System and method for privacy-preserving federated learning of large language model

Abstract

One embodiment of the present invention provides a system for privacy-preserving federated learning of a large language model, the system comprising: a device layer that anonymizes user data by applying a local differential privacy technique that adds noise based on multi-feature encoding to the user data, and provides the anonymized data; an edge layer that trains an LLM local model by using the anonymized data and transmits an encrypted weight of the trained LLM local model to a blockchain system; and a cloud layer that performs toxicity verification on the encrypted weight of the LLM local model and generates an LLM global model by aggregating, on a blockchain, the weights of LLM local models that have passed the toxicity verification.

Description

Privacy-preserving federated learning system and method for large language models

[0001] The present invention relates to a learning system for large language models, and more specifically, to a privacy-preserving federated learning system for large language models and a method thereof that ensures data security and model integrity in a federated learning environment.

[0002] This invention is part of the Industrial Technology International Cooperation Project organized by the Korea Institute for Industrial Technology Advancement (KIAT).

[0003] This is a research achievement supported by the "Development of Reliable AI-Based Cyber ​​Attack Detection Technology for the Safe Operation of IT&OT Convergence Control Systems" (Project No.: P0028271) (Research Period: Oct. 01, 2024 – Sep. 30, 2027).

[0004] Generally, large language models include context-aware capabilities to generate human-like responses to user queries, utilizing Personally Identifiable Information (PII) in this process. The PII used to generate these context-aware responses can be vulnerable to data leakage and malicious attacks. Large language models can be utilized in various fields. For example, they can provide context-aware, personalized responses in areas such as real-time public transportation information, emergency response management, and urban service guidance. Such adaptive services present new possibilities for human-computer interaction.

[0005] The training of large language models primarily takes place in centralized cloud-based environments, and malicious intervention can occur during the data transmission process between user devices and the cloud. Attackers can degrade the model's prediction accuracy by manipulating training parameters or maliciously augmenting them. Furthermore, man-in-the-middle attacks can impair data usability or leak personal information, which can severely compromise the integrity of the entire model training process.

[0006] In particular, since data collected from local devices for model training is often transmitted unencrypted, the privacy and integrity of the data are under threat. Furthermore, adversarial attacks can undermine the reliability and integrity of models by extracting confidential information or inserting maliciously manipulated data during the training process.

[0007] The technical problem that the present invention aims to solve is to provide a privacy-preserving federated learning system and method for large language models that guarantees data privacy and model integrity during the federated learning process of large language models. In particular, it aims to provide a privacy-preserving federated learning system and method for large language models that defends against adversarial attacks and enables secure model training throughout the entire process, from the data collection stage to the model aggregation stage.

[0008] The technical problems that the present invention aims to solve are not limited to those mentioned above, and other unmentioned technical problems will be clearly understood by those skilled in the art to which the present invention belongs from the description below.

[0009] To achieve the above technical objectives, one embodiment of the present invention provides a privacy-preserving federated learning system for a large language model, characterized by comprising: a device layer that collects user data and generates anonymized data by applying a Local Differential Privacy technique that adds noise based on Multi-feature Encoding to the collected data; an edge layer that trains an LLM local model using a Secure Multi-Party Computation (SMPC) method based on the anonymized data and transmits the weights of the trained LLM local model to a blockchain system in an encrypted state; and a cloud layer that performs toxicity verification on the weights of the encrypted LLM local model and aggregates the weights of the LLM local models that passed the toxicity verification on the blockchain to generate an LLM global model.

[0010] In an embodiment of the present invention, the device layer may include: a feature encoding unit that converts a plurality of features of the collected data into a single-bit string using a multiple feature encoding method; a noise addition unit that performs anonymization by adding noise that changes a bit value according to a probability set for each bit of the single-bit string; and a probability determination unit that determines the bit value change probability for adding noise based on the epsilon (ε parameter value) of local difference privacy.

[0011] In an embodiment of the present invention, the edge layer may include: a data distributed storage unit that divides and stores the anonymized data among a plurality of edge nodes; a model learning unit that learns an LLM local model while the edge nodes share only the computation results in a secure multi-party computation (SMPC) manner without sharing the original data; and a weight encryption transmission unit that encrypts the weights of the learned LLM local model in a secret distributed manner and transmits them to a blockchain system.

[0012] In an embodiment of the present invention, the cloud layer may include: a model verification unit that filters out maliciously compromised models by performing a threshold-based toxicity verification on the weights of the encrypted LLM local model; a blockchain record unit that verifies and records the weights of the LLM local model that have passed the toxicity verification through distributed nodes of the blockchain; and a model aggregation unit that generates an LLM global model by aggregating the recorded weights of the LLM local model according to a consensus protocol on the blockchain.

[0013] To achieve the above technical objectives, another embodiment of the present invention provides a privacy-preserving federated learning method for a large language model, characterized by comprising: a step of collecting user data; a step of generating anonymized data by applying a Local Differential Privacy technique that adds noise based on Multi-feature Encoding to the collected data; a step of training an LLM local model using a Secure Multi-Party Computation (SMPC) method based on the anonymized data and transmitting the weights of the trained LLM local model to a blockchain system in an encrypted state; a step of performing a toxicity verification on the weights of the encrypted LLM local model; and a step of generating an LLM global model by aggregating the weights of the LLM local models that passed the toxicity verification on the blockchain.

