Model cloud privacy fine-tuning and reasoning method and system based on adaptive dithering technology, computer device and storage medium

Abstract

The embodiment of the application relates to the field of artificial intelligence, and provides a large model cloud privacy fine-tuning and reasoning method and system based on an adaptive dithering technology, computer equipment and a storage medium, the method comprising: generating dithering keys in different directions, and constructing a dynamic mapping relationship between the dithering keys and dithering operators; implanting the dithering keys into a model expression layer of a large-scale language model to be trained, and performing double adaptive dithering processing; performing training and recovery processing on an initial encrypted model based on a two-stage supervised fine-tuning technology; encrypting fine-tuning data to fine-tune the recovered encrypted model; encrypting reasoning request data and inputting the encrypted reasoning request data into an encrypted privacy model, and performing cloud-side cryptic reasoning to decrypt and output target reasoning results. The implementation of the method guarantees the model precision of the large model in a privacy protection scene, and improves the security of data and the accuracy of reasoning.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, system, computer device, and storage medium for large-scale model cloud privacy fine-tuning and inference based on adaptive jitter technology. Background Technology

[0002] In the field of artificial intelligence, the closed-state privacy training and inference of large-scale language models has become a core requirement for data security and model protection. Large models rely on massive word sequences for training and interaction. The original word sequences directly expose the input semantics and feature information, making them more vulnerable to cyberattacks and easily leading to the leakage of user privacy.

[0003] However, existing privacy protection technologies often employ single perturbation or static permutation strategies for token encryption, leading to a difficulty in balancing protection strength and model accuracy in traditional large-scale model privacy protection technologies. Summary of the Invention

[0004] This application provides a method, system, computer device, and storage medium for large-scale model privacy fine-tuning and inference based on adaptive jitter technology. More specifically, this application provides a method, system, computer device, computer storage medium, and computer program product for large-scale model privacy fine-tuning and inference based on adaptive jitter technology, ensuring the model accuracy of large models in privacy protection scenarios and improving data security and inference accuracy.

[0005] In a first aspect, embodiments of this application provide a method for privacy fine-tuning and inference of large models in the cloud based on adaptive jitter technology, including:

[0006] Dithering keys in different directions are generated, and a dynamic mapping relationship between the dithering keys and dithering operators is constructed.

[0007] Based on the dynamic mapping relationship, the jitter key is implanted into the model representation layer of the large-scale language model to be trained, and dual adaptive jitter processing is performed on the large-scale language model to generate an initial encryption model; the initial encryption model is trained and restored based on a two-stage supervised fine-tuning technique to obtain the restored encryption model.

[0008] Acquire fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data; fine-tune the recovered encrypted model according to the encrypted data to obtain an encrypted privacy model;

[0009] Obtain inference request data; encrypt the inference request data using the jitter key to obtain encrypted request data; input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain encrypted inference results; decrypt the encrypted inference results using the jitter key and output them to obtain the target inference result associated with the inference request data.

[0010] Optionally, in some embodiments of this application, generating dithering keys in different directions includes:

[0011] Generate horizontal jitter keys and vertical jitter keys;

[0012] The jitter keys for different directions are obtained based on the horizontal jitter key and the vertical jitter key.

[0013] Optionally, in some embodiments of this application, the step of embedding the dithering key into the model representation layer of the large-scale language model to be trained based on the dynamic mapping relationship, performing dual adaptive dithering processing on the large-scale language model, and generating an initial encryption model includes:

[0014] Dynamic noise transformation is applied to the word vector values ​​output by the representation layer of the large-scale language model based on the lateral dithering key;

[0015] Based on the vertical dithering key, the word vectors output by the model representation layer in the large-scale language model are dynamically permuted and rearranged column by column.

[0016] Optionally, in some embodiments of this application, the training and recovery processing of the initial encryption model based on the two-stage supervised fine-tuning technique to obtain the recovered encryption model includes:

[0017] The initial encryption model is trained using perceptual recovery to adapt to the new encryption representation space, and a stable mapping between the key and the representation layer is established to obtain the encryption model after perceptual recovery.

[0018] The encrypted model after perception recovery is trained to restore its business capabilities. Through iterative training, the accuracy of the model is made close to that of the original model, thus obtaining the encrypted model after recovery.

[0019] Optionally, in some embodiments of this application, the step of obtaining fine-tuning data and encrypting the fine-tuning data according to the dithering key to obtain encrypted data includes:

[0020] The fine-tuned data is preprocessed to convert it into an original word sequence;

[0021] Based on the dithering key, perform lateral adaptive dithering on the original lexical sequence to generate an encrypted lexical sequence;

[0022] The encrypted token sequence is used as the encrypted state data.

[0023] Optionally, in some embodiments of this application, obtaining inference request data and encrypting the inference request data according to the dithering key to obtain encrypted request data includes:

[0024] The inference request data is preprocessed and converted into an inference word sequence;

[0025] The inference lexical sequence is adaptively jittered and encrypted using the jitter key to obtain the encrypted request data.

