Hierarchical collaborative large language model security reasoning method and system

Abstract

This invention discloses a hierarchical collaborative method and system for secure reasoning using a large language model, belonging to the field of secure reasoning technology for large models. The method includes: on the client side, firstly, named entity recognition is performed on the original document, and sensitive proper nouns are replaced with secure generalized descriptors based on entity type and differential privacy mechanisms, generating an intermediate document and entity type metadata; subsequently, the intermediate document undergoes lexical-level differential privacy semantic perturbation to generate a perturbed document; the perturbed document is sent to a cloud-based large language model to obtain the initial generated text; finally, on the client side, a local lightweight model is used to generate high-quality final text based on entity type metadata, context, and the initial text returned from the cloud. This invention, through a hierarchical collaborative privacy protection framework and under provable differential privacy protection, solves the problem of balancing proper noun protection and generation quality, and is suitable for secure reasoning scenarios involving sensitive texts in finance, healthcare, and other fields.

Description

Technical Field

[0001] This invention belongs to the field of large model secure reasoning technology, specifically relating to a method and system for performing privacy protection processing on user input text and generating high-quality text in an untrusted large language model service environment. It is particularly suitable for reasoning scenarios that protect the privacy of domain texts (such as financial, medical, and legal texts) containing sensitive proper nouns. Background Technology

[0002] In the current ecosystem of large language model services, there are two main technical approaches to protecting user input privacy. One is secure multi-party computation schemes based on homomorphic encryption, such as CipherGPT, which can perform reasoning on ciphertext but incurs huge computational and communication overhead, making it difficult to implement in practice. The other is text perturbation methods based on local differential privacy, such as SANTEXT+ and CUSTEXT+, which achieve privacy protection by adding noise to the text on the client side. However, these methods are mainly designed for classification tasks, and the semantic noise they introduce can severely disrupt the coherence and consistency necessary for text generation tasks, leading to a significant decrease in the quality of generated content.

[0003] In particular, existing perturbation techniques face fundamental challenges in text generation scenarios involving proper nouns. Advanced mechanisms, such as RANTEXT, directly discard proper nouns outside the model's vocabulary to meet strict privacy definitions, resulting in the loss of key information and severely impacting the generation quality in fields such as finance and healthcare. While methods like CUSTEXT+ attempt to retain more semantics, their fixed and small-scale candidate sets make the perturbations easily reverse-engineered, failing to maintain text utility while protecting proper noun privacy, constituting the main drawback of current technologies.

[0004] Therefore, there is an urgent need for a secure reasoning technology for large language models that can safely generalize proper nouns while maintaining semantic coherence and domain fidelity under provable privacy protection. Summary of the Invention

[0005] The present invention aims to resolve the contradiction between strong privacy protection and high generation quality when performing privacy protection processing on text containing sensitive proper nouns in an untrusted large language model service environment.

[0006] Accordingly, this invention provides a hierarchical collaborative method and system for secure reasoning in large language models. The solution of this invention uses a structured and provable privacy protection mechanism to identify and securely generalize proper nouns in the input text before perturbation, avoiding privacy leaks or information loss caused by their being discarded or directly exposed. At the same time, on this basis of security, more refined semantic-level differential privacy perturbation is implemented on the whole text, achieving a better balance between privacy protection strength and generated text utility than existing methods, under the premise of controllable overall privacy budget.

[0007] To achieve the above objectives, the present invention provides the following specific solution: Option 1: A hierarchical collaborative method for secure reasoning in large language models, comprising: Proper noun recognition and secure mapping: Named entity recognition is performed on the original document on the client side to obtain the entities and their types; based on the entity type, a list of candidate generalization words is obtained from a pre-built secure mapping dictionary, and a generalization word is randomly selected through a differential privacy mechanism to replace the corresponding entity in the original document to generate an intermediate document, while recording metadata containing the entity type sequence; Differential privacy semantic perturbation: The intermediate document is segmented into words, and a differential privacy mechanism is used to perform semantically aware perturbation on each word to generate a perturbed document that can be securely transmitted. Remote model inference: The perturbation document is sent to a third-party large language model service to obtain the initial generated text; Context-aware extraction and text reconstruction: On the client side, using a local lightweight language model, the final text is generated based on the entity type sequence in the metadata, the partial context of the intermediate document, and the initial generated text.

[0008] Furthermore, the proper noun recognition and security mapping specifically includes: Load the named entity recognition engine and the domain-adapted secure mapping dictionary; the secure mapping dictionary uses entity type as key, each key corresponds to a list of candidate words consisting of general and fuzzy descriptive phrases, and the candidate words all belong to the public vocabulary of the target large language model; The original document is subjected to text normalization processing, and the named entity recognition engine is used for entity recognition and post-processing. The post-processing includes overlap resolution and cross-sentence entity merging to obtain an ordered and conflict-free entity list. Each entity contains the original text, start position, end position and entity type. For each entity in the entity list, a corresponding candidate word list is retrieved according to its type, and a scoring function unrelated to the original entity text content is applied in combination with an index mechanism to perform random sampling and select replacement words. The mapping relationships are recorded as mapping records. All mapping records are arranged in descending order of their starting positions. The original entities are replaced with the corresponding replacement words in the copy of the original document to generate the intermediate document.

[0009] Furthermore, the application uses a scoring function independent of the original entity text content, combined with an exponential mechanism, for random sampling, specifically including: A generality score is predefined for each candidate word in the candidate word list. The generality score is calculated based on the inverse document frequency of the candidate word in a large public corpus and / or the variance of the semantic vector of the candidate word in a set of similar candidate words, and is independent of the specific text content of the current original entity. Based on the generality score and the privacy budget of the current module, the index mechanism weight of each candidate word is calculated, and all weights are normalized to obtain the sampling probability distribution. A candidate word is randomly selected as the replacement word based on the sampling probability distribution, and this process satisfies ε-LDP.

