Dynamic data security protection method and device based on adversarial training under multi-modal large model

Abstract

The invention provides a dynamic data security protection method and device based on adversarial training under a multi-modal large model, and is applied to the field of data processing. According to the method, multi-modal basic data, intelligent algorithm model information and dynamic security protection requirements are acquired, cross-source mapping of data and model vulnerability detection points is established through security association processing, risks are marked, and target association data are generated; splitting target associated data, aligning network unified multi-modal features by means of hierarchical features, and establishing a high-risk data priority cache to obtain structured security analysis data; then, a targeted protection scheme is generated according to data-model-threat association mapping, and a dynamic defense optimization model is constructed in combination with a protection effect and real-time threat feedback; and finally, processing basic data and model information by using the model, and outputting multi-modal basic data dynamic security protection information in combination with protection requirements.

Description

Technical Field

[0001] This invention relates to the field of data processing, and in particular to a dynamic data security protection method and device based on adversarial training under a multimodal large model. Background Technology

[0002] Current technologies lack cross-source mapping between multimodal data features and vulnerability detection points in intelligent algorithm models. They only perform isolated security detection on the data itself (such as text privacy desensitization and image perturbation recognition), ignoring the correlation between data input and the vulnerabilities of model modules (input layer, feature extraction layer, and decision layer). For example, vulnerabilities in the model input layer that are not thoroughly desensitized, combined with undesensitized privacy fields in text data, can directly lead to privacy leaks. Similarly, the incomplete extraction of occlusion features by the ResNet submodule in the feature extraction layer, combined with occlusion perturbation data from device images, can result in missed detections of industrial faults. Because the causal link between "data threat → model vulnerability" cannot be located, existing protection solutions are mostly generalized designs, unable to precisely target the vulnerabilities of specific model modules, resulting in low protection efficiency.

[0003] Existing technologies focus on single threat types and are insufficient to address complex security risks across multiple scenarios. Limitations of adversarial attack defense: Current adversarial sample defenses are mostly aimed at single-modal data (such as image FGSM / PGD perturbation, text keyword tampering), and adopt the strategy of "static sample enhancement + fixed threshold detection". They cannot adapt to cross-modal collaborative attacks, and the defense parameters are not dynamically adjusted in combination with model vulnerability, resulting in the attack interception rate continuously decreasing as the threat evolves. Backdoor attack defense is lagging: For backdoor attacks on multimodal data (such as embedding "keyword → misclassification" backdoors in official documents and tampering with medical data tags), existing technologies mostly rely on "post-event log auditing" and lack the ability to detect and locate trigger conditions in real time. Once a backdoor is activated, it will affect the model output for a long time and cause serious business losses. Imbalance in privacy protection: Privacy protection technologies (such as differential privacy and encrypted transmission) are mostly "one-size-fits-all" and do not take into account the differences in the sensitivity of multimodal data (such as the different privacy levels of genetic information in medical data and routine physical examination text) and the privacy risk classification of model modules (such as the higher risk of privacy leakage at the input layer than at the decision layer). This results in insufficient protection of highly sensitive data or excessive protection of low-sensitivity data, making it difficult to balance protection efficiency and privacy protection. Summary of the Invention

[0004] According to one aspect of this application, a dynamic data security protection method based on adversarial training for multimodal large models is provided, comprising: acquiring multimodal basic data, intelligent algorithm model information, and dynamic security protection requirements; performing security association processing on the multimodal basic data and intelligent algorithm model information, establishing a cross-source association mapping between the multimodal basic data and vulnerability detection points of the algorithm model, adding an initial security risk label to each associated data, embedding a model vulnerability tracing module during the association processing, locating the core model module that needs optimization by analyzing the correlation between data threats and model modules, and generating target associated data; and decomposing the target associated data based on the structure of data type-model module-threat type-risk label, introducing a hierarchical feature alignment network to realize cross-modal data... The system features unified characteristics and establishes a priority processing and caching mechanism for high-risk threat-related data to generate structured security analysis data. For different types of multimodal basic data security threat detection needs, it generates targeted protection schemes based on the data-model-threat association mapping in the structured security analysis data. It processes the protection effectiveness and real-time threat feedback, designs a closed-loop training optimization mechanism, uses protection effectiveness indicators as loss function constraints for model training, updates the training sample library with real-time threat features, and iteratively adjusts model parameters through causal decoupling defense evolution technology to generate a dynamic defense optimization model. Based on the dynamic defense optimization model, it processes multimodal basic data and intelligent algorithm model information, and generates dynamic security protection information for multimodal basic data, combined with dynamic security protection needs.

[0005] Another aspect of this application is a dynamic data security protection device based on adversarial training under a multimodal large model, configured to execute a dynamic data security protection method based on adversarial training under a multimodal large model by executing the executable instructions.

[0006] According to another aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a second processor, implements the above-described dynamic data security protection method based on adversarial training under a multimodal large model.

[0007] This application provides a dynamic data security protection method and device based on adversarial training for multimodal large-scale models. Addressing the pain points of data security protection for multimodal large-scale models, it constructs a "data-model-threat" linked protection system. It comprehensively acquires multimodal basic data (text, images, audio), intelligent algorithm model information (architecture, parameters, vulnerability records), and dynamic protection requirements. Through deep feature extraction (integrating attention mechanisms and graph neural networks) and model vulnerability analysis, it establishes a cross-source association mapping between data features and model vulnerability detection points. After labeling risk levels, it generates target-related data, achieving precise binding of "data threat-model vulnerability." After splitting the target-related data, a hierarchical feature alignment network is introduced to overcome the problem of incompatibility in the feature dimensions and physical meanings of different modal data, achieving cross-modal feature space unification. Simultaneously, a high-risk data priority caching mechanism is established to quickly focus on key security risks and generate structured security analysis data, providing data support for precise protection.

[0008] Based on the "data-model-threat" correlation mapping in structured data, three targeted protection solutions are generated: adversarial attacks, backdoor attacks, and cross-domain management, covering core security threats across multiple scenarios. Combining protection effectiveness evaluation data with real-time threat feedback, a closed-loop training optimization model is constructed through a meta-learning-driven self-evolution mechanism and causal decoupling defense evolution technology. This dynamically updates the training sample library and model parameters, enabling rapid adaptation to new threats. Based on the dynamic defense optimization model, defense parameters, multimodal data, and algorithm modules are correlated. Combined with multi-industry compliance requirements and threat evolution patterns, dynamic security protection information is output, adaptable to multiple scenarios such as healthcare, industry, and government, ensuring flexibility and compliance in protection. This technology overcomes the limitations of single-modal defense, achieving dynamic threat response and multi-industry compliance adaptation, improving the accuracy and robustness of multimodal data protection.

[0009] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0010] Figure 1 The flowchart illustrates a dynamic data security protection method based on adversarial training in a multimodal large model according to an embodiment of this application. Figure 2 This illustration shows a schematic diagram of a dynamic data security protection device based on adversarial training under a multimodal large model, provided in an embodiment of this application. Detailed Implementation

[0011] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0012] The following is combined Figure 1 This application describes a dynamic data security protection method based on adversarial training for multimodal large models according to exemplary embodiments of the present application.

[0013] S101 acquires multimodal basic data, intelligent algorithm model information, and dynamic security protection requirements.

[0014] In one implementation, the multimodal foundational data encompasses various types such as text, images, and audio, covering raw data from different scenarios in open environments. It also includes information related to the data generation chain to ensure the integrity of data sources and characteristics, providing a foundation for subsequent secure association processing. The focus is on collecting structured and unstructured text data from various industry business scenarios. Structured text includes electronic medical record diagnostic records in the medical field (such as patient symptom descriptions and medication lists) and equipment operation logs in the industrial field (such as equipment numbers, operating parameters, and fault recording times). Unstructured text includes user comments in the internet field (containing potentially private information) and course handouts in the education field (containing copyright information and knowledge points). During the data collection process, it is necessary to record the generation time of the text data (accurate to the millisecond level), the terminal identifier of the data source (such as the terminal ID of the medical system, the number of the industrial equipment), and the business link to which the text data belongs (such as the diagnosis link in the medical record, the maintenance link in the equipment log). For example, from the electronic medical record system of a tertiary hospital, the electronic medical record text of a cardiology patient in a certain quarter of 2024 can be obtained. It includes the patient's basic information (de-sensitized), chief complaint symptoms, examination report conclusions, and medical orders. Each piece of text data is associated with the generation timestamp (such as 2024-05-12 14:30:25.123) and the generation terminal ID (HOSP-CARDIO-001).

[0015] This involves collecting image data containing sensitive information or vulnerable to attack. In the medical field, this includes medical images (such as CT scans and ultrasound images, including lesion annotations) and patient identification images (such as facial images collected during medical visits, which have undergone privacy protection preprocessing). In the industrial field, this includes equipment appearance inspection images (such as images of wear and tear on production line equipment parts and images of product quality defects) and factory security monitoring images (including personnel and equipment location information). When acquiring this data, it is necessary to record the image resolution, the parameters of the capturing equipment (such as the scan slice thickness of a medical CT scanner, and the pixel and exposure parameters of an industrial camera), and the image acquisition scene (such as the scanned area in a CT image or the shooting area in a monitoring image). For example, from the quality inspection system of a car manufacturing plant, images of the appearance inspection of a batch of car parts, including images of qualified and defective parts (such as cracks and deformations), should be recorded as follows: image resolution 2048×2048 pixels, capturing equipment an industrial camera (model IND-CAM-023), and the corresponding part number (such as CAR-PART-0789) and quality inspection station (QUALITY-STATION-05) should be labeled.

[0016] Collect audio data involving business interactions or sensitive information. In the medical field, this includes doctor-patient consultation recordings (including descriptions of symptoms and treatment suggestions) and remote consultation audio (content of multi-expert exchanges).

[0017] The intelligent algorithm model information comprehensively covers key dimensions such as model architecture, operating parameters, and historical performance, clearly defining the functions and potential vulnerabilities of each module, providing a basis for subsequent vulnerability detection point analysis and security correlation processing. It outlines the hierarchical structure and module composition of the intelligent algorithm model, including the types and functions of core modules such as the input layer, feature extraction layer, and decision layer, as well as the data transmission paths between modules. For example, in the medical field, a multimodal large-scale model for disease diagnosis supports multiple data input types in the input layer, including text (medical records), images (medical images), and audio (consultation recordings); the feature extraction layer includes a BERT pre-trained submodule for text (for semantic feature extraction), a ResNet submodule for images (for visual feature extraction), and an MFCC+CNN submodule for audio (for audio feature extraction); the decision layer uses a fully connected neural network to output disease diagnosis results and confidence levels. When obtaining the model, you need to specify the version of each sub-module (such as BERT-base-uncased, ResNet-50), the feature fusion method between modules (such as attention mechanism weighted fusion), and the overall model framework (such as TensorFlow / PyTorch implementation). You should also provide a model architecture diagram (labeling the name of each module and the input and output dimensions).

[0018] Collect key parameters for the model training and inference phases. The training phase includes batch size (e.g., 32), learning rate (initial learning rate 1e-4, using cosine annealing decay strategy), number of iterations (e.g., 100 rounds), loss function type (e.g., cross-entropy loss function, for multi-class tasks), and optimizer (e.g., AdamW optimizer, weight decay coefficient 0.01). The inference phase includes inference latency threshold (e.g., inference time for medical diagnostic models must be ≤5 seconds), concurrent processing capability, and input data format requirements (e.g., text must be converted to tokenID sequence, and images must be normalized to the [0,1] interval). In addition, it is necessary to obtain the versions of the third-party libraries that the model depends on (such as PyTorch 2.0, TensorFlow 2.10) and the hardware deployment environment parameters (such as GPU model NVIDIA A100, memory capacity 128GB). For example, for a fault diagnosis model of industrial equipment, the batch size is set to 64 during training, the initial learning rate is 5e-5, the iteration is 80 rounds, the FocalLoss loss function is used (to solve the sample imbalance problem), the inference supports 500 concurrent requests, the input image needs to be resized to 224×224 pixels and standardized, and it depends on PyTorch 1.13 and scikit-learn 1.2.2 libraries.

