Data leakage risk quantification method for autoregressive language model training process

Abstract

The present invention discloses a data leakage risk quantification method for the autoregressive language model training process, comprising: performing enhanced member data partitioning processing on the original training text set, generating a ternary partitioned text set containing member, non-member, and key boundary text through an optimization function; for each text, using a target model to extract member attributes from three channels: forward reasoning, backpropagation, and state evolution, and fusing them into a member attribute vector; inputting the member attribute vector into a hierarchical contrast embedding network, mapping it into an optimized embedding representation vector through contrastive learning including similar clustering, heterogeneous separation, and boundary positioning; inputting the embedding representation vector into a dynamic reasoning classifier that can perceive the training stage, determining its risk membership, and generating a data leakage risk quantification result. The present invention can perform real-time, fine-grained dynamic quantification of leakage risk, providing timely warning for model training.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence, and in particular to a data leakage risk quantification method for an autoregressive language model training process. Background Art

[0002] With the rapid development and widespread application of generative AI technologies, centered around large-scale autoregressive language models, the data privacy and security issues inherent in these technologies have become increasingly prominent. The datasets used for model training often contain user personal information, business-related data, or other content requiring protection. Autoregressive language models learn data distributions by maximizing conditional probability, a method that inherently leads to a tendency to memorize training examples. This can be particularly problematic when the size of the training data is mismatched with the number of model parameters, or when the data distribution is uneven. The model's output may directly replicate the training text, or its parameters may contain patterns that can be used to infer sensitive information. Therefore, accurate, real-time, and quantitative assessment of potential data leakage risks throughout the model training lifecycle is crucial not only for meeting compliance requirements under increasingly stringent global data privacy regulations (such as GDPR and CCPA), but also for building a core technological foundation for trustworthy, reliable, and responsible AI systems. Developing a technical solution that can dynamically monitor data leakage risks and provide timely warnings during model training is crucial for ensuring user data security, safeguarding the core interests of businesses, and promoting the healthy and sustainable development of AI technology.

[0003] Currently, the industry has proposed and implemented various technical approaches to assessing the data leakage risk of language models. A major research direction is risk quantification based on membership inference attacks (MIA). In this approach, researchers typically construct an attack model (also known as an audit model) whose task is to determine whether a given data sample has been used to train a target model. To achieve this goal, the attack model must utilize signals or features extracted from the target model. In more basic implementations, these features are primarily black-box or gray-box information generated by the target model for the input sample, such as the model's output loss function, prediction confidence, or the entropy of the class probability distribution. The attacker bases their approach on a fundamental assumption: the model will exhibit lower loss values ​​or higher prediction confidence for previously seen member samples. Therefore, the attack model (usually a simple binary classifier) ​​learns the statistical differences between member and non-member samples on these metrics to infer membership. Other risk assessment approaches exist, such as cleverly designing prompts to induce the model to directly generate fragments of training data from its memory, and then assessing the risk of leakage by analyzing the overlap between the output text and the training set. These methods form the foundation of the current field of privacy risk quantification and provide preliminary tools and perspectives for understanding and measuring the data memory effects of models.

[0004] However, existing technologies still face profound technical limitations when dealing with the complex and dynamic training process of large-scale autoregressive language models, resulting in coarse-grained and unreliable risk quantification results. The core technical issue is that existing methods oversimplify the modeling of leakage risk and fail to fully capture and utilize the deep, dynamic interactions between samples during the model training process. Summary of the Invention

[0005] The purpose of the invention is to provide a data leakage risk quantification method for the autoregressive language model training process to solve the above-mentioned problems existing in the prior art.

[0006] The technical solution is a data leakage risk quantification method for the autoregressive language model training process, including:

[0007] Performing enhanced member data partitioning on an original training text set containing a predetermined number of training texts to generate a ternary partition text set consisting of member, non-member and boundary texts;

[0008] For each text in the ternary partition text set, the target model is used to extract three-channel member attributes and generate a corresponding member attribute vector for each text;

[0009] The member attribute vector corresponding to each text is input into the hierarchical contrast embedding network, and mapped into the optimized embedding representation vector through contrast learning;

[0010] The optimized embedding representation vector is input into the dynamic reasoning classifier to determine the risk membership of the corresponding text and generate a data leakage risk quantification result containing the risk score of each text.

[0011] Beneficial effect: by performing real-time fine-grained division of data samples, multi-dimensional attribute extraction, high-discrimination representation learning and dynamic reasoning during model training, real-time, efficient and fine-grained quantification of data leakage risks is achieved, providing timely warning for model training. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A flowchart of the steps of a data leakage risk quantification method for the autoregressive language model training process provided in an embodiment of the present application.

[0013] Figure 2 A flowchart of the steps for generating a ternary partitioned text set provided in an embodiment of the present application.

[0014] Figure 3 A flowchart of the steps for generating a corresponding member attribute vector for each text provided in an embodiment of the present application.

[0015] Figure 4 A flowchart of the steps for extracting temporal channel attributes of text provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0017] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or are inherent to these processes, methods, products or apparatus.

[0018] The research found that existing methods generally treat membership determination as a simple binary classification problem, where a sample is either a member or a non-member. This division ignores a large number of borderline samples with ambiguous properties near the decision boundary. These samples are highly similar to member samples in feature space, but are not part of the training set. They are the most easily confused objects for attack models. Traditional methods lack a mechanism to systematically identify, generate, and analyze such samples. They rely solely on random sampling or simple data augmentation to construct non-member sets. As a result, attack models are unable to learn clear and robust decision boundaries, and are particularly unable to accurately quantify the risk of samples that are on the edge of leakage and non-leakage, which limits the accuracy of the final risk assessment.

[0019] Furthermore, the member attribute features that existing methods use to determine risk are single-dimensional and static, failing to capture a complete picture of the interaction between the model and the sample. Most methods rely on information such as loss values, probabilities, or hidden layer outputs generated by the model after a single forward inference. This snapshot-style feature extraction ignores the richer dynamic information as the model learns the sample. For example, if a sample causes a dramatic gradient update of model parameters (backward channel information) or continuously influences the parameter evolution trajectory over multiple training steps (temporal channel information), these are strong signals that the model has developed a deep memory for the sample. Existing technologies lack mechanisms for extracting features from the backpropagation and temporal evolution dimensions, resulting in the loss of a significant amount of dynamic signals strongly correlated with privacy leaks. Due to the inability to construct a multi-channel, spatiotemporal and temporal representation of member attributes, risk assessments naturally remain superficial and coarse, making it difficult to distinguish subtle differences in leakage risks across different models and training stages.

[0020] like Figure 1 As shown in the figure, a data leakage risk quantification method for the autoregressive language model training process is proposed, which includes the following steps:

[0021] Enhanced member data partitioning is performed on an original training text set containing a predetermined number of training texts to generate a ternary partition text set consisting of member, non-member and boundary texts.

[0022] In this embodiment, by introducing the concept of boundary context, the traditional member / non-member binary problem is upgraded to a ternary problem, so that the subsequent model can learn a more refined decision boundary.

[0023] For each text in the ternary partition text set, the target model is used to perform three-channel member attribute extraction and generate a corresponding member attribute vector for each text.

[0024] In this embodiment, features can be extracted from the forward, reverse, and time series channels to comprehensively capture the information of the model during reasoning, training, and dynamic evolution, enriching the information dimensions used for risk assessment.

[0025] The member attribute vector corresponding to each text is input into the hierarchical contrast embedding network and mapped into the optimized embedding representation vector through contrast learning.

[0026] In this embodiment, hierarchical contrastive learning is adopted through a hierarchical contrastive embedding network, which not only brings similar samples closer and pushes different samples away, but also specifically optimizes the position of boundary samples, thereby learning a more discriminative embedding representation.

[0027] The optimized embedding representation vector is input into the dynamic reasoning classifier to determine the risk membership of the corresponding text and generate a data leakage risk quantification result containing the risk score of each text.

[0028] In this embodiment, the dynamic inference classifier can sense the different training stages of the model and adaptively adjust its classification strategy to address the changing leakage risk patterns at different stages. This provides model developers with real-time risk warnings during training, assisting them in taking targeted privacy protection measures, such as adjusting training strategies or processing high-risk data.