[0010] Furthermore, the differential privacy semantic perturbation specifically includes: Input validation confirms that all words in the intermediate document belong to the public vocabulary of the target large language model; Load the pre-trained semantic embedding model and the public vocabulary, and set the privacy budget and embedding model sensitivity for this module; For each word in the intermediate document, its embedding vector is obtained using the semantic embedding model as a baseline semantic vector; A noise vector is sampled from the Laplace distribution, the reference semantic vector is perturbed to obtain a noisy vector, and the Euclidean distance between the reference semantic vector and the noisy vector is calculated as a dynamic distance threshold. Traverse the public vocabulary and retrieve all lexical units whose distance from the baseline semantic vector is less than the dynamic distance threshold to form a random adjacency candidate set; The utility function is defined based on the semantic distance between candidate words and original lexical units. The selection probability of each candidate word is calculated through an exponential mechanism and normalized. Perturbation lexical units are obtained by random sampling according to probability. All perturbation tokens are concatenated in their original order to generate the perturbation document, which satisfies differential privacy protection.

[0011] Furthermore, the context-aware extraction and text reconstruction specifically include: Receive the metadata from the proper noun recognition and security mapping module, the metadata including a sequence of entity types recorded in the order of their appearance in the original text; Receive the initial generated text from the inference of the remote model; Construct an enhanced system prompt, the enhanced system prompt comprising: the intermediate document or its context containing generalized entities, entity role descriptions generated based on the entity type sequence, and at least a portion of the initial generated text; The enhanced system prompt is input into a local lightweight language model. The local lightweight language model is constrained by the entity type information during generation to generate a description that matches the entity type at the corresponding position. At the same time, it integrates the content and expression in the initially generated text and avoids outputting specific real proper nouns. The generated text is output as the final text.

[0012] Furthermore, the proper noun recognition and security mapping is configured with a first privacy budget, and the differential privacy semantic perturbation is configured with a second privacy budget. The sum of the first privacy budget and the second privacy budget constitutes the overall privacy budget. The proportion of the first privacy budget to the overall privacy budget is less than that of the second privacy budget.

[0013] Furthermore, the named entity recognition engine supports the recognition of standard entity types and extended domain types. The standard entity types include at least one of PERSON, ORG, GPE, and DATE, and the extended domain types include at least one of MEDICAL, FINANCIAL, and LAW.

[0014] Option 2: A hierarchical collaborative large language model secure reasoning system, comprising: The proper noun recognition and security mapping module is used to perform named entity recognition on the original document on the client side, obtain the entity and its type, obtain a list of candidate generalization words from the pre-built security mapping dictionary based on the entity type, and randomly select a generalization word through differential privacy mechanism to replace the corresponding entity in the original document, generate an intermediate document, and record metadata containing the entity type sequence at the same time. The differential privacy semantic perturbation module is used to segment the intermediate document into words and use a differential privacy mechanism to perform semantically aware perturbation on each word to generate a perturbation document that can be securely transmitted. A remote model inference interface is used to send the perturbation document to a third-party large language model service and obtain the initial generated text; The context-aware extraction and text reconstruction module is used on the client to generate the final text based on the entity type sequence in the metadata, the partial context of the intermediate document, and the initial generated text, using a local lightweight language model.

[0015] Furthermore, the proper noun recognition and security mapping module includes: The component loading unit is used to load the named entity recognition engine and the domain-adaptive security mapping dictionary. The security mapping dictionary uses entity type as the key, and each key corresponds to a list of candidate words consisting of general and fuzzy descriptive phrases. All candidate words belong to the public vocabulary of the target large language model. The entity recognition and post-processing unit is used to perform text normalization, entity recognition, overlap resolution and cross-sentence entity merging on the original document, and output an ordered and conflict-free entity list. The differential privacy mapping unit is used to retrieve a list of candidate words for each entity based on its type, and randomly select replacement words using a scoring function that is independent of the original entity content combined with an exponential mechanism. The document reconstruction unit is used to replace the replacement words in the original document in reverse order according to the starting position of the entity, and generate an intermediate document and the metadata.

[0016] Furthermore, the differential privacy semantic perturbation module includes: An input verification unit is used to confirm that all words in the intermediate document belong to the public vocabulary of the target large language model; The embedding and noise generation unit is used to obtain the embedding vector of each word using a pre-trained semantic embedding model, and to perturb the embedding vector by sampling noise vectors from a Laplace distribution; The dynamic adjacency candidate set construction unit is used to calculate the dynamic distance threshold and retrieve all lexical units in the public vocabulary that are within the dynamic distance threshold to form a random adjacency candidate set; The exponential mechanism sampling unit is used to randomly select perturbation lexical units based on the semantic distance between candidate words and original lexical units using an exponential mechanism; The document synthesis unit is used to concatenate all the perturbation tokens in their original order to generate the perturbation document.

[0017] Furthermore, the context-aware extraction and text reconstruction module includes: A prompt construction unit is used to construct an enhanced system prompt, the enhanced system prompt including the intermediate document or its context containing generalized entities, entity role descriptions generated based on the entity type sequence, and at least a portion of the content of the initial generated text; The local model inference unit is used to load a local lightweight language model and input the enhanced system prompts into the local lightweight language model to generate a final text that is constrained by entity type information and integrates the content and expression in the initial generated text.

[0018] Option 3: A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above method.

[0019] Solution 4: An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0020] Compared with the prior art, the present invention has the following significant advantages: It balances proper noun privacy with generation quality: It is the first to achieve "semantic abstraction" of proper nouns under the local differential privacy framework instead of simply discarding them. Through a secure mapping dictionary and index mechanism, it retains the key semantic information of entity type under provable privacy protection, effectively solving the problem of semantic fragmentation and sharp decline in generation quality caused by discarding or over-generalizing proper nouns in existing perturbation techniques.

[0021] It provides provable, hierarchical privacy protection: by allocating independent differential privacy budgets for proper noun mapping and full-text semantic perturbation, it achieves composite privacy protection from the entity level to the lexical level. The entire processing pipeline has a quantifiable upper bound on privacy loss, and its security is explainable and demonstrable.

[0022] It achieves efficient and practical edge-cloud collaborative inference: placing the responsibility of privacy protection entirely on the client side, sending only the perturbed non-sensitive text to the large cloud model, making full use of the powerful generation capabilities of the cloud model, while completing the final context-aware reconstruction through a local lightweight model, thus balancing privacy, generation quality and inference efficiency.

