WO2023109294A1 - 基于隐私保护联合训练自然语言处理模型的方法及装置 - Google Patents

基于隐私保护联合训练自然语言处理模型的方法及装置 Download PDF

Info

Publication number
WO2023109294A1
WO2023109294A1 PCT/CN2022/125464 CN2022125464W WO2023109294A1 WO 2023109294 A1 WO2023109294 A1 WO 2023109294A1 CN 2022125464 W CN2022125464 W CN 2022125464W WO 2023109294 A1 WO2023109294 A1 WO 2023109294A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
privacy
sentence
training
noise
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/125464
Other languages
English (en)
French (fr)
Inventor
杜健
莫冯然
王磊
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Priority to US18/572,937 priority Critical patent/US20240419839A1/en
Publication of WO2023109294A1 publication Critical patent/WO2023109294A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/40—Processing or translation of natural language
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/20—Natural language analysis
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F40/00—Handling natural language data
    • G06F40/30—Semantic analysis
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Definitions

  • One or more embodiments of this specification relate to the field of machine learning, and in particular to a method and device for jointly training a natural language processing model based on privacy protection.
  • NLP natural language processing
  • a variety of neural network models and training methods have been proposed to enhance its semantic understanding ability.
  • the model prediction performance greatly depends on the richness and availability of training samples.
  • a large number of trainings that fit the business scenario are often required. sample.
  • the training data of multiple data sources In order to have abundant training data and improve the performance of the NLP model, in some scenarios, it is proposed to use the training data of multiple data sources to jointly train the NLP model.
  • the local training data of each data party often contains the privacy of local business objects, especially user privacy, which brings security and privacy challenges to multi-party joint training.
  • intelligent question answering as a specific downstream NLP task, requires a large number of question-answer pairs for its training data.
  • questions are often raised by the user side.
  • user questions often contain the user's personal privacy information, and if the user questions on the user end are directly sent to another party such as the server end, there may be a risk of privacy leakage.
  • One or more embodiments of this specification describe a method and device for joint training of NLP models, which can protect the data privacy of training sample providers during the joint training process.
  • the NLP model includes an encoding network located at the first party and a processing network located at the second party, and the method is executed by the first party ,include:
  • the target noise-added representation is sent to the second party for training of the processing network.
  • obtaining the local target training sentence specifically includes: sampling from the total local sample set according to the preset sampling probability p to obtain a sample subset for the current iteration round; from the sample subset Read the target training sentence.
  • forming a sentence representation vector based on the coding output of the coding network specifically includes: obtaining a character representation vector encoded by the coding network for each character in the target training sentence; A clipping operation based on a preset clipping threshold is performed on the character representation vector, and the sentence representation vector is formed based on the clipped character representation vector.
  • the clipping operation may include: if the current norm value of the character representation vector exceeds the clipping threshold, determining the ratio of the clipping threshold to the current norm value, and converting the The above-mentioned character representation vector is clipped according to the above-mentioned ratio.
  • forming the sentence representation vector may specifically include: concatenating the clipped character representation vectors of the respective characters to form the sentence representation vector.
  • the above method before adding the target noise, further includes: determining the noise power for the target training sentence according to a preset privacy budget; sampling the noise distribution determined according to the noise power to obtain the the target noise.
  • the above determination of the noise power for the target training sentence specifically includes: determining the sensitivity corresponding to the target training sentence according to the clipping threshold; according to the preset single sentence privacy budget and the sensitivity, A noise power for the target training sentence is determined.
  • the above-mentioned determination of the noise power for the target training sentence specifically includes: determining the target budget information of the current iteration round t according to the preset total privacy budget for the total number of iteration rounds T; The target budget information is used to determine the noise power for the target training sentence.
  • the target training sentence is sequentially read from the sample subset used for the current iteration round t, and the sample subset is obtained from the local sample population according to the preset sampling probability p.
  • determining the noise power for the target training sentence specifically includes: converting the total privacy budget into a total privacy parameter value in a Gaussian differential privacy space; in the Gaussian differential privacy space Among them, according to the total privacy parameter value, the total number of iteration rounds T and the sampling probability p, determine the target privacy parameter value of the current iteration round t; according to the target privacy parameter value, the clipping threshold, and The number of characters of each training sentence in the sample subset determines the noise power.
  • the target privacy parameter value of the current iteration round t may be determined as follows: deduce the target privacy parameter value based on the first relational expression for calculating the total privacy parameter value in the Gaussian differential privacy space, the The first relation shows that the total privacy parameter value is proportional to the sampling probability p, the square root of the total number of iterations T, and depends on the natural exponent e as the base, and the target privacy parameter value as the exponent The exponentiation result of .
  • the foregoing encoding network may be implemented by using one of the following neural networks: long short-term memory network LSTM, bidirectional LSTM, and transformer network.
  • a device for jointly training a natural language processing NLP model based on privacy protection includes an encoding network located at the first party and a processing network located at the second party, and the device is deployed on the first party ,include:
  • a sentence obtaining unit configured to obtain a local target training sentence
  • a representation forming unit configured to input the target training sentence into the encoding network, and form a sentence representation vector based on the encoding output of the encoding network;
  • a noise adding unit configured to add target noise conforming to differential privacy on the sentence representation vector to obtain a target noise adding representation; the target noise adding representation is sent to the second party for training of the processing network .
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method provided in the above-mentioned first aspect.
  • a computing device including a memory and a processor, where executable codes are stored in the memory, and when the processor executes the executable codes, the method provided by the above-mentioned first aspect is implemented.
  • the local differential privacy technology is used to protect the privacy at the granularity of training sentences. Further, in some embodiments, by considering the privacy amplification brought about by sampling and the superposition of the privacy cost of multiple iterations in the training process, the noise added for privacy protection is better designed, so that the privacy cost of the entire training process controllable.
  • FIG. 1 shows a schematic diagram of an implementation architecture of a joint training NLP model according to an embodiment
  • Fig. 2 shows a schematic diagram of privacy protection processing according to an embodiment
  • FIG. 3 shows a schematic flow diagram of a method for jointly training an NLP model based on privacy protection according to an embodiment
  • Fig. 4 shows the flow of steps for determining the noise power of the current training sentence according to one embodiment
  • Fig. 5 shows a schematic structural diagram of an apparatus for jointly training an NLP model according to an embodiment.
  • the embodiment of this specification proposes a joint training NLP model solution, in which local differential privacy technology is used to protect privacy at the granularity of training sentences. Further, in some embodiments, by considering the privacy amplification brought about by sampling and the superposition of the privacy cost of multiple iterations in the training process, the noise added for privacy protection is better designed, so that the privacy cost of the entire training process controllable.
  • Fig. 1 shows a schematic diagram of an implementation architecture of jointly training an NLP model according to an embodiment.
  • an NLP model that performs a specific NLP task is jointly trained by a first party 100 and a second party 200 .
  • the NLP model is divided into an encoding network 10 and a processing network 20.
  • the encoding network 10 is deployed at the first party 100 to encode the input text.
  • the encoding process can be understood as an upstream, general text understanding task.
  • a processing network 20 is deployed at the second party 200 for further processing the encoded textual representations and performing predictions related to specific NLP tasks.
  • the processing network 20 is used to perform downstream processing for specific NLP tasks.
  • the specific NLP task may be, for example, intelligent question answering, text classification, intent recognition, emotion recognition, machine translation, and so on.
  • the above-mentioned first party and second party may be various data storage and data processing devices/platforms.
  • the first party may be a user terminal device
  • the second party is a server device
  • the user terminal device performs joint training with the server using the user input text collected locally.
  • both the first party and the second party are platform-type devices.
  • the first party is a customer service platform, which collects and stores a large number of user questions; the second party is a platform that needs to train a question answering model, and so on.
  • the second party 200 can first use its local training text data to pre-train the processing network 200; then, jointly with the first party 100, use the training data of the first party 100 for joint training .
  • the upstream first party 100 needs to send the encoded text representation to the downstream second party 200, so that it can continue to train the processing network 200 using the text representation.
  • the text representation sent by the first party 100 may carry user privacy information, which may easily cause the risk of privacy leakage.
  • some privacy protection schemes such as user anonymization have been proposed, it is still possible to restore user privacy information through anti-anonymization processing. Therefore, it is still necessary to enhance the privacy protection of the information provided by the first party.
  • the output of the encoding network 10 is subjected to privacy protection processing, and noise that satisfies differential privacy is added to it to obtain
  • the noised text representation is then sent to the second party 200 such a noised text representation.
  • the second party 200 continues to train the processing network 200 based on the noise-added text representation, and returns the gradient information to realize the joint training of the two parties.
  • the text representation sent by the first party 100 contains random noise, so that the second party 200 cannot obtain the private information in the training text of the first party.
  • the added noise amplitude can be designed so that the model performance of the jointly trained NLP model is affected as little as possible.
  • Fig. 2 shows a schematic diagram of privacy protection processing according to an embodiment.
  • This privacy protection process is performed in the first party 100 shown in FIG. 1 .
  • the first party first reads a training sentence from the local user text data (as a sample set) as the current input text.
  • the training sentence can be obtained by sampling user text data.
  • the first party inputs the current input text into the coding network 10 to obtain the coding representation of the coding network 10 .
