A local reversible pseudonymization privacy protection method and system for cloud agent memory

Abstract

This invention discloses a local reversible pseudonymization privacy protection method and system for cloud-based intelligent agent memory, relating to the fields of artificial intelligence and data security technology. The invention pre-configures a four-level privacy classification system on the local device, performs edge-side privacy detection and hierarchical recognition on user-input text, replaces sensitive information with placeholders carrying semantic types, and uploads it to the cloud. The cloud uses these placeholders to perform semantic reasoning, tool invocation, and memory archiving. The local device then restores the original sensitive information from the placeholders returned by the cloud, achieving a privacy protection effect where plaintext privacy data remains locally while the cloud only processes semantically abstract information. This invention can block privacy leakage paths at the source without compromising the semantic understanding and long-term memory capabilities of cloud-based intelligent agents, balancing privacy security and system utility. It features low processing latency and is imperceptible to the user, making it suitable for long-term interaction and memory management scenarios of cloud-based intelligent agents driven by large language models.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and data security technology, specifically to a privacy protection method in the interaction process of a large language model, and particularly to a local reversible pseudonymization privacy protection method and system for cloud-based intelligent agent memory. Background Technology

[0002] With the rapid development and widespread deployment of large language models, these models are evolving from simple text generation tools into cloud-based intelligent agent systems with long-term memory, tool invocation, and personalized service capabilities. Users increasingly rely on these cloud-based large models to handle daily tasks, but these interactions inevitably contain a large amount of personal privacy information, including real names, contact information, addresses, health status, financial data, and even ID card numbers. Current mainstream intelligent agent service architectures require users to transmit complete input text to the cloud for inference and archiving in the memory system. This process naturally exposes user privacy to multiple risks, including output leakage, retrieval leakage, query privacy leakage, vector leakage, and abuse of intelligent agent tools. Multiple empirical studies have shown that pre-trained language models can recover sensitive information from training data, and mainstream models have a very high success rate in privacy leakage attacks under multi-turn dialogue attacks. Furthermore, models can be induced to actively request private information from users.

[0003] To address the aforementioned privacy risks, existing technologies have developed various privacy protection schemes, including differential privacy methods, cryptographic methods, machine forgetting and model editing, synthetic data substitution, agent protection frameworks, and traditional anonymization methods. Differential privacy achieves privacy protection by injecting noise, but it can compromise the semantic integrity of text; cryptographic methods have enormous computational overhead, making it difficult to meet the needs of real-time interaction; traditional irreversible masks can lose key semantic clues, preventing cloud-based agents from properly understanding context and building long-term memory; existing solutions generally lack proactive protection capabilities on the input side, meaning privacy data is not processed before leaving the local device, posing a risk of leakage once transmitted to the cloud; furthermore, existing technologies lack a systematic privacy layering system, making it impossible to achieve differentiated protection, ensure consistency of cross-session entity mapping, and have insufficient lightweight deployment capabilities on the edge, hindering efficient operation on devices with limited computing power.

[0004] The aforementioned shortcomings prevent existing privacy protection methods from achieving a balance between privacy and system utility in cloud-based intelligent agent long-term memory scenarios. Users must either sacrifice privacy for intelligent services or sacrifice intelligent experience for privacy protection, making it difficult to achieve both. Therefore, there is an urgent need in this field for a privacy protection technology that can perform proactive desensitization locally, preserve semantic integrity, support hierarchical protection, ensure cross-session consistency, and be lightweight in deployment, in order to meet the secure interaction requirements of cloud-based intelligent agent memory. Summary of the Invention

[0005] This invention aims to address the technical problems existing in cloud-based intelligent agent memory scenarios, such as lack of input-side protection, imbalance between semantics and security, insufficient hierarchical protection, lack of cross-session consistency, and difficulties in edge deployment. It provides a local reversible pseudonymization privacy protection method and system for cloud-based intelligent agent memory, achieving the technical effects of privacy data not leaving the local machine in plaintext, the cloud only processing semantic placeholders, the protection process being transparent to the user, and almost no loss of intelligent utility.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a local reversible pseudonymization privacy protection method for cloud-based intelligent agent memory, comprising:

[0008] A hierarchical privacy classification system is pre-installed on local devices to guide the identification and differentiated protection of sensitive information;

[0009] Perform local privacy detection and classification on the original request text input by the user to determine the privacy information, privacy level and semantic type in the text;

[0010] Based on the user-defined protection threshold, the identified privacy information is replaced with placeholders carrying semantic types to obtain desensitized text; the placeholders retain the syntactic components of the original privacy information in the desensitized text, enabling the cloud-based intelligent agent to perform intent parsing and logical reasoning based on the semantic type identifier;

[0011] The mapping relationship between the original privacy information and the corresponding placeholder is encrypted and stored in a local secure storage unit. The mapping relationship supports persistent association across sessions, ensuring that the same privacy entity always corresponds to the same placeholder across sessions, and ensuring consistency of cloud memory retrieval.

[0012] The de-identified text is sent to the cloud-based intelligent agent, which then performs semantic reasoning, tool invocation, and memory archiving based on the de-identified text, generating an intermediate response text with placeholders.

[0013] The system receives the intermediate response text returned from the cloud, restores the placeholders to the original privacy information based on the mapping relationship stored locally, and obtains the natural language response text that can be displayed to the user.

[0014] Furthermore, the hierarchical privacy classification system includes four privacy levels:

[0015] Privacy level four is classified as top secret / credential type, which covers materials that can be directly used to perform authentication, authorization, and access control. Obtaining such materials could directly lead to account takeover or financial loss.

[0016] Privacy level three refers to highly sensitive personal information, the leakage of which would cause significant damage to personal safety, property, and physical and mental health;

[0017] Privacy level two is for identifiable personal information, which, alone or in combination with other information, can identify and locate a specific natural person;

[0018] Privacy level one is open / low-sensitivity preferences, which cannot identify specific individuals, only contain preference and habit information, and does not participate in de-identification processing.