[0023] Widely applicable to domain-specific text generation scenarios: The secure mapping dictionary and entity type guidance mechanism have good domain scalability and can flexibly replace dictionaries and named entity recognition engines in different fields such as finance, healthcare, and law. It is suitable for various generative tasks that require the protection of user data privacy, such as intelligent writing assistance, report generation, and multilingual translation. Attached Figure Description

[0024] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0025] Figure 1 This is an overall flowchart of the hierarchical collaborative large language model secure reasoning method in this invention.

[0026] Figure 2 This is an overall system block diagram of the hierarchical collaborative large language model secure reasoning system in this invention. Detailed Implementation

[0027] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.

[0028] This invention proposes a layered, collaborative, large language model secure inference scheme. It decomposes the two objectives of sensitive information deconstruction and semantic generation capabilities into a three-layered, progressive processing pipeline involving the client and the cloud. Unlike existing technologies, this invention does not attempt to simultaneously address the conflicting tasks of privacy protection and text utility maintenance in a single step, nor does it employ overall discarding or simple noise-adding strategies. Conversely, this invention creatively constructs three complementary and progressively layered processing stages: The first layer, "property term recognition and secure mapping," performs "semantic abstraction" on sensitive entities under provable differential privacy protection, rather than simply discarding them. Utilizing a secure mapping dictionary and index mechanism based on entity type, it accurately preserves the crucial semantic role information of entity type while eliminating specific referents. The second layer, "differential privacy semantic perturbation," builds upon this by performing fine-grained semantic perception perturbation at the lexical level on the desensitized intermediate document, providing full-text-level composite differential privacy protection. The third layer, "context-aware extraction and text reconstruction," fully utilizes the structured metadata (entity type sequence) retained in the first two layers, integrates the powerful generation capabilities of the cloud-based large model, and generates high-quality, domain-consistent final text by a local lightweight model under the constraint of entity type information.

[0029] This invention is the first to achieve "typed semantic abstraction" of sensitive proper nouns within a local differential privacy framework, resolving the fundamental contradiction in existing technologies where "discarding leads to information loss" and "retention leads to privacy leakage." This invention achieves hierarchical and quantifiable composite privacy protection by configuring independent privacy budgets for entity-level mappings and lexical-level perturbations. Furthermore, this invention utilizes a metadata-driven context-aware reconstruction mechanism, enabling the local lightweight model to "understand" the semantic roles of generalized entities, thereby outputting coherent text highly consistent with the original context without accessing original sensitive information.

[0030] The present invention will be described in detail below from three aspects: method embodiments, system embodiments, and application examples.

[0031] Method Implementation Examples This embodiment provides a layered collaborative method for secure reasoning of large language models, which can be deployed on user client devices (such as personal computers, workstations, mobile terminals, etc.) and implemented through computer programs. The processor executes corresponding program instructions to complete each step of the process. Figure 1As shown in the overall flowchart, this method includes the following four core steps: proper noun recognition and secure mapping (step S1), differential privacy semantic perturbation (step S2), remote model inference (step S3), and context-aware extraction and text reconstruction (step S4). These four steps are closely linked in the logical order of "protection first, perturbation later, external inference, and internal reconstruction", forming a complete privacy-preserving inference logic scheme.

[0032] Step S1: Proper noun recognition and secure mapping.

[0033] This step is the first processing step in the entire method, responsible for identifying and securely transforming sensitive proper nouns in the original document locally on the client side. Unlike existing technologies that directly discard or replace them with a fixed candidate set, this step preserves entity type information within a differential privacy framework. By performing "semantic abstraction" on proper nouns rather than simply discarding them, it lays the foundation for solving the semantic gap problem in subsequent generation tasks.

[0034] This step specifically includes: Step S1.1: First, perform initialization and resource preparation, including component loading and parameter configuration.

[0035] A lightweight named entity recognition engine (a distilled version of the BERT-NER model in this embodiment) is loaded. This engine runs offline locally and supports the recognition of standard entity types (PERSON, ORG, GPE, DATE, etc.) and extended domain types (MEDICAL, FINANCIAL, LAW, etc.). Simultaneously, a domain-adapted secure mapping dictionary is loaded. This dictionary is a predefined structured data set, with entity type as the key, and each key corresponding to a list of secure candidate words. The candidate words in the list are all general, fuzzy descriptive phrases (e.g., under the PERSON type, it includes "the patient," "a customer," "related personnel," etc.; under the MEDICAL type, it includes "a certain oral hypoglycemic drug," "a type of SGLT2 inhibitor drug," "a certain type of antibiotic," etc.), ensuring that all words belong to the public vocabulary V of the target large language model. The dictionary can be flexibly switched according to application scenarios such as finance, healthcare, and general applications.

[0036] In addition, configure the following parameters to set a dedicated privacy budget for this step. This value typically accounts for a small proportion of the total budget ε, such as 20%, and the confidence threshold of the named entity recognition engine (such as 0.75) is used to filter low-confidence recognition results, balancing recall and precision.

[0037] Step S1.2: Perform document parsing and entity recognition.

[0038] The document is preprocessed first: the original input document is normalized, including unifying character encoding, standardizing whitespace characters, and handling special punctuation, to ensure the accuracy of subsequent character position calculations.

[0039] Next, sentence segmentation and parallel recognition are performed: the document is divided into a list of sentences, and entity recognition can be performed on multiple sentences in parallel to improve efficiency. The recognition process outputs a four-tuple of information for each entity: (original text, start character offset, end character offset, entity type).

[0040] Finally, the recognition results are post-processed, including: Overlap resolution: If two identified entities overlap in the text range, one of them is retained based on the identification confidence or a preset priority rule (such as "long entity priority"). Cross-sentence entity merging: For the same entity separated by punctuation or line breaks (such as "micro" and "soft"), they are merged according to grammatical rules; This ultimately forms an ordered, conflict-free list of entities. .

[0041] Step S1.3: Perform a security mapping based on local differential privacy.

[0042] This step is for each entity. Perform the following operations independently: First, perform candidate set retrieval: based on entity Type Retrieve the corresponding list of security candidate words from the security mapping dictionary. , where K is a fixed size (e.g., 20).

