring all components in the gradient vector, summing all the squared results, and then taking the square root.

[0099] The k-th timescale parameter represents the timescale parameter in the local sub-model of the large language model of the k-th edge client device. The k-th training loss represents the training loss calculated by the k-th edge client device based on access request log data. The gradient vector represents the vector composed of the partial derivatives of the k-th training loss with respect to the k-th timescale parameter. The k-th timescale gradient sensitivity index is used to measure the sensitivity of the k-th timescale parameter to the k-th training loss.

[0100] Multiply the number of samples from the kth client by the gradient sensitivity index at the kth time scale to calculate the weighted gradient sensitivity at the kth time scale.

[0101] The total weighted amount of time-scale gradient sensitivity is obtained by summing the weighted amounts of the time-scale gradient sensitivity for all edge client devices.

[0102] Divide the gradient sensitivity weight of the kth time scale by the total gradient sensitivity weight of the time scale to obtain the normalized gradient weight of the kth time scale.

[0103] The time-scale parameter is located from the intermediate global dynamic sensitive parameter set. Based on the normalized gradient weights, the time-scale parameter is subjected to gradient sensitivity weighted aggregation in one federated training round to obtain the updated global time-scale parameter.

[0104] In Example 1, the plaintext representation of the time-scale parameter is extracted from the dynamic sensitive parameter set corresponding to each edge client device and recorded as the k-th time-scale parameter. All k-th time-scale parameters are multiplied by the corresponding k-th normalized gradient weight, and the product results are accumulated by addition to obtain the updated global time-scale parameter. The updated global time-scale parameter is used as the update value of the time-scale parameter in the intermediate global dynamic sensitive parameter set.

[0105] The federated aggregation server merges the updated global timescale parameters with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set. The federated aggregation server encapsulates the final global dynamic sensitive parameter set and the global linear projection parameter set into a global Fed Mamba-TAS model parameter package. It encrypts the global Fed Mamba-TAS model parameter package and its Hurwitz stability zero-knowledge proof to obtain the encrypted global model update package.

[0106] In this embodiment, the federated aggregation server merges the updated global timescale parameters with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set, including:

[0107] Write the updated global timescale parameters into the corresponding timescale parameter positions in the intermediate global dynamic sensitive parameter set to obtain the final global dynamic sensitive parameter set;

[0108] In Example 1, the updated global timescale parameters are written into the intermediate global dynamic sensitive parameter set structure as the updated values ​​of the timescale parameter positions. By replacing the original index positions of the timescale parameters in the intermediate global dynamic sensitive parameter set structure with the updated global timescale parameters, the final global dynamic sensitive parameter set is obtained. The final global dynamic sensitive parameter set represents the overall dynamic sensitive parameter set after the aggregation of state space matrix parameters and the weighted aggregation of timescale parameter gradient sensitivity are completed in this federated training round.

[0109] The plaintext representation of the global linear projection parameter set and the final global dynamic sensitive parameter set are structurally encapsulated to construct the global Fed Mamba-TAS model parameter package;

[0110] In Example 1, the final global dynamic sensitive parameter set is taken as the data block of the dynamic sensitive parameter region, and the plaintext representation of the global linear projection parameter set is taken as the data block of the linear projection parameter region. They are arranged and spliced ​​according to the parameter storage order in the global FedMamba-TAS model structure. The data blocks of the dynamic sensitive parameter region and the data blocks of the linear projection parameter region are written into the model parameter storage structure in sequence to obtain the global FedMamba-TAS model parameter package.

[0111] Perform Hurwitz stability verification on the state space matrix parameters in the final global dynamic sensitive parameter set, and generate Hurwitz stability zero-knowledge proof based on the Hurwitz stability verification results;

[0112] In Example 1, eigenvalue calculation is performed on the state space matrix parameters in the final global dynamic sensitive parameter set to obtain the complete set of eigenvalues ​​of the state space matrix parameters. The real part of each eigenvalue is extracted. If the real part of all eigenvalues ​​is less than zero, it is determined that the state space matrix parameters in the final global dynamic sensitive parameter set satisfy the Hurwitz stability condition. The Hurwitz stability condition is used to limit the state space matrix parameters to maintain convergence characteristics in dynamics.