[0019] Furthermore, the local privacy detection and classification are performed using a lightweight detection model deployed on a local device. This lightweight detection model is specifically fine-tuned and trained using reinforcement learning, enabling it to identify privacy information, determine the level, and label semantic types.

[0020] Furthermore, the placeholder carrying the semantic type is constructed in the form of a combination of semantic type identifier and sequence number, which can be recognized by the cloud intelligent agent as an independent semantic unit, preserving the entity grammatical role and logical association ability.

[0021] Furthermore, the local secure storage unit is implemented using an encrypted database, ensuring that the same privacy entity always corresponds to the same placeholder in multiple interactions across sessions, thus guaranteeing the consistency of cloud memory retrieval.

[0022] Furthermore, the cloud-based intelligent agent only processes anonymized information in the form of placeholders during the reasoning and archiving process, without storing or accessing the original privacy plaintext data, thus achieving architecture-level data isolation.

[0023] Furthermore, the lightweight detection model carried by the local privacy detection module is trained through two stages: supervised fine-tuning (SFT) and reinforcement learning (RL). In the reinforcement learning stage, the group relative policy optimization algorithm (GRPO) is used, with the average F1 score extracted from privacy information, privacy level, and semantic type as the scalar reward signal. Combined with KL divergence constraints to prevent output degradation, the model is updated with a policy.

[0024] Furthermore, when archiving memories, the cloud-based intelligent agent converts the desensitized text containing the placeholder into a vector representation and stores it in an external memory bank. Since the placeholder retains the semantic type identifier of the original privacy information, the cloud-based intelligent agent can recall historical memory fragments containing the same placeholder through similarity retrieval in subsequent cross-session interactions.

[0025] Secondly, the present invention provides a local reversible pseudonymization privacy protection system for cloud-based intelligent agent memory, comprising:

[0026] The local privacy classification configuration module is used to pre-configure a hierarchical privacy classification system on the local device;

[0027] The local privacy detection module is used to perform privacy detection and classification on the original request text input by the user, and output privacy information, privacy level and semantic type; the lightweight detection model carried by the local privacy detection module is obtained through two-stage training of supervised fine-tuning and reinforcement learning.

[0028] The desensitization and replacement module is used to replace privacy information with placeholders carrying semantic types based on a protection threshold, generating desensitized text; the placeholders retain the syntactic components of the original privacy information, supporting cloud-based intelligent agent intent parsing and logical reasoning;

[0029] The local secure mapping module is used to encrypt and store the mapping relationship between the original privacy information and placeholders, supports persistent association across sessions, and ensures the consistency of mapping across sessions for the same entity;

[0030] The cloud interaction module is used to send de-identified text to the cloud intelligent agent and receive intermediate response text with placeholders returned from the cloud.

[0031] The local recovery module is used to restore the placeholders in the intermediate response text to the original privacy information based on the mapping relationship, and output the natural language response text.

[0032] Furthermore, the local privacy detection module is equipped with a lightweight detection model that is adapted to the computing power of the local device and can complete the identification and classification of privacy information under low latency conditions.

[0033] Furthermore, the placeholders generated by the desensitization and replacement module carry semantic type identifiers, which can maintain the semantic understanding, logical reasoning, and memory archiving capabilities of the cloud-based intelligent agent.

[0034] Furthermore, the local security mapping module adopts an encrypted storage structure to ensure that the mapping relationship is not read illegally and that the mapping of the same entity is consistent across sessions.

[0035] Thirdly, the present invention provides a local terminal device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0036] Fourthly, the present invention provides a non-volatile computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described method.

[0037] Compared with the prior art, the beneficial technical effects of the present invention are as follows:

[0038] (1) By replacing placeholders carrying semantic types, this invention can hide real sensitive data while preserving the complete semantic structure and logical clues. The utility loss of cloud-based intelligent agents is extremely low, and the accuracy rate drops by less than 1.6% compared to the unprotected state, breaking the zero-sum game between privacy and utility.

[0039] (2) The present invention adopts an active desensitization mechanism on the end side. The original privacy plaintext is always stored on the local device and is not transmitted or stored to the cloud. Even if the cloud is attacked, data is leaked or injection is prompted, only meaningless placeholders can be obtained, thus achieving architecture-level privacy isolation.

[0040] (3) The present invention achieves differentiated protection based on a four-level privacy classification system. Users can dynamically adjust the desensitization threshold according to their trust level and security needs, and flexibly switch between security and personalized experience.

[0041] (4) The local encrypted mapping library of the present invention realizes the mapping of fixed placeholders across sessions for the same entity, ensuring that cloud-based intelligent agents can stably associate with historical dialogue memories and maintain long-term personalized service capabilities.

[0042] (5) The privacy detection of this invention adopts a lightweight model. Downlink recovery only requires local query and string replacement. The processing delay is in the millisecond level, which does not affect the real-time interactive experience. The protection process is completely transparent to the user.

[0043] (6) The Ben Armin lightweight detection model is trained in two stages by SFT+GRPO and achieves a privacy recognition F1 score of up to 86.27% on local low computing power devices. Its performance is comparable to that of general large models, taking into account both edge efficiency and recognition accuracy. This application achieves accurate recall of long-term memory across sessions through placeholder vectorized storage and similarity retrieval, which completely solves the problems of cloud memory breakage and semantic loss caused by traditional desensitization technology. Attached Figure Description

[0044] Figure 1 This is a three-stage lifecycle flowchart of the local reversible pseudonymization privacy protection method of the present invention;

[0045] Figure 2 This is a schematic diagram of the local uplink desensitization process of the present invention;

[0046] Figure 3 This is a schematic diagram of the cloud-based semantic preservation processing flow of the present invention;

[0047] Figure 4 This is a schematic diagram of the local downlink recovery process of the present invention;