[0043] Next, a scoring function independent of the original content is constructed: for each safe candidate word... Predefine a "generality score". This score reflects the ambiguity and universality of the word, and the calculation is based on the following criteria: The inverse document frequency of the current word in a large public corpus; the more common the word, the lower the frequency and the higher the score. The variance of the semantic vector of the current word in the set of candidate words of the same kind, where a small variance indicates semantic concentration, low specificity, and a high score.

[0044] It is important to note that this score is designed to be completely independent of the original entity text being processed. This is key to satisfying the definition of differential privacy without revealing the original semantics.

[0045] Subsequently, an exponential mechanism is applied to perform randomization mapping: For candidate words The probability weight of its selection is calculated as follows: ,in This is the global sensitivity of the scoring function g. Since g is predefined or calculated based on publicly available data, its maximum variation can be normalized to... .

[0046] For list The weights of all candidate words are normalized to obtain the probability distribution: Based on this probability distribution, a random sampling is performed to select the final replacement word. This process satisfies The same original entity may map to different security terms when processed at different times or in different contexts. Simultaneously, the mapping relationships are recorded: .

[0047] Step S1.4: Perform document reconstruction and metadata generation.

[0048] This step is mainly achieved through the following sub-steps: First, perform a reverse order replacement: to avoid positional shifts caused by text replacement, record all mappings. According to its starting position Sort the list from largest to smallest. Then iterate through the sorted list, copying each element from the original document. Replace directly with the corresponding .

[0049] Next, intermediate document generation is performed: after all replacements are completed, the intermediate document is obtained. All sensitive entities in this document have been replaced with generalized descriptors. Auxiliary metadata is also generated: a list of type tags for the replaced entities recorded in the original order of appearance, for example... ;Will The metadata packet containing the entity type sequence is output to the next module. This metadata packet contains only type labels and no raw text content, and is therefore considered non-sensitive information.

[0050] This step S1 differs from RANTEXT in that it directly discards proper nouns, resulting in information loss, and it also differs from CUSTEXT+ in that it uses a fixed small candidate set, leading to privacy risks. By using a secure mapping dictionary and index mechanism based on entity types within a differential privacy framework, it achieves "semantic abstraction" of proper nouns under provable privacy protection, thus preserving crucial entity type information.

[0051] Step S2: Differential privacy semantic perturbation.

[0052] This step receives the intermediate document generated in step S1, which no longer contains sensitive entities. This involves performing fine-grained perturbations on the entire word group and semantically aware components. Unlike step S1, which focuses on entity-level privacy protection, this step focuses on semantic-level protection of ordinary words. The two are complementary in function and independently configured in terms of privacy budget, together forming a hierarchical and composite privacy protection mechanism.

[0053] This step specifically includes the following sub-steps: Step S2.1: Perform input validation and confirmation. All words in the dataset belong to the public vocabulary V. Due to the guarantee provided in step S1, this verification usually passes quickly, with very few outlier words being replaced with [UNK] tokens. Next, the public vocabulary V and the pre-trained semantic embedding model are loaded. (This embodiment uses text-embedding-3-small, with an output dimension d=512.) This model can handle any... Mapped to d-dimensional real vector Set your privacy budget for this step. Preferred components should account for a major portion of the total budget, such as 80%, and the sensitivity of the embedded model should be considered. Typically, the maximum change is normalized by embedding vector normalization. .

[0054] Step S2.2: For Each lexical x in the sequence undergoes the following perturbation operation in turn: Obtain the baseline semantic vector, and calculate .

[0055] Generate dynamic perturbation radius: sample noise vector η from d-dimensional Laplace distribution Independent sampling in the middle, where the scale parameter , It is a general A function mapped to the scaling factor ensures the privacy budget is used correctly; the noise vector is computed. ; Calculate dynamic distance threshold (Euclidean distance). This threshold R is random due to noise. The randomness of the disturbance determines the size of the candidate range.

[0056] Constructing a random adjacency list: Initializing an empty list Iterate through each word w in the vocabulary V and calculate its embedding. and distance If dist < R, then add w to the candidate set. This list contains all semantically located... Words within a hypersphere centered at R and with radius R.

[0057] Semantic-aware exponential sampling: Defining the utility function This function value is between (0, 1]. The closer the candidate word is to the original word, the higher the utility. According to the exponential mechanism, the probability of candidate word y being selected is proportional to... ;right Calculate this value for all candidates and normalize it to obtain the complete probability distribution; then, randomly select a word based on the above probability distribution. As a result of the perturbation of x, the position of x in the original document is marked as... .

[0058] Step S2.3: After perturbing all tokens, concatenate the resulting perturbed token sequences in their original order to generate the final perturbed document. . The generation process satisfies Combined with step S1 The currently processed documents meet the requirements. This document can be directly and securely sent to a third-party large language model service for inference.

[0059] Step S2 of this invention employs a dynamic distance threshold and a semantically aware exponential mechanism, enabling the perturbation range to adaptively adjust according to the randomness of noise. This ensures both the strictness of differential privacy and, as far as possible, maintains the semantic coherence of the text. Furthermore, its independent configuration from the privacy budget in step S1 ensures that the entire pipeline has a quantifiable upper bound on privacy loss, making its security explainable and demonstrable.

[0060] As further explained, steps S1 and S2 in this invention form an organic logical cooperation scheme: Step S1 first performs secure semantic abstraction on the "hard sensitive information" (proper nouns) in the document to generate an intermediate document; Step S2 then performs word-level perturbation on the intermediate document whose specific references have been eliminated. This sequential design of "entity abstraction first, then full-text perturbation" avoids the semantic distortion or privacy leakage that may be caused by directly embedding perturbations on the original proper nouns, and also avoids the risk of leaving ordinary word fingerprints when only entity abstraction is performed. The two work together to achieve comprehensive privacy protection from the entity level to the word level.

[0061] Step S3: Remote model inference.

[0062] This step serves as a connection between the client and the cloud service, and will generate the perturbation document in step S2. As a prompt part of the inference request, it is sent via a secure network connection to a designated third-party large language model service (such as GPT-5). The third-party service, leveraging its powerful language understanding and generation capabilities, processes the input perturbation document and returns the initial perturbation-generated text. .