[0113] After determining that the state space matrix parameters in the final global dynamic sensitive parameter set satisfy the Hurwitz stability condition, a set of proof data structures is constructed to prove that the real parts of all eigenvalues ​​are less than zero. Without disclosing the specific values ​​of the state space matrix parameters, a zero-knowledge proof of Hurwitz stability is generated to prove to each edge client device that the state space matrix parameters in the final global dynamic sensitive parameter set satisfy the Hurwitz stability condition.

[0114] The global Fed Mamba-TAS model parameter package and the Hurwitz stability zero-knowledge proof are encrypted to obtain an encrypted global model update package.

[0115] In Example 1, a public-key-based encryption operator is invoked to input the global Fed Mamba-TAS model parameter package as plaintext data to be encrypted. All parameter values ​​in the global Fed Mamba-TAS model parameter package are encrypted segment by segment according to the parameter storage order to obtain ciphertext model parameter data. The Hurwitz stability zero-knowledge proof is then input as plaintext data to be encrypted. All proof data in the Hurwitz stability zero-knowledge proof are encrypted segment by segment according to the proof data structure order to obtain ciphertext proof data. The ciphertext model parameter data and the ciphertext proof data are concatenated and encapsulated according to a preset model update package data structure. During the encapsulation process, the current federated training round identifier and data length identifier are written to form a complete data structure. This complete data structure is the encrypted global model update package, which is used to send to each edge client device through a secure distribution channel.

[0116] The federated aggregation server distributes encrypted global model update packages to each edge client device through a secure distribution channel. Each edge client device decrypts the encrypted global model update package after verifying the zero-knowledge proof, and replaces the corresponding local parameter set with the final global dynamic sensitive parameter set and global linear projection parameter set to complete the parameter update of the local sub-model of the local large language model.

[0117] In this implementation, the local corresponding parameter set is replaced with the final global dynamic sensitive parameter set and the global linear projection parameter set to complete the parameter update of the local sub-model of the local large language model, including:

[0118] Within the current federated training round, the federated aggregation server distributes encrypted global model update packages to each edge client device via a secure distribution channel.

[0119] Each edge client device receives the encrypted global model update packet from the secure delivery channel, and performs data structure parsing on the encrypted global model update packet to separate the encrypted model parameter data and the encrypted proof data.

[0120] The encrypted model parameter data is used to carry the encrypted form of the global Fed Mamba-TAS model parameter package, and the encrypted proof data is used to carry the encrypted form of the Hurwitz stability zero-knowledge proof.

[0121] Each edge client device performs decryption processing on the proof ciphertext data using the decryption operator corresponding to the private key, to obtain the plaintext representation of the Hurwitz stability zero-knowledge proof, and performs verification processing on the plaintext representation of the Hurwitz stability zero-knowledge proof.

[0122] After the Hurwitz stability zero-knowledge proof verification is passed, each edge client device performs decryption processing on the encrypted data of the model parameters using the decryption operator corresponding to the private key, to obtain the plaintext representation of the global Fed Mamba-TAS model parameter packet, and parses the plaintext representation of the global Fed Mamba-TAS model parameter packet to obtain the final global dynamic sensitive parameter set and the global linear projection parameter set.

[0123] Each edge client device writes the final global dynamic sensitive parameter set obtained from parsing into the dynamic sensitive parameter set storage area in the local sub-model of the large language model, and writes the global linear projection parameter set obtained from parsing into the linear projection parameter set storage area in the local sub-model of the large language model, replacing the corresponding local parameter set, thus completing the parameter update of the local sub-model of the large language model.