  • a privacy processing layer 11 is followed.
  • the privacy processing layer 11 is hereinafter referred to as a DP (differential privacy) layer for short.
  • the DP layer 11 is a non-parameterized network layer, which performs privacy processing according to preset hyperparameters and algorithms without the need for parameter tuning and training.
  • the DP layer 11 obtains the sentence representation according to the coding of the coding network 10
  • noise that conforms to differential privacy is applied to the sentence representation
  • the noise-added representation is obtained as the text representation after privacy processing Send to the second party, so as to enforce privacy protection at the granularity of training sentences.
  • Differential Privacy DP (Differential Privacy) is a means in cryptography that aims to provide a method that maximizes the accuracy of data queries while minimizing the chance of identifying its records when queried from a statistical database.
  • M There is a random algorithm M
  • PM is a set of all possible outputs of M. For any two adjacent data sets x and x' (that is, only one data record between x and x' is different) and any subset of PM If the random algorithm M satisfies:
  • the algorithm M is said to provide ⁇ -differential privacy protection, where the parameter ⁇ is called the privacy protection budget, which is used to balance the degree of privacy protection and accuracy.
  • ⁇ can usually be set in advance. The closer ⁇ is to 0, the closer e ⁇ is to 1, the closer the processing results of the random algorithm to two adjacent data sets x and x', the stronger the degree of privacy protection.
  • ⁇ is a slack term, also known as tolerance, which can be understood as the probability that strict differential privacy cannot be achieved.
  • the implementation methods of differential privacy include noise mechanism, index mechanism, etc.
  • noise mechanisms the magnitude of the added noise is typically determined according to the sensitivity of the query function.
  • the above sensitivity indicates the maximum difference of the query results of the query function when a pair of adjacent data sets x and x' are queried.
  • the noise mechanism is used to achieve differential privacy.
  • the noise power is determined according to the output sensitivity of the encoding network for the training sentence and the preset privacy budget, and then the corresponding random noise is applied to the sentence representation to achieve differential privacy. Since the noise is applied at the sentence scale, this means that the granularity of privacy protection in the above embodiment is at the sentence level.
  • the privacy protection scheme at the sentence granularity is equivalent to hiding or blurring an entire sentence (consisting of a series of words), so the degree of privacy protection is stronger and the privacy protection effect is better.
  • the NLP model includes an encoding network located at the first party and a processing network located at the second party, and the following steps are performed by the first party.
  • the first party may specifically be implemented as any server, device, platform or equipment with computing and processing capabilities, such as user terminal equipment, platform equipment, and so on. The specific implementation manner of each process step in FIG. 3 is described in detail below.
  • the local target training sentence is obtained.
  • the above-mentioned target training sentence is any training sentence in the training sample set collected by the first party in advance.
  • the first party may sequentially or randomly read sentences from the sample set as the above-mentioned target training sentences.
  • a small batch of samples (mini-batch) is sampled from the total local sample set to form the samples used in this round Subset.
  • the above sampling can be performed based on a preset sampling probability p.
  • Such a sampling process can also be called Poisson sampling.
  • the current sample subset x t for the current t-th iteration is obtained by sampling.
  • sentences may be sequentially read from the current sample subset x t as target training sentences.
  • the target training sentence can be denoted as x.
  • the above target training sentence can be a sentence related to the business object obtained in advance from the first party, for example, a user question sentence, a user chat record, a user input text, or other that may involve the privacy of the business object
  • the text of the message statement is not limited here.
  • step 33 the above-mentioned target training sentence is input into the encoding network, and a sentence representation vector is formed based on the encoding output of the encoding network.
  • the encoding network is used to encode the input text, i.e. perform upstream, general text understanding tasks.
  • the encoding network can first encode each character (token) in the target training sentence (a character can correspond to a character, a word, or a punctuation point) to obtain the character representation vector of each character; then based on each character representation vector , fused to form a sentence representation vector.
  • the encoding network can be realized by various neural networks.
  • the above-mentioned encoding network is implemented by a long short-term memory LSTM network.
  • the target training sentence can be converted into a character sequence, and each character in the above character sequence is input into the LSTM network in turn, and the LSTM network processes each character in turn.
  • the LSTM network obtains the hidden state corresponding to the current input character as its corresponding character representation vector according to the hidden state corresponding to the previous input character and the current input character, thereby obtaining the character representation vector corresponding to each character in turn.
  • the above encoding network is implemented by a bidirectional LSTM network, namely BiLSTM.
  • the character sequence corresponding to the target training sentence can be input into the above-mentioned BiLSTM network twice in the order of forward and reverse, and the first representation of each character when it is input in the forward direction and the first representation when it is input in the reverse direction are respectively obtained.
  • Second representation By fusing the first representation and the second representation of the same character, the character representation vector of the character encoded by BiLSTM can be obtained.
  • the above encoding network is implemented by a Transformer network.
  • each character of the target training sentence can be input into the Transformer network together with its position information.
  • the Transformer network encodes each character to obtain the representation vector of each character.
  • the above encoding network may also be implemented by using other existing neural networks suitable for text encoding, which is not limited here.
  • the sentence representation vector of the target training sentence can be obtained by fusion.
  • fusion can be carried out in various ways.
  • character representation vectors of each character may be concatenated to obtain a sentence representation vector.
  • each character representation vector can be weighted and combined to obtain the sentence representation vector.
  • a clipping operation based on a preset clipping threshold can be performed on the character representation vectors of each character, and a sentence representation vector is formed based on the clipped character representation vectors.
  • the clipping operation blurs the character representation vector and the resulting sentence representation vector to a certain extent. More importantly, the clipping operation can facilitate the measurement of the sensitivity of the encoding network to the output of the training sentence, thereby facilitating the calculation of subsequent privacy costs. .
  • the noise power needs to be determined according to the sensitivity, where the sensitivity represents the maximum difference of the query results when the query function queries adjacent data sets x and x'.
  • the sensitivity can be defined as the maximum difference between the sentence representation vectors encoded by the encoding network for a pair of training sentences.
  • the sensitivity ⁇ of the f function can be expressed as the difference between the coding output (sentence representation vector) of the two training sentences x and x′
  • the maximum difference between namely:
  • ⁇ 2 represents the second-order norm.
  • the character representation vector of each character is clipped to limit it within a certain range, so as to facilitate the calculation of the above sensitivity.
  • the clipping operation for character representation vectors can be performed as follows.
  • x v represents the character representation vector of the vth character in the target training sentence x
  • the current norm value such as the second-order norm value
  • the clipping process for the character representation vector x v can be expressed by the following formula (4):
  • CL represents the clipping operation function
  • C is the clipping threshold
  • min is the minimum function.
  • the ratio of C to ⁇ x v ⁇ 2 is greater than 1
  • the min function takes a value of 1.
  • x v is not clipped; when ⁇ x v ⁇ 2 is greater than C, C and The ratio of ⁇ x v ⁇ 2 is less than 1, and the value of the min function is the ratio.
  • x v is clipped according to this ratio, that is, all elements in x v are multiplied by the ratio coefficient.
  • the sentence representation vector is formed based on concatenation of the clipped character representation vectors of each character.
  • the sensitivity of the encoding network output can be expressed as:
  • the clipping threshold C is a preset hyperparameter.
  • the smaller the value of C the larger the clipping range, which may affect the semantic information of the character representation vector, and then affect the performance of the encoding network. Therefore, the above two factors can be traded off by setting an appropriate clipping threshold C.
  • step 35 add the target noise conforming to the differential privacy to the above sentence representation vector to obtain the target noise addition representation; the target noise addition representation will be sent to the second party later for use in The training of the processing network in the middle and downstream of the second party.
  • the first party can send it to the second party after obtaining the noise-added representation of each training sentence; it can also obtain a small batch of noise-added representations of the training sentences and send them to the second party together , is not limited here.
  • the method further includes a step 34 of determining target noise.
  • This step 34 may include, first in step 341, according to the preset privacy budget, determine the noise power (or distribution variance) for the above-mentioned target training sentence; then in step 342, in the noise distribution determined according to the noise power, sample the above-mentioned target noise.
  • the aforementioned target noise may be Laplacian noise satisfying ⁇ -differential privacy, or Gaussian noise satisfying ( ⁇ , ⁇ ) differential privacy, and so on.
  • the determination and addition of the target noise can be realized in many different ways.
  • a sentence representation vector is formed based on the pruned character representation vector, and Gaussian noise conforming to ( ⁇ , ⁇ ) differential privacy is added to the sentence representation vector.
  • the obtained target noise-added characterization can be expressed as:
  • CL(f(x)) represents the sentence representation vector formed based on the character representation vector after the cropping operation CL, Represents a Gaussian distribution with mean 0 and variance ⁇ 2 . ⁇ 2 or ⁇ can also be called noise power.
  • ⁇ 2 or ⁇ can also be called noise power.
  • random noise can be sampled in the Gaussian distribution formed based on the noise power, and superimposed on the sentence representation vector, Get the target noise plus representation.
  • the noise power ⁇ 2 corresponding to the above target training sentence may be determined in different ways, that is, step 341 is executed.
  • privacy budgets ( ⁇ i , ⁇ i ) are set in advance for a single (eg i-th) training sentence.
  • the noise power ⁇ 2 can be determined according to the privacy budget and sensitivity ⁇ set for the above target training sentence.
  • the sensitivity can be determined according to the clipping threshold C and the number of characters of the target training sentence, for example, according to the aforementioned formula (5).
  • a total privacy budget is set for the overall training process considering the superposition of privacy costs.
  • the composition of privacy costs refers to the fact that in a multi-step process such as NLP processing and model training, a series of computational steps need to be performed based on a private data set, each computational step is potentially based on the previous model using the same private data set.
