CryptoTensors: 一种轻量级的大语言模型文件格式，用于高安全性的模型分发
CryptoTensors: A Light-Weight Large Language Model File Format for Highly-Secure Model Distribution
AI总结：
CryptoTensors是一种轻量级的大语言模型文件格式，通过张量级加密和嵌入式访问控制策略，实现高安全性的模型分发与保护。
摘要：
为了提高大语言模型（LLMs）在各种领域特定应用中的性能，医疗、法律和金融等敏感数据被用于私下定制或微调这些模型。此类私有调整的LLMs被视为个人隐私资产或企业知识产权。因此，保护模型权重并在部署和分发过程中保持严格保密变得至关重要。然而，现有的模型格式和部署框架几乎没有内置支持保密性、访问控制或与可信硬件的安全集成。目前用于安全模型部署的方法要么依赖于计算成本高的加密技术，要么依赖于严格控制的私有基础设施。尽管这些方法在特定场景下有效，但它们在广泛部署中却难以实现和成本高昂。在本文中，我们介绍了CryptoTensors，一种用于保密LLM分发的安全且格式兼容的文件结构。它作为广泛采用的Safetensors格式的扩展，结合了张量级加密和嵌入式访问控制策略，同时保留了关键功能，如延迟加载和部分反序列化。它实现了透明解密和自动密钥管理，支持灵活的授权和安全的模型执行，且具有最小的开销。我们实现了一个概念验证库，对其在序列化和运行时场景中的性能进行了基准测试，并验证了其与现有推理框架（包括Hugging Face Transformers和vLLM）的兼容性。我们的结果突显了CryptoTensors作为一种轻量级、高效且开发人员友好的解决方案，用于在现实世界和广泛部署中保护LLM权重。
英文摘要：
To enhance the performance of large language models (LLMs) in various domain-specific applications, sensitive data such as healthcare, law, and finance are being used to privately customize or fine-tune these models. Such privately adapted LLMs are regarded as either personal privacy assets or corporate intellectual property. Therefore, protecting model weights and maintaining strict confidentiality during deployment and distribution have become critically important. However, existing model formats and deployment frameworks provide little to no built-in support for confidentiality, access control, or secure integration with trusted hardware. Current methods for securing model deployment either rely on computationally expensive cryptographic techniques or tightly controlled private infrastructure. Although these approaches can be effective in specific scenarios, they are difficult and costly for widespread deployment. In this paper, we introduce CryptoTensors, a secure and format-compatible file structure for confidential LLM distribution. Built as an extension to the widely adopted Safetensors format, CryptoTensors incorporates tensor-level encryption and embedded access control policies, while preserving critical features such as lazy loading and partial deserialization. It enables transparent decryption and automated key management, supporting flexible licensing and secure model execution with minimal overhead. We implement a proof-of-concept library, benchmark its performance across serialization and runtime scenarios, and validate its compatibility with existing inference frameworks, including Hugging Face Transformers and vLLM. Our results highlight CryptoTensors as a light-weight, efficient, and developer-friendly solution for safeguarding LLM weights in real-world and widespread deployments.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