[0029] This embodiment aims to address the existing issues of delayed privacy risk assessment, high computational overhead, and coarse risk granularity. By performing real-time segmentation of data samples, multi-dimensional attribute extraction, high-discriminative representation learning, and dynamic reasoning during model training, it achieves real-time, efficient, and fine-grained quantification of data leakage risks.

[0030] like Figure 2 As shown, according to one aspect of the present application, generating a triple partition text set includes:

[0031] Sampling is performed from the original training text set to obtain member text and non-member text.

[0032] In this embodiment, this step is the basis of data preparation. Member text refers to the text samples included in the actual training set of the target model. Non-member text refers to the text samples that are distributed with the training set data but are not used for training. Specifically, given the original training text set D train , randomly select a part (for example, sampling ratio α∈[0.2, 0.5]) from it as the member text set D1. At the same time, select a text set that is different from the original training text set D trainThe same number of texts are sampled from the external data source with the same distribution as the non-member text set D0. Ensuring data distribution consistency is to ensure the generalization ability of subsequent attack models and prevent them from learning shortcut features from the data set source.

[0033] Based on the original training text set, the data distribution characteristics are calculated, and a multi-objective optimization function including semantic similarity loss, structural rationality loss and frequency balance loss is constructed according to the data distribution characteristics; the multi-objective optimization function is solved to obtain the text that minimizes the weighted combination of the three losses and obtain the boundary text.

[0034] In this embodiment, traditional binary classification ignores fuzzy samples near the decision boundary between members and non-members. These boundary samples are the most difficult to judge the leakage risk and are the key to improving the accuracy of risk assessment. Actively generating boundary samples through optimization methods allows the risk assessment model to understand and learn from this fuzziness. Specifically, the boundary text x is generated by solving the following optimization problem b :x b =argmin x (λ1L sem (x,D train )+λ2L struct (x)+λ3L freq (x)); where x is the text to be optimized; L sem is the semantic similarity loss, which makes the generated text semantically close to the training set, but not exactly the same; L struct To ensure the loss of structural rationality, methods such as point mutual information (PMI) are used to make the generated text conform to grammatical and logical structures; L freq is the frequency balance loss, which makes the word frequency distribution of the generated text similar to the overall training set and avoids generating abnormal text with rare words or high-frequency words clustered together; λ1, λ2, and λ3 are the balancing weights of each loss.

[0035] Combine boundary, member and non-member texts to form a ternary partition text set.

[0036] In this example, the resulting ternary partitioned text set (containing samples from three categories: member, non-member, and boundary) serves as input for subsequent steps. For example, the number of samples in each category can be determined using the scaling parameters α∈[0.2, 0.5] and β∈[0.1, 0.3]. This example generates a ternary partitioned dataset containing high-quality boundary samples, laying a solid foundation for subsequent model learning to refine decision boundaries and improve the accuracy of risk assessment.

[0037] According to one aspect of the present application, it is unknown whether the boundary text generated by the above steps is actually in a boundary state within the target model. Therefore, a lightweight verification mechanism is introduced to verify whether the position of the candidate boundary text in the target model representation space meets expectations without frequently calling the target model with high computing resources, and to screen out higher quality boundary samples. Specifically, obtaining the boundary text further includes a verification and screening process based on the consistency of the representation space, specifically:

[0038] Extract the hidden state representations of member text and non-member text in the target model, and extract their respective word vector representations.

[0039] In this embodiment, the member text set D1 and the non-member text set D0 are input into the target model to obtain the hidden state representation matrix H of each layer. member and H non-member At the same time, use pre-trained models such as Word2Vec to obtain its word vector representation.

[0040] Based on the word vector representation and hidden state representation, a lightweight representation predictor is trained to predict the hidden state representation of the input text in the target model based on the word vector representation.

[0041] In this example, the predictor is a simple feedforward neural network that takes as input the word vectors for a text and outputs the predicted hidden state representation of that text in the target model. Its goal is to learn a low-cost mapping from surface word vectors to deep model representations.

[0042] Based on the hidden state representations of member text and non-member text, the theoretical boundary representation is calculated.

[0043] In this embodiment, the center position of the theoretical boundary Hboundary can be obtained by taking a weighted average of the means of the member and non-member representation matrices. expected .

[0044] For the candidate boundary texts generated by solving the multi-objective optimization function, the trained lightweight representation predictor is used to obtain the predicted hidden state representation; the representation space deviation between the predicted hidden state representation and the theoretical boundary representation is calculated, and the text with the representation space deviation less than the preset threshold is selected from the candidate boundary texts as the final boundary text.

[0045] In this embodiment, the Euclidean distance or cosine distance between the two can be calculated, and samples with a smaller distance are considered to be high-quality boundary samples.

[0046] This embodiment introduces a verification mechanism based on a lightweight representation predictor. While ensuring the quality of boundary samples, it also reduces the computational overhead of the data partitioning phase and improves the efficiency of the entire risk quantification method. This is achieved through a proxy model approach that leverages small resources for greater results. When generating boundary samples, the most direct way to accurately verify whether each candidate sample is truly at the boundary of the target model's representation space is to input it into a large, expensive language model for computation, but this introduces significant performance bottlenecks. The verification mechanism of this embodiment cleverly circumvents this bottleneck. Using a small number of member and non-member samples, a lightweight representation predictor (e.g., a small feedforward neural network) with extremely low computational cost is trained. The predictor's input is the word vector representation of any text, and its output is the predicted value of its hidden state in the target model. When screening candidate boundary samples, the proxy model performs the majority of the verification work. In the specific scenario of language model risk quantification, this means that the data preparation phase does not require frequent calls to the target model, which often has billions of parameters, resulting in orders of magnitude improvements in computational efficiency. At the same time, by calculating the deviation between the predicted representation and the theoretical boundary representation, the screened boundary samples are indeed ambiguous in their internal behavior of the model, providing a high-quality, internally verified data foundation for the precise learning of subsequent risk models.

[0047] like Figure 3 As shown, according to one aspect of the present application, a corresponding member attribute vector is generated for each text, including:

[0048] Perform forward reasoning and backpropagation on the text on the target model to extract forward and backward channel attributes; monitor the state evolution of the target model between predetermined training steps to extract the temporal channel attributes of the text.

[0049] like Figure 4 As shown, optionally, extracting the temporal channel attributes of the text includes:

[0050] Record the model parameter states of the target model in each adjacent training step and calculate the parameter change vector;

[0051] Track the momentum update process of the optimizer used by the target model in a predetermined number of training steps and calculate the cumulative momentum vector;

[0052] The parameter change vector and the accumulated momentum vector together constitute the time series channel attribute.

[0053] In this embodiment, in order to comprehensively characterize the traces of a sample in the model training process, it is necessary to observe from multiple dimensions. The forward channel focuses on the reaction of the model when it sees the sample (the reasoning process); the backward channel focuses on the reaction of the model when learning the sample (the gradient update); the temporal channel focuses on the impact of the sample on the model over a period of time (dynamic evolution). Specifically, the forward channel attributes include the hidden state h(l) of each layer of the model, the attention entropy Hattn(l), the L2 norm and variance of the activation value, etc., which reflect the model's internal representation and attention pattern of the input text. The backward channel attributes include the loss function value L(fθ(x), y), the first-order gradient g, the approximate value diag(H) of the diagonal elements of the Hessian matrix, and the curvature index κ calculated therefrom, which reveals the position and local geometry of the sample in the loss landscape and is the key to judging the degree of model memory. The temporal channel attributes include the parameter change vector Δ t =θ t -θ t-1 , the optimizer's cumulative momentum vector m t , loss evolution rate ρ t etc., capturing the dynamic trajectory and stability of the model when learning this sample.

[0054] The forward, backward and temporal channel attributes are fused to form the member attribute vector corresponding to each text.