[0019] Collect vulnerability events that occurred during past model runs, including vulnerability types (e.g., adversarial attack vulnerabilities, backdoor attack vulnerabilities), vulnerability triggering conditions (e.g., inputting images with specific perturbations causing model misjudgment, implanting specific labeled data triggering backdoor activation), vulnerability impact scope (e.g., affecting only the inference results of a certain type of image data, causing privacy information leakage for all types of data), and vulnerability remediation measures (e.g., updating feature extraction module parameters, adding adversarial training samples). Obtain recent model running logs, including the number of daily inferences, inference accuracy (e.g., a medical diagnostic model performs 2000 inferences per day with an accuracy of 92.5%), abnormal inference records (e.g., a sudden 5% increase in the model's misjudgment rate for a specific type of CT image within a certain period), and resource usage (e.g., peak GPU utilization of 85% and memory usage of 60GB). For example, a certain Internet user behavior recognition model once had an adversarial attack vulnerability: when user behavior images with slight perturbations added to the input (such as clicking on a screenshot of the interface), the model's false judgment rate increased from 5% to 35%. The fix was to add 10,000 adversarial samples for adversarial training. Recent operation logs show that it performs 5,000 inferences per day with an average accuracy of 88%, and about 3 abnormal inferences per week (mostly caused by low-resolution image input).

[0020] Dynamic security protection requirements need to be combined with the threat characteristics of the open environment and the compliance requirements of various industries, clarifying the protection objectives, performance indicators and adaptation rules under different scenarios, so as to provide direction for the subsequent generation of targeted protection solutions. This includes clearly defining the types of adversarial attacks to be defended against (such as text perturbation attacks, image steganography attacks, and audio tampering attacks), attack protection performance indicators (such as adversarial sample interception rate ≥95%, model accuracy loss under adversarial attacks ≤5%), and protection scenario adaptation requirements. In the medical field, the focus should be on defending against adversarial attacks targeting medical images (such as adding perturbations leading to misdiagnosis of lesions), requiring an adversarial sample interception rate of ≥98%, a model diagnostic accuracy loss of ≤3%, and adaptability to attack protection for different modalities of medical images (CT, MRI, ultrasound). In the industrial field, defense against adversarial attacks targeting equipment inspection images (such as image perturbation leading to missed fault detection) is required, with an interception rate of ≥96%, an accuracy loss of ≤4%, and support for rapid protection of real-time production line images (processing latency ≤1 second). In the internet field, defense against adversarial attacks targeting user images and text is required (such as perturbating user avatars leading to misidentification, and tampering with text comments leading to sentiment misjudgment), with an interception rate of ≥94%, an accuracy loss of ≤6%, and adaptability to high-concurrency user data processing scenarios. For example, the adversarial attack defense requirements for a certain medical image diagnostic model are: resisting FGSM and PGD adversarial attacks targeting chest CT images, with an interception rate of ≥97%, a model diagnostic accuracy decrease of no more than 2% for normal CT images, and support for parallel protection processing of 32 CT images in a single batch, with a processing time of ≤3 seconds.

[0021] Determine the scope of protection against backdoor attacks (such as label tampering backdoors during the data collection stage and malicious parameter implantation backdoors during the model training stage), backdoor detection and blocking indicators (such as backdoor trigger behavior recognition rate ≥98% and backdoor blocking response time ≤0.5 seconds), and industry adaptation rules.

[0022] Clearly define the security control objectives for cross-domain data transmission (such as patient data sharing between medical institutions and business data interaction between government and enterprises) and storage (such as cross-regional data center storage and collaborative storage between edge nodes and the cloud), including data encryption requirements (such as transmission encryption algorithms and storage encryption strength), privacy protection indicators (such as the risk of re-identification after data anonymization ≤ 0.1%), and cross-domain traceability rules. In the medical field, cross-domain data (such as patient medical records and medical images) must use end-to-end encrypted transmission (such as the SM4 algorithm). High-sensitivity data (such as genetic data) must use SM9 searchable encryption during storage. Privacy protection must comply with the protection requirements for medical and health information under the Personal Information Protection Law. Cross-domain transmission must record data flow nodes (such as transmission from Hospital A to Research Institute B, recording the transmission time and the institutions involved). In the industrial field, cross-domain data (such as equipment operation data and production plan data) must use TLS 1.3 encryption for transmission and partitioned encryption during storage (AES-256 encryption for high-sensitivity data and AES-128 encryption for low-sensitivity data). Cross-domain transmission must support blockchain traceability (recording data modification and transmission records). For example, a regional medical consortium has the following cross-domain data security management requirements: patient medical record data is transmitted between different hospitals using the SM4 symmetric encryption algorithm, highly sensitive data (such as HIV diagnosis records) is stored using SM9 searchable encryption, the risk of re-identification after data anonymization is ≤0.05%, cross-domain transmission is carried out through a dedicated medical administration channel, and each data transfer record is uploaded to the blockchain (consortium blockchain) to support traceability query (such as querying the time and operator of a patient's medical record being transmitted from hospital A to hospital B).

[0023] S102 performs security association processing on multimodal basic data and intelligent algorithm model information, establishes cross-source association mapping between multimodal basic data and algorithm model vulnerability detection points, adds initial security risk labels to each associated data, embeds a model vulnerability tracing module during the association processing, locates the core model modules that need to be optimized by analyzing the correlation between data threats and model modules, and generates target associated data.

[0024] In one implementation, feature extraction and threat feature identification are performed on multimodal basic data. A deep feature extraction network integrating attention mechanisms and graph neural networks is used to automatically extract adversarial perturbation features, privacy-sensitive features, and abnormal data features from text, image, and audio data, generating information on the association between multimodal basic data features and threat types. Taking electronic medical record text in the medical field as an example, the text semantics are first encoded using a BERT pre-trained model, and then an attention mechanism is introduced to focus on key information (such as "lesion location: right lower lobe" and "medication: paclitaxel"), highlighting privacy-sensitive fields and expressions related to potential threats. Subsequently, a text entity relationship graph is constructed using a graph neural network (entities include "patient ID", "diagnosis result", and "medication name", and relationships include "diagnosis-medication" and "patient-examination"), automatically extracting three types of features: first, adversarial perturbation features, such as maliciously replaced keywords in the text (changing "benign nodule" to "malignant tumor"). The text data is analyzed for several reasons: 1) grammatical and logically incorrect statements (e.g., "The patient had no cough symptoms but was diagnosed with pneumonia"); 2) privacy-sensitive features, such as the patient's ID number (110101********1234), home address (XX Street, Chaoyang District, Beijing), and gene testing results (BRCA1 gene mutation); 3) abnormal data features, such as logical contradictions between "admission time" and "examination time" in the same medical record (admission time 2024-05-10, examination time 2024-05-09), and conflicts between diagnosis results and examination report conclusions (CT scan showed no lesions but the diagnosis was lung cancer). Finally, the text data features are associated with threat types, such as "Text feature: keyword 'malignant tumor' replacement perturbation; Threat type: adversarial attack (text tampering)" and "Text feature: un-anonymized ID number; Threat type: privacy leakage."

[0025] Taking the appearance inspection images of equipment in the industrial field as an example, the visual features of the image (such as the edge contours of parts, surface textures, and color distribution) are first extracted using a ResNet-50 network. Then, an attention mechanism is used to locate vulnerable areas (such as bearing wear parts and circuit board solder joints). The image pixel features are associated with the physical components of the equipment using a graph neural network (such as "pixel region A - bearing outer ring" and "pixel region B - gear tooth surface"). Three types of features are extracted: First, adversarial features, such as tiny noise blocks added to the image (pixel perturbations that are invisible to the naked eye but cause the model to misjudge) and malicious occlusion of local areas (occluding the bearing crack area); second, privacy-sensitive features, such as the equipment serial number (SN-IND-00123) and factory location marker (workshop 3 of XX factory) contained in the image; and third, abnormal data features, such as abnormal component size ratios (gear tooth pitch suddenly increases by 20%) and color abrupt changes (metal surface changes from silver to red without rust marks) in images of the same equipment taken at different times. Generate image data features and threat type association information, such as "Image features: bearing crack area occlusion disturbance; threat type: adversarial attack (image steganography)" and "Image features: device serial number is clearly visible; threat type: privacy leakage".

[0026] Vulnerability detection points are analyzed in intelligent algorithm models to extract model architecture, parameter configuration, and historical vulnerability records, generating a mapping table of algorithm model vulnerability detection points and modules, as well as vulnerability risk level information. Taking a multimodal disease diagnosis model in the medical field as an example, the model architecture includes four core modules: input layer, feature extraction layer, feature fusion layer, and decision layer. The input layer supports text (medical records), images (CT scans), and audio (consultation recordings). Vulnerability detection points include "lack of multimodal data input format verification" (vulnerable to malicious format data attacks) and "incomplete input data anonymization" (privacy leakage risk), both of which are high-risk detection points. The feature extraction layer includes a text BERT submodule, an image ResNet submodule, and an audio MFCC+CNN submodule. Detection points include "weak robustness of the BERT submodule to text perturbations" (vulnerable to adversarial attacks) and "incomplete feature extraction of low-resolution images by the ResNet submodule" (leading to missed detections). The former is high-risk, and the latter is medium-risk. The feature fusion layer uses attention-weighted fusion. Detection points include "static fusion weight update mechanism" (unable to adapt to dynamic data) and "lack of multimodal feature conflict handling logic" (model misjudgment when features contradict each other), both of which are medium-risk. The decision layer is a fully connected neural network. Detection points include "insufficient interpretability of output results" (unable to trace the cause of misjudgment) and "abnormal output threshold not dynamically adjusted" (weak ability to adapt to threats). The former is low-risk, and the latter is medium-risk. Generate a mapping table of detection points and modules, such as "Detection point: Input data desensitization is incomplete; Module: Input layer; Risk level: High" and "Detection point: BERT submodule has weak robustness to text perturbation; Module: Feature extraction layer (text submodule); Risk level: High".

[0027] Taking this medical diagnostic model as an example, in the training phase, the batch size is set to 32, the initial learning rate is 1e-4 (cosine annealing decay), and the number of iterations is 100. Vulnerability detection points include "fixed learning rate decay rate" (slow model convergence when facing new attack samples) and "the number of iterations is not dynamically adjusted according to the amount of data" (insufficient training when the amount of data increases), both of which are medium risk. In the inference phase, the inference latency threshold is 5 seconds, the concurrent processing capacity is 1000 requests / second, and the input image is normalized to the [0,1] interval. Detection points include "the inference latency threshold is not adapted to emergency scenarios (such as emergency diagnosis requiring results within 2 seconds)" (insufficient real-time performance) and "the input data format verification parameter is single" (only supports JPG format images, which are vulnerable to malicious data attacks in PNG format). The former is high risk, and the latter is medium risk. In addition, the model relies on PyTorch2.0 and scikit-learn1.2.2 libraries. Detection points include "third-party library versions are not updated in a timely manner" (known vulnerabilities exist, such as security vulnerabilities in some operators of PyTorch2.0), with a risk level of medium. Add to the mapping table, for example, "Detection point: Inference latency threshold is not adapted to emergency scenario; Module: Inference layer; Risk level: High" and "Detection point: Third-party library version not updated; Module: Dependency layer; Risk level: Medium".

