Electronic device and methods for fine-tuning foundation models using a compiler system

Abstract

Embodiments disclosed herein relate to an electronic device (200) and methods (700). The method includes obtaining a first data from one or more trusted applications of one or more first parties and a second data from one or more untrusted applications of one or more second parties. The method includes filtering the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data. The method includes encrypting the first data and the filtered second data. The method includes transferring the encrypted data to a Virtual Machine (VM). The method includes fine-tuning at least one foundation model, by the VM, using the encrypted data.

Description

ELECTRONIC DEVICE AND METHODS FOR FINE-TUNING FOUNDATION MODELS USING A COMPILER SYSTEM

[0001] Embodiments disclosed herein relate to Large Language Models (LLM), and more particularly to an electronic device and methods for protecting LLM fine-tuning, and providing secured data inference on one or more functional models using a compiler system.

[0002] Data leaks impact Large Language Models (LLM) and long term business growth. Data leaks happen when sensitive information is exposed either intentionally or unintentionally. Risks of data leaks via LLM include privacy, amplification of disinformation, and intellectual property infringement. For example, LLM trained with personal information has the risk of leaking confidential information, LLMs trained with incorrect information may cause the model to hallucinate and amplify the incorrect information, and LLMs may unintentionally generate copyright information that leads to loss in intellectual property.

[0003] LLMs in general are trained on large dataset for various applications. LLMs require fine-tuning to adapt for a specific task using device specific or smaller subset of data which could be confidential. The process to combine data from multiple competing parties, and also to source their data for a common task can be complex.

[0004] Related methods use a trusted execution environment that provides an isolated environment to run android or mobile applications for runtime execution. However, such methods don't provide a framework to maintain and monitor session. The methods do not provide an Application Programming Interface (API) or secure communication channel across the application for LLM transfer with inference and fine-tuning.

[0005] FIG. 1 depicts an example of critical attack on a functional model during training or fine-tuning, and details on critical components and when the critical components have to be protected.

[0006] Related methods do not collectively fine-tune LLM from multiple similar purpose applications that provide benefits to user. There are known systems that currently share data for training and introduce bias and poison the model. However, there exists no on-device system to utilize the end-end capability of Virtual machine Execution Environment (VEE) to infer and fine-tune the LLM. Further, known solutions do not have the capability to validate and authenticate data.

[0007] Hence, there is a need in the art for solutions which will overcome the above mentioned drawback(s), among others.

[0008] The principal object of embodiments herein is to disclose an electronic device and methods for protecting Large Language Model (LLM) fine-tuning, and providing secured data inference on one or more functional models using a compiler system.

[0009] An object of embodiment herein is to disclose an electronic device and methods for creating and sharing sensitive data from multiple applications to adapt a single foundation model with one or more adapters to leverage the base LLM for fine-tuning.

[0010] An object of embodiment herein is to disclose an electronic device and methods for creating and sharing data from multiple competing applications by preventing various attacks during training and inference, wherein the attacks can be, but not limited to denial of service, data poisoning, and prompt injection.

[0011] An object of embodiment herein is to disclose an electronic device and methods for supporting the virtual environment with fine-tuning capability for base LLM with effective memory management.

[0012] An object of embodiment herein is to disclose an electronic device and methods that utilize a framework for evaluating data for different LLM attacks, and performing post validation utilizing the evaluated data for fine-tuning in safe ecosystem.

[0013] Accordingly, the embodiments herein provide a method. The method comprises obtaining a first data from one or more authenticated applications of one or more first parties. The method comprises obtaining a second data from one or more unauthenticated applications of one or more external parties. The method filtering the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data. The method comprises encrypting the first data and the filtered second data. the method comprises transferring the encrypted data to a Virtual Machine (VM). The method comprises fine-tuning at least one foundation model, by the VM, using the encrypted data.

[0014] Accordingly, the embodiments herein provide an electronic device which comprises a processor and a memory module. The processor is coupled with the memory module. The processor is configured to obtain a first data from one or more authenticated applications of one or more first parties. The processor is configured to obtain a second data from one or more unauthenticated applications of one or more external parties. The processor is configured to filter the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data. The processor is configured to encrypt the first data and the filtered second data. The processor is configured to transfer the encrypted data to the VM. The processor is configured to fine-tune at least one foundation model, by the VM, using the encrypted data.

[0015] Accordingly, the embodiments herein provide a computer-readable storage media storing one or more computer programs including computer-executable instructions that, when executed by one or more processors of an electronic device individually or collectively, cause the electronic device to perform the method provided.

[0016] These and other aspects of the example embodiments herein will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following descriptions, while indicating example embodiments and numerous specific details thereof, are given by way of illustration and not of limitation. Many changes and modifications may be made within the scope of the example embodiments herein without departing from the spirit thereof, and the example embodiments herein include all such modifications.

[0017] Embodiments herein are illustrated in the accompanying drawings, throughout which like reference letters indicate corresponding parts in the various figures. The embodiments herein will be better understood from the following description with reference to the following illustrator drawings. Embodiments herein are illustrated by way of examples in the accompanying drawings, and in which:

[0018] FIG. 1 depicts an example of critical attack on a functional model during training or fine-tuning, and details on critical components and when the critical components have to be protected, according to existing arts;

[0019] FIG. 2 depicts an electronic device for fine-tuning a foundation model using a compiler system, according to an embodiment as disclosed herein;

[0020] FIG. 3 depicts an architecture of a Secure LLM Compiler System (SLCS) for providing communication and sharing of data between normal and secure world, according to an embodiment as disclosed herein;

[0021] FIG. 4 depicts a block diagram of an SLCS framework, according to an embodiment as disclosed herein;

[0022] FIG. 5 depicts a block diagram of an SLCS service module, according to an embodiment as disclosed herein;

[0023] FIG. 6 depicts a block diagram of the SLCS ML service module, according to an embodiment as disclosed herein;

