Method and device for hierarchical decryption of fine-tuned LoRA model by computing power of intelligent computing cloud platform

Abstract

The application provides a hierarchical decryption method and device for fine-tuned LoRA model through computing power by an intelligent computing cloud platform, relates to the technical fields of intelligent computing center, intelligent computing center, computing power infrastructure and intelligent computing cloud, and comprises the following steps: S1, obtaining LoRA parameters and structure metadata; S2, performing structure-aware fragmentation and disturbance packaging on the LoRA parameters to obtain a LoRA fragmented package; S3, performing remote proof for a terminal device requesting to run the LoRA fragmented package; S4, determining the running key of the current session of the terminal device when the remote proof is passed; and S5, when each computing unit in the base model is executed, using the running key to decrypt the LoRA fragments required by the computing unit, calculating the decrypted plaintext together with the computing unit, and deleting the plaintext after the calculation is completed. The application can realize LoRA running state control, avoid forming a large range of long-term plaintext, and reduce the leakage risk of LoRA.

Description

Technical Field

[0001] This invention relates to the fields of intelligent computing centers, smart computing centers, computing infrastructure, and smart cloud computing technologies, specifically to a method and apparatus for layered decryption of a fine-tuned LoRA model using computing power on an intelligent computing cloud platform. Background Technology

[0002] With the rapid development of artificial intelligence technology, "intelligent computing centers" and "smart computing centers" have emerged.

[0003] An "intelligent computing center" refers to a facility that provides the necessary computing power, data, and algorithms for artificial intelligence applications (such as the development, training, and inference of deep learning models) by utilizing large-scale heterogeneous computing resources, including general-purpose and intelligent computing power. Intelligent computing centers encompass facilities, hardware, and software, and can provide full-stack capabilities from underlying computing power to top-level application enablement.

[0004] "Intelligent computing center" includes, but is not limited to, "intelligent computing center".

[0005] "Intelligent computing center" or artificial intelligence computing center is a type of computing infrastructure that provides computing power services, data services, and algorithm services required for artificial intelligence applications, based on artificial intelligence theory and adopting artificial intelligence computing architecture.

[0006] "Computing power" is the core of "intelligent computing center" and "smart computing center". It is the ability of computer equipment or computing / data center to process parameters. It is the ability of computer hardware and software to work together to execute a certain computing requirement. It is the computing power to achieve the target result output by processing parameter data. It is a new type of productivity that integrates parameter computing power, network carrying capacity and data storage capacity. It mainly provides services to society through computing power infrastructure.

[0007] Currently, scenario-based and customer-specific fine-tuning of general-purpose base models has become the mainstream approach for the efficient deployment of large-scale model capabilities. Low-Rank Adaptation (LoRA) has become a representative solution for efficient model parameter fine-tuning due to its characteristics of requiring only a small number of low-rank increment matrices for training, clear coupling with the base model, simple loading method, and significant reduction in the number of trainable parameters and memory consumption. Intelligent computing centers provide computing power support and a secure execution environment for LoRA model decryption and inference. However, in existing technologies, LoRA only uses whole-packet encryption and local overall decryption to protect the storage state. On authorized devices, a large range or even complete plaintext runtime state can still be formed, which is susceptible to problems such as illegal copying, parsing, decompiling, dumping, and cross-device reuse, resulting in low security.

[0008] It is evident that since the emergence of intelligent computing centers, how to achieve LoRA runtime control, avoid the formation of large-scale long-term plaintext, improve LoRA security, and reduce the risk of leakage has been a pressing problem to be solved in this field. Summary of the Invention

[0009] This invention provides a method and apparatus for hierarchical decryption of a finely tuned LoRA model using computing power in an intelligent computing cloud platform. This addresses the problems in existing technologies, such as the lack of LoRA runtime control in intelligent computing cloud platforms, which leads to LoRA easily forming large-scale, long-term plaintext, resulting in low LoRA security and a high risk of leakage.

[0010] To solve the above problems, the present invention is implemented as follows: In a first aspect, the present invention provides a method for hierarchical decryption of a fine-tuned LoRA model using a smart computing cloud platform, comprising: Step S1: Schedule the computing power in the intelligent computing cloud platform to obtain the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; Step S2: Based on the structure metadata, perform structure-aware fragmentation on the LoRA parameters, and perturb the LoRA fragments to obtain LoRA fragment packets; Step S3: For the terminal device requesting to run the LoRA fragment packet, perform remote authentication based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile; Step S4: If the remote authentication is successful, determine the running key of the current session of the terminal device based on the device root factor, the current environment measurement value, the license factor and base model digest in the trusted identity file, and the current session random number; Step S5: For each computing unit in the base model of the terminal device, when the computing unit is executed, the running key is used to decrypt the LoRA fragment required by the computing unit within the trusted boundary of the terminal device. The decrypted plaintext is then used to perform calculations together with the computing unit. After the calculation is completed, the plaintext is deleted. The computing unit is a layer, an operator, or a window. In one embodiment, step S5 includes: Step S5.1: Determine the first computational unit to be executed at the current moment; Step S5.2: Determine the target LoRA fragment required by the first computing unit according to the index table corresponding to the LoRA fragment packet; Step S5.3: Using the running key, decrypt the target LoRA fragment within the trusted boundary of the terminal device, and calculate the decrypted plaintext together with the first computing unit; Step S5.4: After the calculation is completed, delete the plaintext, the target LoRA shard association cache, and the running key; Step S5.5: Based on the execution diagram of the base model, determine the second computing unit to be executed at the next moment after the first computing unit, and determine the running key at the next moment; Step S5.6: Return to step S5.2 to determine the target LoRA fragment required by the second computing unit, and execute the subsequent steps in sequence until the last computing unit in the base model is completed.

[0011] In one embodiment, the plaintext is in the form of a low-rank increment or a product of two low-rank matrices, and step S5.3 includes: S5.3.1, Decrypt to obtain the low-rank increment required by the first computing unit, superimpose the low-rank increment with the original weight of the first computing unit, and use the superimposed weight for calculation; or, S5.3.2 Decrypt to obtain the product of two low-rank matrices, and directly use the product of the two low-rank matrices for the forward calculation of the first calculation unit.

[0012] In one embodiment, step S5.3 includes: S5.3.1' Based on a preset plaintext granularity, the target LoRA fragment is decrypted multiple times. Each decryption yields plaintext that matches the plaintext granularity, where the plaintext granularity is smaller than that of the first calculation unit.

[0013] In one embodiment, the structure-aware sharding of the LoRA parameters in step S2 includes at least one of sharding by layer, sharding by matrix type, sharding by rank direction, sharding by column block, sharding by row block, and sharding by quantization block.

[0014] In one embodiment, step S2 perturbs the LoRA fragment by encapsulating it, including at least one of the following: Remap the layer index of the LoRA shard; Hide the matrix type identifier corresponding to the LoRA partition; The LoRA fragments corresponding to different layers are mixed and packaged; Insert pseudo-fragments into the LoRA fragments; The mapping relationship between the LoRA fragments and the actual locations is stored separately in the form of an index table; The quantization scale table and verification table of the LoRA slice are stored separately.

[0015] In one embodiment, step S3 includes: Step S3.1: Determine the root factor of the terminal device based on the Trusted Platform Module (TPM), Trusted Execution Environment (TEE), security chip, dedicated decryption module, or confidential computing environment. Step S3.2: Collect at least one of the following: startup chain summary, trusted loader summary, inference executor summary, base model summary, driver summary, and firmware summary of the terminal device to obtain the current environment measurement value.

[0016] In one embodiment, step S2 includes: Step S6: Bind the LoRA fragment package to at least one of a specific base model, a specific loading path, and a specific inference executor.

[0017] In one embodiment, step S3 includes: Step S3.1': If a mismatch is detected between the current environmental measurement value and one of the specific base model, specific loading path, or specific inference executor bound to the LoRA fragment package, the remote proof is determined to be unsuccessful.

[0018] In one embodiment, the terminal device is a regular client machine, and step S3 includes: Step S3.1'': Transmit the LoRA fragment packet to the client; Step S3.2'': When the LoRA fragment package is first installed on the client's ordinary client machine, a trusted identity profile of the ordinary client machine is established based on the terminal device binding key material of the ordinary client machine. The trusted identity profile includes at least one of the following: license, client identifier, ordinary client identifier, LoRA version, docking model version, operating period, and call quota.

[0019] In one embodiment, after step S3.2', the method further includes: Step S3.3'': In the case that remote authentication cannot be performed, determine whether the ordinary client has an offline ticket and whether the offline ticket meets the availability conditions. The availability conditions include remaining call count greater than or equal to 1, not expired, and the bound terminal device identifier and environment digest match the ordinary client identifier and current environment measurement value. Step S3.4'': If an offline ticket exists and the availability condition is met, determine that the ordinary client's proof is successful, and decrement the remaining call count corresponding to the offline ticket by 1; Step S3.5'': Based on the audit retransmission requirements bound to the offline ticket, upload the audit information for the offline ticket call.

[0020] In one embodiment, the terminal device is a dedicated decryption machine, and step S3 includes: Step S3.1''': Write the LoRA fragment packet into the protected area inside the dedicated decryption machine to obtain a dedicated decryption machine with LoRA computing power service, and establish a trusted identity file for the dedicated decryption machine; Step S3.2''': Based on the call command sent by the client through the inference interface of the dedicated decryption machine, request to run the LoRA fragment packet.

[0021] In one embodiment, the method further includes: Step S7: If abnormal behavior is detected, terminate the current session, clear the data generated by the current session, and record audit information.

[0022] In one embodiment, the method further includes: Step S8: Embed customer feature identifiers in the LoRA parameters and / or the LoRA fragment package's runtime logs. In the event of a LoRA leak, locate the source of the leak and trace responsibility based on the customer feature identifiers.