[0028] The medical model has encountered two critical vulnerabilities in its past operation: First, in March 2024, when inputting CT images with added FGSM perturbations (perturbation amplitude of 0.01), the model misclassified "benign nodules" as "lung cancer." The vulnerability type was "adversarial attack vulnerability," the trigger condition was "low-amplitude image perturbation," and the affected scope was "only image modality inference results." The remediation measure was "retraining with 5000 adversarial samples," and the corresponding detection point was "weak adversarial robustness of the ResNet submodule," maintaining a high risk level. Second, in May 2024, a backdoor (label tampering) was implanted into the medical record text, which allowed the model to misclassify medical records containing this keyword as diabetes. The vulnerability type was "backdoor attack vulnerability," the trigger condition was "text containing specific keywords," and the affected scope was "text modality-dominated diagnostic results." The remediation measure was "using federated prototype decoupling technology to separate abnormal features," and the added detection point was "abnormal mapping logic between text features and diagnostic results," maintaining a high risk level. Add the detection points corresponding to historical vulnerabilities to the mapping table, for example, "Detection point: Abnormal mapping logic between text features and diagnostic results; Module: Feature fusion layer; Risk level: High (associated with backdoor vulnerability)".

[0029] Cross-source association processing is performed on the correlation information between multimodal basic data features and threat types, and the mapping table between algorithm model vulnerability detection points and modules. The correlation degree between multimodal basic data features and model detection points is calculated using a deep spatiotemporal causal network to establish a cross-source association mapping between multimodal basic data and algorithm model vulnerability detection points, generating a cross-source association mapping table. Taking the association between medical text medical record data and model input layer detection points as an example, the association key is set as "data type (text) + model module identifier (input layer) + threat type (privacy leakage)". The "unmasked ID number" feature is extracted from the multimodal data features, and the "incomplete input data anonymization" detection point is extracted from the model detection points. Through deep spatiotemporal causal network analysis, it is found that the probability of this text feature triggering this detection point and causing privacy leakage in historical data is 92%. The spatiotemporal correlation between the feature appearance time and the detection point alarm time is 0.85 (range 0-1, higher values ​​indicate stronger correlation), and the final calculated correlation degree is 0.88 (high correlation).

[0030] Taking the association between industrial equipment image data and model feature extraction layer detection points as an example, the association key is "data type (image) + model module identifier (feature extraction layer - ResNet sub-module) + threat type (adversarial attack)". The image feature "bearing crack area occlusion disturbance" and the model detection point "ResNet sub-module does not fully extract occlusion area features" are extracted. Causal network analysis shows that the probability of this image feature causing the detection point to be triggered and causing the model to misjudge is 87%, the spatiotemporal correlation is 0.79, and the correlation degree is 0.82 (high correlation).

[0031] Based on the above correlation calculation results, a cross-source correlation mapping table is generated. Each mapping record includes a correlation key, data feature details, model detection point details, and correlation degree. For example: Correlation key: Text + Input layer + Privacy leakage; Data feature: Medical record text contains an unmasked ID number (110101********1234); Model detection point: Incomplete anonymization of input data (belonging to the input layer module, high risk level); Correlation degree: 0.88. Correlation key: Image + Feature extraction layer - ResNet submodule + Adversarial attack; Data feature: Occlusion disturbance in the bearing crack area of ​​an industrial equipment image (occlusion area 5%); Model detection point: Incomplete feature extraction of the occluded area by the ResNet submodule (belonging to the feature extraction layer module, medium risk level); Correlation degree: 0.82. Correlation key: Audio + Decision layer + Anomaly misjudgment; Data feature: Noise disturbance in the working area (signal-to-noise ratio 20dB); Model detection point: The abnormal output threshold of the decision layer is not dynamically adjusted (belonging to the decision layer module, medium risk level); Correlation degree: 0.75.

[0032] An embedded model vulnerability tracing module, based on the correlation data, threat type, and vulnerability level in the cross-source correlation mapping table, first assigns a threat impact weight, then, combined with the module correlation strength, prioritizes the modules according to the calculation rule of threat impact weight × module correlation strength, locating the core model modules that need priority optimization. Simultaneously, it records the module optimization priority and improvement direction based on the generated vulnerability risk level information, forming a tracing result table of model core modules - optimization priorities - improvement schemes. The module's input data directly reuses the cross-source correlation mapping table generated in the previous "cross-source correlation processing" stage, requiring no additional data collection and ensuring the continuity of data flow. This mapping table already contains core information such as "data feature details, model detection point details, correlation, threat type, and vulnerability level," all derived from multimodal basic data feature extraction, model vulnerability detection point parsing, and correlation calculation of deep spatiotemporal causal networks, serving as the core basis for tracing analysis. The rules for assigning threat impact weights match the threat severity levels specified in the "Dynamic Security Protection Requirements" and take into account the security priorities of business scenarios in multiple industries. The weight values ​​are set to a range of 0-1, with higher weights indicating a more severe impact of the threat on the business.

[0033] The module association strength directly reuses the "association degree" from the cross-source association mapping table. This association degree is calculated by the deep spatiotemporal causal network and reflects the closeness of the association between multimodal data features and model detection points. The optimization priority score of each model module is obtained by multiplying "threat impact weight × module association strength". The higher the score, the greater the impact of the vulnerability of the module on security protection, and the more it needs to be optimized.

[0034] By combining the "vulnerability level" and "model detection point details" in the cross-source association mapping table, as well as the module defects identified in the model vulnerability detection point analysis, specific improvement directions are formulated for each core module. This results in a source tracing result table of "model core module - optimization priority - improvement plan". This table will directly serve as the core basis for subsequent "adding security risk labels" and "generating targeted protection plans", achieving a closed-loop connection between source tracing and optimization.

[0035] An initial security risk label is added to each associated data entry in the cross-source association mapping table. This is combined with vulnerability risk level and threat type annotations, along with data collection timestamps and model version information. Multimodal basic data features, model detection point information, security risk labels, timestamps, and model version annotations are integrated to generate target associated data. Labels are then assigned to the associated data based on the risk level and threat type of the model detection points: risk levels are categorized as "high / medium / low," and threat types are categorized as "adversarial attacks (text tampering / image steganography / audio tampering), privacy leaks, and abnormal misjudgments." For example, for the associated record "text + input layer + privacy leak," the model detection point risk level is high, and the threat type is privacy leak, so the label is "risk level: high; threat type: privacy leak." For the associated record "image + feature extraction layer - ResNet submodule + adversarial attack," the model detection point risk level is medium, and the threat type is adversarial attack (image steganography), so the label is "risk level: medium; threat type: adversarial attack (image steganography)."

[0036] Supplement the data collection timestamp (accurate to milliseconds) and model version information (e.g., "V2.1.0 (updated 20240510)"), integrate multimodal basic data features, model detection point information, security risk labels, timestamps, and model versions to generate target-related data. For example: Target-related data 1: Data features (text - medical records containing un-anonymized ID number 110101********1234), model detection points (input layer - incomplete anonymization of input data, high risk level), security risk labels (high risk - privacy leakage), data collection timestamp (2024-05-15 09:20:35.456), model version (V2.1.0). Target associated data 2: Data features (image - occlusion disturbance in the crack area of ​​industrial equipment bearing, occlusion area 5%), model detection points (feature extraction layer - ResNet submodule does not fully extract features of the occluded area, medium risk level), security risk label (medium risk - adversarial attack (image steganography)), data collection timestamp (2024-05-15 10:15:22.789), model version (V2.1.0).

[0037] S103, the target-related data is split and processed based on the structure of data type-model module-threat type-risk label, and a hierarchical feature alignment network is introduced to achieve cross-modal data feature unification. At the same time, a priority processing caching mechanism is established for high-risk threat-related data to generate structured security analysis data.

[0038] In one implementation, the target-related data is split into layers according to a hierarchical structure of data type - model module - threat type - risk label, and the core information of each dimension is extracted to generate dimension-split data. Taking the target-related data in the medical field as an example ("text - input layer - privacy leakage - high risk"): (Data characteristics: electronic medical records contain unmasked ID number 110101********1234; Model detection point: incomplete anonymization of input layer data; Timestamp: 2024-05-15 09:20:35.456; Model version: V2.1.0). For the data type dimension: the core information is extracted as "text - medical electronic medical records," and the data source (electronic medical record system of the cardiology department of a tertiary hospital), text length (500 characters), and data format (XML) are labeled. For the model module dimension: the core information is extracted as "input layer," and the module function (multimodal data reception and preliminary preprocessing), associated sub-modules (text anonymization sub-module), and module parameters (anonymization rule: only names are masked, ID numbers are not masked). For the threat type dimension: the core information is extracted as "privacy leakage," explaining the carrier of the leakage risk (unanonymized ID card numbers), the scope of the leakage impact (exposure of patient identity information), and compliance risks. For the risk label dimension: the core information is extracted as "high risk," annotating the risk judgment criteria (ID card numbers are core privacy data, directly input into the model without anonymization) and the probability of risk occurrence (92% probability of this type of data triggering a privacy leakage event in historical data). The final data generated is dimensionally split, with each dimension's information independently correlated, and can be directly used for subsequent feature processing.

[0039] Taking the target-related data in the industrial field of "image - feature extraction layer (ResNet submodule) - adversarial attack (image steganography) - medium risk" as an example (data characteristics: 5% occlusion perturbation in the crack area of ​​equipment bearing; model detection point: incomplete feature extraction of the occluded area by the ResNet submodule; timestamp: 2024-05-15 10:15:22.789; model version: V2.1.0). Regarding the data type dimension: the core information extracted is "image - industrial equipment appearance inspection image", annotating the image resolution (2048×2048 pixels), the shooting device (industrial camera IND-CAM-023), and the inspection object (automotive bearing parts). Regarding the model module dimension: the core information extracted is "feature extraction layer - ResNet submodule", specifying the submodule version (ResNet-50), the feature extraction range (image edge contour, texture features), and the current defect (only 60% feature extraction coverage of the occluded area). For the threat type dimension: the core information extracted is "adversarial attack - image steganography," explaining the attack method (malicious occlusion of a local area), the attack target (concealing bearing crack defects, leading to model misjudgment), and the attack intensity (occlusion area 5%, perturbation amplitude 0.02). For the risk label dimension: the core information extracted is "medium risk," annotating the risk judgment criteria (occlusion caused the model defect misjudgment rate to increase from 3% to 15%) and the risk impact (increased production line quality inspection miss rate, affecting product quality). This dimensional breakdown of the data provides clear core information for each dimension, supporting subsequent cross-modal feature comparison and unification.

[0040] This paper proposes a unified processing method for multimodal basic data features in dimensionally split data. A hierarchical feature alignment network is introduced to analyze the feature differences between different modalities. Cross-modal feature mapping is used to unify the feature space and generate unified feature data. Taking the dimensionally split data of "text medical records (including unanonymized ID numbers)" and "CT images (including lesion annotations)" in the medical field as examples, the text feature is "ID number text sequence (110101********1234)", with a feature dimension of 128 (BERT encoding output); the image feature is "CT image lesion region pixel matrix (2048×2048)", with a feature dimension of 2048 (ResNet feature extraction output). The two differ significantly in dimension and data type (sequence type vs. matrix type). The hierarchical feature alignment network first converts the text sequence into a 2048-dimensional vector through a "modality transformation layer" (based on text semantic embedding extension). Then, it calculates the cosine similarity between the text vector and the image vector (initial similarity 0.32) through a "feature alignment layer." Gradient descent is used to adjust the mapping parameters, increasing the similarity to 0.85 and achieving feature space unification. After unification, the text feature vector is [0.12, 0.35, ..., 0.28] (2048 dimensions), and the image feature vector is [0.11, 0.33, ..., 0.29] (2048 dimensions). Both contain "privacy sensitive" labels (text corresponds to ID card number, image corresponds to patient's facial region). The unified feature data is labeled "Modality type: text / image; Unified feature dimension: 2048 dimensions; Feature meaning: privacy sensitive region feature".