[0014] According to an embodiment of the present invention, local differential privacy of the device layer, secure multi-party computation of the edge layer, and blockchain technology of the cloud layer are organically combined to comprehensively protect the privacy and integrity of data.

[0015] In addition, it can maintain high model accuracy even in situations involving damaged models, providing strong defensive capabilities against adversarial attacks.

[0016] In addition, through a three-layer structure, secure transmission and processing of data and models are possible, enabling the implementation of federated learning of large language models with enhanced security.

[0017] The effects of the present invention are not limited to the effects described above, and should be understood to include all effects that can be inferred from the configuration of the invention described in the detailed description of the invention or the claims.

[0018] FIG. 1 shows a privacy-preserving federated learning system for a large language model according to one embodiment of the present invention.

[0019] Figure 2 is a diagram to explain in detail the overall configuration and data flow of the privacy-preserving federated learning system of the large language model described in Figure 1.

[0020] Figure 3 shows a data reconstruction algorithm performed at the edge layer.

[0021] Figure 4 shows a secure model verification algorithm performed in the model verification section of the cloud layer.

[0022] Figure 5 shows a secure aggregation algorithm performed in the model aggregation unit of the cloud layer.

[0023] FIG. 6 is a flowchart showing the overall flow of a privacy-preserving federated learning method for a large language model according to another embodiment of the present invention.

[0024] Figure 7 is a graph showing the accuracy of the model according to the level of privacy (ε) using the Wikipedia dataset.

[0025] Figure 8 shows the number of communication rounds according to the privacy level in the same dataset.

[0026] Figure 9 shows the change in accuracy for the Wikipedia dataset when 20% of damaged models are included without applying the model validation process of the federated learning system of the present invention.

[0027] Figure 10 shows the change in accuracy for the Wikipedia dataset when 40% of damaged models are included without applying the model validation process of the federated learning system of the present invention.

[0028] Figure 11 shows the change in accuracy for the Wikipedia dataset when 20% of damaged models are included, with the model validation process of the federated learning system of the present invention applied.

[0029] Figure 12 shows the change in accuracy for the Wikipedia dataset when 40% of damaged models are included, with the model validation process of the federated learning system of the present invention applied.

[0030] The present invention is susceptible to various modifications and may take various forms; therefore, specific embodiments are illustrated in the drawings and described in detail in the text. However, this is not intended to limit the invention to the specific disclosed forms, and it should be understood that the invention includes all modifications, equivalents, and substitutions that fall within the spirit and scope of the invention. Similar reference numerals have been used for similar components in the description of each drawing.

[0031] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by those skilled in the art to which the present invention pertains. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in this application.

[0032] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings.

[0033] FIG. 1 shows a privacy-preserving federated learning system (1) of a Large Language Model (LLM) according to one embodiment of the present invention.

[0034] Referring to FIG. 1, the privacy-preserving federated learning system (1) of the large language model of the present invention includes a device layer (10), an edge layer (20), and a cloud layer (30).

[0035] The device layer (10) is a layer that collects user data and provides it in anonymized form. Specifically, the device layer collects data from user devices such as smartphones and tablets, and generates anonymized data by applying a Local Differential Privacy technique that adds noise based on Multi-feature Encoding to the collected data. Here, the addition of noise is performed by converting the features of the data into a bit string and then changing the bit value according to a probability set for each bit. Through this addition of noise, the privacy of the original data can be protected while maintaining the usability of the data.

[0036] The edge layer (20) is a layer that trains an LLM local model based on anonymized data provided by the device layer (10). The edge layer (20) is composed of multiple distributed edge nodes, and each edge node processes anonymized data collected from nearby devices. In particular, the edge layer trains the LLM local model using a Secure Multi-Party Computation (SMPC) method and transmits the weights of the trained LLM local model to the blockchain system in an encrypted state.

[0037] The cloud layer (30) is a layer that aggregates LLM local models learned in the edge layer (20) to generate an LLM global model. The cloud layer (30) can be executed on a traditional cloud server or a distributed blockchain network. The cloud layer (30) first performs toxicity verification on the weights of the encrypted LLM local models. The weights of the LLM local models that pass the toxicity verification are aggregated on the blockchain to generate an LLM global model. Through this process, the integrity of the model aggregation process is guaranteed.

[0038] The configuration of each layer of the system described above is explained in more detail as follows.