[0024] FIG. 7 depicts a method for fine-tuning a foundation model using the SLCS, according to an embodiment as disclosed herein;

[0025] FIG. 8 depicts a method for enhancing a multi-party prediction for Artificial Intelligence (AI) based services, according to an embodiment as disclosed herein;

[0026] FIG. 9 depicts a method for secure fine-tuning of multiple foundation models in a virtual platform, according to an embodiment as disclosed herein;

[0027] FIG. 10 depicts an example block diagram for fine-tuning a foundation model with one or more adapters using the SLCS, according to an embodiment as disclosed herein;

[0028] FIG. 11 depicts another example block diagram for fine-tuning a foundation model using the SLCS, according to an embodiment as disclosed herein;

[0029] FIG. 12 depicts an example block diagram of identifying and preventing data poisoning using the secure VM, according to an embodiment as disclosed herein;

[0030] FIG. 13 depicts an example flow representation of filtering data for protecting model fine-tuning, according to an embodiment as disclosed herein;

[0031] FIG. 14 depicts an example block diagram of LLM protection with LLM encoder and LLM foundation model in an execution environment module, while adapter model in an virtual environment module, according to an embodiment as disclosed herein;

[0032] FIG. 15 depicts an example block diagram of LLM protection with LLM foundation model in the execution environment module, while LLM encoder and adapter model in the virtual environment module, according to an embodiment as disclosed herein; and

[0033] FIG. 16 depicts a use case of fine-tuning a physical fitness estimation model, according to an embodiment as disclosed herein.

[0034] FIG. 17 depicts a use case of fine-tuning for tracking user smart phone activities model, according to an embodiment as disclosed herein.

[0035] FIG. 18 depicts a use case of fine-tuning for tracking user mental wellbeing model, according to an embodiment as disclosed herein.

[0036] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.

[0037] For the purposes of interpreting this specification, the definitions (as defined herein) will apply and whenever appropriate the terms used in singular will also include the plural and vice versa. It is to be understood that the terminology used herein is for the purposes of describing particular embodiments only and is not intended to be limiting. The terms "comprising", "having" and "including" are to be construed as open-ended terms unless otherwise noted.

[0038] The words / phrases "exemplary", "example", "illustration", "in an instance", "and the like", "and so on", "etc.", "etcetera", "e.g.," , "i.e.," are merely used herein to mean "serving as an example, instance, or illustration." Any embodiment or implementation of the present subject matter described herein using the words / phrases "exemplary", "example", "illustration", "in an instance", "and the like", "and so on", "etc.", "etcetera", "e.g.," , "i.e.," is not necessarily to be construed as preferred or advantageous over other embodiments.

[0039] Embodiments herein may be described and illustrated in terms of blocks which carry out a described function or functions.　These blocks, which may be referred to herein as managers, units, modules, hardware components or the like, are physically implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by a firmware. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like.　The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block.　Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of the disclosure.　Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the disclosure.

[0040] It should be noted that elements in the drawings are illustrated for the purposes of this description and ease of understanding and may not have necessarily been drawn to scale. For example, the flowcharts / sequence diagrams illustrate the method in terms of the steps required for understanding of aspects of the embodiments as disclosed herein. Furthermore, in terms of the construction of the device, one or more components of the device may have been represented in the drawings by conventional symbols, and the drawings may show only those specific details that are pertinent to understanding the present embodiments so as not to obscure the drawings with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein. Furthermore, in terms of the system, one or more components / modules which comprise the system may have been represented in the drawings by conventional symbols, and the drawings may show only those specific details that are pertinent to understanding the present embodiments so as not to obscure the drawings with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

[0041] The accompanying drawings are used to help easily understand various technical features and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. As such, the present disclosure should be construed to extend to any modifications, equivalents, and substitutes in addition to those which are particularly set out in the accompanying drawings and the corresponding description. Usage of words such as first, second, third etc., to describe components / elements / steps is for the purposes of this description and should not be construed as sequential ordering / placement / occurrence unless specified otherwise.

[0042] The embodiments herein disclose an electronic device and methods that facilitate creation and sharing of sensitive data from multiple applications to adapt a single foundation model with one or more adapters to leverage the base Large Language Model (LLM) for fine-tuning. Referring now to the drawings, and more particularly to FIGS. 2 through 16, where similar reference characters denote corresponding features consistently throughout the figures, there are shown embodiments.

[0043] FIG. 2 depicts an electronic device 200 for fine-tuning a foundation model using a compiler system. The electronic device 200 comprises a processor 202, a communication module 204, and a memory module 206.

[0044] In an embodiment herein, the processor 202 can evaluate data for different LLM attacks and can perform post validation utilizing the evaluated data for fine-tuning in safe ecosystem. The processor 202 can collect sensitive data across multiple applications and protect the data before and during training. The processor 202 can provide an end-to-end pipeline for sensitive data inference with protection. The processor 202 can further comprise an execution environment module 208, and a virtual environment module 210 or a Virtual Machine (VM).

[0045] In an embodiment herein, the execution environment module 208 can collect at least one of a data, and a model request from one or more applications of one or more parties. In an embodiment herein, the execution environment module 208 can expose at least one Application Programming Interface (API) to be used by the applications for collecting at least one of the data, and the model request. The data can be collected in at least one form such as a text, an image, and an audio. The model request collected can be at least one of a train request, and an infer request. The train request is for fine-tuning at least one foundation model. The infer request is to infer from the fine-tuned foundation model. The execution environment module 208 can manage and validate the data, and the model request collected via at least one API.

[0046] In an embodiment herein, the execution environment module 208 can manage at least one of a Machine Learning (ML) session, and a data session corresponding to the collected at least one of the data, and the model request for interacting with the applications. The execution environment module 208 can create, and manage a set of policies for the data for at least one application for restricting other parties from accessing the data.