[0023] Secondly, the present invention also provides a layered decryption device for a fine-tuned LoRA model implemented by an intelligent computing cloud platform, comprising: The acquisition module schedules the computing power in the intelligent computing cloud platform to acquire the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; The packaging module is used to perform structure-aware fragmentation of the LoRA parameters based on the structure metadata, and to perturb the LoRA fragmentation to obtain a LoRA fragmentation packet. The verification module is used to perform remote authentication for terminal devices requesting to run the LoRA fragment packet, based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile. The key issuance module is used to determine the running key of the current session of the terminal device based on the device root factor, the current environment measurement value, the license factor and base model digest in the trusted identity file, and the current session random number when the remote authentication is successful. An execution module is used to, for each computing unit in the base model of the terminal device, use the running key to decrypt the LoRA fragment required by the computing unit within the trusted boundary of the terminal device when executing the computing unit, calculate the decrypted plaintext together with the computing unit, and delete the plaintext after the calculation is completed. The computing unit is a layer, operator or window.

[0024] Thirdly, the present invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps in the layered decryption method for the fine-tuned LoRA model implemented by the intelligent computing cloud platform as described in the first aspect above.

[0025] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the layered decryption method for the fine-tuned LoRA model implemented by the intelligent computing cloud platform as described in the first aspect above.

[0026] Fifthly, the present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps in the layered decryption method for the fine-tuned LoRA model implemented by the intelligent computing cloud platform as described in the first aspect above.

[0027] In this invention, step S1 involves scheduling computing power in an intelligent computing cloud platform to obtain the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; step S2 involves performing structure-aware fragmentation on the LoRA parameters based on the structural metadata, and perturbing and encapsulating the LoRA fragments to obtain a LoRA fragment packet; step S3 involves performing remote authentication on a terminal device requesting to run the LoRA fragment packet, based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity file; step S4 involves determining the running key for the current session of the terminal device based on the device root factor, the current environmental measurement value, the license factor and base model digest in the trusted identity file, and the current session random number; step S5 involves decrypting the LoRA fragment required by the computing unit within the trusted boundary of the terminal device using the running key when the computing unit is executed, calculating the decrypted plaintext together with the computing unit, deleting the plaintext after the calculation is completed, and deleting the plaintext after the calculation is completed. The computing unit can be a layer, an operator, or a window. In this way, by fragmenting and perturbing LoRA parameters, remote authentication is performed based on multiple data, including the device root factor, current environmental measurements, and trusted identity profiles, before the terminal device runs the encapsulated LoRA fragment. If the remote authentication is successful, a session-level running key is derived using multiple conditions. During the base model's operation, only the minimum plaintext parameters required by the current computing unit are decrypted and instantly reconstructed, achieving layered decryption of LoRA. This allows the LoRA's operating state to be controlled by computing power within the intelligent computing cloud platform, avoiding the formation of large-scale, long-term plaintext and significantly improving the security of LoRA throughout the entire process within the intelligent computing cloud platform, while reducing the risk of leakage. Attached Figure Description

[0028] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of a layered decryption method for a fine-tuned LoRA model implemented by an intelligent computing cloud platform, as provided by this invention. Figure 2 This is a structural diagram of a device for implementing layered decryption of a finely tuned LoRA model using computing power on an intelligent computing cloud platform, as provided by this invention. Figure 3 This is a structural diagram of an electronic device provided by the present invention. Detailed Implementation

[0030] The technical solutions of this invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0031] The “computing power” mentioned in this invention refers to: the ability of computer equipment or computing / data center to process information; the ability of computer hardware and software to work together to perform a certain computing requirement; the computing power to achieve the target result output by processing information data; and a new type of productivity that integrates information computing power, network carrying capacity, and data storage capacity, mainly providing services to society through computing power infrastructure.

[0032] The "computational power" (CP) described in this invention refers to the ability of a data center server to process data and output results. It is a comprehensive indicator of a data center's computing power, encompassing general computing power, supercomputing power, and intelligent computing power. The commonly used unit of measurement is floating-point operations per second (FLOPS, 1 EFLOPS = 10^18 FLOPS), with higher values ​​indicating stronger overall computing power. It is estimated that 1 EFLOPS is approximately the computing power output of 5 Tianhe-2A supercomputers, 500,000 mainstream server CPUs, or 2 million mainstream laptops. The calculation formula is: CP = CP 通用 +CP 智能 +CP 超级 .

[0033] The "Network Power" (NP) mentioned in this invention refers to the performance of data transmission capability of computing facilities, which includes comprehensive capabilities such as network architecture, network bandwidth, transmission latency, intelligent management and scheduling, and involves network transmission within and between data centers. It is a comprehensive indicator for measuring network transmission scheduling capability.

[0034] The "Storage Power" (SP) described in this invention refers to the comprehensive capabilities of a data center in four aspects: data storage capacity, performance, security and reliability, and green and low-carbon operation. It is a comprehensive indicator for measuring the data storage capacity of a data center, including external storage devices such as storage arrays and internal storage devices within servers. The commonly used unit of measurement for storage capacity is exabytes (EB, 1EB = 2^60 bytes), while the commonly used unit of measurement for performance is the number of read / write operations per second (IOPS / TB). Disaster recovery ratio is an important indicator of security and reliability.

[0035] The "computing infrastructure" mentioned in this invention refers to a new type of information infrastructure that integrates information computing power, network carrying capacity, and data storage capacity, enabling centralized computing, storage, transmission, and application of information.

[0036] The "new information infrastructure" mentioned in this invention refers to network infrastructure such as 5G networks, fiber optic broadband networks, backbone networks, international communication networks, and satellite internet; computing infrastructure such as data centers, general computing centers, intelligent computing centers, and supercomputing centers; and new technology facilities such as artificial intelligence, blockchain, and quantum computing.

[0037] The “computing power” mentioned in this invention includes: general computing power, intelligent computing power, and supercomputing power.

[0038] The "general computing power" mentioned in this invention refers to the computing power provided by servers based on CPU (Central Processing Unit) chips, which is used to support basic general computing such as cloud computing and edge computing.

[0039] The "intelligent computing power" mentioned in this invention refers to: a computing platform deployed on a large scale based on dedicated chips such as GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array), and ASIC (Application Specific Integrated Circuit) for various artificial intelligence innovative applications, such as natural language processing and machine vision.

[0040] The “supercomputing power” mentioned in this invention refers to the computing power provided by high-performance computing clusters such as supercomputers. It utilizes the centralized computing resources of multiple computer systems working in parallel and uses a dedicated operating system to handle extremely complex or data-intensive problems. It is mainly used for computing in cutting-edge scientific fields, such as planetary simulation, drug molecule design, and gene analysis.

[0041] The "intelligent computing center" described in this invention refers to a facility that, through the use of large-scale heterogeneous computing resources, including general-purpose computing power (CPU) and intelligent computing power (GPU, FPGA, ASIC, etc.), primarily provides the necessary computing power, data, and algorithms for artificial intelligence applications (such as the development, training, and inference of deep learning models). The intelligent computing center encompasses facilities, hardware, and software, and can provide full-stack capabilities from underlying computing power to top-level application enablement.

[0042] The "intelligent computing cloud platform" mentioned in this invention, abbreviated as "intelligent computing cloud", refers to a cloud computing platform that integrates hardware and software resources based on an intelligent computing center.

[0043] The "intelligent computing center" mentioned in this invention includes, but is not limited to, "smart computing center".

[0044] The "intelligent computing center" mentioned in this invention, also known as an artificial intelligence computing center, is a type of computing infrastructure that provides computing power services, data services, and algorithm services required for artificial intelligence applications, based on artificial intelligence theory and adopting an artificial intelligence computing architecture.

[0045] The "computing center" mentioned in this invention refers to a facility that is mainly composed of infrastructure such as wind, thermal, hydro, and electricity, and IT hardware and software equipment, and has computing power, carrying capacity, and storage capacity, including general data centers, intelligent computing centers, supercomputing centers, etc.

[0046] The "supercomputing center" mentioned in this invention refers to a supercomputing data center, which is a data center based on supercomputers or large-scale computing clusters. It can provide large-scale computing, storage and network services and is widely used in aerospace, defense, oil exploration, climate modeling and genome sequencing and other application scenarios.

[0047] The “computing resources” mentioned in this invention refer to the technologies and facilities required for the development of the digital society that have the ability to compute, transmit, store and apply information, including but not limited to computing resources such as CPUs and GPUs, network resources such as switches and routers, storage resources such as storage arrays and distributed storage, security resources such as firewalls and intrusion detection systems, and supporting and guaranteeing resources such as wind, fire, water and electricity.

[0048] The "model" mentioned in this invention includes, but is not limited to, "large language model" and "multimodal large model".

[0049] The "large language model" mentioned in this invention refers to a large-scale language model (LLM), which is a language model with a large number of parameters. It is designed to understand and generate human language. It is trained with a large amount of text data and can perform a wide range of tasks, including text summarization, translation, and sentiment analysis.

[0050] The “Multimodal Large Models” mentioned in this invention refer to models that combine multimodal information such as text, images, videos, and audio for training, including but not limited to multimodal large language models.

[0051] The “base model” mentioned in this invention refers to a native large-size pre-trained model that has not been fine-tuned for specific scenarios, has a complete structure, and has fixed weights. It can be deployed in the computing power nodes or terminal devices of the intelligent computing cloud platform, with fixed loading and authorized binding, serving as the basic carrier for LoRA loading.

[0052] The "execution graph" mentioned in this invention refers to a structured static / dynamic computation topology graph composed of model operators, computation nodes, data flow, hierarchical call relationships, and module dependency logic when the base model is running.