[0039] The device layer (10) includes a feature encoding unit (11), a noise addition unit (12), and a probability determination unit (13). The feature encoding unit (11) converts multiple features of collected data into a single-bit string using a multiple-feature encoding method. At this time, multiple-feature encoding is performed by converting each of the various features of the data into a binary bit sequence and then concatenating them into a single string. For example, in the case of text data, various features such as words, parts of speech, and contextual information are each converted into bit sequences and concatenated. The noise addition unit (12) performs anonymization by adding noise that changes the bit value from 0 to 1 or from 1 to 0 according to a set probability for each bit of the converted single-bit string. At this time, the probability determination unit (13) determines the probability of changing the bit value for adding noise based on the epsilon (ε parameter value) of local difference privacy. The smaller the epsilon value, the stronger the privacy protection is possible, but the data usability decreases; conversely, if the epsilon value is large, the data usability increases, but the level of privacy protection decreases.

[0040] The edge layer (20) includes a distributed data storage unit (21), a model training unit (22), and a weight encryption transmission unit (23). Looking at the distributed learning process of the edge layer (20), first, the distributed data storage unit (21) divides and stores the anonymized data received from the device layer (10) among multiple edge nodes. The model training unit (22) trains an LLM local model while the edge nodes do not share the original data but only share the computation results using a secure multi-party computation (SMPC) method. This allows for cooperative learning while maintaining data security, as each node possesses only a part of the function required for the computation. The weight encryption transmission unit (23) encrypts the weights of the trained LLM local model using a secret distributed method and transmits them to the blockchain system, so that no single node can understand the information of the entire model.

[0041] The cloud layer (30) includes a model verification unit (31), a blockchain record unit (32), and a model aggregation unit (33). The model verification and aggregation process of the cloud layer (30) is performed as follows. First, the model verification unit (31) performs threshold-based toxicity verification on the weights of the encrypted LLM local models to filter out maliciously compromised models. At this time, the threshold is set by comprehensively considering various performance indicators such as the model's prediction accuracy and loss function value. The blockchain record unit (32) verifies and records the weights of the LLM local models that have passed the toxicity verification through the distributed nodes of the blockchain. The model aggregation unit (33) aggregates the recorded weights of the LLM local models according to the consensus protocol on the blockchain to create an LLM global model. Through this process, compromised models or malicious attacks are blocked, and the integrity of the model aggregation is guaranteed.

[0042] The cloud layer (30) can be flexibly implemented in a traditional centralized cloud server environment or a distributed blockchain network environment. In a traditional cloud server environment, the model verification unit (31) performs toxicity verification of the LLM local model using the high-performance computing resources of the server, and the blockchain record unit (32) securely records the verified model weights in conjunction with a private blockchain network. On the other hand, in a fully distributed environment, each node of the blockchain network performs the model verification, recording, and aggregation functions in a distributed manner, and in this case, the model aggregation unit (33) creates the LLM global model by directly utilizing the consensus mechanism of the blockchain. In both implementation methods, the integrity and security of the system are guaranteed, and the specific implementation environment can be selected according to the requirements of the application field.

[0043] The three-layer structure of the present invention enables efficient distributed learning while ensuring privacy and security throughout the entire process from data collection to model creation. In particular, the local differential privacy of the device layer (10), the SMPC of the edge layer (20), and the connection between the cloud layer (30) and the blockchain system are organically combined to simultaneously secure data usability and security.

[0044] To implement this three-tiered structure, the privacy-preserving federated learning system of the large language model of the present invention is a Blockchain and Federated Learning enabled Large Language Model (BFL-LLM) and includes the following key technical features.

[0045] First, the device layer (10) begins by adding noise while processing device data using local differential privacy and multiple feature encoding. Here, bit distortion is controlled by epsilon (ε value) to maintain a balance between privacy and data usability.

[0046] The anonymized data from the feature encoding unit (11) is reconstructed through statistical aggregation in the data distribution storage unit (21) of the edge layer (20), and the feature distribution is repeatedly updated in the model training unit (22) to ensure accurate model training. In this process, data fluctuations are minimized.

[0047] The federated learning system (1) of the present invention securely performs model verification using blockchain-based federated learning and maintains data integrity and confidentiality through secret sharing and SMPC. Functional shares generate public values ​​by masking private input values, and are then encrypted in the weighted encryption transmission unit (23) and transmitted to the blockchain system.

[0048] In the cloud layer (30), the local model verified through the model verification unit (31) and the blockchain record unit (32) is securely aggregated through additive secret sharing in the blockchain node. Model reconstruction in the model aggregation unit (33) is possible only when all shared values ​​are combined, and the consensus value is determined through the summation and averaging of shared values ​​collected from federated learning participants.

[0049] How these technical features of BFL-LLM are implemented at each layer will be explained in more detail with reference to Fig. 2.

[0050] Figure 2 is a diagram for explaining in detail the overall configuration and data flow of the privacy-preserving federated learning system (1) of the large language model described in Figure 1.

[0051] Referring to FIG. 2, the federated learning system (1) of the present invention is composed of three layers, a device layer (10), an edge layer (20), and a cloud layer (30), as described above, and specific processing steps performed in each layer are shown sequentially.

[0052] The device layer (10) collects data from user devices (User 1-4) and performs a process of anonymizing it. This process consists of multi-feature encoding in the feature encoding unit (11), noise addition (ε) in the noise addition unit (12), and data anonymization through this. In the feature encoding unit (11), various features of the user query data are converted into a single-bit string, and in the noise addition unit (12), noise is added based on the epsilon (ε) parameter determined in the probability determination unit (13). Through this process, data anonymization is completed.