[0047] In an embodiment herein, the execution environment module 208 can identify data poisoning from the collected data, and filter the collected data. The data poisoning may be an attack method where malicious or incorrect data is intentionally inserted into training dataset to mislead or manipulate an AI model's behavior. The data poisoning can be identified by evaluating data distribution of the collected data, and comparing the evaluated data distribution with an original data distribution state. The execution environment module 208 can encrypt at least one of the filtered data, and the model request. The execution environment module 208 can transfer the encrypted at least one of the data, and the model request of the virtual environment module 210.

[0048] In an embodiment herein, the virtual environment module 210 can fine-tune at least one foundation model using the encrypted at least one of the data, and the model request

[0049] In an embodiment herein, the virtual environment module 210 can receive the encrypted at least one of the data, and the model request from a service execution location. The virtual environment module 210 can decrypt the encrypted at least one of the data, and the model request when required. The virtual environment module 210 can fine-tune the foundation model using the decrypted at least one of the data, and the model request by utilizing a model and training management for protecting the foundation model from theft and denial of service. The fine-tuned foundation model can be encrypted and transmitted back to the execution environment module 208.

[0050] In an embodiment herein, the virtual environment module 210 can store, and manage the at least one of the data, and the model request in the fine-tuned foundation model. In an embodiment herein, the virtual environment module 210 can validate a plurality of LLM data, and a plurality of model attacks, during training, for identifying at least one of data poisoning, system overload, anomalies, and bias. The plurality of LLM data is validated by performing one or more filtering methods. The filtering methods comprise at least one of malicious data filtering, anomaly detection, bias verification, pattern analysis, and distribution validation to protect the fine-tuning of the foundation model.

[0051] In an embodiment herein, the compiler system is a Secure LLM Compiler System (SLCS). The compiler system comprises one or more data APIs, and one or more inference APIs for inferring the fine-tuned foundation model.

[0052] In an embodiment herein, the execution environment module 208 can receive a first data of trusted nature from a first party service provider module, where the first party service provider module can be located in the service execution location of the electronic device 200. In an embodiment, the trusted nature may include one or more authenticated applications. The service execution location is located in the execution environment module 208. The execution environment module 208 can receive a second data of untrusted nature from a second party service provider module, where the second party service provider module can be located in the service execution location of the electronic device 200. In an embodiment, the untrusted nature may include one or more unauthenticated applications. The first party service provider module may receive the first data. The second party service provider module receive the second data from at least one of one or more authenticated applications, and a server. The one or more authenticated applications may be included in at least one of second parties or third party. The execution environment module 208 can validate and filter the second data of untrusted nature. The execution environment module 208 can transfer the first data and the processed second data into a database located in a secure location of the electronic device 200. The secure location of the electronic device 200 is located in the virtual environment module 210.

[0053] In an embodiment herein, the virtual environment module 210 can fine-tune a base model present in a secure or normal execution environment, using both the first data and the validated second data. The virtual environment module 210 can share the fined-tuned base model with at least one learning and inference API that predicts insights (e.g., prediction, summarization, classification, etc..) for a first party service, and a second party service. The fined-tuned base model is located in the secure location of the electronic device 200. The first party service, and the second party service can be different business entities that provide data of different applications.

[0054] For example, the processor 202 can feed a first data from one or more trusted sources, specific to a user, to a virtual Machine (VM) or the virtual environment module 210 using a data encryption technique. The processor 202 can feed a second data from one or more untrusted sources, specific to the user, to the virtual platform or the virtual environment module 210 by performing one or more security validation techniques. The processor 202 can generate a property record in a database for the collected first data and the second data, and set permission for the collected first data and the second data by one or more foundation models. The processor 202 can schedule fine-tuning of the foundation models using the permission specified first data, and the second data in the database specific to the foundation models.

[0055] In an embodiment herein, the processor 202 can process and execute data of a plurality of modules of the electronic device 200. The processor 202 can be configured to execute instructions stored in the memory module 206. The processor 202 may comprise one or more of microprocessors, circuits, and other hardware configured for processing. The processor 202 can be at least one of a single processer, a plurality of processors, multiple homogeneous or heterogeneous cores, multiple Central Processing Units (CPUs) of different kinds, microcontrollers, special media, and other accelerators. The processor 202 may be an application processor (AP), a graphics-only processing unit (such as a graphics processing unit (GPU), a visual processing unit (VPU)), and / or an Artificial Intelligence (AI)-dedicated processor (such as a neural processing unit (NPU)).

[0056] In an embodiment herein, the plurality of modules of the processor 202 of the electronic device 200 can communicate via the communication module 204. The communication module 204 may be in the form of either a wired network or a wireless communication network module. The wireless communication network may comprise, but not limited to, Global Positioning System (GPS), Global System for Mobile Communications (GSM), Wi-Fi, Bluetooth low energy, Near-field communication (NFC), and so on. The wireless communication may further comprise one or more of Bluetooth, ZigBee, a short-range wireless communication (such as Ultra-Wideband (UWB)), and a medium-range wireless communication (such as Wi-Fi) or a long-range wireless communication (such as 3G / 4G / 5G / 6G and non-3GPP technologies or WiMAX), according to the usage environment.

[0057] In an embodiment herein, the memory module 206 may comprise one or more volatile and non-volatile memory components which are capable of storing data and instructions of the modules of the electronic device 200 to be executed. Examples of the memory module 206 can be, but not limited to, NAND, embedded Multi Media Card (eMMC), Secure Digital (SD) cards, Universal Serial Bus (USB), Serial Advanced Technology Attachment (SATA), solid-state drive (SSD), and so on. The memory module 206 may also include one or more computer-readable storage media. Examples of non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory module 206 may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted to mean that the memory module 206 is non-movable. In certain examples, a non-transitory storage medium may store data that can, over time, change (for example, in Random Access Memory (RAM) or cache).

