{"id":15857,"date":"2023-11-27T02:00:07","date_gmt":"2023-11-27T10:00:07","guid":{"rendered":"https:\/\/softwareengineeringdaily.com\/?p=15857"},"modified":"2023-11-20T18:04:32","modified_gmt":"2023-11-21T02:04:32","slug":"building-a-privacy-preserving-llm-based-chatbot","status":"publish","type":"post","link":"https:\/\/softwareengineeringdaily.com\/2023\/11\/27\/building-a-privacy-preserving-llm-based-chatbot\/","title":{"rendered":"Building a Privacy-Preserving LLM-Based Chatbot"},"content":{"rendered":"

As Large Language Models (LLMs) and generative AI continue to grow more sophisticated and available, many organizations are starting to build, fine-tune, and customize LLMs based on their internal data and documents. This can bring incredible efficiency and reliability to data-driven decision-making processes. However, this practice comes with its share of challenges, primarily around data privacy, protection, and governance.<\/p>\n

Let\u2019s consider the construction of the LLM itself, which is trained on a massive amount of data collected from public and private sources. Without careful anonymization and filtering, sensitive data \u2014 such as PII or intellectual property \u2014 may be inadvertently included in the training set, potentially leading to a privacy breach.<\/p>\n

Furthermore, privacy concerns are introduced when interacting with LLMs, as users might input sensitive data, such as names, addresses, or even confidential business information. If these inputs aren\u2019t handled properly, the misuse or exposure of this information is a genuine risk.<\/p>\n

In this post, we\u2019ll explore how to work with LLMs in a privacy-preserving way when building an LLM-based chatbot. As we walk through the technology from end-to-end, we\u2019ll highlight the most acute data privacy concerns and we\u2019ll show how using a data privacy vault addresses those concerns.<\/p>\n

Let\u2019s start by taking a closer look at the problem we need to solve.<\/p>\n

The problem: Protecting sensitive information from exposure by a chatbot<\/h1>\n

Consider a company that has uses an LLM-based chatbot for its internal operations. The LLM for the chatbot was built by modifying a pre-existing base model with embeddings created from internal company documents. The chatbot provides an easy-to-use interface that lets non-technical users within the company access information from internal data and documents.<\/p>\n

The company has a sensitive internal project called \u201cProject Titan.\u201d Project Titan is so important and so sensitive that only people working on Project Titan know about it. In fact, the team often says: the first rule of Project Titan is don\u2019t talk about Project Titan. Naturally, the team wants to take advantage of the internal chatbot and also include Project Titan specific information to speed up creation of design documents, documentation, and press releases. However, they need to control who can see details about this sensitive project.<\/p>\n

What we have is a tangible and pressing privacy concern that sits at the intersection of AI and data. These challenges appear extremely difficult to solve in a scalable and production-ready way. Simply having a private version of the LLM doesn\u2019t address the core issue of data access.<\/p>\n

The proposed solution: Sensitive data de-identification and fine-grained access control<\/h1>\n

Ultimately, we need to identify the key points where sensitive data must be de-identified during the process of building (or fine-tuning) the LLM and the end user\u2019s interaction with the LLM-based chatbot. After careful analysis, we\u2019ve identified that there are two key points in the process where we need to de-identify (and later re-identify) sensitive data:<\/p>\n

    \n
  1. Before ingestion<\/strong>: When documents from Project Titan are used to create embeddings, the project name, any PII, and anything else sensitive to the project must be de-identified. This de-identification should occur as part of the ETL pipeline prior to data ingestion into the LLM.<\/li>\n
  2. During use<\/strong>: When a user inputs data to the chatbot, any sensitive data included in that input must also be de-identified.<\/li>\n<\/ol>\n

    You can de-identify sensitive data using Skyflow\u2019s polymorphic encryption and tokenization engine that\u2019s included within Skyflow Data Privacy Vault. This includes detection of PII but also terms you define within a sensitive data dictionary, like intellectual property (i.e. Project Titan).<\/p>\n

    Of course, only Project Titan team members who use the chatbot should be able to access the sensitive project data. Therefore, when the chatbot forms a response, we\u2019ll rely on Skyflow\u2019s governance engine (which provides fine-grained access control) and detokenization API to retrieve the sensitive data from the data privacy vault, making it available only to authorized end users.<\/p>\n

    Before we dive into the technical implementation, let\u2019s go through a brief overview of foundational LLM concepts. If you\u2019re already familiar with these concepts, you can skip the next section.<\/p>\n

    A brief primer on LLMs<\/h1>\n

    LLMs are sophisticated artificial intelligence (AI) systems designed to analyze, generate, and work with human language. Built on advanced machine learning architectures, they are trained on vast quantities of text data, enabling them to generate text that is convincingly human-like in its coherence and relevance.<\/p>\n

    LLMs leverage a technology called\u00a0transformers\u00a0<\/em>\u2014 one example is GPT, which stands for Generative Pre-Trained Transformer \u2014 to predict or generate a piece of text when given input or context. LLMs learn from patterns in the data they are trained on and then apply these learnings to understand newly given content or to generate new content.<\/p>\n

    Despite their benefits, LLMs pose potential challenges in terms of privacy, data security, and ethical considerations. This is because LLMs can inadvertently memorize sensitive information from their training data or generate inappropriate content if not properly regulated or supervised. Therefore, the use of LLMs necessitates effective strategies for data handling, governance, and preserving user privacy.<\/p>\n

    A technical overview of the solution<\/h1>\n

    When embarking on any LLM project, we need to start with a model. Many open-source LLMs have been released in recent months, each with its specific area of focus. Instead of building an entire LLM model from scratch, many developers choose a pre-built model and then adjust the model with vector embeddings generated from domain-specific data.<\/p>\n

    Vector embeddings encapsulate the semantic relationship between words and help algorithms understand context. The embeddings act as an additional contextual knowledge base to help augment the facts known by the base model.<\/p>\n

    In our case, we\u2019ll begin with an\u00a0existing model from Hugging Face<\/a>, and then customize it with embeddings.\u00a0Hugging Face<\/a>\u00a0provides ML infrastructure services as well as open-source models and datasets.<\/p>\n

    In addition to the Hugging Face model, we\u2019ll use the following additional tools to build out our privacy-preserving LLM-based ETL pipeline and chatbot:<\/p>\n