[0048] Figure 5 This is a schematic diagram of the two-stage training process of the lightweight detection model of the present invention. Detailed Implementation

[0049] like Figure 1 As shown, this invention provides a local reversible pseudonymization privacy protection method for cloud-based intelligent agent memory based on a three-stage closed-loop architecture of "local-cloud-local". The specific business data flow process is as follows: First, in the first stage (local), the system obtains the original input from the end user. Before the data leaves the local device, it completes the identification, desensitization, and replacement of privacy information, and securely stores the mapping relationship between the original privacy plaintext and the generated placeholders locally. Subsequently, the system sends the processed desensitized text to the cloud. Second, in the second stage (cloud), the cloud server receives the desensitized text with placeholders. Without touching the user's plaintext privacy throughout the process, it completes the semantic understanding, memory retrieval, and business logic processing of the large model, and generates a cloud reply text containing placeholders for distribution. Finally, in the third stage (local), after receiving the cloud reply text, the local device queries the locally constructed mapping relationship to accurately restore the placeholders in the text to the original privacy plaintext, and finally replies to the user with the restored complete natural language information.

[0050] like Figure 2 As shown, the specific operation flow of the local desensitization stage (uplink desensitization) in the privacy protection method of the present invention is as follows: First, the system receives the original user input text; then, a lightweight privacy detection model deployed on the local device is triggered to scan and analyze the input text, and perform the operation steps of identifying the privacy information text, level and type; next, the system generates corresponding placeholders for the identified sensitive content, and performs the mapping operation between the privacy information text and the placeholders. During this process, the system interacts with the local database to persistently and securely store the mapping relationship between the original plaintext and the placeholders; on this basis, the system performs the privacy text replacement step, using the generated placeholders to replace the sensitive information fragments in the original input in situ; finally, the de-identified desensitized text is generated and output, providing a compliant data foundation for the subsequent secure transmission and processing to the cloud server.

[0051] like Figure 3As shown, the specific operation flow of the cloud processing stage (second stage) in the privacy protection method of the present invention is as follows: First, the system uses the desensitized text uploaded by the local terminal as the starting point for processing; then, the cloud server receives the desensitized text and obtains secure data with semantic type placeholders; next, the cloud model enters the desensitized text understanding and reasoning step, and the cloud big model performs intent parsing and business logic processing based on the type labels retained by the placeholders; during the reasoning process, the system performs the extraction and storage of personalized memory operations, and writes the identified user features into the cloud profile memory database (at this time, the cloud only stores secure placeholder mappings, not plaintext privacy); then, the cloud model generates a response step, and constructs personalized feedback content by combining long-term memory and the current reasoning result; finally, the cloud response text containing placeholders is generated and output, ready to be sent to the local terminal for subsequent restoration processing.

[0052] like Figure 4 As shown, the specific operation flow of the local downlink recovery stage (third stage) in the privacy protection method of the present invention is as follows: First, the local terminal takes the received cloud reply (i.e., the intermediate reply text containing semantic type placeholders) as the starting point for data processing; then, the local recovery module performs the placeholder identification operation, accurately locating the placeholder identifiers in the reply text through text feature scanning (regular expression matching); next, it enters the placeholder query and privacy information restoration step, where the system uses the extracted placeholders to interact with the local database, retrieves and verifies the corresponding original privacy plaintext mapping relationship, and performs in-situ replacement operation; finally, the system outputs the restored complete and fluent natural language text and replies to the user, thereby completing the entire closed loop and achieving complete privacy protection without the end user's awareness and transparency.

[0053] like Figure 5 As shown, local privacy detection and classification are performed using a lightweight detection model deployed on a local device. This lightweight detection model is trained in two stages: supervised fine-tuning (SFT) and reinforcement learning (RL). First, supervised fine-tuning is performed on a large-scale privacy-annotated dataset to establish privacy recognition and structured output capabilities. Then, the group relative policy optimization algorithm (GRPO) is used, with the average F1 score of privacy extraction as the reward signal, combined with KL divergence constraint optimization model, so that the lightweight model with 0.6B-4B parameters can achieve high-precision privacy recognition, and can complete privacy information recognition, level determination and semantic type labeling.

[0054] This invention achieves optimal synergy between privacy and intelligence in cloud-based intelligent agent memory scenarios through a three-stage architecture of local reversible pseudonymization. It solves the core pain point of existing technologies that cannot balance security and user experience. It is applicable to a wide range of scenarios such as large-scale model dialogue, personalized services, and long-term memory intelligent agents. It complies with relevant regulations on data security and personal information protection and has high technical value and application prospects.

[0055] The present invention will be further described in detail below with reference to specific embodiments.

[0056] Example 1

[0057] like Figure 1 As shown, this embodiment provides a local reversible pseudonymization privacy protection method for cloud-based intelligent agent memory, which fully implements a three-stage closed-loop protection process and is applied to the interaction scenario between local smartphones and cloud-based personalized chat intelligent agents.

[0058] Example setup:

[0059] The local device is a smartphone equipped with a local privacy protection component and a pre-installed four-level privacy classification system. When a user initiates a conversation with a cloud-based long-term memory agent, the protection threshold is set to anonymize privacy information at level two and above. The cloud-based agent has the capabilities of conversation memory, user profile building, and personalized recommendation.

[0060] Workflow:

[0061] Privacy classification system pre-configured

[0062] The local device is pre-loaded with a four-level privacy classification system, which clarifies the scope and processing rules of information at each level. Level 1 information is not processed, while Level 2, 3, and 4 information is desensitized according to the threshold.

[0063] Privacy Level 4 (Top Secret / Credential): Highest Priority. Covers authentication, authorization, signature, or access control materials that can be directly reused or executed immediately. Acquisition of such materials could immediately lead to account takeover, financial loss, or lateral movement of the system. This includes passwords, PIN codes, verification codes (SMS / email / MFA), API keys, private keys, mnemonic phrases, database connection strings, payment card security codes (CVV / CVC), and undisclosed business information. The core criterion for determination is that the information can be used immediately upon acquisition, requires no social engineering, and directly leads to account takeover or financial loss.