[0053] The “LoRA model” mentioned in this invention refers to the Low-Rank Adaptation model, which is a lightweight incremental fine-tuning model attached to the base model. It does not modify the weights of the original base model, but only adds a small number of low-rank matrix parameters, so that the base model has the ability to be customized for specific scenarios and specific businesses.

[0054] The “trusted boundary” mentioned in this invention refers to a secure operating area that is isolated, closed, non-bypassable, and protected by hardware within the computing power nodes or terminal devices of an intelligent computing cloud platform.

[0055] Please see Figure 1 , Figure 1 This is a flowchart of a layered decryption method for a fine-tuned LoRA model implemented by an intelligent computing cloud platform, as provided by this invention. Figure 1 As shown, the method includes: Step S1: Schedule the computing power in the intelligent computing cloud platform to obtain the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters.

[0056] The LoRA parameters mentioned above refer to low-rank adaptation weights obtained by training on specific industry data without changing the original weights of the underlying model (such as QWen), in order to adapt to the specific tasks of the client. Structural metadata is auxiliary data that describes the attributes, structural characteristics, and adaptation rules of the LoRA parameters themselves. It is stored and retrieved synchronously with the LoRA parameters and serves as the basis for splitting LoRA parameter segments.

[0057] In one embodiment, the distributed and heterogeneous computing power of the intelligent computing cloud platform can be scheduled. Relying on the computing power orchestration, computing power load balancing, containerized scheduling, and model version management capabilities of the intelligent computing cloud platform, the lightweight fine-tuning task of the base model can be completed. The LoRA incremental parameters generated by the fine-tuning are extracted, and the structural metadata of the LoRA parameters is collected, parsed, and solidified simultaneously, providing core data support for the subsequent layered security decryption, trusted loading, and permission-based operation of the base model.

[0058] The beneficial technical effect achieved by step S1 is to quickly obtain LoRA parameters and their structural metadata, laying a reliable data foundation for the intelligent computing cloud platform to achieve model layered decryption.

[0059] Step S2: Based on the structural metadata, perform structure-aware fragmentation on the LoRA parameters, and perturb the LoRA fragments to obtain LoRA fragment packets.

[0060] The aforementioned structure-aware partitioning relies on LoRA parameter structure metadata to deeply identify the original topology, module division, matrix attributes, and low-rank operation logic of the LoRA model. It follows the model's own business structure and computational integrity, and performs a refined partitioning of LoRA parameters in a regular, bounded manner without destroying the operator logic. This ensures that each LoRA partition has local computational independence and operator integrity.

[0061] In one embodiment, the intelligent computing cloud platform can schedule computing power such as GPUs to complete structure-aware sharding based on LoRA parameter structure metadata. At the same time, the intelligent computing cloud platform can also perform perturbation encapsulation and controlled packaging on the sharding results through computing power, achieving efficient batch processing throughout the process by relying on the computing power of the intelligent computing cloud platform.

[0062] In this invention, LoRA parameters are not mechanically sliced ​​according to the order of the byte stream, but are sliced ​​according to their structural semantics. The intelligent computing cloud platform can adopt at least one of the following slicing methods: layer slicing, matrix category slicing, rank direction slicing, column block slicing, row block slicing, quantization block slicing, or hierarchical slicing based on key layers and ordinary layers.

[0063] To prevent attackers from reconstructing the original LoRA solely based on tensor size, naming, sorting, and statistical characteristics, this invention further perturbs and encapsulates the LoRA fragments. This ensures that the original order and naming relationships between LoRA fragments are not preserved. During the perturbation operation on the LoRA fragments, the true mapping index, quantization scale, and verification table can be maintained based on this operation. These are not exposed long-term in the same packet as the parameter ontology and are used as a cryptographic book to restore the true parameter state before the perturbation after the terminal device completes verification. The perturbation operation allows LoRA fragments from different layers, positions, and matrix types to be mixed into several LoRA fragment packet groups. In other words, LoRA is not encrypted as a whole, but rather protected using its structural characteristics to minimize the risk of LoRA exposure during runtime.

[0064] The beneficial technical effects achieved by step S2 are: the LoRA delivered to customers by the intelligent computing cloud platform is no longer a directly reusable file, but a set of controlled parameter fragments that can only be recovered in an authorized context, which significantly raises the threshold for static copying of LoRA, improves the security of the intelligent computing cloud platform running LoRA through computing power, and reduces the risk of leakage.

[0065] Step S3: For terminal devices requesting to run LoRA fragmentation packets, perform remote authentication based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile.

[0066] The aforementioned device root factor is a unique and tamper-proof encryption root identifier or key factor embedded in the device hardware encryption chip (such as TPM) that connects to the intelligent computing cloud platform. It is the "underlying trust foundation" for the device's identity legitimacy and is used to generate runtime decryption capabilities and complete remote verification.

[0067] The aforementioned environmental measurements are a set of immutable security verification data generated in real time through real-time collection, hashing, and solidification of the current operating hardware and software environment, system status, program integrity, and memory computing power environment within the trusted computing power nodes and TEE / trusted runtime domain of the intelligent computing cloud platform. In one embodiment, the current environmental measurements of the terminal device may include at least one of the following: the terminal device's current boot chain digest, trusted loader digest, inference executor digest, docking model digest, driver digest, and firmware digest.

[0068] The aforementioned trusted identity profile is an immutable, fully lifecycle-traceable digital identity and security attribute profile established by the intelligent computing cloud platform for all connected devices. It is used to achieve trusted device verification, access control, and security auditing. In one embodiment, when a LoRA fragment packet is written to or installed on a client terminal device, a trusted identity profile associated with the terminal device can be established based on at least one of the following: client identifier, terminal device identifier, allowed LoRA version, docking station model version, etc.

[0069] In one embodiment, remote attestation can be performed before each LoRA run on the terminal device to verify whether the terminal device, trusted loader, inference executor, docking model, and environment state comply with a preset security policy, thus confirming that the terminal device is in a trusted state. The intelligent computing cloud platform can collect real-time environmental measurements of the LoRA-running terminal device. Through the verification service of the intelligent computing cloud platform, based on the device root factor associated with the terminal device, trusted identity profile, and current environmental measurements, at least the following determinations are made: whether the current terminal device is on the authorized whitelist; whether the current terminal device identity matches the license record; whether the current environment digest meets the preset security policy; whether the current docking model digest matches the target LoRA binding relationship; whether the current trusted loader and inference executor are trusted versions; whether the current license is expired, revoked, frozen, or exceeded; and whether the current request triggers an abnormal replay or an abnormal frequency limit. The verification service determines that the remote attestation is successful only when the above conditions are met; otherwise, if any of the above determination conditions are abnormal (such as the terminal device not being on the authorized whitelist, inconsistent with the license record, or the current request triggering an abnormal replay), the remote attestation is determined to fail.

[0070] In this invention, the terminal device can be a regular authorized client (hereinafter referred to as a regular client) or a dedicated decryption machine.

[0071] The beneficial technical effects achieved by step S3 are as follows: Unlike existing technologies that use licenses or serial numbers for single access control, the intelligent computing cloud platform combines device root factors, trusted identity profiles, and environmental measurements to conduct remote authentication. This allows for simultaneous verification of the terminal device's identity legitimacy, operational permission compliance, and the integrity of the computing power operating environment. This provides a more reliable verification result for the intelligent computing cloud platform to issue decryption permissions, effectively preventing risks such as device impersonation, environment tampering, parameter reverse analysis, illegal copying, and cross-device reuse, further improving the security of LoRA.

[0072] Step S4: If remote authentication is successful, determine the running key of the current session of the terminal device based on the device root factor, current environment measurement value, license factor and base model digest in the trusted identity file, and the current session random number.

[0073] Remote authentication indicates that the terminal device is in a trusted state, allowing the generation of session-level operation keys for that terminal device. In this invention, LoRA's decryption and operation capabilities are not solely bound to a fixed file key, but are determined by multiple conditions, namely the device root factor, current environmental measurements, the license factor and base model digest in the trusted identity profile, and the current session random number.

[0074] In one embodiment, the running key of the current session can be represented by the following formula (1): (1) in, For predefined derived functions, To run the key, For the device root factor, These are current environmental measurements. For the license factor, A random number for the current session. The digest is the base model digest (or a combination digest of the base model and LoRA). Formula (1) means that a valid operating key can only be obtained within the trusted boundary when the terminal device is legitimate, the environment is trustworthy, the license is valid, the session is genuine, and the base model matches. Therefore, even if an attacker copies the ciphertext or historical license response, they cannot reliably reproduce the same decryption capability on another terminal device or in another environment.

[0075] The beneficial technical effects achieved by step S4 are: the ability to bind execution rights to the terminal device, environment, license, and session simultaneously, rather than simply binding to a file or a single key, thereby significantly increasing the difficulty of cross-device copying and replay attacks, improving the security of LoRA running on the intelligent computing cloud platform through computing power, and reducing the risk of leakage.

[0076] In some possible implementations, session-level key generation can be performed either within the trusted boundary of the client device or by the server issuing fragment-level tokens, decapsulation permissions, or time-limited subkeys.

[0077] Step S5: For each computing unit in the base model of the terminal device, when the computing unit is executed, the running key is used to decrypt the LoRA fragment required by the computing unit within the trusted boundary of the terminal device, and the decrypted plaintext is calculated together with the computing unit. After the calculation is completed, the plaintext is deleted.

[0078] The aforementioned computational unit is the smallest independent computational carrier divided according to the model execution logic during the base model's inference process. It may include, but is not limited to, different execution granularities such as model network layers, internal computation operators, or token computation windows.

