Towards Encrypted Large Language Models with FHE

TL;DR

Hugging Face and Zama have demonstrated a method to run parts of a Large Language Model (LLM) on encrypted data using Fully Homomorphic Encryption (FHE). This approach allows LLMs to process sensitive user queries without the service provider seeing the raw data, while simultaneously protecting the model owner's intellectual property from being leaked via on-premise deployment.

Solving LLM Privacy with Fully Homomorphic Encryption

Fully Homomorphic Encryption (FHE) enables the execution of functions directly on encrypted data, removing the need to decrypt information before processing. By adapting the GPT-2 implementation from the Hugging Face transformers library and using Concrete-Python, specific sections of the model's inference process can be converted into FHE equivalents.

In the TFHE (Torus Fully Homomorphic Encryption) scheme, model weights and activations are represented as integers. Nonlinear functions are handled via Programmable Bootstrapping (PBS), which performs a table lookup (TLU) on encrypted data and refreshes ciphertexts to allow for arbitrary computation. While PBS is more computationally expensive than linear operations, it allows any sub-part or the entirety of an LLM's computation to be expressed in FHE.

Technical Implementation: Encrypting the Attention Head

To implement an encrypted LLM layer, the system uses a hybrid approach where the client performs initial local inference, encrypts intermediate operations, and sends them to a server. The server then applies part of the attention mechanism on the encrypted data and returns the results for the client to decrypt and continue local inference.

Quantization Requirements

Because FHE operates on integers, model weights and activations must be quantized. Using post-training quantization—which avoids the need for re-training—Zama found that 4-bit quantization maintains 96% of the original model accuracy (based on a dataset of approximately 80 sentences).

Integration with GPT-2

The implementation involves rewriting the forward pass of specific modules to include quantized operators. For example, a GPT2LMHeadModel can be modified by replacing the first multi-head attention module with a QGPT2SingleHeadAttention module.

In this setup, the first head of the multi-head attention mechanism, including the projections for query, key, and value matrices, is performed using FHE-friendly operators. Other computations remain in floating point and are executed non-encrypted on the client side.

Computational Complexity and Performance

The attention mechanism is the most computationally intensive part of transformer models due to the multiplication of queries, keys, and values. In FHE, this cost is further increased by the complexity of encrypted-domain multiplications and a quadratic increase in operations as sequence length grows.

Key performance observations include:

  • Computational Load: A sequence of length 6 requires 11,622 PBS operations.
  • Current State: The current implementation is an unoptimized first experiment that runs in seconds on a CPU but requires significant computing power.
  • Future Outlook: Zama projects that future ASIC hardware could improve latency by 1,000x to 10,000x, potentially reducing processing time from several minutes on a CPU to under 100ms.

Conclusion

Integrating FHE into LLMs provides a path toward cloud-based AI services where user privacy is fully respected and model intellectual property is secured. By leveraging the transformers library and Zama's Concrete and Concrete-ML libraries, developers can begin converting ML models into FHE equivalents to predict over encrypted data.

Sources