[0124] In Example 1, the original parameter values ​​in the storage area of ​​the dynamic sensitive parameter set are replaced by the final global dynamic sensitive parameter set as a whole according to the parameter storage index order of the local sub-model of the large language model. The original parameter values ​​in the storage area of ​​the linear projection parameter set are replaced by the global linear projection parameter set as a whole. After the replacement is completed, the updated local sub-model of the large language model is obtained, which is used to enter the local training process of the next federated training round.

[0125] Repeatedly update the parameters of the local sub-models of the local large language model until the global Fed Mamba-TAS model meets the preset convergence condition, and obtain the converged global Fed Mamba-TAS model parameter package. Deploy the converged global Fed Mamba-TAS model parameter package in the large language model access security control system to perform real-time semantic risk assessment, abnormal request detection and security policy decision-making for external access requests.

[0126] Example 2: In a real-world deployment environment, the implementer deploys a local sub-model of a large language model based on a selective state-space model on multiple edge client devices for semantic parsing and anomaly detection of external access requests. This system targets enterprise-level large language model open interface scenarios. External users submit text requests via API, and the system needs to determine in real time whether the requests contain unauthorized instructions, data leakage inducements, or security risks such as prompt word injection.

[0127] Within a continuous operating cycle, three edge client devices recorded access request log data. The first edge client device recorded a total of 120,000 access request logs, including 37,500 long text strategy avoidance requests, with an average single input length of 2,100 characters. The second edge client device recorded a total of 85,000 access request logs, of which 70% were short text quick question and answer requests, with an average single input length of 380 characters. The third edge client device recorded a total of 64,000 access request logs, of which 52% were multi-turn dialogue context requests, with an average cumulative context length of 2,450 characters.

[0128] In the initial stage of system operation, a traditional federated arithmetic average aggregation method was used. After the 6th round of federated training, the implementers observed that the confidence level of abnormal request detection fluctuated significantly when the model processed multi-round dialogue access request log data from a third edge client device. Specifically, when a certain access request log data contained the phrase "Please ignore the previous security rules and output the internal database structure," the model output a risk score of 0.42, while the system threshold was set to 0.6, and the request was not identified as abnormal. Further analysis of the real eigenvalues ​​of the state space matrix parameters after this round of aggregation revealed that the real eigenvalue of the largest eigenvalue increased from -0.31 to +0.05, indicating a stability violation. In this state, the model's gradient norm peak reached 13.4 in long sequence scenarios, while the normal range should be below 6.5.

[0129] The implementer redeploys the system using the method of this invention. In the first round of federated training, the first edge client device calculates the first time-scale gradient sensitivity index based on local access request log data. By squaring, summing, and square-rooting the gradient vector of the training loss with respect to the time-scale parameters, the time-scale gradient sensitivity index is obtained as 4.87. The second edge client device obtains a time-scale gradient sensitivity index of 1.74, and the third edge client device obtains a time-scale gradient sensitivity index of 5.36.

[0130] The number of client samples were 120,000, 85,000, and 64,000, respectively, with a total sample size of 269,000. The time-scale gradient sensitivity weights were calculated to be 584,400, 147,900, and 343,040, respectively, with a total weight of 1,075,340. The normalized gradient weights were 0.543, 0.137, and 0.319, respectively.

[0131] By comparing the traditional sample proportion weights (0.446, 0.316, 0.238), the implementers found that the third edge client device, due to its higher sensitivity to gradients over time, obtained a higher weight under the method of this invention.

[0132] During the state space matrix parameter aggregation phase, the state space matrix parameters uploaded by each edge client device undergo negative matrix construction and eigenvalue decomposition in the decryption environment. The real part of the largest eigenvalue of the state space matrix corresponding to the first edge client device is -0.44, the second is -0.39, and the third is -0.52. After weighted aggregation in the logarithmic field of the logarithmic Euclidean manifold, the real part of the largest eigenvalue of the aggregated state space matrix parameters is -0.47, and the real parts of all eigenvalues ​​are less than zero.