[0079] It should be noted that the computing power node mentioned in this invention refers to the hardware operating platform that carries the deployment of the base model, computing power scheduling, and model inference operations under the intelligent computing cloud platform. The computing unit is a concept of computational granularity at the model software logic level, which exists dependent on the execution graph of the base model, while the computing power node is a physical / virtualized computing power carrier at the hardware resource level, and the base model is deployed and runs on the computing power node as a whole.

[0080] The method provided by this invention does not restore the complete LoRA in the terminal device as a whole, but only restores the plaintext of the minimum available parameter form when the current layer, current operator or current window needs it at any execution time of the base model. The plaintext of the minimum available parameter form can be the current layer increment matrix, the current sub-block increment matrix or an intermediate form that maintains the low-rank multiplication form.

[0081] In one embodiment, the current execution time is t. The execution graph of the base model can determine the computing unit at the current execution time and the LoRA shard St required by the computing unit. Then, the intelligent computing cloud platform can schedule GPU computing power on demand based on the running key with runtime decryption capability. Within the trusted boundary, it can locate, decrypt, and restore the real mapping of the LoRA shard St. At the same time, it can utilize the memory pooling computing power of the intelligent computing cloud platform to realize the instantaneous reconstruction of the plaintext with the minimum available parameter form required at the current time, and load it into the computing unit for joint calculation. This can significantly reduce computing power consumption, improve inference response speed, and adapt to high-concurrency inference scenarios.

[0082] The beneficial technical effects achieved by step S5 are as follows: By decrypting and reconstructing the minimum plaintext required by different layers, operators, or windows during LoRA operation on demand, the formation of long-term complete plaintext during operation is avoided, reducing the success rate of runtime dumping, debugging, instrumentation, and hot patching analysis. When the intelligent computing cloud platform realizes layered decryption for the fine-tuned LoRA model through computing power, it achieves fine-grained control over the LoRA runtime state and improves the security of LoRA.

[0083] In this invention, step S1 involves scheduling computing power in an intelligent computing cloud platform to obtain the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; step S2 involves performing structure-aware fragmentation on the LoRA parameters based on the structural metadata, and perturbing and encapsulating the LoRA fragments to obtain a LoRA fragment packet; step S3 involves performing remote authentication on a terminal device requesting to run the LoRA fragment packet, based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity file; step S4 involves determining the running key for the current session of the terminal device based on the device root factor, the current environmental measurement value, the license factor and base model digest in the trusted identity file, and the current session random number; step S5 involves decrypting the LoRA fragment required by the computing unit within the trusted boundary of the terminal device using the running key when the computing unit is executed, calculating the decrypted plaintext together with the computing unit, deleting the plaintext after the calculation is completed, and deleting the plaintext after the calculation is completed. The computing unit can be a layer, an operator, or a window. In this way, by fragmenting and perturbing LoRA parameters, remote authentication is performed based on multiple data, including the device root factor, current environmental measurements, and trusted identity profiles, before the terminal device runs the encapsulated LoRA fragment. If the remote authentication is successful, a session-level running key is derived using multiple conditions. During the base model's operation, only the plaintext of the minimum parameters required for the current computing unit is decrypted and instantly reconstructed, achieving layered decryption of LoRA. This allows the LoRA's operating state to be controlled by computing power within the intelligent computing cloud platform, avoiding the formation of large-scale, long-term plaintext and significantly improving the security of LoRA throughout the entire process within the intelligent computing cloud platform, while reducing the risk of leakage.

[0084] In this invention, the entire LoRA parameter operation process is carried out using an intelligent computing cloud platform. It leverages the computing power (GPU clusters, distributed computing power, and secure computing units) of the intelligent computing cloud platform for efficient processing, and utilizes the productization capabilities (computing power scheduling, device management, and security control) of the intelligent computing cloud platform to achieve full process controllability. The computing power of the intelligent computing cloud platform supports the efficiency and parallelism of the process, while the productization capabilities support the security and compliance of the process. The combination of these two aspects allows the secure operation of LoRA parameters to be transformed from a technical process into a scalable and commercially viable service capability of the intelligent computing cloud platform, meeting the core needs of enterprise customers for secure deployment and efficient inference of LoRA models.

[0085] In one embodiment, step S5 includes: Step S5.1: Determine the first computation unit to be executed at the current moment.

[0086] In this invention, the first calculation unit to be executed at the current moment can be determined based on the execution diagram of the base model.

[0087] Step S5.2: Determine the target LoRA fragment required by the first computing unit based on the index table corresponding to the LoRA fragment packet.

[0088] In one embodiment, when determining the LoRA fragment packet, an index table containing the mapping relationship between LoRA fragments and real locations can be stored. Therefore, the target LoRA fragment required by the first computing unit can be determined according to the index table corresponding to the LoRA fragment packet.

[0089] Step S5.3: Using the running key, decrypt the target LoRA fragment within the trusted boundary of the terminal device, and calculate the decrypted plaintext together with the first computing unit.

[0090] In one embodiment, the plaintext obtained by decrypting the target LoRA slice can be the increment matrix of the original weights of the first computing unit, or it can be a low-rank matrix product that can be directly used by the first computing unit to perform forward computation on the input.

[0091] In one embodiment, when decrypting the target LoRA fragment, all incremental plaintext required by the first computing unit can be directly decrypted, or the granularity of plaintext decryption can be further refined to complete the decryption of all incremental plaintext required by the first computing unit in turn, so as to further reduce the scope of plaintext exposure.

[0092] Step S5.4: After the calculation is completed, delete the plaintext, the target LoRA fragment association cache, and the running key.

[0093] To adhere to the principle of least plaintext, after the first computational unit finishes running, the decrypted plaintext, LoRA fragment association cache, and running key need to be cleared immediately. The LoRA fragment association cache may contain fragmented plaintext, mapping cache, intermediate reconstruction tensors, and temporary scheduling states, etc.

[0094] In one embodiment, the computing power node management module of the intelligent computing cloud platform can automatically trigger a video memory cleanup computing power instruction after the first computing unit completes its calculation at the current moment. This instruction clears the LoRA plaintext parameter fragments, reconstructs the cache and session keys within the node, ensuring that no plaintext data remains. At the same time, it releases the occupied GPU computing power and video memory resources and returns them to the intelligent computing cloud platform's computing power resource pool, thereby realizing the recycling of computing power and improving resource utilization.

[0095] The beneficial technical effects achieved by step S5.4 are: it can prevent plaintext information related to LoRA parameters from remaining in the video memory or memory of the computing power nodes of the intelligent computing cloud platform, reduce the possibility of illegal dumping, copying, and decompilation, reduce the risk of LoRA parameter leakage, and help improve the computing power utilization of the intelligent computing cloud platform.

[0096] Step S5.5: Based on the execution graph of the base model, determine the second computing unit to be executed at the next moment after the first computing unit, and determine the running key at the next moment.

[0097] In this invention, since the environmental digests such as the terminal boot chain, firmware, driver, inference executor, and docking model may dynamically change with the operating state during the LoRA operation of the terminal device, and the environmental measurement values ​​have real-time fluctuations, the current operating key can be deleted immediately after the operation of a single computing unit. The next computing unit re-integrates the latest environmental measurement values, device root factor, and identity profile to generate a new operating key, so that the decryption key of each calculation is bound to the current real operating environment in real time. This allows subsequent LoRA decryption and calculation to be intercepted in a timely manner if there are anomalies such as tampering, component replacement, or illegal injection in the operating environment, thus realizing real-time perception and proactive blocking of environmental anomalies.

[0098] Step S5.6: Return to step S5.2 to determine the target LoRA fragment required for the second computing unit, and execute the subsequent steps in sequence until the last computing unit in the base model is completed.

[0099] The beneficial technical effects achieved by steps S5.1 to S5.6 are as follows: the plaintext is decrypted and generated only for the currently running computing unit, without the need to decrypt all LoRA parameters globally. The remaining LoRA fragments always remain in a encrypted state, and the decrypted plaintext is deleted immediately after the computing unit finishes its calculation. This effectively reduces the scope and duration of plaintext data exposure, and lowers the risk of LoRA parameters being stolen, captured, and reverse-analyzed.

[0100] The following explanation uses the LoRA execution method of layer-by-layer instantaneous reconstruction as an example. When the base model has n layers that can be injected with LoRA, the intelligent computing cloud platform must satisfy the following during operation: Before executing to the i-th layer, no plaintext fragments related to the i-th layer are recovered, where i is no greater than n; upon reaching the i-th layer, the scheduler locates the controlled fragment set for that layer and completes decryption and recovery within the trusted boundary; once the computation of that layer is completed, the plaintext fragments, mapping cache, and temporary keys for that layer are immediately cleared before proceeding to the (i+1)-th layer. Furthermore, the intelligent computing cloud platform does not explicitly recover the complete... Instead, it maintains a low-rank form to directly participate in the calculation, thereby avoiding the formation of a large-scale complete increment matrix in memory.

[0101] With this layer-by-layer instantaneous reconstruction LoRA execution method, even if an attacker attempts to perform a memory scan at runtime, they can only observe short-term local fragments of a single layer or a few layers. To piece together the complete LoRA of all layers, it is necessary to simultaneously grasp the complete time series, the actual mapping relationship, the base binding relationship, and the session-level permission changes, which significantly increases the attack cost and is suitable for high-security and high-value scenarios.

[0102] In one embodiment, the plaintext can be in the form of a low-rank increment or a product of two low-rank matrices, so the instantaneous reconstruction of the LoRA model can include either explicit reconstruction or implicit reconstruction that preserves the low-rank operation form. Therefore, step S5 includes: S5.3.1 Decrypt to obtain the low-rank increment required by the first computing unit, superimpose the low-rank increment with the original weight of the first computing unit, and use the superimposed weight for calculation.

