A privacy large model training method and system

Abstract

The application discloses a privacy large model training method and system, and belongs to the technical field of language processing and artificial intelligence. The method comprises the following steps: acquiring a natural language instruction, performing multi-level semantic analysis on the natural language instruction by using a large language model to obtain a structured semantic representation; decomposing a task into a plurality of atomic semantic units according to the structured semantic representation, and generating an initial semantic arrangement topology graph; matching a target execution component from a preset skill library, and generating an executable semantic arrangement workflow; performing semantic consistency verification on the workflow, and inserting a semantic adaptation node between nodes with a semantic alignment degree lower than a threshold value; executing the workflow in a topological order, and outputting an execution result after semantic merging; and acquiring feedback information and dynamically optimizing the workflow according to the feedback information. The system comprises a semantic analysis module, a task decomposition module, a component matching module, a semantic verification module, an arrangement execution module and a feedback optimization module.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and privacy protection technology, specifically to a method and system for training a privacy-preserving large model. Background Technology

[0002] In recent years, Large Language Models (LLMs) based on the Transformer architecture have made groundbreaking progress in fields such as natural language processing, computer vision, and intelligent dialogue. The powerful capabilities of LLMs rely on massive amounts of training data, which often contain a large amount of user privacy information, such as personal identification information, financial data, health records, and biometrics. During model training, this privacy information is implicitly encoded in the model parameters. Attackers can use techniques such as member inference attacks, attribute inference attacks, and model inversion attacks to reverse-engineer and extract this privacy information from the training data.

[0003] To address the privacy leakage problem during large model training, existing technologies have proposed the following main types of solutions: The existing technology has the following shortcomings: First, existing solutions are mostly single-stage privacy protection measures, lacking a full-process privacy protection framework covering data preprocessing, model training, model evaluation, and model postprocessing.

[0004] Second, existing differential privacy training schemes lack a refined adaptive mechanism for controlling noise intensity, which significantly impairs model performance.

[0005] Third, existing solutions lack a systematic assessment mechanism for the risk of privacy leakage of models after training, and cannot quantify the privacy and security level of the models.

[0006] Fourth, in existing solutions, privacy erasure and training processes are independent of each other, lacking an iterative optimization closed loop of training-evaluation-erasure.

[0007] To address the aforementioned issues, a privacy-preserving large-scale model training method and system are proposed. Summary of the Invention

[0008] To address the shortcomings of existing solutions, such as the lack of a comprehensive privacy protection framework covering data preprocessing, model training, model evaluation, and post-processing, resulting in isolated privacy protection measures at each stage; the lack of refined adaptive noise control mechanisms in existing differential privacy training, which significantly degrades model performance; the lack of a systematic quantitative assessment mechanism for the risk of privacy leakage after training; and the independent nature of privacy erasure and training processes in existing solutions, lacking an iterative optimization loop, this application provides a method and system for training large privacy-preserving models. To achieve the above objectives, this invention provides the following technical solution: A method for training a privacy-preserving large model includes the following steps: Step S1: Privacy Risk Assessment and Data Classification Stage.

[0009] Obtain the original training dataset, perform a privacy risk assessment on the original training dataset, and identify a subset of privacy data containing sensitive attributes and a subset of non-privacy data.

[0010] Specifically, firstly, sensitive information detection is performed on each data sample in the original training dataset. The personal identity information (name, ID number, phone number, address, etc.), financial information (bank account, transaction records, etc.), health information (medical records, diagnosis results, etc.) and biometric information (fingerprint, facial features, etc.) contained in the data samples are identified by a pre-set sensitive information identification model (such as a hybrid model based on named entity recognition and regular expression matching).

[0011] Then, based on the type, quantity, and sensitivity of the detected sensitive information, a privacy sensitivity score is calculated for each data sample. Different types of sensitive information have different weighting coefficients; for example, biometric information has the highest weight, followed by personally identifiable information, and general behavioral information has a lower weight.

[0012] Data samples with a privacy sensitivity score exceeding a first threshold are classified as the privacy data subset, while data samples with a privacy sensitivity score lower than or equal to the first threshold are classified as the non-privacy data subset.

[0013] Furthermore, the data samples in the privacy data subset are classified according to privacy sensitivity scores into three categories: Category I sensitive data (extremely high sensitivity, such as biometrics and medical records), Category II sensitive data (high sensitivity, such as financial information and identity information), and Category III sensitive data (moderate sensitivity, such as location information and behavioral preferences).

[0014] Step S2: Multi-layered privacy-preserving data processing stage.

[0015] For the aforementioned subset of privacy data, a multi-layered privacy protection strategy is adopted for data processing: a secure multi-party computation protocol is applied to the first type of sensitive data to complete encrypted feature extraction and output plaintext feature data; a localized differential privacy mechanism is applied to the second type of sensitive data for perturbation processing; anonymization processing is applied to the third type of sensitive data; and all the processed data are aggregated to obtain the privacy-protected training dataset.

