Data desensitization method, device, electronic device and storage medium

Abstract

The present invention discloses a data desensitization method, device, electronic device and storage medium. A data desensitization adversarial network model is pre-trained, and the data desensitization adversarial network model includes a generation model and a discrimination model, and the generation model and the discrimination model are obtained by training through adversarial learning. The desensitized data obtained based on the data desensitization adversarial network model has good security. And when generating the desensitized data, the original data to be processed is obtained, the original data is classified and marked, and a conditional vector is generated according to the classification mark. After the random distribution vector is generated, the random distribution vector and the conditional vector are input into the data desensitization adversarial network model, and the desensitized data corresponding to the original data is output based on the generation model in the data desensitization adversarial network model. The conditional vector is added to optimize the desensitized data, and the desensitized data includes numerical information and category information. Therefore, the desensitized data has good availability.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence and data security technology, and in particular to a data desensitization method, device, electronic device and storage medium. Background Art

[0002] At present, with the development of big data, artificial intelligence and Internet of Things technology, how to effectively protect personal privacy and protect sensitive corporate data from being leaked has become the focus of more and more security vendors. With the integration of high-tech information technology and the industrial field, the circulation and sharing of industrial data has been promoted. However, industrial data is very sensitive. For example, if corporate data, APP and other data are tampered with or stolen, it will seriously threaten user security, corporate security, and even national security. In this context, data desensitization technology came into being, which is an effective way to solve the above security problems and risks.

[0003] Data desensitization refers to the transformation of sensitive information according to preset rules or transformation algorithms, so that personal identity cannot be identified or sensitive information is directly hidden. Desensitized data will have a certain degree of information loss, so privacy leakage and data availability become a natural contradiction.

[0004] Traditional structured data desensitization technologies are based on anonymization and disturbance. These two types of technologies not only cause large information loss, but more importantly, there is a one-to-one correspondence between the original data and the desensitized data, which leads to a great risk of re-identification of the desensitized data.

[0005] How to ensure the security and availability of desensitized data is a technical problem that needs to be solved urgently. Summary of the invention

[0006] Embodiments of the present invention provide a data desensitization method, device, electronic device and storage medium to ensure the security and availability of desensitized data.

[0007] An embodiment of the present invention provides a data desensitization method, the method comprising:

[0008] Acquire raw data to be processed, classify and label the raw data, and generate a conditional vector according to the classification label;

[0009] Generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained by adversarial learning;

[0010] Based on the generation model in the data desensitization adversarial network model, desensitized data corresponding to the original data is output, wherein the desensitized data includes numerical information and category information.

[0011] Furthermore, the process of training the generative model and the discriminative model through adversarial learning includes:

[0012] For the sample data in the training set, classify and label the sample data, and generate a sample condition vector according to the classification label;

[0013] Generate a sample random distribution vector, input the sample random distribution vector and the sample condition vector into a generation model in a data desensitization adversarial network model, and the generation model outputs sample desensitized data;

[0014] Inputting the sample desensitized data and the sample condition vector into a discriminant model in a data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample;

[0015] Inputting the sample data and the sample condition vector into the discriminant model, the discriminant model outputting a second probability that the sample data is a true sample;

[0016] The generative model and the discriminative model are trained according to the first probability and the second probability.

[0017] Further, the training of the generative model and the discriminative model according to the first probability and the second probability includes:

[0018] The WGAN method is used to calculate the Wasserstein distance between the first probability and the second probability, and the generative model and the discriminative model are trained according to the Wasserstein distance.

[0019] Furthermore, the training process of the discriminant model includes:

[0020] A differential privacy algorithm is used to clip the determined gradient and add random noise before updating the parameters; the parameters are updated based on the gradient after clipping and adding random noise.

[0021] Further, the process of determining the gradient includes:

[0022] Determine the joint loss function of the generative adversarial network and the conditional generative adversarial network, the statistical information loss function including the expectation and variance, and the hinge loss function respectively, and determine the target loss function and the corresponding gradient according to the joint loss function, the statistical information loss function and the hinge loss function.

[0023] Furthermore, the structure of the generative model includes, from the input side to the output side, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer and a Softmax layer.

[0024] Furthermore, the structure of the discriminant model includes, from the input side to the output side, a fully connected layer, a LeakyRelu layer, a fully connected layer, a LeakyRelu layer, and a fully connected layer.

[0025] On the other hand, an embodiment of the present invention provides a data desensitization device, the device comprising:

[0026] An acquisition module, used for acquiring raw data to be processed, classifying and marking the raw data, and generating a conditional vector according to the classification mark;

[0027] An input module, used to generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generation model and a discriminant model, and the generation model and the discriminant model are trained by adversarial learning;

[0028] An output module is used to output the desensitized data corresponding to the original data based on the generation model in the data desensitization adversarial network model, wherein the desensitized data includes numerical information and category information.

[0029] Furthermore, the device also includes:

[0030] A training module is used to classify and label the sample data in a training set, and generate a sample condition vector based on the classification label; generate a sample random distribution vector, input the sample random distribution vector and the sample condition vector into a generation model in a data desensitization adversarial network model, and the generation model outputs sample desensitized data; input the sample desensitized data and the sample condition vector into a discriminant model in a data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample; input the sample data and the sample condition vector into the discriminant model, and the discriminant model outputs a second probability that the sample data is a true sample; and train the generation model and the discriminant model based on the first probability and the second probability.

[0031] The training module is specifically used to calculate the Wasserstein distance between the first probability and the second probability by using the WGAN method, and train the generative model and the discriminative model according to the Wasserstein distance.

