# Enhancing Privacy in Large Language Model with Homomorphic Encryption and Sparse Attention
## 3 Materials and Methods
### Proposed Method
#### 3.3.2 Operator Replacement Technique  
The capability of homomorphic encryption to perform computations on encrypted data without decryption enables models to calculate while preserving data privacy. The detailed implementation of operator replacement is expounded herein, providing corresponding mathematical proofs and formulas, and elucidating the advantages of this design. Traditional transformer models contain several key operators, such as linear transformations, activation functions, and layer normalization, typically operating in the real number domain. To realize a transformer model in an FHE environment, these operators must be replaced with versions compatible with homomorphic operations. **Homomorphic Linear Transformation:** In the transformer model, linear transformations are executed by multiplying a weight matrix with an input vector. In the homomorphic encryption setting, weight matrices and input vectors are converted to integers via quantization techniques, followed by the application of addition and multiplication from the homomorphic encryption algorithm to effectuate linear transformations. The specific replacement technique is mathematically expressed as:  
\[\text{Enc}(Wx+b)=\text{Enc}(W)\cdot\text{Enc}(x)+\text{Enc}(b) \tag{16}\]  
Figure 3: Overview of the privacy-preserving framework proposed in this paper. The steps are as follows: (1) A bootstrapping key is generated by the user. (2) The bootstrapping key is received by the server, which is utilized for subsequent encrypted data processing. (3) The data are encrypted by the user utilizing the bootstrapping key, resulting in an encrypted prompt. (4) The encrypted data are transmitted to the server. (5) Inference on the prompt is conducted by the server with the encrypted data. (6) The server encrypts the outcome of the processing before sending it back to the user. (7) The encrypted result is received by the user, who then decrypts it using the bootstrapping key to obtain the final plaintext output. where \(W\) represents the weight matrix, \(x\) represents the input vector, \(b\) represents the bias term, and \(\text{Enc}()\) denotes the homomorphic encryption function. The homomorphic encryption's additive and multiplicative operations ensure that the outcome's encrypted form is equivalent to directly computing \(Wx+b\) in plaintext. **Homomorphic Activation Function:** Activation functions are typically nonlinear, such as the ReLU or Sigmoid functions. In a homomorphic encryption context, implementing nonlinear functions presents challenges, thus, piecewise linear functions are employed as approximations. For instance, the ReLU function can be approximated by the following piecewise linear function:  
\[\text{ReLU}(x)\approx\max(0,x)\approx\left\{ \begin{array}{ll}0&\text{if }\text{Enc}(x)<0\\ \text{Enc}(x)&\text{if }\text{Enc}(x)\geq 0\end{array} \right. \tag{17}\]  
The comparison operation here can be realized through comparison protocols supported by FHE. **Homomorphic Normalization:** Layer normalization plays a pivotal role in stabilizing training and accelerating convergence in the transformer model. Implementing layer normalization in an FHE context necessitates the computation of mean and variance that is supported by homomorphic encryption. Mean and variance of encrypted data can be calculated using homomorphic encryption algorithms, which are then utilized for normalization. Mathematically, homomorphic layer normalization is depicted as:  
\[\text{Enc}(\hat{x})=\frac{\text{Enc}(x)-\text{Enc}(\mu)}{\sqrt{\text{Enc}( \sigma^{2})+\epsilon}} \tag{18}\]  
where \(\mu\) and \(\sigma^{2}\) are the mean and variance of the encrypted data \(x\), respectively, \(\epsilon\) is a small constant added for numerical stability, and \(\hat{x}\) is the normalized data.