Shared neural networks with restricted usage

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for using a neural network to generate an output. One of the methods include obtaining an embedded representation of a ciphertext input, wherein the embedded representation of the ciphertext input comprises a plurality of embeddings generated based on encrypted tokens included in the ciphertext input, and wherein the encrypted tokens are generated by using a cryptographic key; obtaining a plaintext input that includes plaintext; processing the plaintext input using one or more plaintext embedding layers to generate an embedded representation of the plaintext input that comprises a plurality of embeddings generated based on the plaintext included in the plaintext input; and processing the embedded representation of the ciphertext input and the embedded representation of the plaintext input using one or more neural network layers to generate an output.

Description

[0001] SHARED NEURAL NETWORKS WITH RESTRICTED USAGE

[0002] BACKGROUND

[0003] This specification relates to processing inputs using neural networks to generate outputs.

[0004] Neural networks are machine learning models that employ one or more layers of nonlinear units to predict an output for a received input. Some neural networks include one or more hidden layers in addition to an output layer. The output of each hidden layer is used as input to the next layer in the network, i.e., another hidden layer or the output layer. Each layer of the network generates an output from a received input in accordance with current values of a respective set of parameters.

[0005] SUMMARY

[0006] This specification describes a system implemented as computer programs on one or more computers in one or more locations that implements a neural network that is configured to perform inference using mixed ciphertext and plaintext inputs.

[0007] In particular, the neural network is configured to receive an input that includes data derived from both a ciphertext input and a plaintext input, where the ciphertext input defines a machine learning task to be performed on the plaintext input, and then perform the machine learning task defined in the ciphertext input on the plaintext input to generate an output for the machine learning task.

[0008] In this specification, plaintext refers to data that is not modified by any known encryption or hashing technique. On the other hand, ciphertext refers to data that is an output of a known encryption, hashing, or other encoding technique. For example, the plaintext can include text data, image data, audio data, or the like, and the ciphertext can include an encrypted version of the text data, an encrypted version of the image data, an encrypted version of the audio data, or the like.

[0009] The subject matter described in this specification can be implemented in particular embodiments so as to realize one or more of the following advantages. Locally implementing neural networks at client computing devices has numerous benefits including reduced inference latency, savings of network bandwidth, and improved data privacy, compared to implementing the neural networks at a server computing device, e.g., in the cloud. The specification describes techniques to enable local implementation of neural networks to achieve such benefits, all while reducing potential misuse of the locally implemented neural networks, i.e., after the architecture and parameters are shared outside of a server computing device.

[0010] By performing inference using mixed ciphertext and plaintext inputs, where the ciphertext input defines the machine learning task(s) to be performed on the plaintext input, the techniques described in this specification can restrict the usage of the neural networks to only a limited number of machine learning tasks. The neural networks can thus be distributed more broadly and yet, more securely, because the usage of the neural networks is controllable and thus can be limited as needed to prevent potential misuse of the neural networks, e.g., to avoid processing of inappropriate inputs or generation of toxic or memorized outputs by the neural networks.

[0011] When provisioning different machine learning services to different users, the techniques described in this specification can improve the effectiveness of the training of a neural network without greatly increasing the time and computational resource and power consumption of the training, because training a separate neural network for each individual task (or each combination of individual tasks) for provision to a different user can be avoided. Instead, a single neural network can be trained on a broad range of tasks during the training, and then usage of the broadly trained neural network by each user can be restricted by providing only a predetermined set of ciphertext inputs that are required by the neural network to accurately perform corresponding tasks to the user.

[0012] The details of one or more embodiments of the subject matter of this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims.

[0013] BRIEF DESCRIPTION OF THE DRAWINGS

[0014] FIG. 1 shows an example neural network sharing environment.

[0015] FIG. 2 is a flow diagram of an example process for using a neural network to generate an output.

[0016] FIG. 3 is a flow diagram of sub-steps of one of the steps of the process of FIG. 2.

[0017] FIG. 4 is another flow diagram of sub-steps of one of the steps of the process of FIG. 2.

[0018] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0019] FIG. 1 shows an example neural network sharing environment 100 that includes a server computing device 102 and a plurality of client computing devices 104A-N. The server computing device 102 is typically hosted within a data center, which can be a distributed computing system having hundreds or thousands of computers in one or more locations. Each client computing device 104A-N can be, for example, a desktop computer, laptop computer, a tablet computer, a wearable computer, a cellular phone, a smart phone, a music player, an e-book reader, a navigation system, a gaming device, a digital assistant device, an augmented reality device, a virtual reality device, an edge device, or any other appropriate computing device.

[0020] The neural network sharing environment 100 includes a network 122, such as a local area network (LAN), a wide area network (WAN), the Internet, or a combination thereof. The network 122 connects the server computing device 102 and the plurality of client computing devices 104A-N.

[0021] The neural network sharing environment 100 includes a plurality of neural networks, e.g., neural network 110, that are distributed by the server computing device 102 among the plurality of client computing devices 104A-N for them to use. In some implementations, the plurality of neural networks included in the neural network sharing environment 100 have the same architecture and the same parameters; that is, they are multiple instances of the same neural network, e.g., neural network 110. In other implementations, the plurality of neural networks have the same architectures but different parameters. In yet other implementations, the architectures and, therefore, the parameters of the plurality of neural networks differ from one another.

[0022] The server computing device 102 develops and / or trains the neural network 110 on training data and then the server computing device 102 distributes the neural network among the plurality of client computing devices 104A-N for them to use. For example, the server computing device 102 can provide architecture data that specifies the architecture of the neural network and parameter data that specifies the values of the parameters of the neural network to each client computing device 104A-N over the network 122.

[0023] As a specific example, the neural network 110 can be pre-trained on a maximumlikelihood objective on a large dataset of text in one or more natural languages, e.g., text that is publicly available from the Internet or another text corpus, a large dataset of computer code in one or more programming languages, e.g., Python, C++, C#, Java, Ruby, PHP, and so on, e.g., computer code that is publicly available from the Internet or another code repository, a large dataset of audio samples, e.g., audio recordings or waveforms that represent the audio recordings, a large dataset of images where each image includes an array of pixels, a large dataset of videos where each video includes a temporal sequence of frames, or a large multimodal dataset that includes a combination of two or more of these datasets.