[0032] The training module is specifically used to adopt a differential privacy algorithm to clip the determined gradient and add random noise before updating the parameters; and update the parameters according to the gradient after clipping and adding random noise.

[0033] The training module is specifically used to determine the joint loss function of the generative adversarial network and the conditional generative adversarial network, the statistical information loss function including expectation and variance, and the hinge loss function, and determine the target loss function and the corresponding gradient based on the joint loss function, the statistical information loss function and the hinge loss function.

[0034] On the other hand, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0035] Memory, used to store computer programs;

[0036] The processor is used to implement any of the method steps described above when executing the program stored in the memory.

[0037] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the method steps described above is implemented.

[0038] An embodiment of the present invention provides a data desensitization method, device, electronic device and storage medium, the method comprising: obtaining original data to be processed, classifying and marking the original data, and generating a conditional vector according to the classification mark; generating a random distribution vector, inputting the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model comprises a generative model and a discriminative model, and the generative model and the discriminative model are trained through adversarial learning; based on the generative model in the data desensitization adversarial network model, outputting the desensitized data corresponding to the original data, wherein the desensitized data comprises numerical information and category information.

[0039] The above technical solution has the following advantages or beneficial effects:

[0040] Since in an embodiment of the present invention, a data desensitization adversarial network model is pre-trained, and the data desensitization adversarial network model includes a generation model and a discriminant model, and the generation model and the discriminant model are obtained by training through adversarial learning. After the training of the data desensitization adversarial network model is completed, it is difficult for the discriminant model to distinguish the true and false of the desensitized data and the original data obtained by the generation model, so the desensitized data obtained based on the data desensitization adversarial network model is safe. And when generating the desensitized data, the original data to be processed is obtained, the original data is classified and marked, and a conditional vector is generated according to the classification mark. After generating the random distribution vector, the random distribution vector and the conditional vector are input into the data desensitization adversarial network model, and the desensitized data corresponding to the original data is output based on the generation model in the data desensitization adversarial network model. The conditional vector is added to optimize the desensitized data, and the desensitized data includes numerical information and category information. Therefore, the desensitized data has good availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A schematic diagram of a data desensitization process provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the training process of the generative model and the discriminative model provided in an embodiment of the present invention;

[0044] Figure 3 This is a diagram of the overall framework of desensitization based on a neural network proposed in an embodiment of the present invention;

[0045] Figure 4 Schematic diagram of the traditional GAN ​​network structure;

[0046] Figure 5 A data desensitization flow chart provided for an embodiment of the present invention;

[0047] Figure 6 A schematic diagram of a generation model structure provided by an embodiment of the present invention;

[0048] Figure 7 A schematic diagram of a residual network structure provided by an embodiment of the present invention;

[0049] Figure 8 A schematic diagram of the structure of a discriminant model provided by an embodiment of the present invention;

[0050] Fig. 9A schematic diagram of the structure of a data desensitization device provided in an embodiment of the present invention;

[0051] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] First, the terms involved in the present invention are explained.

[0054] Data representation classification:

[0055] In reality, data mainly exists in two forms, namely structured data and unstructured data. Common structured data is data in the form of databases. There are many types of unstructured data, and common unstructured data includes data in the form of text, images, voice, etc.

[0056] Structured data has a very fixed pattern, with the following characteristics: data is in rows, one row of data represents the information of an entity, and the attributes of each row of data are the same. The storage and arrangement of structured data are very regular, which is very helpful for operations such as query and modification. Therefore, desensitization of structured data usually starts from the overall distribution of the data.

[0057] Data desensitization introduction:

[0058] Data desensitization refers to the transformation of sensitive information according to preset rules or transformation algorithms, so that personal identity cannot be identified or sensitive information is directly hidden. Desensitized data will have a certain degree of information loss, so privacy leakage and data availability become a natural contradiction.

[0059] Existing technology and technical defects:

[0060] Traditional structured data desensitization technology:

[0061] Traditional research on structured data desensitization is mainly divided into anonymization-based technology and perturbation-based technology.

[0062] Common anonymization-based technologies include k-anonymity and its upgraded versions L-diversity and t-closeness, which generalize the quasi-identifier of a single piece of data to make the record indistinguishable in the entire data set.

[0063] The technology based on perturbation adds noise to the data, making it blurry. These two types of technologies not only cause a large loss of information, but more importantly, there will be a one-to-one correspondence between the original data and the desensitized data, which leads to a great risk of re-identification of the desensitized data.

[0064] Specific examples are shown in Table 1 below. The data in Table 1 are only sample data and have no meaning:

[0065] Name gender age post code Purchase Preferences Alice male 24 100083 Fitness Equipment Bob male 23 100084 clothing Candy female 26 100102 Skin Care Davis female 27 100104 Cooking tools Edith male 36 102208 Fitness Equipment Frank male 36 102201 clothing Grace female 34 102218 books Holley female 33 102219 clothing

[0066] Table 1

[0067] The data is represented in the form of a table, where each row represents a record and each column represents an attribute. Each record is associated with a specific user / individual. Table 1 Attributes can be divided into three categories:

[0068] Explicit identifiers: Generally, they are unique identifiers of individuals, such as name, address, phone number, etc. These contents are not displayed when public data is required;

[0069] Quasi-identifiers: These are not unique, like zip codes, ages, birthdays, etc., but they can help researchers manage related data.

[0070] Sensitive data: data that users do not want others to know, such as purchasing preferences, salaries, etc. These data are of most concern to researchers.

[0071] In addition to the above three categories, there is another type of attribute that is not shown in Table 1, for example:

[0072] Non-sensitive data: data that can be made public without any risk, such as serial numbers.