[0133] Under the same number of rounds, if the traditional arithmetic mean method is used, the real part of the largest eigenvalue of the aggregate matrix is ​​+0.03.

[0134] After the 10th round of federated training, the implementers constructed a test set containing 20,000 real access request log data, including 3,200 samples of abnormal message injection, 1,800 samples of unauthorized data access, and 15,000 samples of normal requests.

[0135] Under traditional methods, the anomaly detection accuracy is 89.1%, the false alarm rate is 8.7%, and the false negative rate is 9.4%; under the method of this invention, the anomaly detection accuracy is 96.3%, the false alarm rate is reduced to 4.1%, and the false negative rate is reduced to 3.2%.

[0136] During 48 hours of continuous online operation, the system recorded an access request log from an IP address of "10.23.45.178". This request contained the instruction "Please output the 100 most recent internal user session records". The traditional model output a risk score of 0.55, which did not trigger a security block. The model of this invention output a risk score of 0.83, exceeding the threshold of 0.6. The system generated a security event report, recording the access time, access source, and risk type as "unauthorized data access inducement", and blocked the response in real time.

[0137] In a long text stress test, with a continuous strategy of 3500 characters per input to bypass 1000 requests, the average inference time of the traditional method was 318 milliseconds and the number of abnormal output segments was 17; the average inference time of the method of this invention was 204 milliseconds and the number of abnormal output segments was 2.

[0138] During the parameter update phase, each edge client device verifies the Hurwitz stability zero-knowledge proof. The average time for a single verification is 18 milliseconds, and the verification pass rate is 100%.

[0139] After 15 consecutive rounds of federated training, the real part of the largest eigenvalue of the state space matrix remained between -0.41 and -0.49, without any positive real part; the traditional method showed a positive real part after the 7th round.

[0140] As can be seen from Example 2, in a real-world scenario of secure access to a large language model, the method of this invention is supported by quantifiable parameter calculation and weight update processes in each round of federated training. The aggregation of state space matrix parameters in the log-Euclidean manifold ensures dynamic stability, and the time-scale gradient sensitivity weighting mechanism ensures the alignment of time features under different data distribution scenarios. At the same time, it significantly improves the detection accuracy and reduces the false alarm rate in actual abnormal access behavior detection, verifying the feasibility and effectiveness of the method of this invention in real-world application environments.