[0055] In this embodiment, an adaptive weighted fusion strategy is adopted. For example, the fusion weight is dynamically calculated based on the variance of each channel feature. The channel with a large variance is considered to have richer information and is given a higher weight. The fusion formula can be: total =w f ΘΨ f ⊕w b ΘΨ b ⊕w t ΘΨ t ; Among them Ψ f ,Ψ b ,Ψ t are the feature sets extracted from the forward channel, reverse channel, and timing channel respectively; w f 、w b 、w t They are the fusion weights of forward features, reverse features, and time series features respectively; the fusion weights of the three channels of forward, reverse, and time series are w channel =softmax(Var(Ψ channel ) / τ), ⊕ represents feature concatenation, Ψ channelis the feature set extracted from a channel, Var( ) represents the operation of calculating the variance, τ is the temperature parameter that controls the sharpness of the weight distribution, and Θ represents the Hadamard product, that is, the element-by-element product. The output member attribute vector Ψ total This is a comprehensive, high-quality feature representation of each text, which will be input into the hierarchical contrast embedding network in the next stage. This embodiment can extract a multi-dimensional member attribute vector for each sample that is rich in information, low in noise, and highly robust, improving the accuracy of subsequent risk assessments.

[0056] The original features extracted from the three channels may contain noise or redundant information, and direct fusion may lead to performance degradation. For example, in the later stages of training, the gradient information may be full of noise. Furthermore, before fusing the forward, backward, and time series channel attributes, feature purification is also included. Feature purification aims to clean the features of each channel, improve the signal-to-noise ratio, and provide higher-quality input for subsequent fusion. Specifically:

[0057] For each channel attribute in the forward, reverse, and time series channels, calculate its signal-to-noise ratio (e.g., through power spectral density analysis) or inter-channel consistency (e.g., by calculating the correlation coefficient between pairwise channel features) to generate a channel reliability score;

[0058] According to the channel reliability score of each channel, corresponding purification operations are performed on the attribute data of the channel. For example, wavelet denoising and other algorithms are applied to process the channel features with low signal-to-noise ratio to obtain the purified forward, reverse and time series channel attributes.

[0059] Optionally, the step of performing a corresponding purification operation on the attribute data of the channel includes a self-healing compensation mechanism, specifically:

[0060] comparing the channel reliability score of each channel with a preset reliability threshold;

[0061] When the reliability score of a channel is lower than the reliability threshold, the channel is identified as an unreliable channel, and the remaining one or more channels are reliable channels;

[0062] Perform weighted combination on the attribute data of one or more reliable channels to generate compensation features;

[0063] Compensation features are used to replace the attribute data of unreliable channels to obtain the self-healed channel attributes for subsequent fusion steps.

[0064] For example, if the backward channel is judged to be unreliable at a certain stage, its features can be replaced by a weighted combination of features from the forward and timing channels, thus ensuring the integrity and robustness of the overall feature vector.

[0065] This embodiment enhances the robustness of the member attribute extraction process and the stability of the final risk assessment results by constructing a self-healing compensation mechanism, especially in complex training environments with noise or missing information. This is achieved by combining fault-tolerance principles from systems engineering with feature engineering. When extracting attributes from the forward, reverse, and time series channels, the data quality of each channel is evaluated by calculating metrics such as signal-to-noise ratio or inter-channel consistency. The evaluation result (channel reliability score) is then compared with a preset reliability threshold. When the reliability score of a channel (for example, the reverse channel) falls below the threshold, the noisy data from that channel is not simply discarded. Instead, it is identified as an unreliable channel and a compensation algorithm is invoked. This algorithm performs a weighted combination of attribute data from one or more other channels identified as healthy (for example, the forward and time series channels) to generate a compensation feature. This generated compensation feature is then used to replace the original data from the unreliable channel. In the application of autoregressive language model risk quantification, the contamination of the entire member attribute vector due to problems such as excessive gradient noise in the late training stage is avoided, so that the data input to the downstream network is complete and high-quality, the variance of the final risk score is reduced, and the consistency and credibility of the risk quantification results are improved when performing risk quantification at different training stages and on different models.

[0066] According to one aspect of the present application, mapping to an optimized embedding representation vector includes:

[0067] The hierarchical contrastive embedding network is trained by minimizing a multi-objective loss function; the multi-objective loss function includes: a similar sample clustering loss for forcing similar samples to cluster in the embedding space; a heterogeneous sample separation loss for pushing heterogeneous samples away; and a boundary sample localization loss for regulating the position of boundary samples.

[0068] In this embodiment, the Hierarchical Contrastive Embedding Network (HCEN) is a deep neural network whose design goal is not to perform final classification, but to learn a mapping function that maps the input, complex membership attribute vector to a new, low-dimensional embedding space. In this space, samples of different categories (members, non-members, boundaries) are highly distinguishable in terms of geometric position. The multi-objective loss function is a total loss function composed of a weighted combination of multiple sub-loss functions used to train the network. Since classification directly in the original, high-dimensional membership attribute vector space may not be effective because there may be complex nonlinear relationships between features, this embodiment actively reshapes the feature space through contrastive learning, so that similar samples are clustered in the embedding space and heterogeneous samples are separated, and the most ambiguous boundary samples are accurately located, providing a well-organized and easier-to-process input for the final classifier. Specifically, the training of the Hierarchical Contrastive Embedding Network is driven by a multi-objective loss function that contains three core components, including the clustering loss (L intra ), heterogeneous sample separation loss (L inter ) and boundary sample positioning loss (L global ). For member samples, the clustering loss of similar samples is achieved by maximizing the similarity between a member sample and its similarity (other member samples) while minimizing its similarity with all other samples. Its calculation formula is: L intra =(-1 / M)∑ i=1 M log(∑ j≠i exp(sim(r i mem , r j mem ) / τ in ) / ∑ k≠i exp(sim(r i mem , r k ) / τ in )); where M is the number of member samples, r i mem is the embedding representation of the i-th member sample, sim(,) is the cosine similarity, τ in is the temperature parameter, r k represents the embedding representation of the kth sample in the dataset (including both members and non-members). The heterogeneous sample separation loss aims to maximize the distance between member samples and non-member samples in the embedding space. It also introduces a data similarity adjustment factor to prevent over-separation in the embedding space of samples that are similar in the original data space. The boundary sample localization loss is used to control the location of boundary samples.

[0069] Utilize the trained hierarchical contrast embedding network to receive member attribute vectors and output optimized embedding representation vectors.

[0070] In this embodiment, the final output is an optimized embedding representation vector, which has better category discrimination than the original member attribute vector and provides high-quality input for the final risk determination.

[0071] According to one aspect of the present application, the calculation process of the boundary sample positioning loss includes:

[0072] Based on the embedding representations of member samples and non-member samples, the theoretical boundary center is calculated and determined;

[0073] For the embedded representation of each boundary sample, calculate the distance between the embedded representation and the theoretical boundary center to obtain the spatial regularization term;

[0074] Input the embedded representation of each boundary sample into the classifier to obtain the predicted membership probability, and calculate the deviation between the predicted membership probability and the preset intermediate value (such as 0.5) to obtain the probability deviation term;

[0075] The spatial regularization term is combined with the probability bias term to obtain the boundary sample localization loss.

[0076] In this embodiment, the boundary samples are precisely pinned to the middle position between the member and non-member clusters. The boundary sample positioning loss is calculated as: L global =∑ rb∈Sboundary (∣(1 / 2)-P(r b )∣+λ reg ∣∣r b -μ boundary ∣∣), where the theoretical boundary center μ boundary By calculating the center of the member sample embedding representation (such as the mean vector) and the center of the non-member sample embedding representation, and then taking the midpoint; the spatial regularization term r b -μ boundary Penalize those boundary samples that are far away from the theoretical boundary center in the embedding space; the probability deviation term (1 / 2)-P(r b ) punishes boundary samples that are easily judged as members (probability close to 1) or non-members (probability close to 0) by the classifier, where P(r b ) is the classifier prediction boundary sample r b is the probability of membership. This item drives the predicted probability of boundary samples to the fuzzy middle value of 0.5; reg is the weight of the spatial regularization term in the boundary sample localization loss; S boundary is the set of boundary sample embedding representations; r b is the embedding representation vector of the boundary sample.