[0041] Taking the dimensional splitting of "equipment appearance inspection images (bearing obstruction disturbance)" and "equipment operation audio (abnormal vibration sound)" in the industrial field as an example, the image feature is "visual features of the bearing obstruction area (2048-dimensional vector)," with feature values ​​reflecting pixel grayscale and edge intensity; the audio feature is "spectral features of abnormal vibration sound (512-dimensional MFCC vector)," with feature values ​​reflecting frequency distribution and energy changes. The two have significant differences in dimensionality and physical meaning. The hierarchical feature alignment network expands the 512-dimensional MFCC vector of the audio to 2048 dimensions through a "dimensional unification layer" (based on frequency-visual feature association rules), and then adjusts the feature weights through a "dynamic alignment layer" using "equipment fault features" as anchor points (obstruction in the image corresponds to a fault, and a specific frequency in the audio corresponds to a fault), thereby increasing the fault correlation between image and audio features from 0.4 to 0.9. The unified image feature vector is [0.45, 0.21, ..., 0.37] (2048 dimensions), and the audio feature vector is [0.43, 0.23, ..., 0.35] (2048 dimensions). Both are labeled with the "fault-related feature" identifier. The unified feature data record is "modal type: image / audio; unified feature dimension: 2048 dimensions; feature anchor: equipment fault feature".

[0042] Risk levels in the unified feature data are identified and filtered. For associated data labeled as high-risk threats, a priority processing caching mechanism is established to generate high-risk cached data. Unified feature data (unified feature: 2048-dimensional privacy-sensitive vector) in the medical field is filtered based on "text-input layer-privacy leakage-high risk". Data is confirmed to belong to the high-risk category by matching "risk label: high risk", with the risk basis being that "unmasked ID numbers are core privacy data, and leakage could lead to identity theft". A dedicated database (DB1) for "high-risk data" is set up in Redis caching, with the cache key "data ID: MED-TEXT-001; risk level: high", the cache expiration time is set to 24 hours (high-risk data needs to be processed quickly to avoid long-term storage), and the cache priority is set to "highest" (higher than medium and low-risk data). The cached data contains "unified feature vector: [0.12, 0.35, ..., 0.28]; original data source: electronic medical record system of a tertiary hospital; risk handling requirements: complete desensitization within 1 hour; cache status: cached, hit count: 0", which triggers a cache alarm and notifies security personnel to handle it first.

[0043] Filter the unified feature data (unified feature: 2048-dimensional fault occlusion feature vector) in the industrial field under the category of "image-feature extraction layer-adversarial attack (equipment fault masking)-high risk". Tag matching is performed for "risk tag: high risk", with the risk criterion being "equipment fault masking can lead to major quality accidents on the production line, with historical losses exceeding 500,000 yuan for similar events". In Redis cache DB1, the cache key is set to "data ID: IND-IMAGE-002; risk level: high", the cache expiration time is set to 1 hour (industrial scenarios have high real-time requirements and require immediate processing), and the caching strategy is "write penetration" (cache data is synchronously written to the database to avoid data loss). The cached data contains "unified feature vector: [0.45, 0.21, ..., 0.37]; original data source: automotive factory quality inspection system; risk handling requirement: fault review to be completed within 10 minutes; cache status: cached, hit count: 2 (security analysis module has called 2 times)", and the cache is associated with the industrial equipment number (CAR-PART-0789) for easy location of faulty equipment.

[0044] The unified feature data and high-risk cached data are integrated and processed, and data collection timestamps, model version information, and details of associated detection points are added to generate structured security analysis data. High-risk cached data on text privacy leakage and unified image lesion feature data from the medical field are integrated. The merged data includes unified feature vectors (both 2048-dimensional), risk labels (text: high risk - privacy leakage; image: medium risk - lesion recognition), and modality type (text / image). Data collection timestamps (text: 2024-05-15 09:20:35.456; image: 2024-05-15 09:30:12.789), model versions (both V2.1.0), and details of associated detection points (text associated with "input layer - incomplete desensitization," detection point ID: MED-DET-001; image associated with "feature extraction layer - insufficient lesion recognition accuracy," detection point ID: MED-DET-002). The structured security analysis data format is as follows: "Data ID: MED-SEC-001; Modal combination: text + image; Uniform feature vector (text): [0.12, 0.35, ..., 0.28]; Uniform feature vector (image): [0.11, 0.33, ..., 0.29]; Risk label: high / medium; Timestamp: 2024-05-15 09:20:35.456 / 09:30:12.789; Model version: V2.1.0; Associated detection points: MED-DET-001 / MED-DET-002; Detection point details: Input layer desensitization defect / lesion recognition accuracy 85%".

[0045] This dataset integrates "high-risk cached data of image adversarial attacks" and "unified data of abnormal vibration features in audio" from the industrial field. The merged data includes unified feature vectors (both 2048-dimensional), risk labels (image: high risk - adversarial attack; audio: medium risk - abnormal vibration), and modal types (image / audio). It also includes supplementary data collection timestamps (image: 2024-05-15 10:15:22.789; audio: 2024-05-15 10:16:05.345), model version (V2.1.0), and details of associated detection points (image associated with "feature extraction layer - incomplete ResNet occlusion feature extraction", detection point ID: IND-DET-001; audio associated with "decision layer - fixed threshold for abnormal vibration judgment", detection point ID: IND-DET-002). The structured security analysis data format is as follows: "Data ID: IND-SEC-002; Modal combination: image + audio; Unified feature vector (image): [0.45, 0.21, ..., 0.37]; Unified feature vector (audio): [0.43, 0.23, ..., 0.35]; Risk label: High / Medium; Timestamp: 2024-05-15 10:15:22.789 / 10:16:05.345; Model version: V2.1.0; Associated detection points: IND-DET-001 / IND-DET-002; Detection point details: Occlusion feature extraction coverage 60% / Anomaly judgment threshold 0.6 not dynamically adjusted."

[0046] S104 generates targeted protection solutions based on the data-model-threat correlation mapping in structured security analysis data, addressing different types of multimodal basic data security threat detection needs.

[0047] In one implementation, the data-model-threat association mapping in structured security analysis data is parsed to extract multimodal basic data features, model vulnerability detection points, and risk level information corresponding to different threat types, generating a detailed threat-data-model association. Taking structured security analysis data in the medical field (Data ID: MED-SEC-001, modal combination: text + image) as an example: Threat type identification: includes two types of threats: "Privacy leakage (text modality)" and "Adversarial attack (image modality)". Privacy leakage threat: The multimodal basic data feature is "text medical records containing un-anonymized ID numbers (110101********1234)", the model vulnerability detection point is "input layer - incomplete data anonymization (detection point ID: MED-DET-001)", and the risk level is "high". Adversarial attack threat: The multimodal basic data feature is "small pixel perturbation added to the lesion area of ​​CT image (perturbation amplitude 0.01)", and the model vulnerability detection point is "weak adversarial robustness of the feature extraction layer-ResNet submodule (detection point ID: MED-DET-003)", with a risk level of "high". The annotations are: "Threat type: privacy leakage / adversarial attack; Modal type: text / image; Data feature: unanonymized ID number / CT image pixel perturbation; Model detection point: MED-DET-001 / MED-DET-003; Detection point details: input layer anonymization defect / insufficient ResNet adversarial robustness; Risk level: high / high; Data source: electronic medical record system / CT imaging system of a tertiary hospital's cardiology department".

[0048] Taking structured security analysis data from the industrial sector (Data ID: IND-SEC-002, modal combination: image + audio) as an example. Threat type identification includes two types of threats: "Adversarial attacks (image modality)" and "Anomaly misjudgment (audio modality)". Adversarial attack threat: The basic multimodal data feature is "5% occlusion disturbance in the equipment bearing crack area (occlusion area 100×100 pixels)", and the model vulnerability detection point is "incomplete feature extraction of the feature extraction layer - ResNet submodule occlusion (detection point ID: IND-DET-001)", with a risk level of "high". Anomaly misjudgment threat: The basic multimodal data feature is "equipment operating audio containing 20dB current noise (frequency 1kHz)", and the model vulnerability detection point is "decision layer - fixed threshold for abnormal vibration judgment (detection point ID: IND-DET-002)", with a risk level of "medium". The following tags are used to indicate the threat type: adversarial attack / anomaly misjudgment; modality type: image / audio; data attack / anomaly misjudgment; modality type: image / audio; data features: bearing occlusion disturbance / noise audio; model detection points: IND-DET-001 / IND-DET-002; detection point details: occlusion feature extraction coverage 60% / threshold 0.6 not dynamically adjusted; risk level: high / medium; data source: automotive factory quality inspection system / equipment sensors.

[0049] To address adversarial attack threats, this study integrates causal reasoning and dynamic defense techniques based on data features and model vulnerabilities in the correlation details. It analyzes the causal relationship between attack features and model vulnerabilities using a deep spatiotemporal causal network, generates explainable adversarial sample defense strategies through counterfactual intervention, and dynamically defends against real-time attacks using a time-sensitive gradient correction algorithm, generating a specialized adversarial attack protection scheme. For the mapping "CT image pixel perturbation → weak adversarial robustness of ResNet submodule" in the correlation details, deep spatiotemporal causal network analysis shows that the perturbation causes misjudgments through a causal link of "abnormal pixel grayscale value → shift in activation value of feature extraction layer → classification error in decision layer," with a causal correlation strength of 0.91 (ranging from 0 to 1, with higher values ​​indicating a stronger correlation). Counterfactual intervention generates a counterfactual sample stating that "removing 50% of the perturbation pixels in the lesion area of ​​the CT image increases the model's diagnostic accuracy from 65% to 92%." Based on this sample, the ResNet submodule parameters are optimized, improving the adversarial sample recognition rate from 78% to 96%, and generating a defense report (annotated with "perturbation pixel location, affected feature dimension, and change in accuracy after repair"). A time-sensitive gradient correction algorithm is deployed to monitor the input features of CT images in real time. When a pixel perturbation amplitude exceeds 0.005, gradient adjustment is automatically triggered (the correction amplitude is positively correlated with the perturbation amplitude), maintaining a real-time attack interception rate of over 95%. The algorithm is defined as follows: "Protection target: Medical CT image diagnostic model; Defense strategy: Counterfactual sample optimization + time-sensitive gradient correction; Performance indicators: Adversarial sample recognition rate ≥96%, real-time interception rate ≥95%, normal image diagnostic accuracy loss ≤2%; Deployment location: Between the model feature extraction layer and the input layer."

[0050] To address the issue of "bearing occlusion disturbance → incomplete occlusion feature extraction by ResNet submodule," a deep spatiotemporal causal network locates the causal link: "occlusion area → missing edge features → missed detection by fault classifier," with a causal correlation strength of 0.87. An explainable adversarial example defense strategy is generated: counterfactual intervention generates a sample stating that "if the crack features in the bearing occlusion area are completed, the model's fault detection rate increases from 40% to 93%." Based on this sample, the ResNet submodule occlusion feature compensation mechanism is trained, achieving an occlusion disturbance recognition rate of 94%. Real-time attack defense utilizes a time-sensitive gradient correction algorithm to analyze the integrity of image edge features in real time. When the occlusion area exceeds 3%, a backup feature extraction channel (based on texture feature-assisted recognition) is automatically invoked, achieving a real-time interception rate exceeding 93%. The target audience is: "Industrial equipment quality inspection model; defense strategy: occlusion feature compensation + multi-channel feature fusion; performance indicators: disturbance recognition rate ≥94%, real-time interception rate ≥93%, quality inspection efficiency ≥20 frames / second; applicable scenario: real-time quality inspection of automotive parts production lines."