[0024] In this example, the pre-trained neural network 110 can then be adjusted, e.g., through fine-tuning adaptation, to one or more machine learning tasks using labeled training data that is specific to the tasks. The machine learning tasks can include any combination of one or more of the machine learning tasks mentioned below and possibly other tasks. Examples of fine-tuning adaptation techniques include supervised fine-tuning (SFT), reinforcement learning from human feedback (RLHF), instruction tuning, and the like, that use different training objectives, different data, or both.

[0025] The neural network 110 can have any of a variety of neural network architectures. That is, the neural network 110 can include any appropriate types of neural network layers (e.g., selfattention layers, fully connected layers, convolutional layer, and so forth) in any appropriate numbers (e.g., 5 layers, 10 layers, or 50 layers) and connected in any appropriate configuration (e.g., as a directed graph of layers).

[0026] As a particular example, the neural network 110 can have any of a variety of Transformer-based neural network architectures, e.g., encoder-only Transformer architectures, encoder-decoder Transformer architectures, decoder-only Transformer architectures, other attention-based architectures, and so on. Examples of such Transformer-based neural network architectures include those described in Rohan Anil, et al. Palm 2 technical report. arXiv preprint arXiv:2305.10403 (2023), Devlin, Jacob, et al. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 1810.04805 (2018), and Gemini Team, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 (2023).

[0027] Some examples of machine learning tasks that the neural network 110 when implemented using one of the architectures described above or other known architectures can be configured to perform will now be discussed. In implementations the neural network 110 may be configured as, or include, a generative (large) language model or a multi-modal model, e.g., a visual and language model, to perform these example machine learning tasks.

[0028] The neural network 110 can be configured through training to perform any kind of machine learning task on plaintext in response to received ciphertext requests. That is, the neural network 110 can be configured to receive (i) data derived from a ciphertext input that defines any kind of machine learning task and (ii) data derived from a plaintext input that includes any kind of digital data input and to perform the machine learning task on the digital data input to generate any kind of score, classification, or regression output based on the ciphertext and plaintext inputs.

[0029] In some cases, the neural network 110 is a neural network that is configured to perform an image or video processing task, i.e., receive (i) data derived from a ciphertext input that is generated based on encrypting a prompt or a request for an image or video processing task and (ii) data derived from a plaintext input that includes an input image or an input video having multiple frames (where each frame is an input image), and to process the ciphertext input and the plaintext input to generate a network output for the input image or the input video.

[0030] For example, the task defined in the ciphertext input may be image classification and the output generated by the neural network 110 for a given image may be scores for each of a set of object categories, with each score representing an estimated likelihood that the image contains an image of an object belonging to the category. As another example, the task defined in the ciphertext input can be image embedding generation and the output generated by the neural network 110 can be a numeric embedding of the input image. As yet another example, the task defined in the ciphertext input can be object detection and the output generated by the neural network 110 can identify locations in the input image at which particular types of objects are depicted. As yet another example, the task defined in the ciphertext input can be image semantic segmentation and the output generated by the neural network 110 can assign each pixel of the input image to a category from a set of categories. As yet another example, the task defined in the ciphertext input can be image instance segmentation and the output generated by the neural network 110 can assign each pixel of the input image to a respective object instance from a set of object instances. As yet another example, the task defined in the ciphertext input can be image depth prediction and the output generated by the neural network 110 can assign a respective predicted depth value to each pixel of the input image. In some cases, the neural network 110 is a neural network that is configured to perform an image or video generation task where the neural network 110 generates images or videos that each have multiple frames (where each frame is an image) as sequences of pixels. In this example, the output generated by the neural network 110 can include a sequence of color values for pixels in an output image arranged according to a specified order.

[0031] As another example, if the plaintext inputs to the neural network 110 include data derived from Internet resources (e.g., web pages), documents, or portions of documents or features extracted from Internet resources, documents, or portions of documents, the task defined in the ciphertext input can be to classify the resource or document, i.e., the output generated by the neural network 110 for a given Internet resource, document, or portion of a document may be a score for each of a set of topics, with each score representing an estimated likelihood that the Internet resource, document, or document portion is about the topic.

[0032] As another example, if the plaintext inputs to the neural network 110 include data derived from features of an impression context for a particular advertisement, the output generated by the neural network 110 may be a score that represents an estimated likelihood that the particular advertisement will be clicked on.

[0033] As another example, if the plaintext inputs to the neural network 110 include data derived from features of a personalized recommendation for a user, e.g., features characterizing the context for the recommendation, e.g., features characterizing previous actions taken by the user, the output generated by the neural network 110 may be a score for each of a set of content items, with each score representing an estimated likelihood that the user will respond favorably to being recommended the content item.

[0034] As another example, if the plaintext input to the neural network 110 include data derived from a sequence of text in one language, the output generated by the neural network 110 may be a piece of text in the other language that is a predicted proper translation of the input text into the other language.

[0035] Some implementations may be used for automatic code generation. For example, the plaintext input may include data derived from a sequence that represents words, wordpieces or characters in a first natural language and the output may represent instructions in a computer programming or markup language, or instructions for controlling an application program to perform a task e.g. build a data item such as an image or web page. As another example, the plaintext input to the neural network 1 10 may include data derived from computer code or a text description of the function of computer code and the output generated by the neural network is a sequence of computer code in a programming language that completes the input code in the context input or that performs the function described in the context input.