[0016] The localized differential privacy perturbation processing for the second type of sensitive data specifically includes: constructing a noise distribution function with fixed upper and lower bounds based on Lagrange interpolation and Fourier series methods; determining the parameters of the noise distribution function according to the numerical range of the second type of sensitive data and the privacy protection strength requirements; sampling noise values ​​from the noise distribution function to add noise perturbation to the second type of sensitive data, generating perturbed second type of sensitive data; performing data quality verification on the perturbed second type of sensitive data, and when the data quality is lower than a second threshold, adjusting the parameters of the noise distribution function and re-perturbing the data.

[0017] The advantage of localized differential privacy lies in the fact that the data is perturbed before leaving the user's terminal, ensuring that the original data is not exposed to any third party, including the model trainer. The noise distribution function constructed using Lagrange interpolation and Fourier series methods can better fit the distribution characteristics of different types of data, maximizing data utility while ensuring privacy.

[0018] The anonymization process for the second type of sensitive data specifically includes: using the k-anonymization method to generalize the data, ensuring that each record is indistinguishable from at least k-1 other records in terms of quasi-identifier attributes; for high-dimensional data, using the l-diversity method to ensure that the sensitive attributes in each equivalence class have sufficient diversity; and for scenarios that need to preserve the data distribution characteristics, using the differential privacy synthetic data generation method to generate synthetic data that is similar to the original data distribution but does not contain real privacy information.

[0019] The secure multi-party computation encryption processing for the first type of sensitive data specifically includes: distributing the data to multiple computing nodes, with each node holding only one fragment of the data; using a secret sharing protocol to encrypt the data fragments, ensuring that no single node can recover the complete data; and completing the initial training of the model or feature extraction in an encrypted state, with each node cooperating in computation but not leaking the original data to each other.

[0020] Step S3: Differential privacy pre-training phase.

[0021] Based on the privacy-preserving training dataset, the initial large language model is subjected to differential privacy pre-training in the first stage. During the pre-training process, an adaptive noise scheduling strategy is adopted to dynamically adjust the injected noise intensity according to the gradient norm and parameter sensitivity of the current training round, thereby obtaining the pre-trained model.

[0022] Specifically, in the current training epoch, the gradient norm of the parameter to be updated is calculated, and the basic noise intensity is determined based on the gradient norm. The larger the gradient norm, the greater the update magnitude of the parameter on the current batch of data, which may carry more data information, and therefore requires stronger noise protection.

[0023] The parameter sensitivity evaluation method calculates the sensitivity of each training parameter to the model output, generating a parameter sensitivity mapping. The core idea of ​​parameter sensitivity evaluation is that some parameters have a decisive influence on the model output, and excessive perturbation of these parameters will significantly impair model performance; while other parameters have a smaller influence and can be subject to stronger noise.

[0024] The training parameters are divided into a high-sensitivity subset and a low-sensitivity subset based on the parameter sensitivity mapping. A first noise intensity (smaller noise) is applied to the parameters in the high-sensitivity subset, and a second noise intensity (larger noise) is applied to the parameters in the low-sensitivity subset, wherein the first noise intensity is less than the second noise intensity.

[0025] A high-order privacy budget estimation method is used to perform high-order expansion and approximate estimation of the privacy loss in the current training round, and the intensity of the first noise and the intensity of the second noise are dynamically adjusted to ensure that the overall training process meets the differential privacy constraint. Specifically, a high-order moment accountants method is used to accurately track the privacy loss, ensuring that the total privacy budget of the entire training process does not exceed the preset upper bound of (ε,δ).

[0026] By employing the aforementioned differentiated noise addition strategy, this invention can significantly reduce the interference of noise on key parameters and improve the final performance of the model while ensuring strong privacy protection.

[0027] Step S4: Non-privacy knowledge enhancement training phase.

[0028] The pre-trained model is subjected to a second stage of non-privacy knowledge enhancement training based on the non-privacy data subset. During the knowledge enhancement training process, the knowledge learned by the pre-trained model on privacy data is transferred to the privacy-preserving representation space through knowledge distillation to obtain the enhanced privacy-preserving large model.

[0029] Specifically, the pre-trained model is used as the teacher model to construct a student model with the same structure. The non-privacy data subset is input into the teacher model and the student model respectively to obtain the first soft labels output by the teacher model and the second soft labels output by the student model.

[0030] Calculate the distillation loss (e.g., KL divergence) between the first soft label and the second soft label, and the task loss (e.g., cross-entropy loss) between the student model output and the real label.

[0031] The student model is updated with parameters based on a weighted sum of the distillation loss and the task loss: L_total=α·L_distill+(1-α)·L_task Where α is the weighting coefficient of distillation loss, L_distill is the distillation loss, and L_task is the task loss.

[0032] Repeat the above process until the student model converges, and use the converged student model as the enhanced privacy big model.