[0053] The present invention enhances privacy protection by adding noise to device data using local differential privacy and multi-feature encoding, thereby preventing adversarial actors from inferring user personal information during transmission at the initial stage of data collection. The user device can control the level of privacy protection by adjusting the epsilon (ε parameter value) of local differential privacy. The probability of privacy protection is defined by the following [Equation 1].

[0054] [Mathematical Formula 1]

[0055]

[0056] Here ε is the privacy protection function, x and x' are the input values, and o is the output value. A low ε value increases the level of data protection, but may lower model accuracy.

[0057] Local differential privacy limits the probability of inferring a specific output value for different input values ​​to a value of ε, which is suitable for environments where user devices do not trust the local model manager.

[0058] This method utilizes a multi-feature encoding technique capable of processing multiple feature data by extending unary encoding, which processes single feature data. The unary encoding of a single feature is expressed as [Equation 2] as follows.

[0059] [Mathematical Formula 2]

[0060]

[0061] Here is the binary bit string representation of the data value str at position i, and n represents the number of possible feature values.

[0062] Multi-feature encoding combines multiple unary coded bit strings into a single bit string and is represented as [Equation 3] as follows.

[0063] [Mathematical Formula 3]

[0064]

[0065] Here, S is a string formed by concatenating the unary encodings of each feature, and the total length is This is the sum of the cardinality of all feature domains.

[0066] This multi-feature encoding technology efficiently manages data privacy for various datasets and enables safe and flexible data representation in federated learning environments.

[0067] The data conversion process based on such multi-feature encoding is performed as follows. When converting each bit of data encoded with multiple features, the bit maintains its original state with a probability of 1-fn, or its value changes from 0 to 1 or from 1 to 0 with a probability of (1 / 2)fn.

[0068] The bit transition probability is limited to the value of ε, and

[0069]

[0070] Satisfies.

[0071] To strike a balance between data protection and usability, the transformation probability fn is set in relation to the ε value. A high ε value reduces noise to increase data usability, while a low ε value increases noise to strengthen personal information protection.

[0072] For example, if data X = (Green, Square, Large) and the probability is set to 0.3, about 1 / 3 of the bits are modified and converted into the encoded data string S = 010010001.

[0073] The edge layer (20) is responsible for processing anonymized data to train an LLM local model and safely transmitting it. The data distributed storage unit (21) reconstructs the anonymized data to provide a foundation for training an LLM local model.

[0074] The next step of local differential privacy is to reconstruct the randomized bit strings for local model training. In a federated learning environment, anonymized user data is transmitted to the edge layer to train the local model, and the global model is trained in the cloud layer (30). The edge layer reconstructs the data by analyzing the transformed bit strings using statistical and probabilistic techniques to determine the data distribution method.

[0075] Figure 3 shows a data reconstruction algorithm performed in the edge layer (20).

[0076] Referring to FIGS. 1 to 3, the data reconstruction process performed in the data distributed storage unit (21) offsets the effect of local differential privacy according to the data reconstruction algorithm shown in FIG. 3 and ensures accurate data reconstruction for effective model learning. The operation process of the data reconstruction algorithm is as follows.

[0077] The prior estimation of an anonymized bit string begins with statistically aggregating the transformed data and performing corrections to offset the randomization introduced by the multi-feature encoding of local difference privacy. Mathematically, the prior estimation is expressed as [Equation 4] as follows.

[0078] [Mathematical Formula 4]

[0079]

[0080] Here, Cn(i) is the number of times the i-th bit in user data is set from 0 to 1, and bstr(i) represents the binary state.

[0081] The correction uses the following [Equation 5] to adjust the bias caused by randomization.

[0082] [Mathematical Formula 5]

[0083]

[0084] Here represents the guaranteed number of i-th bits, corrects distortion caused by the bit flipping probability 0.5fn, and aligns the observed data to the actual feature distribution.

[0085] The edge layer estimates the initial distribution of each feature within the dataset using these corrected values, which can be expressed as [Equation 6] as follows, assuming that each feature is independent.

[0086] [Mathematical Formula 6]

[0087]

[0088] To accurately reconstruct anonymized data, the reconstructed feature distribution is the original distribution It is refined to be as similar as possible to, and the probability calculation is calculated as the product of development conditional probabilities expressed by [Equation 7] for each feature as follows.

[0089] [Mathematical Formula 7]

[0090]

[0091] Here, ω represents the conditional probability of a specific feature.

[0092] The feature distribution is iteratively updated by averaging the lagging probabilities for each feature combination, and this process is repeated until the change due to anonymization decreases below a predefined threshold, which indicates convergence.

[0093] Through this iterative refinement process, the accuracy of feature distribution estimation is improved, which serves as the basis for LLM local model learning performed in the model learning unit (22).

[0094] The model learning unit (22) performs model learning based on the reconstructed data. In this process, the model learning unit (22) performs feature distribution estimation, which is done using a secure multi-party computation (SMPC) method. SMPC is a technology that enables multiple nodes at the edge layer to cooperatively learn a model without sharing the original data.