[0036] As another example, the task defined in the ciphertext input may be an audio processing task. For example, if the plaintext input to the neural network 110 includes data derived from a sequence representing a spoken utterance, the output generated by the neural network 110 may be a text transcript for the utterance. As another example, the task defined in the ciphertext input may be a keyword spotting task where, if the plaintext input to the neural network includes data derived from is a sequence representing a spoken utterance, the output generated by the neural network 110 can indicate whether a particular word or phrase (“hotword”) was spoken in the utterance. As another example, if the plaintext input to the neural network 110 includes data derived from a sequence representing a spoken utterance, the output generated by the neural network 110 can identify the natural language in which the utterance was spoken. As another example, the task defined in the ciphertext input can be an audio generation task where the neural network 110 generates audio signals. In this example, the output generated by the neural network 110 can be an output audio example that includes a sample of an audio wave at each of a sequence of output time steps that span a specified time window. For example, the output time steps can be arranged at regular intervals within the specified time window. The audio sample at a given output time step can be an amplitude value of the audio wave or an amplitude value that has been compressed, companded, or both. For example, the audio sample can be a raw amplitude value or a mu-law companded representation of the amplitude value.

[0037] As another example, the task defined in the ciphertext input can be a natural language processing or understanding task, e.g., an entailment task, a paraphrase task, a textual similarity task, a sentiment task, a sentence completion task, a grammaticality task, and so on, that operates on a sequence of text in some natural language.

[0038] As another example, the task defined in the ciphertext input can be a text to speech task, and the plaintext input includes data derived from text in a natural language or features of text in a natural language and the network output is a spectrogram or other data defining audio of the text being spoken in the natural language. As another example, the task defined in the ciphertext input can be a health prediction task, and the plaintext input includes data derived from a sequence derived from electronic health record data for a patient and the output is a prediction that is relevant to the future health of the patient, e.g., a predicted treatment that should be prescribed to the patient, the likelihood that an adverse health event will occur to the patient, or a predicted diagnosis for the patient. Such electronic health data may, for example, comprise one or more sequences of physiological data taken from a patient, with the output being a corresponding prediction that relates to those sequences of data. Examples of physiological data and a corresponding prediction include; blood glucose measurements, with the prediction being a predicted future blood glucose measurement or the prediction of a hyper- or hypo-glycemic event; a heart rate, with the prediction being the presence or absence of a heart condition, or a future cardiac event; blood pressure measurements, with the prediction being the risk of a future heart condition; or the like.

[0039] As another example, the task defined in the ciphertext input can be a text generation task, and the plaintext input includes data derived from a sequence of text, and the output is another sequence of text, e.g., a completion of the input sequence of text, a response to a question posed in the input sequence, or a sequence of text that is about a topic specified by the first sequence of text. As another example, the plaintext input to the text generation task can include data other than text, e.g., data derived from an image or a video, and the output can be text that describes the input.

[0040] The input sequence of text and the output sequence of text may be in the same language, or may alternatively be in different languages. For example, the task defined in the ciphertext input is a multilingual text generation task, and the plaintext input includes data derived from a sequence of text in a first language, e.g., English, and the output generated by the neural network is a sequence of text in a second language, e.g., Gemian. As another example, the plaintext input to the text generation task can be an input other than text, e.g., an image, and the output sequence can be text that describes the input.

[0041] In some implementations the plaintext input represents data to be compressed, e.g. image data, video data, text data, audio data, or any other type of data; and the output a compressed version of the data. The input and output may each comprise any representation of the data to be compressed / compressed data e.g. symbols or embeddings generated / decoded by a respective neural network. As another example, the task defined in the ciphertext input can be an agent control task, and the plaintext input includes data derived from one or more observations characterizing states of an environment and the output defines an action to be performed by the agent in response to the most recent data in the sequence. The agent can be, e.g., a real -world or simulated robot, a control system for an industrial facility, or a control system that controls a different kind of agent. The observations may comprise sensor data captured by sensors associated with (e.g. part of) the agent, for example visual data, LIDAR data, sonar data, agent configuration data (e.g. joint angles), agent orientation data, or the like.

[0042] In some implementations, the environment is a suitable execution environment, e.g., a runtime environment or an operating system environment, that is implemented on a client computing device, e.g., client computing device 104A, and the agent is a virtual agent (also known as “automated assistant” or “mobile assistant”) that may be interacted with by a user through the client computing device. The virtual agent can receive input from the user (e.g., typed or spoken natural language input) and respond with responsive content (e.g., visual and / or audible natural language output). The virtual agent can provide a broad range of functionalities through interactions with various local and / or third-party applications, websites, or other agents. In these implementations, the actions include any activity or operation that may be performed or initiated by the user on a client computing device, e.g., within an application software installed on the client computing device.

[0043] As another example, the task defined in the ciphertext input can be a genomics task, and the plaintext input includes data derived from a sequence representing a fragment of a DNA sequence or other molecule sequence and the output is either an embedding of the fragment for use in a downstream task, e.g., by making use of an unsupervised learning technique on a data set of DNA sequence fragments, or an output for the downstream task. Examples of downstream tasks include promoter site prediction, methylation analysis, predicting functional effects of noncoding variants, and so on.

[0044] In some cases, the machine learning task defined in the ciphertext input is a combination of multiple individual machine learning tasks, i.e., the neural network 110 is configured to perform multiple different individual machine learning tasks, e.g., two or more of the machine learning tasks mentioned above. For example, the neural network 110 can be configured to perform multiple individual natural language understanding tasks, with the ciphertext input including an identifier for the individual natural language understanding task to be performed on a corresponding portion of the plaintext input.

[0045] In some cases, the machine learning task defined in the ciphertext input is a multi-modal processing task that requires processing multi-modal data. In general, multi-modal data is a combination of two or more different types of data, e.g., two or more of audio data, image data, text data, or graph data. As one example the multi-modal data may comprise audio-visual data, comprising a combination of pixels of an image or of video and audio data representing values of a digitized audio waveform. As another example the multi-modal data may comprise a combination of i) text data representing text in a natural language and ii) pixels of an image or of video or audio data representing values of an audio waveform. Optionally, but not necessarily, the different types of data may represent the same or overlapping objects using the different modalities (types), and when processing multi-modal data the data may be mapped into a common embedding space.