[0033] The core advantage of knowledge distillation lies in the fact that the knowledge learned by the teacher model on private data is passed to the student model in the form of soft labels. The student model, in turn, is trained only on non-private data, thus indirectly acquiring valuable knowledge patterns from private data without needing direct access to it. This approach achieves a balance between privacy protection and knowledge transfer.

[0034] Step S5: Privacy Breach Risk Assessment Phase.

[0035] A privacy breach risk assessment is conducted on the aforementioned privacy model. The security of the privacy model is tested by simulating various privacy attack methods, and a privacy breach risk score for the privacy model is calculated.

[0036] Specifically, a membership inference attack test set is constructed, and membership inference attacks are performed on the privacy-preserving large model using this test set. The success rate of the membership inference attacks is then calculated. Membership inference attacks aim to determine whether a specific data sample belongs to the model's training set. A higher success rate indicates a stronger memory of the training data by the model, and a greater risk of privacy leakage.

[0037] An attribute inference attack test set is constructed, and attribute inference attacks are performed on the privacy-preserving large model using this test set. The success rate of the attribute inference attacks is calculated. Attribute inference attacks aim to infer sensitive attributes of an individual in the training data from the model output. The higher the attack success rate, the greater the risk of privacy leakage.

[0038] A model inversion attack test set is constructed. The privacy-preserving large model is then subjected to a model inversion attack using this test set, and the reconstruction error of the attack is calculated. The model inversion attack aims to reconstruct training data samples from model parameters or output. A smaller reconstruction error indicates a more accurate memory of the training data by the model, but also a greater risk of privacy leakage.

[0039] The privacy leakage risk score is calculated by weighting the success rate of the member inference attack (P_mia), the success rate of the attribute inference attack (P_pia), and the reconstruction error of the model inversion attack (E_inv): R_score=w1·P_mia+w2·P_pia+w3·(1-E_inv) Where w1, w2, and w3 are the weight coefficients of each attack method, satisfying w1+w2+w3=1.

[0040] Step S6: Privacy erasure and iterative optimization phase.

[0041] When the privacy leakage risk score is lower than the preset security threshold, the privacy big model is output as the final training result; when the privacy leakage risk score is higher than or equal to the preset security threshold, a privacy erasure operation is performed on the privacy big model. By training the privacy erasure model, the weight parameters related to privacy data in the privacy big model are erased in a targeted manner to obtain the erased privacy big model, and the process returns to step S5 to re-evaluate the privacy leakage risk.

[0042] The specific implementation method for privacy erasure is as follows: Obtain the privacy-preserving large model to be erased, obtain the first training sample set containing privacy data, and anonymize the privacy data in the first training sample set to obtain the second training sample set.

[0043] Using the exact same training method, the privacy-preserving large model is trained on the first training sample set and the second training sample set respectively, and the first weight data of the privacy-preserving large model on the first training sample set and the second weight data on the second training sample set are recorded.

[0044] The privacy erasure model is trained using the structure description text of the privacy-preserving large model and the first weight data as training samples, and the second weight data as labels. The training process uses mean squared error as the loss function. Independent erasure sub-models are trained for the embedding layer, attention layer, and feedforward network layer of the Transformer architecture. Each sub-model only processes the weight parameters of its corresponding layer. By learning the mapping relationship from "containing privacy weights" to "removing privacy weights," the privacy erasure model learns how to identify and eliminate weight components related to privacy data from the model parameters.

[0045] The current weight data of the privacy model to be erased is input into the privacy erasure model, and the privacy erasure model outputs the erased weight data. The weight components related to the privacy data in the erased weight data are eliminated in a targeted manner.

[0046] Through the aforementioned iterative optimization closed loop of "evaluation-erasure-re-evaluation", this invention ensures that the final output privacy model meets the preset standards in terms of privacy and security.

[0047] A privacy-preserving large model training system includes: The privacy risk assessment module is used to obtain the original training dataset, perform a privacy risk assessment on the original training dataset, and identify a subset of privacy data containing sensitive attributes and a subset of non-privacy data.

[0048] The privacy risk assessment module includes: a sensitive information detection unit, used to identify personal identity information, financial information, health information, and biometric information contained in data samples through a pre-set sensitive information identification model; a privacy sensitivity calculation unit, used to calculate the privacy sensitivity score of each data sample based on the type, quantity, and sensitivity of the detected sensitive information; a data classification unit, used to classify data samples with privacy sensitivity scores exceeding a first threshold into the privacy data subset; and a data grading unit, used to grade the data samples in the privacy data subset according to their privacy sensitivity scores.

[0049] The privacy data processing module, connected to the privacy risk assessment module, is used to process the privacy data subset using a multi-level privacy protection strategy. The multi-level privacy protection strategy includes localized differential privacy perturbation processing, anonymization processing, and secure multi-party computation encryption processing to obtain a privacy-protected training dataset.