[0058] FIG. 2 shows example modules of the electronic device 200, but it is to be understood that other embodiments are not limited thereon. In other embodiments, the electronic device 200 may include less or more number of modules. Further, the labels or names of the modules are used only for illustrative purpose and does not limit the scope of the disclosure. One or more modules can be combined together to perform same or substantially similar function in the electronic device 200.

[0059] FIG. 3 depicts an architecture 300 of the Secure LLM Compiler System (SLCS) for providing communication and sharing of data between normal and secure world. The SLCS provides communication between the execution environment module 208, and the virtual environment module 210. The execution environment module 208 comprises an applications and services module 302, an SLCS framework 304, an SLCS service module 306, a Neural Learning Framework (NLF) 308, and a kernel 310.

[0060] In an embodiment herein, the applications and services module 302 collects data, and model requests from one or more applications of one or more parties. The applications and services module 302 filters the collected data by identifying data poisoning. The applications and services module 302 helps to showcase the data generation and interaction.

[0061] In an embodiment herein, the SLCS framework 304 helps to interact with applications, and receive data and API request to communicate with the virtual machine. The SLCS framework 304 further comprises an SLCS Software Development Kit (SDK) 318, and an SLCS manager 320.

[0062] FIG. 4 depicts a block diagram of the SLCS framework 304. The SLCS framework 304 communicates with at least one application to interact with data sharing for virtual machine, and training.

[0063] In an embodiment herein, the SLCS SDK 318 exposes APIs to be integrated with the application. The application uses the exposed SDK APIs to share data, initiate request, and obtain results. The SLCS SDK 318 acts as an entry point for the SLCS framework 304.

[0064] In an embodiment herein, the SLCS manager 320 manages application connections received via SDK APIs, and validates the caller and data received. The SLCS manager 320 acts an entry point for the SLCS service. Response from the SLCS service is communicated to caller via the SLCS manager 320. Session instance to unique identifier mapping is created to manage the application instance. This helps to seamlessly manage multiple requests across device and applications.

[0065] In an embodiment herein, the SLCS service module 306 further comprises a Machine Learning (ML) session 322, a data session 324, a crypto engine 326, and a policy manager 328.

[0066] In an embodiment herein, the ML session 322 receives at least one training or inferring request as an input. The ML session 322 creates, monitors, and destroys a new session for each training or fine-tuning requests. The ML session 322 holds information about a requested model training and history to communicate with application and secure world. For example, the ML session 322 can schedule a model training job at a particular time. The ML session 322 can cancel a scheduled training. The ML session 322 can start a training model on demand and return the trained model instantly. For example, the ML session 322 can create a session for inference. The ML session 322 can destroy the created session. The ML session 322 can make an inference on the trained model. For example, the ML session 322 can get a service instance for supporting APIs. The ML session 322 can return a service bind status for supporting APIs.

[0067] In an embodiment herein, the data session 324 receives at least one application data and / or inference data. The data session 324 creates and, destroys a new session for each data fetching or storing request. The data session 324 holds information about the data shared and its origin for fine-tuning in secure world. For example, the data session 324 can creates a session for the client for data transfer. The data session 324 can close the session object and close all file descriptors opened in the session. For example, the data session 324 can write data on data blob, and return unique ID of dataset / model for data storage. The data session 324 can provide the current size of the file descriptor for data storage. The data session 324 can delete data and return result for data storage. For example, the data session 324 can get a service instance for supporting APIs. The data session 324 can return a service bind status for supporting APIs.

[0068] In an embodiment herein, the crypto engine 326 is used to create end-to-end encrypted pipeline to share data and model request. The crypto engine 326 helps in decryption of the data from application and re-encryption of the shared information as required by the virtual environment module 210. For example, the crypto engine 326 can encrypt the data in an ML trainer data buffer using the mentioned algorithm. The crypto engine 326 can decrypt the data from the ML trainer data buffer.

[0069] In an embodiment herein, the policy manager 328 receives at least one data and / or policy validation API request. The policy manager 328 creates and manages set of policies like one data and one training to restrict and protect the model request and data. The policy manager 328 manages to monitor and apply existing and new policies as required by the SLCS framework 304. For example, one data can be used by its own application for training and inference.

[0070] FIG. 5 depicts a block diagram of the SLCS service module 306. In an embodiment herein, the SLCS service module 306 validates the session's request and makes decision to process the request or data. The SLCS service module 306 maintains different session instance for ML and data to track the training request, and data storage request respectively using the ML session 322, and the data session 324. The crypto engine 326 helps to validate the data and request shared from the application. The crypto engine 326 also helps to protect any communication between the SLCS service module 306 and the virtual environment module 210. The SLCS service module 306 communicates with the virtual environment module 210 to store and secure data.

[0071] In an embodiment herein, the NLF 308 can receive data as input, and execute Neural Network (NN) layers for the given application input in a Neural Processing Unit (NPU). The NLF 308 can provide a model result as a data output.

[0072] In an embodiment herein, the kernel 310 can receive an application or service request as an input. The kernel 310 can interact, and manage memory and system device. The kernel 310 can further provide the hardware data as output.

[0073] In an embodiment herein, the virtual environment module 210 further comprises a SLCS ML service module 312, a VM storage module 314, and a Virtual Neural Layer Framework (VNLF) 316.

[0074] In an embodiment herein, the SLCS ML service module 312 can receive an input of data, and API request. FIG. 6 depicts a block diagram of the SLCS ML service module 312. The SLCS ML service module 312 can store the shared data securely, and utilize the stored data for tasks of ML training. The SLCS ML service module 312 can store data securely, and fine-tune Large Language Model (LLM) using personalized data. This helps any two or more business entities to share their data and create one personalized model for one single purpose. The SLCS ML service module 312 can provide an output of inference data, encrypted data and ML model. The SLCS ML service module 312 further comprises a data pre-processor 330, a Virtual Machine (VM) crypto engine 332, an ML manager 334, a ML policy manager 336, a Database (DB) manager 338, and a learning and inference API module 340.