[0046] As a particular example, the task defined in the ciphertext input is a multi-modal processing task that requires processing both text and image inputs, so that the neural network 110 includes both a computer vision neural network and a text processing neural network. That is, the output to be generated by the computer vision neural network for a given image depends on one or more outputs generated by the text processing neural network for one or more corresponding text inputs (and vice versa). Examples of such tasks include open-vocabulary image classification, open-vocabulary object detection, image captioning, text-based image search, image-based retrieval, and so on.

[0047] More generally, the multi-modal processing task may correspond to any of the tasks previously described for any of the types of data making up the multi-modal combination. For example, an accuracy of the previously described tasks may be increased when the task is applied to multi-modal data combining the data for which the task has been previously described and another type of data. For example detection or classification of an object or event may be improved when data of multiple different types (modalities) is processed.

[0048] The example machine learning tasks described above are not exhaustive, and the neural network 110 may also be used to perform other tasks.

[0049] The server computing device 102 offers machine learning services, including services that involve locally deploying the plurality of neural networks at the plurality of client computing devices 104A-N to perform one or more of the machine learning tasks mentioned above on an input to generate an output for each of the machine learning tasks.

[0050] The plurality of neural networks included in the neural network sharing environment 100 map respectively to the plurality of client computing devices 104A-N. That is, each client computing device 104A-N stores and implements a corresponding neural network. For convenience, FIG. 1 illustrates that the neural network sharing environment 100 includes a neural network 110 that maps to the client computing device 104A. The client computing device 104A can include one or more data processing apparatuses and one or more computer storage media that provide the processing resources and memory resources needed to store and run the neural network 110. Generally, however, the neural network sharing environment 100 can include a greater number of neural networks, and descriptions about the client computing device 104A and the neural network 110 can apply equally to each of the plurality of client computing devices 104A-N and the neural networks that may be included in the neural network sharing environment 100.

[0051] For example, a user, by using an application, e.g., a machine learning application, an image / video processing application, a document editing application, and so on, installed on the client computing device 104 A, can use the neural network 110 to process an input for a machine learning task to generate an output for the machine learning task. The output for the machine learning task can then be provided for presentation to the user on a display of the client computing device, or further processed by the application.

[0052] Locally implementing a neural network at each of the plurality of client computing devices 104A-N has advantages over hosting the neural network at the server computing device 102. For example, by enabling on-device inference, latency experienced by the user can be reduced as round trip communication to the server computing device 102 can be eliminated. As another example, data privacy can be enhanced as user inputs can be processed on the client computing devices 104A-N, without being transmitted to the server computing device 102.

[0053] Despite these advantages, the neural networks may nevertheless be susceptible to potential misuse when they are deployed locally at the plurality of client computing devices 104A-N rather than at the server computing device 102. Neural network misuse is defined as unauthorized access to certain functionalities of the neural network, e.g., performing an impermissible machine learning task and / or processing data in an impermissible modality. To limit neural network misuse in the neural network sharing environment 100, the neural network 110 is configured to perform inference using mixed ciphertext and plaintext inputs. In particular, the neural network 110 is configured to receive an input that includes data derived from both a ciphertext input and a plaintext input, where the ciphertext input defines a machine learning task to be performed on the plaintext input, and then perform the machine learning task defined in the ciphertext input on the plaintext input to generate an output for the machine learning task.

[0054] In this specification, plaintext refers to data that is not modified by any known encryption or hashing technique. On the other hand, ciphertext refers to data that is an output of a known encryption, hashing, or other encoding technique. For example, the plaintext can include text data, image data, audio data, or the like, and the ciphertext can include an encrypted version of the text data, an encrypted version of the image data, an encrypted version of the audio data, or the like.

[0055] FIG. 1 thus illustrates that, in some implementations, the client computing device 104A stores one or more ciphertext embedding layers 120 that operate on ciphertext and one or more plaintext embedding layers 130 that operate on a plaintext input. In some other implementations, the one or more ciphertext embedding layers 120 that operate on ciphertext can be stored on the server computing device 102 (but the one or more plaintext embedding layers 130 will typically be stored in the client computing device 104A).

[0056] The one or more ciphertext embedding layers 120 processes the ciphertext input to generate an embedded representation of the ciphertext input. To that end, the one or more ciphertext embedding layers 120 can be implemented in any of a variety of ways. For example, a ciphertext embedding layer can be configured as a single neural network layer that has trainable parameters. As another example, a ciphertext embedding layer can be configured as a neural network having multiple neural network layers, e.g., as a multi-layer perceptron or as a Transformer neural network. As another example, a ciphertext embedding layer can implement look-up table that stores embeddings of encrypted tokens (where the embeddings are trainable).

[0057] The one or more plaintext embedding layers 130 processes the plaintext input to generate an embedded representation of the plaintext input. Likewise, the one or more plaintext embedding layers 130 can be implemented in any of a variety of ways. In some examples, a plaintext embedding layer can be configured as a single neural network layer or a neural network having multiple neural network layers, or can implement a look-up table.

[0058] The neural network 110 receives an input that includes the embedded representation of the ciphertext input and the embedded representation of the plaintext input, and then processes the input, e.g., based on updating the input by applying attention operations, to generate an output.

[0059] In particular, prior to distribution across the plurality of client computing devices 104A- N, the server computing device 102 trains the neural network 110 in a way such that the neural network 110 can properly perform a machine learning task (which can be any one of the tasks mentioned above) on an input to generate an accurate output for the machine learning task only when the input to the neural network 110 includes an embedded representation of a ciphertext input that is generated based on encrypting a prompt or a request corresponding to the machine learning task.

[0060] In some implementations, this can be achieved by training the neural network 110 jointly with the one or more ciphertext embedding layers 120 and with the one or more plaintext embedding layers 130 on mixed ciphertext and plaintext, such that once trained the neural network 110 will respond appropriately only when it operates on mixed plaintext and ciphertext during inference.

[0061] In some implementations, this can be achieved by training the neural network 110 jointly with the one or more ciphertext embedding layers 120 solely or mostly on ciphertext, e.g., an encrypted version of text data, an encrypted version of image data, an encrypted version of the data, and so on, such that once trained the neural network 110 will not respond appropriately if it operates entirely on plaintext, i.e., processes data that excludes ciphertext, during inference.