  • the calculation result of a calculation step Even if each step i performs DP privacy protection with a privacy cost ( ⁇ i , ⁇ i ), when many steps are combined, the whole of all steps may lead to a serious degradation of the privacy protection effect.
  • the model often undergoes many rounds of iterations, such as thousands of rounds. Even if the privacy budget for a single round and a single training statement is set very small, after thousands of iterations, the privacy cost will often explode.
  • a total privacy budget ( ⁇ tot , ⁇ tot ) is set for the overall training process including T iterations.
  • the target budget information of the current iteration round t is determined, and then according to the target budget information, the noise power of the current target training sentence is obtained.
  • the total privacy budget ( ⁇ tot , ⁇ tot ) can be assigned to each iteration round according to the relationship between iteration steps, so as to obtain the privacy budget of the current iteration round t, and determine accordingly The noise power of the current target training sentence.
  • the influence of differential privacy DP amplification caused by the sampling process on the degree of privacy protection is also considered.
  • a sample is not included in the sample set at all, the sample is completely confidential, and the resulting effect is privacy amplification.
  • the sampling probability p is much smaller than 1.
  • the sampling process of each round will bring about DP amplification.
  • the privacy budget in ( ⁇ , ⁇ ) space is mapped to its dual space: Gaussian differential privacy space, thus facilitating the computation of privacy assignments.
  • Gaussian differential privacy is a concept proposed in the paper "Gaussian Differential Privacy” published in 2019.
  • a balance function T (trade-off function) is introduced.
  • P and Q the probability distribution functions
  • Hypothesis testing is performed based on P and Q
  • ⁇ is assumed to be a rejection rule under hypothesis testing .
  • the balance function defining P and Q is:
  • ⁇ ⁇ and ⁇ ⁇ respectively represent the first type error rate and the second type error rate of the hypothesis test under the rejection rule ⁇ . Therefore, the balance function T can obtain the minimum value of the sum of the first type error rate and the second type error rate under the above hypothesis test, that is, the minimum error sum.
  • the random mechanism M when the random mechanism M is satisfied, the value of the balance function T is greater than the value of a continuous convex function f, that is At this time, the random mechanism M is said to satisfy f differential privacy, that is, f-DP. It can be proved that the privacy representation space of f-DP forms the dual space of ( ⁇ , ⁇ )-DP representation space.
  • Gaussian differential privacy GDP (Gaussian differential privacy) is proposed.
  • Gaussian differential privacy is obtained by taking the function f in the above formula into a special form, which is the T function value between a Gaussian distribution with a mean of 0 and a variance of 1 and a Gaussian distribution with a mean of ⁇ and a variance of 1, namely : That is, if the random algorithm M satisfies: Then it is said to conform to Gaussian differential privacy GDP, denoted as G ⁇ -DP, or ⁇ -GDP.
  • the privacy loss is measured by the parameter ⁇ .
  • the Gaussian differentially private GDP representation space can be regarded as a subspace of the f-DP representation space, and also as the dual space of the ( ⁇ , ⁇ )-DP representation space.
  • the privacy measure in the Gaussian differential privacy GDP space, and the ( ⁇ , ⁇ )-DP representation space can be transformed into each other by the following formula (8):
  • ⁇ (t) is the integral of the standard normal distribution, namely:
  • the privacy superposition has a very compact computational form. Assume that n steps all satisfy GDP, and the values of ⁇ are ⁇ 1 , ⁇ 2 ,..., ⁇ n . According to the principle of GDP, the superposition result of the n steps still satisfies GDP, namely: And, the ⁇ value of the superposition result is
  • the total privacy parameter value It is proportional to the sampling probability p (denoted as p train in Formula 12), the square root of the total number of iterations T, and depends on the power operation result with the natural exponent e as the base and the privacy parameter value ⁇ train of a single iteration as the exponent.
  • the privacy budget allocated to the current round t and the current target training sentence can be calculated through the GDP space, so as to determine its noise power.
  • a total privacy budget ( ⁇ tot , ⁇ tot ) is set for the overall training process of T iterations.
  • the noise power of the current target training sentence can be determined according to the steps shown in FIG. 4 .
  • Fig. 4 shows a flow of steps for determining the noise power of the current training sentence according to one embodiment. It can be understood that the step flow in FIG. 4 can be understood as a sub-step of step 341 in FIG. 3 .
  • the total privacy budget ( ⁇ tot , ⁇ tot ) expressed in the ( ⁇ , ⁇ ) space can be transformed into the GDP space, and the total privacy parameter value after T iterations can be obtained
  • the above conversion can be carried out according to the aforementioned formula (8).
  • step 42 using the relational expression (12) under the central limit theorem, the privacy parameter value ⁇ train of a single iteration is deduced inversely. Specifically, according to the above relationship (12), it can be based on the total privacy parameter value The total number of iteration rounds T and the sampling probability p are calculated to obtain the privacy parameter value ⁇ train , which is used as the target privacy parameter value of the current iteration round t.
  • the noise power ⁇ t is determined based on the target privacy parameter value ⁇ train , the aforementioned clipping threshold C, and the number of characters of each training sentence in the current sample subset. Specifically, according to formula (11), the noise power applicable to the current iteration round t can be obtained:
  • the noise power is calculated for the sample subset of the t-th iteration. Therefore, different iterations correspond to different noise powers.
  • Any training sentence of shares the same noise power.
  • the corresponding noise power ⁇ t is determined.
  • random noise can be sampled from the Gaussian distribution formed based on the noise power, and superimposed on the sentence representation vector to obtain the target noise representation, as shown in the aforementioned formula (6).
  • the noise determined in this way can satisfy the privacy loss to meet the preset total privacy budget ( ⁇ tot , ⁇ tot ) after T iterations.
  • the upstream first party uses the local differential privacy technology to protect privacy at the granularity of training sentences. Further, in some embodiments, by considering the privacy amplification brought about by sampling and the superposition of the privacy cost of multiple iterations in the training process, the value added for privacy protection in each iteration is accurately calculated in the Gaussian differential privacy GDP space Noise makes the total privacy cost of the whole training process controllable and better achieves privacy protection.
  • the embodiment of this specification also discloses a device for jointly training an NLP model based on privacy protection, wherein the NLP model includes an encoding network located at the first party and a network located at the second party. Handle the network.
  • Fig. 5 shows a schematic structural diagram of a device for jointly training an NLP model according to an embodiment. The device is deployed in the aforementioned first party, and the first party can be implemented as any computing unit, platform, server, equipment etc. As shown in Figure 5, the device 500 includes:
  • a sentence obtaining unit 51 configured to obtain a local target training sentence
  • a representation forming unit 53 configured to input the target training sentence into the encoding network, and form a sentence representation vector based on the encoding output of the encoding network;
  • the noise adding unit 55 is configured to add target noise conforming to differential privacy on the sentence representation vector to obtain a target noise addition representation; the target noise addition representation is sent to the second party for use in the processing network train.
  • the sentence acquisition unit 51 is configured to: sample from the total local sample set according to a preset sampling probability p to obtain a sample subset for the current iteration round; read from the sample subset Take the target training sentence.
  • the representation forming unit 53 is configured to: obtain character representation vectors encoded by the encoding network for each character in the target training sentence;
  • the clipping operation of clipping the threshold is to form the sentence representation vector based on the clipped character representation vector.
  • the clipping operation performed by the representation forming unit 53 specifically includes: if the current norm value of the character representation vector exceeds the clipping threshold, determining the clipping threshold and the clipping threshold The ratio of the current norm value, the character representation vector is clipped according to the ratio.
  • the representation forming unit 53 is specifically configured to: concatenate the clipped character representation vectors of each character to form the sentence representation vector.
  • the apparatus 500 further includes a noise determination unit 54, specifically including:
  • the noise power determination module 541 is configured to determine the noise power for the target training sentence according to a preset privacy budget
  • the noise sampling module 542 is configured to obtain the target noise by sampling in the noise distribution determined according to the noise power.
  • the noise power determination module 541 is configured to: determine the sensitivity corresponding to the target training sentence according to the clipping threshold; The noise power of the target training sentence.
  • the noise power determination module 541 is configured to: determine the target budget information of the current iteration round t according to the preset total privacy budget for the total iteration round number T; according to the target budget information , to determine the noise power for the target training sentence.
  • the target training sentence is sequentially read from the sample subset used for the current iteration round t, and the sample subset is obtained from the local
  • the noise power determination module 541 is specifically configured to: convert the total privacy budget into a total privacy parameter value in a Gaussian differential privacy space; in the Gaussian differential privacy space Among them, according to the total privacy parameter value, the total number of iteration rounds T and the sampling probability p, determine the target privacy parameter value of the current iteration round t; according to the target privacy parameter value, the clipping threshold, and The number of characters of each training sentence in the sample subset determines the noise power.
  • the noise power determination module 541 is specifically configured to: deduce the target privacy parameter value based on the first relational expression for calculating the total privacy parameter value in the Gaussian differential privacy space, the first relation
  • the formula shows that the total privacy parameter value is proportional to the sampling probability p, the square root of the total number of iterations T, and depends on the natural exponent e as the base, and the power operation of the target privacy parameter value as the exponent result.
  • the foregoing encoding network may be implemented by using one of the following neural networks: long short-term memory network LSTM, bidirectional LSTM, and transformer network.
  • the first party can jointly train the NLP model with the second party under the condition of privacy protection.
  • a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed in a computer, the computer is instructed to execute the method described in conjunction with FIG. 3 .
  • a computing device including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, the method described in conjunction with FIG. 3 is implemented. .
  • the functions described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Evolutionary Computation (AREA)
  • Bioethics (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Medical Informatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Audiology, Speech & Language Pathology (AREA)
  • Biomedical Technology (AREA)
  • Molecular Biology (AREA)
  • Biophysics (AREA)
  • Databases & Information Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Machine Translation (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本说明书实施例提供一种基于隐私保护联合训练自然语言处理NLP模型的方法，其中NLP模型包括位于第一方的编码网络和位于第二方的处理网络。根据该方法，第一方获取本地的目标训练语句后，将其输入编码网络，基于所述编码网络的编码输出，形成句子表征向量。然后，在句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征。将该目标加噪表征发送至第二方，用于处理网络的训练。