[0063] Because the input document has undergone rigorous differential privacy processing in steps S1 and S2, all sensitive entities have been replaced by generalized descriptors, and ordinary words have been semantically perturbed, making it impossible for third-party services to recover any original sensitive information. Meanwhile, since the generalized document still maintains its basic language structure and semantic framework, the large cloud-based model can still generate meaningful content based on its pre-trained knowledge.

[0064] Step S4: Context-aware extraction and text reconstruction.

[0065] This step, as the final output of the method of this invention, runs on the client side and is responsible for integrating the structured information of the original document with the preliminary generation results of the cloud model to produce high-quality, secure final text. Unlike existing technologies that rely solely on cloud output or simple local post-processing, this step utilizes the entity type metadata retained in step S1 to drive a local lightweight model to perform "context-aware" constraint generation, thereby restoring the professionalism and coherence of the text without needing to access original sensitive information.

[0066] Specifically, this step, in its implementation, includes the following sub-steps: Step S4.1: First, perform input aggregation. Receive the metadata packet from step S1, specifically the entity type sequence recorded in the original text order (e.g., [PERSON, MEDICAL, MEDICAL]); receive the data from step S3, processed by a third-party large language model. The initial perturbation returned later generates text. .

[0067] Step S4.2: Construct Enhanced System Prompts. This step integrates the above information by designing a structured prompt template. This template includes the following key parts: Original context section: Insert here Or it may contain the context of a generalized entity, such as "A 65-year-old male patient presented with poor glycemic control. He had a history of long-term use of a certain oral hypoglycemic agent and recently added an SGLT2 inhibitor..."; Important background section: Explicitly indicate the entity type represented by each generalization term. For example, in the original context, "{generalization term A}" represents an entity type A, and "{generalization term B}" represents an entity type B. For instance: "In the original context, 'the patient' represents a PERSON type entity, 'a certain oral hypoglycemic drug' represents a MEDICAL type entity, and 'an SGLT2 inhibitor drug' represents a MEDICAL type entity." Reference text section: Insert the initial generated text obtained from the large model in the cloud here. Or its key segments; The generation instruction section requires that, based on the original context and referencing the useful content and style of the reference text, a logically coherent continuation text that conforms to common sense in the domain should be generated, while maintaining the reasonable roles of each entity type in the text, but without inventing specific names.

[0068] The key to this hint is that it explicitly indicates entity type information, providing the local model with semantic role clues lost in step S1; it also provides... As a source of "knowledge distillation," local models can draw upon the fluent expressions and professional logic of cloud models.

[0069] Step S4.3: Perform local model inference and constraint generation. Call the open-source language model with a small parameter size deployed on the user's local device (Qwen3-7B is used in this embodiment). Input the constructed enhancement hints into the local model. The local model is subject to the following three constraints during generation: (1) Constrained by the "entity type" information in the prompt, a description that matches the type is generated in the corresponding position. For example, for an entity of type "financial institution", statements related to banks, investments, and financial statements are generated. (2) Reference The text is used to extract fluent phrases, logical chains, or professional knowledge, which are then integrated and refined. (3) Automatically avoid outputting any specific, real proper nouns.

[0070] Finally, the local model outputs the continuation text. This is the final result of the entire secure reasoning method. The result not only protects the privacy of sensitive entities in the original document but also fully utilizes the generation capabilities of large cloud models and the understanding of entity structures by local models, achieving high-quality text output.

[0071] As further explained, steps S3 and S4 in this invention form an organic logical cooperation scheme: Step S3 sends the privacy-protected document to the cloud to obtain preliminary generation results; Step S4 then "refines" and "reconstructs" the cloud results on the client side. This collaborative mode of "cloud-based coarse generation and local fine processing" not only utilizes the massive knowledge and powerful generation capabilities of the cloud-based large model, but also corrects inaccurate expressions or logical inconsistencies that may be caused by disturbances through the local model's understanding of entity type information, ultimately achieving an optimal balance between privacy and utility.

[0072] As can be seen from the above, the method of this invention systematically solves the technical contradiction in existing technologies where "protecting the privacy of proper nouns" and "maintaining the quality of text generation" are mutually exclusive through a layered and collaborative three-layer pipeline. The first layer, secure mapping, performs semantic abstraction of sensitive entities under provable differential privacy protection, avoiding the information loss problem caused by direct discarding in RANTEXT and other methods. The second layer, semantic perturbation, provides full-text-level composite privacy protection, avoiding the privacy risks caused by fixed candidate sets in CUSTEXT+ and other methods. The third layer, context reconstruction, uses metadata to drive local models for constraint generation, fully restoring the domain fidelity and coherence of the text. The three steps work closely together in terms of privacy budget allocation, information transmission, and functional complementarity, constituting a complete, quantifiable, and high-quality privacy-protected inference scheme.

[0073] System Implementation Examples This embodiment provides a hierarchical collaborative large language model secure reasoning system. This system is a specific implementation of the above method embodiments and can be deployed on user client devices (such as personal computers, workstations, mobile terminals, etc.). See also... Figure 2 The system, as shown in the logical architecture diagram, comprises four core modules: a proper noun recognition and secure mapping module 100, a differential privacy semantic perturbation module 200, a remote model inference interface module 300, and a context-aware extraction and text reconstruction module 400, as well as several internal functional units. These modules and units operate in an orderly manner according to a hierarchical collaborative logic of "protection first, perturbation later, external inference, and internal reconstruction," forming a complete end-to-end privacy-preserving inference pipeline.

[0074] The proper noun recognition and security mapping module 100 in this system serves as the first processing step and data preprocessing hub of the entire system. It is responsible for recognizing and securely converting sensitive proper nouns in the original document on the client side.

[0075] In its specific implementation, the proper noun recognition and security mapping module 100 is configured with four units: a component loading unit 110, an entity recognition and post-processing unit 120, a differential privacy mapping unit 130, and a document reconstruction unit 140.

[0076] The component loading unit 110 is configured to load a named entity recognition engine (such as a distilled version of the BERT-NER model) and a domain-adaptive secure mapping dictionary during the initialization phase. The secure mapping dictionary uses entity type as the key, and each key corresponds to a list of candidate words consisting of general, fuzzy descriptive phrases. All candidate words belong to the public vocabulary of the target large language model.