[0064] Privacy Level 3 (Highly Sensitive Personal Information): High Risk. Information whose disclosure or unauthorized use is expected to cause significant harm to personal safety / property, mental or physical health, reputation, or fair opportunity. This includes ID card numbers, bank / payment card numbers, transaction records, salary income, medical records and diagnoses, precise location (latitude / longitude / real-time location), biometrics (face / fingerprint / iris), communication content (original chat logs / SMS content), sensitive identity attributes (race / religion / political opinion), information about minors, litigation / penalty records, etc. The core criterion for determination is high potential harm, even if it cannot independently and uniquely identify an individual.

[0065] Privacy Level Two (Identifiable Personal Information): Basic Identification Level. Information that, alone or in combination with reasonably available information, can identify, locate, or reliably track a specific natural person. This includes their real name, specific age / date of birth, gender, mobile phone number, email address, detailed address (street / house number level), account username / ID, personal homepage link, device identifier, IP address, workplace / school name, job title / rank, and third-party identifiable information (personal information of emergency contacts / relatives and friends). The core criteria for determination are identifiability, associativity, and traceability.

[0066] Privacy Level 1 (Open / Low-Sensitive Preferences): Information that cannot identify a specific individual, but only reflects style, preferences, or habits. This includes preferences for expression and interaction, self-reported personality and emotions (non-diagnostic level), lifestyle and habit preferences, interests and content preferences, aesthetic and style preferences, motivation and goal preferences, etc. Examples include "I like watching science fiction movies," "I run at 6 am every morning," and "I've been under a lot of stress lately." The core criteria for this level are that the information is unidentifiable, low-harm, and not highly sensitive. This level of information is not extracted and is not subject to anonymization.

[0067] The classification and determination of all the aforementioned privacy information levels employ two ultra-large-scale language models for data annotation and verification. First, one model performs initial privacy information annotation on given user dialogue data, using prompts that define and exemplify all the aforementioned privacy information. Then, another model reviews and corrects this annotation. Finally, manual verification and correction are performed to create a dataset of user-agent dialogues annotated with privacy information. Each annotated privacy item includes the privacy information text (the text in the original dialogue), the privacy level, and the privacy type.

[0068] Because existing open-source datasets cannot fully cover the defined privacy levels and are insufficient to meet the training and evaluation needs of models, a user dialogue dataset containing rich privacy information was constructed. In the construction process, 200 complete user profiles were first synthesized based on initial user profile seeds. Each profile includes basic attributes, personal preferences, and privacy fields covering various levels, and the diversity of privacy content was ensured through procedural sampling. Subsequently, multi-turn human-computer dialogues were generated based on these profiles, allowing privacy information to be inserted into the dialogue directly or indirectly, thereby highly reproducing real-world dialogue exposure scenarios. Regarding data annotation, initial privacy annotations were automatically generated by two large-scale language models through a two-stage "annotation-proofreading" process. Then, human annotators reviewed the privacy information again to ensure data quality. The final dataset contains approximately 1 million tokens, with a balanced distribution in both Chinese and English. The training set includes 26,016 rounds of dialogue from 160 users and over 125,000 privacy instances, while the test set includes 6,337 rounds of dialogue from 40 users, over 29,900 privacy instances, and 615 question-answer pairs.

[0069] Supplementary rules for privacy information identification: Information belonging to Privacy Level 1 does not need to be identified and extracted; general, non-sensitive user profile information does not require privacy protection; globally / nationally renowned public figures, well-known institutions, famous locations, etc., will not be extracted if they are not linked to a user's personal identity, location, or private context. Once a higher level is detected (Level 4 > Level 3 > Level 2 > Level 1), do not downgrade. When uncertain, follow the principle of erring on the side of higher rather than lower. For example, if a sentence represents a habit preference (Level 1) but contains a specific identifiable location / account, etc. (Level 2 or above), then that privacy portion still needs to be extracted.

[0070] Local privacy detection and classification

[0071] The user entered the following text: "My name is Zhang San, my mobile phone number is 13912345678, I have a history of hypertension, and I need to be reminded to buy antihypertensive drugs every Monday. My bank card password is 123456."

[0072] The local privacy detection module scans and identifies the text: "Zhang San" is identified as Level 2 recognizable personal information; "13912345678" is identified as Level 2 recognizable personal information; "History of hypertension" is identified as Level 3 highly sensitive personal information; "123456" is identified as Level 4 top-secret credential information; "Need reminder to buy antihypertensive drugs every Monday" is identified as Level 1 preference information and is not processed.

[0073] The local privacy detection uses a lightweight detection model deployed locally with a parameter count between 0.6B and 4B. This model has been specifically fine-tuned and trained with reinforcement learning, and its F1 score for privacy extraction can reach up to 86.27%, which is significantly better than general large models.

[0074] Besides using a lightweight local large language model for privacy span extraction, a traditional Named Entity Recognition (NER) model combined with a large number of regular expressions and dictionary matching rules can also be used to achieve preliminary privacy discovery. This approach reduces the local computing power requirements, but the generalization ability and accuracy in complex contexts will decrease.

[0075] The lightweight detection model in this application employs a two-stage training process: the first stage is supervised fine-tuning (SFT), where parameters are optimized using autoregressive cross-entropy loss on a labeled dataset containing 26,016 rounds of training dialogues and 125,000 privacy instances to establish basic privacy recognition capabilities; the second stage is reinforcement learning (RL), which uses the GRPO algorithm, with the average F1 score of privacy extraction as the reward signal, and is combined with KL divergence constraints to prevent output degradation. Ultimately, the lightweight model achieves low-latency, high-precision privacy detection on local devices.