Description

基于隐私保护联合训练自然语言处理模型的方法及装置
本申请要求于2021年12月13日提交中国国家知识产权局、申请号为202111517113.5、申请名称为“基于隐私保护联合训练自然语言处理模型的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本说明书一个或多个实施例涉及机器学习领域，尤其涉及一种基于隐私保护联合训练自然语言处理模型的方法及装置。
背景技术
机器学习的迅猛发展使得各种机器学习的模型在各种各样的业务场景得到应用。自然语言处理NLP(natural language processing)是一种常见的机器学习任务，广泛应用于多种业务场景中，例如，用户意图识别，智能客服问答，机器翻译，文本分析分类，等等。针对NLP任务，已经提出了多种神经网络模型和训练方法，来增强其语义理解能力。
可以理解，对于机器学习模型来说，模型预测性能极大地依赖于训练样本的丰富程度和可用程度，为了得到性能更加优异更符合实际业务场景的预测模型，往往需要大量贴合该业务场景的训练样本。针对具体NLP任务的NLP模型更是如此。为了具有丰富的训练数据，提升NLP模型的性能，在一些场景中，提出利用多个数据方的训练数据，共同训练NLP模型。然而，各个数据方本地的训练数据往往包含本地业务对象的隐私，特别是用户隐私，这为多方的联合训练带来安全和隐私方面的挑战。例如，智能问答作为一项具体的下游NLP任务，其训练数据需要大量的问题-答案对。在实际业务场景中，问题常常由用户端提出。然而，用户问题中往往包含用户个人的隐私信息，如果直接将用户端的用户问题发往例如服务端的另一方，可能存在隐私泄露的风险。
因此，希望能有改进的方案，在多方共同训练自然语言处理NLP模型的场景中，保护数据安全和数据隐私。
发明内容
本说明书一个或多个实施例描述了一种联合训练自然语言处理NLP模型的方法及装置，能够在联合训练过程中，保护训练样本提供方的数据隐私安全。
根据第一方面，提供一种基于隐私保护联合训练自然语言处理NLP模型的方法，所述NLP模型包括位于第一方的编码网络和位于第二方的处理网络，所述方法由第一方执行，包括：
获取本地的目标训练语句；
将所述目标训练语句输入所述编码网络，基于所述编码网络的编码输出，形成句子表征向量；
在所述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；所述目标加噪表征被发送至所述第二方，用于所述处理网络的训练。
根据一种实施方式，获取本地的目标训练语句，具体包括：根据预设的采样概率p，从本地样本总集中进行采样，得到用于当前迭代轮次的样本子集；从所述样本子集中读取所述目标训练语句。
在一种实施方式中，基于所述编码网络的编码输出，形成句子表征向量，具体包括：获取所述编码网络针对所述目标训练语句中各个字符进行编码的字符表征向量；针对所述 各个字符的字符表征向量进行基于预设裁剪阈值的裁剪操作，基于裁剪后的字符表征向量形成所述句子表征向量。
进一步的，在上述实施方式的一个实施例中，裁剪操作可以包括：若所述字符表征向量的当前范数值超过所述裁剪阈值，确定所述裁剪阈值与所述当前范数值的比例，将所述字符表征向量按照所述比例进行裁剪。
在上述实施方式的一个实施例中，形成句子表征向量具体可以包括：将所述各个字符的裁剪后的字符表征向量拼接，形成所述句子表征向量。
根据一种实施方式，在添加目标噪声之前，上述方法还包括：根据预设的隐私预算，确定针对所述目标训练语句的噪声功率；在根据所述噪声功率确定的噪声分布中，采样得到所述目标噪声。
在一个实施例中，上述确定针对所述目标训练语句的噪声功率具体包括：根据所述裁剪阈值，确定所述目标训练语句对应的敏感度；根据预设的单句隐私预算和所述敏感度，确定针对所述目标训练语句的噪声功率。
在另一实施例中，上述确定针对所述目标训练语句的噪声功率具体包括：根据预设的用于总迭代轮数T的总隐私预算，确定当前迭代轮次t的目标预算信息；根据所述目标预算信息，确定针对所述目标训练语句的噪声功率。
在以上实施例的一个具体示例中，目标训练语句是从用于当前迭代轮次t的样本子集中依次读取得到的，所述样本子集是根据预设的采样概率p，从本地样本总集中采样得到的；在这样的情况下，确定针对所述目标训练语句的噪声功率具体包括：将所述总隐私预算转换为高斯差分隐私空间中的总隐私参数值；在所述高斯差分隐私空间中，根据所述总隐私参数值、所述总迭代轮数T和所述采样概率p，确定当前迭代轮次t的目标隐私参数值；根据所述目标隐私参数值，所述裁剪阈值，以及所述样本子集中各个训练句子的字符数目，确定所述噪声功率。
更进一步的，当前迭代轮次t的目标隐私参数值可以如下确定：基于在所述高斯差分隐私空间中计算所述总隐私参数值的第一关系式反推出所述目标隐私参数值，所述第一关系式示出，所述总隐私参数值正比于所述采样概率p，所述总迭代轮数T的平方根，并依赖于以自然指数e为底数，以所述目标隐私参数值为指数的幂运算结果。
在不同实施方式中，前述编码网络可以采用以下神经网络之一实现：长短期记忆网络LSTM，双向LSTM，transformer网络。
根据第二方面，提供一种基于隐私保护联合训练自然语言处理NLP模型的装置，所述NLP模型包括位于第一方的编码网络和位于第二方的处理网络，所述装置部署在第一方，包括：
语句获取单元，配置为获取本地的目标训练语句；
表征形成单元，配置为将所述目标训练语句输入所述编码网络，基于所述编码网络的编码输出，形成句子表征向量；
加噪单元，配置为在所述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；所述目标加噪表征被发送至所述第二方，用于所述处理网络的训练。
根据第三方面，提供了一种计算机可读存储介质，其上存储有计算机程序，当该计算机程序在计算机中执行时，令计算机执行上述第一方面提供的方法。
根据第四方面，提供了一种计算设备，包括存储器和处理器，存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述第一方面提供的方法。
在本说明书实施例提供的联合训练NLP模型的方案中，利用本地差分隐私技术，以训练语句为粒度，进行隐私保护。进一步的，在一些实施例中，通过考虑采样带来的隐私放大，以及训练过程中多轮迭代的隐私成本叠加，更好地设计为进行隐私保护所添加的噪声，使得整个训练过程的隐私成本可控。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1示出根据一个实施例的联合训练NLP模型的实施架构示意图；
图2示出根据一个实施例进行隐私保护处理的示意图；
图3示出根据一个实施例的基于隐私保护联合训练NLP模型的方法流程示意图；
图4示出根据一个实施例确定当前训练语句的噪声功率的步骤流程；
图5示出根据一个实施例的联合训练NLP模型的装置的结构示意图。
具体实施方式
下面结合附图，对本说明书提供的方案进行描述。
如前所述，在多方共同训练自然语言处理NLP模型的场景中，数据安全和隐私保护是需要关注的问题。如何保护各数据方数据的隐私和安全，同时尽量不影响训练出的NLP模型的预测性能，是一项挑战。
为此，本说明书实施例提出一种联合训练NLP模型的方案，其中利用本地差分隐私技术，以训练语句为粒度，进行隐私保护。进一步的，在一些实施例中，通过考虑采样带来的隐私放大，以及训练过程中多轮迭代的隐私成本叠加，更好地设计为进行隐私保护所添加的噪声，使得整个训练过程的隐私成本可控。
图1示出根据一个实施例的联合训练NLP模型的实施架构示意图。如图1所示，由第一方100和第二方200联合训练执行特定NLP任务的NLP模型。相应的，该NLP模型被划分为编码网络10和处理网络20，编码网络10部署在第一方100，用于对输入文本进行编码，该编码处理可以理解为上游的、通用文本理解任务。处理网络20部署在第二方200，用于对编码后的文本表征进行进一步处理，并执行与特定NLP任务相关的预测。换而言之，处理网络20用于执行下游的、针对特定NLP任务的处理过程。该特定NLP任务例如可以是，智能问答、文本分类、意图识别、情绪识别、机器翻译，等等。
在不同实施例中，上述第一方和第二方，可以是各种数据存储和数据处理设备/平台。在一个实施例中，第一方可以是用户终端设备，第二方是服务器设备，用户终端设备利用其本地采集的用户输入文本，与服务器进行联合训练。在另一例子中，第一方和第二方均为平台型设备，例如，第一方为客服平台，其中采集存储有大量用户问题；第二方为需要训练问答模型的平台，等等。
为训练NLP模型，可选地，第二方200可以首先利用其本地的训练文本数据，对处理网络200进行预训练；然后，联合第一方100，利用第一方100的训练数据进行联合训练。在联合训练过程中，处于上游的第一方100，需要将编码后的文本表征发送给下游的第二方200，使其利用该文本表征继续对处理网络200进行训练。这个过程中，第一方100发送的文本表征，有可能携带用户隐私信息，容易造成隐私泄露风险。尽管已提出一些例如用户匿名化的隐私保护方案，但是，仍然有可能通过反匿名化处理，还原出用户隐私信息。因此，仍需对第一方提供的信息进行隐私保护增强。
为此，根据本说明书的实施例，基于差分隐私的思想，在将用户文本作为训练语料输入编码网络10后，对编码网络10的输出进行隐私保护处理，为其添加满足差分隐私的噪声，得到加噪文本表征，然后将这样的加噪文本表征发送至第二方200。第二方200基于加噪文本表征继续训练处理网络200，并将梯度信息回传，实现两方的联合训练。在以上的联合训练过程中，第一方100所发送的文本表征含有随机噪声，使得第二方200无法获知第一方的训练文本中的隐私信息。并且，根据差分隐私的原理，可以通过设计所添加的 噪声幅度，使得联合训练的NLP模型的模型性能受到尽可能小的影响。
图2示出根据一个实施例进行隐私保护处理的示意图。该隐私保护处理在图1所示的第一方100中执行。如图2所示，第一方首先从本地的用户文本数据(作为样本集)中读取一个训练语句作为当前输入文本。可选地，该训练语句可以通过在用户文本数据中采样来获得。然后，第一方将该当前输入文本输入编码网络10，得到编码网络10的编码表征。根据本说明书的实施例，在编码网络10之后，接续隐私处理层11。该隐私处理层11在下文中又简称为DP(差分隐私)层。DP层11是非参数化的网络层，根据预先设定的超参数和算法进行隐私处理，而无需进行调参和训练。在本说明书的实施例中，针对当前训练语句，DP层11根据编码网络10的编码而得到句子表征后，针对该句子表征施加符合差分隐私的噪声，得到加噪表征作为隐私处理后的文本表征发送给第二方，从而以训练语句为粒度，施加隐私保护。
在下文具体描述施加噪声的详细过程之前，首先对差分隐私的基本原理进行简单的介绍。
差分隐私DP(Differential Privacy)是密码学中的一种手段，旨在提供一种当从统计数据库查询时，最大化数据查询的准确性，同时最大限度减少识别其记录的机会。设有随机算法M，PM为M所有可能的输出构成的集合。对于任意两个邻近数据集x和x＇(即x和x＇仅有一条数据记录不同)以及PM的任何子集
Figure PCTCN2022125464-appb-000001
若随机算法M满足：
Figure PCTCN2022125464-appb-000002
则称算法M提供ε-差分隐私保护，其中参数ε称为隐私保护预算，用于平衡隐私保护程度和准确度。ε通常可以预先设定。ε越接近0，e ε越接近1，随机算法对两个邻近数据集x和x＇的处理结果越接近，隐私保护程度越强。