[0026] Optionally, in some embodiments of this application, obtaining inference request data and encrypting the inference request data according to the dithering key to obtain encrypted request data includes:

[0027] Identify the user identifier of the request initiating user associated with the inference request data;

[0028] Based on the user identifier of the user initiating the request, assign the jitter key held independently by the tenant to the user initiating the request;

[0029] The inference request data is encrypted using the jitter key held independently by the tenant to obtain the encrypted request data.

[0030] Secondly, embodiments of this application provide a large-model cloud-based privacy fine-tuning and inference system based on adaptive jitter technology, which has the function of implementing the large-model cloud-based privacy fine-tuning and inference method based on adaptive jitter technology provided in the first aspect above. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function, and the modules can be software and / or hardware.

[0031] In one possible design, the system includes:

[0032] The key generation module is used to generate dither keys in different directions and construct a dynamic mapping relationship between the dither keys and dither operators.

[0033] The model encryption and adaptive recovery module is used to implant the jitter key into the model representation layer of the large-scale language model to be trained based on the dynamic mapping relationship, perform dual adaptive jitter processing on the large-scale language model to generate an initial encrypted model, and perform training recovery processing on the initial encrypted model based on a two-stage supervised fine-tuning technique to obtain a recovered encrypted model.

[0034] The encrypted privacy fine-tuning module is used to acquire fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data, and fine-tune the recovered encrypted model according to the encrypted data to obtain an encrypted privacy model.

[0035] The encrypted privacy inference module is used to acquire inference request data, encrypt the inference request data according to the jitter key to obtain encrypted request data; input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain encrypted inference results; decrypt the encrypted inference results according to the jitter key and output them to obtain the target inference result associated with the inference request data.

[0036] In another aspect, this application provides a computer device including at least one connected processor and a memory, wherein the memory is used to store program code, and the processor is used to call the program code in the memory to execute the methods described in the above aspects.

[0037] In another aspect, embodiments of this application provide a computer storage medium including instructions that, when executed on a computer, cause the computer to perform the methods described in the above aspects.

[0038] In another aspect, this application provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods described in the above aspects.

[0039] Compared to traditional technologies, this application can meet the real-time requirements of the power industry without homomorphic encryption or other heavy computation operations. It does not require reconstruction of the original model structure and can be directly integrated into existing large model applications. Through phased adaptive recovery training, the accuracy loss can be iteratively approximated to the original model, making the accuracy controllable and recoverable. It achieves full-dimensional privacy protection in terms of model data, model memory, and tenant isolation, thereby ensuring the model accuracy of large models in privacy protection scenarios and improving data security and inference accuracy. Attached Figure Description

[0040] Figure 1 This is a flowchart of one embodiment.

[0041] Figure 2 This is a structural block diagram of a system in one embodiment.

[0042] Figure 3 This is an internal structural diagram of a computer device in one embodiment.

[0043] Figure 4 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0044] The terms "first," "second," etc., used in the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those steps or modules explicitly listed, but may include other steps or modules not explicitly listed or inherent to these processes, methods, products, or devices. The division of modules appearing in the embodiments of this application is only a logical division. In actual applications, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interface, and the indirect coupling or communication connection between modules may be electrical or other similar forms. None of these are limited in the embodiments of this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed among multiple circuit modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of this application.

[0045] Figure 1 This is a flowchart illustrating one embodiment, such as... Figure 1 As shown in the embodiments of this application, the large model cloud privacy fine-tuning and inference method based on adaptive jitter technology includes:

[0046] S1 generates dithering keys in different directions, and constructs a dynamic mapping relationship between dithering keys and dithering operators.

[0047] Here, the jitter key refers to the dedicated key used to drive various perturbation transformation operations; the jitter operator refers to the functional operation unit that realizes the transformation of vectors and sequences of different dimensions.

[0048] The dynamic mapping relationship is used to reflect the association rules for linkage and matching between the key and the corresponding operation unit.

[0049] For example, the client generates a vertical key vs_key and a horizontal key hs_key, and establishes a unique dynamic mapping relationship between the keys and the jitter operator.

[0050] S2, based on dynamic mapping, embeds the jitter key into the model representation layer of the large-scale language model to be trained, performs dual adaptive jitter processing on the large-scale language model, and generates an initial encrypted model; based on two-stage supervised fine-tuning technology, the initial encrypted model is trained and restored to obtain the restored encrypted model.

[0051] Among them, the model representation layer refers to the layer in the large model that carries semantic vectors and feature representations; dual adaptive jitter processing refers to the model encryption operation that carries out dynamic perturbation in both directions simultaneously; and the initial encrypted model refers to the encrypted large model that has not yet recovered its accuracy after the basic perturbation transformation has been completed.

[0052] Among them, the two-stage is used to represent two different training stages that are carried out in a hierarchical and step-by-step manner; supervised fine-tuning technology, namely SFT (Supervised Fine-Tuning) technology, refers to the training method that uses labeled data to complete the adaptation and adjustment of model capabilities; training recovery processing refers to the operation of making up for the deviation caused by perturbation and restoring the original performance of the model; and the post-recovery encrypted model refers to the encrypted and formed large model whose accuracy has returned to the standard state.