[0075] In an embodiment herein, the data pre-processor 330 can receive an input of data, and an API request. The data pre-processor 330 can validate and filter data from anomaly, bias and poisoning. The data pre-processor 330 can provide an output of anomaly detection results. The data pre-processor 330 helps to validate the data with no abnormalities that include data poisoning, data validation, bias verification, and filtering and cleaning of malicious labels.

[0076] In an embodiment herein, the VM crypto engine 332 includes a key management module. The VM crypto engine 332 needs to store the end-to-end encryption pipeline securely to decrypt and process information when required. Therefore, the key management module handles creation and maintaining of unique keys for each use case. The VM crypto engine 332 helps in decryption of a virtual environment specific encryption done by the execution environment SLCS service. The decrypted data can be used for fine-tuning or real time inference as per the request. The VM crypto engine 332 also helps in encrypting the inference results to be communicated with a trusted execution environment.

[0077] In an embodiment herein, the ML manager 334 receives an input of the encrypted data, and stores and manages the received information on the fine-tuned model.

[0078] In an embodiment herein, the ML policy manager 336 safely holds the policy to protect from attackers, and withholds the policy in secure world to manage multiple data and training sessions.

[0079] In an embodiment herein, the DB manager 338 manages information about the shared data that includes type, size, and format, and so on.

[0080] In an embodiment herein, the ML manager 334, the ML policy manager 336, and the DB manager 338 manages training, inference or data store request shared by the execution environment module 208 within the virtual environment module 210.

[0081] In an embodiment herein, the learning and inference API module 340 receives an input of data, and API Request, and provides support for existing Knox and other third party learning and inference APIs for model fine-tuning and inference. The learning and inference API module 340 helps to fine-tune given data and the model. Additionally, learning and inference API module 340 helps to infer from fine-tuned model. The learning and inference API module 340 provides an output of inference results.

[0082] In an embodiment herein, the VM storage module 314 comprises an application and service DB 342, an adapter model DB 344, a data DB 346, and a training DB 348.

[0083] In an embodiment herein, the application and service DB 342 is a database which is configured to maintain the interacted list of application and services for data and model fine-tuning.

[0084] In an embodiment herein, the adapter model DB 344 is a database which is configured to store the fine-tuned model for all applications and services. The fine-tuned model can be stored in Binary Large OBject (BLOB) or other formats. The fine-tuned model can be stored with mapping to its application and other model information.

[0085] In an embodiment herein, the data DB 346 is a database which is configured to manage information about the data and its pre-processing state, and clean-up and use case to be fine-tuned. This helps to save the pre-processed data, and prevents from same pre-processing task repeated for the same dataset.

[0086] In an embodiment herein, the training DB 348 is a database which is configured to track information about the past / on-going / future fine-tuning that are planned and scheduled on the secure world. The training DB 348 is configured to maintain the execution status of the virtual machine, and monitor the current state and the state at which the data / model exists.

[0087] In an embodiment herein, the VNLF 316 can receive data as input, and execute NN layers for the given application input in an NPU.

[0088] FIG. 7 depicts a method 700 for fine-tuning a foundation model using the SLCS. The method 700 comprises obtaining, by the execution environment module 208, a first data from one or more authenticated applications of one or more first parties, as depicted in operation 702. The method 700 comprises obtaining, by the execution environment module 208, a second data from one or more unauthenticated applications of one or more external parties, as depicted in operation 704. The method 700 comprises filtering, by the execution environment module 208, the second data by identifying data poisoning, as depicted in operation 706.

[0089] Thereafter, the method 700 comprises encrypting, by the execution environment module 208, the first data and the filtered second data, as depicted in operation 708. The method 700 comprises transferring, by the execution environment module 208, the encrypted data to the virtual environment module 210, as depicted in operation 710 The method 700 comprises fine-tuning, by the virtual environment module 210, at least one foundation mode using the encrypted data, as depicted in operation 712.

[0090] The various actions in method 700 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 7 may be omitted.

[0091] FIG. 8 depicts a method 800 for enhancing a multi-party prediction for Artificial Intelligence (AI) based services. The method 800 comprises receiving, by the execution environment module 208, a first data of trusted nature from a first party service provider module, as depicted in operation 802. The first party service provider module is located in a service execution location of the electronic device 200. The method 800 comprises receiving, by the execution environment module 208, a second data of untrusted nature from a second party service provider module, as depicted in operation 804. The second party service provider module is located in the service execution location of the electronic device 200.

[0092] Thereafter, the method 800 comprises validating, by the execution environment module 208, and filtering the second data of untrusted nature, as depicted in operation 806. The method 800 comprises transferring, by the execution environment module 208, the first data and the validated and filtered second data into a database, as depicted in operation 808. The database can be at least one of the application and service DB 342, the adapter model DB 344, the data DB 346, and the training DB 348. The database is located in a secure location of the virtual environment module 210.

[0093] The method 800 comprises fine-tuning, by the virtual environment module 210, an LLM which is located in the secure location of the electronic device 200, as depicted in operation 810. The virtual environment module 210 fine-tunes the foundation model or LLM using both the first data and the processed second data. The method 800 comprises sharing, by the virtual environment module 210, the fined-tuned LLM with at least one adapter model, as depicted in operation 812. The adapter model predicts insights for a first party service, and a second party service. The fined-tuned LLM is located in the secure location of the electronic device 200.

[0094] The various actions in method 800 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 8 may be omitted

[0095] FIG. 9 depicts a method 900 for secure fine-tuning of multiple foundation models in a virtual platform. The method 900 comprises feeding, by the execution environment module 208, a first data from one or more trusted sources, specific to a user, to the virtual platform or virtual machine of the virtual environment module 210, as depicted in operation 902, using a data encryption technique. The method 900 comprises feeding, by the execution environment module 208, a second data from one or more untrusted sources, specific to the user, to the virtual platform or virtual machine of the virtual environment module 210, as depicted in operation 904, by performing one or more security validation techniques.

