Training sample data set construction method with privacy protection and multiple classifiers

Abstract

The invention discloses a training sample data set construction method with privacy protection and a multi-classifier, sensitive information in training data is protected by constructing a multi-hidden-label mechanism, firstly, a label space division module is utilized to divide a label set into sensitive labels and non-sensitive labels, and the sensitive labels and the non-sensitive labels are classified according to a multi-hidden-label strategy; and dividing the labels into disjoint hidden label groups to form hidden label input. And then, an unbiased risk estimation module is adopted to calculate model loss, and effective training of a multi-class classifier is realized on the premise that real label explicit exposure is not needed. Furthermore, a learning strategy based on two-step optimization is provided, the first step is to optimize the positive risk item, and the second step is to optimize the negative risk item, so that the model recognition capability is improved. According to the method, a multi-hidden label mechanism is introduced, while a plurality of sensitive labels are effectively hidden, clear supervision information is still provided for part of non-sensitive labels, a plurality of sensitive and non-sensitive class labels can be effectively recognized, and privacy protection and model learnability are both considered.

Description

Technical Field

[0001] This invention relates to a method for constructing a privacy-preserving training sample dataset and a multi-classifier, applicable to privacy-preserving scenarios in the data annotation stage of classification tasks in computer vision, and belongs to the field of computer vision technology. Background Technology

[0002] Traditional ordered supervised learning tasks face numerous challenges, among which acquiring large amounts of data and accurate supervisory information is difficult, even impossible in some real-world scenarios. To address this, extensive research has been conducted on various weakly supervised learning frameworks, including semi-supervised learning, positive unlabeled learning, multi-instance learning, and noisy label learning, offering new insights into improving learning performance. Another key challenge arises in obtaining large amounts of high-quality labels when sensitive information cannot be publicly disclosed. For example, in business and personal life, there is a wealth of sensitive information (e.g., political preferences or habits) whose labeling information needs to be hidden during data collection. In this problem, collecting explicit sensitive labels becomes difficult, prohibiting learning from ordered supervised data.

[0003] Sensitive labels play a crucial role in data usage, frequently appearing in datasets and containing important information such as diseases, assets, or weapons; their exposure can lead to significant security threats. To protect sensitive labels during data annotation, researchers have proposed various label learning methods, including label proportion learning, complementary label learning, similarity and unlabeling learning, and similarity confidence learning. Label proportion learning obfuscates sensitive information by annotating the data with the proportion of positive instances instead of displaying explicit labels. Complementary label learning aims to protect privacy by assigning labels to instances that do not belong, thus avoiding the direct disclosure of their true labels. Similarity and unlabeling learning and similarity confidence learning protect privacy by training a binary classifier using only unlabeled instance pairs, where annotation is based on similarity rather than explicit labels, preventing the leakage of sensitive labels.

[0004] While these weakly supervised learning methods can protect sensitive information during the label collection phase, they hide all labels for each instance, regardless of whether the labels contain sensitive information. Therefore, due to the complete lack of precisely labeled data, these methods increase the difficulty of training the classifier. Furthermore, in the real world, the label space typically contains multiple sensitive labels. Therefore, researching and developing a method to hide multiple sensitive labels during the label collection phase, which can both protect sensitive labels and provide supervisory information for insensitive labels, is of great significance. Summary of the Invention

[0005] Purpose of the invention: In order to overcome the shortcomings of the existing technology, the present invention provides a method for constructing a training sample dataset with privacy protection and a multi-classifier. The method has low evaluation cost, is easy to popularize, has accurate evaluation and is convenient to use.

[0006] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0007] A privacy-preserving method for constructing training sample datasets, based on real-label training sample datasets. Constructing a hidden label training sample dataset Includes the following steps:

[0008] S1: Constructing the tag space in: This represents the m-th non-sensitive tag, where m = 1, 2, ..., M, and M is the number of non-sensitive tags; cl n This represents the nth sensitive tag, where n = 1, 2, ..., N, and N is the number of sensitive tags;

[0009] S2: Construct a dataset of real-label training samples in the label space Y. x i Let y represent the i-th training sample. i Indicates training sample x i Authentic labels, y i ∈Y, i=1,2,…,Q, where Q represents the total number of training samples;