[0053] For example, the key is implanted into the model representation layer, and dual adaptive jitter is performed to restore model accuracy through two-stage SFT training.

[0054] S3. Obtain fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data; fine-tune the recovered encrypted model according to the encrypted data to obtain the encrypted privacy model.

[0055] Fine-tuning data refers to customized training text materials used to optimize the model's specific business capabilities; encrypted data refers to data that has been encrypted with a key and cannot be directly read for its true semantics.

[0056] Among them, model fine-tuning refers to the operation of slightly optimizing parameters on the basis of the established model to adapt to specific scenarios; encrypted privacy model refers to a model that has both encryption protection and exclusive business capabilities.

[0057] For example, the client encrypts the fine-tuning data before uploading it, and the cloud performs model fine-tuning based on the encrypted data, with no plaintext leakage throughout the process.

[0058] S4. Obtain the inference request data, encrypt the inference request data according to the jitter key to obtain the encrypted request data; input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain the encrypted inference result; decrypt the encrypted inference result according to the jitter key and output the result to obtain the target inference result associated with the inference request data.

[0059] Among them, inference request data refers to the text data submitted by users when initiating business inquiries; encrypted request data refers to the business inquiry data that has been encrypted and uploaded to the cloud.

[0060] Among them, cloud-based encrypted reasoning refers to reasoning that completes model calculations in the cloud without decryption; encrypted reasoning results refer to encrypted business response results generated after model calculations.

[0061] Among them, decryption output refers to restoring encrypted content based on a dedicated key, and target inference result refers to the standard business response content obtained by matching user query requirements.

[0062] For example, the client encrypts the encrypted request data, sends it to the cloud for encrypted inference, returns the encrypted inference result, and then the client decrypts and outputs the target inference result, with the plaintext not leaving the trusted domain.

[0063] Compared to traditional technologies, in this embodiment, dithering keys in different directions are first generated, and a dynamic mapping relationship is established between the dithering keys and various dithering operators. Then, based on the dynamic mapping relationship, the dithering keys are embedded into the model representation layer of the large-scale language model to be trained. Dual adaptive dithering processing is then performed on the large-scale language model to obtain an initial encrypted model. Next, training recovery processing is performed based on a two-stage supervised fine-tuning technique. Then, the fine-tuned data is encrypted using the dithering keys to obtain encrypted data. The recovered encrypted model is then fine-tuned to obtain an encrypted privacy model. Finally, the inference request data is encrypted to obtain an encrypted request. The data is input into the encrypted privacy model to perform cloud-based encrypted inference, and then decrypted to output the target inference result. The technical solution of this application embodiment can meet the real-time requirements of the power industry without homomorphic encryption or other heavy computation operations. It does not require reconstruction of the original model structure and can be directly connected to existing large model applications. Through phased adaptive recovery training, the accuracy loss can be iteratively approximated to the original model, making the accuracy controllable and recoverable. It achieves full-dimensional privacy protection in terms of model data, model memory, and tenant isolation, thereby ensuring the model accuracy of large models in privacy protection scenarios and improving data security and inference accuracy.

[0064] Optionally, in some embodiments of this application, generating jitter keys in different directions includes: generating a horizontal jitter key and a vertical jitter key; and obtaining jitter keys in different directions based on the horizontal jitter key and the vertical jitter key.

[0065] The shaking keys in different directions include horizontal shaking keys and vertical shaking keys. The horizontal shaking key is vs_key (Vertical Shaking Key), which is a dedicated security key that controls the permutation and arrangement of word sequences; the vertical shaking key is hs_key (Horizontal Shaking Key), which is a dedicated security key that controls the perturbation and transformation of word vector values.

[0066] In this embodiment, by dividing the keys into two categories for different purposes and configuring them independently, the flexibility of key classification and management is improved, the independent control effect of different encryption dimensions is enhanced, and the adaptability of layered encryption implementation is strengthened.

[0067] Optionally, in some embodiments of this application, based on a dynamic mapping relationship, a dithering key is implanted into the model representation layer of the large-scale language model to be trained, and dual adaptive dithering processing is performed on the large-scale language model to generate an initial encryption model, including: applying dynamic noise transformation to the word vector values ​​output by the model representation layer in the large-scale language model based on the horizontal dithering key; and dynamically permuting and rearranging the word vectors output by the model representation layer in the large-scale language model column by column based on the vertical dithering key.

[0068] Among them, word vectors refer to high-dimensional numerical vector units used to represent the semantic features of text; dynamic noise transformation refers to the transformation method that autonomously adjusts the perturbation amplitude to change the vector value; and column-wise dynamic permutation and rearrangement refers to the operation of changing the position of vectors according to predetermined rules.

[0069] For example, dynamic noise transformation is applied to word vector values ​​based on horizontal dithering keys to scramble the correspondence between the original vectors and the encrypted vectors; word vectors are dynamically permuted and rearranged column by column based on vertical dithering keys, and the mapping relationship between words and vectors is completely invisible to the cloud.

[0070] In this embodiment, by dividing the model encryption into two different perturbation methods, the dual protection capability of the model's underlying parameters and surface semantics is enhanced, the encryption uniformity is improved, and the security strength of the model against reverse analysis is increased.