[0077] This embodiment improves the accuracy of the risk assessment model for difficult samples (i.e., boundary samples) by constructing a dual-constraint positioning loss function for boundary samples. It imposes collaborative constraints on boundary samples in two spaces of different properties (embedding representation space and membership probability space). Traditional contrastive learning loss usually only operates in a single embedding representation space, such as pulling in or pushing away. The loss function (L global ) is more refined: first, in the embedding representation space, the spatial regularization term is used to pull the embedding vector of the boundary sample closer to the theoretical boundary center calculated by the member and non-member cluster centers, thereby achieving geometric anchoring; second, in the member probability space, the probability bias term is used to penalize the classifier's high-confidence predictions for boundary samples (that is, the predicted probability is far away from 0.5), driving the model's judgment on such samples to be vague. In the risk quantification scenario of the autoregressive language model, the combined effect forces the model to learn a more reasonable decision boundary: the boundary samples are not only precisely placed between members and non-members geometrically, but their classification confidence is also effectively suppressed. This solves the technical pain point that existing methods have difficulty in accurately assessing the risk of boundary samples, so that the final risk quantification results can more finely distinguish those texts that are most easily confused and have intermediate risk levels, thereby improving the accuracy and resolution of the overall evaluation system.

[0078] According to one aspect of the present application, the importance of the above three loss terms changes dynamically at different stages of training. For example, in the early stages of training, it may be more necessary to separate the large categories (separation of heterogeneous samples), while in the later stages, it may be necessary to fine-tune the boundaries (boundary sample positioning). Static weights cannot adapt to such changes. Therefore, a predictive mechanism is introduced to dynamically adjust the weights to achieve smarter and more efficient training. Specifically, the weights of each loss in the multi-objective loss function are dynamically determined by an intelligent weight scheduling mechanism, which includes:

[0079] Collect multiple training status indicators in real time during the training process of the target model and construct a state history matrix arranged in time series. The training status indicators may include gradient norm, loss convergence speed, parameter change rate, etc.

[0080] The state history matrix is ​​input into the state prediction model to predict the future training state of the target model and obtain a future state prediction. The state prediction model can be a long short-term memory network (LSTM).

[0081] Based on the future state prediction, predictive scheduling weights are proactively generated for each loss in the multi-objective loss function.

[0082] In this embodiment, if the model predicts that the training is about to enter a stable period, the weight of the boundary sample positioning loss can be proactively increased. The dynamic adjustment of the weight can follow the following formula: α i (t)=α i (0)·exp(-(tt i ∗ ) 2 / 2σ i 2 ); where α i (t) is the weight of the i-th loss term at time t, and its peak time is t i ∗ and the steepness of change σ i Can be adjusted based on state prediction; α i (0) is the initial weight of the i-th loss term; t represents the time index of the training step; t i ∗ Indicates the preset moment when the weight of the i-th loss item reaches its peak; σ i Represents the parameter that controls the steepness of the change in the weight of the i-th loss term.

[0083] Predictive scheduling weights are applied to weight the multi-objective loss function when training the layer-wise contrastive embedding network.

[0084] This embodiment improves the efficiency of the hierarchical contrast embedding network training process and the quality of the final embedded representation by introducing an intelligent weight scheduling mechanism. This is achieved by linking an abstract algorithm (state prediction model) with data from the specific technical field of risk quantification. Specifically, multiple state indicators (such as gradient norm and loss convergence rate) during the target model training process are used as inputs to the state prediction model (e.g., LSTM network). These inputs provide a real-time, quantitative description of the target model's dynamic behavior. Based on this historical data, the prediction model predicts the target model's future training state (e.g., when it is about to enter a stable convergence period) and outputs forward-looking scheduling weights. The weights are applied to the various losses (similar clustering, heterogeneous separation, and boundary location) of the hierarchical contrast loss function, enabling adaptive optimization of the risk assessment model's own training strategy. In the scenario of language model leakage risk quantification, meta-learning-based closed-loop control brings a key advantage: the training of the risk assessment model is no longer blind, but can intelligently allocate different learning focuses at different stages of target model training. For example, in the early stages of target model learning, the focus is on widening the macro distance between members and non-members, while in the later stages, the focus is on fine-tuning the embedding positions of boundary samples. With limited computing resources, a more discriminative embedding space can be learned more efficiently, ultimately improving the accuracy and reliability of data leakage risk scoring.

[0085] According to one aspect of the present application, generating a data leakage risk quantification result includes:

[0086] Monitor the convergence process of the target model's loss function, obtain the loss change rate, and divide the current training process of the target model into early, middle, and late training stages based on the loss change rate.

[0087] In this embodiment, large language models exhibit significant differences in their memory and forgetting behaviors, generalization capabilities, and privacy leakage patterns at different stages of training. For example, in the early stages, the model learns rapidly and the loss decreases quickly; in the later stages, the model converges and may begin to memorize noise or specific samples. Therefore, a static risk classifier cannot adapt to this dynamic change. This step aims to make the risk assessment model stage-aware. Specifically, the stages are divided by calculating the derivative of the loss function with respect to the number of training steps (time), namely, the loss change rate dL / dt. Stage(t) = Early, if dL / dt < -γ1; Middle, if -γ1 ≤ dL / dt ≤ -γ2; Late, if dL / dt > -γ2. Where Stage(t) is the training stage of the model at training step t (e.g., early, middle, late); γ1 and γ2 are preset loss change rate thresholds used to distinguish different stages, for example, γ1 = 0.1 and γ2 = 0.01.

[0088] The classification strategy of the dynamic inference classifier is adaptively adjusted according to the current training stage of the partition.

[0089] Optionally, adaptively adjusting the classification strategy of the dynamic inference classifier is achieved by at least one of the following methods:

[0090] Method 1: Preset stage-specific weight offsets for each training stage in the early, middle, and late stages. Select the corresponding stage-specific weight offset according to the current training stage and combine it with the basic weight matrix to generate a stage-aware weight matrix; apply the stage-aware weight matrix to the dynamic inference classifier.

[0091] In this embodiment, the update formula is: W(t)=W base +I[Stage(t)=s]·ΔW s ;W(t) is the stage perception weight matrix used by the classifier at time t, W base is the basic weight matrix of the classifier, ΔW s is a weight offset matrix optimized specifically for stage s (e.g., late stage); I[·] represents an indicator function, which is 1 when the condition is met and 0 otherwise. This means that at different stages, the classifier will switch to a set of parameters that is more suitable for the risk model of the current stage.

[0092] Method 2: According to the current training stage, a time-varying adjustment factor is calculated, and the basic activation function is modified using the time-varying adjustment factor to generate a time-varying activation function; the time-varying activation function is applied to the dynamic inference classifier.

[0093] In this embodiment, the time-varying activation function f in training step t dynamic (z, t) = Swish(z)·(1+β(t)·tanh(z)); where z is the input of the activation function; the time-varying adjustment factor β(t) can be a function related to the training stage. For example, in the late stage, β(t) takes a larger value to enhance the nonlinearity of the activation function and thus capture more subtle feature differences.

[0094] The optimized embedding representation vector is processed using the adjusted dynamic inference classifier to determine the risk affiliation of the corresponding text and summarize the data leakage risk quantification results.

[0095] This embodiment proposes a dynamic inference classifier, enabling the data leakage risk quantification process to adapt to the dynamic evolution of the target language model training, thereby improving the real-time and accuracy of risk assessment. This is achieved by transforming the classifier from a static entity into an intelligent agent capable of perceiving the external environment (i.e., the target model training phase) and dynamically adjusting its own strategies. Specifically, by monitoring the rate of change of the target model's loss function, the training process is objectively divided into early, mid, and late stages. The dynamic inference classifier adjusts its classification strategy based on the current stage using one of two optional methods: first, by combining a base weight matrix with preset stage-specific weight offsets to generate a stage-aware weight matrix more appropriate for the current stage's risk model; second, by modifying the activation function's shape using a time-varying adjustment factor, altering its nonlinear mapping capabilities. In the application scenario of language model risk quantification, risk assessment is no longer a fixed, unchanging metric, but a dynamic process that evolves alongside the model being assessed. For example, in the later stages of model training, when the leakage risk pattern becomes more subtle, the classifier can automatically switch to a more sensitive set of weights or a more expressive activation function, so that the risk quantification results always maintain high accuracy and timeliness throughout the entire training life cycle.

[0096] Case 1: A data leakage risk quantification method for the autoregressive language model training process. This framework combines classification-based and representation-based membership inference attack methods. It does not directly rely on the raw white-box information of the data samples (the intermediate calculation results of the model). Instead, it focuses on learning high-quality membership representations from the white-box information of the samples. The distance or similarity between the membership representations is used as the optimization target, so that the inference model can learn the differences in the membership representations of member and non-member samples in the target model as much as possible. Specifically, it includes:

[0097] Step 1: Enhance member data division.