[0010] S3: Divide the tag space v into N hidden tag groups {G1, G2, ..., G...} N}, Hide tag group G n Contains a sensitive label cl n And a by M n A set of non-sensitive tags consisting of randomly assigned non-sensitive tags Then there is Where: M n >0,

[0011] S4: For each pair of training sample data with real labels (x i y i Perform the following operations:

[0012] (1) Determine the true label y i The hidden tag group to which it belongs is denoted as G. i Hide tag group G i The set of non-sensitive tags in the data is denoted as ICG. i Hide tag group G i Sensitive tags in the cl i;

[0013] (2) From the hidden tag group G i Random sampling A set of non-sensitive tags. From the non-sensitive tag set ICG i Obtained by random sampling;

[0014] (3) Determine the true label y i Is it included in the set? If (i.e., from the non-sensitive tag set ICG) i Medium sample set At that time, the training sample x was hit. i Real Labels i If the training sample x is then... i Hidden tags i Set to the true label y i , that is s i =y i ;like (i.e., from the non-sensitive tag set ICG) i Medium sample set When, the training sample x was not hit. i Real Labels i If so, first set the sensitive tag cl i Marked as a sensitive label c i Then the training sample x i Hidden tags i Set to c i , that is s i =c i ;

[0015] (4) Transfer the training sample x i and hidden tags i Combined into hidden label training sample data pairs (x i s i ), and add it to the hidden label training sample dataset {(x i s i )}middle;

[0016] S5: Repeat step S4 until all training samples have hidden label training sample data pairs, resulting in a complete hidden label training sample dataset. All hidden labels constitute a multi-hidden label space S = {s1, s2, ..., s} i ,…,s Q}

[0017] In existing technologies, multi-label learning or classification training generally uses real-label training sample datasets directly. However, the label space used in these datasets does not distinguish between sensitive and non-sensitive labels, meaning the real labels corresponding to the training samples may be sensitive labels involving user privacy. During training, real labels are directly used for supervision information, which can lead to the risk of sensitive labels being exposed during data sharing and model release, potentially causing user privacy leaks. Due to the lack of effective label-level privacy protection mechanisms, models obtained through existing training methods will have the ability to infer sensitive labels. Therefore, effectively hiding sensitive labels in multi-label classification tasks using technical means is an urgent technical problem to be solved. To solve this problem, this invention first classifies sensitive and non-sensitive labels in the initial design of the label space. Then, it mixes sensitive and non-sensitive labels through grouping design. Next, it maps real labels to hidden labels within the hidden label training sample data pairs, making it impossible for the outside to directly identify the true category (sensitive or non-sensitive label) of the training samples. Finally, it constructs a multi-hidden label space, thereby achieving the goal of hiding sensitive labels during the training phase, effectively improving the privacy protection capability of data use, and taking into account model performance.

[0018] A privacy-preserving multi-classifier is proposed, which uses a hidden-label training sample dataset constructed based on the aforementioned method. Multi-classifier training is performed, and during the training phase, hidden labels s are used. i Replace real label y i This achieves privacy protection for sensitive labels; training based on a multi-hidden label space S can balance label privacy and classification accuracy, effectively protecting sensitive information and ultimately improving classification performance.

[0019] Specifically, the multi-classifier is a linear classifier, and the training sample x i First, a pre-trained visual encoder extracts image feature vectors, then a linear classifier performs multi-class prediction to obtain training samples x. i The probability distribution belongs to the multi-hidden label space S (training phase) or the label space Y (testing phase); the visual encoder adopts the ViT-L / 14 architecture in the CLIP model (Contrastive Language-Image Pretraining) with frozen parameters.

[0020] Specifically, the training sample x i After undergoing a standardization preprocessing step to obtain an input that meets the requirements of the visual encoder, the image feature vector is then input into the pre-trained visual encoder to extract the feature vector. The standardization preprocessing step includes size adjustment, pixel normalization, and channel normalization.

[0021] Specifically, the classifier uses a linear classification layer to learn the probability distribution of hidden labels. While keeping the parameters frozen, the CLIP ViT-L / 14 visual encoder is used for feature extraction, and a linear classification layer is used to learn the probability distribution of hidden labels. This structure is simple to design and has strong generalization ability, which helps to improve the robustness of multi-class classification across datasets. It can not only improve the learning efficiency of feature extraction, but also reduce the risk of overfitting, ensuring robust multi-class classification performance across different datasets.