[0071] In another embodiment, dynamic noise transformation is applied to the word vector values ​​output by the representation layer of a large-scale language model based on a horizontal dithering key. Specifically, this includes: real-time acquisition of the original distribution of word vector values ​​and the model's accuracy loss status, and autonomously determining an adaptive noise application amplitude range. Based on the horizontal dithering key, matching perturbation rules are retrieved, and adaptive noise intensity is obtained by differentially configuring word vectors with different semantic weights. Based on the adaptive noise application amplitude range and noise intensity, dynamic noise transformation is applied to the word vector values ​​output by the representation layer of the large-scale language model.

[0072] In another embodiment, the dynamic permutation and rearrangement of word vectors output by the model representation layer in a large-scale language model based on the vertical dithering key includes: autonomously selecting suitable column permutation combinations based on the column dimension arrangement features and word sequence structure of the entire batch of word vectors; determining arrangement scenarios suitable for word vectors of different lengths and sentence structures; matching adaptive permutation templates that conform to the characteristics of word vector rearrangement based on the permutation combination forms and arrangement scenarios; and dynamically permuting and rearranging the word vectors output by the model representation layer in the large-scale language model by column based on the adaptive permutation template.

[0073] Optionally, in some embodiments of this application, the initial encryption model is trained and restored based on a two-stage supervised fine-tuning technique to obtain a restored encryption model. This includes: performing perceptual restoration training on the initial encryption model to adapt to the new encryption representation space and establish a stable mapping between the key and the representation layer to obtain a perceptually restored encryption model; performing functional restoration training on the perceptually restored encryption model to restore the model's business capabilities; and achieving an accuracy close to the original model through iterative training to obtain a restored encryption model.

[0074] Among them, perception recovery training refers to the basic adaptation training process that allows the model to adapt to the new encrypted feature space; functional recovery training refers to the advanced tuning process that restores the model's various business computing capabilities; model business capabilities include model reasoning, generation, dialogue and other business capabilities.

[0075] For example, training recovery processing of the initial encryption model based on the two-stage supervised fine-tuning technique is also known as two-stage precision recovery SFT training, which includes perceptual recovery training and functional recovery training. Perceptual recovery training allows the model to adapt to the new encryption representation space and establish a stable mapping between the key and the representation layer. Functional recovery training is used to recover the model's business capabilities such as reasoning, generation, and dialogue, and achieves accuracy close to the original model through iterative training.

[0076] In this embodiment, by carrying out model accuracy recovery training in a layered and step-by-step manner, the semantic adaptation efficiency of the encrypted model is improved, the accuracy of model business operation is improved, and the performance loss caused by encryption operation is reduced.

[0077] In another embodiment, the initial encryption model is perceptually recovered to adapt to the new encryption representation space, and a stable mapping between the key and the representation layer is established to obtain the perceptually recovered encryption model. This includes: constructing a perceptually recovered training dataset based on historical question-and-answer records of simple short sentences, daily dialogues, and basic common sense; and adjusting the model parameters of the embedding layer and the representation layer of the initial encryption model based on the perceptually recovered training dataset to obtain the perceptually recovered encryption model.

[0078] In another embodiment, the encrypted model after perception recovery is subjected to functional recovery training to restore the model's business capabilities. Through iterative training, the accuracy is brought close to that of the original model to obtain the recovered encrypted model. This includes: constructing a functional recovery training dataset based on historical question and answer records of difficult questions, logical reasoning, and professional content; and adjusting all model parameters of the encrypted model after perception recovery based on the functional recovery training dataset to obtain the recovered encrypted model.

[0079] As can be seen from the above embodiments, the different datasets and parameter training ranges of the two training methods, perceptual recovery training and functional recovery training, and the selection of different levels of training data from shallow to deep, allow the model to quickly adapt to the encrypted space first, and then fully restore complex business capabilities. The transition from local parameter tuning to full parameter tuning can not only stabilize the encrypted mapping relationship, but also correct the overall perturbation deviation, significantly reduce the training difficulty, smoothly complete the accuracy restoration, and balance training efficiency and the final running effect of the model.

[0080] Optionally, in some embodiments of this application, obtaining fine-tuning data and encrypting the fine-tuning data according to the dithering key to obtain encrypted data includes: preprocessing the fine-tuning data to convert it into an original word sequence; performing lateral adaptive dithering on the original word sequence based on the dithering key to generate an encrypted word sequence; and using the encrypted word sequence as encrypted data.

[0081] Preprocessing refers to the preliminary processing operations that involve regularizing and transforming the original text data.

[0082] Among them, the original word sequence, also known as the original token sequence, refers to the sequence of basic semantic units obtained by splitting the text according to standard rules.

[0083] Among them, the encrypted token sequence, also known as the encrypted token sequence, refers to the encrypted semantic unit sequence formed after key perturbation transformation.

[0084] For example, the client performs preprocessing, converting the fine-tuning data (Prompt / Target) into a raw token sequence; and performs lateral adaptive jitter based on the key to generate an encrypted token sequence.

