标题： 基于全同态加密的微调大语言模型的实用安全推理算法 显示英文标题

标题： Practical Secure Inference Algorithm for Fine-tuned Large Language Model Based on Fully Homomorphic Encryption

摘要： 大型语言模型(LLMs)目前处于机器学习领域的前沿，显示出广泛的应用前景，但同时也暴露了隐私泄露的一些风险。 我们将全同态加密(FHE)和可证明安全理论与参数高效微调(PEFT)相结合，提出了一种针对LLMs的高效安全推理方案。 更具体地说，我们关注依赖于开源基础模型并使用LoRA通过私有数据集进行微调的预训练LLMs。 这是垂直领域模型如LawGPT和BenTsao的常见路线图。 我们使用了两种关键技术。 首先，我们将整个模型分为公共部分和私人部分。 公共部分的权重是公开可访问的（例如，开源的基础模型），而私人部分需要被保护（例如，LoRA矩阵）。 这样可以大大减少在私有数据上计算带来的开销。 其次，我们提出了一种通用方法，将一个线性层转换为另一个线性层，该方法能够抵御模型提取攻击并保留其原始功能，称为私有线性层(PLL)。 然后我们将这种方法应用于LoRA矩阵，以确保服务器保护其私有权重而不限制用户的输入。 我们还表明，对PLL执行模型提取攻击的难度可以降低到著名的困难问题学习带误差(LWE)。 将此方法与FHE结合，我们可以同时保护用户输入。 在本文中，我们使用开源模型ChatGLM2-6B作为基础模型，并通过LoRA进行微调。 实验结果表明，我们方案的推理效率达到1.61秒/标记，显示该方案具有良好的实用性。 显示英文摘要

摘要： Large language models(LLMs) are currently at the forefront of the machine learning field, which show a broad application prospect but at the same time expose some risks of privacy leakage. We combined Fully Homomorphic Encryption(FHE) and provable security theory with Parameter-Efficient Fine-Tuning(PEFT) to propose an efficient and secure inference scheme for LLMs. More specially, we focus on pre-trained LLMs which rely on open-sourced base model and then fine-tuned with the private datasets by LoRA. This is a popular road-map for Vertical Domain Models such as LawGPT and BenTsao. We use two key technologies below. Firstly, we divide the whole model into the public part and the private part. The weights of public part are publicly accessible(e.g. the open-sourced base model) while the private part needs to be protected(e.g. the LoRA matrices). In this way, the overhead brought by computing on private data can be greatly reduced. Secondly, we propose a general method to transform a linear layer into another one which provides security against model extraction attacks and preserves its original functionality, which denoted as Private Linear Layer(PLL). Then we use this method on the LoRA matrices to make sure that the server protects their private weights without restricting the user's input. We also show that the difficulty of performing model extraction attacks for PLL can be reduced to the well-known hard problem Learning with Errors(LWE). Combing this method with FHE, we can protect user's input at the same time. In this paper, we use the open-source model ChatGLM2-6B as the base model which is fine-tuned by LoRA. Experimental results show the inference efficiency of our scheme reaches 1.61s/token which displays that the scheme has good practicality.