[0062] In contrast, when the input to the neural network 110 does not include any embedded representation of a ciphertext input that is generated based on encrypting a prompt or a request corresponding to a machine learning task, then the neural network 110 cannot properly perform the machine learning task, i.e., the neural network 110 will not generate an accurate output for the machine learning task. In some implementations, the neural network 110 generates no output. In some other implementations, the output of the neural network 110 is a predetermined null value. In yet other implementations, the output of the neural network 110 is an inaccurate or otherwise defective output for the machine learning task. For example, when the neural network 110 is used to perform an image classification task on an input image, the neural network 110 can receive (i) an embedded representation of a ciphertext input that is generated by the one or more ciphertext embedding layers 120 from the ciphertext input and (ii) an embedded representation of a plaintext input that is generated by the one or more plaintext embedding layers 130 from the plaintext input. In this example, if the ciphertext input does not define such an image classification task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the output generated by the neural network 110 may include a null score for each of a set of object categories.

[0063] As another example, when the neural network 110 is used to perform a text generation task, the neural network 110 can receive (i) an embedded representation of a ciphertext input that is generated by the one or more ciphertext embedding layers 120 from a ciphertext input and (ii) an embedded representation of a plaintext input that is generated by the one or more plaintext embedding layers 130 from the plaintext input. The plaintext input can be or represent a sequence of text, an image, a video, and so on. In this example, if the ciphertext input does not define such a text generation task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the output generated by the neural network 110 may be a sequence of gibberish text, e.g., a text sequence that includes semantically meaningless words.

[0064] As another example, when the neural network 110 is used to perform an automatic code generation task, the neural network 110 can receive (i) an embedded representation of a ciphertext input that is generated by the one or more ciphertext embedding layers 120 from a ciphertext input and (ii) an embedded representation of a plaintext input that is generated by the one or more plaintext embedding layers 130 from the plaintext input. The plaintext input can be or represent a sequence of text, e.g., text in a natural language or a computer programming language, an image, a video, and so on. In this example, if the ciphertext input does not define such an automatic code generation task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the output generated by the neural network 110 may be a sequence of computer code that does not perform the function described in the context input sequence, or a sequence of computer code that does not compile.

[0065] As another example, when the neural network 110 is used to perform an audio generation task, the neural network 110 can receive (i) an embedded representation of a ciphertext input that is generated by the one or more ciphertext embedding layers 120 from a ciphertext input and (ii) an embedded representation of a plaintext input that is generated by the one or more plaintext embedding layers 130 from the plaintext input. The plaintext input can be or represent a sequence of text, an audio signal, and so on. In this example, if the ciphertext input does not define such an audio generation task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the output generated by the neural network 110 may be an output audio example that represents jumbled audio, gibberish audio, or noise signals.

[0066] As yet another example, when the neural network 110 is used to perform an image or video generation task, the neural network 110 can receive (i) an embedded representation of a ciphertext input that is generated by the one or more ciphertext embedding layers 120 from a ciphertext input and (ii) an embedded representation of a plaintext input that is generated by the one or more plaintext embedding layers 130 from the plaintext input. The plaintext input can be or represent a sequence of text, an image, a video, and so on. In this example, if the ciphertext input does not define such an audio image or video task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the output generated by the neural network 110 may be an image or a video with artifacts (e.g., patterns, variations in brightness / darkness, or blurring in video continuations).

[0067] In any of these examples, while the plaintext input is typically included in or otherwise specified by a user input provided by a user of the client computing device 104A, the ciphertext input (or the embedded representation of the ciphertext) can be obtained by the client computing device 104A in many different ways, as will be discussed further below.

[0068] FIG. 2 is a flow diagram of an example process 200 for generating an output using a neural network. For convenience, the process 200 will be described as being performed by a client computing device. For example, the neural network can be the neural network 110 of FIG. 1, and a client computing device, e.g., the client computing device 104A of FIG. 1, appropriately programmed, can perform the process 200.

[0069] The client computing device locally implements and runs the neural network. Prior to the first iteration of the process 200, the client computing device receives architecture data that specifies the architecture of the neural network and parameter data that specifies the values of the parameters of the neural network from a server computing device over a network. The server computing device distributes the neural network to client computing devices for them to use. The client computing device obtains an embedded representation of a ciphertext input (step 202). The ciphertext input includes encrypted tokens. The encrypted tokens are generated from plaintext by using a cryptographic key and a key-based encryption algorithm. For example, the cryptographic key can be a single encryption key or a public key in a private-public key pair. The ciphertext input can define a machine learning task to be performed by the neural network.

[0070] In implementations, the key-based encryption algorithm may be a homomorphic encryption algorithm. A homomorphic encryption algorithm is an encryption algorithm that allows operations to be performed on encrypted data. For example, under a homomorphic encryption scheme, encrypt (A) + encrypt (B) = encrypt (A+B), where “encrypt” represents homomorphic encryption.

[0071] The cryptographic key may be managed by the neural network sharing platform implemented on the server computing device. Thus, the server computing device stores the cryptographic key. In some cases, only the server computing device can utilize the cryptographic key to encrypt plaintext to generate the ciphertext input. In some other cases, after a user of the client computing device has signed into a user account associated with the neural network sharing platform, the server computing device can provide the cryptographic key to the client computing device. That is, in some other cases, in addition to the server computing device, the client computing device, after verification, can also utilize the cryptographic key to encrypt plaintext to generate the ciphertext input.

[0072] The embedded representation of the ciphertext input includes a plurality of embeddings generated based on encrypted tokens included in the ciphertext input. An “embedding” as used in this specification is a sequence of one or more vectors of numeric values, e.g., floating point values or other values, each vector having a pre-determined dimensionality.