[0051] To address backdoor attack threats, based on the abnormal data characteristics related to backdoor implantation in the association details and the mapping of model modules, a federated prototype decoupling technique is used to separate normal and abnormal feature representations. Combined with a trustworthy assessment module based on backdoor adjustment counterfactual reasoning, backdoor triggering conditions are dynamically identified, generating a specific backdoor attack protection solution. The prototype library is updated according to a preset cycle, such as monthly or quarterly. Regarding the "document label tampering → decision-making level label mapping logic anomaly" in the association details, the federated prototype decoupling technique divides text features into "normal features (document text semantics, compliance labels)" and "abnormal features (tampered labels, malicious keywords)," achieving a separation accuracy of 98%. Based on the trustworthy assessment module based on backdoor adjustment counterfactual reasoning, a counterfactual conclusion is generated: "If the document label has not been tampered with, the model classification accuracy increases from 55% to 98%." The backdoor triggering condition is identified as "specific keywords (e.g., 'confidential' → 'public') + specific text length (≥1000 characters)."

[0052] A "label validity verification module" was added before the model's decision layer to detect the consistency between the label and the semantics of the text in real time (e.g., if the "public" label corresponds to an official document containing the word "confidential," an alarm is triggered), and a label modification log (including the modifier and modification time) is recorded. To address the backdoor of "medical record keyword 'diabetes' → model misclassifies diabetes," the federated prototype decoupling technology separates "normal features (symptom descriptions, examination indicators)" from "abnormal features (malicious keywords, false labels)," achieving a separation accuracy of 97%. Counterfactual reasoning shows that "if the keyword 'diabetes' is removed from the medical record, the model's misclassification rate drops from 80% to 5%," confirming the triggering condition as "medical record containing the keyword 'diabetes' + no corresponding blood glucose examination indicator."

[0053] The credibility assessment module verifies the correlation between keywords and inspection indicators in real time. If no corresponding indicator is found, manual review is triggered. At the same time, the modification traces of medical records are recorded through the blockchain. The system is labeled "Protection Target: Medical Record Diagnostic Model; Defense Strategy: Feature Decoupling + Correlation Verification + Blockchain Traceability; Performance Indicators: Backdoor Identification Rate ≥ 97%, Manual Review Response Time ≤ 5 minutes, Data Tampering Traceability Rate 100%; Applicable Scenarios: Hospital Electronic Medical Record Diagnostic System".

[0054] To address the security management requirements of cross-domain multimodal basic data, a hierarchical feature alignment network is constructed based on cross-device data features and distributed model information in the associated details to achieve robust aggregation of cross-modal data. This is integrated with a federated hierarchical privacy collaboration engine to generate a cross-domain data security protection scheme. For cross-domain data such as "Hospital A text medical record + Hospital B CT image" in the associated details, the hierarchical feature alignment network maps the 128-dimensional semantic vector of the text and the 2048-dimensional visual vector of the image to a unified 2048-dimensional feature space. After aggregation, the feature similarity reaches 0.86, ensuring the consistency of cross-domain data features. The federated hierarchical privacy collaboration engine performs hierarchical processing of cross-domain data: L3-L4 high-sensitivity data (such as gene testing reports and HIV diagnosis records) uses SM9 searchable encryption technology, maintaining a 92% accuracy rate in data aggregation after encryption; L1-L2 low-sensitivity data (such as routine physical examination text) uses robust federated learning that integrates sparse gradient filling and differential privacy, with a privacy protection strength satisfying ε=0.1 (differential privacy parameter, the smaller the value, the stronger the protection).

[0055] Integrating a blockchain traceability mechanism, it records the cross-domain data flow path (e.g., "Hospital A → Regional Medical Platform → Hospital B"). Each step generates an immutable timestamp and operator information, and storage partitions are divided based on a trust score (Hospital A score 95, Hospital B score 92). The protection targets are clearly defined as follows: "Protection target: Cross-domain data of medical consortia; Defense strategy: Feature alignment + hierarchical encryption + blockchain traceability; Performance indicators: Cross-domain data aggregation accuracy ≥ 92%, high-sensitivity data encryption and decryption efficiency ≥ 100MB / s, traceability information integrity 100%; Compliance requirements: Complies with regulations on cross-domain transmission of medical and health information."

[0056] Cross-modal data aggregation: For cross-domain data such as "images of equipment in plant A + audio recordings of operation in plant B", a hierarchical feature alignment network maps the appearance features of the image equipment and the vibration features of the audio to a unified 1024-dimensional space, achieving a 93% consistency rate in fault identification after aggregation. High-sensitivity L3-L4 data (such as core equipment parameters and production plans) is aggregated using AES-256 encryption, while low-sensitivity L1-L2 data (such as routine equipment operation logs) uses federated learning parameter sharing to avoid raw data transmission. A distributed data lake based on poisoning detection stores cross-domain data, partitioned by trust score (94 for plant A, 91 for plant B), while simultaneously monitoring data transmission bandwidth in real time to avoid exceeding the concurrency threshold (≤500Mbps). Labeled as: "Protection object: Industrial cross-plant equipment data; Defense strategy: Cross-modal aggregation + hierarchical federated learning + poisoning detection; Performance indicators: Aggregated fault identification consistency ≥93%, data transmission latency ≤100ms, poisoning detection rate ≥98%; Applicable scenario: Collaborative monitoring of cross-plant equipment in automotive manufacturing."

[0057] The aforementioned protection solutions were integrated, taking into account business scenarios and compliance requirements across multiple industries. Industry-specific customized rules were added, and an interpretability module was integrated to generate targeted protection solutions covering multiple threat types and application scenarios. The solutions for "CT image adversarial attack protection," "medical record text backdoor attack protection," and "cross-domain protection for medical consortia" were integrated, with clear priorities: high-risk threats (adversarial attacks, backdoor attacks) were handled first, while cross-domain protection was implemented simultaneously. New requirements were added: "Encryption of highly sensitive medical data must comply with the 'Guidelines for Health Data Security'" and "Medical record modifications must be reviewed by both the attending physician and the information technology department." For emergency scenarios, the processing latency of the adversarial attack protection module was reduced from 500ms to 200ms, and the manual review response time for backdoor attacks was reduced from 5 minutes to 2 minutes. Confidence assessments (e.g., 96% confidence level for adversarial attack interception, 97% confidence level for backdoor identification) and visual explanation interfaces (showing the location of attack features and the effectiveness process of the defense strategy) were added to each protection strategy. It covers threats such as "counter-attacks / backdoor attacks / cross-domain management" and is adapted to scenarios such as "outpatient diagnosis / emergency treatment / inter-hospital consultation". The performance indicators are uniformly set as "attack interception rate ≥95%, data security compliance 100%, and doctor operation satisfaction ≥90%".

[0058] S105 processes the protection effect and real-time threat feedback, designs a closed-loop training optimization mechanism, uses the protection effect index as a loss function constraint term for model training, updates the training sample library in combination with real-time threat characteristics, and iteratively adjusts the model parameters through causal decoupling defense evolution technology to generate a dynamic defense optimization model.

[0059] In one implementation, indicators are extracted and analyzed to assess the actual protective effectiveness of targeted protection schemes. Core indicators such as attack interception rate, model accuracy retention rate, cross-domain defense adaptability, and sensitive data protection compliance are collected to generate basic evaluation data for protection effectiveness. Taking the medical field's "CT image adversarial attack protection scheme + medical record text backdoor attack protection scheme + medical consortium cross-domain protection scheme" as an example, the adversarial attack protection scheme achieves an average success rate of 95.2% in intercepting FGSM and PGD adversarial samples (96.1% for CT image adversarial samples and 94.3% for medical record text adversarial samples); the backdoor attack protection scheme achieves an accuracy rate of 97.8% in identifying "keyword tampering" backdoors, with a false positive rate of 2.1%.

[0060] After the protection scheme was deployed, the diagnostic accuracy of the medical diagnostic model for normal CT images decreased from 93.5% to 91.8% (accuracy loss of 1.7%), and the accuracy of medical record text classification decreased from 94.2% to 92.5% (accuracy loss of 1.7%), both meeting the preset requirement of "accuracy loss ≤ 3%". During cross-domain data aggregation within the medical consortium, the adaptation rates of the protection schemes for different hospitals (A, B, and C) were 94.5%, 93.8%, and 92.7%, respectively, with an average adaptation latency of 120ms (≤ 200ms preset threshold). The encryption compliance rate for high-sensitivity data (HIV diagnostic records) was 100% (compliant with the Personal Information Protection Law), and the federated learning privacy protection strength ε for low-sensitivity data (routine physical examination text) was 0.12 (≤ 0.15 preset value). The evaluation criteria are as follows: "Evaluation Target: Comprehensive protection solution for the medical field; Attack interception rate: 95.2% for countermeasures / 97.8% for backdoors; Model accuracy retention rate: 91.8% for CT diagnosis / 92.5% for text classification; Cross-domain adaptability: 93.7% on average / 120ms latency; Compliance: 100% for high sensitivity / ε=0.12 for low sensitivity; Evaluation period: 7 days."

[0061] Taking the "Equipment Image Countermeasure Attack Protection Solution + Cross-Plant Data Protection Solution" in the industrial field as an example, the interception rate of equipment image countermeasure attacks (occlusion, noise disturbance) is 94.6%, and the detection rate of cross-plant data poisoning attacks is 96.3%. The accuracy of the equipment fault diagnosis model decreased from 92.8% to 90.5% (accuracy loss of 2.3%), meeting the requirement of "accuracy loss ≤ 4%" in industrial scenarios. The cross-plant (A, B) data transmission adaptation rate is 92.1%, and the data aggregation latency is 95ms (≤100ms preset threshold). The compliance rate of equipment core parameters (AES-256 encryption) is 100%, and the compliance rate of production plan data federated learning parameter sharing is 98.5%. The evaluation criteria are: "Evaluation object: Industrial field protection solution; Attack interception rate: Countermeasure 94.6% / Poisoning 96.3%; Model accuracy retention rate: Fault diagnosis 90.5%; Cross-domain adaptation: 92.1% / Latency 95ms; Compliance: Core parameters 100% / Production plan 98.5%; Evaluation period: 10 days."

[0062] Real-time threat feedback information in open environments is processed, and new attack patterns are tracked using multimodal adversarial perturbation dynamic detection technology. Attack feature updates and threat evolution trends are extracted to generate a real-time threat feature dataset. A cross-modal adversarial attack involving "medical CT images + medical record text" was detected (adding minor perturbations to CT images while altering the "lesion size" description in the medical record text). This attack increased the model's misdiagnosis rate from 3.2% to 28.5%, representing a previously uncovered cross-modal collaborative attack. The image perturbation amplitude of the cross-modal adversarial attack increased from 0.01 to 0.015 (making it more difficult to detect with the naked eye), and the text tampering keywords expanded from "benign nodules" to three categories including "lesion nature" and "treatment plan." In the past 7 days, the frequency of this cross-modal attack increased from 0 times / day to 5 times / day, with the attack source concentrated on unknown external IPs (suspected malicious testing). The record shows the following: Threat type: cross-modal collaborative adversarial attack; attack characteristics: CT image perturbation 0.015 + text keyword tampering (3 types); false positive rate: 28.5%; frequency of occurrence: 5 times / day; attack source: unknown IP; data format: image feature vector (2048 dimensions) + text feature vector (128 dimensions).