[0085] In this embodiment, by uniformly converting training data into standard units before encryption, the regularity of data encryption operations is improved, the adaptation effect of cloud-based encrypted training is enhanced, and data privacy and security are guaranteed throughout the training process.

[0086] Optionally, in some embodiments of this application, obtaining inference request data and encrypting the inference request data according to a dithering key to obtain encrypted request data includes: preprocessing the inference request data to convert it into an inference lexical sequence; and performing adaptive dithering encryption on the inference lexical sequence based on the dithering key to obtain encrypted request data.

[0087] Among them, the reasoning lexical sequence is the token sequence of the reasoning request, which refers to the semantic unit arrangement sequence formed after splitting the business query text.

[0088] Among them, adaptive jitter encryption refers to a method of autonomously completing sequence perturbation encryption according to adaptation rules.

[0089] For example, the client converts the inference request into a token and sends it to the cloud with adaptive jitter encryption.

[0090] In this embodiment, standardized data conversion followed by encryption improves the processing efficiency of real-time request data encryption and enhances the smoothness of cloud-based encrypted inference.

[0091] Optionally, in some embodiments of this application, obtaining inference request data and encrypting the inference request data using a jitter key to obtain encrypted request data includes: identifying the user identifier of the request initiating user associated with the inference request data; allocating a jitter key held independently by the tenant to the request initiating user based on the user identifier of the request initiating user; and encrypting the inference request data using the jitter key held independently by the tenant to obtain encrypted request data.

[0092] Among them, user identifier refers to exclusive identity information used to distinguish different users. The user who initiates the request is also known as a tenant, which is used to represent an independent user of the large-scale encryption service. Independent holding refers to the form of use in which a single user manages and controls the exclusive encryption key.

[0093] For example, by tenant isolation, different tenants hold independent keys, thus completely isolating the risk of cross-tenant access.

[0094] In this embodiment, by assigning exclusive encryption keys based on user identity, the data isolation and protection capabilities in multi-user scenarios are enhanced, the security order of multi-tenant parallel use is improved, and the privacy isolation effect is improved.

[0095] The technical research process and other technical details of this application are described below with reference to a specific embodiment.

[0096] In traditional technologies, current privacy protection technologies for large-scale cloud deployment and applications mainly include the following categories:

[0097] Homomorphic encryption technology: After fully homomorphically encrypting the data, the computation is performed in the cloud. The cloud processes the encrypted data throughout the process, but it has problems such as exponential growth in computational overhead, high inference latency, and inability to support full fine-tuning of large models.

[0098] Federated learning technology enables joint training by transmitting gradients without leaving the domain of data from multiple parties. However, it suffers from drawbacks such as high communication costs, gradient leakage risks, and difficulty in achieving efficient cross-institutional collaboration.

[0099] Differential privacy technology introduces random noise during model training or inference to reduce the risk of data leakage, but it introduces a significant loss of model accuracy, which cannot meet the high accuracy requirements of industries such as power.

[0100] Traditional model encryption techniques achieve protection by modifying the model structure and encrypting model weights, but require deep reconstruction of mainstream large models, have poor compatibility, and cannot simultaneously protect input and output data and model memory.

[0101] In view of the shortcomings of the existing technology, this application aims to solve the following core problems:

[0102] How to achieve full-process encrypted operation of large model fine-tuning and inference without reconstructing the original model structure, ensuring that plaintext never leaves the domain; how to improve encryption irreversibility through adaptive perturbation mechanisms while solving the problem of significant model accuracy degradation caused by traditional jitter; how to achieve two-stage accuracy recovery training, supporting flexible configuration of "trading time for accuracy" to make the encrypted model approach the performance of the original model; how to build a multi-tenant key isolation system to adapt to sensitive data scenarios in the power industry and achieve complete isolation between tenant data and models; and how to be compatible with mainstream large models such as Llama, Deepseek, and Qwen and GPU distributed environments with zero additional performance loss and no inference latency.

[0103] Based on this, this application provides a cloud-based privacy fine-tuning and inference method for large models based on adaptive jitter technology. It proposes an adaptive jitter technology based on the embedding layer of artificial intelligence large models. Through progressive unidirectional irreversible perturbation of the representation space, combined with key-operator dynamic mapping and two-stage precision recovery SFT training, a closed loop of edge-cloud collaborative dense fine-tuning and inference is constructed to form a dedicated privacy model that can only be used normally by the key holder, thereby achieving full-process security protection for sensitive data in the power industry.

[0104] The cloud-based privacy fine-tuning and inference method for large models based on adaptive jitter technology proposed in this application is divided into two major modules in terms of overall technical framework: client (trusted area) and cloud (untrusted area). The core process is divided into four stages, corresponding to steps S1 to S4.

[0105] Specifically, step S1 can also be described as the key generation stage: the client generates a vertical key vs_key (Vertical Shaking Key) and a horizontal key hs_key (Horizontal Shaking Key), and establishes a unique dynamic mapping relationship between the key and the jitter operator.

[0106] Step S2 can also be described as the model encryption and adaptive recovery stage: the key is implanted into the model representation layer, dual adaptive jitter is performed, and the model accuracy is recovered through two-stage SFT (Supervised Fine-Tuning) training.