实践中，对式(1)示出的严格的ε-差分隐私可以进行一定程度放宽，实现为(ε,δ)差分隐私，即如下式(2)所示：
Figure PCTCN2022125464-appb-000003
其中，δ为松弛项，又称为容忍度，可以理解为不能实现严格差分隐私的概率。
需注意的是，常规的差分隐私DP处理，是由提供数据查询的数据库拥有方执行。在图1所示的场景中，在NLP模型训练好之后，由第二方200提供针对前述特定NLP任务的预测结果查询，因此第二方200作用为提供数据查询的服务方。而根据图1和图2的示意，在本说明书的实施方式中，由第一方100在其本地对语句文本(在模型训练阶段为训练语句，在模型训练好之后的预测使用阶段，则为查询语句)进行隐私保护后，发送给第二方200。因此，上述实施方式是在终端侧进行本地差分隐私LDP(Local Differential Privacy)处理。
差分隐私的实现方式包括，噪声机制、指数机制等。在噪声机制的情况下，一般根据查询函数的敏感度，确定所添加噪声的幅度。上述敏感度表示，该查询函数在一对相邻数据集x和x＇查询时其查询结果的最大差异。
在如图2所示的实施例中，利用噪声机制实现差分隐私。具体的，以训练语句为处理粒度，根据编码网络针对训练语句的输出敏感度以及预设的隐私预算，确定噪声功率，进而在句子表征上施加相应的随机噪声而实现差分隐私。由于是在句子的尺度上施加噪声，这意味着，上述实施例中隐私保护的粒度为句子层级。相对于字词粒度的隐私保护，句子粒度的隐私保护方案相当于隐藏或模糊了一整个句子(由一系列字词构成)，因此隐私保护程度更强，隐私保护效果更好。
下面结合具体的实施例，描述在第一方中进行隐私保护处理的具体实施步骤。
图3示出根据一个实施例的基于隐私保护联合训练NLP模型的方法流程示意图，其中NLP模型包括位于第一方的编码网络和位于第二方的处理网络，以下步骤流程由其中的第一方执行，该第一方具体可以实现为任何具有计算、处理能力的服务器、装置、平台或 设备，例如用户终端设备，平台型设备，等等。下面详细描述图3中的各个流程步骤的具体实施方式。
如图3所示，首先在步骤31，获取本地的目标训练语句。
在一个实施例中，上述目标训练语句是第一方预先采集的训练样本集中的任一训练语句。相应的，第一方可以依次或随机地从该样本集中读取语句，作为上述目标训练语句。
在另一实施例中，考虑到训练所需的多轮迭代过程，在每一迭代轮次中，从本地样本总集中采样出一小批样本(mini-batch)，构成该轮次所用的样本子集。上述采样可以基于一个预设的采样概率p进行。这样的采样过程又可称为泊松采样。假定当前处于第t轮迭代过程，相应的，基于上述采样概率p，采样得到了针对当前第t轮迭代的当前样本子集x t。在这样的情况下，可以依次从该当前样本子集x t中读取语句作为目标训练语句。该目标训练语句可记为x。
可以理解，上述目标训练语句可以是第一方中预先获取到的与业务对象相关的语句，例如，一个用户问句，一句用户聊天记录，一条用户输入文本，或其他有可能涉及业务对象的隐私信息的语句文本。对于训练语句的内容在此不做限定。
接着，在步骤33，将上述目标训练语句输入编码网络，基于编码网络的编码输出，形成句子表征向量。
如前所述，编码网络用于对输入文本进行编码，即执行上游的、通用的文本理解任务。一般地，编码网络可以首先针对目标训练语句中的各个字符(token)(一个字符可以对应一个字，一个词，或者一个标点)进行编码，得到各个字符的字符表征向量；然后基于各个字符表征向量，融合形成句子表征向量。具体实践中，该编码网络可以通过多种神经网络实现。
在一个实施例中，上述编码网络通过长短期记忆LSTM网络实现。在这样的情况下，可以将目标训练语句转化为字符序列，将上述字符序列中的各个字符依次输入该LSTM网络，LSTM网络依次处理各个字符。其中，在任一时刻，LSTM网络根据之前输入字符对应的隐状态和当前输入字符，得到当前输入字符对应的隐状态作为其对应的字符表征向量，从而依次得到各个字符对应的字符表征向量。
在另一个实施例中，上述编码网络通过双向LSTM网络，即BiLSTM实现。在这样的情况下，可以将目标训练语句对应的字符序列按照正向，反向的顺序，分两次输入上述BiLSTM网络，分别得到各个字符正向输入时的第一表征和反向输入时的第二表征。融合同一字符的第一表征和第二表征，可以得到该字符经BiLSTM编码的字符表征向量。
在又一实施例中，上述编码网络通过Transformer网络实现。在这样的情况下，可以将目标训练语句的各个字符连同其位置信息，一并输入Transformer网络。Transformer网络基于注意力机制，对各个字符进行编码，得到各个字符表征向量。
在其他实施例中，上述编码网络还可以采用已有的其他适合进行文本编码的神经网络实现，在此不做限定。
基于各个字符的字符表征向量，可以融合得到该目标训练语句的句子表征向量。根据不同神经网络的特点，可以采用多种方式进行融合。例如，在一个实施例中，可以将各个字符的字符表征向量进行拼接，得到句子表征向量。在另一实施例中，可以基于注意力机制，将各个字符表征向量进行加权组合，得到句子表征向量。
根据一种实施方式，在以上编码网络针对各个字符编码得到字符表征向量之后，可以针对各个字符的字符表征向量进行基于预设裁剪阈值的裁剪操作，基于裁剪后的字符表征向量形成句子表征向量。剪裁操作一方面对字符表征向量，以及进而产生的句子表征向量进行一定程度的模糊化，更重要的是，裁剪操作可以便于衡量编码网络针对训练语句输出的敏感度，从而便于后续隐私成本的计算。
如前所述，在噪声机制中，需根据敏感度来决定噪声功率，其中敏感度表示，查询函 数对相邻数据集x和x＇查询时其查询结果的最大差异。在编码网络针对训练语句进行编码的场景下，敏感度可以定义为，编码网络针对一对训练语句编码出的句子表征向量之间的最大差异。具体的，用x表示一个训练语句，用f(x)表示编码网络的编码输出，那么f函数的敏感度Δ，可以表示为两个训练语句x和x′的编码输出(句子表征向量)之间的最大差异，即：
Figure PCTCN2022125464-appb-000004
其中，‖·‖ 2表示二阶范数。
可以理解，如果对训练语句x的范围没有约束，对编码网络的输出范围没有约束，那么敏感度Δ的准确估计存在一定的困难。因此，在一种实施方式中，针对各个字符的字符表征向量进行裁剪，将其限制在一定范围之内，从而便于上述敏感度的计算。
具体地，在一个实施例中，针对字符表征向量的裁剪操作可以如下进行。假定x v表示目标训练语句x中第v个字符的字符表征向量，那么可以判断，该字符表征向量x v的当前范数值(例如二阶范数值)是否超过预设的裁剪阈值C，若超过，则根据该裁剪阈值C与当前范数值的比例，对x v进行裁剪。
在一个具体例子中，针对字符表征向量x v的裁剪过程可以用以下公式(4)表示：
Figure PCTCN2022125464-appb-000005
公式(4)中，CL表示裁剪操作函数，C为裁剪阈值，min为取最小函数。当‖x v‖ 2小于C时，C与‖x v‖ 2的比例大于1，min函数取值为1，此时，不对x v进行裁剪；当‖x v‖ 2大于C时，C与‖x v‖ 2的比例小于1，min函数取值即为该比例，此时，按照该比例对x v进行裁剪，也就是将x v中所有元素乘以该比例系数。
在一个实施例中，基于各个字符的裁剪后的字符表征向量的拼接，形成句子表征向量。
在进行上述裁剪的情况下，如果训练语句x中包含n个字符，那么，编码网络输出的敏感度可以表示为：
Δ＝n·C         (5)
可以理解，裁剪阈值C是预先设定的一个超参数。该裁剪阈值C数值越小，敏感度越小，后续需要添加的噪声功率越小。然而，另一方面，C值越小意味着裁剪幅度越大，这有可能影响字符表征向量的语义信息，进而影响编码网络的性能。因此，可以通过设置适当的裁剪阈值C的大小，来对以上两个因素进行权衡。
在步骤33形成句子表征向量的基础上，在步骤35，在上述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；该目标加噪表征后续会发送至第二方，用于第二方中下游的处理网络的训练。实际操作中，第一方可以在每得到一个训练语句的加噪表征后，就将其发送给第二方；也可以获取一小批训练语句的加噪表征后，一并发送给第二方，在此不做限定。
可以理解，为实现差分隐私保护，上述目标噪声的确定至关重要。根据一种实施方式，在步骤35之前，该方法还包括确定目标噪声的步骤34。该步骤34可以包括，首先在步骤341，根据预设的隐私预算，确定针对上述目标训练语句的噪声功率(或者分布方差)；然后在步骤342，根据噪声功率确定的噪声分布中，采样得到上述目标噪声。在不同例子中，上述目标噪声可以是满足ε-差分隐私的拉普拉斯噪声，或者满足(ε,δ)差分隐私的高斯噪声，等等。目标噪声的确定和添加，可以有多种不同实现方式。
在一个实施例中，基于裁剪后的字符表征向量形成句子表征向量，在该句子表征向量上添加符合(ε,δ)差分隐私的高斯噪声。在该实施例中，得到的目标加噪表征可以表示为：
Figure PCTCN2022125464-appb-000006
其中，CL(f(x))表示基于裁剪操作CL后的字符表征向量形成的句子表征向量，
Figure PCTCN2022125464-appb-000007
表示均值为0，方差为σ 2的高斯分布。σ 2或σ又可称为噪声功率。根据该公式(6)，对于目标训练语句x来说，在确定出其噪声功率σ 2后，就可以在基于噪声功率形成的高斯 分布中采样出随机噪声，将其叠加在句子表征向量上，得到目标加噪表征。
在不同实施例中，可以通过不同方式确定出上述目标训练语句对应的噪声功率σ 2，即执行步骤341。
在一个例子中，预先针对单个(例如第i个)训练语句设置隐私预算(ε i,δ i)。在这样的情况下，可以根据针对上述目标训练语句设定的隐私预算和敏感度Δ，确定出噪声功率σ 2。其中，敏感度可以例如按照前述公式(5)根据裁剪阈值C和目标训练语句的字符数而确定。
在一个实施例中，考虑隐私成本的叠加，针对整体训练过程设置总隐私预算。隐私成本的叠加(composition)是指，在诸如NLP处理和模型训练的多步骤处理过程中，需要基于隐私数据集执行一系列的计算步骤，每个计算步骤潜在地基于利用同一隐私数据集的前一计算步骤的计算结果。即使每个步骤i以隐私成本(ε i,δ i)进行DP隐私保护，当诸多步骤组合在一起时，所有步骤的整体则可能导致隐私保护效果的严重降级。具体的，在NLP模型的训练过程中，模型往往要经历许多轮次的迭代，例如几千轮次。即使针对单个轮次、单个训练语句的隐私预算被设置的非常小，在经过上千次迭代后，常常也会引起隐私成本爆炸的现象。
为此，在一种实施方式中，假定NLP模型的总迭代轮数为T，针对包含T轮迭代的整体训练过程设置总隐私预算(ε tot,δ tot)。根据该总隐私预算，确定当前迭代轮次t的目标预算信息，再根据该目标预算信息，得到针对当前的目标训练语句的噪声功率。
具体的，在一些实施例中，可以根据迭代步骤之间的关系，将总隐私预算(ε tot,δ tot)分配给各个迭代轮次，从而得到当前迭代轮次t的隐私预算，据此确定当前目标训练语句的噪声功率。
进一步的，在一个实施例中，还考虑采样过程引起的差分隐私DP放大对隐私保护程度的影响。直观地，当一个样本根本没有包含在采样的样本集中时，该样本是完全保密的，由此带来的效应即为隐私放大。如前所述，在一些实施例中，在每一迭代轮次中，以采样概率p从本地样本集中采样出一小批样本作为本轮的样本子集。一般地，该采样概率p远小于1。由此，每一轮次的采样过程将会带来DP放大。
