Selective LLM Parameter Encryption for Confidential Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large Language Models (LLMs) face significant security concerns due to the exposure of sensitive data during training and inference processes, which can lead to unauthorized access and data breaches, particularly when handling confidential information.
Innovation Solution
A method is introduced to secure LLMs by encrypting parameters during training and controlling access rights, ensuring that only authorized users can decrypt and utilize sensitive data, using encryption schemes like symmetric and asymmetric key encryption, and homomorphic encryption techniques to perform computations on encrypted data without decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If LLMs process confidential data during training and inference, then the model can provide personalized insights and accurate responses, but the sensitive data becomes vulnerable to unauthorized access and data breaches
Solution Approach 1:
The patent segments the model parameters into two categories: preset parameters that remain unencrypted and accessible to all users, and changed parameters that are encrypted and accessible only to authorized users. This segmentation allows the system to maintain data accuracy for authorized users while protecting sensitive information from unauthorized access.
Solution Approach 2:
The patent introduces an encryption mechanism as an intermediary between the model parameters and the users. The encryption layer acts as a mediator that allows authorized users to access accurate personalized insights while preventing unauthorized users from accessing the sensitive changed parameters, thus resolving the contradiction between data accuracy and security.
2Object-affected harmful factors
If the system encrypts all parameters to protect confidential data, then data security is enhanced, but the model cannot provide personalized insights to authorized users
Solution Approach 1:
The patent applies segmentation by dividing parameters into preset parameters (unencrypted, publicly accessible) and changed parameters (encrypted, access-controlled). This allows the system to maintain ease of operation for authorized users who can access personalized insights while enhancing security for unauthorized users.
Solution Approach 2:
The patent implements local quality by applying encryption selectively only to the changed parameters that contain sensitive information, while leaving preset parameters unencrypted. This selective approach maintains ease of operation for authorized users who need access to personalized data while enhancing security where needed.
3Ease of operation
If the system decrypts parameters for authorized users to provide personalized insights, then data accessibility is improved, but the risk of unauthorized access increases
Solution Approach 1:
The patent segments parameters into two distinct groups with different access rights: preset parameters are publicly accessible, while changed parameters are encrypted and accessible only to authorized users. This segmentation allows the system to improve ease of operation for authorized users while minimizing unauthorized access risk.
Solution Approach 2:
The encryption mechanism serves as an intermediary that controls access to changed parameters. It allows authorized users to decrypt and access personalized insights while preventing unauthorized users from accessing the sensitive data, thus balancing ease of operation with security.
4Object-affected harmful factors
If the system uses encryption schemes to protect confidential data, then data privacy is maintained, but the computational complexity increases
Solution Approach 1:
The patent segments the parameter space to encrypt only the changed parameters that contain sensitive information, rather than encrypting all parameters. This segmentation reduces the computational complexity of encryption operations while maintaining data privacy for the critical components.
Solution Approach 2:
The patent applies partial encryption only to the changed parameters rather than complete encryption of all parameters. This partial action approach maintains data privacy for sensitive information while reducing the computational complexity and resource requirements compared to encrypting the entire model.
Data Source
AI summary
A system receives a training dataset for the LLM that includes confidential data, wherein the LLM comprises preset parameters. The system trains the LLM using the training dataset, including: identifying one or more parameters changed during the training, and encrypting the changed parameters. The system receives an input query for the LLM from a user. The system determines if the user has access rights to the confidential data. In response to determining that the user has the access rights to the confidential data, the system decrypts the encrypted changed parameters of the LLM, and performs an LLM inference using the decrypted changed parameters. In response to determining that the user does not have the access rights to the confidential data, the system performs the LLM inference with the preset parameters without decrypting the encrypted changed parameters.