[0050] The differential privacy pre-training module, connected to the privacy data processing module, is used to perform the first stage of differential privacy pre-training on the initial large language model based on the privacy-protected training dataset. During the pre-training process, an adaptive noise scheduling strategy is used to dynamically adjust the injected noise intensity to obtain the pre-trained model.

[0051] The differential privacy pre-training module includes: a gradient norm calculation unit, used to calculate the gradient norm of the parameters to be updated in the current training round; a parameter sensitivity evaluation unit, used to calculate the sensitivity of each training parameter to the model output using a parameter sensitivity evaluation method, and generate a parameter sensitivity mapping map; a differential noise addition unit, used to divide the training parameters into a high-sensitivity parameter subset and a low-sensitivity parameter subset according to the parameter sensitivity mapping map, apply a first noise intensity to the high-sensitivity parameter subset, and apply a second noise intensity to the low-sensitivity parameter subset; and a privacy budget control unit, used to estimate the privacy loss of the current training round using a high-order privacy budget estimation method, and dynamically adjust the noise intensity to ensure that the overall training process meets the differential privacy constraints.

[0052] The knowledge enhancement module, connected to the differential privacy pre-training module, is used to perform a second stage of non-privacy knowledge enhancement training on the pre-trained model based on the non-privacy data subset. The knowledge learned by the pre-trained model on privacy data is transferred to the privacy-preserving representation space through knowledge distillation to obtain the enhanced privacy-preserving large model.

[0053] The privacy and security assessment module, connected to the knowledge enhancement module, is used to assess the privacy leakage risk of the privacy model, conduct security tests on the privacy model by simulating various privacy attack methods, and calculate the privacy leakage risk score of the privacy model.

[0054] The privacy erasure module, connected to the privacy security assessment module, is used to perform a privacy erasure operation on the privacy big model when the privacy leakage risk score is higher than or equal to a preset security threshold. The privacy erasure module is trained to perform targeted erasure of the weight parameters related to privacy data in the privacy big model, thereby obtaining the erased privacy big model.

[0055] The privacy erasure module includes: a sample set construction unit, used to acquire a first training sample set containing privacy data, and anonymize the privacy data in the first training sample set to obtain a second training sample set; a weight recording unit, used to train the privacy big model based on the first training sample set and the second training sample set respectively, and record the first weight data of the privacy big model on the first training sample set and the second weight data on the second training sample set; an erasure model training unit, used to train the privacy erasure model using the structural description text of the privacy big model and the first weight data as training samples, and the second weight data as labels; and an erasure execution unit, used to input the current weight data of the privacy big model to be erased into the privacy erasure model, and obtain the erased weight data. Compared with the prior art, the present invention has the following advantages: 1. This invention constructs a privacy protection framework covering the entire process of large-scale model training, from data preprocessing to model training, model evaluation, and model postprocessing. The privacy protection measures at each stage are coordinated and complementary, forming a complete privacy protection chain from data input to model output.

[0056] 2. This invention introduces a differentiated noise addition strategy based on parameter correlation assessment in differential privacy training; by applying smaller noise to highly correlated parameters and larger noise to low-correlation parameters, the damage of noise to model performance is minimized while ensuring the strength of privacy protection; at the same time, precise control of privacy loss is achieved through a high-order privacy budget estimation method.

[0057] 3. This invention conducts comprehensive security tests on the trained model by simulating various privacy attack methods (member inference attack, attribute inference attack, and model inversion attack), and provides a quantitative privacy leakage risk score, which makes the privacy security level of the model measurable, comparable, and traceable. Attached Figure Description

[0058] Figure 1This is a schematic diagram of the overall process of the privacy-preserving large model training method of the present invention.

[0059] Figure 2 This is a block diagram of the module structure of the privacy-preserving large model training system of the present invention.

[0060] Figure 3 This is a schematic diagram of the privacy risk assessment and data classification process in this invention.

[0061] Figure 4 This is a schematic diagram of the adaptive differential privacy pre-training process in this invention.

[0062] Figure 5 This is a schematic diagram of the privacy leakage risk assessment and iterative erasure optimization process in this invention. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0064] Example 1: Specific Implementation Methods for Privacy Risk Assessment and Data Classification In this embodiment, the specific implementation of privacy risk assessment and data classification in step S1 is described in detail.

[0065] Suppose the original training dataset is a large language model training corpus from a medical institution, containing 1 million medical dialogue records and medical record texts.

[0066] First, sensitive information detection is performed on each data sample in the original training dataset. A sensitive information recognition model based on Named Entity Recognition (NER) is used to identify personal identity information (such as patient name, ID number, contact information), health information (such as diagnosis results, medication records, surgical history), and biometric information (such as gene sequence, fingerprint features) in the data samples.

[0067] Then, based on the type, quantity, and sensitivity of the detected sensitive information, a privacy sensitivity score is calculated for each data sample. The privacy sensitivity scoring system is set as follows: biometric information has a weight of 0.5, health information has a weight of 0.3, and personal identification information has a weight of 0.2. For a sample containing "Patient Zhang San, ID number 3201****1234, diagnosed with type II diabetes, taking metformin", its privacy sensitivity score is: 0.2 (identity information) + 0.3 (health information) = 0.5.