[0073] Simply put, the purpose of k-anonymity is to ensure that for each record in the public data, there are at least k-1 other records that cannot be distinguished by quasi-identifiers.

[0074] For example, suppose a public data is protected by 2-anonymity. If an attacker wants to confirm Frank's sensitive information, by querying his age, zip code and gender, the attacker will find that there are at least two people with the same age, zip code and gender in the data. In this way, the attacker cannot distinguish which of the two data is Frank, thus ensuring that Frank's privacy will not be leaked. As shown in Table 2 below: the name as an identifier is replaced by "*", gender, age and zip code are quasi-identifiers, and purchase preferences are sensitive attributes.

[0075]

[0076] Table 2 2-anonymity example

[0077] Although k-anonymity reduces the possibility of re-identification attacks (records can be recovered or identified if background knowledge or other sources of information are available), information about other sensitive attributes of the table can still be obtained. This sensitive attribute information enables attackers to conduct homogeneity and background knowledge attacks, also known as attribute leakage attacks. In order to deal with these attacks, L-diversity was proposed on k-anonymity, and the concept of sensitive attribute diversity was also proposed. That is, for data with the same quasi-identifier, sensitive data must be diverse, so as to ensure that the user's privacy cannot be inferred through background knowledge and other methods. L-diversity ensures that there are at least L types of sensitive attributes in the same type of data. As shown in Table 3 below, 3-diversity is taken as an example: the combination of quasi-identifier values ​​contains 3 pieces of sensitive data with different contents.

[0078] Name gender age post code Purchase Preferences ＊ male (20，30] 10008＊ Fitness Equipment ＊ male (20，30] 10008＊ Fitness Equipment ＊ male (20，301 10008＊ Fitness Equipment ＊ male (20，30] 10008＊ … ＊ male (20，30] 10008＊ … ＊ … (20，30] … … ＊ … (20，30] … books ＊ male (20，30] 10008＊ Cooking tools

[0079] Table 3 3-diversity example

[0080] For L-diversity, it is still vulnerable to attack when the attacker knows the global distribution of the attribute. To solve this problem, people have proposed the t-closeness algorithm. t-closeness ensures that the distribution of sensitive information in the quasi-identifier combination is close to the distribution of sensitive information in the entire data, so that the difference between the two distributions does not exceed the threshold t. However, even if k-anonymity, L-diversity, and t-closeness are guaranteed at the same time, information can still be leaked due to the attacker's background knowledge.

[0081] In addition, data perturbation usually involves changing the values ​​and adding "noise" to the database. Compared with anonymization methods, data perturbation technology not only modifies quasi-identifiers, but also modifies sensitive data. In doing so, the availability of these modified data will be greatly affected.

[0082] Based on the above technical problems, the technical problems to be solved by the present invention and the inventive ideas are as follows:

[0083] The desensitization system based on neural network has the following advantages: (1) It breaks the one-to-one mapping relationship between data before and after desensitization, solving the problem of reverse attack risk of desensitized data. (2) It has better usability and security after desensitization. (3) It has better fault tolerance and self-adaptation ability for heterogeneous data (different regions or enterprises, etc.). (4) It has the ability to learn through examples.

[0084] To this end, the present invention mainly aims at the deficiencies of anonymization and perturbation desensitization methods, and starts from solving the security problem in the data generation stage. It proposes a generative adversarial network ResNet+GAN+DP for structured data generation and desensitization. Based on the ResNet neural network, the system uses the training ideas of WAGN and CGAN to optimize the effect of desensitized data, and further introduces differential privacy (DP) into the model. By clipping the gradient and adding noise to perturb the discriminator, the influence of each piece of data on the model is limited. Finally, desensitized data with high usability and security is generated.

[0085] The data desensitization process provided by the embodiment of the present invention is described in detail below.

[0086] Figure 1 A schematic diagram of a data desensitization process provided by an embodiment of the present invention, the process includes:

[0087] S101: Acquire original data to be processed, classify and label the original data, and generate a conditional vector according to the classification label.

[0088] S102: Generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained through adversarial learning.

[0089] S103: Based on the generation model in the data desensitizing adversarial network model, output the desensitized data corresponding to the original data, wherein the desensitized data includes numerical information and category information.

[0090] The data desensitization method provided in the embodiment of the present invention is applied to an electronic device, which may be a device such as a PC, a tablet computer, or a server.

[0091] After the electronic device obtains the raw data to be processed, it determines the category information of the raw data, classifies and labels the raw data according to the category information of the raw data, and then generates a conditional vector according to the classification label. For example, the classification label of the raw data includes "name", and the conditional vector is obtained by encoding "name". The electronic device generates a random distribution vector, which can also be called a hidden variable. The random distribution vector and the conditional vector are then input into a pre-trained data desensitization adversarial network model, and based on the generation model in the data desensitization adversarial network model, the desensitized data corresponding to the raw data is output, where the desensitized data includes numerical information and category information.

[0092] The embodiment of the present invention focuses on the training process of the data desensitization adversarial network model. The data desensitization adversarial network model includes a generation model and a discriminant model. The training process of the data desensitization adversarial network model is also the training process of the generation model and the discriminant model.

[0093] Figure 2 A schematic diagram of the training process of the generative model and the discriminative model provided in an embodiment of the present invention, the process includes:

[0094] S201: Classify and label the sample data in a training set, and generate a sample condition vector according to the classification label.

[0095] S202: Generate a sample random distribution vector, input the sample random distribution vector and the sample condition vector into a generation model in a data desensitization adversarial network model, and the generation model outputs sample desensitized data.