[0096] Thereafter, the method 900 comprises generating, by the virtual environment module 210, a property record in a database for the collected first data and the second data, as depicted in operation 906. The method 900 comprises setting permission for the collected first data and the second data by one or more foundation models, as depicted in operation 908. Further, the method 900 comprises scheduling, by the virtual environment module 210, fine-tuning of the foundation models, as depicted in operation 910, using the permission specified first data and the second data in the database specific to the foundation models.

[0097] The various actions in method 900 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 9 may be omitted.

[0098] FIG. 10 depicts an example block diagram for fine-tuning a foundation model with one or more adapters using the SLCS. The SLCS facilitates creation and sharing of sensitive data from multiple applications (for example, from company A and company B, and platform P1 and platform P2) to adapt single foundation model with one or more adapters to leverage the base LLM for fine-tuning.

[0099] FIG. 11 depicts an example block diagram for fine-tuning a foundation model using the SLCS. The SLCS provides rich capability to construct a rich world to secure world communication pipeline with LLM administration that makes the ecosystem available for secure data on-device AI utilisation. In one embodiment, the SLCS includes an adapter model comprising an ML manager 334, an ML policy manager 336, and a DB manager 338 which are isolated within a secure execution environment. The ML manager 334 receives encrypted input data and securely manages fine-tuned model-related information. The ML policy manager 336 safely stores training and inference policies, isolated from attackers, and governs secure handling of multi-session training processes. The DB manager 338 keeps metadata (e.g., type, size, format) related to the shared datasets and facilitates secure data flow. The adapter model is updated through a secure training loop involving these managers. The SLCS only allows trusted application data and any data from untrusted external sources is strictly blocked from accessing the secure LLM compiler system, thereby preventing model theft and data poisoning. The SLCS helps to create a platform to share data across applications and businesses to fine-tune a model for single tasks. For example, health data from multiple applications collectively helps to identify a user health status.

[0100] FIG. 12 depicts an example block diagram of identifying and preventing data poisoning using the secure VM. The SLCS uses an anomaly detection model for identifying unusual patterns and outlier rejection inside the training data, during training or fine-tuning, when the third party training data is involved. Additionally, for identifying data poisoning, trusted data sources (e.g., samsung's trusted application text data, samsung's trusted application gallery data, samsung's trusted application health data, samsung's trusted application wearables data) within the device are considered, which meets security standards (encryption and decryption in the VM). The SLCS checks the functional models with the trusted test sets in real-time to verify the vulnerability and model performance. For the third applications training data, additional steps such as anomaly detection, pattern analysis, bias verification, distribution validation, data filtering and cleaning, and malicious label detection are performed before being included in the adaptor model training to prevent data poisoning.

[0101] FIG. 13 depicts an example flow representation of filtering data for protecting model fine-tuning. The data shared across different applications are filtered by a multi-step filtering process. The process includes malicious data filtering, anomaly detection, bias verification and pattern analysis and distribution validation to protect model fine-tuning. These steps may be executed sequentially or in parallel. After the multi-step filtering process, fine-tuning is carried out in a virtual environment, and fine-tuned data is integrated into a secure compiler framework. During the inference stage, additional data validation and end-to-end encryption mechanisms are applied to secure LLM compiler framework.

[0102] FIG. 14 depicts an example block diagram of LLM protection with LLM encoder and LLM foundation model in the execution environment module 208, while adapter model in the virtual environment module 210. In this embodiment, the LLM is present in the execution environment module 208. During training using on-device data, the fine-tuned adapter can be trained and saved in the virtual environment module 210. The fine-tuned model outperforms plain LLM. The adapter remains protected in the virtual environment module 210 from normal world and other applications. The NLF 308 receives data from the virtual environment module 210 as input, and execute Neural Network (NN) layers for the given application input in a Neural Processing Unit (NPU). The NLF 308 can provide a model result as a data output.

[0103] FIG. 15 depicts an example block diagram of LLM protection with LLM foundation model in the execution environment module 208, while LLM encoder and adapter model in the virtual environment module 210. Sharing personal or confidential information for LLM present in the execution environment module 208 or cloud may leak the data. To address this, the LLM encoder can be stored in the virtual environment module 210. With a combination of LLM and fine-tuned model present in the virtual environment module 210, the confidential input is used in protected environment. This is not possible when LLM encoder exists in normal world as input sharing may lead to leak. The application to virtual environment module 210 channel is encrypted and the input is decrypted. The generated output is encrypted back and shared to application. The NLF 308 receives data from the virtual environment module 210 as input, and execute Neural Network (NN) layers for the given application input in a Neural Processing Unit (NPU). The NLF 308 can provide a model result as a data output.

[0104] FIG. 16 depicts a use case of fine-tuning a physical fitness estimation model. Health and user physical activities are tracked across different applications. The health and user physical activities data from the different applications collected and securely processed within a protected environment (SLCS). The collected data undergoes filtering and validation to remove potential data poisoning attempts by attackers. After validation and encryption, a fine-tuned adapter model is trained using the secured data. The SLCS helps to fine-tune a model to estimate user physical fitness.

[0105] FIG. 17 depicts a use case of fine-tuning for tracking user smart phone activities model. User interaction activities are tracked across different applications. The user interaction activities data from the different applications collected and securely processed within a protected environment (SLCS). The collected data undergoes filtering and validation to remove potential data poisoning attempts by attackers. After validation and encryption, a fine-tuned adapter model is trained using the secured data. The SLCS helps to fine-tune a model to estimate user smart phone activities and addiction level.

[0106] FIG. 18 depicts a use case of fine-tuning for tracking user mental wellbeing model. User conversation with friends and family are tracked across different social applications. The user conversation data from the different social applications collected and securely processed within a protected environment (SLCS). The collected data undergoes filtering and validation to remove potential data poisoning attempts by attackers. After validation and encryption, a fine-tuned adapter model is trained using the secured data. The SLCS helps to fine-tune a model to estimate user mental wellbeing.