为了综合考虑隐私叠加和采样造成的DP放大的影响而更好地计算总隐私预算的分配，在一个实施例中，将(ε,δ)空间中的隐私预算映射至其对偶空间：高斯差分隐私空间，从而便于隐私分配的计算。
高斯差分隐私是2019年发表的论文“Gaussian Differential Privacy”中提出的概念。根据该论文，为了衡量隐私损失，引入了平衡函数T(trade-off function)。假定某个随机机制M，作用在两个相邻数据集S和S’上，得到的概率分布函数记为P和Q，基于P和Q进行假设检验，假定Ф为假设检验下的一个拒绝规则。基于此，定义P和Q的平衡函数为：
T(P,Q)(α)＝inf{β φ:α φ≤α}         (7)
其中，α φ和β φ分别表示在拒绝规则Ф下假设检验的第一类错误率和第二类错误率。由此，该平衡函数T可以得到上述假设检验下第一类错误率和第二类错误率的和值的最小值，即最小错误和。T函数值越大，两个分布P和Q之间越难以区分。
基于以上定义，当随机机制M满足，平衡函数T取值大于一个连续凸函数f的取值，即
Figure PCTCN2022125464-appb-000008
此时，称随机机制M满足f差分隐私，即f-DP。可以证明，f-DP的隐私表征空间，形成(ε，δ)-DP表征空间的对偶空间。
进一步地，在f-DP的范围中，提出了非常重要的一种隐私刻画机制，即高斯差分隐私GDP(Gaussian differential privacy)。高斯差分隐私通过将上式中的函数f取特殊形式而得到，该特殊形式即为，均值为0方差为1的高斯分布和均值为μ方差为1的高斯分布之间的T函数值，即：
Figure PCTCN2022125464-appb-000009
即，如果随机算法M满足：
Figure PCTCN2022125464-appb-000010
Figure PCTCN2022125464-appb-000011
则称其符合高斯差分隐私GDP，记为G μ-DP，或μ-GDP。
可以理解，在高斯差分隐私GDP的度量空间中，隐私损失通过参数μ衡量。并且，作为f-DP族中的一类，高斯差分隐私GDP表征空间可以视为f-DP表征空间的子空间，同样作为(ε，δ)-DP表征空间的对偶空间。
高斯差分隐私GDP空间中的隐私度量，和(ε，δ)-DP表征空间可以通过以下公式(8)互相转化：
Figure PCTCN2022125464-appb-000012
μ＝Δ/σ          (9)
其中，Φ(t)是标准正态分布的积分，即：
Figure PCTCN2022125464-appb-000013
在高斯差分隐私GDP的度量空间中，隐私叠加具有非常简洁的计算形式。假定n个步骤均满足GDP，其且μ值分别为μ 1,μ 2,…,μ n。根据GDP的原理，该n个步骤的叠加结果仍然满足GDP，即：
Figure PCTCN2022125464-appb-000014
并且，叠加结果的μ值为
Figure PCTCN2022125464-appb-000015
Figure PCTCN2022125464-appb-000016
结合到图3所示的流程中。假定当前进行到第t轮迭代，x t表示针对当前第t轮迭代采样的样本子集，|x t|表示该样本子集中训练语句的数目。
Figure PCTCN2022125464-appb-000017
表示该样本子集中第k个句子，
Figure PCTCN2022125464-appb-000018
表示该句子中的字符数目。那么，根据前述公式(5)，该句子对应的敏感度可表示为：
Figure PCTCN2022125464-appb-000019
结合公式(9)和(10)，可以假定针对该第k个句子的噪声添加处理满足
Figure PCTCN2022125464-appb-000020
Figure PCTCN2022125464-appb-000021
根据前述GDP空间中的叠加原理，在针对第t轮的样本子集中的各个训练句子分别执行满足GDP的噪声处理后，叠加的结果依然满足GDP，且其μ值为：
Figure PCTCN2022125464-appb-000022
以上得出了一轮迭代的隐私叠加损失μ train。然而，NLP模型的训练要历经多轮迭代，在每轮迭代重新采样的情况下，考虑到采样的隐私放大效应，各轮迭代之间不再适用以上叠加原理。通过对GDP空间中采样概率p引起的隐私放大进行研究，可以得到GDP空间中的中心极限定理，即，在各轮迭代的隐私参数值均为μ train的情况下，当迭代轮次T足够大(趋于无穷)时，T次迭代后的总隐私参数值满足以下关系式(12)：
Figure PCTCN2022125464-appb-000023
上述关系式示出，总隐私参数值
Figure PCTCN2022125464-appb-000024
正比于采样概率p(公式12中记为p train)，总迭代轮数T的平方根，并依赖于以自然指数e为底数，以单轮迭代的隐私参数值μ train为指数的幂运算结果。
由此，综合以上(8)-(12)，可以通过GDP空间，计算分配给当前轮次t以及当前的目标训练语句的隐私预算，从而确定出其噪声功率。具体的，假定针对总迭代轮次T次的整体训练过程设置总隐私预算(ε tot,δ tot)。可以根据图4示出的步骤，确定出当前的目标训练语句的噪声功率。
图4示出根据一个实施例确定当前训练语句的噪声功率的步骤流程。可以理解，图4的步骤流程可以理解为图3中步骤341的子步骤。如图4所示，首先，在步骤41，可以将该(ε,δ)空间中表示的总隐私预算(ε tot,δ tot)转换到GDP空间，得到T次迭代后的总隐私参数值
Figure PCTCN2022125464-appb-000025
上述转化可以根据前述公式(8)进行。
然后，在步骤42，利用中心极限定理下的关系式(12)，反推出单轮迭代的隐私参数值μ train。具体地，根据上述关系式(12)，可以基于总隐私参数值
Figure PCTCN2022125464-appb-000026
总迭代轮数T和采样概率p，计算得到隐私参数值μ train，作为当前迭代轮次t的目标隐私参数值。
接着，在步骤43，基于目标隐私参数值μ train，前述裁剪阈值C，以及当前样本子集中各个训练句子的字符数目，确定噪声功率σ t。具体的，根据公式(11)，可以得到当前迭代轮次t适用的噪声功率：
Figure PCTCN2022125464-appb-000027
根据公式(13)，该噪声功率是针对第t轮迭代的样本子集计算的，因此，不同迭代轮次对应于不同的噪声功率，同一迭代轮次(如第t轮迭代)的样本子集中的任一训练语句共享同一噪声功率。由此，根据目标训练语句所在的迭代轮次的样本子集，确定出对应的噪声功率σ t。
于是，就可以在基于该噪声功率形成的高斯分布中采样出随机噪声，将其叠加在句子表征向量上，得到目标加噪表征，如前述公式(6)所示。通过该方式确定的噪声，可以满足在T次迭代后，隐私损失满足预设的总隐私预算(ε tot,δ tot)。
回顾以上总体过程，在本说明书实施例的联合训练NLP模型的过程中，处于上游的第一方利用本地差分隐私技术，以训练语句为粒度，进行隐私保护。进一步的，在一些实施例中，通过考虑采样带来的隐私放大，以及训练过程中多轮迭代的隐私成本叠加，在高斯差分隐私GDP空间中精确计算每轮迭代中为进行隐私保护所添加的噪声，使得整个训练过程的总隐私成本可控，更好地实现隐私保护。
另一方面，与上述联合训练的相对应的，本说明书实施例还披露一种基于隐私保护联合训练NLP模型的装置，其中所述NLP模型包括位于第一方的编码网络和位于第二方的处理网络。图5示出根据一个实施例的联合训练NLP模型的装置的结构示意图，该装置部署在前述第一方中，该第一方可以实现为任何具有计算、处理能力的计算单元、平台、服务器、设备等。如图5所示，该装置500包括：
语句获取单元51，配置为获取本地的目标训练语句；
表征形成单元53，配置为将所述目标训练语句输入所述编码网络，基于所述编码网络的编码输出，形成句子表征向量；
加噪单元55，配置为在所述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；所述目标加噪表征被发送至所述第二方，用于所述处理网络的训练。
根据一种实施方式，所述语句获取单元51配置为：根据预设的采样概率p，从本地样本总集中进行采样，得到用于当前迭代轮次的样本子集；从所述样本子集中读取所述目标训练语句。
在一种实施方式中，所述表征形成单元53配置为：获取所述编码网络针对所述目标训练语句中各个字符进行编码的字符表征向量；针对所述各个字符的字符表征向量进行基于预设裁剪阈值的裁剪操作，基于裁剪后的字符表征向量形成所述句子表征向量。
进一步的，在上述实施方式的一个实施例中，所述表征形成单元53实施的裁剪操作具体包括：若所述字符表征向量的当前范数值超过所述裁剪阈值，确定所述裁剪阈值与所述当前范数值的比例，将所述字符表征向量按照所述比例进行裁剪。
在上述实施方式的一个实施例中，所述表征形成单元53具体配置为：将所述各个字符的裁剪后的字符表征向量拼接，形成所述句子表征向量。
根据一种实施方式，该装置500，还包括噪声确定单元54，具体包括：
噪声功率确定模块541，配置为根据预设的隐私预算，确定针对所述目标训练语句的噪声功率；
噪声采样模块542，配置为在根据所述噪声功率确定的噪声分布中，采样得到所述目标噪声。
在一个实施例中，所述噪声功率确定模块541配置为：根据所述裁剪阈值，确定所述目标训练语句对应的敏感度；根据预设的单句隐私预算和所述敏感度，确定针对所述目标 训练语句的噪声功率。
在另一实施例中，所述噪声功率确定模块541配置为：根据预设的用于总迭代轮数T的总隐私预算，确定当前迭代轮次t的目标预算信息；根据所述目标预算信息，确定针对所述目标训练语句的噪声功率。
在以上实施例的一个具体示例中，所述目标训练语句是从用于当前迭代轮次t的样本子集中依次读取得到的，所述样本子集是根据预设的采样概率p，从本地样本总集中采样得到的；在这样的情况下，所述噪声功率确定模块541具体配置为：将所述总隐私预算转换为高斯差分隐私空间中的总隐私参数值；在所述高斯差分隐私空间中，根据所述总隐私参数值、所述总迭代轮数T和所述采样概率p，确定当前迭代轮次t的目标隐私参数值；根据所述目标隐私参数值，所述裁剪阈值，以及所述样本子集中各个训练句子的字符数目，确定所述噪声功率。
更进一步的，所述噪声功率确定模块541具体配置为：基于在所述高斯差分隐私空间中计算所述总隐私参数值的第一关系式反推出所述目标隐私参数值，所述第一关系式示出，所述总隐私参数值正比于所述采样概率p，所述总迭代轮数T的平方根，并依赖于以自然指数e为底数，以所述目标隐私参数值为指数的幂运算结果。
在不同实施方式中，前述编码网络可以采用以下神经网络之一实现：长短期记忆网络LSTM，双向LSTM，transformer网络。
通过以上装置，第一方实现在隐私保护的情况下，与第二方联合训练NLP模型。
根据另一方面的实施例，还提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行结合图3所描述的方法。
根据再一方面的实施例，还提供一种计算设备，包括存储器和处理器，该存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现结合图3所描述的方法。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (13)