[0096] S203: Input the sample desensitized data and the sample condition vector into a discriminant model in a data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample.

[0097] S204: Input the sample data and the sample condition vector into the discriminant model, and the discriminant model outputs a second probability that the sample data is a true sample.

[0098] S205: Training the generative model and the discriminative model according to the first probability and the second probability.

[0099] When training the generative model and the discriminative model, the electronic device saves a training set in advance. The data in the training set is called sample data. The sample data is classified and labeled, and a sample condition vector is generated according to the classification label. Then the generated sample random distribution vector and sample condition vector are input into the generative model in the data desensitization adversarial network model, and the generative model outputs the sample desensitized data.

[0100] The sample desensitized data and the sample condition vector are input into the discriminant model in the data desensitization adversarial network model, and the discriminant model outputs the first probability that the sample desensitized data is a true sample; the sample data and the sample condition vector are input into the discriminant model, and the discriminant model outputs the second probability that the sample data is a true sample. Finally, the generative model and the discriminant model are trained based on the first probability and the second probability.

[0101] Traditional adversarial network models have problems such as training non-convergence, gradient disappearance, and mode collapse. To address the above problems, the embodiment of the present invention trains the generative model and the discriminative model according to the first probability and the second probability, including: using the WGAN method to calculate the Wasserstein distance between the first probability and the second probability, and training the generative model and the discriminative model according to the Wasserstein distance. By introducing the Wasserstein distance to measure the distance between the first probability and the second probability to replace the JS divergence and KL divergence in the traditional adversarial network model that measure the difference between different probabilities, the shortcomings of the traditional adversarial network model are greatly compensated.

[0102] In order to further ensure the security of the desensitized data, in an embodiment of the present invention, the training process of the discriminant model includes: using a differential privacy algorithm, clipping the determined gradient and adding random noise before updating the parameters; and updating the parameters according to the gradient after clipping and adding random noise.

[0103] In order to ensure data security, the embodiment of the present invention introduces differential privacy, which can largely ensure the security of the generated desensitized data, because according to its definition, if the training process of the model is differentially private, the probability of training the same model with or without a certain sample in the training data set is close. Therefore, differential privacy is added during the training process of the discriminant model, so that the entire data desensitization adversarial network model maintains differential privacy.

[0104] The embodiment of the present invention uses the DP-SGD algorithm to train the discriminant model. In the traditional stochastic gradient descent (SGD) algorithm, the gradient of the loss function to the model parameter θt is first calculated during the parameter optimization process of the algorithm, and then the product of the gradient and the learning rate lr is subtracted from the current parameter to update the current parameter to θt+1. Repeat this process until the loss converges. The DP-SGD algorithm clips the calculated gradient and adds corresponding noise before updating the parameters. After clipping the gradient, random noise that conforms to the Gaussian distribution needs to be added to introduce randomness to the discriminator model, that is, Gaussian noise is added to the clipped gradient and then averaged, and finally the value is used for parameter update.

[0105] The loss function is the key to the training of the data desensitization adversarial network model and guides the training process of the data desensitization adversarial network model. In essence, the training process of the data desensitization adversarial network model is the process of optimizing the loss function. In an embodiment of the present invention, the process of determining the gradient includes: respectively determining the joint loss function of the generative adversarial network and the conditional generative adversarial network, the statistical information loss function including the expectation and variance, and the hinge loss function, and determining the target loss function and the corresponding gradient according to the joint loss function, the statistical information loss function, and the hinge loss function.

[0106] In addition to using the common joint loss function of WGAN and CGAN, the entire network of the embodiment of the present invention also adds a statistical information loss function and a hinge loss function to optimize and control the desensitization effect and improve the data generation quality. The target loss function and the corresponding gradient are determined according to the joint loss function, the statistical information loss function and the hinge loss function.

[0107] In the embodiment of the present invention, the structure of the generative model includes, from the input side to the output side, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer, and a Softmax layer. The structure of the discriminative model includes, from the input side to the output side, a fully connected layer, a LeakyRelu layer, a fully connected layer, a LeakyRelu layer, and a fully connected layer.

[0108] The following is a detailed description of the training process of the generative model and the discriminative model in the data desensitization adversarial network model. After the training of the generative model and the discriminative model is completed, the generative model is used to generate desensitized data.

[0109] The English explanation is as follows:

[0110] WGAN (Wasserstein Generative Adversarial Nets): Wasserstein Generative Adversarial Networks;

[0111] CGAN (Conditional Generative Adversarial Nets): Conditional Generative Adversarial Networks;

[0112] DP (Differential Privacy): Differential Privacy;

[0113] ResNet: residual network;

[0114] DP-SGD (Differential Privacy-stochastic gradient descent): stochastic gradient descent based on differential privacy;

[0115] L-diversity:l-diversity;

[0116] t-closeness: t-approximation.

[0117] The embodiment of the present invention provides a data desensitization method based on a neural network. The overall process is as follows: first, the sample random distribution vector and the corresponding sample condition vector are used as the input of the generation model (G), and D is the discriminant model to determine whether the sample data is real data or data generated by G; then, the parameters of the generation model are fixed to train the discriminant model, and differential privacy (DP) is added when training the discriminant model, gradient clipping and noise are added; finally, the discriminant model parameters are fixed, and the discriminant model probability is fed back to G to guide the gradient update of G. After multiple iterations and alternating optimization of G and D, data can be generated. At the same time, WGAN and CGAN are also used in the training process to optimize the quality of the generated desensitized data. The security and availability of the generated data can be ensured through strategies such as DP, WGAN, and CGAN. Thereby better serving personal data, enterprise data, and national data security. In the embodiment of the present invention, the desensitized data generated by GAN and DP for sample data is close in distribution and has high availability, but it is not real data, so the desensitized data has high security.