[0068] If the first threshold is set to 0.3, then data samples with a privacy sensitivity score greater than 0.3 are classified as privacy data subsets, and those with a score less than or equal to 0.3 are classified as non-privacy data subsets.

[0069] Furthermore, the data samples in the privacy data subset are classified into three categories: those with a privacy sensitivity score ≥ 0.7 are classified as Category I sensitive data (such as samples containing gene sequences), those with a score of 0.5 ≤ score < 0.7 are classified as Category II sensitive data (such as samples containing detailed medical records), and those with a score of 0.3 ≤ score < 0.5 are classified as Category III sensitive data (such as samples containing general medical records).

[0070] Example 2: Specific Implementation of Multi-layered Privacy-Preserving Data Processing In this embodiment, the specific implementation of the multi-layered privacy protection data processing in step S2 is described in detail.

[0071] For the first type of sensitive data (such as gene sequence data), a secure multi-party computation protocol is applied to complete encrypted feature extraction. A secret sharing protocol is used to distribute the data to three computing nodes, with each node holding only one fragment of the data. Preliminary feature extraction and statistical calculations are performed in an encrypted state. Each node collaborates on the calculations but does not disclose the original data to the others, and finally outputs usable plaintext feature data.

[0072] For the second type of sensitive data (such as medical record data), a localized differential privacy mechanism is applied for perturbation processing. A noise distribution function with fixed upper and lower bounds is constructed based on Lagrange interpolation and Fourier series methods. It is assumed that the range of values ​​for the structured numerical data of medical records is [0, 1000], and the privacy protection strength requirement is ε = 0.5. Noise values ​​are sampled from the constructed noise distribution function, and the original data is perturbed element-by-element with added noise. After perturbation, data quality is verified to ensure that the perturbed data still retains the original statistical distribution characteristics.

[0073] For the third category of sensitive data (such as medical records), anonymization is employed. The k-anonymization method is used, with k=20, to generalize quasi-identifiers (such as age, gender, and place of residence) in the medical records, ensuring that each record is indistinguishable from at least 19 other records in terms of the quasi-identifier attribute. For sensitive attributes (such as the department visited), the l-diversity method is used to ensure that each equivalence class contains at least l different sensitive attribute values, with l=5.

[0074] Example 3: Detailed Implementation of Adaptive Differential Privacy Pre-training In this embodiment, the specific implementation of the adaptive differential privacy pre-training in step S3 is described in detail.

[0075] Assume the initial large language model is a 7 billion parameter model based on the Transformer architecture, and the training dataset is privacy-preserving medical dialogue data.

[0076] In the current training epoch t, ​​the gradient norm ||g||2 of the parameter to be updated is first calculated. The base noise intensity σ_base=C·||g||2 is determined based on the gradient norm, where C is a preset scaling factor.

[0077] The sensitivity of each training parameter to the model output is calculated using a parameter sensitivity evaluation method, generating a parameter sensitivity mapping relationship. Specifically, for each parameter θ_i, the correlation coefficient ρ_i between its gradient g_i and the change ΔL in the model output is calculated: ρ_i=Cov(g_i,ΔL) / (σ(g_i)·σ(ΔL)) Based on the correlation coefficient, the parameters are divided into a subset of high-sensitivity parameters (ρ_i>0.7) and a subset of low-sensitivity parameters (ρ_i≤0.7).

[0078] A first noise intensity σ_high = 0.5·σ_base is applied to the high-sensitivity parameter subset, and a second noise intensity σ_low = 2.0·σ_base is applied to the low-sensitivity parameter subset.

[0079] The higher-order moment accountants method is used to perform a higher-order expansion and approximate estimation of the privacy loss in the current training epoch. Assuming the total privacy budget is (ε=3, δ=1e-5), the values ​​of σ_high and σ_low are dynamically adjusted by tracking the cumulative privacy loss in each epoch to ensure that the overall privacy loss during the entire training process does not exceed the preset upper bound.

[0080] By employing the aforementioned differentiated noise addition strategy, this invention can significantly reduce the impact of noise introduction on model performance.

[0081] Example 4: Specific Implementation Methods for Privacy Leakage Risk Assessment In this embodiment, the specific implementation method of privacy leakage risk assessment in step S5 is described in detail.

[0082] If the trained privacy model is a dialogue model for the medical field, its privacy and security need to be fully evaluated.

[0083] Construct a membership inference attack test set. Randomly select 1000 samples from the original training data as positive samples (training set members), and select 1000 similar samples from external public data as negative samples (non-training set members). Input the test samples into the model and obtain the confidence score of the model's output. Set a confidence threshold; when the model's output confidence score for a sample exceeds the threshold, it is determined to be a training set member. Calculate the success rate P_mia of the membership inference attack.