[0073] In some cases, all of the encrypted tokens have an identical size, e.g., include the same number of bits, while in other cases, the encrypted tokens will have different sizes, e.g., include varying numbers of bits. Some common examples of the key-based homomorphic encryption algorithm include the Rivest-Shamir-Adleman (RSA) encryption algorithm, the El-Gamal encryption algorithm, the Goldwassar-Micali encryption algorithm, the Pailleir algorithm, and the Gentry’s homomorphic encryption algorithm (described in https: / / crypto.stanford.edu / craig / craig-thesis.pdf) to name just a few. Using different keys to encrypt the same plaintext token typically (but need not) produces different encrypted tokens. In some cases, the server computing device stores one or more ciphertext embedding layers that are used to generate the embedded representation of the ciphertext input. The server computing device stores the embedded representation of the ciphertext input, and provides the embedded representation of the ciphertext input to the client computing device on an as-needed basis. Thus, in these cases, the client computing device can receive the embedded representation of the ciphertext input from the server computing device over the network.

[0074] For example, the server computing device can pre-generate a predetermined set of embedded representations of ciphertext inputs that correspond to different machine learning tasks by using the one or more ciphertext embedding layers, and then store the predetermined set of embedded representations of ciphertext inputs in association with a user account that has been established on a neural network sharing platform implemented on the server computing device. Then, after a user has signed into the user account, e.g., by way of entry of a password or other credential, the server computing device can provide one of the embedded representations of the ciphertext inputs in the predetermined set to the client computing device.

[0075] In some cases, the client computing device stores one or more ciphertext embedding layers. The client computing device obtains a ciphertext input that includes the encrypted tokens, and then processes the ciphertext input using the one or more ciphertext embedding layers to generate the embedded representation of the ciphertext input.

[0076] In some of these cases, the client computing device receives a plaintext prompt and then encrypts the received plaintext prompt to generate the ciphertext input, as discussed further below with reference to FIG. 3.

[0077] FIG. 3 is a flow diagram of sub-steps 302-308 of step 202 of the process of FIG. 2.

[0078] The client computing device receives a plaintext prompt as a user input from a user of the client computing device (step 302). The plaintext prompt includes plaintext. The plaintext prompt can be a request or a prompt that defines a machine learning task to be performed by the neural network.

[0079] The client computing device compares the plaintext prompt against a predetermined set of plaintext prompts to determine whether the plaintext prompt matches one of the plaintext prompts included in the predetermined set (step 304). In implementations the predetermined set of plaintext prompts can include permissible plaintext prompts that are associated with a user account of the user. Each user account can be associated with a corresponding, predetermined set of permissible plaintext prompts.

[0080] In some cases, the client computing device stores the predetermined set of plaintext prompts that is managed by the server computing device. For example, a user, by using an application installed on the client computing device, can request modifications to the predetermined set of plaintext prompts by the neural network sharing platform implemented on the server computing device. The modifications can include, adding, modifying, or removing a plaintext prompt in the predetermined set, for example. Upon receipt of the modification request, the neural network sharing platform can determine whether the modification request should be approved. If the modification request is approved, the neural network sharing platform can modify the predetermined set of plaintext prompts in accordance with the request and send the modified predetermined set of plaintext prompts to the client computing device.

[0081] In response to determining that the plaintext prompt matches one of the plaintext prompts in the predetermined set, the client computing device obtains an encrypted version of the plaintext prompt that has been generated based on the plaintext prompt using the cryptographic key (step 306). The match can either be an exact match, or a soft match based on a similarity measure. When there is a match, the encrypted version of the plaintext prompt can be obtained in many different ways.

[0082] For example, in cases where the cryptographic key has been provided by the server computing device to the client computing device, the client computing device can encrypt the plaintext prompt using the cryptographic key to generate the encrypted version of the plaintext prompt.

[0083] In some cases, the plaintext prompt can include an identifier, e.g., e.g., a memory location, that identifies one or more plaintext data items, e.g., an image, a video, an audio, or the like, and the client computing device can additionally or alternatively encrypt the one or more plaintext data items identified by the identifier and use the encrypted data item (as part of) the encrypted version of the plaintext prompt.

[0084] As another example, the encrypted version of the plaintext prompt can have been pregenerated by using the cryptographic key, and the client computing device can retrieve from a memory that stores the pre-generated, encrypted version of the plaintext prompt. As another example, the client computing device can request that the server computing device encrypts the plaintext prompt using the cryptographic key to generate the encrypted version of the plaintext prompt, and in response, receive the encrypted version of the plaintext prompt from the server computing device.

[0085] The client computing device uses the encrypted version of the plaintext prompt as the ciphertext input (step 308). Alternatively, in response to determining that the plaintext prompt does not match any one of the plaintext prompts in the predetermined set, the client computing device will refrain from obtaining the encrypted version of the plaintext prompt, and thus no ciphertext input can be generated.

[0086] In some others of these cases, the client computing device receives a ciphertext prompt and then uses the ciphertext prompt as the ciphertext input, as discussed further below with reference to FIG. 4.

[0087] FIG. 4 is another flow diagram of sub-steps 402-406 of step 202 of the process of FIG. 2.

[0088] The client computing device receives a ciphertext prompt as a user input from a user of the client computing device (step 402). The ciphertext prompt includes ciphertext. The ciphertext prompt can be generated based on encrypting a plaintext prompt that defines a machine learning task to be performed by the neural network.

[0089] The client computing device compares the ciphertext prompt against a predetermined set of ciphertext prompts to determine whether the ciphertext prompt matches one of the ciphertext prompts included in the predetermined set (step 404). In implementations the predetermined set of ciphertext prompts can include permissible ciphertext prompts that are associated with a user account of the user. Each user account can be associated with a corresponding, predetermined set of permissible ciphertext prompts.

[0090] In some cases, the client computing device stores the predetermined set of ciphertext prompts that is managed by the server computing device. For example, a user, by using an application installed on the client computing device, can request modifications to the predetermined set of ciphertext prompts by the neural network sharing platform implemented on the server computing device. The modifications can include, adding, modifying, or removing a ciphertext prompt in the predetermined set, for example. Upon receipt of the modification request, the neural network sharing platform can determine whether the modification request should be approved. If the modification request is approved, the neural network sharing platform can modify the predetermined set of ciphertext prompts in accordance with the request and send the modified predetermined set of ciphertext prompts to the client computing device.