[0103] For example, in the base model, the original weight of an injectable linear layer (i.e., the first computational unit executed at the current moment) is... The low-rank increment introduced by LoRA is denoted as In the case of, and After superposition and fine-tuning of the first calculation unit, the actual weights involved in the calculation can be expressed as the following formula (2): (2) The beneficial technical effects achieved by step S5.3.1 are as follows: Capability adaptation is achieved by superimposing low-rank increments with the original weights of computing units, without modifying the network structure, operator logic and execution flow of the base model, fully reusing the original inference scheduling mechanism of computing power nodes, adapting to the large-scale computing power deployment of intelligent computing cloud platforms, and taking into account both inference compatibility and operational stability.

[0104] S5.3.2 Decryption yields the product of two low-rank matrices, which is then directly used for the forward computation of the first computation unit.

[0105] Due to low-rank increment It can be constructed from two low-rank matrices, i.e. , , , The rank value is much smaller than the original dimension. Therefore, in this invention, instead of explicitly generating the complete low-rank increment, it can directly participate in the calculation of the input of the first calculation unit in the form of a low-rank matrix product, as shown in the following formula (3): (3) In formula (3), This represents the input to the first computational unit. This represents the output of the first calculation unit. This represents the original weight of the computational unit in the base model. It is the product of two low-rank matrices. Formula (3) can be rewritten as formula (4) to avoid forming a large, long-lasting matrix in memory.

[0106] (4) In this invention, the product of two low-rank matrices Higher rank matrices have stronger expressive power but also have more parameters. Therefore, the rank value can be set reasonably according to different tasks. Since A and B are relatively small in size, have clear functions, and can be loaded independently, the two low-rank matrices A and B can be used as objects of structure-aware partitioning.

[0107] The beneficial technical effects achieved by step S5.3.1 are: no need to splice, calculate and cache the complete low-rank incremental weights, and directly participate in the forward operation in the form of low-rank matrix product, reducing the generation and residence of intermediate sensitive parameters, shortening the life cycle of plaintext data, and reducing the risk of LoRA parameters being captured, dumped and reverse extracted from memory from the source.

[0108] In one embodiment, step S5 includes: S5.3.1' Based on the preset plaintext granularity, the target LoRA fragment is decrypted multiple times, and each decryption yields plaintext that matches the plaintext granularity.

[0109] The plaintext granularity mentioned above should be smaller than the first calculation unit. The plaintext granularity can be a layer, operator, batch, or token window. In specific embodiments, an appropriate plaintext granularity can be selected according to different security levels and performance requirements.

[0110] For example, if the base model has reached a certain layer, the granularity of plaintext decryption can be further reduced. The required LoRA segments within the layer can be decrypted on demand and reconstructed locally at the operator granularity. That is, for each attention operator or linear operator within the layer, the plaintext corresponding to the operator in the LoRA segment is decrypted before execution. After the operator calculation is completed, it is immediately cleared before the reconstruction and calculation of the next operator are executed.

[0111] In this application, instantaneous reconstruction can be performed by layer, by operator, by batch, or by window, or it can be performed by explicit reconstruction or implicit reconstruction that maintains the low-rank operation form.

[0112] Step S5.3.1': The beneficial technical effects achieved are: it can further reduce the scope of plaintext exposure, reduce memory usage, and further improve the fine-grained control of LoRA's runtime state when the intelligent computing cloud platform realizes layered decryption for the finely tuned LoRA model through computing power, thereby improving the security of LoRA.

[0113] In one embodiment, the structure-aware sharding of the LoRA parameters in step S2 includes at least one of sharding by layer, sharding by matrix type, sharding by rank direction, sharding by column block, sharding by row block, and sharding by quantization block.

[0114] The above-mentioned layer-based sharding can be based on the layer number in the structural metadata, using each layer of the base model as an independent boundary, dividing the low-rank matrix and adaptation parameters corresponding to that layer in the LoRA parameters into an independent shard. Sharding by matrix type can aggregate functional matrices of the same type in the LoRA parameters into a single shard, while parameters of different operators and functions are separated and isolated. Sharding by rank direction can, based on the low-rank characteristics of LoRA and the rank dimension r recorded in the metadata, vertically divide the A / B low-rank matrix along the low-rank space direction, splitting the complete low-rank representation space into multiple sub-rank shards, retaining only the single-segment rank dimension parameter as the smallest sharding unit, without disrupting the matrix multiplication operation logic. Sharding by column block / sharding by row block involves uniformly dividing the column / row dimensions of the weight matrix corresponding to the LoRA parameters into blocks, generating independent shards with column / row data blocks as boundaries, limiting the range of column / row parameters in a single shard. Fragmentation by quantization block combines the model's quantization attributes (such as INT4, INT8, or FP16) and, based on the quantization compression granularity and quantization block partitioning rules, packages continuous quantization parameter units into independent fragments, thus avoiding disruption of quantization data decoding and computation rules.

[0115] The structure-aware fragmentation of LoRA parameters in various forms achieves the following beneficial technical effects: it can completely scatter the complete LoRA parameters, and even if individual fragments are illegally dumped or copied, they cannot be pieced together to restore the complete low-rank weights, thus preventing overall leakage and illegal copying, enabling more refined independent fragment management, adapting to the needs of intelligent computing cloud platforms for on-demand decryption at the smallest granularity, and effectively avoiding the long-term residence of large-scale plaintext parameters.

[0116] For example, suppose a certain LoRA is in the base model of the first... Layer The parameters for each injection location are The result obtained by partitioning the parameters of this layer can be expressed by the following formula (5): (5) It should be noted that, in other possible embodiments of the present invention, structure-aware segmentation can also be implemented by means of channel groups, attention head groups, etc.

[0117] In one embodiment, perturbation encapsulation of LoRA slices in step S2 may include at least one of the following: remapping the layer index of the LoRA slice; hiding the matrix type identifier corresponding to the LoRA slice; mixing and encapsulating LoRA slices corresponding to different layers; inserting pseudo slices into the LoRA slices; storing the mapping relationship between the LoRA slices and the real positions separately in the form of an index table; and storing the quantization scale table and the verification table of the LoRA slices separately.

[0118] The above-mentioned remapping of the layer index of LoRA shards involves scrambling the original layer numbers and layer order of the shards, performing logical offsets and re-encoding, so that the exposed layer indexes are virtual mapping values ​​that no longer correspond to the real physical layers. This makes it impossible to restore the LoRA layer weights according to the normal layers. The mapping relationship before and after the layer index remapping can also be stored separately in the form of an index table.

[0119] The aforementioned hidden LoRA fragment matrix type identifier refers to erasing or encrypting the original attribute tags of the fragment, making it impossible for the fragment to be directly identified as belonging to which type of computation operator. This prevents attackers from using matrix type features to perform targeted parsing and classification to restore low-rank parameters, significantly increasing the difficulty of reverse analysis.

[0120] The above-mentioned mixed encapsulation of LoRA fragments corresponding to different layers breaks the original layer-isolated storage structure. It scrambles and mixes LoRA fragments from shallow layers, deep layers, and different network modules to form cross-layer mixed data packets. It no longer follows the original network order of the model, making it impossible to splice and reassemble the complete LoRA weights according to the network topology order when multiple fragments are obtained.

[0121] The aforementioned insertion of pseudo fragments into LoRA fragments refers to mixing virtual pseudo fragments that have no actual computational function and are randomly generated without any real purpose into the set of legitimate and valid LoRA fragments. The pseudo fragments have the same format and appearance as the real fragments, thus allowing real and fake fragments to be stored and transmitted together, which can increase the difficulty of extracting valid parameters.

[0122] The aforementioned method of storing the mapping relationship between LoRA fragments and their real locations separately in the form of an index table means that the fragments themselves no longer carry key information such as location, ownership, and splicing rules. Instead, the fragment's real address, row and column position, assembly order, and splicing topology are extracted and independently encrypted and stored as an offline index table, accessible only as needed in a trusted environment. Therefore, without the index table, it is completely impossible to reconstruct, splice, or perform calculations, preventing fragments from being misused independently after leaving the trusted boundary.

[0123] The aforementioned separate storage of the quantization scale table and verification table for LoRA shards refers to physically separating and independently encrypting and storing key supporting data such as quantization scaling coefficients, quantization mapping rules, error compensation parameters, and integrity check codes from the shard entity for quantization LoRA parameters. This prevents illegally obtained quantized shards from being properly decoded, dequantized, and their original weight values ​​from being restored.

[0124] By applying various forms of structure-aware fragmentation to LoRA parameters, the following beneficial technical effects are achieved: Through multiple perturbations, the LoRA fragment packets deployed to client terminal devices completely obscure their original structure, significantly increasing the difficulty of reverse engineering and decompiling these LoRA fragment packets, improving the security of intelligent computing cloud platforms running LoRA through computing power, and reducing the risk of leakage. In one embodiment, step S3 includes: Step S3.1: Determine the device root factor based on the Trusted Platform Module (TPM), Trusted Execution Environment (TEE), security chip, dedicated decryption module, or confidential computing environment of the terminal device.

[0125] The beneficial technical effects achieved by step S3.1 are as follows: The intelligent computing cloud platform uses TPM, TEE, local security chip, dedicated decryption hardware and confidential computing environment as trust roots to generate and store device root factors at the hardware level, so that the device root factors cannot be tampered with, forged or mass-copied, ensuring the uniqueness and authenticity of the device root factors, and providing an unforgeable hardware trust foundation for subsequent LoRA fragment decryption and remote proof.

[0126] Step S3.2: Collect at least one of the following from the terminal device's startup chain summary, trusted loader summary, inference executor summary, base model summary, driver summary, and firmware summary to obtain the current environment measurement value.