[0084] Construct a test set for attribute inference attacks. Select samples from the training data that are labeled with sensitive attributes (such as samples labeled "whether or not one has diabetes"), construct an attribute inference attack model, and attempt to infer the values ​​of sensitive attributes from the output of the target model. Calculate the success rate P_pia of the attribute inference attack.

[0085] Construct a model inversion attack test set. Select intermediate representations or outputs of a subset of training samples and attempt to reconstruct the original input data using optimization methods. Calculate the mean squared error between the reconstructed image / text and the original data as the reconstruction error E_inv.

[0086] Set weighting coefficients w1=0.3, w2=0.3, w3=0.4, and calculate the privacy breach risk score: R_score=0.3·P_mia+0.3·P_pia+0.4·(1-E_inv) Assuming the calculated R_score is 0.28 and the preset security threshold is 0.30, then if R_score < 0.30, the privacy security assessment passes and the model can be directly output. If R_score ≥ 0.30, then a privacy erasure operation needs to be performed.

[0087] Example 5: Specific Implementation Methods for Privacy Erasure and Iterative Optimization In this embodiment, the specific implementation of privacy erasure and iterative optimization in step S6 is described in detail.

[0088] If the privacy breach risk assessment result shows R_score=0.45, which is higher than the preset security threshold of 0.30, a privacy erasure operation needs to be performed on the model.

[0089] Obtain the privacy-preserving large model to be erased (denoted as model M), obtain the first training sample set D1 containing privacy data, and anonymize the privacy data in D1 to obtain the second training sample set D2.

[0090] Model M was trained using the exact same training method and configuration, based on D1 and D2 respectively. The first weight data W1 after training on D1 and the second weight data W2 after training on D2 were recorded. The difference between W1 and W2, ΔW = W1 - W2, reflects the weight components in the model parameters related to privacy data.

[0091] Using the structural description text of model M and W1 as training samples, and W2 as the label, the privacy erasure model Erasor is trained. Mean squared error is used as the loss function during training, and corresponding erasure sub-models are trained at each model level. By learning the mapping relationship from W1 to W2, the privacy erasure model Erasor learns how to identify and eliminate privacy-related components in the model parameters.

[0092] The current weight data W_current of the model M to be erased is input into the privacy erasure model Erasor. Erasor outputs the erased weight data W_erased = Erasor(W_current). The weight components related to privacy data in the erased weight data are selectively removed.

[0093] Return the erased model to step S5 and reassess the privacy risk. If the assessment passes, output the model; otherwise, continue the erasure process until the security requirements are met.

[0094] Through the aforementioned iterative optimization closed loop of "evaluation-erasure-re-evaluation", this invention ensures that the final output privacy model meets the preset privacy and security standards.

Claims

1. A method for training a privacy-preserving large model, characterized in that, Includes the following steps: Step S1: Obtain the original training dataset, perform a privacy risk assessment on the original training dataset, and identify the privacy data subset containing sensitive attributes and the non-privacy data subset; divide the privacy data subset into three categories of sensitive data, namely, Category 1, Category 2, and Category 3, according to the privacy sensitivity from high to low, wherein Category 1 is extremely sensitive data, Category 2 is highly sensitive data, and Category 3 is moderately sensitive data. Step S2: For the subset of privacy data, a multi-layered privacy protection strategy is adopted for data processing: a secure multi-party computation protocol is applied to the first type of sensitive data to complete the extraction of encrypted features and output plaintext feature data; The second type of sensitive data is perturbed using a localized differential privacy mechanism. Anonymization is applied to the third category of sensitive data; All processed data are aggregated to obtain the privacy-preserving training dataset. Step S3: Based on the privacy-preserving training dataset, perform the first stage of differential privacy pre-training on the initial large language model; during the pre-training process, firstly, norm clipping is performed on the gradient of a single sample to limit the gradient sensitivity of a single data point, and then an adaptive noise scheduling strategy is adopted to dynamically adjust the injected noise intensity according to the gradient norm and parameter sensitivity of the current training round to obtain the pre-trained model; wherein, the higher the sensitivity of the parameters to the output results and the greater the impact on the model performance, the smaller the applied noise intensity; the lower the sensitivity of the parameters to the output results, the greater the applied noise intensity. Step S4: Perform the second stage of knowledge distillation enhancement based on the non-privacy data subset: use the pre-trained model as the teacher model to construct a student model with the same structure; apply differential privacy noise perturbation to the soft labels output by the teacher model and use it to train the student model, transfer the knowledge patterns learned by the pre-trained model on the privacy data to the student model, and obtain the enhanced privacy big model; Step S5: Conduct a privacy leakage risk assessment on the privacy model by simulating various privacy attack methods to test the security of the privacy model and calculate the privacy leakage risk score of the privacy model; Step S6: When the privacy leakage risk score is lower than the preset security threshold, output the privacy big model as the final training result; when the privacy leakage risk score is higher than or equal to the preset security threshold, perform a privacy erasure operation on the privacy big model, and use the privacy erasure model to perform targeted erasure of the weight parameters related to privacy data in the privacy big model to obtain the erased privacy big model, and return to step S5 to re-evaluate the privacy leakage risk; if the security threshold is still not met after reaching the preset maximum number of iterations, output the current model and label the corresponding privacy risk level.