[0076] like Figure 5 As shown, the two-stage training process of the lightweight privacy detection model of this invention, consisting of supervised fine-tuning (SFT) and reinforcement learning (RL), is as follows:

[0077] In the supervised fine-tuning phase, supervised fine-tuning training data is first extracted from the privacy-annotated dataset. A lightweight base model with 0.6B–4B parameters is then integrated into the training process, and targeted supervised fine-tuning training is conducted on this dataset. The training process employs an autoregressive cross-entropy loss function to continuously optimize the model parameters, enabling the model to quickly establish preliminary recognition capabilities for privacy information, privacy levels, and semantic types, as well as structured output capabilities. It also masters the basic mapping rules from privacy text to semantic placeholders. Upon completion, a finely tuned lightweight model with basic privacy detection capabilities is output, laying a stable foundation for subsequent reinforcement learning optimization.

[0078] The reinforcement learning optimization phase starts with a finely tuned lightweight model and extracts reinforcement learning-specific training data from the same privacy-annotated dataset to construct a dedicated reward mechanism for privacy recognition tasks. This phase uses the average F1 score of privacy-information text matching, privacy level consistency, and semantic type similarity as a scalar reward signal. The Group Relative Policy Optimization (GRPO) algorithm is employed to update the model's policy, while KL divergence constraints are introduced to prevent output degradation during optimization, effectively balancing precision and recall in privacy recognition.

[0079] After the two-stage collaborative training process described above, the final output is a lightweight detection model. This model can achieve low-latency operation on resource-constrained local devices, with a privacy extraction F1 score of up to 86.27%. Its recognition accuracy is comparable to large-scale cloud-based general-purpose models. It can stably output three structured results: privacy information, privacy level, and semantic type. This directly supports the local de-identification and replacement process, providing a reliable edge-side model guarantee for achieving the core objective of this invention: "privacy plaintext not leaving the local machine, and lossless semantic understanding in the cloud."

[0080] Placeholder replacement and mapping storage

[0081] According to the protection threshold, perform the following replacements on the information at levels two, three, and four: Zhang San → <Name_1>; 13912345678 → <Mobile Number_1>; History of Hypertension → <Medical Record_1>; 123456 → <Password_1>.

[0082] The placeholders are constructed using the format "<Privacy Type_Monotonically Increasing Number>". For the same privacy type, this number is assigned sequentially increasing based on the number of similar placeholders already stored in the local database, and the initial number of any newly added privacy type is set to 1. During the text desensitization process, only the placeholders are used to replace the privacy information fragments in the original dialogue text in situ, while the remaining non-sensitive content of the original text remains unchanged.

[0083] Generate desensitized text: "My name is <Name_1>, my mobile number is <Mobile Number_1>, I have <Medical Record_1>, I need to be reminded to buy antihypertensive medication every Monday, and my <Password_1>."

[0084] The local device encrypts and stores the mapping relationships in a secure database. All identified privacy information text and its corresponding placeholders are stored in pairs in the local database, forming a persistent mapping relationship, such as storing it in a local relational database. This database supports persistent storage across sessions, ensuring that the same privacy entity corresponds to the same placeholder in long-term interactions.

[0085] This scheme uses plaintext placeholders of <semantic type_serial number>. Alternatively, order-preserving encrypted strings or format-preserving encrypted (FPE) ciphertext can be used as placeholders, as long as the cloud model can treat them as independent semantic tokens.

[0086] For one-off question-and-answer tasks that do not require long-term memory across sessions, a persistent local secure database can be avoided. Instead, an in-memory hash table can be used for single-session-level mapping caching. This hash table is destroyed immediately after the session ends, further enhancing the storage security of the local device.

[0087] Cloud-based semantic processing and memory archiving

[0088] The anonymized text is uploaded to the cloud-based intelligent agent, which receives the anonymized text with placeholders. Because the placeholders preserve the semantic type and grammatical role of the entities, the cloud-based large language model can still understand the user's true intent and perform logical reasoning, tool invocation, and memory archiving. Specifically, the privacy type contained in the placeholders represents the semantic category of the original sensitive information, thus maintaining the integrity of the original statement in terms of grammatical structure and contextual semantics. Therefore, the cloud-based large language model can accurately parse the anonymized dialogue text, effectively avoiding semantic ambiguity or misunderstanding caused by the absence of specific privacy content or values. Based on this, the cloud-based intelligent agent can smoothly perform operations such as identification, extraction, and archiving of memory information based on the anonymized text, ensuring that the placeholder replacement mechanism does not negatively impact the normal utility of the agent's memory system.

[0089] The cloud identifies the semantic type of the placeholder, understands the user's intent to set up health-related reminders, extracts user preferences, and writes them into the memory: <Name_1> has <Medical Record_1> and needs a reminder to purchase medicine every Monday. The cloud generates an intermediate reply: "Okay, <Name_1>, I have set up a weekly medicine purchase reminder for you. You can use it with confidence. The relevant information has been securely recorded."

[0090] During this stage, the intermediate response content generated in the cloud also includes these placeholders, achieving physical data isolation at the architecture level and ensuring that no plaintext privacy data is stored in the cloud.

[0091] Local recovery and display

[0092] The local device receives the intermediate reply, scans the placeholder and queries the local mapping library, restores <Name_1> to Zhang San, and finally displays to the user: "Okay Zhang San, I have set up a weekly medicine purchase reminder for you. You can use it with confidence. The relevant information has been safely recorded."

[0093] During local recovery, a regular expression matching algorithm is used to scan and identify placeholder features in the text. When a placeholder matching a preset format is found, a mapping retrieval operation in the local security database is triggered. If the original privacy plaintext corresponding to the placeholder is successfully found in the database, the placeholder in the reply text is replaced with the original privacy plaintext in its original position; if no matching record is found, this part of the text is not modified, thereby achieving automatic recovery of local downlink data.