[0127] The beneficial technical effects achieved by step S3.2 are as follows: Based on the cluster computing power and trusted scheduling capabilities of the intelligent computing cloud platform, diverse dynamic measurement information from the startup chain digest, trusted loader digest, inference executor digest, base model digest, driver digest, and firmware digest is collected in a unified manner, and the current environment measurement value is generated in real time. This can avoid the blind spots in environment verification caused by single-dimensional detection, realize dynamic verification and key derivation, improve the reliability of layered decryption in the intelligent computing cloud platform, and thus improve the security of LoRA.

[0128] In one embodiment, step S2 includes: Step S6: Bind the LoRA fragment package to at least one of the following: a specific base model, a specific load path, and a specific inference executor.

[0129] In this invention, to prevent LoRA from being migrated to other models or frameworks, LoRA fragments can be bound to at least one of a specific base model, a specific loading path, and a specific inference executor. This allows the intelligent computing cloud platform to allocate computing power only on the base model and loading path to which LoRA is bound, enabling LoRA recovery and execution operations, preventing cross-model and cross-framework migration, and further improving the security of LoRA decryption in the intelligent computing cloud platform.

[0130] It should be noted that binding a specific base model can be accomplished by recording an overall summary of the base model, a key layer summary, an operator layout summary, or a summary of multiple feature combinations during the LoRA packaging and licensing stages. Alternatively, a license can be issued for a specific base model or it can be specially marked so that the LoRA fragment package can only be executed on this one base model.

[0131] In this invention, LoRA fragment packages can be bound to a specific load path or a specific inference executor by using a binding digest.

[0132] The beneficial technical effects achieved by step S2.1 are as follows: By binding LoRA fragment packages to specific base models and / or specific loading paths, the base models and loading paths in which LoRA is effective are restricted, which helps to prevent arbitrary migration and illegal reuse of LoRA parameters. The intelligent computing cloud platform only needs to allocate computing power to specific base models and / or loading paths, thereby improving the fineness of LoRA runtime management.

[0133] In the case where the present invention includes step S2.1, step S3 includes: Step S3.1': If a mismatch is detected between the current environmental measurement value and one of the specific base model, specific loading path, or specific inference executor bound to the LoRA fragment package, the remote proof is determined to be unsuccessful.

[0134] In this invention, if the runtime detects that the base model summary in the current environment measurement does not match the specific base model bound to the LoRA shard package, the execution of the LoRA shard package cannot be remotely proven, or the intelligent computing cloud platform may directly refuse execution. Similarly, LoRA does not allow direct reading by ordinary loaders. Only signed trusted loaders and trusted executors can locate shards, derive permissions, and complete instantaneous reconstruction according to the hidden mapping rules. Thus, even if an attacker takes the controlled encrypted package to other frameworks or a self-made executor, they cannot use it correctly due to the lack of a real mapping relationship and legitimate permissions.

[0135] The beneficial technical effects achieved by step S3.1' are as follows: By combining the computing power scheduling and management capabilities of the intelligent computing cloud platform, only model loading and computing power calls that meet the requirements of specific models, compliant paths, and specific inference executors are allowed, preventing LoRA from being directly reused in other base models, other inference frameworks, or other loaders, thereby improving the security of LoRA operation in the intelligent computing cloud platform.

[0136] It should be noted that this invention applies to both ordinary client mode and dedicated decryption machine mode. In ordinary client mode, LoRA operation is constrained by TPM or other hardware roots, trusted loaders, and network authentication processes. In dedicated decryption machine mode, LoRA fragments can be directly written into the protected area inside the dedicated decryption machine's terminal device. The dedicated decryption machine's internal security module completes fragment scheduling, decryption, and execution. Clients can only call the standard inference interface and cannot access the parameter body. Thus, this invention can simultaneously cover both flexible delivery and high-security delivery scenarios.

[0137] In one embodiment, the terminal device can be a regular client, i.e., the intelligent computing cloud platform provided by this invention implements a layered decryption method for the fine-tuned LoRA model through computing power, enabling the terminal device to operate in a bound and controlled manner in regular client mode. Step S3 includes: Step S3.1'': Transmit the LoRA fragment packets to the client.

[0138] In one embodiment, in an enterprise on-premises deployment scenario, a customer already possesses a workstation or inference server with a TPM or similar hardware root and wishes to load a LoRA model finely tuned with industry data locally. The intelligent computing cloud platform can first obtain all LoRA parameters and metadata of the finely tuned LoRA model, perform multi-granularity sharding based on layer number, matrix type, rank direction, and quantization block, then perform layer index perturbation, cross-layer mixing, mapping table separation, and pseudo-shard insertion on the shards, and encapsulate them using a multi-domain key strategy to obtain a LoRA shard packet that can only be recovered in a controlled environment. The intelligent computing cloud platform can then schedule computing power with transmission capabilities to transmit the LoRA shard packet to the customer requesting to load it.

[0139] Step S3.2'': When the LoRA fragment package is installed for the first time on a customer's ordinary client, a trusted identity profile of the ordinary client is established based on the device binding key material of the ordinary client. The trusted identity profile includes at least one of the following: license, customer identifier, ordinary client identifier, LoRA version, docking station model version, operating period, and call quota.

[0140] The aforementioned trusted identity profile is a trusted identity ledger for each legitimate computing power device and client terminal, created and encrypted and hosted throughout its entire lifecycle, based on the terminal device's local trusted components and TPM-generated terminal device binding key materials.

[0141] In one embodiment, when a regular client is installed for the first time, it calls the TPM through the local trusted component to generate device binding key materials and registers with the authorization center of the intelligent computing cloud platform. The authorization center establishes a trusted identity profile for the regular client, recording the license, customer identifier, regular client identifier, allowed LoRA version, docking station model version, operating period, call limit, and offline policy of the regular client.

[0142] Subsequently, when a regular client starts the model service, it first loads the base model and trusted loader, then collects the startup chain state, loader digest, executor digest, base model digest, and session random factor, and submits the collected data along with the regular client's device identity information to the authorization center. Based on the trusted identity profile, the authorization center, after confirming the device's legitimacy, the environment's trustworthiness, the base matching, and the license's validity, allows the session to derive the execution key within the trusted boundary. Furthermore, during inference, the inference executor only requests the LoRA shards required by the current operator at a certain layer, and restores the minimum available low-rank increment for that layer within the trusted boundary. After the computation of that layer is completed, the intelligent computing cloud platform immediately clears the plaintext and intermediate cache of the relevant shards before proceeding to the next layer using the same process. Through this mechanism, even if an attacker copies the local directory and LoRA shard package, they cannot reproduce a valid session on other terminal devices; even if an attacker attempts regular memory scraping on the current terminal device, they can usually only obtain parameter shards that are localized, short-lived, and lack true mapping relationships.

[0143] The beneficial technical effects achieved by steps S3.1'' and S3.2'' are: enabling the intelligent computing cloud platform to bind and control terminal devices in ordinary client mode; establishing a trusted identity profile to provide a legitimate subject basis for LoRA layered decryption; and improving the security of LoRA layered decryption performed by the intelligent computing cloud platform based on computing power.

[0144] It should be noted that in actual business scenarios, some customers have unstable network conditions and cannot meet the requirement of real-time network authorization for each LoRA operation. Therefore, this invention adds a short-term offline ticket mechanism on the basis of the ordinary client mode.

[0145] In one embodiment, after step S3.2'', the method further includes: Step S3.3'': In the case that remote authentication cannot be performed, determine whether the ordinary client has an offline ticket and whether the offline ticket meets the availability conditions. The availability conditions include that the remaining number of calls is greater than or equal to 1, it is not expired, and the bound terminal device identifier and environment digest match the ordinary client identifier and the current environment measurement value. Step S3.4'': If an offline ticket exists and the availability condition is met, determine that the ordinary client's proof is successful, and decrement the remaining call count corresponding to the offline ticket by 1; Step S3.5'': Based on the audit retransmission requirements of offline ticket binding, upload the audit information for offline ticket retrieval.

[0146] The aforementioned offline ticket can be bound to the terminal device identifier, environment summary, LoRA version, docking station model version, expiration time, remaining call count, and audit retransmission requirements. It is not equivalent to a long-term master key. Each offline run deducts the remaining call count, and the offline ticket automatically expires after the expiration time, when the call count is exhausted, or when the environment changes.

[0147] In this invention, authorization is divided into two categories: real-time online authorization and short-term offline authorization. When connected to the network, the client performs remote authentication and session-level key issuance according to the normal process; if the network is currently unavailable, but there is still an offline ticket that is not expired, has not exceeded the call limit, and matches the current terminal device and environment digest locally, then continued operation is allowed under restricted conditions.

[0148] The beneficial technical effects achieved by steps S3.3'' to S3.5'' are: avoiding the issuance of long-term, permanently valid local keys to customers, while also ensuring availability in weak network environments. Even if an attacker copies an offline ticket, it is difficult to reuse it directly on other machines because it is bound to the terminal device and environment.

[0149] In one embodiment, the terminal device can be a dedicated decryption machine, that is, the intelligent computing cloud platform provided by the present invention implements a layered decryption method for the fine-tuned LoRA model through computing power, and can achieve integrated secure operation in dedicated decryption machine mode. Step S3 includes: Step S3.1''': Write the LoRA fragment packet into the protected area inside the dedicated decryption machine to obtain a dedicated decryption machine with LoRA computing power service, and establish a trusted identity file for the dedicated decryption machine; Step S3.2''': Based on the call command sent by the client through the inference interface of the dedicated decryption machine, request to run the LoRA fragment packet.

[0150] In one embodiment, in industry customer scenarios with higher security requirements, customers demand that LoRA capabilities run locally but do not wish to access any directly exportable model files. Therefore, this invention can also accommodate layered decryption of LoRA models in a dedicated decryption machine mode.