[0022] Specifically, the multi-classifier is based on the total classification risk R. MCL Conduct supervised training:

[0023]

[0024] Where: f(x) i ) represents the training sample x i The predicted label obtained by the multi-classifier, l[·] represents the classification loss function;

[0025] The expectation function E in the first term on the right side of the equation represents the value of the sample set. Hit the true tag y i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and non-sensitive tags i Expected training loss between; Indicates hidden tag group G i The total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included;

[0026] The expected function E of the second term on the right-hand side of the equation represents the value of the sample set. No true label was hit. i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and sensitive labels c i Expected training loss between;

[0027] The expected function E of the third term on the right-hand side of the equation represents the value of the sample set. No true label was hit. i In the case of "", for the true label y j Training samples x with non-sensitive labels j The predicted label f(x) of a statistical multi-classifier j ) and sensitive labels j The expected training loss between sensitive labels; Indicates hidden tag group G jThe total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included.

[0028] Total Classification Risk R MCL The design is crucial. On the one hand, it ensures that sensitive labels are invisible in the training data, and on the other hand, it guarantees that non-sensitive labels are hidden with equal probability, so that the overall risk estimation is unbiased and can be formally expressed as a risk expression based on hidden labels.

[0029] Specifically, the total classification risk R MCL In the equation, the first and second terms on the right-hand side constitute the positive risk term R. + The third item constitutes a negative risk item R. - When a multi-classifier employs a more flexible model, the negative risk term R from the third term... - This could cause the overall loss to tend towards a negative value, potentially leading to overfitting; therefore, the training process of the multi-classifier employs a two-step iterative optimization strategy to fully improve the positive risk term R. + and negative risk item R - The advantage is that the positive risk term R... + and negative risk item R - The optimization process is carried out simultaneously, but different learning rate and step size parameters are used to effectively avoid the negative risk term R. - This addresses the overfitting problem caused by the dominant factor, thereby improving the stability and classification accuracy of the multi-classifier.

[0030] Specifically, designing an effective loss function l[·] is crucial for learning hidden labels. In this invention, the loss function l[·] of the multi-classifier adopts a loss function based on a one-to-many strategy, which is renowned for its strong theoretical foundation and powerful performance in multi-class classification. This case uses the squared loss function φ(z)=(1-z). 2 It enables flexible optimization for binary tasks.

[0031] Specifically, the multi-classifier, during the training phase, uses a training sample dataset with hidden labels. Multi-classifier training is performed by updating the parameters of the multi-classifier by minimizing the loss function constructed based on the multi-hidden label space S, thus completing the training without directly using the real labels. In the testing phase, the test samples to be classified are used as input, and the trained multi-classifier outputs the prediction results corresponding to the real labels, achieving a balance between hiding and protecting sensitive information and accurate classification.

[0032] Specifically, the multi-classifier includes a data preprocessing and feature extraction module, an unbiased risk estimation module, and a two-step optimization module;

[0033] The data preprocessing and feature extraction module receives the original sample set and the corresponding hidden label set, and performs standardized preprocessing, including data cleaning and structuring, on the original sample set and the hidden label set to obtain the training sample set. and corresponding hidden spaces Training samples x are extracted using a pre-trained visual encoder. i Image feature vectors;

[0034] The unbiased risk estimation module performs multi-class prediction using a linear classifier to obtain training sample x. i The predicted label f(x) in the hidden label space S i ), calculate training sample x i The classification loss value l[f(x) i ), s i ];

[0035] The two-step optimization module is based on the classification loss value l[f(x)] i ), s i The positive risk term R for constructing a linear classifier for multi-class prediction. + and negative risk item R - A two-step iterative optimization strategy is adopted, using different learning rates and step size parameters to simultaneously optimize the positive risk term R. + and negative risk item R - Ultimately, this leads to the positive risk term R. + Negative risk item R - The sum tends to the expected value; this scheme allows the gradients of two risks to be calculated and backpropagated within the same training step, but controls their relative impact on the update of multi-classifier parameters by different learning rates, thus achieving a more balanced and stable training process.