[0094] Local recovery is not a simple string replacement, but a closed loop of semantic isolation and context reconstruction: it quickly locates placeholders through regular expression matching, completes local encryption library query and in-situ replacement in milliseconds, and achieves lossless restoration of privacy information; cross-session fixed placeholder mapping ensures the consistency of dialogue logic and completely avoids the problems of reply breakage and semantic distortion caused by traditional desensitization.

[0095] The local restoration process involves only database queries and string replacements, with a processing latency in the millisecond range, achieving an ultimate balance between "usable but invisible".

[0096] In this embodiment, the original privacy data never leaves the local machine, and the cloud only processes placeholders. Users receive privacy protection without being aware of it, and the cloud-based intelligent agent's semantic understanding and memory capabilities operate normally.

[0097] The privacy level standards and classification rules will be provided below.

[0098] 1. Core Principles

[0099] Extraction scope: Only extract PL2 (identifiable information), PL3 (highly sensitive information), and PL4 (confidential information).

[0100] Exclusion criteria: Extraction of PL1 (low-sensitivity / preference-based) information is strictly prohibited. Preferences, habits, non-diagnostic emotions, and tone / style are not within the scope of privacy information extraction.

[0101] Exceptions to publicly available information: Global / national public figures, well-known institutions, or famous locations that are not associated with the user's personal identity, location, or private context in the conversation do not require identification or extraction.

[0102] Conflict resolution:

[0103] Once a higher-level rule (such as PL4) is matched, the class is immediately classified at that level and cannot be downgraded.

[0104] When uncertain, follow the principle of "choosing the higher option over the lower one" (PL2→PL3→PL4).

[0105] PL1 vs. PL2+ conflict: If the information is described as a custom (PL1) but contains a specific location (PL2), then the location information must be extracted.

[0106] 2. Detailed Definitions and Categories

[0107] PL4: Confidential / Certificate / Critical Loss (Highest Priority)

[0108] Definition: Any authentication, authorization, signature, or access control material that can be "directly reused / executed immediately," or critical confidential information that, if disclosed, could immediately lead to account takeover, financial loss, lateral movement of systems, or large-scale data breach.

[0109] Core criterion: It can be used immediately after acquisition, without social engineering, and can directly cause account takeover or financial loss.

[0110] Classification rules:

[0111] Authentication / Account: Password, PIN code, security questions and answers, verification code (SMS / email / MFA), session token, cookie (containing authentication information), OAuth code, bank card / payment card security code (CVC, CVV, etc.), backup code, recovery code, SSO ticket.

[0112] Keys / Signatures: API Key, Access Key, Secret Key, Private Key, Mnemonic Phrase, Seed Phrase, Database Connection String (including credentials), Certificate Private Key, Signing Key, Encryption Key, etc.

[0113] System / Attack: Database connection string, management backend URL, reproducible vulnerability details, internal network entry / segment, bastion host information, CI key, cloud key, production configuration, etc.

[0114] Undisclosed business information: Financial information, M&A materials, core roadmap, internal pricing, customer list, original contracts, core implementation details, exploitation details, vulnerability PoC, etc., are not publicly disclosed.

[0115] Standard type tags: Password, Verification Code, Token, Key, Private Key, PaymentSecurity Code, Database Connection String, Vulnerability Details, BusinessSecret.

[0116] PL3: Highly Sensitive Personal Information (High Risk)

[0117] Definition: Information that, if disclosed or misused, is expected to cause significant harm to an individual's personal / property safety, mental or physical health, reputation, or fair opportunity, or data that is generally considered sensitive.

[0118] Core criterion: High damage consequences, even if they cannot be uniquely identified on their own, should be classified as PL3.

[0119] Classification rules:

[0120] Documents required: ID card number, passport number, social security / insurance number, ID photo / scanned copy, driver's license number, license plate number, etc.

[0121] Financial: Bank card / payment card number, basic card information (opening bank / card organization / type / expiration date, etc.), account information, transaction records / billing details, salary / income (annual income / monthly income), credit report (credit score / credit rating), debt / loan information, assets / net assets.

[0122] Health: Medical records / medical history / visits / surgeries / clinical procedures, diagnoses, prescriptions, specific physiological indicators (blood type / blood sugar / blood pressure / blood lipids / blood oxygen, etc.), specific body indicators (height / weight / BMI, etc.), reproductive health, mental illness / psychological counseling records (Note: non-diagnostic emotional states belong to PL1). Physiological / body indicators must have specific numerical values ​​to be categorized.

[0123] Tracking: Precise location (latitude and longitude / real-time positioning), accommodation records (hotel room number / check-in time, etc.), detailed itinerary (flight / ticket information), commuting route, etc.

[0124] Biometric identification: face, fingerprint, voiceprint, iris features, etc.

[0125] Communication content: original chat logs, SMS / email text (not just contact information), call details, etc.

[0126] Sensitive attributes: ethnicity / race, religious belief, political stance.

[0127] Other: Information on minors (those under 14 years old and their guardians), litigation / arbitration / punishment / police reports, etc.

[0128] Standard type tags: ID Number, Financial Account, Transaction Record, Assets / Income, Medical Health, Precise Location, Itinerary / Trajectory, Biometrics, Communication Content, Sensitive Identity, Judicial Record.

[0129] PL2: Can identify personal information (basic identification)

[0130] Definition: Information that can be used alone or in combination with reasonably available information to identify, locate or reliably track a particular natural person.

[0131] Core standards: Identifiable / Associable / Traceable.

[0132] Classification rules:

[0133] Direct identification: Real name (full name), specific age, specific date of birth, gender, mobile phone number, landline number, email address, detailed address (street / house number / community / deliverable address, etc.), postal code, and work address.

[0134] Network identifiers: Username / Account ID / Platform UID / Device account name, Personal homepage link, Device identifier, IP address, Device ID, UserAgent, Reusable Cookie / Session identifier.

[0135] Strong combinations: Combinations such as "company + position + name" or "school + class + name" can be used to identify individuals; individual company names, positions, schools, and class information should also be categorized (because they can be collected and combined).