[0077] The entity recognition and post-processing unit 120 is configured to receive the original document, perform text normalization, sentence segmentation, and entity recognition, and output the quadruple information for each entity. Subsequently, overlap resolution and cross-sentence entity merging are performed to output an ordered and conflict-free entity list.

[0078] The differential privacy mapping unit 130 is configured to retrieve a list of candidate words from the security mapping dictionary for each entity in the entity list based on its entity type, and randomly select replacement words according to probability using a general scoring function that is independent of the original entity text content combined with an exponential mechanism, and record the mapping relationship.

[0079] Document reconstruction unit 140 is configured to sort all mapping records in descending order of entity starting position, perform replacement operations sequentially on the original document copy, and generate an intermediate document. At the same time, it generates a metadata packet containing a sequence of entity types.

[0080] The differential privacy semantic perturbation module 200 in this system is configured to perform fine-grained perturbation of intermediate documents that no longer contain sensitive entities, with full lexical and semantic awareness.

[0081] Specifically, in its implementation, the differential privacy semantic perturbation module 200 is internally configured with an input verification unit 210, an embedding and noise generation unit 220, a dynamic adjacency candidate set construction unit 230, an exponential mechanism sampling unit 240, and a document synthesis unit 250.

[0082] The input verification unit 210 is configured to confirm that all words in the intermediate document belong to the public vocabulary of the target large language model, and abnormal words are replaced with [UNK] tokens.

[0083] The embedding and noise generation unit 220 is configured to load a pre-trained semantic embedding model (such as text-embedding-3-small), obtain the embedding vector of each word, sample noise vectors from the Laplace distribution, perturb the embedding vectors, and calculate the dynamic distance threshold.

[0084] The dynamic adjacency candidate set construction unit 230 is configured to traverse the public vocabulary, retrieve all lexical units whose embedding distance from the original lexical unit is less than the dynamic distance threshold, and form a random adjacency candidate set.

[0085] The exponential mechanism sampling unit 240 is configured to define a utility function based on the semantic distance between candidate words and original lexical units, calculate the selection probability through the exponential mechanism, and randomly select perturbation lexical units.

[0086] Document synthesis unit 250 is configured to concatenate all perturbation tokens in their original order to generate a perturbation document that satisfies differential privacy protection. .

[0087] The remote model inference interface module 300 in this system serves as a communication bridge between the system and external cloud services, configured to transmit perturbation documents. Securely send to a third-party large language model service (such as GPT-5) and receive the returned initial generated text Gen_p.

[0088] The context-aware extraction and text reconstruction module 400 in this system serves as the final output hub of the system. It is configured to integrate the structured information generated by the preceding modules with the generated content returned from the cloud, producing high-quality final text.

[0089] Specifically, in its implementation, the context-aware extraction and text reconstruction module 400 is configured with a prompt construction unit 410 and a local model inference unit 420.

[0090] The prompt construction unit 410 is configured to aggregate metadata (entity type sequence) from the proper noun recognition and security mapping module and the initial generated text Gen_p from the remote inference interface to construct an enhanced system prompt containing the original context, entity role description and reference text.

[0091] The local model inference unit is configured to load a local lightweight language model (such as Qwen3-7B) at 420, and the enhanced system prompts are input into the model to generate the final text Gen_final, which is constrained by entity type information and incorporates the content and expressions in Gen_p.

[0092] The layered and collaborative large language model security inference system formed above can be deployed on servers, cloud computing platforms, or dedicated security analysis devices. After startup, the above modules and units coordinate and cooperate organically. The overall dynamic cooperation process is described as follows: First, the proper noun recognition and security mapping module 100 starts and completes the first stage of processing. Its internal component loading unit initializes the named entity recognition engine and the security mapping dictionary. The entity recognition and post-processing unit performs text normalization, entity recognition, overlap resolution, and cross-sentence merging on the user-input raw document, outputting an ordered list of entities. The differential privacy mapping unit performs a differential privacy mapping based on... The secure mapping utilizes a general scoring system unrelated to the original entity content, combined with an index mechanism, to randomly select generalized replacement words based on probability and record the mapping relationships. The document reconstruction unit performs replacement operations in reverse order from the starting position, generating an intermediate document. And entity type sequence metadata.

[0093] Subsequently, the differential privacy semantic perturbation module runs, and the input verification unit of this module verifies... Perform vocabulary verification. The embedding and noise generation unit obtains embedding vectors word by word, samples noise from the Laplace distribution for perturbation, and calculates the dynamic distance threshold. The dynamic adjacency candidate set construction unit retrieves candidate words from the public vocabulary based on this threshold. The exponential mechanism sampling unit selects perturbed tokens probabilistically. The document synthesis unit concatenates all the perturbed tokens in order to generate a perturbed document that satisfies the .

[0094] Next, the remote model inference interface sends to a third-party large language model service (such as GPT-5) via the network and waits to receive the returned initial generated text .

[0095] Finally, the context-aware extraction and text reconstruction module takes over the processing. The prompt construction unit inside it integrates the entity type sequence metadata with to form an enhanced system prompt, explicitly annotates the entity roles of each generalized word, and provides the cloud-generated content as a reference. The local model inference unit inputs the enhanced prompt into a local lightweight model (such as Qwen3-7B). Under the constraint of the entity type information, the model integrates the useful content in it to generate the final text for output.

[0096] Application example: Medical report continuation generation Taking the typical scenario of medical report continuation as an example, this example further illustrates the complete implementation process and technical effects of the present invention in combination with the foregoing method and system solutions.

[0097] Scenario setting: A doctor hopes to use a third-party large language model (such as GPT-5) to assist in generating the subsequent analysis part of the patient's condition description, but the original record contains sensitive information. The original document Doc is: "Patient Li Mou, male, 65 years old, visited the doctor due to poor blood sugar control. He has been taking metformin orally for a long time and recently added dapagliflozin. Physical examination showed high blood pressure." In this example, a hierarchical collaborative large language model security inference system is deployed in the hospital management system. The process of the doctor using this system to assist in generating the subsequent analysis report of the patient's condition description is as follows: Step S1: Proper noun recognition and security mapping.