[0095] The fundamental principle of SMPC is to divide the function required for computation into multiple parts and distribute them to each edge node. Each edge node is a function targeting an Abelian group A that guarantees computational consistency and predictability. It holds only a part of. Here, an abelian group is a mathematical structure in which the commutative property holds, enabling safe operations between distributed nodes.

[0096] Each edge node calculates the feature distribution of the data it possesses and processes it using the function shares method. Function shares are expressed as [Equation 8] as follows.

[0097] [Mathematical Formula 8]

[0098]

[0099] Here, n is the number of encoded bits, and [[f]]0 and [[f]]1 represent the partial functions held by each edge node. In this way, each node can identify the feature distribution of the entire data, but it cannot know the original data of other nodes.

[0100] Specifically, each edge node performs partial computations using its own data and collaboratively trains a local LLM model by sharing only the results with other nodes. This SMPC-based distributed training enables effective model training while guaranteeing data privacy.

[0101] The weight encryption transmission unit (23) encrypts the weights of the LLM local model learned during the data processing process and determines a threshold for transmitting them to the blockchain system.

[0102] The cloud layer (30) performs the process of verifying and aggregating the received LLM local models to create an LLM global model.

[0103] FIG. 4 shows a safe model verification algorithm performed in the model verification unit (31) of the cloud layer (30).

[0104] Referring to FIGS. 1, 2 and 4, the model verification unit (31) performs toxicity verification of the LLM local model by extending the principles of SMPC used in the edge layer (20) through a secure model verification algorithm. Specifically, for model verification, the model verification unit (31) masks the private input value (pip) used as a test dataset using a random mask (m). This maintains confidentiality.

[0105] The public value (ip) is calculated as ip = pip + m to securely reconstruct the output share. After data reconstruction, the public input value is converted into an integer value using one-hot encoding to obtain a standardized form for encrypted computation. Through this process, the dataset is encrypted with function shares [[f]]0 and [[f]]1, ensuring confidentiality in collaborative computation between the global model manager and the local model learner.

[0106] Private input values ​​are masked with public values ​​for calculation, and the final output value (f0) is verified based on a threshold set by the model verification unit (31). Models with low performance are subject to inspection or rejection, and only verified models are aggregated in the cloud layer (30) to contribute to the global model.

[0107] The model verification unit (31) performs toxicity verification on the weights of the encrypted LLM local models received during the global model aggregation stage to filter out maliciously compromised models.

[0108] The blockchain record book (32) verifies and records the weights of LLM local models that have passed the toxicity verification in the local model verification stage through the distributed nodes of the blockchain. In this process, additive secret sharing and blockchain technology are utilized to ensure that model aggregation is performed safely without exposing confidential data to unauthorized user devices.

[0109] FIG. 5 shows a secure aggregation algorithm performed in the model aggregation unit (33) of the cloud layer (30).

[0110] Referring to FIGS. 1, 2 and 5, the model aggregation unit (33) performs the following aggregation algorithm to securely aggregate the weights of LLM local models that have passed toxicity verification and are recorded on the blockchain. Specifically, after verifying each local model, the blockchain record unit (32) records the verified shared value to the blockchain node (Block n It is transmitted to ), and the model aggregation unit (33) performs aggregation.

[0111] Access to the model's encrypted shared values ​​is restricted to blockchain nodes and the local model only, maintaining confidentiality. Additive secret sharing is used to securely aggregate the model, distributing secrets among all participants (edge ​​nodes) using a high prime number P, and the shared values ​​sec1, sec2, ..., sec n It must satisfy the following [Equation 9].

[0112] [Mathematical Formula 9]

[0113]

[0114] The shared values ​​obtained from each participant in the federated learning process are aggregated to form the global model gb, which begins after the blockchain node receives all verified model shares from each local entity (edge ​​node). Each local model participant (edge ​​node) measures the shared value for each parameter or weight of the global model as follows using [Equation 10].

[0115] [Mathematical Formula 10]

[0116]

[0117] Here Lm s is the entity that participated in the shared value calculation, n is the total number of participants, sh ij is the shared value of the j-th weight provided by the i-th participant.

[0118] The model aggregation unit (33) generates an LLM global model by measuring each participant's share during the global model training phase. The model aggregation unit (33) determines the consensus value in the global model by summing and averaging the shared values ​​of all weights. This is expressed by the following [Equation 11].

[0119] [Mathematical Formula 11]

[0120]

[0121] Here represents the final consensus value for the j-th weight of the global model.

[0122] Through this hierarchical structure and step-by-step processing, the present invention enables effective distributed learning while preserving data privacy. In particular, the multi-feature encoding-based local differential privacy of the device layer (10), the SMPC-based distributed learning of the edge layer (20), and the blockchain-based verification of the cloud layer (30) are organically linked to ensure the safety of the entire system.

[0123] FIG. 6 is a flowchart showing the overall flow of a privacy-preserving federated learning method for a large language model according to another embodiment of the present invention.