[0118] WGAN updates the D network stably by trimming the D network parameters.

[0119] CGAN is the first attempt to conditionally generate GAN, which directly adds conditional information c to the network input to control the conditional output mode of the network.

[0120] Differential privacy technology: It can ensure that changes in a single individual in a data set have little effect on the statistical results of the overall data set, thereby providing strong privacy protection for individual sensitive information. DP describes the impact of a small change in the original data set on the final statistical output in the form of probability, and constrains this probability change through the privacy parameter ε to achieve the purpose of privacy protection.

[0121] Figure 3 The overall framework diagram of desensitization based on neural network proposed in the embodiment of the present invention, the specific steps are as follows:

[0122] Step 1: Input data construction.

[0123] For the entire system, the input data needs to be constructed first. The input of the generation model (G) is composed of the addition or concatenation of the sample random distribution vector, or the latent vector z of the sample random distribution and the corresponding sample condition vector. The sample random distribution vector refers to a random noise vector. The generated desensitized data can be obtained by training this vector. The sample condition vector refers to the embedding vector of the attribute category label of the sample data. It is used to guide the attribute category to which the generated data needs to generate the corresponding value. For example: a database has four attributes such as name, address, job, and ID number. Each attribute is encoded to obtain its randomly initialized embedding vector representation second. At the same time, the embedding vector representation ez of the corresponding attribute value (hidden variable z) is generated for these four attributes. Finally, the encoding of each generator data is shown in Formula 1:

[0124] e i =concat[e cond , e z ] Formula 1.

[0125] Step 2: Training process.

[0126] The idea of ​​the traditional GAN ​​network is a two-player game, where the sum of the interests of both parties is a constant. Extending this to GAN, we can see that there are two such players in GAN, one is the generation model (G) and the other is the discrimination model (D). Figure 4 As shown. The generative model is used to generate a realistic sample, and the discriminative model is used to determine whether the input of the model is true or false. In layman's terms, the generative model must continuously improve its counterfeiting skills to ultimately achieve the goal of deceiving the discriminative model. The discriminative model continuously improves its discriminative ability to achieve the purpose of distinguishing true from false, which forms a game, that is, confrontation. These two networks with opposite goals are constantly trained alternately. When they finally converge, if the discriminative network can no longer determine the source of a sample, then it is equivalent to the generative network being able to generate samples that conform to the real data distribution. Applied to the field of desensitization, it means that the desensitized (generated) data conforms to the real data distribution and can be used for subsequent data analysis and mining (availability), but it is not real data (security).

[0127] However, the original GAN ​​network has problems such as training non-convergence, gradient disappearance, and mode collapse. To address these problems, this case uses the WGAN strategy, which introduces the Wasserstein distance (which measures the distance between two probability distributions) to replace the JS divergence and KL divergence in the original GAN ​​that measure the differences between different distributions, thus making up for the shortcomings of GAN to a great extent. At the same time, in order to solve the problem that the original GAN ​​is not good at controlling which category the output belongs to during the generation phase, this case also uses the CGAN network, which is an improvement based on GAN and adds conditional distribution, that is, by adding additional conditional information to the generator and discriminator of the original GAN, which can be category labels or other auxiliary information, to achieve a conditional generation model.

[0128] Now that we have some concepts about GAN, let’s introduce how to use GAN to desensitize structured data. The training process is as follows: Figure 3 As shown. First, the input data ei is input into the GAN generation model to fit the data distribution of the training data (i.e., the data to be desensitized), and the generated data (i.e., desensitized data) G(ei) is obtained through a series of transformations, and then it is input into the discriminant model for prediction, and the discriminant model parameters are optimized to obtain D(G(ei)). Next, the discriminant model parameters are fixed, and the discriminant probability is fed back to G to guide the gradient update of G. Finally, after the model training converges, the generation model can be used to generate data, and the purpose of desensitizing the data can be achieved. However, considering the quality of the generated data, that is, how to control the degree of desensitization and security, the embodiment of the present invention introduces a statistical information loss function to control the degree of fitting and then the degree of data desensitization. At the same time, because the training idea of ​​CGAN is adopted, conditional information needs to be added, which is equivalent to adding a layer of conditional constraints (category label constraints) on the hidden variable z to constrain the generated data, as shown in Formula 7. In addition, the DP idea (gradient clipping, adding noise) is added to the discriminator training to better ensure the security of the data.

[0129] Step 3: Desensitization process.

[0130] After having a trained model, to use this model for desensitization, just use the trained GAN generation model, input the ei vector of the data to be desensitized into the generation model (G) to obtain G(ei), as follows Figure 5 As shown, desensitized data can be generated when used, and the generated data can be used by data users for data distribution statistical analysis, data mining and other purposes.

[0131] Step 4: Construction of generative model (G) and discriminative model (D).

[0132] After introducing the training and desensitization process of the entire desensitization system, let's specifically introduce the generation model (G) and the discriminant model (D) in the network structure, which are the core modules of the entire GAN network.

[0133] Generative Model (G):

[0134] Generative models can take many forms and can be combined using different neural network models. The main structures of the generators introduced in this article are multi-layer perceptron and ResNet structures, such as Figure 6 As shown. First, let’s briefly introduce the ResNet network.