  1. 一种基于隐私保护联合训练自然语言处理NLP模型的方法，所述NLP模型包括位于第一方的编码网络和位于第二方的处理网络，所述方法由第一方执行，包括：
    获取本地的目标训练语句；
    将所述目标训练语句输入所述编码网络，基于所述编码网络的编码输出，形成句子表征向量；
    在所述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；所述目标加噪表征被发送至所述第二方，用于所述处理网络的训练。
  2. 根据权利要求1所述的方法，其中，获取本地的目标训练语句，包括：
    根据预设的采样概率p，从本地样本总集中进行采样，得到用于当前迭代轮次的样本子集；
    从所述样本子集中读取所述目标训练语句。
  3. 根据权利要求1所述的方法，其中，基于所述编码网络的编码输出，形成句子表征向量，包括：
    获取所述编码网络针对所述目标训练语句中各个字符进行编码的字符表征向量；
    针对所述各个字符的字符表征向量进行基于预设裁剪阈值的裁剪操作，基于裁剪后的字符表征向量形成所述句子表征向量。
  4. 根据权利要求3所述的方法，其中，所述基于预设裁剪阈值的裁剪操作包括：
    若所述字符表征向量的当前范数值超过所述裁剪阈值，确定所述裁剪阈值与所述当前范数值的比例，将所述字符表征向量按照所述比例进行裁剪。
  5. 根据权利要求3所述的方法，其中，基于裁剪后的字符表征向量形成所述句子表征向量，包括：
    将所述各个字符的裁剪后的字符表征向量拼接，形成所述句子表征向量。
  6. 根据权利要求3所述的方法，其中，在所述句子表征向量上添加符合差分隐私的目标噪声之前，还包括：
    根据预设的隐私预算，确定针对所述目标训练语句的噪声功率；
    在根据所述噪声功率确定的噪声分布中，采样得到所述目标噪声。
  7. 根据权利要求6所述的方法，其中，根据预设的隐私预算，确定针对所述目标训练语句的噪声功率，包括：
    根据所述裁剪阈值，确定所述目标训练语句对应的敏感度；
    根据预设的单句隐私预算和所述敏感度，确定针对所述目标训练语句的噪声功率。
  8. 根据权利要求6所述的方法，其中，根据预设的隐私预算，确定针对所述目标训练语句的噪声功率，包括：
    根据预设的用于总迭代轮数T的总隐私预算，确定当前迭代轮次t的目标预算信息；
    根据所述目标预算信息，确定针对所述目标训练语句的噪声功率。
  9. 根据权利要求8所述的方法，其中，所述目标训练语句是从用于当前迭代轮次t的样本子集中依次读取得到的，所述样本子集是根据预设的采样概率p，从本地样本总集中采样得到的；
    所述确定当前迭代轮次t的目标预算信息，包括：
    将所述总隐私预算转换为高斯差分隐私空间中的总隐私参数值；
    在所述高斯差分隐私空间中，根据所述总隐私参数值、所述总迭代轮数T和所述采样概率p，确定当前迭代轮次t的目标隐私参数值；
    根据所述目标预算信息，确定针对所述目标训练语句的噪声功率，包括：
    根据所述目标隐私参数值，所述裁剪阈值，以及所述样本子集中各个训练句子的字符数目，确定所述噪声功率。
  10. 根据权利要求9所述的方法，其中，确定当前迭代轮次t的目标隐私参数值，包括：
    基于在所述高斯差分隐私空间中计算所述总隐私参数值的第一关系式反推出所述目标隐私参数值，所述第一关系式示出，所述总隐私参数值正比于所述采样概率p，所述总迭代轮数T的平方根，并依赖于以自然指数e为底数，以所述目标隐私参数值为指数的幂运算结果。
  11. 根据权利要求1所述的方法，其中，所述编码网络采用以下神经网络之一实现：
    长短期记忆网络LSTM，双向LSTM，transformer网络。
  12. 一种基于隐私保护联合训练自然语言处理NLP模型的装置，所述NLP模型包括位于第一方的编码网络和位于第二方的处理网络，所述装置部署在第一方，包括：
    语句获取单元，配置为获取本地的目标训练语句；
    表征形成单元，配置为将所述目标训练语句输入所述编码网络，基于所述编码网络的编码输出，形成句子表征向量；
    加噪单元，配置为在所述句子表征向量上添加符合差分隐私的目标噪声，得到目标加噪表征；所述目标加噪表征被发送至所述第二方，用于所述处理网络的训练。
  13. 一种计算设备，包括存储器和处理器，其特征在于，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-11中任一项所述的方法。
PCT/CN2022/125464 2021-12-13 2022-10-14 基于隐私保护联合训练自然语言处理模型的方法及装置 Ceased WO2023109294A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/572,937 US20240419839A1 (en) 2021-12-13 2022-10-14 Method and apparatus for jointly training natural language processing model based on privacy protection