[0098] The system loads the named entity recognition engine and security mapping dictionary in the medical field. It normalizes the text of Doc and performs entity recognition to obtain the entity list: ["Li Mou": PERSON, "metformin": MEDICAL, "dapagliflozin": MEDICAL]. After overlapping resolution and cross-sentence merging, it is confirmed that there is no conflict.

[0099] Differential privacy mapping unit performs on each entity Security Mapping: The replacement word "the patient" is selected probabilistically from the PERSON type dictionary; "a certain oral hypoglycemic drug" is selected probabilistically from the MEDICAL type dictionary to replace "metformin"; "an SGLT2 inhibitor drug" is selected probabilistically from the MEDICAL type dictionary to replace "dapagliflozin". The document reconstruction unit performs replacements sequentially in reverse order from its starting position (from "dapagliflozin" to "metformin" and then to "Li Mou"), generating an intermediate document. "The patient is a 65-year-old male who presented with poorly controlled blood sugar. He had a history of long-term oral hypoglycemic medication and recently started taking an SGLT2 inhibitor. Physical examination revealed elevated blood pressure." Also, record the entity type sequence metadata: [PERSON, MEDICAL, MEDICAL].

[0100] Step S2: Differential privacy semantic perturbation.

[0101] Differential privacy semantic perturbation module After input validation, execute word-by-word meta-analysis. Perturbation. The system uses the text-embedding-3-small model to obtain the embedding vectors of each word, samples noise from the Laplace distribution for perturbation, calculates a dynamic distance threshold, constructs a random adjacency candidate set, and selects perturbed words probabilistically through an exponential mechanism. After perturbation, the document becomes: "This patient is a 65-year-old male who sought medical attention due to poor blood sugar management. His medical history shows long-term use of a classic hypoglycemic drug, and recent combined use of a novel SGLT2 inhibitor. A physical examination revealed elevated blood pressure." This is the perturbed document. .

[0102] Step S3: Remote model inference.

[0103] The remote model inference interface will The text is sent to the GPT-5 service. Based on its medical knowledge and understanding of the text, GPT-5 returns a preliminary generated text. The content might read: "A 65-year-old male patient presented with poorly controlled blood sugar. He had a history of long-term use of a certain oral hypoglycemic agent and recently added an SGLT2 inhibitor. Physical examination revealed elevated blood pressure. Drug interactions and cardiovascular risk assessment need to be considered..."

[0104] Step S4: Context-aware extraction and text reconstruction.

[0105] The hint constructs aggregate entity type sequence metadata [PERSON, MEDICAL, MEDICAL] and An enhanced system prompt is constructed. This prompt explicitly informs the local model: "'This patient' represents the PERSON type, 'a certain oral hypoglycemic agent' represents the MEDICAL type, 'a certain SGLT2 inhibitor' represents the MEDICAL type," and provides... For reference, the local model inference unit inputs this prompt into the Qwen3-7B model.

[0106] The local model performs reasoning generation under entity type constraints: for "the patient" of type PERSON, it generates a description related to patient characteristics; for the two drugs of type MEDICAL, it generates a professional analysis related to drug mechanisms and interactions. Simultaneously, it integrates... Fluent expression and clinical logic. Final output: Gen_final: "This patient is an elderly male who still experienced poor glycemic control despite combining basal insulin sensitization therapy with a novel SGLT2 inhibitor. Insulin resistance and medication adherence require close monitoring. Given his new-onset hypertension, the cardioprotective and renal protective benefits of the SGLT2 inhibitor, as well as the risk of hypovolemia, should be assessed. Monitoring of renal function, electrolytes, and urine output is recommended, and the antihypertensive regimen should be adjusted if necessary." Results Analysis: The final output neither revealed any real drug names (metformin, dapagliflozin) nor patient names (Mr. Li), and generated valuable analysis with highly accurate clinical logic. Throughout the process, sensitive proper nouns were generalized and replaced under differential privacy protection, while common words were protected through semantic perturbation. The cloud model only accessed the perturbed, secure document, while the local model, guided by metadata, restored the professionalism and coherence of the text. This example fully verifies the technical balance between privacy and utility achieved by the hierarchical collaborative architecture of this invention.

[0107] Based on the above-mentioned hierarchical collaborative large language model secure reasoning scheme, this embodiment of the invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the steps of the above-mentioned hierarchical collaborative large language model secure reasoning method.

[0108] This invention also provides a processor for running a program, wherein the program executes the steps of the above-described hierarchical collaborative large language model secure inference method.

[0109] This invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. The program code is loaded and executed by the processor to implement the steps of the above-described hierarchical collaborative large language model secure reasoning method.

[0110] The present invention also provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of the above-described hierarchical collaborative large language model secure reasoning method.

[0111] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0112] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0113] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0114] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0115] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A hierarchical collaborative method for secure reasoning in large language models, characterized in that, include: Proper noun recognition and security mapping: Perform named entity recognition on the original document to obtain the entities and their types; Based on entity type, a list of candidate generalization words is obtained from a pre-built security mapping dictionary, and a generalization word is randomly selected through a differential privacy mechanism to replace the corresponding entity in the original document to generate an intermediate document. At the same time, metadata containing the entity type sequence is recorded. Differential privacy semantic perturbation: The intermediate document is segmented into words, and a differential privacy mechanism is used to perform semantically aware perturbation on each word to generate a perturbed document that can be securely transmitted. Remote model inference: The perturbation document is sent to a third-party large language model service to obtain the initial generated text; Context-aware extraction and text reconstruction: Using a local lightweight language model, the final text is generated based on the entity type sequence in the metadata, the partial context of the intermediate document, and the initial generated text.

2. The method according to claim 1, characterized in that, The proper noun recognition and security mapping specifically includes: Load the named entity recognition engine and the domain-adapted secure mapping dictionary; the secure mapping dictionary uses entity type as key, each key corresponds to a list of candidate words consisting of general and fuzzy descriptive phrases, and the candidate words all belong to the public vocabulary of the target large language model; The original document is subjected to text normalization processing, and the named entity recognition engine is used for entity recognition and post-processing. The post-processing includes overlap resolution and cross-sentence entity merging to obtain an ordered and conflict-free entity list. For each entity in the entity list, a corresponding candidate word list is retrieved according to its type, and a scoring function unrelated to the original entity text content is applied in combination with an index mechanism to perform random sampling and select replacement words. The mapping relationships are recorded as mapping records. All mapping records are arranged in descending order of their starting positions. The original entities are replaced with the corresponding replacement words in the copy of the original document to generate the intermediate document.