[0036] Beneficial Effects: The privacy-preserving training sample dataset construction method and multi-classifier provided in this invention have the following advantages compared to existing technologies: 1. While existing weakly supervised learning methods can protect sensitive information to a certain extent during the label collection stage, they often adopt a strategy of completely hiding all labels, resulting in the model being unable to obtain accurately labeled data during training, thus increasing the difficulty of classifier training. This invention introduces a multi-hidden label mechanism, which effectively hides multiple sensitive labels while still providing explicit supervision information for some non-sensitive labels, balancing privacy protection and model learnability; 2. This invention addresses the practical need of multiple sensitive categories often existing in the label space of the real world, and designs a multi-hidden construction strategy that can hide multiple sensitive labels simultaneously, improving the applicability and scalability of the method in structures containing multiple sensitive information. Attached Figure Description

[0037] Figure 1 The structural block diagram of the privacy-protected multi-classifier provided by this invention;

[0038] Figure 2 A flowchart illustrating the privacy-preserving training sample dataset construction method provided by this invention. Detailed Implementation

[0039] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0040] This study aims to provide a sensitive label hiding method for multi-label classification tasks. During the sample labeling stage, sensitive and non-sensitive labels are distinguished. A grouping design and sampling mechanism are introduced when constructing the training sample dataset to hide sensitive labels, thus avoiding direct exposure of sensitive labels during multi-classifier training and improving the privacy protection of training data. Furthermore, based on machine learning theory, a total classification risk loss function is constructed for the designed hidden labels, enabling the multi-classifier to achieve supervision performance comparable to that of the true labels using only the hidden labels. Theoretical analysis shows that this total classification risk loss is an unbiased estimate of the original risk, ensuring no bias is introduced during multi-classifier training. Therefore, even with hidden labels, the multi-classifier can still achieve predictive performance similar to that of a typical strongly supervised model.

[0041] like Figure 1 The diagram shown illustrates the structure of the multi-classifier designed in this case, including a data preprocessing and feature extraction module, an unbiased risk estimation module, and a two-step optimization module. The data preprocessing and feature extraction module receives the original sample set and its corresponding hidden label set, and performs standardized preprocessing, including data cleaning and structuring, on the original sample set and hidden label set to obtain the training sample set. and corresponding hidden spaces Simultaneously, training samples x are extracted using a pre-trained visual encoder. i The image feature vector. The unbiased risk estimation module performs multi-class prediction using a linear classifier to obtain the training sample x. i The predicted label f(x) in the hidden label space S i ), calculate training sample x i The classification loss value l[f(x) i ), s i The two-step optimization module is based on the classification loss value l[f(x)]. i ), s i The positive risk term R for constructing a linear classifier for multi-class prediction. + and negative risk item R -A two-step iterative optimization strategy is adopted, using different learning rates and step size parameters to simultaneously optimize the positive risk term R. + and negative risk item R - Ultimately, this leads to the positive risk term R. + Negative risk item R - The sum tends to the expected value.

[0042] The invention will be further explained below with reference to the complete construction process of the multi-classifier.

[0043] PART 1: Constructing the Hidden Label Training Sample Dataset

[0044] Training sample dataset based on real labels Construct a privacy-preserving hidden-label training sample dataset Includes the following steps:

[0045] S1: Constructing the tag space in: This represents the m-th non-sensitive tag, where m = 1, 2, ..., M, and M is the number of non-sensitive tags; cl n This represents the nth sensitive label, where n = 1, 2, ..., N, and N is the number of sensitive labels.

[0046] S2: Construct a dataset of real-label training samples in the label space Y. x i Let y represent the i-th training sample. i Indicates training sample x i Authentic labels, y i Let ∈Y, i = 1, 2, ..., Q, where Q represents the total number of training samples. In existing technologies, the training sample dataset with the actual labels is generally used directly. Multi-label learning or classification training is performed, but due to the true label y i It does not distinguish between sensitive and non-sensitive labels, which leads to the exposure of sensitive labels; how to avoid the exposure of sensitive labels is the problem that this invention needs to solve.