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111517113.5 2021-12-13
CN202111517113.5A CN113961967B (zh) 2021-12-13 2021-12-13 基于隐私保护联合训练自然语言处理模型的方法及装置

Publications (1)

Publication Number Publication Date
WO2023109294A1 true WO2023109294A1 (zh) 2023-06-22

Family

ID=79473206

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125464 Ceased WO2023109294A1 (zh) 2021-12-13 2022-10-14 基于隐私保护联合训练自然语言处理模型的方法及装置

Country Status (3)

Country Link
US (1) US20240419839A1 (zh)
CN (1) CN113961967B (zh)
WO (1) WO2023109294A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117852071A (zh) * 2023-12-01 2024-04-09 羚羊工业互联网股份有限公司 基于大模型的隐私保护方法及相关装置、设备和存储介质
CN119201981A (zh) * 2024-11-27 2024-12-27 浪潮软件科技有限公司 一种自适应sql差分隐私加噪方法
CN119494408A (zh) * 2025-01-16 2025-02-21 厦门理工学院 基于差分隐私机制的大模型训练方法、介质及系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113961967B (zh) * 2021-12-13 2022-03-22 支付宝(杭州)信息技术有限公司 基于隐私保护联合训练自然语言处理模型的方法及装置
CN114547687A (zh) * 2022-02-22 2022-05-27 浙江星汉信息技术股份有限公司 基于差分隐私技术的问答系统模型训练方法和装置
CN115640611B (zh) * 2022-11-25 2023-05-23 荣耀终端有限公司 一种自然语言处理模型的更新方法及相关设备
CN116303908A (zh) * 2023-04-10 2023-06-23 阳光保险集团股份有限公司 基于噪声约束的句子向量表示方法、装置及电子设备
CN119864175A (zh) * 2024-12-24 2025-04-22 青岛华晶生物技术有限公司 慢性病患者档案数据分析方法、装置、存储介质及设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112101946A (zh) * 2020-11-20 2020-12-18 支付宝(杭州)信息技术有限公司 联合训练业务模型的方法及装置
US20210216902A1 (en) * 2020-01-09 2021-07-15 International Business Machines Corporation Hyperparameter determination for a differentially private federated learning process
CN113282960A (zh) * 2021-06-11 2021-08-20 北京邮电大学 一种基于联邦学习的隐私计算方法、装置、系统及设备
US20210342546A1 (en) * 2020-04-30 2021-11-04 Arizona Board Of Regents On Behalf Of Arizona State University Systems and methods for a privacy preserving text representation learning framework
CN113642717A (zh) * 2021-08-31 2021-11-12 西安理工大学 一种基于差分隐私的卷积神经网络训练方法
CN113961967A (zh) * 2021-12-13 2022-01-21 支付宝(杭州)信息技术有限公司 基于隐私保护联合训练自然语言处理模型的方法及装置

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12547759B2 (en) * 2019-08-14 2026-02-10 Google Llc Privacy preserving machine learning model training
CN113688855B (zh) * 2020-05-19 2023-07-28 华为技术有限公司 数据处理方法、联邦学习的训练方法及相关装置、设备
US12373729B2 (en) * 2020-05-28 2025-07-29 Samsung Electronics Co., Ltd. System and method for federated learning with local differential privacy
CN112199717B (zh) * 2020-09-30 2024-03-22 中国科学院信息工程研究所 一种基于少量公共数据的隐私模型训练方法及装置
CN112257876B (zh) * 2020-11-15 2021-07-30 腾讯科技（深圳）有限公司 联邦学习方法、装置、计算机设备及介质
CN112966298B (zh) * 2021-03-01 2022-02-22 广州大学 一种复合隐私保护方法、系统、计算机设备及存储介质
CN112862001B (zh) * 2021-03-18 2024-07-26 中山大学 一种联邦学习下去中心化数据建模的隐私保护方法及系统
CN113408743B (zh) * 2021-06-29 2023-11-03 北京百度网讯科技有限公司 联邦模型的生成方法、装置、电子设备和存储介质
CN113435583B (zh) * 2021-07-05 2024-02-09 平安科技（深圳）有限公司 基于联邦学习的对抗生成网络模型训练方法及其相关设备
CN113626854B (zh) * 2021-07-08 2023-10-10 武汉大学 一种基于本地化差分隐私的图像数据隐私保护方法
CN113642715B (zh) * 2021-08-31 2024-07-12 南京昊凛科技有限公司 自适应分配动态隐私预算的差分隐私保护深度学习算法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210216902A1 (en) * 2020-01-09 2021-07-15 International Business Machines Corporation Hyperparameter determination for a differentially private federated learning process
US20210342546A1 (en) * 2020-04-30 2021-11-04 Arizona Board Of Regents On Behalf Of Arizona State University Systems and methods for a privacy preserving text representation learning framework
CN112101946A (zh) * 2020-11-20 2020-12-18 支付宝(杭州)信息技术有限公司 联合训练业务模型的方法及装置
CN113282960A (zh) * 2021-06-11 2021-08-20 北京邮电大学 一种基于联邦学习的隐私计算方法、装置、系统及设备
CN113642717A (zh) * 2021-08-31 2021-11-12 西安理工大学 一种基于差分隐私的卷积神经网络训练方法
CN113961967A (zh) * 2021-12-13 2022-01-21 支付宝(杭州)信息技术有限公司 基于隐私保护联合训练自然语言处理模型的方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117852071A (zh) * 2023-12-01 2024-04-09 羚羊工业互联网股份有限公司 基于大模型的隐私保护方法及相关装置、设备和存储介质
CN119201981A (zh) * 2024-11-27 2024-12-27 浪潮软件科技有限公司 一种自适应sql差分隐私加噪方法
CN119494408A (zh) * 2025-01-16 2025-02-21 厦门理工学院 基于差分隐私机制的大模型训练方法、介质及系统

Also Published As

Publication number Publication date
CN113961967B (zh) 2022-03-22
CN113961967A (zh) 2022-01-21
US20240419839A1 (en) 2024-12-19

Similar Documents

Publication Publication Date Title
CN113961967B (zh) 基于隐私保护联合训练自然语言处理模型的方法及装置
US11615255B2 (en) Multi-turn dialogue response generation with autoregressive transformer models
US11049500B2 (en) Adversarial learning and generation of dialogue responses
CN108052512B (zh) 一种基于深度注意力机制的图像描述生成方法
CN109582956B (zh) 应用于句子嵌入的文本表示方法和装置
CN115688879B (zh) 一种基于知识图谱的智能客服语音处理系统及方法
CN111930914B (zh) 问题生成方法和装置、电子设备以及计算机可读存储介质
WO2018014835A1 (zh) 一种对话生成方法及装置、设备、存储介质
US20190354588A1 (en) Device and method for natural language processing
CN111797220B (zh) 对话生成方法、装置、计算机设备和存储介质
WO2020151689A1 (zh) 对话生成方法、装置、设备及存储介质
KR102781099B1 (ko) Qa 모델을 이용하여 지식 그래프를 구축하는 방법, 장치 및 컴퓨터 프로그램
CN113221104B (zh) 用户异常行为的检测方法及用户行为重构模型的训练方法
CN111291166A (zh) 基于Bert的语言模型的训练方法及装置
CN113449110A (zh) 情感分类方法、装置、存储介质及计算机设备
CN110598207B (zh) 一种词向量获取方法、装置及存储介质
CN115357711B (zh) 一种方面级情感分析方法、装置、电子设备及存储介质
CN117972033A (zh) 大模型幻觉检测方法、装置、计算机设备及存储介质
CN111353554B (zh) 预测缺失的用户业务属性的方法及装置
CN116579350A (zh) 对话理解模型的鲁棒性分析方法、装置和计算机设备
CN120430418B (zh) 大模型推理方法、装置、相关设备及计算机程序产品
CN115221322A (zh) 一种基于联邦学习的文本情感分类方法及终端
CN114842246A (zh) 一种社交媒体压力类别检测方法及装置
Matza et al. Skew Gaussian mixture models for speaker recognition
CN115618846B (zh) 篇章级关系抽取方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22906046

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22906046

Country of ref document: EP

Kind code of ref document: A1