[0124] Referring to FIG. 6, in the method of the present invention, user data is first collected (S10). Original data required for learning is collected from user devices of the device layer (10).

[0125] Next, anonymized data is generated by applying a Local Differential Privacy technique that adds noise based on Multi-feature encoding to the collected data (S20). In this step, the feature encoding unit (11) converts multiple features of the collected data into a single-bit string using a Multi-feature encoding method, and the noise addition unit (12) performs anonymization by adding noise that changes the bit value according to a probability set for each bit of the single-bit string. At this time, the probability determination unit (13) determines the probability of changing the bit value for adding noise based on the epsilon (ε) parameter value of the Local Differential Privacy.

[0126] Next, an LLM local model is trained using a Secure Multi-Party Computation (SMPC) method based on the anonymized data, and the weights of the trained LLM local model are transmitted to the blockchain system in an encrypted state (S30). In this step, the data distributed storage unit (21) divides and stores the anonymized data among multiple edge nodes, and the model training unit (22) trains the LLM local model while the edge nodes do not share the original data but only share the computation results using the Secure Multi-Party Computation (SMPC) method. Subsequently, the weight encryption transmission unit (23) encrypts the weights of the trained LLM local model using a secret distributed method and transmits them to the blockchain system.

[0127] Next, toxicity verification is performed on the weights of the encrypted LLM local model (S40). In this step, the model verification unit (31) performs threshold-based toxicity verification to filter out maliciously compromised models.

[0128] Finally, the weights of the LLM local models that have passed the toxicity verification are aggregated on the blockchain to create an LLM global model (S50). In this step, the blockchain record unit (32) verifies and records the weights of the LLM local models that have passed the toxicity verification through the distributed nodes of the blockchain, and the model aggregation unit (33) aggregates the recorded weights of the LLM local models according to the consensus protocol on the blockchain to create an LLM global model.

[0129] Through this stepwise processing, effective LLM model training is possible while preserving data privacy, and security mechanisms at each stage are organically combined to guarantee the safety of the entire system.

[0130] Looking more specifically at the data anonymization processing method in the device layer (10), the feature encoding unit (11) converts multiple features of the collected user data into a single-bit string using a multi-feature encoding method. For example, when processing text data of LLM, various features such as words, parts of speech, and contextual information are each converted into binary bit sequences and then concatenated into a single string. The noise addition unit (12) performs anonymization by adding noise that changes from 0 to 1 or from 1 to 0 according to a set probability for each bit of the converted single-bit string. At this time, the probability determination unit (13) determines the probability of changing the bit value for adding noise based on the epsilon (ε) parameter value of Local Differential Privacy, and the smaller the ε value, the stronger the privacy protection.

[0131] The distributed learning method in the edge layer (20) is performed as follows. The data distributed storage unit (21) divides and stores the anonymized data received from the device layer (10) among multiple edge nodes. The model learning unit (22) utilizes a function secret sharing method to learn the LLM local model using a secure multi-party computation (SMPC) method. At this time, each edge node holds only a subset of the entire data and learns the LLM local model by sharing only the computation results without sharing the original data. In this way, cooperative learning is possible without any single node having access rights to the entire data.

[0132] The weight encryption transmission unit (23) encrypts the weights of the LLM local model learned at each edge node using a secret distribution method and transmits them to the blockchain system. This secure multi-party computation (SMPC) method enables each edge node to cooperatively learn the LLM local model while holding only a portion of the functions required for computation and sharing only the computation results. The weights transmitted in an encrypted state ensure that no single node can ascertain the information of the entire model.

[0133] The method for evaluating and aggregating models in the cloud layer (30) proceeds in the following steps. First, the model verification unit (31) performs threshold-based toxicity verification on the weights of the encrypted LLM local models transmitted from the edge layer (20) to filter out maliciously compromised models. At this time, the threshold is set by comprehensively considering various performance indicators such as the prediction accuracy and loss function value of the LLM model. The blockchain record unit (32) verifies and records the weights of the LLM local models that have passed the toxicity verification through the distributed nodes of the blockchain. Finally, the model aggregation unit (33) aggregates the recorded weights of the LLM local models according to the consensus protocol on the blockchain to create an LLM global model.

[0134] Figure 7 is a graph showing the accuracy of the model according to the privacy level (ε) using the Wikipedia dataset. Here, a smaller ε value indicates stronger privacy protection, and the BFL-LLM model (blue line), representing the federated learning system of the present invention, shows superior accuracy compared to other existing models across the entire ε range. In particular, it ensures an appropriate level of privacy while achieving high accuracy of 90% and 91% when the ε value is 0.6 and 0.7, respectively.

[0135] Figure 8 shows the number of communication rounds according to privacy levels in the same dataset. A communication round refers to the number of data exchanges required for model training, and the method of the present invention (blue line) requires the fewest communication rounds for all privacy levels. This demonstrates that the present invention can minimize the amount of data transmitted while realizing efficient distributed learning.