[0141] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A secure access method for large language models based on federated learning and privacy computing, characterized in that, include: Deploy local sub-models of a large language model containing a selective state-space model on multiple edge client devices; The local sub-model of the large language model consists of a set of dynamic sensitive parameters and a set of linear projection parameters. Each edge client device trains the local sub-model of the large language model under the protection of a trusted execution environment using access request log data, and obtains the updated set of dynamic sensitive parameters, the updated set of linear projection parameters, and gradient information corresponding to the time scale parameters. Each edge client device performs parameter decoupling operation on the updated set of dynamic sensitive parameters and the updated set of linear projection parameters to obtain the set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded. At the same time, it calculates the time scale gradient sensitivity index based on the gradient information. Each edge client device uses a privacy computing encryption mechanism to encrypt the parameter set in the local sub-model of the large language model, forming an encrypted dynamic sensitive parameter set, an encrypted linear projection parameter set, and an encrypted time-scale gradient sensitivity index, which are then sent to the federated aggregation server. The formation of the encrypted dynamic sensitive parameter set, the encrypted linear projection parameter set, and the encrypted time-scale gradient sensitivity index includes: The privacy computing encryption mechanism is initialized, the security parameters of the privacy computing encryption mechanism are set, the public key and private key corresponding to the edge client device are generated, and the encryption operator based on the public key and the decryption operator based on the private key are determined. The set of dynamic sensitive parameters to be uploaded and the set of linear projection parameters to be uploaded are mapped into fixed-length plaintext vectors, while the time-scale gradient sensitivity index is preserved as a scalar plaintext form. By using public-key cryptographic operators, the set of dynamic sensitive parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of dynamic sensitive parameters, the set of linear projection parameters to be uploaded in the form of fixed-length plaintext vectors is converted into an encrypted set of linear projection parameters, and the time-scale gradient sensitivity index in the form of scalar plaintext is converted into an encrypted time-scale gradient sensitivity index. The encrypted dynamic sensitive parameter set, encrypted linear projection parameter set, encrypted time-scale gradient sensitivity index, security parameters of privacy computing encryption mechanism, edge client device identifier and current federated training round are packaged together to construct an upload message and sent to the federated aggregation server through a secure upload channel. Perform a weighted arithmetic aggregation with a weight equal to the number of client samples on the received set of encrypted linear projection parameters to obtain the global set of linear projection parameters; The state space matrix parameters in the received encrypted dynamic sensitive parameter set are subjected to cryptographic domain weighted aggregation in a log-Euclidean manifold to obtain aggregated state space matrix parameters, which are then combined with the remaining parameters of the encrypted dynamic sensitive parameter set to generate an intermediate global dynamic sensitive parameter set. The federated aggregation server decrypts the encrypted time-scale gradient sensitivity index and calculates normalized gradient weights based on the number of samples from each client and the time-scale gradient sensitivity index, including: The federated aggregation server parses the encrypted time-scale gradient sensitivity index carried in each uploaded message to obtain the encrypted time-scale gradient sensitivity index corresponding to the kth edge client device, and performs decryption processing through the decryption operator based on the private key to obtain the kth time-scale gradient sensitivity index. Multiply the number of samples from the kth client by the gradient sensitivity index at the kth time scale to calculate the weighted gradient sensitivity at the kth time scale. The total weighted amount of time-scale gradient sensitivity is obtained by summing the weighted amounts of the time-scale gradient sensitivity for all edge client devices. Divide the gradient sensitivity weight of the kth time scale by the total gradient sensitivity weight of the time scale to obtain the normalized gradient weight of the kth time scale. Locate the time-scale parameter position from the intermediate global dynamic sensitive parameter set, and perform gradient sensitivity weighted aggregation on the time-scale parameter in one federated training round according to the normalized gradient weight to obtain the updated global time-scale parameter. The updated global timescale parameters are merged with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set. This set is then encapsulated with the global linear projection parameter set into a global Fed Mamba-TAS model parameter package and encrypted to obtain the encrypted global model update package. After verifying the zero-knowledge proof, decrypt the encrypted global model update package, replace the corresponding local parameter set with the final global dynamic sensitive parameter set and global linear projection parameter set, and complete the parameter update of the local large language model and local sub-model. Repeatedly update the parameters of the local sub-models of the local large language model until the preset convergence condition is met, obtain the converged global Fed Mamba-TAS model parameter package, and deploy it in the large language model access security control system.

2. The method for secure access to a large language model based on federated learning and privacy computing according to claim 1, characterized in that, The federated aggregation server performs weighted arithmetic aggregation on the received set of encrypted linear projection parameters, with the weight being the number of client samples, including: The federated aggregation server receives upload messages from multiple edge client devices in a single federated training round, and parses each upload message to obtain the set of encrypted linear projection parameters corresponding to the upload message. For each set of encrypted linear projection parameters, obtain the corresponding number of client samples and the total number of client samples; By dividing the number of kth client samples by the total number of client samples, a corresponding weighting coefficient is assigned to each set of encrypted linear projection parameters. By performing weighted arithmetic aggregation on each set of encrypted linear projection parameters using weighted coefficients, the global linear projection parameter set of the ciphertext domain is obtained. Within a single federated training round, the set of global linear projection parameters in the ciphertext domain is decrypted using a private key decryption operator to restore the set of global linear projection parameters in the ciphertext domain to its plaintext representation. The federated aggregation server writes the plaintext representation of the global linear projection parameter set into the corresponding linear projection parameter set storage area in the global Fed Mamba-TAS model structure.

