THE-X: Privacy-Preserving Transformer Inference with Homomorphic Encryption

Abstract

The privacy concerns associated with the use of Large Language Models (LLMs) have grown recently with the development of LLMs such as ChatGPT. Differential Privacy (DP) techniques are explored in existing work to mitigate their privacy risks at the cost of generalization degradation. Our paper reveals that the flatness of DP-trained models' loss landscape plays an essential role in the trade-off between their privacy and generalization. We further propose a holistic framework to enforce appropriate weight flatness, which substantially improves model generalization with competitive privacy preservation. It innovates from three coarse-to-grained levels, including perturbation-aware min-max optimization on model weights within a layer, flatness-guided sparse prefix-tuning on weights across layers, and weight knowledge distillation between DP & non-DP weights copies. Comprehensive experiments of both black-box and white-box scenarios are conducted to demonstrate the effectiveness of our proposal in enhancing generalization and maintaining DP characteristics. For instance, on text classification dataset QNLI, DP-Flat achieves similar performance with non-private full fine-tuning but with DP guarantee under privacy budget ϵ = 3, and even better performance given higher privacy budgets. Codes are provided in the supplement.

Recent Progress and Applications of HfO2-Based Ferroelectric Memory

“…Two recent studies explore replacing these fundamentally expensive non-linear functions with operators that are more friendly in private inference. For instance, Chen et al [5] use ReLU to substitute all non-linearities in a transformer, and relying on HE for linear operations. However, their architecture requires the ReLU functions to be executed in plaintext by the client, which may reveal the proprietary model owned by the server.…”

Complex QA and language models hybrid architectures, Survey

“…• Models per sensitivity: the different type of sensitive data could each be stored in a specific model and a common frontend could manage the access control to each model. • Data privacy mechanisms [352][353][354][355][356][357][358][359][360]: QA can ensure protection of private data by implementing privacypreserving techniques such as homomorphic encryption, local differential privacy, or secure multiparty computation. These techniques can be applied to the input text, token embeddings, and sequence representations in order to protect the data from malicious actors.…”

MERGE: Fast Private Text Generation

“…To alleviate the privacy problem, recent works (Hao et al 2022;Chen et al 2022) have developed two-party secure inference services for PLMs by secure Multi-Party Computation (MPC). MPC ensures the privacy of user data and model weights, and shares them secretly.…”

“…Though designed for Transformer, existing works (Hao et al 2022;Chen et al 2022;Li et al 2022) solely explore the scenario of natural language understanding (NLU) (e.g., on the GLUE (Wang et al 2019) benchmark). Unfortunately, we observe that they have no significant improvements in natural language generation (NLG) tasks (cf., Fig.…”