[0098] Traditional membership inference attacks only consider binary classification problems, that is, samples either belong to the training set (member) or do not belong to it (non-member). However, in real scenarios, there are a large number of boundary samples near the decision boundary. The membership attributes of these samples are ambiguous. Accurately identifying such samples is crucial to improving the accuracy of privacy risk assessment. In this paper, a ternary data partitioning strategy is introduced to construct a more refined training data structure through an information theory-driven boundary sample generation mechanism. Given a text classification training dataset D train ={(x i ,y i )|i=1,2,…,N}, the information entropy of data distribution is defined as: H(D train )=-∑ i=1 ∣v∣ p i log2p i ; Among them, p i represents the probability of occurrence of the i-th token in the vocabulary v. The boundary sample generation function is: b =argmin x [λ1 L sem (x,D train )+λ2 L struct (x)+λ3 L freq (x)]; where L sem (x,D train )=(1 / (|D ft |))∑ x'∈Dft sim(x, x') is the semantic similarity loss, L struct (x)=-∑ k=1 n PMI(w k , w k+1 ) is the structural rationality loss, L freq (x)=∑ w∈x |logf (w)-logf*| is the frequency balance loss. Member sample D1={(x i ,y i ,1)} i=1 αN From D train In the sampling, non-member sample D0={(x j ,y j ,0)} j=1 αN Sampling from the same distribution external data, boundary sample set D b ={(x k ,y k , 0.5)} k=1 βNGenerated by the boundary generating function. Where α∈[0.2,0.5],β∈[0.1,0.3] are sampling ratio parameters; x i is the i-th input sample, y i is x i Corresponding label; D ft is the reference sample subset used to calculate semantic similarity; x' is the subset of samples belonging to D ft The reference sample, n is the number of token pairs in sample x, w k is the kth token in sample x; f(w) is the frequency of word w in the training corpus, and f* is the average frequency of all tokens in the vocabulary.

[0099] In order to ensure that the generated boundary samples have the expected fuzzy properties, a quantitative evaluation index is used to measure the quality of the boundary samples. This index is based on the similarity difference between the sample and the member set and the non-member set. The fuzziness index of the boundary sample is: Φ(x b )=1 / 2 [1-tanh((|S mem (x b )-S non (x b )|) / σ) ]; where S mem (x b ) and S non (x b ) denote the similarity scores between the sample and the member set and the non-member set, respectively, and σ is a normalization parameter. The advantage of the ternary partitioning strategy is that by introducing boundary samples, the model can learn a more refined decision boundary; the presence of boundary samples makes the classifier more robust in the face of ambiguous situations.

[0100] Step 2: Extract the attributes of three-channel members.

[0101] Based on the dual-channel feature extraction, a third dimension, the time series channel, is introduced to form a three-channel enhanced attribute extraction mechanism. This can comprehensively capture privacy leakage characteristics during model training from multiple angles, improving feature richness and discriminative ability.

[0102] 1. Forward channel attribute extraction.

[0103] The forward channel is responsible for extracting the feature information of each layer generated by the model during the forward reasoning process. Compared with the traditional method that only focuses on the final output, it deeply explores the hidden state and attention pattern of the intermediate layer. For the basic forward feature, for L (for example, 32 layers) layer autoregressive language model (such as GPT-2 large), the first The hidden state of the layer is: h (l) =TransformerLayer l (h(l-1) ); For the attention weight distribution feature, calculate the information entropy distribution of multi-head attention: A h (l) =Attention h (Q (l) , K (l) , V (l) )H attn (l) =(-1 / H)∑ h=1 H ∑ i，j A h，ij (l) logA h，ij (l) ; Then, we get the final forward channel feature set: Ψ f ={h (l) , H attn (l) , ‖h (l) ‖2, Var(h (l) )} l=1 L ; where h (l) ∈R T×d is the hidden state matrix of the lth layer, T is the sequence length, and d is the hidden dimension. l is the complete transformation function of the lth layer, including multi-head self-attention, feedforward network and residual connection; l∈{1, 2, ..., L} is the layer index, L is the total number of model layers, h (0) =x is the initial input, i.e. the output of the word embedding layer. attn (l) is the attention information entropy, reflecting the concentration of attention distribution; ‖h (l) ‖2 is the L2 norm, which measures the overall level of activation intensity; Var(h (l) ) is the variance, reflecting the dispersion of activation values; Q (l) is the query matrix of the lth layer, K (l) is the bond matrix of the lth layer, V (l) is the value matrix of the lth layer; H is the number of heads in the multi-head attention, h refers to the hth attention head index, A h，ij (l) is the attention weight of sequence position i to position j in the lth layer and the hth head.

[0104] 2. Back channel attribute extraction.

[0105] The back channel focuses on extracting gradient information during model training. For the first-order gradient feature, the first-order gradient directly reflects the rate of change of the loss function relative to the model parameters and is the core information of the optimization process: g=▽ θ L(fθ (x), y); where g∈R |θ| is the gradient vector, whose dimension is equal to the total number of model parameters; θ is the set of all trainable parameters of the model; L( ) is the loss function, usually the cross entropy loss; ▽ θ is the gradient of parameter θ; f θ (x) is the predicted output of the parameterized model for input x, and y is the true label of the sample. For the diagonal elements of the Hessian, the second-order gradient information (Hessian matrix) provides information about the curvature of the loss landscape, which is important for understanding the optimization dynamics and memory properties of the model. Since the full Hessian matrix is ​​computationally expensive, the Hutchinson estimator is used to efficiently approximate its diagonal elements. diag(H)≈(1 / K)∑ k=1 K Ξ k Θ▽ θ (Ξ k T g); where diag(H)∈R |θ| is the diagonal element vector of the Hessian matrix; K is the number of sampling times, usually 10-50, balancing accuracy and efficiency; k Rademacher distribution (Rademacher(±1)) is the random vector sampled at the kth time, each element independently takes the value +1 or -1; Θ is the Hadamard product (element-wise product); T is the transpose; g is the first-order gradient vector of the loss function with respect to the model parameters. Combining the first-order and second-order gradient information, a curvature index is obtained to quantify the local geometric characteristics of the current sample in the loss landscape. κ = ‖diag(H)‖2 / (‖g‖2+Ξ); where κ∈R + is the curvature ratio, a positive real number; Ξ is a small positive number (such as 1e-8) to prevent division by zero errors. A high κ value indicates that the loss landscape has a large curvature and may be near a sharp local extreme; a low κ value indicates that the loss landscape is relatively flat and the optimization process is more stable. b ={g,‖g‖2,diag(H),κ,L(f θ (x), y)}.

[0106] 3. Timing channel attribute extraction.

[0107] The time series channel is specifically designed to capture the dynamic changes in the model training process. It reflects the evolution trajectory of model parameters, the cumulative effect of optimization momentum, and the temporal change pattern of the loss landscape. For the parameter evolution trajectory, the parameter change trajectory directly reflects the model's learning process. By tracking the parameter change pattern, it is possible to identify the model's memory strength for different samples: Δ t =θ t-θ t-1 ; where Δ t ∈R |θ| is the parameter change vector at time t; θ t Represents the model parameter state at time t; t is the time index of the training step. Large ‖Δ t ‖2 indicates the model’s strong memory of the current sample. Δ t The variance of reflects the stability of the learning process. For the momentum accumulation feature, in actual training, the optimizer usually uses the momentum mechanism to accelerate convergence and reduce oscillation. The momentum accumulation pattern can reflect the degree of dependence of the model on historical gradient information: t =γm t-1 +(1-γ)Δ t ; where m t ∈R |θ| represents the cumulative momentum vector at time t; γ∈[0.9, 0.99] is the momentum decay coefficient, which controls the degree of retention of historical information; and (1-γ) is the weight coefficient for current changes. A high γ value retains more historical information, resulting in a smoother learning process. A low γ value focuses more on current changes and is more sensitive to new information.