[0091] In response to determining that the ciphertext prompt matches one of the ciphertext prompts included in the predetermined set, the client computing device uses the ciphertext prompt as the ciphertext input (step 406). The match can either be an exact match, or a soft match based on a similarity measure.

[0092] Alternatively, in response to determining that the ciphertext prompt does not match any one of the ciphertext prompts in the predetermined set, the client computing device will refrain from using the ciphertext prompt as the ciphertext input.

[0093] The client computing device obtains a plaintext input as a user input from a user of the client computing device (step 204). The plaintext input sequence includes plaintext.

[0094] The client computing device processes the plaintext input using one or more plaintext embedding layers to generate an embedded representation of the plaintext input (step 206). The embedded representation of the plaintext input includes a plurality of embeddings. There are many ways in which the embedded representation of the plaintext input can be generated based on plaintext included in the plaintext input.

[0095] For example, if the plaintext input includes a sequence of text, the client computing device can represent the sequence of text as a sequence of tokens from a predefined vocabulary of tokens, and then process the sequence of text using the one or more plaintext embedding layers to map each token in the sequence to a corresponding embedding. The predefined vocabulary of tokens can include one or more of characters, sub-words, words, punctuation marks, numbers, or other symbols that appear in a corpus of natural language text and / or computer code. In this example the one or more plaintext embedding layers can implement a loop-up table that stores embeddings of tokens in the predefined vocabulary.

[0096] As another example, if the plaintext input includes an image, the client computing device can divide the image into a plurality of image patches, and then process each of the plurality of image patches using the one or more plaintext embedding layers to generate a corresponding embedding for the image patch. Each image patch includes a different subset of the pixels of the image. Examples configurations of the one or more plaintext embedding layers in this example include those described in Dosovitskiy, Alexey, et al. "An image is worth 16x16 words: Transformers for image recognition at scale." arXiv preprint arXiv:2010.11929 (2020) and Chang, Huiwen, et al. "Maskgit: Masked generative image transformer." Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2022.

[0097] As another example, if the plaintext input includes an audio signal, the client computing device can process the audio signal using the one or more plaintext embedding layers to generate a plurality of embeddings that collectively represent a prediction of the code vectors selected from a codebook of a quantizer, e.g., a residual vector quantizer, that would be generated by applying the quantizer to the audio signal. Examples configurations of the one or more plaintext embedding layers in this example include those described in Agostinelli, Andrea, et al. "Musiclm: Generating music from text." arXiv preprint arXiv:2301.11325 (2023) and Borsos, Zalan, et al. "Audio Im: a language modeling approach to audio generation." IEEE / ACM Transactions on Audio, Speech, and Language Processing (2023).

[0098] The client computing device processes the embedded representation of the ciphertext input and the embedded representation of the plaintext input using the neural network to generate an output for a machine learning task (step 208). The neural network includes one or more neural network layers. The neural network is configured to perform inference using mixed ciphertext and plaintext inputs.

[0099] In particular, the neural network is configured to receive an input that includes the embedded representation of the ciphertext input and the embedded representation of the plaintext input, where the ciphertext input defines the machine learning task to be performed on the plaintext input, and then perform the machine learning task defined in the ciphertext input on the plaintext input to generate an output for the machine learning task. The output can be any kind of score, classification, or generative output.

[0100] As a particular example, the server computing device can offer medical-related machine learning services to the client computing device, where the client computing device locally implements a neural network configured to perform medical-related machine learning tasks. In this example, the embedded representation of the ciphertext input can be generated based on a plaintext prompt, e.g., “find all diseases that fit the given symptoms,” “double check whether the reasoning behind the diagnosis makes sense,” or “write a report analyzing this chest X-ray image,” or “write a report analyzing this computed tomography (CT) scan,” by first encrypting the plaintext prompt using a cryptographic key stored at the server computing device to generate a ciphertext input, and then generating the embedded representation of the ciphertext input by using one or more ciphertext embedding layers.

[0101] Furthermore, in this example, the embedded representation of the plaintext input can be generated by using one or more plaintext embedding layers based on a plaintext input that is, e.g., a sequence of text in a natural language that describes a list of symptoms or a diagnosis, or a plaintext input that is a medical image acquired by an X-ray scanner, a computed tomography (CT) scanner, or another medical imaging scanner. The plaintext input can be received as a user input from a user of the client computing device.

[0102] Then, the neural network processes the embedded representation of the ciphertext input and the embedded representation of the plaintext input to generate an output for the medical- related machine learning task. For example, the neural network can receive an input that includes (i) the embedded representation of the ciphertext input which has been generated based on the plaintext prompt of “write a report analyzing this chest X-ray image,” and (ii) the embedded representation of the plaintext input that is a medical image acquired by an X-ray scanner, and then perform the X-ray report generation task defined in the ciphertext input on the plaintext input to generate an output that includes a text report that characterizes the medical image.

[0103] In particular, in this example, when the embedded representation of the ciphertext input is not provided for processing by the neural network, e.g., only the embedded representation of the plaintext input is provided, or when the ciphertext input does not define the X-ray report generation task, e.g., it is generated based on encrypting a prompt or a request for a different task, then the neural network will not be able to properly perform the X-ray report generation task, e.g., it may generate a sequence of gibberish text.

[0104] This specification uses the term “configured” in connection with systems and computer program components. For a system of one or more computers to be configured to perform particular operations or actions means that the system has installed on it software, firmware, hardware, or a combination of them that in operation cause the system to perform the operations or actions. For one or more computer programs to be configured to perform particular operations or actions means that the one or more programs include instructions that, when executed by data processing apparatus, cause the apparatus to perform the operations or actions.