[0136] Referring to FIGS. 7 and 8, the present invention has the following advantages compared to existing methods. First, the degradation of accuracy is relatively small even when the level of privacy protection increases (as the value of ε decreases). This means that the multi-feature encoding-based local differential privacy method of the present invention provides effective privacy protection while preserving the usefulness of the data. Second, it also shows excellent performance in terms of communication efficiency, which proves that local model learning of the edge layer (120) in the 3-layer structure is effectively performed. In particular, when the value of ε is between 0.6 and 0.7, an optimal balance point can be found in both accuracy and communication efficiency.

[0137] Figures 7 and 8 show the results of evaluating the performance of the present invention on the Wikipedia dataset. Figure 7 shows the change in model accuracy according to the privacy level (ε), and the method of the present invention ensures an appropriate level of privacy while achieving high accuracy of 90–92% in the ε = 0.6–0.7 range. Figure 8 shows that the number of communication rounds gradually decreases from an initial approximately 350 to finally about 150.

[0138] The excellence of the present invention has been consistently demonstrated across other datasets. Similar performance patterns were observed in the IMDB movie review dataset and the BookCorpus novel dataset; in particular, the range ε ​​= 0.6–0.7 was identified as the optimal balance point between privacy protection and model performance across all three datasets. This demonstrates that the multi-feature encoding-based local differential privacy scheme proposed in this invention operates stably regardless of the characteristics or scale of the data. Such consistent performance indicates that the present invention can be universally utilized in real-world application environments.

[0139] Figure 9 shows the change in accuracy for the Wikipedia dataset when 20% of the damaged models are included, without applying the model validation process of the federated learning system of the present invention. In Figure 9, Edge nodes 1 through 8 represent the local model accuracy of normal edge nodes, and Malicious nodes 9 and 10 represent the accuracy of the damaged models. The Global model represents the accuracy of the global model that combines these.

[0140] Figure 10 shows the change in accuracy for the Wikipedia dataset when 40% of the models are damaged without applying the model validation process of the federated learning system of the present invention. Figure 10 shows the normal edge nodes, damaged nodes, and the change in accuracy of the global model, similar to Figure 9.

[0141] Referring to Figures 9 and 10, it can be seen that the performance of the system deteriorates significantly as the proportion of compromised models increases. In Figure 9, the accuracy of the global model remains at approximately 65% ​​when 20% of the models are compromised, whereas in Figure 10, the accuracy of the global model drops to approximately 54% when 40% of the models are compromised. This demonstrates that the impact of adversarial attacks becomes more severe as the proportion of compromised models increases.

[0142] Of particular note is that the accuracy of malicious nodes remains very low at 30-40%, continuously degrading the performance of the entire system. These results demonstrate that without security model validation, the system can be vulnerable to adversarial attacks.

[0143] Similar trends are observed in experiments using the IMDB and BookCorpus datasets. Specifically, including a 20% corrupted model results in a 14% and 16% decrease in accuracy, respectively, while including a 40% corrupted model results in a 43% and 45% decrease in accuracy, respectively. This demonstrates that the negative impact of corrupted models on system performance is consistent regardless of the type of dataset.

[0144] Figure 11 shows the change in accuracy for the Wikipedia dataset when 20% of damaged models are included, with the model validation process of the federated learning system of the present invention applied. In Figure 11, Edge nodes 1 through 8 represent the local model accuracy of normal edge nodes, and Malicious nodes 9 and 10 represent the accuracy of damaged models. The Global model represents the accuracy of the global model that combines these.

[0145] Figure 12 shows the change in accuracy for the Wikipedia dataset when 40% of the damaged models are included, with the model validation process of the federated learning system of the present invention applied. Figure 12 shows the normal edge nodes, damaged nodes, and the change in accuracy of the global model, similar to Figure 11.

[0146] Referring to FIGS. 11 and 12, it can be seen that when the security verification mechanism of the present invention is applied, the global model maintains high accuracy regardless of the proportion of compromised models. In FIG. 11, the accuracy of the global model is maintained at approximately 92% even when 20% of compromised models are included, and in FIG. 12, the accuracy of the global model is maintained at 91% even when 40% of compromised models are included. This demonstrates that the security verification mechanism of the present invention effectively blocks the influence of compromised models.

[0147] Of particular note is that the low accuracy of malicious nodes does not affect the performance of the global model. This demonstrates that the threshold-based verification and blockchain-based secure aggregation method of the present invention are operating effectively.

[0148] The effectiveness of this security mechanism is equally observed in experiments using the IMDB dataset and the BookCorpus dataset. Even when 40% of the models were compromised, high accuracy of 93% was maintained on the IMDB dataset and 89% on the BookCorpus dataset, demonstrating that the security mechanism of the present invention operates stably regardless of the characteristics of the dataset.

[0149] The foregoing description of the present invention is for illustrative purposes only, and those skilled in the art will understand that other specific forms can be easily modified without altering the technical spirit or essential features of the present invention. Therefore, the embodiments described above should be understood as illustrative in all respects and not restrictive. For example, each component described as a single unit may be implemented in a distributed manner, and components described as distributed may likewise be implemented in a combined form.