[0108] For the evolution of loss landscape curvature, the change of loss function not only reflects the improvement of model performance, but its rate of change can also reveal the efficiency and stability of the optimization process. t =(L t -L t-1 ) / (|Δ t T g t-1 |+Ξ); where ρ t ∈R is the curvature evolution ratio, which can be positive or negative; L t is the loss value at time t; Δ t T g t-1 represents the inner product of the parameter change and the gradient, which represents the expected linear loss change; Ξ is a numerical stability constant. ρ t ≈1 means that the loss change is in line with the linear expectation and the optimization is normal; ρ t >>1 indicates that the loss decreases beyond expectations and may be close to the local optimum; ρ t <0 indicates that the loss changes in the opposite direction and there is a problem with the optimization. For time series correlation analysis, by analyzing the correlation of parameter changes at different time lags, it is possible to identify periodic patterns and long-term dependencies in the training process. temp (k)=(1 / (Tk))∑ t=k+1 T corr(Δ t , Δ t-k ); where C temp(k)∈[-1,1] is the correlation coefficient after k steps; corr(,) is the Pearson correlation coefficient; and T is the total time step. A high positive correlation indicates that the parameter changes are continuous and the learning process is stable; a high negative correlation indicates that the parameter changes are oscillatory and there may be overfitting; a low correlation indicates that the parameter changes are highly random and the learning effect is unstable. t ={Δ t , m t ,ρ t , C temp (k), Entropy({L t-w:t})}. Where L t-w:t is the set of loss value sequences from time tw to t; Entropy is the information entropy of the local loss sequence.

[0109] 4. Feature fusion and normalization.

[0110] Effectively fusing the features of the three channels is a key step in ensuring the overall feature quality. An adaptive weighting mechanism is constructed to dynamically adjust the fusion weight according to the variance of each channel feature. Weights are assigned based on the variance of each channel feature, and channels with large variances receive higher weights, so that features with rich information are fully utilized: channel =softmax((Var(Ψ channel )) / τ); where w channel ∈[0,1] is the normalized weight of each channel; channel∈{f,b,t} represents the forward, reverse and time series channels respectively; Var(Ψ channel ) is the variance of the channel feature; τ>0 is the temperature parameter, which controls the sharpness of the weight distribution. The comprehensive feature is expressed as: total =w f ΘΨ f ⊕w b ΘΨ b ⊕w t ΘΨ t Where ⊕ represents the feature concatenation operation, and Θ is the element-by-element product (weighted application). The advantages of the adaptive fusion strategy are: it automatically adjusts the importance of each channel based on data characteristics to avoid completely ignoring the information of a particular channel; and it is well adaptable to differences in feature quality.

[0111] Step 3: Hierarchical contrast embedding learning.

[0112] Traditional contrastive learning methods typically use a simple positive-negative sample comparison strategy, which has significant shortcomings when handling membership inference tasks: they fail to fully exploit fine-grained relationships between samples; their processing capabilities for boundary samples are limited; and they lack consideration for temporal consistency. The Hierarchical Contrastive Embedding Network (HCEN) proposed in this example systematically addresses these issues through a three-level contrastive learning mechanism. It not only learns the intrinsic similarities between samples of the same type, but also maximizes the discrimination between different categories, while precisely locating boundary samples.

[0113] 1. Clustering of similar samples.

[0114] For the member sample set S mem ={r i mem} i=1 M , based on the principle of information maximization, the contrast loss function is designed: L intra =(-1 / M)∑ i=1 M log(∑ j≠i exp(sim(r i mem , r j mem ) / τ in )) / (∑ k≠i exp( sim(r i mem , r k ) / τ in )); where L intra ≥0 is the intra-layer contrast loss, and the smaller the value, the higher the degree of aggregation of similar samples; M is the total number of member samples; r i mem ∈R d is the embedding representation vector of the i-th member sample; sim(u,v)=(u T v) / (|u|2|v|2 ) is the cosine similarity function; τ in >0 is the temperature parameter that controls the sharpness of the similarity distribution. This loss function maximizes the similarity between samples of the same type through a contrastive learning framework while taking into account the relative relationship with all other samples.

[0115] 2. Separation of heterogeneous samples.

[0116] Heterogeneous sample separation, also known as inter-layer contrastive learning, focuses on maximizing the separation between samples of different categories. Unlike the traditional simple boundary loss, the introduction of data similarity adjustment factors enables the separation strategy to adapt to the intrinsic relationship between samples. inter =∑i，j max(0,ξ-d(r i mem , r j non )+α·Φ(x i , x j )); where L inter ≥0 is the inter-layer contrast loss, which measures the degree of separation of different categories; ξ>0 is the boundary parameter, which defines the expected minimum separation distance; d(u, v)=1-sim(u, v) is the distance function, which is based on cosine similarity; α∈[0,1] is the adjustment factor weight, which controls the influence of data similarity; Φ(x i , x j ) is the data similarity adjustment factor. The data similarity adjustment factor takes into account the similarity of samples in the original data space and prevents over-separation of essentially similar samples in the embedded space. This function uses a Gaussian kernel to calculate the similarity between two samples in the original data space. Samples with high similarity require less separation.

[0117] 3. Boundary sample positioning.

[0118] Global contrastive learning is specifically designed to accurately locate and process boundary samples. By introducing a triple contrast mechanism, boundary samples can be accurately located at the middle position between member and non-member samples. The triple global positioning loss consists of two parts: a probability bias term that makes the predicted probability of boundary samples close to 0.5; and a regularization term that makes the boundary samples located at the theoretical boundary position in the embedding space. global =∑ rb∈Sboundary (∣(1 / 2)-P(r b )∣+λ reg ∣∣r b -μ boundary ∣∣); where L global ≥0 is the global contrast loss, which measures the accuracy of boundary sample positioning; S boundary is the embedding representation set of boundary samples; P(r b )=σ(W T r b +b) is the predicted probability of the boundary sample; W∈R d×1 , b∈R represents the weight and bias parameters of the classifier; λ reg >0 indicates regularization weight, balancing the two loss terms; μ boundary is the theoretical boundary center. The definition of the theoretical boundary center is based on the embedding center of member and non-member samples, which provides a clear positioning target for boundary samples. In order to maintain the stability of the embedding representation during training, a temporal consistency constraint L is added. temporalThe temporal consistency constraint ensures that the embedding representation maintains reasonable continuity during training and avoids drastic jumps. This constraint ensures the predictability and stability of the embedding evolution by predicting the embedding representation at the current moment and comparing it with the actual value. The four levels of contrastive learning objectives are integrated into a unified multi-objective optimization framework, and the adaptive balance of the training process is achieved through a dynamic weight adjustment strategy: L total =α1 L intra +α2L inter +α3 L global +α4 L temporal ; Among them, the importance of different loss terms will change during the training process, and a dynamic weight adjustment mechanism based on the Gaussian function is constructed: α i (t)=α i (0)·exp(-(tt i ∗ ) 2 / 2σ i 2 ); where α i (t) is the weight of the i-th loss item at time t; α i (0) is the initial weight value; t i ∗ is the peak moment of the i-th loss term; σ i is a parameter that controls the steepness of weight changes.

[0119] Step 4: Dynamic weighted membership inference.

[0120] Traditional membership inference methods use static classification strategies, ignoring the dynamic nature of model training. However, at different training stages, the model's data memory patterns, generalization capabilities, and privacy leakage risks can change significantly. By introducing a training stage-aware mechanism, privacy risk assessment can adapt to these dynamic changes. Based on the convergence characteristics of the loss function, the training process is automatically divided into three distinct stages, each with unique learning characteristics and privacy risk patterns: Stage(t) = Early, if dL / dt|bigg| t < -γ1; Middle, if -γ1≤dL / dt|bigg| t ≤-γ2;Late, if dL / dt|bigg| t > -γ2; where Stage(t)∈{Early, Middle, Late} is the training stage identifier at time t; dL / dt |bigg| t is the loss change rate at time t (numerical derivative); γ1>γ2>0 is the threshold parameter for stage division.