[0151] A dedicated decryption unit can internally include a security module, trusted firmware, a trusted loader, a controlled execution module, and an audit module. During the factory manufacturing process, the dedicated decryption unit is programmed with a manufacturing certificate, device identifier, and internal security register information; critical private keys and device root capabilities are not exported. LoRA fragment packets can be written into the protected area within the dedicated decryption unit before delivery to the customer. The customer receives an end device with specific LoRA service capabilities, rather than just an adapter file.

[0152] Upon startup, the dedicated decryption machine performs a self-test, then submits its current firmware status and device verification materials to the authorization center in the intelligent computing cloud platform. Verification is then completed based on the trusted identity profile established for the dedicated decryption machine. Once the authorization center's verification is successful, the dedicated decryption machine is allowed to enable the corresponding LoRA controlled operation capabilities within its internal security boundaries. Afterward, the client only needs to invoke the dedicated decryption machine through the standard inference interface. The dedicated decryption machine can automatically complete shard scheduling, decryption, instant reconstruction, and base execution internally. The client cannot access the internal mapping table, session keys, or complete LoRA parameters. Even if an attacker performs an offline image of the storage medium, they cannot replicate the dedicated decryption machine's internal root capabilities and security state, making it difficult to restore LoRA operation rights on other machines.

[0153] The beneficial technical effects achieved by steps S3.1''' and S3.2''' are: enabling layered decryption of the LoRA model in a high-security delivery scenario for the intelligent computing cloud platform, improving the security of the LoRA model, and reducing the illegal reuse of LoRA parameters.

[0154] It should be noted that, in addition to the ordinary client mode and the dedicated decryption machine mode, the application scenarios of this invention can also be extended to cloud-based confidential instances, edge integrated machines, inference cards with security modules, and cluster authorization scenarios.

[0155] In one embodiment, the method further includes: Step S7: If abnormal behavior is detected, terminate the current session, clear the data generated in the current session, and record audit information.

[0156] The aforementioned audit information may refer to abnormal behavior types, terminal device identifiers, computing node information, decryption operation logs, timestamps, and shard access records, etc.

[0157] In this invention, the intelligent computing cloud platform can continuously detect the following abnormal behaviors during LoRA operation: debugger attachment, dynamic injection, memory scan anomalies, license replay, fragment request order anomalies, base model replacement, and loading path tampering. Once an anomaly is detected, the intelligent computing cloud platform can immediately perform operations such as terminating the inference session, clearing the session state, freezing the license, recording audit information, and reporting to the superior service.

[0158] The beneficial technical effects achieved by step S7 are as follows: By monitoring abnormal behavior in real time throughout the entire process of LoRA layering and on-demand decryption on the intelligent computing cloud platform, plaintext leakage caused by continuous batch decryption of LoRA fragments under abnormal conditions can be avoided. This can block the spread of security risks in real time, effectively reduce the probability of plaintext exposure, improve the security of LoRA model layering decryption in the intelligent computing cloud platform, and achieve risk traceability.

[0159] In one embodiment, the method further includes: Step S8: Embed customer feature identifiers in the LoRA parameters and / or LoRA fragment package runtime logs. In the event of a LoRA leak, locate the source of the leak and trace responsibility based on the customer feature identifiers.

[0160] The beneficial technical effects achieved by step S8 are: the ability to combine the layered decryption of the LoRA model by the intelligent computing cloud platform with audit trails and customer-specific features to achieve a complete protection chain from pre-operation blocking, in-operation control, to post-leakage tracing, thereby improving the security of LoRA.

[0161] Please see Figure 2 , Figure 2 It is an intelligent computing cloud platform that uses computing power to realize a layered decryption device for the fine-tuned LoRA model, such as... Figure 2 As shown, the intelligent computing cloud platform utilizes computing power to implement a layered decryption device 200 for the fine-tuned LoRA model, comprising: Module 201 is used to schedule computing power in the intelligent computing cloud platform and obtain the LoRA parameters and structural metadata of the LoRA parameters after fine-tuning. Packaging module 202 is used to perform structure-aware fragmentation of LoRA parameters based on structural metadata, and to perturb and encapsulate the LoRA fragments to obtain LoRA fragment packets. Verification module 203 is used to perform remote authentication for terminal devices requesting to run LoRA fragmentation packets, based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile. The key issuing module 204 is used to determine the running key of the current session of the terminal device based on the device root factor, the current environment measurement value, the license factor and the base model digest in the trusted identity file, and the current session random number, when the remote authentication is successful. The execution module 205 is used to decrypt the LoRA fragments required by the computing unit within the trusted boundary of the terminal device using the running key when executing the computing unit, calculate the decrypted plaintext together with the computing unit, and delete the computing unit after the calculation is completed. The computing unit is a layer, operator or window.

[0162] In one embodiment, the execution module 205 is further configured to: Determine the first computational unit to be executed at the current moment; Based on the index table corresponding to the LoRA fragment packet, determine the target LoRA fragment required by the first computing unit; Using the running key, the target LoRA fragment is decrypted within the trusted boundary of the terminal device, and the decrypted plaintext is calculated together with the first computing unit. After the calculation is complete, delete the plaintext, the target LoRA shard association cache, and the running key; Based on the execution graph of the base model, determine the second computing unit to be executed at the next moment after the first computing unit, and determine the running key at the next moment; Return to determine the target LoRA fragment required for the second computational unit, and execute subsequent steps sequentially until the last computational unit in the base model is completed.

[0163] In one embodiment, the plaintext is in the form of a low-rank increment or a product of two low-rank matrices. Execution module 205 is further configured to: Decrypt the low-rank increment required for the first computational unit, then superimpose the low-rank increment with the original weights of the first computational unit, and use the superimposed weights for calculation; or, The decryption yields a product of two low-rank matrices, which is then directly used for the forward computation of the first computational unit.

[0164] In one embodiment, the execution module 205 is further configured to: Based on a preset plaintext granularity, the target LoRA fragment is decrypted multiple times. Each decryption yields plaintext that matches the plaintext granularity, which is smaller than the computation unit.

[0165] In one embodiment, the packaging module 202 is further configured to: Structure-aware partitioning of LoRA parameters includes at least one of the following: partitioning by layer, partitioning by matrix type, partitioning by rank direction, partitioning by column block, partitioning by row block, and partitioning by quantization block.

[0166] In one embodiment, the packaging module 202 is further configured to: Remap the layer indexes of LoRA shards; Hide the matrix type identifier corresponding to the LoRA partition; The LoRA fragments corresponding to different layers are mixed and packaged; Insert pseudo-fragments into LoRA fragments; The mapping relationship between LoRA fragments and real locations is stored separately in the form of an index table; Store the quantization scale table and calibration table for LoRA slices separately.

[0167] In one embodiment, the verification module 203 is further configured to: Based on the Trusted Platform Module (TPM), Trusted Execution Environment (TEE), security chip, dedicated decryption module, or confidential computing environment of the terminal device, determine the device root factor; Collect at least one of the following from the terminal device's startup chain summary, trusted loader summary, inference executor summary, base model summary, driver summary, and firmware summary to obtain the current environmental measurement value.

[0168] In one embodiment, the packaging module 202 is further configured to: Bind the LoRA fragment package to at least one of a specific base model, a specific load path, and a specific inference executor.

[0169] In one embodiment, the verification module 203 is further configured to: If a mismatch is detected between the current environmental measurement and the specific base model, specific loading path, or specific inference executor bound to the LoRA fragment package, the remote proof is determined to be unsuccessful.

[0170] In one embodiment, the terminal device is a regular client machine, and the authentication module 203 is further configured to: Transmit LoRA fragment packets to the client; When a customer's ordinary client machine first installs the LoRA fragment package, a trusted identity profile of the ordinary client machine is established based on the device binding key material of the ordinary client machine. The trusted identity profile includes at least one of the following: license, customer identifier, ordinary client identifier, LoRA version, docking station model version, operating period, and call quota.

[0171] In one embodiment, the terminal device is a regular client machine, and the authentication module 203 is further configured to: In the absence of remote authentication, determine whether the ordinary client has an offline ticket and whether the offline ticket meets the availability conditions, which include remaining call count greater than or equal to 1, not expired, and the bound terminal device identifier and environment digest matching the ordinary client identifier and the current environment measurement value. If an offline ticket exists and the availability condition is met, the ordinary client's proof is confirmed to be successful, and the remaining call count corresponding to the offline ticket is decremented by 1. Based on the audit retransmission requirement for offline invoice binding, upload the audit information retrieved from the offline invoice.

[0172] In one embodiment, the terminal device is a dedicated decryption machine, and the verification module 203 is further used for: LoRA fragment packets are written into the protected area inside the dedicated decryption machine to obtain a dedicated decryption machine with LoRA computing power service, and a trusted identity file is established for the dedicated decryption machine; Based on the invocation command sent by the client through the inference interface of the dedicated decryptor, a request is made to run the LoRA fragment packet.

[0173] In one embodiment, the intelligent computing cloud platform, through computing power, enables a layered decryption device 200 for the fine-tuned LoRA model, which further includes: The first detection module is used to terminate the current session, clear the data generated by the current session, and record audit information when abnormal behavior is detected.

[0174] In one embodiment, the intelligent computing cloud platform, through computing power, enables a layered decryption device 200 for the fine-tuned LoRA model, which further includes: The second detection module embeds customer feature identifiers in the LoRA parameters and / or LoRA fragment package runtime logs. In the event of a LoRA leak, the module locates the source of the leak and traces responsibility based on the customer feature identifiers.

[0175] The intelligent computing cloud platform provided by this invention enables a layered decryption device for the fine-tuned LoRA model through computing power. This device can realize the various processes of each embodiment of the above-mentioned intelligent computing cloud platform's layered decryption method for the fine-tuned LoRA model through computing power. The technical features are one-to-one and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0176] It should be noted that the intelligent computing cloud platform in this invention can be a device, or a component, integrated circuit, or chip in an electronic device, which can be used to implement the hierarchical decryption device for the fine-tuned LoRA model through computing power.