[0063] A new attack pattern was discovered: a composite attack combining "equipment audio noise" and "image steganography" (injecting interference noise into the equipment's operating audio while simultaneously writing malicious code into the visual inspection image). This caused the fault identification rate during cross-plant data aggregation to drop from 93% to 65%. The attack characteristics have been updated: the audio noise frequency has increased from 1kHz to 1.5kHz (closer to the normal vibration frequency of the equipment), and the image steganography size has increased from 5KB to 8KB (for enhanced concealment). The threat evolution trend shows that the attack primarily targets production equipment in Plant B, occurring 3 times in the past 5 days, and the attack code iteration speed has accelerated (updated once every 2 days). The attack is labeled as follows: "Threat type: audio-image composite attack; attack characteristics: 1.5kHz audio noise + 8KB image steganography; impact on fault identification rate: 65%; frequency of occurrence: 3 times / 5 days; attack target: equipment in Plant B; data format: audio spectrum features (512 dimensions) + image steganography features (2048 dimensions)."

[0064] A closed-loop training optimization mechanism is designed, using core indicators from the basic assessment data of protection effectiveness as constraints in the loss function of model training, and constructing a mapping relationship between protection effectiveness and loss value. At the same time, the training sample library is updated in conjunction with the real-time threat feature dataset, and adversarial samples and backdoor attack samples are dynamically expanded according to the proportion of new threat samples ≥30% and the retention of historical effective samples ≥70%. Causal decoupling defense evolution technology is used to analyze the causal relationship between indicator shortcomings and model parameters, and core parameters are iteratively adjusted to specifically improve shortcomings, forming a closed-loop link of indicator constraint - sample update - parameter tuning.

[0065] First, core indicators are extracted from the basic assessment data of protection effectiveness and transformed into loss function constraints for model training, constructing a dynamic mapping relationship between "protection effectiveness and loss value"—the closer the core indicator is to the preset threshold, the smaller the loss value; the more the indicator deviates from the threshold, the larger the loss value, thus guiding model training to focus on protection weaknesses. Following the ratio of "new threat samples accounting for ≥30% and historical valid samples retained ≥70%", new threat samples from the real-time threat feature dataset are integrated into the training sample library, preserving the model's ability to defend against historically known threats while ensuring the model can learn the characteristic patterns of new threats.

[0066] By employing a causal decoupling defense evolution technique, irrelevant factors are eliminated to accurately pinpoint the causal relationship between core indicator weaknesses and model parameters. This clarifies which model parameter adjustments can specifically improve defense weaknesses, avoiding blind parameter tuning. Based on the causal correlation analysis results, the core model parameters are iteratively adjusted, and the effect of parameter adjustments is verified through multiple rounds of training. If the indicator weaknesses are not improved, the process returns to optimizing the loss function constraints or supplementing samples until the core indicators reach the preset threshold, forming a complete closed loop. Correlation analysis is performed on the basic assessment data of defense effectiveness and the real-time threat feature dataset. Combined with the causal correlations initially analyzed in the closed-loop training optimization mechanism, the causes of weaknesses are further identified, generating a detailed list of optimization directions for the defense solution.

[0067] The basic assessment data showed a missing "cross-modal adversarial attack interception rate" (the original solution did not cover this attack), which correlated with the "cross-modal attack false positive rate of 28.5%" in the real-time threat data. Causal decoupling technology revealed that the shortcoming stemmed from the original protection solution's design only targeting single-modal attacks and lacking a cross-modal feature collaborative detection mechanism. Simultaneously, the "medical record text backdoor false positive rate of 2.1%" was correlated with the "high frequency of the keyword 'diabetes' in normal medical records," caused by the backdoor judgment rules failing to distinguish between normal and malicious keywords. A new cross-modal attack detection module was added, integrating CT image and medical record text features for collaborative judgment, achieving a target interception rate ≥95%. The backdoor judgment rules were optimized by introducing a dual-dimensional verification of "keywords + contextual semantics," reducing the target false positive rate to ≤1.5%. Model parameters were fine-tuned to reduce the impact of cross-domain data aggregation on model accuracy, resulting in a target accuracy loss of ≤1.5%.

[0068] The "cross-plant area data adaptation rate of 92.1% (lower than the preset 95%)" in the basic assessment data is related to the "composite attack causing aggregate failure" in the real-time threat data. The causal decoupling shows that the cause is that "the cross-domain feature alignment network does not consider the correlation between audio-image composite features"; the "equipment fault diagnosis accuracy loss of 2.3%" is related to "insufficient adversarial sample training data", the cause of which is that "the original training samples only contain single-modal attacks and lack composite attack samples".

[0069] The optimization directions are detailed as follows: upgrade the hierarchical feature alignment network, add a composite attack feature association layer, and achieve a target cross-domain adaptation rate of ≥95%; expand the composite attack sample library (add 5000 audio-image composite attack samples), retrain the model, and achieve a target accuracy loss of ≤2%; optimize the poisoning detection algorithm to reduce the false negative rate caused by composite attacks, and achieve a target detection rate of ≥97%.

[0070] Based on the optimization direction of the protection scheme, an integrated meta-learning-driven self-evolution mechanism is used to iteratively fine-tune the parameters of the protection model. Defense strategies are dynamically adjusted in response to attack features, and lightweight defense migration deployment technology is combined to adapt to edge-side scenarios, generating a preliminary optimized model. For the optimization of "cross-modal attack detection," the meta-learning controller calls upon historical defense experience (single-modal attack detection parameters, prioritizing defense data from the past 3 to 6 months), and through 5 rounds of iteration, adjusts the cross-modal feature fusion weights (from 0.3:0.7 to 0.5:0.5), increasing the cross-modal adversarial attack interception rate from 0 to 95.8%. For "backdoor false positive rate optimization," the keyword semantic verification threshold is iteratively adjusted (from 0.6 to 0.55), reducing the false positive rate from 2.1% to 1.4%. A new "real-time response strategy for cross-modal attacks" is added. When cross-modal attack features are detected, dual-modal feature collaborative verification (CT image lesion area + medical record text description consistency verification) is automatically triggered, with response latency controlled within 80ms. For edge medical devices (such as mobile ultrasound equipment), a defensive feature decoupling distillation method is adopted to compress the model size from 2GB to 500MB and reduce the inference latency from 300ms to 150ms, meeting the real-time requirements of the edge side. The model is labeled as follows: "Model type: Medical multimodal protection model V2.2; Core parameters: cross-modal fusion weight 0.5:0.5, semantic verification threshold 0.55; Defense strategy: cross-modal collaborative verification; Lightweight indicators: size 500MB / latency 150ms; Optimization effect: cross-modal interception rate 95.8% / backdoor false alarm rate 1.4%".

[0071] To optimize cross-domain adaptation, the meta-learning mechanism iteratively adjusted the dynamic alignment coefficient of the feature alignment network (from 0.8 to 0.9), increasing the cross-factory data adaptation rate from 92.1% to 95.3%. To optimize accuracy loss, through three rounds of parameter iteration (adjusting the convolution kernel size of the ResNet submodule), the model's fault diagnosis accuracy recovered from 90.5% to 91.8% (accuracy loss of 1.0%). A new "composite attack layered defense strategy" was added, first detecting audio noise features, then verifying image steganography, and finally performing cross-modal feature consistency verification, increasing the attack detection rate from 96.3% to 97.5%. For industrial IoT edge nodes (such as factory sensors), an edge-side disturbance tolerance calibration module was designed, reducing model inference latency from 200ms to 80ms, meeting the needs of real-time industrial control. The model is labeled as follows: "Model type: Industrial cross-modal protection model V1.8; Core parameters: Alignment coefficient 0.9, convolution kernel size 3×3; Defense strategy: Layered composite defense; Lightweight indicators: Latency 80ms / Adaptation to edge sensors; Optimization effect: Cross-domain adaptation rate 95.3% / Fault diagnosis accuracy 91.8%".

[0072] The initial optimized model underwent multi-dimensional validation. Noise robustness testing verified the model's anti-interference capability, and privacy inversion testing verified its data protection effectiveness. Based on actual business feedback from multiple industry demonstration application scenarios, model deviations were corrected, resulting in a dynamic defense optimized model. The dynamic defense optimized model for the medical field was generated as follows: Noise Robustness Test: CT images and medical record texts containing 10%, 20%, and 30% noise were input into the optimized model. The model's robustness to noise was 94.2%, 89.5%, and 82.3% respectively (all higher than the pre-optimization 10%-15%), meeting the requirement of "robustness ≥80% under 30% noise". Privacy Inversion Test: An attempt was made to infer highly sensitive data (HIV diagnostic records) from the model output. The inversion success rate was only 1.2% (compared to 5.8% before optimization), significantly improving privacy protection. Industry Business Feedback Correction: Hospitals reported that "the edge device model has insufficient processing accuracy for low-resolution ultrasound images." The model's image resolution adaptation parameters were corrected (supporting images ≥512×512 pixels), increasing the processing accuracy from 85% to 90%. Dynamic defense optimization model generation: labeled "Model version: Medical V2.3; Validation results: Noise robustness 82.3% (30% noise) / Privacy inversion 1.2%; Business feedback correction: Low resolution image adaptation; Final results: Cross-modal interception rate 96.1% / Backdoor false alarm rate 1.3% / Edge latency 150ms; Adapted scenarios: Outpatient diagnosis / Emergency / Edge ultrasound equipment".

[0073] The optimized dynamic defense model for the industrial sector was generated as follows: Noise robustness test: The model was input with device audio and images containing 15%, 25%, and 35% noise. The model's fault identification robustness was 93.5%, 88.7%, and 81.5%, respectively (an improvement of 8%-12% before optimization). Privacy inversion test: An inversion attempt was performed on encrypted core device parameters, with a success rate of 0.8% (3.5% before optimization), meeting industrial data privacy requirements. Industry business feedback correction: Factory feedback indicated increased latency during peak cross-factory data transmission periods (8:00-10:00). The model's concurrent processing parameters were optimized (supporting ≥800Mbps bandwidth), reducing peak latency from 120ms to 90ms. Dynamic defense optimization model generation: labeled "Model version: Industrial V1.9; Validation results: Noise robustness 81.5% (35% noise) / Privacy inversion 0.8%; Business feedback correction: Concurrent bandwidth optimization; Final results: Cross-domain adaptation rate 95.8% / Fault diagnosis accuracy 92.1% / Peak latency 90ms; Adapted scenarios: Cross-plant equipment monitoring / Edge sensor protection".

[0074] S106 processes multimodal basic data and intelligent algorithm model information based on the dynamic defense optimization model, and generates dynamic security protection information for multimodal basic data in combination with dynamic security protection requirements.

[0075] In one implementation, the causal reasoning module, federated prototype decoupling module, hierarchical feature alignment network parameters, multimodal basic data, and intelligent algorithm model information in the dynamic defense optimization model are analyzed for correlation, generating model defense parameter-data feature-algorithm module correlation factors and security protection strategy dynamic adaptation factors. Taking the medical dynamic defense optimization model (V2.3), "CT image + medical record text" multimodal data, and disease diagnosis model as examples, for the causal reasoning module: the core parameters are "causal association strength threshold 0.85, counterfactual intervention step size 0.01". Correlation with data features: CT image lesion perturbation feature (amplitude 0.015) adaptation degree 0.92, medical record text keyword tampering feature ("benign → malignant") adaptation degree 0.88; correlation with model information: diagnostic layer classification threshold (0.7) synergy degree 0.86, generating correlation factors "causal parameter-image perturbation-diagnostic layer: 0.92; causal parameter-text tampering-diagnostic layer: 0.88". For the federated prototype decoupling module: the parameters are "feature separation threshold 0.7, federated aggregation weight 0.6". Related to data features: high-sensitivity medical record text (HIV diagnosis) fit 0.93, low-sensitivity CT image (routine physical examination) fit 0.85; related to model information: feature fusion layer attention weight (0.5) synergy 0.89, generating the association factor "federated parameters - high-sensitivity text - fusion layer: 0.93; federated parameters - low-sensitivity image - fusion layer: 0.85". For the hierarchical feature alignment network: the parameters are "cross-modal mapping dimension 2048, alignment similarity threshold 0.82". Related to data features: CT image 2048-dimensional visual features and medical record text 128-dimensional semantic features mapping fit 0.87; related to model information: input layer multimodal interface (supports 2048-dimensional input) compatibility 0.95, generating the association factor "alignment parameter - cross-modal feature - input layer: 0.87; alignment parameter - interface parameter - input layer: 0.95". Based on the needs of medical scenarios, the compatibility of the time-sensitive gradient correction strategy with the emergency scenario (real-time) is 0.91, the compatibility of the federated encryption strategy with the consultation scenario (cross-domain) is 0.94, and the compatibility of the counterfactual sample defense strategy with the routine scenario is 0.88.