[0121] According to the characteristics of different training stages, a classifier architecture that can be dynamically adjusted is constructed, and an adaptive classification strategy is implemented through the stage-aware weight matrix and dynamic activation function: W(t)=W base +∑ s∈{Early，Middle，Late} I[Stage(t)=s]·ΔW s ; Where I[·] is the indicator function, ΔW s is the stage-specific weight offset. In addition to the dynamic adjustment of the weight matrix, a time-varying activation function is introduced to further enhance the adaptability of the classifier: dynamic (z, t) = Swish(z)·(1+β(t)·tanh(z)); where β(t) = β0·sin(ωt+φ) is the time-varying adjustment factor, β0 is the initial time-varying adjustment factor, ω is the frequency factor, and φ is the phase offset. The classifier training process is supervised by the member label l, and the training goal is to minimize the cross entropy loss between the predicted label l* and the actual member label l: L ce =(-1 / N)∑ i [l i log(l i *)+(1-l i )log(1-l i *)]. The embedded representations generated in the previous steps serve as the input features of the classifier. These representations have been optimized and provide the classifier with the key information needed to distinguish between member and non-member samples, which can effectively improve the accuracy of membership inference. Finally, the two parts of the loss are jointly optimized to update the audit model weights: L = L total +vL ce ; where v is the weight parameter that balances the two parts of the loss.

[0122] To comprehensively evaluate the effectiveness of the privacy risk audit framework and achieve the goal of privacy quantification, the definition and selection of quantitative metrics should be consistent and scientific, enabling comparison of audit results across different downstream tasks within the same model. Furthermore, they should support comparative analysis of audit results across multiple models within the same downstream task. Specifically, to verify the effectiveness of the quantification method and provide feedback on its effectiveness, the following evaluation metrics are used: Balanced Accuracy, Area Under the Curve (AUC), and True Positive Rate at Low False Positive Rate (TPR at Low FPR). Balanced Accuracy is evaluated by calculating the attack accuracy, i.e., the ratio of correctly inferred samples to the total number of inferred samples. Balanced accuracy refers to the fact that the training and test datasets of the audit model contain an equal number of member and non-member samples. The AUC is the area covered by the ROC curve, which measures the model's performance in determining whether a sample belongs to the training dataset (positive sample) or the non-training dataset (negative sample). A larger AUC value indicates a better classifier. The true positive rate indicator under low false positive rate can better reflect the attack's ability to accurately identify member samples under low false positive rate conditions. The evaluation under low FPR can more clearly demonstrate the attack's ability to identify sensitive individuals while reducing false positive errors.

[0123] Case 2: Using a real-world scenario involving fine-tuning the GPT-2 large model on the PubMed-RCT text classification dataset, this application demonstrates its complete application. Specifically, the application uses an enhanced membership data partitioning method based on representation space consistency verification to generate a member set, a non-member set, and a high-quality boundary text set from the PubMed-RCT dataset, forming a tri-partitioned text set. During the fine-tuning process of the GPT-2 large model (an autoregressive language model consisting of 32 Transformer layers), a member attribute extraction method based on feature purification and self-healing is applied to each text in the tri-partitioned text set. Attributes from the forward, backward, and temporal channels are extracted, purified, and fused to generate a member attribute vector. The member attribute vector is then fed into a hierarchical contrastive embedding network based on intelligent weight scheduling for training. This network uses dynamically weighted contrastive learning to map the attribute vector to an optimized embedding representation vector. The optimized embedding representation vector is then fed into a dynamic inference classifier. The classifier will determine whether it is in the early, middle or late stages according to the loss change rate during the GPT-2 fine-tuning process, and accordingly use the stage-aware weight matrix or time-varying activation function to determine the risk membership. When training the risk assessment model (including the hierarchical contrastive embedding network and the dynamic inference classifier), its total loss function is to convert the total contrastive learning loss L total Cross entropy loss L with membership classification ce Perform joint optimization: L=L total+vL ce ; Where L is the total loss function of joint optimization, L total is the total loss of layer-wise contrastive embedding learning, and is L intra , L inter , L global The weighted sum of the equal losses; v is the weight parameter that balances the contrastive learning loss and the classification loss. Through the above steps, a risk score (e.g., a value between 0 and 1) is output for each input text, indicating its risk affiliation. Aggregating the risk scores of all texts yields a quantified data breach risk.

[0124] To verify the effectiveness of this embodiment, balanced accuracy, area under the receiver operating characteristic (ROC) curve (AUC), and true positive rate at low false positive rate (TPR at Low FPR) were used as evaluation metrics. In a GPT-2 fine-tuning scenario, the following quantitative results were achieved: balanced accuracy: 0.741 ± 0.012; AUC: 0.775 ± 0.008; TPR at 0.1 FPR: 0.371 ± 0.080. These results demonstrate that this embodiment can effectively and accurately quantify the data leakage risk during autoregressive language model training, resolving issues existing in existing technologies.

[0125] This invention can be applied to AI model development, such as large-scale language model training, providing privacy risk monitoring for the training of models like GPT and BERT; and domain-specific model development, providing privacy protection for AI models in sensitive fields like finance, healthcare, and law. It can also be applied to data security and compliance, such as privacy compliance audits to help companies meet the requirements of privacy regulations like GDPR and CCPA, and to provide quantitative assessments of the security of data usage. It can also be used in cloud computing and edge computing. For example, it can provide privacy protection for cloud-based model training services, enable lightweight risk monitoring on resource-constrained edge devices, and provide privacy risk assessments for distributed learning.

[0126] Example 3: This example uses an application scenario in the financial sector. For example, a bank plans to use its customer service chat logs to fine-tune a large language model (e.g., an autoregressive model with approximately 100 billion parameters) to develop an intelligent customer service application. Because chat logs can contain sensitive information such as customer privacy and financial transactions, quantifying data leakage risks in real time during the fine-tuning process is valuable. The specific steps include:

[0127] 1. Generation of ternary partitioned text sets.

[0128] Provide the original training text set D train, which can contain millions of anonymized chat records between customers and banks with user authorization. As an example, the following text is selected from the original training text set: Text A (which will be used as a member sample later): My credit card with the last number 8848 had an abnormal consumption of 520 yuan last month. I request an investigation. Text B (which will be used as a non-member sample later): How do I apply for a new savings card online? Based on this, enhanced member data segmentation processing is performed, specifically including:

[0129] Step 1: Generate member text and non-member text. train Sampling is performed to obtain the member text set D1. For example, text A is sampled as a sample in D1, and its category is marked as a member. At the same time, train Sampling is performed from an external corpus with similar but independent data distribution characteristics to obtain a non-member text set D0. For example, text B is sampled as a sample in D0 and its category is marked as non-member.

[0130] Step 2: Generate boundary text. The boundary text can be obtained by solving the multi-objective optimization function xb = argmin x [λ1*L sem (x,D train ) + λ2*L struct (x) + λ3*L freq (x)] to generate. Among them, the optimization function aims to generate a type of text that is semantically close to the member text but is not a member text. As an example, the optimization calculation is performed with the member text A as a reference to obtain the candidate boundary text D: My credit card with the last number 8848 had an abnormal transaction of 518 yuan last month. Please help. It can be understood that during the optimization process, the semantic similarity loss L calculated by the candidate boundary text D relative to the member text A is sem The value of is low (for example, 0.02), the structural rationality loss L struct (e.g. 0.15) and frequency balance loss L freq (For example, 0.08) is also within a reasonable range. Text D is selected as the boundary text and added to the boundary text set Db, and its category is marked as boundary. Through the above steps, a ternary partitioned text set consisting of member, non-member and boundary text is obtained. For example, the set includes: member text: {My credit card with the last number 8848 had an abnormal consumption of 520 yuan last month. I request an investigation.}; non-member text: {How can I apply for a new savings card online?}; boundary text: {My credit card with the last number 8848 had an abnormal transaction of 518 yuan last month. I request assistance.}.

[0131] 2. Extraction and construction of member attribute vectors.

[0132] For each text in the ternary partitioned text set, in the t-th training step of the target model, its three-channel member attributes are extracted to generate a member attribute vector. In this embodiment, it is assumed that the hidden layer dimension of the model is 1024. As an example, the member text A is processed: forward channel attributes: extract the features generated by the forward reasoning process of the model. For example, the calculated loss value L is 0.08; the L2 norm of the activation value of a certain intermediate layer ||h(l)||2 is 35.4; the attention entropy H attn (l) is 1.8. Backward channel attributes: extract the features generated by the model's back propagation process. For example, the calculated gradient norm ||g|| 2 is 2.5; the curvature index κ is 15.2. Time series channel attributes: extract the characteristics of the state evolution of the model between multiple training steps. For example, the calculated parameter change norm ||Δt|| 2 is 0.9; the cumulative momentum norm of the optimizer ||mt|| 2 is 4.1. Correspondingly, the same attribute extraction process is performed on non-member text B and boundary text D to obtain their respective attribute values. For example, the loss value L of non-member text B is 2.5, and the gradient norm ||g|| 2 is 8.9; the loss value L of the boundary text D is 0.15, and the gradient norm ||g|| 2 is 3.0.