[0107] The electronic device 200 with the compiler system creates a platform to share data across applications and businesses to fine-tune a model for single tasks. The compiler system validates incoming data and helps in management of multiple requests for fine-tuning LLM on personalized data on secure environment for common purpose by different business entities. The compiler system supports LLM compiler framework inside the virtual environment with fine tuning capability for base LLM with effective memory management.

[0108] The methods 700, 800, 900 provide mechanism to collect sensitive data across multiple applications, and protect the data before and during training. The methods 700, 800, 900 provide the end-to-end pipeline for sensitive data inference with protection.

[0109] The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device. The modules shown in FIG. 2 include blocks which can be at least one of a hardware device, or a combination of hardware device and software module.

[0110] The embodiment disclosed herein describes a compiler system that provides a framework with the capacity to accumulate sensitive and private information across multiple parties for fine-tuning the foundation model. Therefore, it is understood that the scope of the protection is extended to such a program and in addition to a computer readable means having a message therein, such computer readable storage means contain program code means for implementation of one or more steps of the method, when the program runs on a server or mobile deviceor any suitable programmable device. The method is implemented in at least one embodiment through or together with a software program written in e.g., Very high speed integrated circuit Hardware Description Language (VHDL) another programming language, or implemented by one or more VHDL or several software modules being executed on at least one hardware device. The hardware device can be any kind of portable device that can be programmed. The device may also include means which could be e.g., hardware means like e.g., an ASIC, or a combination of hardware and software means, e.g., an ASIC and an FPGA, or at least one microprocessor and at least one memory with software modules located therein. The method embodiments described herein could be implemented partly in hardware and partly in software. Alternatively, the disclosure may be implemented on different hardware devices, e.g., using a plurality of CPUs.

[0111] The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and / or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of embodiments and examples, those skilled in the art will recognize that the embodiments and examples disclosed herein can be practiced with modification within the scope of the embodiments as described herein.

[0112] Accordingly, the embodiments herein provide a method. The method comprises obtaining a first data from one or more authenticated applications of one or more first parties. The method comprises obtaining a second data from one or more unauthenticated applications of one or more external parties. The method filtering the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data. The method comprises encrypting the first data and the filtered second data. the method comprises transferring the encrypted data to a Virtual Machine (VM). The method comprises fine-tuning at least one foundation model, by the VM, using the encrypted data.

[0113] In an embodiment, the first data and the second data are at least one of a text, an image, and an audio.

[0114] In an embodiment, the method comprises obtaining a model request from one or more applications of one or more parties, wherein the model request is at least one of a train request, or an infer request. In an embodiment, the method comprises managing at least one of a Machine Learning (ML) session, or a data session corresponding to the obtained first data and second data, and the model request for interacting with the one or more applications. In an embodiment, the method comprises creating a set of policies for the data for at the one or more applications for restricting other parties from accessing the data.

[0115] In an embodiment, the data poisoning is identified by evaluating data distribution of the obtained data, and comparing the evaluated data distribution with an original data distribution state.

[0116] In an embodiment, the fine-tuning the at least one foundation model comprises receiving from a service execution location, the encrypted data by the VM. In an embodiment, the fine-tuning the at least one foundation model comprises decrypting, by the VM, the encrypted data when required. In an embodiment, the fine-tuning the at least one foundation model comprises fine-tuning the at least one foundation model using the decrypted data by utilizing a model and training management for protecting the at least one foundation model from theft and denial of service.

[0117] In an embodiment, the method comprises storing the encrypted data, in the at least one fine-tuned foundation model.

[0118] In an embodiment, the method comprises sharing the at least one fined-tuned foundation model with at least one learning and inference API that predicts insights for at least one of the one or more authenticated applications of one or more first parties, or the one or more unauthenticated applications of one or more external parties, wherein the at least one fined-tuned foundation model is located in the secure location of the electronic device.

[0119] In an embodiment, the method comprises validating a plurality of Large Language Model (LLM) data, and a plurality of model attacks, during training, for identifying at least one of data poisoning, system overload, anomalies, and bias, wherein the plurality of LLM data is validated by performing one or more filtering methods, wherein the one or more filtering methods comprise at least one of malicious data filtering, anomaly detection, bias verification, pattern analysis, and distribution validation to protect the fine-tuning of the at least one foundation model.

[0120] Accordingly, the embodiments herein provide an electronic device which comprises a processor and a memory module. The processor is coupled with the memory module. The processor is configured to obtain a first data from one or more authenticated applications of one or more first parties. The processor is configured to obtain a second data from one or more unauthenticated applications of one or more external parties. The processor is configured to filter the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data. The processor is configured to encrypt the first data and the filtered second data. The processor is configured to transfer the encrypted data to the VM. The processor is configured to fine-tune at least one foundation model, by the VM, using the encrypted data.

[0121] In an embodiment, the processor is configured to fine-tune the at least one foundation model using a compiler system.

[0122] In an embodiment, the processor is configured to share the at least one fined-tuned foundation model with at least one learning and inference API that predicts insights for at least one of the one or more authenticated applications of one or more first parties, or the one or more unauthenticated applications of one or more external parties, wherein the at least one fined-tuned foundation model is located in the secure location of the electronic device.

[0123] In an embodiment, the first data and the second data are at least one of a text, an image, and an audio.

[0124] In an embodiment, the processor is configured to obtain a model request from one or more applications of one or more parties, wherein the model request is at least one of a train request, or an infer request. In an embodiment, the processor is configured to manage at least one of a Machine Learning (ML) session, or a data session corresponding to the obtained first data and second data, and the model request for interacting with the one or more applications. In an embodiment, the processor is configured to create, and manage a set of policies for the data for at least one application for restricting other parties from accessing the data.

[0125] In an embodiment, the data poisoning is identified by evaluating data distribution of the obtained data, and comparing the evaluated data distribution with an original data distribution state.