[0136] Third-party identifiable information: Name, phone number, email address, address, and relationship of emergency contacts / relatives.

[0137] Standard type tags: Real Name, Phone Number, Email, Detailed Address, AccountID / Username, Network Identifier, Identity Background, Relationship Info.

[0138] PL1: Public / Low Sensitivity (Counterexample - Do Not Extract)

[0139] Definition: Cannot identify a specific individual, only involves style, preference or habit.

[0140] Core criteria: Unidentifiable + Low hazard + Not highly sensitive.

[0141] Classification rules: expression preferences, interaction style, personality description (non-diagnostic), lifestyle habits, interest preferences, aesthetic preferences, motivation and goals, etc.

[0142] Typical example (ignore this information):

[0143] I like this tone of voice.

[0144] I run every morning at 6 a.m.

[0145] "I've been under a lot of pressure lately."

[0146] I like watching science fiction movies.

[0147] I have a rather short temper.

[0148] Extraction granularity and boundary principle

[0149] Core principle: Only extract "sensitive entities" or "minimum sensitive fact fragments"; extracting entire sentences is strictly prohibited to avoid destroying the original semantics.

[0150] Remove irrelevant context:

[0151] It does not contain introductory words (such as "My phone number is", "I live in", "The doctor said").

[0152] It does not contain punctuation (unless it belongs to an address or number).

[0153] Preserving semantic integrity (descriptive privacy):

[0154] For privacy information that cannot be expressed in a single word (such as transactions or trajectories), extract the smallest complete fragment.

[0155] Numerical values ​​must be combined with units / objects:

[0156] Individual numbers are usually not extracted unless they conform to PL2-PL4 (such as mobile phone numbers or ID numbers).

[0157] The amount must be withdrawn along with the intended use (if the intended use is private).

[0158] The real name must be the user's own.

[0159] Only the user's full name is considered a Real Name (PL2).

[0160] Determine if the name belongs to the user based on the User's Real Name field.

[0161] Output format (requirements)

[0162] Please strictly use JSON format for output and do not include Markdown code block tags. Output a JSON array directly. If no PL2-PL4 information is found, output an empty array [].

[0163] JSON field description:

[0164] original_text: The original text must be copied directly from the dialogue; it must not be modified, anonymized, or summarized.

[0165] privacy_type: Select from the standard type tags; if no exact match is found, you can fill in the English type based on semantic judgment.

[0166] privacy_level: PL2, PL3, and PL4 only.

[0167] Example 2

[0168] This embodiment provides a local reversible pseudonymization privacy protection system for cloud-based intelligent agent memory, deployed on a personal computer for interaction with cloud-based office assistant intelligent agents.

[0169] System composition and settings:

[0170] Local privacy classification configuration module: It has a pre-set four-level privacy classification system, configures commonly used privacy recognition rules for office scenarios, and provides privacy level judgment standards and supplementary judgment rules.

[0171] Local privacy detection module: Equipped with a lightweight detection model, adapted to the computing power of PCs, and supports real-time text scanning. The model has been fine-tuned and trained with reinforcement learning, and can accurately identify privacy information at all levels.

[0172] Desensitization and replacement module: Supports the generation of semantic type placeholders. The placeholders use a combination of semantic type and monotonically increasing sequence number. It supports user-defined protection thresholds and performs in-situ replacement.

[0173] Local secure mapping module: It uses a local encrypted SQLite database, supports cross-session mapping persistence, stores the correspondence between original privacy and placeholders, and ensures mapping security and consistency.

[0174] Cloud-based interaction module: Communicates with the cloud-based office assistant via HTTPS, sending and receiving anonymized text and intermediate replies to ensure secure transmission.

[0175] Local recovery module: Based on string matching and fast table lookup, it identifies placeholders through regular expression matching, realizes millisecond-level recovery of placeholders, and supports handling of abnormal placeholders.

[0176] Workflow:

[0177] The user entered office-related text: "My name is Li Si, my work email is lisi@company.com, my monthly salary is 25,000 yuan, and my workstation is Room 302, Building A."

[0178] The local privacy classification configuration module provides classification standards; the local privacy detection module identifies: Li Si (Level 2), lisi@company.com (Level 2), monthly salary of 25,000 yuan (Level 3), workstation A, Room 302 (Level 2); the desensitization and replacement module generates placeholders: <Name_1>, <Email_1>, <Salary_1>, <Address_1>; the local security mapping module stores and encrypts the mapping relationship; the cloud interaction module uploads the desensitized text, and the cloud office assistant builds the user's memory and replies with the intermediate text; the local recovery module restores the placeholders to the original information and displays a complete natural language reply.

[0179] The system in this embodiment operates stably with modular design, has efficient edge processing, normal cloud memory, and secure local storage of private data.

[0180] Example 3

[0181] This embodiment provides a local terminal device, which is a tablet computer equipped with the privacy protection program of this invention, for cloud-based intelligent tutor interaction in the education field.

[0182] Device settings:

[0183] The tablet computer is equipped with an Android system, a processor, and memory. The memory stores the privacy protection computer program of this invention. The device comes pre-installed with a four-level privacy classification system optimized for educational scenarios, which strengthens the rules for protecting minors' information and safeguards their information security.

[0184] Work process:

[0185] A student user entered: "My name is Wang Wu, I am 12 years old, and I live in Room 201, Building 5, Sunshine Community. I am not very good at math."

[0186] The processor executes the program, initiates local detection, identifies name, age, and address as sensitive information, and retains preference information; it performs placeholder replacement, generates a local mapping table, and uploads the de-identified text to the cloud-based intelligent tutor; the cloud provides learning suggestions based on the placeholders and returns an intermediate response; the local device restores the placeholders and displays the complete response to the user.

[0187] This embodiment demonstrates that the present invention can run independently on terminal devices, the program executes stably, and it is suitable for high-security scenarios such as the protection of minors' privacy.