2. The privacy-preserving large model training method according to claim 1, characterized in that, In step S1, a privacy risk assessment is performed on the original training dataset, specifically including: Step S101: Perform sensitive information detection on each data sample in the original training dataset, and identify personal identity information, financial information, health information and biometric information contained in the data samples through a preset sensitive information recognition model; Step S102: Based on the type, quantity, and sensitivity of the detected sensitive information, and combined with the preset weight coefficients for various types of sensitive information, calculate the privacy sensitivity score for each data sample; Step S103: Data samples with privacy sensitivity scores exceeding the first threshold are classified as the privacy data subset, and data samples with privacy sensitivity scores lower than or equal to the first threshold are classified as the non-privacy data subset; Step S104: According to the three preset scoring intervals, the data samples in the privacy data subset are divided into the first type of sensitive data, the second type of sensitive data and the third type of sensitive data.

3. The privacy-preserving large model training method according to claim 1, characterized in that, In step S2, a localized differential privacy mechanism is applied to the second type of sensitive data for perturbation processing, specifically including: Step S201: Construct a noise distribution function with fixed upper and lower bounds based on the Lagrange interpolation method and the Fourier series method. The noise distribution function satisfies the (ε,δ) constraint of differential privacy. Step S202: Determine the shape parameters and scale parameters of the noise distribution function based on the numerical range of the second type of sensitive data and the privacy protection strength requirements; Step S203: Sample noise values ​​from the noise distribution function, perform element-by-element noise perturbation on the second type of sensitive data, and generate perturbed second type of sensitive data; Step S204: Calculate the statistical distribution deviation between the perturbed data and the original data as a data quality indicator. When the data quality is lower than the second threshold, adjust the parameters of the noise distribution function and perform perturbation processing again.

4. The privacy-preserving large model training method according to claim 1, characterized in that, In step S3, an adaptive noise scheduling strategy is used to dynamically adjust the injected noise intensity, specifically including: Step S301: In the current training round, first perform norm clipping on the gradient of a single sample, then calculate the batch gradient norm, and determine the basic noise intensity based on the batch gradient norm; Step S302: Calculate the Pearson correlation coefficient between the gradient of each training parameter and the change in model loss, and use it as an indicator of the sensitivity of the parameters to the output results to generate parameter sensitivity mapping relationship; Step S303: Divide the training parameters into a high-sensitivity parameter subset and a low-sensitivity parameter subset according to the parameter sensitivity mapping relationship; Step S304: Apply a first noise intensity to the parameters in the high-sensitivity parameter subset and apply a second noise intensity to the parameters in the low-sensitivity parameter subset, wherein the first noise intensity is less than the second noise intensity; Step S305: Calculate and cumulatively track the privacy loss of the current training round using the moment accountant method, and dynamically adjust the first noise intensity and the second noise intensity to ensure that the total privacy budget of the entire training process does not exceed the preset upper bound of (ε,δ).

5. The privacy-preserving large model training method according to claim 1, characterized in that, Step S4 specifically includes: Step S401: Use the pre-trained model as the teacher model to construct a student model with the same structure as the teacher model; Step S402: Input the non-privacy data subset into the teacher model and the student model respectively, and obtain the first soft label output by the teacher model and the second soft label output by the student model; apply differential privacy Gaussian noise perturbation to the first soft label to obtain desensitized soft labels; Step S403: Calculate the KL divergence between the desensitized soft label and the second soft label as the distillation loss, and at the same time calculate the cross-entropy loss between the student model output and the real label as the task loss; Step S404: Update the parameters of the student model based on the weighted sum of the distillation loss and the task loss; Step S405: Repeat steps S402 to S404 until the student model converges, and use the converged student model as the enhanced privacy big model.

6. The privacy-preserving large model training method according to claim 1, characterized in that, In step S5, the security of the privacy model is tested by simulating various privacy attack methods, specifically including: Step S501: Construct a member inference attack test set, perform member inference attacks on the privacy big model using the member inference attack test set, and calculate the accuracy of the member inference attack as the attack success rate; Step S502: Construct an attribute inference attack test set, perform attribute inference attacks on the privacy big model using the attribute inference attack test set, and calculate the accuracy of the attribute inference attack as the attack success rate; Step S503: Construct a model inversion attack test set, perform a model inversion attack on the privacy big model using the model inversion attack test set, and calculate the mean square error between the reconstructed data and the original data as the reconstruction error; Step S504: Based on the degree of privacy harm of the three types of attacks, set corresponding weights, and perform weighted calculations on the success rate of the member inference attack, the success rate of the attribute inference attack, and the model inversion reconstruction error to obtain the privacy leakage risk score; wherein, the smaller the reconstruction error, the higher the similarity between the data reconstructed by the attack and the original data, the higher the risk of privacy leakage, and the higher the corresponding risk score.