[0076] Taking the industrial dynamic defense optimization model (V1.9), multimodal data of "equipment image + operation audio", and fault diagnosis model as examples. For the causal inference module: the parameters are "causal link depth 3, fault association threshold 0.8". Correlation with data features: the fit of the bearing occlusion feature (area 8%) in the equipment image is 0.89, and the fit of the 1.5kHz noise feature in the audio is 0.85; Correlation with model information: the synergy of the fault identification layer judgment threshold (0.75) is 0.91, generating the correlation factors "causal parameter - image occlusion - identification layer: 0.89; causal parameter - audio noise - identification layer: 0.85".

[0077] For the federated prototype decoupling module: the parameters are "5 separation iterations, 100ms cross-plant aggregation delay". Correlation with data features: equipment core parameters (speed, temperature) adaptability 0.94, production log text adaptability 0.86; correlation with model information: distributed deployment parameters (5 plant nodes) compatibility 0.92, generating correlation factors "Federated parameters - high-sensitivity equipment features - distributed layer: 0.94; Federated parameters - low-sensitivity logs - distributed layer: 0.86".

[0078] For the hierarchical feature alignment network: the parameters are "feature alignment dynamic coefficient 0.9, edge adaptation dimension 1024". Correlation with data features: the mapping fit between the 1024-dimensional visual features of the device image and the 512-dimensional spectral features of the audio is 0.88; correlation with model information: the synergy of edge inference layer latency (80ms) is 0.93, generating the correlation factors "alignment parameter - cross-modal feature - edge layer: 0.88; alignment parameter - edge latency - edge layer: 0.93". The fit between maintenance scenarios (real-time protection) and rapid fault detection strategies is 0.95; the fit between peak periods (high concurrency) and lightweight defense strategies is 0.92; and the fit between normal scenarios and cross-plant collaborative strategies is 0.89.

[0079] We performed weighted fusion and effectiveness verification analysis on the correlation factors of model defense parameters, data features, and algorithm modules with dynamic adaptation factors of security protection strategies, generating a quantitative matrix of correlation between protection parameters, data, and algorithms. For the quantitative matrix in the medical field, the weight allocation is as follows: privacy protection (0.4) > real-time performance (0.35) > cross-domain adaptation (0.25), and the correlation factors and dynamic adaptation factors are fused according to this weight. "Causal parameters - CT image perturbation - diagnostic layer" (0.92×0.35 + emergency adaptation factor 0.91×0.4) = 0.787; "Federation parameters - highly sensitive medical records - fusion layer" (0.93×0.4 + consultation adaptation factor 0.94×0.35) = 0.757. Through testing with 1000 medical data, the matching degree between the fusion result and the protection effect is 92.5%. After removing correlation items with an adaptation degree <0.8, the core content of the matrix is ​​generated. Causal Inference Module: "Counterfactual Step Size 0.01 - CT Image Perturbation - Diagnostic Layer" correlation value 0.787; "Causal Threshold 0.85 - Text Tampering - Diagnostic Layer" correlation value 0.762. Federated Prototype Decoupling Module: "Aggregation Weight 0.6 - High-Sensitivity Medical Records - Fusion Layer" correlation value 0.757; "Separation Threshold 0.7 - Low-Sensitivity CT - Fusion Layer" correlation value 0.721. Hierarchical Feature Alignment Network: "Mapping Dimension 2048 - Cross-Modal Features - Input Layer" correlation value 0.743; "Alignment Threshold 0.82 - Single Text - Input Layer" correlation value 0.698.

[0080] For the quantization matrix in the industrial field, the weight allocation is as follows: fault detection accuracy (0.45) > low latency (0.3) > high concurrency (0.25). The correlation factor and dynamic adaptation factor are fused according to this weight. "Causal parameter - audio noise - recognition layer" (0.85×0.45 + maintenance adaptation factor 0.95×0.3) = 0.6775; "Alignment parameter - cross-modal feature - edge layer" (0.88×0.3 + peak period adaptation factor 0.92×0.25) = 0.464. Through testing with 100,000 equipment data from 5 factories, the matching degree is 91.2%. Correlation items with an adaptation degree <0.7 are removed to generate the core content of the matrix. Causal inference module: "Link depth 3 - audio noise - recognition layer" correlation value 0.6775; "Fault threshold 0.8 - image occlusion - recognition layer" correlation value 0.658. Federation Prototype Decoupling Module: "Separation Iteration 5 - High-Sensitive Device Parameters - Distributed Layer" correlation value 0.632; "Aggregation Delay 100ms - Production Plan - Distributed Layer" correlation value 0.598. Hierarchical Feature Alignment Network: "Edge Dimension 1024 - Cross-Modal Features - Edge Layer" correlation value 0.464; "Dynamic Coefficient 0.9 - Single Image - Edge Layer" correlation value 0.423.

[0081] Based on a closed-loop protection architecture using a dynamic defense optimization model and a quantitative matrix relating protection parameters, data, and algorithms, this system integrates dynamic security protection requirements with rules for calling defense modules, threat risk assessment thresholds, and multi-industry compliance constraints to generate requirement-module-constraint correlation features. For cross-hospital consultation privacy protection, based on the matrix "Federated Parameters - High-Sensitive Text - Fusion Layer (0.757, High Adaptability)," it calls a federated prototype decoupling module (weight 0.6) + a hierarchical feature alignment network (weight 0.4). The risk thresholds are: high-sensitivity data privacy inversion success rate ≤ 5%, and cross-hospital transmission latency ≤ 150ms. This complies with the "Personal Information Protection Law" and the "Guidelines for Health Data Security." The correlation features are: "Requirement: Cross-hospital privacy protection; Module: Federated decoupling + Feature alignment; Constraints: Inversion ≤ 5%, Latency ≤ 150ms; Compliance: Personal Information Protection Law + Health Data Security Guidelines."

[0082] To address the need for rapid emergency defense, a matrix based on "causal parameters - CT perturbation - diagnostic layer (0.787, high adaptability)" is used, invoking a causal inference module (weight 0.7) and a time-sensitive gradient correction module (weight 0.3). The risk thresholds are inference latency ≤ 200ms and adversarial attack misjudgment rate ≤ 3%. This meets the real-time requirements of the *Emergency Treatment Guidelines*. The associated features are: "Requirement: Rapid emergency defense; Modules: Causal inference + Time-sensitive correction; Constraints: Latency ≤ 200ms, Misjudgment ≤ 3%; Compliance: *Emergency Treatment Guidelines*".

[0083] To address the need for collaborative fault detection across plant areas, a matrix based on "causal parameters - audio noise - recognition layer (0.6775, medium adaptation)" is used, invoking a causal inference module (weight 0.5) and a federated prototype decoupling module (weight 0.5). The risk thresholds are a fault miss rate ≤2% and cross-plant aggregation latency ≤100ms. This complies with the cross-domain transmission requirements of the "Industrial Data Security Management Measures". The associated characteristics are: "Requirement: Cross-plant fault detection; Modules: Causal inference + federated decoupling; Constraints: Miss rate ≤2%, latency ≤100ms; Compliance: 'Industrial Data Security Measures'".

[0084] To address the need for lightweight protection of edge nodes, a layered feature alignment network (weight 0.4) and a lightweight distillation module (weight 0.6) are invoked based on the matrix "alignment parameters - cross-modal features - edge layer (0.464, medium adaptation)". The risk thresholds are edge model size ≤ 500MB and inference latency ≤ 80ms. This meets the computing power standards for industrial edge devices (CPU usage ≤ 60%). The associated features are: "Requirement: Lightweight edge protection; Module: Feature alignment + Lightweight distillation; Constraints: Size ≤ 500MB, Latency ≤ 80ms; Compliance: Edge device computing power standards".

[0085] Based on a dynamic defense optimization model, the system analyzes and processes the correlation features between requirements, modules, and constraints. Combined with the temporal patterns of threat evolution in an open environment, it generates dynamic security protection information for multimodal basic data. Considering threat evolution over the past three months (cross-modal attacks updated weekly, privacy leaks averaged twice monthly), for "CT image + medical record text" data, it utilizes a causal inference module (counterfactual step size 0.01) and time-sensitive gradient correction to intercept CT image perturbations (amplitude > 0.01) and text tampering, achieving an interception rate ≥ 96% and accuracy loss ≤ 1.5%. For privacy protection, it utilizes a federated prototype decoupling module (separation threshold 0.7), encrypting high-sensitivity medical records with SM9 encryption (key updated 24 hours) and low-sensitivity CT scans with differential privacy (ε = 0.1), achieving an inversion success rate ≤ 1.2%. For cross-hospital collaboration, it utilizes a hierarchical feature alignment network (mapping dimension 2048), achieving cross-hospital transmission latency ≤ 150ms and aggregation accuracy ≥ 92%.

[0086] The dynamic adjustment trigger conditions are as follows: when attack characteristics are updated (perturbation amplitude increases to 0.02), the causal threshold is reduced to 0.82, and the counterfactual step size is adjusted to 0.008. For high-sensitivity data transmission exceeding 500MB / hour, the federated aggregation weight is increased to 0.7, and the key update frequency is changed to once every 12 hours. It complies with the Personal Information Protection Law and the Health Data Guidelines, and encrypts logs and traceability records (stored on the blockchain for 1 year). For emergency scenarios, time-sensitivity correction is prioritized, and latency is compressed to within 200ms; for consultation scenarios, federated aggregation is strengthened to ensure cross-hospital data consistency.

[0087] Based on threat evolution over the past two months (composite attacks iterate once every 10 days, and poisoning attacks occur an average of 3 times per month), data generation targeting "device image + operating audio" is implemented. A causal inference module (link depth 3) and a fault identification module are used to intercept 1.5kHz audio noise and image occlusion, achieving a detection rate of ≥92% and a false positive rate of ≤2.3%. For cross-plant security, a federated prototype decoupling module (aggregation latency 100ms) is used, core device parameters are encrypted using AES-256, and production logs are shared using federated parameters, achieving a cross-domain adaptability rate of ≥95%. For edge protection, a hierarchical feature alignment network (edge ​​dimension 1024) and lightweight distillation are used, resulting in a model size ≤500MB and an inference latency ≤80ms.

[0088] The dynamic adjustment trigger conditions are as follows: when compound attack code iterates (steganography capacity increased to 10KB), the number of federated separation iterations increases to 7, and the alignment similarity threshold increases to 0.85. During peak transmission periods (8:00-10:00), the edge model's concurrent capacity increases from 500 requests / second to 800 requests / second. It complies with the "Industrial Data Security Measures" and "Information Security Level Protection 2.0," with data partitioned according to trust scores (≥90 points for factories storing highly sensitive data), and traceability records retained for 6 months. For maintenance scenarios, real-time fault protection is prioritized, with the causal module having a priority of 0.7; for production scenarios, federated aggregation is strengthened to balance data value and security.