3. The method according to claim 2, characterized in that, The application uses a scoring function independent of the original entity text content, combined with an exponential mechanism for random sampling, specifically including: A generality score is predefined for each candidate word in the candidate word list. The generality score is calculated based on the inverse document frequency of the candidate word in a large public corpus and / or the variance of the semantic vector of the candidate word in a set of similar candidate words, and is independent of the specific text content of the current original entity. Based on the generality score and the privacy budget of the current module, the index mechanism weight of each candidate word is calculated, and all weights are normalized to obtain the sampling probability distribution. A candidate word is randomly selected as the replacement word based on the sampling probability distribution, and this process satisfies ε-LDP.

4. The method according to claim 1, characterized in that, The differential privacy semantic perturbation specifically includes: Input validation confirms that all words in the intermediate document belong to the public vocabulary of the target large language model; Load the pre-trained semantic embedding model and the public vocabulary, and set the privacy budget and embedding model sensitivity for this module; For each word in the intermediate document, its embedding vector is obtained using the semantic embedding model as a baseline semantic vector; A noise vector is sampled from the Laplace distribution, the reference semantic vector is perturbed to obtain a noisy vector, and the Euclidean distance between the reference semantic vector and the noisy vector is calculated as a dynamic distance threshold. Traverse the public vocabulary and retrieve all lexical units whose distance from the baseline semantic vector is less than the dynamic distance threshold to form a random adjacency candidate set; The utility function is defined based on the semantic distance between candidate words and original lexical units. The selection probability of each candidate word is calculated through an exponential mechanism and normalized. Perturbation lexical units are obtained by random sampling according to probability. All perturbation tokens are concatenated in their original order to generate the perturbation document, which satisfies differential privacy protection.

5. The method according to claim 1, characterized in that, The context-aware extraction and text reconstruction specifically include: Receive the metadata from the proper noun recognition and security mapping module, the metadata including a sequence of entity types recorded in the order of their appearance in the original text; Receive the initial generated text from the inference of the remote model; Construct an enhanced system prompt, the enhanced system prompt comprising: the intermediate document or its context containing generalized entities, entity role descriptions generated based on the entity type sequence, and at least a portion of the initial generated text; The enhanced system prompt is input into a local lightweight language model. The local lightweight language model is constrained by the entity type information during generation to generate a description that matches the entity type at the corresponding position. At the same time, it integrates the content and expression in the initially generated text and avoids outputting specific real proper nouns. The generated text is output as the final text.

6. The method according to any one of claims 1 to 5, characterized in that, The proper noun recognition and security mapping is configured with a first privacy budget, and the differential privacy semantic perturbation is configured with a second privacy budget. The sum of the first privacy budget and the second privacy budget constitutes the overall privacy budget. The proportion of the first privacy budget to the overall privacy budget is less than that of the second privacy budget.

7. A hierarchical collaborative large language model secure reasoning system, characterized in that, include: The proper noun recognition and security mapping module is used to perform named entity recognition on the original document on the client side, obtain the entity and its type, obtain a list of candidate generalization words from the pre-built security mapping dictionary based on the entity type, and randomly select a generalization word through differential privacy mechanism to replace the corresponding entity in the original document, generate an intermediate document, and record metadata containing the entity type sequence at the same time. The differential privacy semantic perturbation module is used to segment the intermediate document into words and use a differential privacy mechanism to perform semantically aware perturbation on each word to generate a perturbation document that can be securely transmitted. A remote model inference interface is used to send the perturbation document to a third-party large language model service and obtain the initial generated text; The context-aware extraction and text reconstruction module is used on the client to generate the final text based on the entity type sequence in the metadata, the partial context of the intermediate document, and the initial generated text, using a local lightweight language model.

8. The system according to claim 7, characterized in that, The proper noun recognition and security mapping module includes: The component loading unit is used to load the named entity recognition engine and the domain-adaptive security mapping dictionary. The security mapping dictionary uses entity type as the key, and each key corresponds to a list of candidate words consisting of general and fuzzy descriptive phrases. All candidate words belong to the public vocabulary of the target large language model. The entity recognition and post-processing unit is used to perform text normalization, entity recognition, overlap resolution and cross-sentence entity merging on the original document, and output an ordered and conflict-free entity list. The differential privacy mapping unit is used to retrieve a list of candidate words for each entity based on its type, and randomly select replacement words using a scoring function that is independent of the original entity content combined with an exponential mechanism. The document reconstruction unit is used to replace the replacement words in the original document in reverse order according to the starting position of the entity, and generate an intermediate document and the metadata.

9. The system according to claim 7, characterized in that, The differential privacy semantic perturbation module includes: An input verification unit is used to confirm that all words in the intermediate document belong to the public vocabulary of the target large language model; The embedding and noise generation unit is used to obtain the embedding vector of each word using a pre-trained semantic embedding model, and to perturb the embedding vector by sampling noise vectors from a Laplace distribution; A dynamic adjacency candidate set construction unit is used to calculate a dynamic distance threshold and retrieve all lexical units in the public vocabulary that are within the dynamic distance threshold to form a random adjacency candidate set. The exponential mechanism sampling unit is used to randomly select perturbation lexical units based on the semantic distance between candidate words and original lexical units using an exponential mechanism; The document synthesis unit is used to concatenate all the perturbation tokens in their original order to generate the perturbation document.

10. The system according to claim 8, characterized in that, The context-aware extraction and text reconstruction module includes: A prompt construction unit is used to construct an enhanced system prompt, the enhanced system prompt including the intermediate document or its context containing generalized entities, entity role descriptions generated based on the entity type sequence, and at least a portion of the content of the initial generated text; The local model inference unit is used to load a local lightweight language model and input the enhanced system prompts into the local lightweight language model to generate a final text that is constrained by entity type information and integrates the content and expression in the initial generated text.

Images