给大模型输入加噪声，让数据更安全还能用。
Learning Obfuscations Of LLM Embedding Sequences: Stained Glass Transform
- 用可学习的随机变换隐藏大模型输入的词嵌入。
- 实测在保持模型性能的同时，显著提升隐私保护水平。
- 适合担心数据泄露的企业用户或敏感场景部署。
大模型部署成本高且服务难保障，导致企业多采用托管式或共享算力的部署模式。无论哪种方式，模型都只能处理明文数据，导致敏感数据暴露在共享或多方共用的计算环境中，使数据拥有者对使用这些服务持谨慎态度。本文提出「彩窗变换」（Stained Glass Transform），一种可学习、随机且依赖序列的词嵌入变换方法，在信息论层面保障输入隐私的同时，维持模型的输出能力。我们理论连接了特定类别的彩窗变换与高斯混合模型的互信息理论，并基于互信息计算事后隐私估计。通过词粒度隐私指标和标准大模型性能基准，验证了变换后嵌入在隐私性和实用性上的有效性。
原文摘要 · Abstract (English)
The high cost of ownership of AI compute infrastructure and challenges of robust serving of large language models (LLMs) has led to a surge in managed Model-as-a-service deployments. Even when enterprises choose on-premises deployments, the compute infrastructure is typically shared across many teams in order to maximize the return on investment. In both scenarios the deployed models operate only on plaintext data, and so enterprise data owners must allow their data to appear in plaintext on a shared or multi-tenant compute infrastructure. This results in data owners with private or sensitive data being hesitant or restricted in what data they use with these types of deployments. In this work we introduce the Stained Glass Transform, a learned, stochastic, and sequence dependent transformation of the word embeddings of an LLM which information theoretically provides privacy to the input of the LLM while preserving the utility of model. We theoretically connect a particular class of Stained Glass Transforms to the theory of mutual information of Gaussian Mixture Models. We then calculate a-postiori privacy estimates, based on mutual information, and verify the privacy and utility of instances of transformed embeddings through token level metrics of privacy and standard LLM performance benchmarks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。