[0135] ResNet is a residual network, which can be understood as a sub-network. This sub-network can form a very deep network after multiple layers are stacked. Figure 6 The plus sign in can be simply understood as vector addition, which is part of the implementation of the residual network; the residual network adds the information of the previous layer and the output of the previous layer with nonlinear changes. Let's take a look at the structure of ResNet, as shown in Figure 7 It is generally understood that for a neural network, the deeper the network, the more information it can obtain and the richer the features. However, experiments have shown that as the network deepens, the optimization effect becomes worse, and the accuracy of the test data and training data decreases. This is because the deepening of the network will cause gradient explosion and gradient disappearance. In view of this, a residual network is generated. It can be seen that the output in the box is not only obtained by nonlinear transformation of the output of the previous layer, but also adds shallow information x. This can greatly alleviate the situation of information loss as the number of network layers becomes deeper.

[0136] The generative model of the embodiment of the present invention is built under the condition of ResNet structure as the main structure, combining the multi-layer perceptron with ResNet, retaining the shallow information representation of the model, and the input of the model is mainly composed of the addition or concatenation of the latent variable z and a conditional embedding vector, such as ei in step 1. The conditional embedding layer converts the sparse conditional vector represented by one-hot encoding into a distributed (Embedding) representation. The specific process of generating data by the generative model is shown in Formula 2.

[0137] h w1 =e i +relu(w1e i +b1);

[0138] h w2 =h w1 +relu(w2h w1 +b2);

[0139] g(i) = Gumbel-Softmax(w3hw2 +b3);

[0140] Formula 2.

[0141] The input vector ei is passed through two residual network modules in succession, and finally through Gumbel-Softmax to obtain the generated data. The Gumbel-softmax distribution is used for sampling output to ensure that the parameters of the generative model and the discriminative model can be updated through the gradient-based algorithm.

[0142] Discriminant model (D):

[0143] After having the generative model, we need to build the discriminative model, which also uses the framework of multi-layer perceptron. The activation function used in each fully connected layer is leakyReLU, which solves the neuron death problem of the Relu activation function. In addition, each forward propagation uses the output or original data of the generative model as input to perform binary classification and update the parameters of the discriminative model. The discriminative model structure is as follows: Figure 8 The specific discriminator discrimination process is shown in Formula 3. In order to ensure the security of generated data, the idea of ​​DP is also added, see step 5 for details.

[0144] h w1 =leakyrelu(w1g(i)+b1);

[0145] h w2 =leakyrelu(w2h w1 +b2);

[0146] D(i)=w3h w2 +b3;

[0147] Formula 3.

[0148] Step 5: Differential privacy of the discriminator.

[0149] In order to ensure data security, the embodiment of the present invention also introduces differential privacy, which can guarantee the security of generated data to a large extent, because according to its definition, if the training process of the model is differentially private, the probability of training the same model with or without a certain sample in the training data set is close. Therefore, differential privacy is added to the discriminator to keep the differential privacy of the entire network.

[0150] The embodiment of the present invention uses the DP-SGD algorithm to train the discriminator. In the traditional stochastic gradient descent (SGD) algorithm, the gradient of the loss function to the model parameter θt is first calculated during the parameter optimization process, and then the product of the gradient and the learning rate lr is subtracted from the current parameter to update the current parameter to θt+1. This process is repeated until the loss converges. The DP-SGD algorithm clips the calculated gradient and adds corresponding noise before updating the parameters.

[0151] The embodiment of the present invention performs L2 norm clipping on the gradient in the process of updating the discriminator parameters, as specifically shown in Formula 4.

[0152]

[0153] Where g(xi) represents the gradient vector, C is the gradient threshold, and the specific meaning of the formula is that if the gradient L2 norm is less than or equal to C, the gradient does not change, otherwise it is Gradient scaling is performed in proportion. Gradient clipping avoids gradient explosion and reduces overfitting, thus making the model converge better.

[0154] After clipping the gradient, it is necessary to add random noise that conforms to the Gaussian distribution to introduce randomness into the discriminator model, that is, add Gaussian noise to the clipped gradient and then average it, and finally use the value for parameter update, as shown in Formula 5:

[0155]

[0156] θ t+1 =θ t -lr·g;

[0157] Formula 5.

[0158] Where σ is the noise size. The larger the noise, the better the security. However, excessive noise may cause data distortion.

[0159] For DP-SGD, it is also important to control the privacy loss during the entire discriminator training process so that it does not exceed the overall privacy budget. To this end, the embodiment of the present invention uses a new privacy estimation method MomentsAccountant, which is specifically shown in the following formula 6:

[0160]

[0161] Where M is a random algorithm, d and d~ represent the data sets before and after differential privacy, and o is the output. This method has strict requirements on privacy loss. DP-SGD can iterate more times during the training process, learn more knowledge, and then achieve better results while ensuring security. That is, it ensures that the discriminator data has both good security and good results.

[0162] The entire GAN network training process: first train the discriminant model and then train the generative model.

[0163] Discriminant model training process: First, fix the generation model parameters, take the random distribution vector and the corresponding conditional vector as the input of the generation model, and get the output of the generation model. Then, fit (train) the discriminator based on the output (generated sample probability distribution) and the real sample probability distribution. Calculate the loss loss and corresponding gradient using the joint loss function of WGAN and CGAN in formula 7, the loss function of statistical information in formula 8, and the hinge loss function in formula 9. Based on this, clip and add noise to the calculated gradient in combination with differential privacy technology. Then, a round of discriminator parameter update can be completed based on the gradient after differential privacy.

[0164] Generative model training process: The parameters of the discriminant model are fixed after one round of update, and the discriminant probability is fed back to the generator to guide the parameter update of the generator.