[0047] S3: Divide the tag space Y into N hidden tag groups {G1, G2, ..., G...} N}, Hide tag group G n Contains a sensitive label cl n And a by M n A set of non-sensitive tags consisting of randomly assigned non-sensitive tags Then there is Where: M n >0,

[0048] S4: For each pair of training sample data with real labels (xi y i Perform the following operations:

[0049] (1) Determine the true label y i The hidden tag group to which it belongs is denoted as G. i Hide tag group G i The set of non-sensitive tags in the data is denoted as ICG. i The sensitive tags in the hidden tag group Gi are denoted as cl. i .

[0050] (2) From the hidden tag group G i Random sampling A set of non-sensitive tags. From the non-sensitive tag set ICG i Obtained by random sampling.

[0051] (3) Determine the true label y i Is it included in the set? If (i.e., from the non-sensitive tag set ICG) i Medium sample set At that time, the training sample x was hit. i Real Labels i If the training sample x is then... i Hidden tags i Set to the true label y i , that is s i =y i ;like (i.e., from the non-sensitive tag set ICG) i Medium sample set When, the training sample x was not hit. i Real Labels i If so, first set the sensitive tag cl i Marked as a sensitive label c i Then the training sample x i Hidden tags i Set to c i , that is s i =c i .

[0052] (4) Transfer the training sample x i and hidden tags i Combined into hidden label training sample data pairs (x i s i ), and add it to the hidden label training sample dataset {(x i s i )}middle.

[0053] S5: Repeat step S4 until all training samples have hidden label training sample data pairs, resulting in a complete hidden label training sample dataset. All hidden labels constitute a multi-hidden label space S = {s1, s2, ..., s} i ,…,s Q}

[0054] The hidden label training sample dataset designed in this case can balance label privacy and classification accuracy, effectively protect sensitive information, and ultimately improve classification performance; specifically, it can be divided into the following three cases:

[0055] ①If the true label y i The label is non-sensitive and the actual label is y. i Sampled into set In the middle, the tag s is hidden. i Set to the true label y i The hidden tag s at this time i Non-sensitive tags, sensitive tags cl i Not marked as a sensitive label c i ; means: if y i ∈ICG i and Then s i =y i s i ≠cl i ,

[0056] ②If the true label y i This is a non-sensitive label, but if the real label y i No sampled set In the middle, the hidden tag s will be... i Set as a sensitive label cl i Meanwhile, the sensitive label cl i Marked as a sensitive label c i ; means: if y i ∈ICG i and Then s i ≠y i c i =cl i s i =c i .

[0057] ③If the true label y i Sensitive labels, also known as sensitive labels cl i Therefore, it is completely impossible for it to be sampled into the set. In the middle, the hidden tag s i Set as a sensitive label cl i Meanwhile, the sensitive label cl i Marked as a sensitive label c i ; indicates: if So s i =y i c i =cl i s i =c i .

[0058] In summary, if the true labels of all training samples cover all sensitive labels in the label space Y, then all sensitive labels cl in the label space Y... i All will become hidden tags s in the multiple hidden tag space S. i and marked as a sensitive label c i Simultaneously, some non-sensitive tags in tag space Y will also become hidden tags s in the multiple hidden tag space S. i However, it was not marked as a sensitive tag c. i (Scenario ①)

[0059] This mechanism enables obfuscation protection for sensitive samples (training samples with sensitive real labels) and non-sensitive samples (training samples with non-sensitive real labels). Sensitive samples are not directly exposed in the multi-hidden label space S, thus enhancing privacy and security. Simultaneously, in the multi-hidden label space S, if the real label y... i If it is a sensitive label, then the training sample x i Hidden tags i It is certain that it is marked as a sensitive label c. i Sensitive tags cl i Additionally, if the true label y i If the label is non-sensitive, then the training sample x i Hidden tags i It's uncertain; it's either the true label y or... i (at this time ), or sensitive tags cl i (at this time c) i =cl i It cannot be the non-sensitive tag set ICG. i Other non-sensitive tags in the ICG. Therefore, for all tags in the non-sensitive tag set ICG... i The non-sensitive labels in the training samples are the real labels, and are labeled as sensitive labels c in the multi-hidden label space S. iThe probabilities are equal, meaning that the probability of a non-sensitive sample in label space Y being mapped to a sensitive sample in multiple hidden label space S is equal. Therefore, this mechanism can represent the unknown conditional probability in fully supervised risk, thereby enabling the unbiased risk to be re-expressed based on the hidden labels. While protecting sensitive labels, it achieves an unbiased estimate of classification risk and ensures the uniformity of hidden label sampling.