[0107] Step S3 can also be described as the encrypted privacy fine-tuning stage: the client encrypts the fine-tuning data and uploads it, and the cloud completes the model fine-tuning based on the encrypted data, with no plaintext leakage throughout the process.

[0108] Step S4 can also be described as the encrypted privacy inference stage: client encrypted request → cloud encrypted inference → return encrypted result → client decryption output, plaintext does not leave the trusted domain.

[0109] In step S2, the adaptive jitter technology differs from traditional fixed jitter in that it has adaptive, progressive, and unidirectional irreversible characteristics. It achieves representation space reconstruction through key-driven methods, specifically including longitudinal adaptive jitter and lateral adaptive jitter.

[0110] (1) The principle of longitudinal adaptive jitter is: based on vs_key, dynamic noise transformation is applied to the word vector values ​​to disrupt the correspondence between the original vector and the encrypted vector; the operators used include: differential operator, nonlinear operator, tilt operator, and hash operator; the function of longitudinal adaptive jitter is to improve irreversibility and prevent attackers from restoring the original model parameters from the encrypted weights.

[0111] (2) The principle of horizontal adaptive jitter is: based on hs_key, the word vectors are dynamically permuted and rearranged column by column, and the mapping relationship between words and vectors is completely invisible to the cloud; the operators used include: offset operator, permutation operator, scaling operator, affine operator, and confusion operator; the function of horizontal adaptive jitter is to reduce the loss of precision and protect the semantic privacy of input and output data.

[0112] In adaptive jitter technology, the core characteristics of jitter include: (1) progressive perturbation: gradually increasing the difference in expression to avoid precision collapse caused by one-time jitter; (2) one-way irreversibility: it is impossible to reverse the original data, model parameters and keys through the dense state data; (3) unique key binding: different keys correspond to independent jitter spaces, which naturally supports multi-tenant isolation.

[0113] Step S2 is also known as the key implantation and two-stage precision recovery process. The key implantation and two-stage precision recovery process is divided into an adaptive jitter stage and a two-stage precision recovery stage, in order to solve the problem of traditional jitter precision loss.

[0114] Specifically, in the adaptive jitter stage of step S2, the client generates a key, drives the longitudinal / lateral jitter module to perform dual dynamic perturbation on the model embedding and the Transformer representation layer, and generates an initial encrypted model.

[0115] The two-stage precision recovery SFT training phase in step S2 includes perceptual recovery training and functional recovery training. Perceptual recovery training adapts the model to the new cryptographic representation space, establishing a stable mapping between the key and the representation layer. Functional recovery training restores the model's business capabilities, such as inference, generation, and dialogue, achieving near-perfect accuracy through iterative training. The core effect of the two-stage precision recovery SFT training is that it supports "trading time for accuracy"—the more training rounds, the better the accuracy recovery, with no irreversible accuracy loss.

[0116] Step S3, also known as the cloud-based encrypted privacy fine-tuning process, specifically includes: (1) Client preprocessing: converting the fine-tuning data (Prompt / Target) into the original token sequence; (2) Client encryption: performing horizontal adaptive jitter based on the key to generate an encrypted token sequence; (3) Cloud-based encrypted training: loading the key-bound privacy model in the cloud, processing only the encrypted token, calculating the loss and updating the weights; (4) Model output: generating an encrypted privacy model, which cannot parse the input and output semantics without the key.

[0117] Step S4 is also known as the cloud-based encrypted privacy inference process, which specifically includes: (1) Client encryption: convert the inference request into a token and adaptively jitter-encrypt it, and send it to the cloud; (2) Cloud encrypted inference: the privacy model processes the encryption request and returns the encrypted result token; (3) Client decryption: use the corresponding key to decrypt and restore the plaintext output; (4) Security features: the plaintext does not leave the client throughout the process, and the cloud can only see the encrypted data and cannot obtain the business semantics.

[0118] In a specific embodiment, during the model inference stage in step S4, the original model input is: "What is the capital of China?", and the resulting original token is: [3922, 3823, 9208, 36495, 2498]. Based on the technical solution of this application, client-side encryption is performed, and the resulting encrypted token is: [7283, 1922, 1283, 4192, 39718]. Then, cloud-based encrypted inference is performed, returning the encrypted result token. Finally, the token is decrypted on the client side, and the output text content is "The capital of China is Beijing".

[0119] The cloud-based privacy fine-tuning and inference method for large models based on adaptive jitter technology proposed in this application has the following advantages:

[0120] 1. Comprehensive privacy protection: (1) Model data: Input and output are both encrypted data, and semantic information cannot be obtained in the cloud; (2) Model memory: Exclusive encrypted model, which can only be accessed by users holding the key; (3) Tenant isolation: Different tenants hold independent keys, completely isolating the risk of cross-tenant access.

[0121] 2. Extreme performance: No homomorphic encryption or other heavy computation operations are required. Fine-tuning and inference efficiency are completely consistent with the original model, with no additional latency, meeting the real-time requirements of the power industry.