[0165] The discriminant model and the generative model achieve convergence and minimize the loss function after multiple alternating optimizations.

[0166] Step 6: Loss function;

[0167] With the architecture of the entire network, the loss function of the embodiment of the present invention is introduced below. The loss function is the key to the neural network and guides the process of neural network training. In essence, the training process of the neural network is the process of optimizing the loss function. In addition to using the common joint loss function of WGAN and CGAN such as Formula 7, the entire network of this case also adds a statistical information loss function in order to optimize and control the desensitization effect (data generation quality).

[0168]

[0169] Where x is the original data, z is the latent variable, Pz represents the distribution of the input variable of the generative model, G is the generative model, and its output is the generated data; D is the discriminative model. y is the additional conditional information.

[0170] The loss function of statistical information can be used for model learning to optimize the quality of generated data. Statistical information mainly considers expectation and variance. In addition, the desensitization process also hopes to control the quality of generated data. Specifically, the expectation and variance of generated data are controlled through formula 8. Its physical meaning is to measure the difference between the expectation and variance of original data and desensitized data.

[0171]

[0172]

[0173] Formula 8.

[0174] Where f represents a series of linear and nonlinear transformation operations on the data, E refers to the expectation of the features of the last layer of the model, and SD refers to the variance of the features of the last layer. In the desensitization scenario, many times we do not want to share desensitized data that is very similar to the original data with untrustworthy partners, so we need to control the desensitization effect (the quality of the generated data). Through the following formula 9, the hinge loss function of Lf-mean and Lf-sd is added. mf-mean and mf-sd are the hyperparameters of the hinge loss function. Adjusting these two parameters can control the quality of data generation and the degree of desensitization.

[0175] L statis =max(0,L f-mean -m f-mean )+max(0,L f-sd -m f-sd )

[0176] ;Formula 9.

[0177] Step 7: Security and availability.

[0178] An important principle for desensitization algorithms is the need for security and availability assessments. For availability, this case uses a statistical information loss function for model learning to optimize the quality of generated data. For security, the DP idea is used to ensure the security of generated data. In addition, since the desensitized data generated by the GAN network still has specific values ​​or categories, it can be directly used for model training at the data availability level, and can also bring a more intuitive experience when conducting data analysis and mining.

[0179] In summary, the above structured data desensitization algorithm has achieved certain results in both usability and security, and has brought new ideas for the trade-off between usability and security of the desensitization algorithm.

[0180] The embodiment of the present invention uses a neural network algorithm based on the Resnet+GAN network to perform data desensitization, which is different from the existing anonymization and perturbation algorithms. It improves the shortcomings of the traditional desensitization algorithm that the data before and after desensitization may be attacked by re-identification due to the one-to-one correspondence, and proposes a new idea for the development of desensitization algorithms. The idea of ​​WGAN+CGAN+DP is used in the entire system network. Compared with the traditional desensitization algorithm, it not only controls the quality of the generated data, but also ensures the security of the generated data, and enhances the availability and security of the desensitized data.

[0181] Fig. 9 A schematic diagram of the structure of a data desensitization device provided in an embodiment of the present invention, the device comprises:

[0182] An acquisition module 91 is used to acquire raw data to be processed, classify and label the raw data, and generate a condition vector according to the classification label;

[0183] An input module 92 is used to generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained by adversarial learning;

[0184] The output module 93 is used to output the desensitized data corresponding to the original data based on the generation model in the data desensitization adversarial network model, wherein the desensitized data includes numerical information and category information.

[0185] The device also includes:

[0186] The training module 94 is used to classify and label the sample data in the training set, and generate a sample condition vector based on the classification label; generate a sample random distribution vector, input the sample random distribution vector and the sample condition vector into the generation model in the data desensitization adversarial network model, and the generation model outputs sample desensitized data; input the sample desensitized data and the sample condition vector into the discriminant model in the data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample; input the sample data and the sample condition vector into the discriminant model, and the discriminant model outputs a second probability that the sample data is a true sample; and train the generation model and the discriminant model based on the first probability and the second probability.

[0187] The training module 94 is specifically configured to calculate the Wasserstein distance between the first probability and the second probability by using the WGAN method, and train the generative model and the discriminative model according to the Wasserstein distance.

[0188] The training module 94 is specifically used to adopt a differential privacy algorithm to clip the determined gradient and add random noise before updating the parameters; and update the parameters according to the gradient after clipping and adding random noise.

[0189] The training module 94 is specifically used to determine the joint loss function of the generative adversarial network and the conditional generative adversarial network, the statistical information loss function including expectation and variance, and the hinge loss function, and determine the target loss function and the corresponding gradient based on the joint loss function, the statistical information loss function and the hinge loss function.

[0190] An embodiment of the present invention further provides an electronic device, such as Fig.10As shown, it includes: a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304;

[0191] The memory 303 stores a computer program. When the program is executed by the processor 301, the processor 301 performs the following steps:

[0192] Acquire raw data to be processed, classify and label the raw data, and generate a conditional vector according to the classification label;

[0193] Generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained by adversarial learning;

[0194] Based on the generation model in the data desensitization adversarial network model, desensitized data corresponding to the original data is output, wherein the desensitized data includes numerical information and category information.

[0195] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present invention. Since the principle of solving the problem by the above electronic device is similar to that of the data desensitization method, the implementation of the above electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0196] The electronic device provided in the embodiment of the present invention may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), a network side device, etc.

[0197] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0198] The communication interface 302 is used for communication between the electronic device and other devices.