[0060] PART 2: Building a Privacy-Preserving Multi-Classifier

[0061] The multi-classifier is a linear classifier, employing the CLIP ViT-L / 14 architecture, and using the hidden label training sample dataset constructed in Part 1. Training is performed; during training, the CLIP ViT-L / 14 visual encoder with frozen parameters is first used to train the training samples x. i Feature extraction is performed, and then a linear classification layer is used to learn the probability distribution of the hidden labels to obtain the training samples x. i The probability distribution belonging to the multi-hidden label space S (during training). During training, the hidden labels s are used. i Replace real label y i This approach can protect the privacy of sensitive labels; training based on a multi-hidden label space S can balance label privacy and classification accuracy, effectively protecting sensitive information and ultimately improving classification performance.

[0062] Training sample x i Before being input into the visual encoder, the image needs to undergo standardization preprocessing such as size adjustment, pixel normalization, and channel normalization to obtain an input that meets the requirements of the visual encoder. Then, the image is input into the pre-trained visual encoder to extract the image feature vector.

[0063] PART 3: Constructing the Overall Classification Risk Loss Function

[0064] The multi-classifier is based on the total classification risk R. MCL Conduct supervised training:

[0065]

[0066] Where: f(x) i ) represents the training sample x i The predicted label obtained by the multi-classifier, l[·] represents the classification loss function;

[0067] The first term on the right side of the equals sign This indicates that in the "sample set" Hit the true tag y i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and non-sensitive tagsi Expected training loss between; Indicates hidden tag group G i The total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included.

[0068] The second term on the right side of the equals sign This indicates that in the "sample set" No true label was hit. i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and sensitive labels c i The expected training loss between them.

[0069] The third term on the right side of the equals sign This indicates that in the "sample set" No true label was hit. i In the case of "", for the true label y j Training samples x with non-sensitive labels j The predicted label f(x) of a statistical multi-classifier j ) and sensitive labels j The expected training loss between sensitive labels; Indicates hidden tag group G j The total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included.

[0070] PART 4: Optimizing the Multi-Classifier Using a Two-Step Iterative Optimization Strategy

[0071] The total classification risk R MCL In the equation, the first and second terms on the right-hand side constitute the positive risk term R. + The third item constitutes a negative risk item R. - When a multi-classifier employs a more flexible model, the negative risk term R from the third term... - This could cause the overall loss to tend towards a negative value, potentially leading to overfitting; therefore, the training process of the multi-classifier employs a two-step iterative optimization strategy to fully improve the positive risk term R. + and negative risk item R - The advantage is that the positive risk term R... + and negative risk item R - The optimization process is carried out simultaneously, but different learning rate and step size parameters are used to effectively avoid the negative risk term R. - This addresses the overfitting problem caused by the dominant factor, thereby improving the stability and classification accuracy of the multi-classifier.

[0072] Training sample dataset using hidden labels Multi-classifier training is performed by updating the parameters of the multi-classifier by minimizing the loss function constructed based on the multi-hidden label space S, thus completing the training without directly using the real labels. In the testing phase, the test samples to be classified are used as input, and the trained multi-classifier outputs the prediction results corresponding to the real labels, achieving a balance between hiding and protecting sensitive information and accurate classification.

[0073] Part 5: Hardware Configuration and Performance Testing

[0074] The hardware environment used in this case is an NVIDIA 4090D GPU, a CPU model of 18vCPU AMD EPYC 9754128-Core Processor, an operating system of Ubuntu 20.04 and CUDA 11.3, and software versions of Python 3.8 and PyTorch 1.11.0.

[0075] The effectiveness of the proposed method (MCL method) was validated using three standard image datasets (MNIST, Fashion-MNIST, and CIFAR-10), three real-world image datasets (MCLMP and MCLSD), and two text datasets (SearchSnippets and TREC).