[0177] The present invention also provides an electronic device, see [link to relevant documentation]. Figure 3 , Figure 3This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device includes a memory 301, a processor 302, and a program or instructions stored in the memory 301 that run on the memory. When the program or instructions are executed by the processor 302, they can achieve the following: Figure 1 The corresponding intelligent computing cloud platform uses computing power to implement any step in the implementation of the layered decryption method for the fine-tuned LoRA model and achieve the same beneficial effect, which will not be elaborated here.

[0178] The processor 302 can be a CPU, ASIC, FPGA or GPU.

[0179] Those skilled in the art will understand that all or part of the steps of the above-described intelligent computing cloud platform implementation of the hierarchical decryption method for the fine-tuned LoRA model through computing power can be completed by hardware related to program instructions, and the program can be stored in a readable medium.

[0180] The present invention also provides a readable storage medium on which a computer program is stored, and which, when executed by a processor, can perform the above-described functions. Figure 1 The corresponding intelligent computing cloud platform can achieve any step in the layered decryption method embodiment for the fine-tuned LoRA model through computing power, and can achieve the same technical effect. To avoid repetition, it will not be described in detail here. The storage medium mentioned is such as read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0181] The present invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the above-described... Figure 1 The corresponding intelligent computing cloud platform uses computing power to implement each process of the layered decryption method implementation for the fine-tuned LoRA model, and can achieve the same technical effect. To avoid repetition, it will not be described in detail here.

[0182] The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or apparatuses. Additionally, the use of "and / or" in this application indicates at least one of the connected objects, such as A and / or B and / or C, representing seven possibilities: A alone, B alone, C alone, both A and B present, both B and C present, both A and C present, and A, B, and C present.

[0183] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or second terminal device, etc.) to execute the methods of the various embodiments of this application.

[0185] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for hierarchical decryption of a fine-tuned LoRA model using computing power on an intelligent computing cloud platform, characterized in that: include: Step S1: Schedule the computing power in the intelligent computing cloud platform to obtain the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; Step S2: Based on the structure metadata, perform structure-aware fragmentation on the LoRA parameters, and perturb the LoRA fragments to obtain LoRA fragment packets; Step S3: For the terminal device requesting to run the LoRA fragment packet, perform remote authentication based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile; Step S4: If the remote authentication is successful, determine the running key of the current session of the terminal device based on the device root factor, the current environment measurement value, the license factor and base model digest in the trusted identity file, and the current session random number; Step S5: For each computing unit in the base model of the terminal device, when the computing unit is executed, the running key is used to decrypt the LoRA fragment required by the computing unit within the trusted boundary of the terminal device, and the decrypted plaintext is calculated together with the computing unit. After the calculation is completed, the plaintext is deleted. The computing unit is a layer, operator or window.

2. The method as described in claim 1, characterized in that, Step S5 includes: Step S5.1: Determine the first computational unit to be executed at the current moment; Step S5.2: Determine the target LoRA fragment required by the first computing unit according to the index table corresponding to the LoRA fragment packet; Step S5.3: Using the running key, decrypt the target LoRA fragment within the trusted boundary of the terminal device, and calculate the decrypted plaintext together with the first computing unit; Step S5.4: After the calculation is completed, delete the plaintext, the target LoRA shard association cache, and the running key; Step S5.5: Based on the execution diagram of the base model, determine the second computing unit to be executed at the next moment after the first computing unit, and determine the running key at the next moment; Step S5.6: Return to step S5.2 to determine the target LoRA fragment required by the second computing unit, and execute the subsequent steps in sequence until the last computing unit in the base model is completed.

3. The method as described in claim 2, characterized in that, The plaintext is in the form of a low-rank increment or the product of two low-rank matrices. Step S5.3 includes: S5.3.1, Decrypt to obtain the low-rank increment required by the first computing unit, superimpose the low-rank increment with the original weight of the first computing unit, and use the superimposed weight for calculation; or, S5.3.2 Decrypt to obtain the product of two low-rank matrices, and directly use the product of the two low-rank matrices for the forward calculation of the first calculation unit.

4. The method as described in claim 2, characterized in that, Step S5.3 includes: S5.3.1' Based on a preset plaintext granularity, the target LoRA fragment is decrypted multiple times. Each decryption yields plaintext that matches the plaintext granularity, where the plaintext granularity is smaller than that of the first calculation unit.

5. The method as described in claim 1, characterized in that, In step S2, the LoRA parameters are subjected to structure-aware sharding, which includes at least one of the following: sharding by layer, sharding by matrix type, sharding by rank direction, sharding by column block, sharding by row block, and sharding by quantization block.

6. The method as described in claim 1, characterized in that, The perturbation encapsulation of the LoRA fragments in step S2 includes at least one of the following: Remap the layer index of the LoRA shard; Hide the matrix type identifier corresponding to the LoRA partition; The LoRA fragments corresponding to different layers are mixed and packaged; Insert pseudo-fragments into the LoRA fragments; The mapping relationship between the LoRA fragments and the actual locations is stored separately in the form of an index table; The quantization scale table and verification table of the LoRA slice are stored separately.

7. The method as described in claim 1, characterized in that, Step S3 includes: Step S3.1: Determine the root factor of the terminal device based on the Trusted Platform Module (TPM), Trusted Execution Environment (TEE), security chip, dedicated decryption module, or confidential computing environment. Step S3.2: Collect at least one of the following: startup chain summary, trusted loader summary, inference executor summary, base model summary, driver summary, and firmware summary of the terminal device to obtain the current environment measurement value.

8. The method as described in claim 1, characterized in that, Following step S2, the method further includes: Step S6: Bind the LoRA fragment package to at least one of a specific base model, a specific loading path, and a specific inference executor.

9. The method as described in claim 8, characterized in that, Step S3 includes: Step S3.1': If a mismatch is detected between the current environmental measurement value and one of the specific base model, specific loading path, or specific inference executor bound to the LoRA fragment package, the remote proof is determined to be unsuccessful.

10. The method according to any one of claims 1 to 9, characterized in that, The terminal device is a regular client machine. Step S3 includes: Step S3.1'': Transmit the LoRA fragment packet to the client; Step S3.2'': When the LoRA fragment package is first installed on the client's ordinary client machine, a trusted identity profile of the ordinary client machine is established based on the terminal device binding key material of the ordinary client machine. The trusted identity profile includes at least one of the following: license, client identifier, ordinary client identifier, LoRA version, docking model version, operating period, and call quota.

11. The method as described in claim 10, characterized in that, Following step S3.2'', the method further includes: Step S3.3'': In the case that remote authentication cannot be performed, determine whether the ordinary client has an offline ticket and whether the offline ticket meets the availability conditions. The availability conditions include remaining call count greater than or equal to 1, not expired, and the bound terminal device identifier and environment digest match the ordinary client identifier and current environment measurement value. Step S3.4'': If an offline ticket exists and the availability condition is met, determine that the ordinary client's proof is successful, and decrement the remaining call count corresponding to the offline ticket by 1; Step S3.5'': Based on the audit retransmission requirements bound to the offline ticket, upload the audit information for the offline ticket call.

12. The method according to any one of claims 1 to 9, characterized in that, The terminal device is a dedicated decryption machine, and step S3 includes: Step S3.1''': Write the LoRA fragment packet into the protected area inside the dedicated decryption machine to obtain a dedicated decryption machine with LoRA computing power service, and establish a trusted identity file for the dedicated decryption machine; Step S3.2''': Based on the call command sent by the client through the inference interface of the dedicated decryption machine, request to run the LoRA fragment packet.

13. The method according to any one of claims 1 to 9, characterized in that, The method further includes: Step S7: If abnormal behavior is detected, terminate the current session, clear the data generated by the current session, and record audit information.

14. The method according to any one of claims 1 to 9, characterized in that, The method further includes: Step S8: Embed customer feature identifiers in the LoRA parameters and / or the LoRA fragment package's runtime logs. In the event of a LoRA leak, locate the source of the leak and trace responsibility based on the customer feature identifiers.

15. A layered decryption device for a fine-tuned LoRA model, implemented through a smart computing cloud platform, characterized in that: include: The acquisition module schedules the computing power in the intelligent computing cloud platform to acquire the LoRA parameters of the fine-tuned LoRA model and the structural metadata of the LoRA parameters; The packaging module is used to perform structure-aware fragmentation of the LoRA parameters based on the structure metadata, and to perturb the LoRA fragmentation to obtain a LoRA fragmentation packet. The verification module is used to perform remote authentication for terminal devices requesting to run the LoRA fragment packet, based on the device root factor associated with the terminal device, the current environmental measurement value, and the trusted identity profile. The key issuance module is used to determine the running key of the current session of the terminal device based on the device root factor, the current environment measurement value, the license factor and base model digest in the trusted identity file, and the current session random number when the remote authentication is successful. An execution module is used to, for each computing unit in the base model of the terminal device, use the running key to decrypt the LoRA fragment required by the computing unit within the trusted boundary of the terminal device when executing the computing unit, calculate the decrypted plaintext together with the computing unit, and delete the plaintext after the calculation is completed. The computing unit is a layer, operator or window.

16. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of implementing a layered decryption method for a fine-tuned LoRA model by means of computing power in an intelligent computing cloud platform as described in any one of claims 1 to 14 are described.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the intelligent computing cloud platform as described in any one of claims 1 to 14, which implements a layered decryption method for the fine-tuned LoRA model using computing power.

18. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the steps of the intelligent computing cloud platform as described in any one of claims 1 to 14, to implement a layered decryption method for a finely tuned LoRA model using computing power.

Images