[0105] Embodiments of the subject matter and the functional operations described in this specification can be implemented in digital electronic circuitry, in tangibly-embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible non-transitory storage medium for execution by, or to control the operation of, data processing apparatus. The computer storage medium can be a machine-readable storage device, a machine -readable storage substrate, a random or serial access memory device, or a combination of one or more of them. Alternatively or in addition, the program instructions can be encoded on an artificially-generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus.

[0106] The term “data processing apparatus” refers to data processing hardware and encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. The apparatus can also be, or further include, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). The apparatus can optionally include, in addition to hardware, code that creates an execution environment for computer programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0107] A computer program, which may also be referred to or described as a program, software, a software application, an app, a module, a software module, a script, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages; and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A program may, but need not, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, e.g., files that store one or more modules, sub-programs, or portions of code. A computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a data communication network. In this specification the term “engine” is used broadly to refer to a software-based system, subsystem, or process that is programmed to perform one or more specific functions. Generally, an engine will be implemented as one or more software modules or components, installed on one or more computers in one or more locations. In some cases, one or more computers will be dedicated to a particular engine; in other cases, multiple engines can be installed and running on the same computer or computers.

[0108] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuitry, e.g., an FPGA or an ASIC, or by a combination of special purpose logic circuitry and one or more programmed computers.

[0109] Computers suitable for the execution of a computer program can be based on general or special purpose microprocessors or both, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a central processing unit for performing or executing instructions and one or more memory devices for storing instructions and data. The central processing unit and the memory can be supplemented by, or incorporated in, special purpose logic circuitry. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device, e.g., a universal serial bus (USB) flash drive, to name just a few.

[0110] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto -optical disks; and CD- ROM and DVD-ROM disks.

[0111] To provide for interaction with a user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user’s device in response to requests received from the web browser. Also, a computer can interact with a user by sending text messages or other forms of message to a personal device, e.g., a smartphone that is running a messaging application, and receiving responsive messages from the user in return.

[0112] Data processing apparatus for implementing machine learning models can also include, for example, special-purpose hardware accelerator units for processing common and computeintensive parts of machine learning training or production, i.e., inference, workloads.

[0113] Machine learning models can be implemented and deployed using a machine learning framework, e.g., a TensorFlow framework or a JAX framework.

[0114] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes a back-end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front-end component, e.g., a client computer having a graphical user interface, a web browser, or an app through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN) and a wide area network (WAN), e.g., the Internet.

[0115] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, a server transmits data, e.g., an HTML page, to a user device, e.g., for purposes of displaying data to and receiving user input from a user interacting with the device, which acts as a client. Data generated at the user device, e.g., a result of the user interaction, can be received at the server from the device.

[0116] While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any invention or on the scope of what may be claimed, but rather as descriptions of features that may be specific to particular embodiments of particular inventions. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially be claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

[0117] Similarly, while operations are depicted in the drawings and recited in the claims in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0118] Particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results. As one example, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous.

[0119] What is claimed is:

Claims

CLAIMS1. A method performed by one or more data processing apparatus, the method comprising: obtaining an embedded representation of a ciphertext input, wherein the embedded representation of the ciphertext input comprises a plurality of embeddings generated based on encrypted tokens included in the ciphertext input, and wherein the encrypted tokens are generated by using a cryptographic key; obtaining a plaintext input that includes plaintext; processing the plaintext input using one or more plaintext embedding layers to generate an embedded representation of the plaintext input that comprises a plurality of embeddings generated based on the plaintext included in the plaintext input; and processing the embedded representation of the ciphertext input and the embedded representation of the plaintext input using one or more neural network layers to generate an output.

2. The method of claim 1, wherein obtaining the embedded representation of the ciphertext input comprises: obtaining the ciphertext input that includes the encrypted tokens that are generated by using the cryptographic key; and processing the ciphertext input using one or more ciphertext embedding layers to generate the plurality of embeddings.

3. The method of claim 2, wherein obtaining the ciphertext input comprises: receiving a plaintext prompt; comparing the plaintext prompt against a predetermined set of plaintext prompts to determine whether the plaintext prompt matches one of the predetermined set of plaintext prompts; in response to determining that the plaintext prompt matches one of the predetermined set of plaintext prompts, retrieving an encrypted version of the plaintext prompt that has been generated based on the plaintext prompt using the cryptographic key; and using the encrypted version of the plaintext prompt as the ciphertext input.

4. The method of any one of claims 2-3, wherein obtaining the ciphertext input comprises: receiving a ciphertext prompt; comparing the ciphertext prompt against a predetermined set of ciphertext prompts to determine whether the ciphertext prompt matches one of predetermined set of ciphertext prompts; and in response to determining that the ciphertext prompt matches one of the predetermined set of ciphertext prompts, using the ciphertext prompt as the ciphertext input.

5. The method of any one of claims 3-4, further comprising: transmitting, from a client computing device, a request for modifying the predetermined set of plaintext prompts to a server computing device; and receiving, by the client computing device, a modified predetermined set of plaintext prompts from the server computing device.

6. The method of claim 1, wherein obtaining the embedded representation of the ciphertext input comprises: receiving the embedded representation of the ciphertext input from the server computing device.

7. The method of any one of claims 1 -6, wherein the method is performed by a client computing device, and wherein the cryptographic key and a neural network comprising the one or more neural network layers are provided by a server computing device to the client computing device.

8. The method of any one of claims 1-7, wherein the method is performed by a client computing device, and wherein the plaintext prompt and the plaintext input are received by the client computing device from a user.

9. The method of any one of claims 1-8, wherein the method is performed by an edge device.

10. The method of any one of claims 1-9, wherein the encrypted tokens are encrypted using homomorphic encryption.

11. A system comprising: one or more data processing apparatus and one or more storage devices storing instructions that are operable, when executed by the one or more data processing apparatus, to cause the one or more data processing apparatus to perform operations of the respective method of any one of claims 1-10.

12. A computer storage medium encoded with a computer program, the program comprising instructions that are operable, when executed by one or more data processing apparatus, to cause the one or more data processing apparatus to perform operations of the respective method of any one of claims 1-10.

Images