Practical Secure Inference Algorithm for Fine-tuned Large Language Model Based on Fully Homomorphic Encryption

Large language models (LLMs) are currently at the forefront of the machine learning field, showing broad application prospects but at the same time presenting certain risks of privacy leakage. Both the training datasets and the user’s input data during interactions face security issues, which need to be addressed urgently before their further development. To address this problem, we combine privacy-preserving techniques such as fully homomorphic encryption (FHE) and provable security theory with parameter-efficient fine-tuning (PEFT) to propose an efficient and secure inference scheme for LLMs that protects both the user-side’s input and the server-side’s private parameters. More specifically, we focus on pretrained LLMs that rely on open-sourced base models and then are fine-tuned with private datasets by LoRA. This is a popular roadmap for vertical domain large models such as LawGPT and BenTsao. To achieve this efficient and secure inference LLM scheme, we use two key technologies that are summarized below: 1) we divide the whole model into two parts, denoted as the public part and the private part. The weights of the public part are publicly accessible (e.g., the open-sourced base model), whereas those of the private part need to be protected (e.g., the LoRA matrices). Then, the public part is deployed on the client side, and the server maintains the private part. In this way, the overhead associated with computing on private data can be greatly reduced. 2) we propose a general method to transform a linear layer into another one that provides security against model extraction attacks and preserves its original functionality, denoted as the private linear layer (PLL). Afterwards, we use this method on the LoRA matrices of the server side, where the PLL changes the computation of the LoRA matrices in a way that accomplishes correct inference and ensures that the server protects their private weights without restricting the user’s input. We also show that the difficulty of performing model extraction attacks for the PLL can be reduced to the well-known hard problem of learning with errors (LWE). Combining this method with FHE, we can obtain an inference algorithm for fine-tuned LLMs that protects the user’s input and the server’s private weights at the same time. In this paper, we use the open-source model ChatGLM2-6B as the base model, which is fine-tuned by LoRA. The experimental results show that the inference efficiency of our scheme reaches 1.61 s/token, demonstrating that the scheme is highly practical.