[0133] Furthermore, the attributes extracted from each channel are normalized and weighted fused to form a member attribute vector Ψ corresponding to each text. For example, the dimension of this vector can be 1024. It can be seen that the member attribute vector Ψ of the boundary text D is D In terms of numerical structure, the member attribute vector Ψ of the member text A A is closer to the member attribute vector Ψ of the non-member text B B There is a big difference.

[0134] 3. Generation of embedded representation vectors.

[0135] The 1024-dimensional member attribute vector Ψ is input into the Hierarchical Contrastive Embedding Network (HCEN). The HCEN is used to map the member attribute vector Ψ to a preset low-dimensional embedding space (e.g., 128 dimensions) to generate an optimized embedding representation vector r. As an example, the mapped 128-dimensional embedding representation vector r is as follows: The embedding representation r of member text A A : [0.91, 0.88, -0.12, ...]; Embedding representation r of non-member text B B : [-0.85, -0.92, 0.21, ...]; Embedding representation r of boundary text D D:[0.05, -0.01, 0.08, ...]. By calculating the cosine similarity between the embedding representation vectors, we can illustrate their distribution characteristics in the embedding space. For example, sim(r A , r B ) is calculated to be -0.95, indicating that the representations of members and non-members are effectively pushed apart in space. A , r D ) is calculated as 0.45, and sim(r D , r B ) is -0.42, indicating that the boundary text characterization r D Positioned between the clusters formed by member and non-member representations.

[0136] 4. Quantification results of data leakage risk.

[0137] On this basis, the 128-dimensional embedding representation vector r is input into the dynamic reasoning classifier. The dynamic reasoning classifier can adaptively use the weight matrix W(t) of the first stage perception to perform classification according to the training stage of the target model fine-tuning process (for example, judging it as the late stage based on the loss change rate), and finally determine and output the risk membership of the corresponding text. The exemplary data leakage risk quantification result (risk score, value range [0, 1]) is as follows: A Risk score (member text): 0.97; B Risk score (non-member text): 0.02; D Risk score for (boundary text): 0.51.

[0138] As can be seen, the above steps of this embodiment implement a method for quantifying the data leakage risk of text containing specific sensitive information (such as the last number 8848 or 520 yuan). Member text receives a high risk score close to 1, non-member text receives a low risk score close to 0, and boundary text with ambiguous attributes receives an intermediate risk score close to 0.5. The quantified results can serve as technical signals to trigger early warning mechanisms, prompting model developers to adopt technical measures such as differential privacy, data desensitization, or adjust training strategies. This provides technical support for data security and compliance during the development of applications such as financial intelligent customer service, helping to meet the requirements of relevant data protection regulations.

[0139] The preferred embodiments of the present invention are described in detail above. However, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all fall within the scope of protection of the present invention.

Claims

1. A data leakage risk quantification method for the autoregressive language model training process, characterized by: include: An enhanced member data partition is performed on an original training text set containing a predetermined number of training texts to generate a ternary partitioned text set consisting of member, non-member, and boundary texts. The process of obtaining the boundary texts comprises: calculating data distribution characteristics based on the original training text set, and constructing a multi-objective optimization function based on the data distribution characteristics, including semantic similarity loss, structural rationality loss, and frequency balance loss; solving the multi-objective optimization function to obtain text that minimizes a weighted combination of the losses, thereby obtaining the boundary texts. For each text in the ternary partitioned text set, the target model is used to extract three-channel member attributes and generate a corresponding member attribute vector for each text; the three-channel member attributes are forward and reverse channel attributes and time series channel attributes; The member attribute vector corresponding to each text is input into the hierarchical contrast embedding network, and mapped into the optimized embedding representation vector through contrast learning; The optimized embedding representation vector is input into the dynamic reasoning classifier to determine the risk membership of the corresponding text and generate a data leakage risk quantification result including the risk score of each text; Among them, the mapping is the optimized embedding representation vector, including: The hierarchical contrastive embedding network is trained by minimizing a multi-objective loss function, wherein the multi-objective loss function includes: a similar sample clustering loss for forcing similar samples to cluster in the embedding space; a heterogeneous sample separation loss for forcing heterogeneous samples to separate; and a boundary sample localization loss for regulating the position of boundary samples. Utilize the trained hierarchical contrast embedding network to receive member attribute vectors and output optimized embedding representation vectors.

2. The method according to claim 1, characterized in that Generate a triple partition text set, including: Sampling is performed from the original training text set to obtain member text and non-member text; boundary, member and non-member text are combined to form a ternary partition text set.

3. The method according to claim 1, characterized in that Generate a corresponding member attribute vector for each text, including: Perform forward reasoning and backpropagation on the text on the target model to extract forward and backward channel attributes; Monitor the state evolution of the target model between predetermined training steps and extract the temporal channel properties of the text; The forward, backward and temporal channel attributes are fused to form the member attribute vector corresponding to each text.

4. The method according to claim 3, characterized in that Extract the temporal channel attributes of the text, including: Record the model parameter states of the target model in each adjacent training step and calculate the parameter change vector; Track the momentum update process of the optimizer used by the target model in a predetermined number of training steps and calculate the cumulative momentum vector; The parameter change vector and the accumulated momentum vector together constitute the time series channel attribute.

5. The method according to claim 1, wherein The calculation process of boundary sample positioning loss includes: Based on the embedding representations of member samples and non-member samples, the theoretical boundary center is calculated and determined; For each boundary sample’s embedded representation, calculate its distance from the theoretical boundary center to obtain the spatial regularization term; Input the embedded representation of each boundary sample into the classifier to obtain the predicted membership probability, and calculate its deviation from the preset intermediate value to obtain the probability deviation term; The spatial regularization term is combined with the probability bias term to obtain the boundary sample localization loss.

6. The method according to claim 1, characterized in that Generate quantitative data breach risk results, including: Monitor the convergence process of the target model's loss function and obtain the loss change rate, based on which the current training process of the target model is divided into early, middle, and late training stages; Adaptively adjust the classification strategy of the dynamic reasoning classifier according to the current training stage of the division; The optimized embedding representation vector is processed using the adjusted dynamic inference classifier to determine the risk affiliation of the corresponding text and summarize the data leakage risk quantification results.

7. The method according to claim 6, characterized in that Adaptively adjust the classification strategy of the dynamic inference classifier by at least one of the following methods: Preset stage-specific weight offsets for each training stage in the early, middle, and late stages. Select the corresponding stage-specific weight offset based on the current training stage and combine it with the base weight matrix to generate the stage-aware weight matrix. Apply it to dynamic inference classifiers; or, According to the current training stage, the time-varying adjustment factor is calculated, and the basic activation function is modified accordingly to generate a time-varying activation function; Apply it to dynamic inference classifiers.

8. The method according to claim 2, characterized in that Obtaining the boundary text further includes a verification and screening process based on the consistency of the representation space, specifically: Extract the hidden state representations of member text and non-member text in the target model, and extract their respective word vector representations; Based on word vector representation and hidden state representation, train a lightweight representation predictor; Based on the hidden state representation of member text and non-member text, calculate the theoretical boundary representation; For the candidate boundary texts generated by solving the multi-objective optimization function, the trained lightweight representation predictor is used to obtain the predicted hidden state representation; The representation space deviation between the predicted hidden state representation and the theoretical boundary representation is calculated, and the text with the representation space deviation less than a preset threshold is selected from the candidate boundary texts as the final boundary text.

9. The method according to claim 3, characterized in that Before fusing the forward, reverse and time series channel attributes, further feature purification processing is included: For each channel attribute in the forward, reverse, and time series channels, calculate the signal-to-noise ratio or inter-channel consistency to generate a channel reliability score; According to the channel reliability score of each channel, corresponding purification operations are performed on the attribute data of the channel to obtain the purified forward, reverse and timing channel attributes.

Images