[0122] 3. Strong compatibility and ease of use: (1) Supports all mainstream open source large models such as Llama, Deepseek, and Qwen; (2) No need to reconstruct the original structure of the model, and can be directly connected to existing large model applications; (3) Supports GPU and distributed computing, and is compatible with public cloud, private cloud and hybrid cloud deployment.

[0123] 4. Controllable and recoverable accuracy: Through phased adaptive recovery training, the accuracy loss can be iteratively approximated to the original model, supporting flexible configuration of "trading time for accuracy".

[0124] 5. Low deployment cost: No need to modify cloud infrastructure or collaborate with multiple parties on data; only a lightweight encryption / decryption module needs to be deployed on the client side to achieve full-process privacy protection.

[0125] The key technical points of the large model cloud privacy fine-tuning and inference method based on adaptive jitter technology in this application are as follows: (1) A large model adaptive jitter method is proposed, which adopts progressive unidirectional irreversible vertical + horizontal joint perturbation to realize key-jitter operator dynamic mapping and representation space reconstruction. (2) A large model two-stage precision recovery training method is proposed, including perceptual recovery SFT and functional recovery SFT, and the accuracy of the encrypted model is made close to the original model through iterative training. (3) A large model cloud-based encrypted fine-tuning + inference full-process method is proposed, in which the client completes data encryption and result decryption, and the cloud only processes the encrypted token, and the plaintext does not leave the trusted domain throughout the process. (4) A multi-tenant isolated large model privacy protection method is proposed, in which different tenants use independent keys to form mutually isolated encrypted representation spaces.

[0126] It should be noted that any technical feature in any of the above embodiments provided in this application is also applicable to any of the following embodiments provided in this application; the technical features in the relevant embodiments of the various methods provided in this application are also applicable to the relevant embodiments of the various devices, systems or equipment provided in this application; the same, related or corresponding technical features in the various embodiments provided in this application can be referenced and explained to each other, and similarities will not be repeated.

[0127] Figure 2 Here is a structural block diagram of the system in one embodiment, with reference to Figure 2 The large-model cloud-based privacy fine-tuning and inference system based on adaptive jitter technology includes:

[0128] The key generation module 201 is used to generate dither keys in different directions and construct a dynamic mapping relationship between dither keys and dither operators.

[0129] The model encryption and adaptive recovery module 202 is used to implant the jitter key into the model representation layer of the large-scale language model to be trained based on the dynamic mapping relationship, perform dual adaptive jitter processing on the large-scale language model to generate an initial encrypted model, and perform training recovery processing on the initial encrypted model based on a two-stage supervised fine-tuning technique to obtain the recovered encrypted model.

[0130] The encrypted privacy fine-tuning module 203 is used to acquire fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data, and fine-tune the recovered encrypted model according to the encrypted data to obtain the encrypted privacy model.

[0131] The encrypted privacy inference module 204 is used to obtain inference request data, encrypt the inference request data according to the jitter key to obtain encrypted request data, input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain encrypted inference results, and decrypt the encrypted inference results according to the jitter key to output the target inference result associated with the inference request data.

[0132] In this embodiment of the application, based on, as follows Figure 2 The connections between the various modules or units shown in the diagram ensure the accuracy of the large model in privacy protection scenarios, and improve the security of data and the accuracy of inference through the cooperation between these modules or units.

[0133] The following section describes the system composition and technical principles of a large-scale model cloud-based privacy fine-tuning and inference system based on adaptive jitter technology from the perspective of other technical descriptions. The system comprises a client and a cloud, connected via a communication network. The system implementation process includes:

[0134] The client generates jitter keys in different directions, and constructs a dynamic mapping relationship between the jitter keys and jitter operators.

[0135] Based on a dynamic mapping relationship, the client implants the jitter key into the model representation layer of the large-scale language model to be trained, performs dual adaptive jitter processing on the large-scale language model, and generates an initial encrypted model. Based on a two-stage supervised fine-tuning technique, the initial encrypted model is trained and restored to obtain the restored encrypted model.

[0136] The client obtains the fine-tuning data and encrypts it using the jitter key to obtain the encrypted data.

[0137] The client will upload the restored encrypted model and encrypted data to the cloud.

[0138] The cloud platform fine-tunes the recovered encrypted model based on the encrypted data to obtain an encrypted privacy model.

[0139] The client obtains the inference request data and encrypts it using the jitter key to obtain the encrypted request data.

[0140] The client uploads the encrypted request data to the cloud.

[0141] The cloud inputs the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain the encrypted inference result.

[0142] The cloud sends the dense state inference results to the client.

[0143] The client decrypts the encrypted inference result using the jitter key and outputs the result to obtain the target inference result associated with the inference request data.

[0144] In another embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, it includes a processor, memory, input / output interfaces, and a communication interface. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface is connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores relevant data. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. The computer program can be executed by the processor to implement the various methods described in the above embodiments.

[0145] In yet another embodiment, a computer device is provided, such as a terminal, whose internal structure diagram may be as follows: Figure 4 As shown, it includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. The computer program can be executed by the processor to implement the various methods described in the above embodiments.