[0150] The scope of the present invention is defined by the claims set forth below, and all modifications or variations derived from the meaning and scope of the claims and equivalent concepts thereof should be interpreted as being included within the scope of the present invention.

[0151]

[0152] [Explanation of the symbol]

[0153] Privacy-preserving federated learning system for large language models (1)

[0154] device layer (10)

[0155] Feature encoding section (11)

[0156] Noise addition part (12)

[0157] Probability determination unit (13)

[0158] Edge layer (20)

[0159] Data distribution storage unit (21)

[0160] Model learning unit (22)

[0161] Weighted encryption transmission unit (23)

[0162] Cloud layer (30)

[0163] Model verification unit (31) blockchain record unit (32)

[0164] Model aggregation unit (33)

Claims

1. In a privacy-preserving federated learning system for a Large Language Model (LLM), A device layer that collects user data, generates anonymized data by applying a Local Differential Privacy technique that adds noise based on Multi-feature encoding to the collected data, and provides the anonymized data; An edge layer that trains an LLM local model using a Secure Multi-Party Computation (SMPC) method based on the anonymized data and encrypts and transmits the weights of the trained LLM local model; and A privacy-preserving federated learning system for a large language model, characterized by including: a cloud layer that performs toxicity verification on the weights of the encrypted LLM local models and aggregates the weights of the LLM local models that passed the toxicity verification on a blockchain to generate an LLM global model.

2. In Paragraph 1, The above device layer is, A feature encoding unit that converts multiple features of the collected data into a single-bit string using a multi-feature encoding method; A privacy-preserving federated learning system for a large language model, characterized by including a noise addition unit that performs anonymization by adding noise that changes bit values ​​according to a probability set for each bit of the single-bit string.

3. In Paragraph 1, The above device layer is, A privacy-preserving federated learning system for a large language model, characterized by further including a probability determination unit that determines the bit value change probability for adding the above noise based on the epsilon (ε) parameter value of the local difference privacy.

4. In Paragraph 1, The above edge layer is, A data distributed storage unit that divides and stores the above-mentioned anonymized data into multiple edge nodes; A model training unit that trains an LLM local model while the above edge nodes do not share the original data but share only the computation results in a secure multi-party computation (SMPC) manner; and A privacy-preserving federated learning system for a large language model, characterized by including a weight encryption transmission unit that encrypts the weights of the above-mentioned learned LLM local model in a secret distributed manner and transmits them to a blockchain system.

5. In Paragraph 1, The above cloud layer is, A model validation unit that filters out maliciously compromised models by performing threshold-based toxicity verification on the weights of the above-mentioned encrypted LLM local model; A blockchain record that verifies and records the weights of the LLM local models that have passed the above toxicity verification through distributed nodes of the blockchain; and A privacy-preserving federated learning system for large language models, characterized by including a model aggregation unit that aggregates the weights of the recorded LLM local models according to a consensus protocol on a blockchain to generate an LLM global model.

6. In a privacy-preserving federated learning method for a Large Language Model (LLM), Step of collecting user data; A step of generating anonymized data by applying a Local Differential Privacy technique that adds noise based on Multi-feature encoding to the collected data; A step of training an LLM local model using a Secure Multi-Party Computation (SMPC) method based on the anonymized data, and transmitting the weights of the trained LLM local model to a blockchain system in an encrypted state; A step of calculating an output value while maintaining confidentiality using a public value obtained by applying a random mask to the weights of the above-mentioned encrypted LLM local model as input, and performing toxicity verification by comparing the output value with a preset standard; and A privacy-preserving federated learning method for large language models, characterized by including the step of generating an LLM global model by aggregating the weights of LLM local models that have passed the above toxicity verification on a blockchain.

7. In Paragraph 6, The step of generating the above anonymized data is, A step of converting multiple features of the collected data into a single bit string using a multi-feature encoding method; A step of performing anonymization by adding noise that changes the bit value according to a probability set for each bit of the single bit string; and A privacy-preserving federated learning method for a large language model, characterized by including the step of determining the bit value change probability for adding the above noise based on the epsilon (ε) parameter value of the local difference privacy.

8. In Paragraph 6, The step of transmitting to the blockchain system is, A step of dividing and storing the anonymized data into multiple edge nodes; A step of training an LLM local model in which the above edge nodes do not share the original data but share only the computation results in a secure multi-party computation (SMPC) manner; and A privacy-preserving federated learning method for a large language model, characterized by including the step of encrypting the weights of the above-mentioned learned LLM local model using a secret distributed method and transmitting them to a blockchain system.

9. In Paragraph 6, The step of performing the above toxicity verification is, A privacy-preserving federated learning method for large language models characterized by filtering out maliciously compromised models by performing threshold-based toxicity verification on the weights of the above-mentioned encrypted LLM local models.

10. In Paragraph 6, The step of creating an LLM global model is, A step of verifying and recording the weights of the LLM local model that has passed the above toxicity verification through distributed nodes of the blockchain; and A privacy-preserving federated learning method for a large language model, characterized by including the step of generating an LLM global model by aggregating the weights of the LLM local models recorded above according to a consensus protocol on a blockchain.

Images