[0199] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0200] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0201] In an embodiment of the present invention, when the processor executes the program stored in the memory, it obtains the original data to be processed, classifies and marks the original data, and generates a conditional vector based on the classification mark; generates a random distribution vector, and inputs the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained through adversarial learning; based on the generative model in the data desensitization adversarial network model, outputs the desensitized data corresponding to the original data, wherein the desensitized data includes numerical information and category information.

[0202] Since in an embodiment of the present invention, a data desensitization adversarial network model is pre-trained, and the data desensitization adversarial network model includes a generation model and a discriminant model, and the generation model and the discriminant model are obtained by training through adversarial learning. After the training of the data desensitization adversarial network model is completed, it is difficult for the discriminant model to distinguish the true and false of the desensitized data and the original data obtained by the generation model, so the desensitized data obtained based on the data desensitization adversarial network model is safe. And when generating the desensitized data, the original data to be processed is obtained, the original data is classified and marked, and a conditional vector is generated according to the classification mark. After generating the random distribution vector, the random distribution vector and the conditional vector are input into the data desensitization adversarial network model, and the desensitized data corresponding to the original data is output based on the generation model in the data desensitization adversarial network model. The conditional vector is added to optimize the desensitized data, and the desensitized data includes numerical information and category information. Therefore, the desensitized data has good availability.

[0203] The embodiment of the present invention further provides a computer storage readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program is run on the electronic device, the electronic device implements the following steps when executing:

[0204] Acquire raw data to be processed, classify and label the raw data, and generate a conditional vector according to the classification label;

[0205] Generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained by adversarial learning;

[0206] Based on the generation model in the data desensitization adversarial network model, desensitized data corresponding to the original data is output, wherein the desensitized data includes numerical information and category information.

[0207] Based on the same inventive concept, a computer-readable storage medium is also provided in an embodiment of the present invention. Since the principle of solving the problem when the processor executes the computer program stored on the above-mentioned computer-readable storage medium is similar to the data desensitization method, the implementation of the processor when executing the computer program stored on the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0208] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0209] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0210] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0211] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0212] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0213] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A data desensitization method, characterized in that: The method comprises: Acquire raw data to be processed, classify and label the raw data, and generate a conditional vector according to the classification label; Generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generative model and a discriminative model, and the generative model and the discriminative model are trained by adversarial learning; Based on the generation model in the data desensitization adversarial network model, output the desensitized data corresponding to the original data, wherein the desensitized data includes numerical information and category information; The process of training the generative model and the discriminative model through adversarial learning includes: For the sample data in the training set, classify and label the sample data, and generate a sample condition vector according to the classification label; Generate a sample random distribution vector, input the sample random distribution vector and the sample condition vector into a generation model in a data desensitization adversarial network model, and the generation model outputs sample desensitized data; Inputting the sample desensitized data and the sample condition vector into a discriminant model in a data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample; Inputting the sample data and the sample condition vector into the discriminant model, the discriminant model outputting a second probability that the sample data is a true sample; Training the generative model and the discriminative model according to the first probability and the second probability; The training process of the discriminant model includes: A differential privacy algorithm is used to clip the determined gradient and add random noise before updating the parameters; the parameters are updated based on the gradient after clipping and adding random noise.

2. The method according to claim 1, characterized in that The training of the generative model and the discriminative model according to the first probability and the second probability comprises: The WGAN method is used to calculate the Wasserstein distance between the first probability and the second probability, and the generative model and the discriminative model are trained according to the Wasserstein distance.

3. The method according to claim 1, characterized in that The process of determining the gradient includes: Determine the joint loss function of the generative adversarial network and the conditional generative adversarial network, the statistical information loss function including the expectation and variance, and the hinge loss function respectively, and determine the target loss function and the corresponding gradient according to the joint loss function, the statistical information loss function and the hinge loss function.

4. The method according to claim 1, characterized in that The structure of the generative model includes, from the input side to the output side, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer, a Relu layer, a residual network layer, a fully connected layer and a Softmax layer.

5. The method according to claim 1, characterized in that The structure of the discriminant model includes, from the input side to the output side, a fully connected layer, a LeakyRelu layer, a fully connected layer, a LeakyRelu layer, and a fully connected layer.

6. A data desensitization device, characterized in that: The device comprises: An acquisition module, used for acquiring raw data to be processed, classifying and marking the raw data, and generating a conditional vector according to the classification mark; An input module, used to generate a random distribution vector, and input the random distribution vector and the conditional vector into a pre-trained data desensitization adversarial network model, wherein the data desensitization adversarial network model includes a generation model and a discriminant model, and the generation model and the discriminant model are trained by adversarial learning; An output module, configured to output desensitized data corresponding to the original data based on the generation model in the data desensitization adversarial network model, wherein the desensitized data includes numerical information and category information; Wherein, the device further comprises: A training module, used for classifying and labeling the sample data in the training set, and generating a sample condition vector according to the classification label; generating a sample random distribution vector, inputting the sample random distribution vector and the sample condition vector into a generation model in a data desensitization adversarial network model, and the generation model outputs sample desensitized data; inputting the sample desensitized data and the sample condition vector into a discriminant model in a data desensitization adversarial network model, and the discriminant model outputs a first probability that the sample desensitized data is a true sample; inputting the sample data and the sample condition vector into the discriminant model, and the discriminant model outputs a second probability that the sample data is a true sample; and training the generation model and the discriminant model according to the first probability and the second probability; The training module is specifically used to adopt a differential privacy algorithm to clip the determined gradient and add random noise before updating the parameters; and update the parameters according to the gradient after clipping and adding random noise.

7. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method according to any one of claims 1 to 5 when executing a program stored in a memory.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images