[0126] In an embodiment, the processor is configured to receive, from a service execution location, the encrypted at least one of the data, and the model request by the VM. In an embodiment, the processor is configured to decrypt, by the VM, the encrypted at least one of the data, and the model request when required. In an embodiment, the processor is configured to fine-tune the at least one foundation model using the decrypted at least one of the data, and the model request by utilizing a model and training management for protecting the at least one foundation model from theft and denial of service.

[0127] In an embodiment, the processor is configured to store and manage the at least one of the data, and the model request in the at least one fine-tuned foundation model.

[0128] In an embodiment, the processor is configured to validate a plurality of Large Language Model (LLM) data, and a plurality of model attacks, during training, for identifying at least one of data poisoning, system overload, anomalies, and bias, wherein the plurality of LLM data is validated by performing one or more filtering methods, wherein the one or more filtering methods comprise at least one of malicious data filtering, anomaly detection, bias verification, pattern analysis, and distribution validation to protect the fine-tuning of the at least one foundation model.

[0129] In an embodiment, the first party service provider module, and the second party service provider module receive the first data, and the second data from at least one of an application, and a server.

[0130] In an embodiment, the method comprises feeding a first data from one or more trusted sources, specific to a user, to the virtual platform using a data encryption technique. In an embodiment, the method comprises feeding a second data from one or more untrusted sources, specific to the user, to the virtual platform by performing one or more security validation techniques. In an embodiment, the method comprises generating a property record, by the virtual platform, in a database for the collected first data and the second data, and setting permission for the collected first data and the second data by one or more foundation models. In an embodiment, the method comprises scheduling fine-tuning of the one or more foundation models using the permission specified first data and the second data in the database specific to the one or more foundation models.

Claims

1.A method (700) performed by an electronic device, comprising:obtaining a first data from one or more authenticated applications of one or more first parties;obtaining a second data from one or more unauthenticated applications of one or more external parties;filtering the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data;encrypting the first data and the filtered second data;transferring the encrypted data to a Virtual Machine (VM); andfine-tuning at least one foundation model, by the VM, using the encrypted data.2.The method (700) of claim 1, wherein the first data and the second data are at least one of a text, an image, and an audio3.The method (700) any one of claims 1 to 2, further comprises:obtaining a model request from one or more applications of one or more parties, wherein the model request is at least one of a train request, or an infer request;managing at least one of a Machine Learning (ML) session, or a data session corresponding to the obtained first data and second data, and the model request for interacting with the one or more applications; andcreating a set of policies for the data for at the one or more applications for restricting other parties from accessing the data.4.The method (700) any one of claims 1 to 3, wherein the data poisoning is identified by evaluating data distribution of the obtained data, and comparing the evaluated data distribution with an original data distribution state.5.The method (700) any one of claims 1 to 4, wherein the fine-tuning the at least one foundation model, comprises:receiving from a service execution location, the encrypted data by the VM;decrypting, by the VM, the encrypted data when required; andfine-tuning the at least one foundation model using the decrypted data by utilizing a model and training management for protecting the at least one foundation model from theft and denial of service.6.The method (700) any one of claims 1 to 5, further comprises:storing the encrypted data, in the at least one fine-tuned foundation model.7.The method (700) any one of claims 1 to 6, further comprises:sharing the at least one fined-tuned foundation model with at least one learning and inference API that predicts insights for at least one of the one or more authenticated applications of one or more first parties, or the one or more unauthenticated applications of one or more external parties, wherein the at least one fined-tuned foundation model is located in the secure location of the electronic device.8.The method (700) any one of claims 1 to 7, further comprises:validating a plurality of Large Language Model (LLM) data, and a plurality of model attacks, during training, for identifying at least one of data poisoning, system overload, anomalies, and bias,wherein the plurality of LLM data is validated by performing one or more filtering methods,wherein the one or more filtering methods comprise at least one of malicious data filtering, anomaly detection, bias verification, pattern analysis, and distribution validation to protect the fine-tuning of the at least one foundation model.9.An electronic device (200), comprising:a processor (202); anda memory module (206),wherein the processor (202) is coupled with the memory module (206), and configured to:obtain a first data from one or more authenticated applications of one or more first parties;obtain a second data from one or more unauthenticated applications of one or more external parties;filter the second data by identifying data poisoning, wherein the data poisoning is an insertion of incorrected data into the obtained data;encrypt the first data and the filtered second data;transfer the encrypted data to a Virtual Machine (VM); andfine-tune at least one foundation model, by the VM, using the encrypted data.10.The electronic device (200) of claim 9, wherein the processor (202) is configured to fine-tune the at least one foundation model using a compiler system.11.The electronic device (200) any one of claims 9 to 10, wherein the processor (202) is configured to share the at least one fined-tuned foundation model with at least one learning and inference API that predicts insights for at least one of the one or more authenticated applications of one or more first parties, or the one or more unauthenticated applications of one or more external parties, wherein the at least one fined-tuned foundation model is located in the secure location of the electronic device.12.The electronic device (200) any one of claims 9 to 11, wherein the first data and the second data are at least one of a text, an image, and an audio.13.The electronic device (200) any one of claims 9 to 12, wherein the processor (202) is configured to :obtain a model request from one or more applications of one or more parties, wherein the model request is at least one of a train request, or an infer request;manage at least one of a Machine Learning (ML) session, or a data session corresponding to the obtained first data and second data, and the model request for interacting with the one or more applications;create, and manage a set of policies for the data for at least one application for restricting other parties from accessing the data.14.The electronic device (200) any one of claims 9 to 13, wherein the data poisoning is identified by evaluating data distribution of the obtained data, and comparing the evaluated data distribution with an original data distribution state.15.A computer-readable storage media storing one or more computer programs including computer-executable instructions that, when executed by one or more processors of an electronic device individually or collectively, cause the electronic device to perform the method of any one of claims 1 to 8.

Images