7. The privacy-preserving large model training method according to claim 1, characterized in that, The privacy erasure model in step S6 is pre-trained in the following manner: Step S601: Obtain the baseline initial model weights, the first weight data after pre-training on privacy data, and the second weight data after pre-training on non-privacy data; Step S602: Using the first weight data as training input and the second weight data as training labels, train the corresponding level of the erasure sub-model according to the model level. Step S603: Fit the mapping relationship from privacy weights to privacy-free weights using a multilayer perceptron architecture, use mean squared error as the training loss function, and train independent erasure sub-models for the embedding layer, attention layer, and feedforward network layer of the Transformer model to obtain a hierarchical privacy erasure model. Step S604: When performing erasure, input the weights of each layer of the privacy model to be erased into the corresponding layer of the erasure sub-model, output the layer weights after targeted elimination of privacy-related components, and concatenate them to obtain the complete erased model weights.

8. A privacy-preserving large model training system, characterized in that, It includes a data storage unit, a processor, and a computing acceleration unit. The processor is configured with the following functional modules: The privacy risk assessment module is used to obtain the original training dataset, perform a privacy risk assessment on the original training dataset, identify privacy data subsets and non-privacy data subsets containing sensitive attributes, and divide the privacy data subsets into three categories according to privacy sensitivity. The privacy data processing module is connected to the privacy risk assessment module and is used to process the privacy data subset using a multi-level privacy protection strategy. The multi-level privacy protection strategy includes secure multi-party computation feature extraction, localized differential privacy perturbation processing, and anonymization processing, and the results are summarized to obtain a training dataset after privacy protection processing. The differential privacy pre-training module, connected to the privacy data processing module, is used to perform the first stage of differential privacy pre-training on the initial large language model based on the privacy-preserving training dataset. In the pre-training, gradient clipping is performed first, and then an adaptive noise scheduling strategy is used to dynamically adjust the injected noise intensity to obtain the pre-trained model. The knowledge enhancement module is connected to the privacy risk assessment module and the differential privacy pre-training module, respectively. It is used to perform a second-stage knowledge distillation enhancement based on the non-privacy data subset, and to train the student model using the pre-trained model as the teacher model to obtain the enhanced privacy big model. The privacy and security assessment module, connected to the knowledge enhancement module, is used to assess the privacy leakage risk of the privacy model, conduct security tests by simulating various privacy attack methods, and calculate the privacy leakage risk score. The privacy erasure module is bidirectionally connected to the privacy security assessment module. When the privacy leakage risk score does not meet the security threshold, it calls the hierarchical privacy erasure model to perform targeted privacy erasure on the model weights and returns the erased model to the privacy security assessment module for re-evaluation, forming an iterative optimization closed loop.

9. The privacy-preserving large model training system according to claim 8, characterized in that, The privacy risk assessment module includes: The sensitive information detection unit is used to identify personal identity information, financial information, health information and biometric information contained in data samples through a pre-set sensitive information recognition model; The privacy sensitivity calculation unit is used to calculate the privacy sensitivity score of each data sample based on the type, quantity and sensitivity of the detected sensitive information, combined with preset weights. A data classification unit is used to classify data samples with a privacy sensitivity score exceeding a first threshold as the privacy data subset, and those with a score lower than or equal to the first threshold as the non-privacy data subset; The data grading unit is used to divide the data samples in the privacy data subset into three categories: extremely high sensitivity, high sensitivity, and medium sensitivity, according to a preset scoring range.

10. The privacy-preserving large model training system according to claim 8, characterized in that, The differential privacy pre-training module includes: The gradient clipping unit is used to perform norm clipping on the gradient of a single sample in each training epoch, thus limiting the gradient sensitivity of a single data point. The parameter sensitivity evaluation unit is used to calculate the correlation coefficient between the gradient of each parameter and the change in model loss, and to generate parameter sensitivity mapping relationships; The differential noise unit is used to divide the training parameters into high-sensitivity and low-sensitivity subsets based on parameter sensitivity, applying stronger noise to high-sensitivity parameters and weaker noise to low-sensitivity parameters. The privacy budget control unit is used to accumulate and track privacy losses in each round using the matrix accountant method, and dynamically adjust the noise intensity to ensure that the total privacy budget does not exceed the limit. The privacy erasure module includes: A hierarchical erasure model library stores privacy-preserving erasure sub-models corresponding to each level of the large model. The erase execution unit is used to call the corresponding erase sub-models hierarchically, perform targeted privacy component elimination on the model weights, and concatenate them to obtain the complete erased model weights. The iterative control unit controls the number of evaluation-erasure iterations. When the maximum number of iterations is reached, the loop terminates and a risk label is output.

Images