[0188] Example 4

[0189] This embodiment provides a non-volatile computer-readable storage medium, which is a USB flash drive, containing a computer program for the method of the present invention.

[0190] Media settings:

[0191] The USB flash drive stores computer programs that can run on systems such as Windows, Linux, and Android. The programs include a four-level privacy classification system, a lightweight detection model, de-identification and replacement logic, mapping storage logic, and recovery logic, and are compatible with different terminal device operating environments.

[0192] Execution method:

[0193] Insert the USB drive into the local device, load the program, and the user inputs private dialogue text. The program automatically runs the method steps described in Example 1, completing the entire process of detection, de-identification, uploading, and recovery, without the original private data leaving the local device. During program execution, a local lightweight model is used for detection, the mapping relationship is encrypted and stored, and recovery is completed in milliseconds, completely transparent to the user.

[0194] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for local reversible pseudonymization privacy protection for cloud-based intelligent agent memory, characterized in that, include: A hierarchical privacy classification system is pre-installed on local devices to guide the identification and differentiated protection of sensitive information; Perform local privacy detection and classification on the original request text input by the user to determine the privacy information, privacy level and semantic type in the text; Based on the user-defined protection threshold, the identified privacy information is replaced with placeholders carrying semantic types to obtain desensitized text; The placeholders retain the syntactic components of the original privacy information in the desensitized text, enabling the cloud-based intelligent agent to perform intent parsing and logical reasoning based on the semantic type identifier. The mapping relationship between the original privacy information and the corresponding placeholder is encrypted and stored in a local secure storage unit. The mapping relationship supports persistent association across sessions, ensuring that the same privacy entity always corresponds to the same placeholder across sessions, and ensuring consistency of cloud memory retrieval. The de-identified text is sent to the cloud-based intelligent agent, which then performs semantic reasoning, tool invocation, and memory archiving based on the de-identified text, generating an intermediate response text with placeholders. The system receives the intermediate response text returned from the cloud, restores the placeholders to the original privacy information based on the mapping relationship stored locally, and obtains the natural language response text that can be displayed to the user.

2. The method according to claim 1, characterized in that, The hierarchical privacy classification system includes four privacy levels: top secret credentials, highly sensitive personal information, identifiable personal information, and publicly disclosed low-sensitivity preferences. Different privacy levels correspond to different protection strategies and de-identification rules.

3. The method according to claim 1, characterized in that, The local privacy detection and classification are performed using a lightweight detection model deployed on a local device. This lightweight detection model is specifically fine-tuned and trained with reinforcement learning to complete privacy information identification, level determination, and semantic type labeling.

4. The method according to claim 1, characterized in that, The placeholders carrying semantic types are composed of a semantic type identifier and a monotonically increasing sequence number. The sequence number of the same privacy type is allocated sequentially based on the number of similar placeholders already stored locally.

5. The method according to claim 1, characterized in that, The local secure storage unit is implemented using an encrypted database. The same privacy entity always corresponds to the same placeholder in multiple interactions across sessions, ensuring the consistency of cloud memory retrieval.

6. The method according to claim 1, characterized in that, The cloud-based intelligent agent only processes anonymized information in placeholder form during inference and archiving processes, without storing or accessing the original privacy plaintext data, thus achieving architecture-level data isolation.

7. The method according to claim 1, characterized in that, The lightweight detection model carried by the local privacy detection module is trained through two stages: supervised fine-tuning and reinforcement learning. In the reinforcement learning stage, a group relative policy optimization algorithm is adopted, using the average F1 score extracted from privacy information, privacy level and semantic type as a scalar reward signal, combined with KL divergence constraints to prevent output degradation, and the model is updated with a policy.

8. The method according to claim 1, characterized in that, When archiving memories, the cloud-based intelligent agent converts the anonymized text containing the placeholder into a vector representation and stores it in an external memory bank. Since the placeholder retains the semantic type identifier of the original privacy information, the cloud-based intelligent agent can recall historical memory fragments containing the same placeholder through similarity retrieval in subsequent cross-session interactions.

9. A local reversible pseudonymization privacy protection system for cloud-based intelligent agent memory, characterized in that, include: The local privacy classification configuration module is used to pre-configure a hierarchical privacy classification system on the local device; The local privacy detection module is used to perform privacy detection and classification on the original request text input by the user, and output privacy information, privacy level and semantic type; the lightweight detection model carried by the local privacy detection module is obtained through two-stage training of supervised fine-tuning and reinforcement learning. The desensitization and replacement module is used to replace privacy information with placeholders carrying semantic types based on a protection threshold, generating desensitized text. The placeholders retain the syntactic components of the original privacy information, supporting cloud-based intelligent agent intent parsing and logical reasoning. The local secure mapping module is used to encrypt and store the mapping relationship between the original privacy information and placeholders, supports persistent association across sessions, and ensures the consistency of mapping across sessions for the same entity; The cloud interaction module is used to send de-identified text to the cloud intelligent agent and receive intermediate response text with placeholders returned from the cloud. The local recovery module is used to restore the placeholders in the intermediate response text to the original privacy information based on the mapping relationship, and output the natural language response text.

10. The system according to claim 9, characterized in that, The local privacy detection module is equipped with a lightweight detection model that is adapted to the computing power of the local device and can complete the identification and classification of privacy information under low latency conditions.

11. The system according to claim 9, characterized in that, The placeholders generated by the desensitization and replacement module carry semantic type identifiers, which can maintain the semantic understanding, logical reasoning and memory archiving capabilities of the cloud-based intelligent agent.

12. The system according to claim 9, characterized in that, The local security mapping module adopts an encrypted storage structure to ensure that the mapping relationship is not read illegally and that the mapping of the same entity is consistent across sessions.

13. A local terminal device, characterized in that, The method includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 8.

14. A non-volatile computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 8.

Images