[0146] Those skilled in the art will understand that Figure 3 and Figure 4 The structure shown is only a block diagram of a part of the structure related to the present application and does not constitute a limitation on the computer device on which the present application is applied. It may also include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements, in order to realize the function of the computer device.

[0147] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0148] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the systems, devices, equipment, modules or units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, devices, or methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0150] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0151] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0152] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0153] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium, or a semiconductor medium (e.g., a solid-state drive), etc.

[0154] The technical solutions provided by the embodiments of this application have been described in detail above. Specific examples have been used in the embodiments of this application to illustrate the principles and implementation methods of the embodiments of this application. The description of the above embodiments is only for the purpose of helping to understand the methods and core ideas of the embodiments of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments of this application. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this application.

Claims

1. A method for privacy fine-tuning and inference of large models in the cloud based on adaptive jitter technology, characterized in that, The method includes: Dithering keys in different directions are generated, and a dynamic mapping relationship between the dithering keys and dithering operators is constructed. Based on the dynamic mapping relationship, the jitter key is implanted into the model representation layer of the large-scale language model to be trained, and dual adaptive jitter processing is performed on the large-scale language model to generate an initial encryption model; the initial encryption model is trained and restored based on a two-stage supervised fine-tuning technique to obtain the restored encryption model. Acquire fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data; fine-tune the recovered encrypted model according to the encrypted data to obtain an encrypted privacy model; Obtain inference request data; encrypt the inference request data using the jitter key to obtain encrypted request data; input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain encrypted inference results; decrypt the encrypted inference results using the jitter key and output them to obtain the target inference result associated with the inference request data.

2. The method according to claim 1, characterized in that, The generation of dither keys in different directions includes: Generate horizontal jitter keys and vertical jitter keys; The jitter keys for different directions are obtained based on the horizontal jitter key and the vertical jitter key.

3. The method according to claim 1, characterized in that, The process of embedding the dithering key into the model representation layer of the large-scale language model to be trained based on the dynamic mapping relationship, performing dual adaptive dithering processing on the large-scale language model, and generating an initial encryption model includes: Dynamic noise transformation is applied to the word vector values ​​output by the representation layer of the large-scale language model based on the lateral dithering key; Based on the vertical dithering key, the word vectors output by the model representation layer in the large-scale language model are dynamically permuted and rearranged column by column.

4. The method according to claim 1, characterized in that, The two-stage supervised fine-tuning technique is used to train and restore the initial encryption model to obtain the restored encryption model, including: The initial encryption model is trained using perceptual recovery to adapt to the new encryption representation space, and a stable mapping between the key and the representation layer is established to obtain the encryption model after perceptual recovery. The encrypted model after perception recovery is trained to restore its business capabilities. Through iterative training, the accuracy of the model is made close to that of the original model, thus obtaining the encrypted model after recovery.

5. The method according to claim 1, characterized in that, The process of acquiring fine-tuning data and encrypting the fine-tuning data using the dithering key to obtain encrypted data includes: The fine-tuned data is preprocessed to convert it into an original word sequence; Based on the dithering key, perform lateral adaptive dithering on the original lexical sequence to generate an encrypted lexical sequence; The encrypted token sequence is used as the encrypted state data.

6. The method according to claim 1, characterized in that, The process of obtaining inference request data, and encrypting the inference request data using the dithering key to obtain encrypted request data, includes: The inference request data is preprocessed and converted into an inference word sequence; The inference lexical sequence is adaptively jittered and encrypted using the jitter key to obtain the encrypted request data.

7. The method according to claim 1, characterized in that, The process of obtaining inference request data, and encrypting the inference request data using the dithering key to obtain encrypted request data, includes: Identify the user identifier of the request initiating user associated with the inference request data; Based on the user identifier of the user initiating the request, assign the jitter key held independently by the tenant to the user initiating the request; The inference request data is encrypted using the jitter key held independently by the tenant to obtain the encrypted request data.

8. A large-model cloud-based privacy fine-tuning and inference system based on adaptive jitter technology, characterized in that, The system includes: The key generation module is used to generate dither keys in different directions and construct a dynamic mapping relationship between the dither keys and dither operators. The model encryption and adaptive recovery module is used to implant the jitter key into the model representation layer of the large-scale language model to be trained based on the dynamic mapping relationship, perform dual adaptive jitter processing on the large-scale language model to generate an initial encrypted model, and perform training recovery processing on the initial encrypted model based on a two-stage supervised fine-tuning technique to obtain a recovered encrypted model. The encrypted privacy fine-tuning module is used to acquire fine-tuning data, encrypt the fine-tuning data according to the jitter key to obtain encrypted data, and fine-tune the recovered encrypted model according to the encrypted data to obtain an encrypted privacy model. The encrypted privacy inference module is used to acquire inference request data, encrypt the inference request data according to the jitter key to obtain encrypted request data; input the encrypted request data into the encrypted privacy model to perform cloud-based encrypted inference to obtain encrypted inference results; decrypt the encrypted inference results according to the jitter key and output them to obtain the target inference result associated with the inference request data.

9. A computer device, characterized in that, The computer device includes: At least one processor and memory; The memory is used to store program code, and the processor is used to call the program code stored in the memory to execute the method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, It includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images