[0076] Specifically, MNIST consists of grayscale images of handwritten digits (0 to 9), comprising 10 classes, 60,000 training images and 10,000 test images, with a size of 28×28×1. Fashion-MNIST consists of grayscale images of clothing items (such as T-shirts, shoes, bags, etc.) from Zalando, comprising 10 classes, 60,000 training images and 10,000 test images, with a size of 28×28×1. CIFAR-10 consists of color images of everyday objects, comprising 10 classes, 50,000 training images and 10,000 test images, with a size of 32×32×3. SearchSnippets consists of short text snippets returned by search engines, covering eight semantic categories, including 10,060 training samples and 2,280 test samples. TREC is a classic question classification dataset, divided into six question types, including 5,452 training samples and 500 test samples.

[0077] This case uses accuracy to evaluate the classification performance of a pre-trained multi-classifier.

[0078] Table 1. Accuracy of different methods on different image datasets

[0079] Methods Number of sensitive categories MNIST Fashion-MNIST CIFAR-10 MCLMP MCLSD PAPI 1 89.78 48.17 69.68 52.32 42.99 SPMI 1 74.46 46.47 40.37 51.27 42.62 DIRK 1 63.84 38.42 57.89 58.23 32.24 CLF 1 87.77 79.72 80.42 75.74 75.23 MCL (Ours) 1 96.30 86.08 85.87 83.76 80.33 PAPI 2 87.82 46.10 70.87 46.20 38.07 SPMI 2 71.24 44.67 43.83 49.58 40.80 DIRK 2 62.67 39.24 61.59 54.85 39.71 CLF 2 87.28 80.38 78.58 76.58 69.21 MCL (Ours) 2 96.35 86.85 86.27 85.02 84.70

[0080] Table 2. Accuracy of different methods on text datasets

[0081]

[0082]

[0083] Tables 1 and 2 compare the accuracy of linear classifiers trained using other privacy-labeling learning methods (PAPI, SPMI, DIRK, and CLF) with those trained using the MCL method on different datasets. The results show that the MCL method consistently achieves the highest accuracy across all settings, demonstrating its effectiveness and robustness in scenarios with multiple hidden labels. The results on text datasets also demonstrate the superior performance of our proposed method, consistent with the results observed on visual datasets, further validating its advantage in hiding multiple sensitive labels. This highlights the adaptability and robustness of our proposed method in both visual and text domains.

[0084] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the above embodiments do not limit the present invention in any way, and all technical solutions obtained by equivalent substitution or equivalent transformation fall within the protection scope of the present invention.

Claims

1. A method for constructing a privacy-preserving training sample dataset, characterized in that: Training sample dataset based on real labels Constructing a hidden label training sample dataset Includes the following steps: S1: Constructing the tag space in: This represents the m-th non-sensitive tag, where m = 1, 2, ..., M, and M is the number of non-sensitive tags; cl n This represents the nth sensitive tag, where n = 1, 2, ..., N, and N is the number of sensitive tags; S2: Construct a dataset of real-label training samples in the label space Y. x i Let y represent the i-th training sample. i Indicates training sample x i Authentic labels, y i ∈Y, i=1,2,…,Q, where Q represents the total number of training samples; S3: Divide the tag space Y into N hidden tag groups {G1, G2, ..., G...} N }, Hide tag group G n Contains a sensitive label cl n And a by M n A set of non-sensitive tags consisting of randomly assigned non-sensitive tags Then there is Where: M n >0, S4: For each pair of training sample data with real labels (x i y i Perform the following operations: (1) Determine the true label y i The hidden tag group to which it belongs is denoted as G. i Hide tag group G i The set of non-sensitive tags in the data is denoted as ICG. i Hide tag group G i Sensitive tags in the cl i ; (2) From the hidden tag group G i Random sampling A set of non-sensitive tags. (3) Determine the true label y i Is it included in the set? If Then the training sample x i Hidden tags i Set to the true label y i , that is s i =y i ;like First, set the sensitive tag cl i Marked as a sensitive label c i Then the training sample x i Hidden tags i Set to c i , that is s i =c i ; (4) Transfer the training sample x i and hidden tags i Combined into hidden label training sample data pairs (x i s i ), and add it to the hidden label training sample dataset {(x i s i )}middle; S5: Repeat step S4 until all training samples have hidden label training sample data pairs, resulting in a complete hidden label training sample dataset. All hidden labels constitute a multi-hidden label space S = {s1, s2, ..., s} i , ..., s Q } 2. A privacy-preserving multi-classifier, characterized in that: The hidden label training sample dataset constructed using claim 1 Train a multi-classifier.