3. The method for secure access to a large language model based on federated learning and privacy computing according to claim 2, characterized in that, The federated aggregation server performs cryptographic domain-weighted aggregation on the state space matrix parameters in the received set of cryptographically sensitive dynamic parameters within a log-Euclidean manifold, including: Each uploaded message is parsed to obtain the set of encrypted dynamic sensitive parameters corresponding to the uploaded message, and the ciphertext representation of the state space matrix parameters is extracted from the set of encrypted dynamic sensitive parameters. Perform a logarithmic field transformation and weighted arithmetic aggregation based on the logarithmic Euclidean manifold on the ciphertext representation of each state space matrix parameter to obtain the logarithmic field representation of the k-th state space matrix parameter; A weighted arithmetic aggregation is performed on the logarithmic field representation of the state space matrix parameters corresponding to all edge client devices to obtain the aggregated logarithmic matrix; Perform matrix exponentiation on the aggregated logarithmic matrix to restore the parameters of the aggregated state space matrix; Extract the remaining parameters except for the aggregated state space matrix parameters from the encrypted dynamic sensitive parameter set, decrypt them to obtain the plaintext representation of the remaining parameters corresponding to the k-th edge client device, and perform weighted arithmetic aggregation based on the weighting coefficients to obtain the aggregation result of the remaining parameters; The aggregated state space matrix parameters that satisfy the Hurwitz stability condition are combined with the aggregated results of other parameters to form an intermediate global dynamic sensitive parameter set.

4. The method for secure access to a large language model based on federated learning and privacy computing according to claim 3, characterized in that, The federated aggregation server merges the updated global timescale parameters with the intermediate global dynamic sensitive parameter set to form the final global dynamic sensitive parameter set, including: Write the updated global timescale parameters into the corresponding timescale parameter positions in the intermediate global dynamic sensitive parameter set to obtain the final global dynamic sensitive parameter set; The plaintext representation of the global linear projection parameter set and the final global dynamic sensitive parameter set are structurally encapsulated to construct the global Fed Mamba-TAS model parameter package; Perform Hurwitz stability verification on the state space matrix parameters in the final global dynamic sensitive parameter set, and generate Hurwitz stability zero-knowledge proof based on the Hurwitz stability verification results; The global Fed Mamba-TAS model parameter package and the Hurwitz stability zero-knowledge proof are encrypted to obtain an encrypted global model update package.

5. The method for secure access to a large language model based on federated learning and privacy computing according to claim 4, characterized in that, The step of replacing the local corresponding parameter set with the final global dynamic sensitive parameter set and the global linear projection parameter set to complete the parameter update of the local sub-model of the local large language model includes: Within the current federated training round, the federated aggregation server distributes encrypted global model update packages to each edge client device via a secure distribution channel. Each edge client device receives the encrypted global model update packet from the secure delivery channel, and performs data structure parsing on the encrypted global model update packet to separate the encrypted model parameter data and the encrypted proof data. Each edge client device performs decryption processing on the proof ciphertext data using the decryption operator corresponding to the private key, to obtain the plaintext representation of the Hurwitz stability zero-knowledge proof, and performs verification processing on the plaintext representation of the Hurwitz stability zero-knowledge proof. After the Hurwitz stability zero-knowledge proof verification is passed, each edge client device performs decryption processing on the encrypted data of the model parameters using the decryption operator corresponding to the private key, to obtain the plaintext representation of the global Fed Mamba-TAS model parameter packet, and parses the plaintext representation of the global Fed Mamba-TAS model parameter packet to obtain the final global dynamic sensitive parameter set and the global linear projection parameter set. Each edge client device writes the final global dynamic sensitive parameter set obtained from parsing into the dynamic sensitive parameter set storage area in the local sub-model of the large language model, and writes the global linear projection parameter set obtained from parsing into the linear projection parameter set storage area in the local sub-model of the large language model, replacing the corresponding local parameter set, thus completing the parameter update of the local sub-model of the large language model.

Images