[0089] In one implementation, such as Figure 2 As shown, this application also provides a dynamic data security protection device based on adversarial training under a multimodal large model, comprising: The acquisition module 201 is used to acquire multimodal basic data, intelligent algorithm model information, and dynamic security protection requirements. Processing module 202 is used to perform security association processing on multimodal basic data and intelligent algorithm model information, establish a cross-source association mapping between multimodal basic data and vulnerability detection points of algorithm models, add initial security risk labels to each associated data, embed a model vulnerability tracing module during the association processing, locate the core model modules that need optimization by analyzing the correlation between data threats and model modules, and generate target associated data; the target associated data is decomposed based on the structure of data type-model module-threat type-risk label, and a hierarchical feature alignment network is introduced to achieve cross-modal data feature unification. At the same time, a priority processing caching mechanism is established for high-risk threat associated data to generate Structured security analysis data; for different types of multimodal basic data security threat detection needs, based on the data-model-threat correlation mapping in the structured security analysis data, targeted protection schemes are generated; the protection effect and real-time threat feedback are processed, and a closed-loop training optimization mechanism is designed, using the protection effect index as a loss function constraint term for model training, updating the training sample library in combination with real-time threat characteristics, and iteratively adjusting the model parameters through causal decoupling defense evolution technology to generate a dynamic defense optimization model; based on the dynamic defense optimization model, multimodal basic data and intelligent algorithm model information are processed, and combined with dynamic security protection needs, dynamic security protection information for multimodal basic data is generated.

[0090] The various embodiments in this application are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for evaluating the dynamic data security protection method, electronic device, electronic device, and readable storage medium based on adversarial training under a multimodal large model are basically similar to the above-described embodiments of the dynamic data security protection method based on adversarial training under a multimodal large model, and therefore are described relatively simply. Relevant parts can be referred to in the descriptions of the above-described embodiments of the dynamic data security protection method based on adversarial training under a multimodal large model.

Claims

1. A dynamic data security protection method based on adversarial training under a multi-modal large model, characterized in that, Comprise: Obtaining multi-modal basic data, intelligent algorithm model information and dynamic security protection demand; Performing security correlation processing on the multi-modal basic data and the intelligent algorithm model information, establishing cross-source correlation mapping of the multi-modal basic data and the algorithm model vulnerability detection points, adding a security risk initial label to each piece of correlated data, embedding a model vulnerability traceability module in the correlation processing process, positioning the core model module that needs to be optimized by analyzing the correlation degree of data threats and model modules, and generating target correlated data; Splitting the target correlated data based on the structure of data type-model module-threat type-risk label, realizing cross-modal data feature unification by introducing a hierarchical feature alignment network, establishing a priority processing cache mechanism for high-risk threat correlated data, and generating structured security analysis data; Generating a targeted protection scheme based on the data-model-threat correlation mapping in the structured security analysis data for different types of multi-modal basic data security threat detection requirements; Processing the protection effect and real-time threat feedback, designing a closed-loop training optimization mechanism, taking the protection effect index as a loss function constraint term of model training, updating the training sample library combined with real-time threat features, iteratively adjusting the model parameters through the causal decoupling defense evolution technology, and generating a dynamic defense optimization model; Processing the multi-modal basic data and the intelligent algorithm model information based on the dynamic defense optimization model, generating multi-modal basic data dynamic security protection information combined with the dynamic security protection demand.

2. The method of claim 1, wherein, Performing security correlation processing on the multi-modal basic data and the intelligent algorithm model information, establishing cross-source correlation mapping of the multi-modal basic data and the algorithm model vulnerability detection points, adding a security risk initial label to each piece of correlated data, embedding a model vulnerability traceability module in the correlation processing process, positioning the core model module that needs to be optimized by analyzing the correlation degree of data threats and model modules, and generating target correlated data, comprising: Performing feature extraction and threat feature recognition on the multi-modal basic data, using a deep feature extraction network that fuses attention mechanisms and graph neural networks to automatically extract adversarial perturbation features, privacy sensitive features, and abnormal data features from text, image, and audio data, and generating multi-modal basic data feature and threat type correlation information; Performing vulnerability detection point analysis on the intelligent algorithm model information, extracting model architecture, parameter configuration, and historical vulnerability record information, generating an algorithm model vulnerability detection point and module mapping table and vulnerability risk level information; Performing cross-source correlation processing on the multi-modal basic data feature and threat type correlation information and the algorithm model vulnerability detection point and module mapping table, calculating the correlation degree of the multi-modal basic data feature and the model detection point through a deep spatio-temporal causal network, establishing cross-source correlation mapping of the multi-modal basic data and the algorithm model vulnerability detection points, and generating a cross-source correlation mapping table; The embedded model vulnerability tracing module assigns a threat impact weight to each threat type based on the correlation degree data, threat type, and vulnerability level in the cross-source correlation mapping table, and then combines the module correlation strength to prioritize the calculation rule of threat impact weight x module correlation strength, locates the model core module that needs to be optimized in priority, and records the module optimization priority and improvement direction based on the generated vulnerability risk level information to form a tracing result table of model core module-optimization priority-improvement scheme; An initial security risk label is added to each piece of correlation data in the cross-source correlation mapping table, combined with the vulnerability risk level and threat type label, and associated with the data collection timestamp and model version information. The multi-modal basic data features, model detection point information, security risk label, timestamp, and model version label are integrated to generate target correlation data.

3. The method of claim 1, wherein, The target correlation data is split based on the structure of data type-model module-threat type-risk label, and a hierarchical feature alignment network is introduced to unify the cross-modal data features. A priority processing cache mechanism is established for high-risk threat correlation data to generate structured security analysis data, including: The target correlation data is split based on the hierarchical structure of data type-model module-threat type-risk label, and the core information of each dimension is extracted to generate dimensionally split data. The multi-modal basic data features in the dimensionally split data are uniformly processed, and a hierarchical feature alignment network is introduced to analyze the feature differences of different modal data. Cross-modal feature mapping is used to unify the feature space and generate feature-unified data. The risk level in the feature-unified data is identified and filtered. For correlation data labeled as high-risk threats, a priority processing cache mechanism is established to generate high-risk cache data. The feature-unified data and high-risk cache data are integrated and processed to supplement the data collection timestamp, model version information, and associated detection point details to generate structured security analysis data.

4. The method of claim 1, wherein, Based on the data-model-threat correlation mapping in the structured security analysis data, targeted protection schemes are generated for different types of multi-modal basic data security threat detection needs, including: The data-model-threat correlation mapping in the structured security analysis data is analyzed to extract multi-modal basic data features, model vulnerability detection points, and risk level information corresponding to different threat types to generate threat-data-model correlation details. For adversarial attack threats, based on the data features and model vulnerabilities in the correlation details, causal reasoning and dynamic defense technology are fused to analyze the causal relationship between attack features and model vulnerabilities through a deep spatio-temporal causal network. An interpretable adversarial sample defense strategy is generated by combining counterfactual intervention, and a time-sensitive gradient correction algorithm is used to dynamically resist real-time attacks to generate an adversarial attack special protection scheme. For backdoor attack threats, based on the abnormal data features related to backdoor implant in the correlation details and model module mapping, a federated prototype decoupling technology is used to separate normal and abnormal feature representations. A trusted evaluation module based on backdoor adjustment counterfactual reasoning is used to dynamically identify backdoor trigger conditions to generate a backdoor attack special protection scheme. In view of the cross-domain multi-modal basic data security management needs, based on the cross-device data characteristics in the association details and the distributed model information, a hierarchical feature alignment network is constructed to realize robust aggregation of cross-modal data, a federal hierarchical privacy collaboration engine is integrated to generate a cross-domain data security protection scheme; Integrate the above protection scheme, combine multi-industry business scenarios and compliance requirements, supplement industry customized rules, and integrate explainability modules to generate targeted protection schemes covering multiple threat types and multiple application scenarios.

5. The method of claim 1, wherein, Process the protection effect and real-time threat feedback, design a closed-loop training optimization mechanism, use the protection effect index as the loss function constraint term of model training, update the training sample library combined with real-time threat features, iteratively adjust the model parameters through the causal decoupling defense evolution technology to generate a dynamic defense optimization model, including: Extract and analyze the actual protection effect of the targeted protection scheme, collect the core indicators of attack interception rate, model precision retention rate, cross-domain defense adaptation degree, and sensitive data protection compliance, and generate protection effect basic evaluation data; Process real-time threat feedback information in an open environment, track new attack patterns through multi-modal adversarial disturbance dynamic detection technology, extract attack feature update information and threat evolution trend, and generate real-time threat feature dataset; Design a closed-loop training optimization mechanism, use the core indicators in the protection effect basic evaluation data as the loss function constraint term of model training, and construct the mapping relationship between protection effect and loss value; At the same time, update the training sample library combined with the real-time threat feature dataset, dynamically expand the adversarial samples and backdoor attack samples according to the proportion of new threat samples≥30% and the proportion of historical effective samples≥70%, analyze the causal relationship between index short board and model parameters through causal decoupling defense evolution technology, iteratively adjust the core parameters to improve the short board, form a closed-loop link of index constraint-sample update-parameter optimization; Correlate the protection effect basic evaluation data and the real-time threat feature dataset, further locate the causes of the short board based on the causal relationship that has been preliminarily analyzed in the above closed-loop training optimization mechanism, and generate a protection scheme optimization direction detail; Based on the protection scheme optimization direction, integrate the meta-learning driven self-evolution mechanism to iteratively optimize the protection model parameters, dynamically adjust the defense strategy according to the attack feature update, and adapt to edge scenarios combined with lightweight defense migration deployment technology, to generate a preliminary optimization model; Multi-dimensional verification is performed on the preliminary optimization model, the model's anti-interference ability is verified through noise robustness testing, and the data protection effect is verified through privacy inversion testing, the model bias is corrected combined with the actual business feedback of multi-industry demonstration application scenarios, and a dynamic defense optimization model is generated.

6. The method of claim 5, wherein, Based on the dynamic defense optimization model, process multi-modal basic data and intelligent algorithm model information, generate multi-modal basic data dynamic security protection information combined with dynamic security protection needs, including: The causal reasoning module, the federal prototype decoupling module, the hierarchical feature alignment network parameters and the multi-modal basic data, the intelligent algorithm model information in the dynamic defense optimization model are associated and analyzed to generate model defense parameter-data feature-algorithm module correlation factors and security protection strategy dynamic adaptation factors; The model defense parameter-data feature-algorithm module correlation factors and security protection strategy dynamic adaptation factors are subjected to weight fusion and effectiveness verification analysis to generate protection parameter-data-algorithm correlation quantization matrix; Based on the closed-loop protection architecture of the dynamic defense optimization model, the protection parameter-data-algorithm correlation quantization matrix, combined with dynamic security protection requirements, the defense module calling rules, threat risk judgment thresholds, and multi-industry compliance constraints corresponding to different protection requirements are fused to generate requirement-module-constraint correlation features; Based on the dynamic defense optimization model, the requirement-module-constraint correlation features are analyzed and processed, combined with the threat evolution time sequence law in an open environment, to generate multi-modal basic data dynamic security protection information.

7. A dynamic data security protection device based on adversarial training under a multi-modal large model, characterized in that, The device is configured to execute the multi-modal large model based dynamic data security protection method based on adversarial training according to any one of claims 1-6 by executing the executable instructions.

8. An electronic device, comprising: It comprises: a first processor; and a memory for storing executable instructions of the first processor; wherein the first processor is configured to execute the multi-modal large model based dynamic data security protection method based on adversarial training according to any one of claims 1-6 by executing the executable instructions.

Images