3. The privacy-preserving multi-classifier according to claim 2, characterized in that: The multi-classifier is a linear classifier, with training sample x. i First, a pre-trained visual encoder extracts image feature vectors, then a linear classifier performs multi-class prediction to obtain training samples x. i The probability distribution belonging to the multiple hidden label space S or the label space Y; the visual encoder adopts the ViT-L / 14 architecture in the CLIP model.

4. The privacy-preserving multi-classifier according to claim 3, characterized in that: The training sample x i After undergoing a standardization preprocessing step to obtain an input that meets the requirements of the visual encoder, the image feature vector is then input into the pre-trained visual encoder to extract the feature vector. The standardization preprocessing step includes size adjustment, pixel normalization, and channel normalization.

5. The privacy-preserving multi-classifier according to claim 3, characterized in that: The classifier uses a linear classification layer to learn the probability distribution of the hidden labels.

6. The privacy-preserving multi-classifier according to claim 2, characterized in that: The multi-classifier is based on the total classification risk R. MCL Conduct supervised training: Where: f(x) i ) represents the training sample x i The predicted label obtained by the multi-classifier, l[·] represents the classification loss function; The first term on the right side of the equals sign indicates that in the "sample set" Hit the true tag y i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and non-sensitive tags i Expected training loss between; Indicates hidden tag group G i The total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included; The second term on the right side of the equals sign indicates that in the "sample set" No true label was hit. i In the case of "", the predicted label f(x) of the statistical multi-classifier i ) and sensitive labels c i Expected training loss between; The third term on the right side of the equals sign indicates that in the "sample set" No true label was hit. i In the case of "", for the true label y j Training samples x with non-sensitive labels j The predicted label f(x) of a statistical multi-classifier j ) and sensitive labels j The expected training loss between sensitive labels; Indicates hidden tag group G j The total number of categories of non-sensitive labels included; Represents a set The total number of non-sensitive tags included.

7. The privacy-preserving multi-classifier according to claim 6, characterized in that: The total classification risk R MCL In the equation, the first and second terms on the right-hand side constitute the positive risk term R. + The third item constitutes a negative risk item R. - The training process of the multi-classifier employs a two-step iterative optimization strategy, with the positive risk term R... + and negative risk item R - The optimization process is carried out simultaneously, but with different learning rate and step size parameters.

8. The privacy-preserving multi-classifier according to claim 6, characterized in that: The loss function l[·] of the multi-classifier adopts a squared loss function constructed based on a one-to-many strategy.

9. The privacy-preserving multi-classifier according to claim 2, characterized in that: The multi-classifier uses a hidden-label training sample dataset during the training phase. Multi-classifier training is performed by updating the parameters of the multi-classifier by minimizing the loss function constructed based on the multi-hidden label space S, thereby completing the training without directly using the real labels; During the testing phase, the test samples to be classified are used as input, and the pre-trained multi-classifier outputs the prediction results corresponding to the real labels, thus achieving a balance between hiding and protecting sensitive information and accurate classification.

10. The privacy-preserving multi-classifier according to claim 2, characterized in that: It includes a data preprocessing and feature extraction module, an unbiased risk estimation module, and a two-step optimization module; The data preprocessing and feature extraction module receives the original sample set and the corresponding hidden label set, and performs standardized preprocessing, including data cleaning and structuring, on the original sample set and the hidden label set to obtain the training sample set. and corresponding hidden spaces Training samples x are extracted using a pre-trained visual encoder. i Image feature vectors; The unbiased risk estimation module performs multi-class prediction using a linear classifier to obtain training sample x. i The predicted label f(x) in the hidden label space S i ), calculate training sample x i The classification loss value l[f(x) i ), s i ]; The two-step optimization module is based on the classification loss value l[f(x)] i ), s i The positive risk term R for constructing a linear classifier for multi-class prediction. + and negative risk item R - A two-step iterative optimization strategy is adopted, using different learning rates and step size parameters to simultaneously optimize the positive risk term R. + and negative risk item R - Ultimately, this leads to the positive risk term R. + Negative risk item R - The sum tends to the expected value.

Images