Differential privacy-based text desensitization method, program product and computing device

Abstract

Embodiments of the present specification relate to a differential privacy-based text desensitization method, program product and computing device, the method comprising: obtaining a cluster set, any target word in any cluster having a preset replacement probability distribution, the replacement probability distribution being determined based on an exponential mechanism, the probability description module is used for describing the probability of replacing the target word with each word in the cluster; named entity recognition is carried out on an input text to be desensitized, and entity types to which all words belong are determined and comprise entity types preset as sensitive word types; for any target sensitive word belonging to the sensitive word type, judging whether the target sensitive word exists in any cluster of a cluster set, and when the target sensitive word exists in a first target cluster, sampling according to replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word; and replacing the target sensitive word in the to-be-desensitized text with the target replacement word to obtain a desensitized text.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of privacy computing technology, and in particular, to a text desensitization method, program product, and computing device based on differential privacy. Background Art

[0002] Large language models (hereinafter referred to as large models) have achieved great success in recent years and have been widely used in various fields. As a result, data privacy in the application of large language models has also attracted attention. Pre-trained large models are usually fine-tuned before executing downstream specific tasks. The process of executing downstream tasks often includes the inference process based on the large model. In both the fine-tuning and inference processes, there are obvious risks of privacy leakage.

[0003] During the fine-tuning process, the downstream task party needs to use its own unique data set to fine-tune a large model in a vertical field. Directly using data from a specific field for training can easily make the final model vulnerable to white-box attacks, resulting in privacy leaks. An optional solution is to use differential privacy technology to fine-tune the model, but this will incur huge time and memory overhead, and will also have a significant impact on model performance. In addition, fine-tuning large models is also difficult for downstream task parties with limited computing power. Such downstream task parties may choose to entrust a third-party organization to help them fine-tune the model, but this requires passing the data to a third party, and direct data transmission still has a great risk of privacy leaks.

[0004] During the reasoning process, users often use the interface provided by large model service providers for reasoning, but large model service providers are often unreliable in practice. When users enter prompts for reasoning, sensitive information involved in the prompts may also bring privacy risks.

[0005] In the above scenarios, the use of text desensitization technology can effectively protect data privacy. Compared with other privacy protection technologies, text desensitization is more lightweight and has the characteristics of one-time desensitization and multiple uses. There are some text desensitization methods in the related art, however, these methods have their own shortcomings.

[0006] Some related technologies use a word-by-word replacement strategy. For each word in a fixed vocabulary, the Euclidean distance between the word and other words in the vocabulary is calculated, and a word is selected for replacement using a method similar to an exponential mechanism (so this technology uses a relaxed differential privacy definition). In addition, it will filter out insensitive words based on the frequency of the word, and will not replace insensitive words with a certain probability. However, this technology has the following problems: Due to the use of a relaxed differential privacy definition, the actual privacy budget is related to the maximum distance between words. When the vocabulary is too large, a very large probability matrix needs to be saved. In addition, this technology has an inaccurate definition of insensitive words, and it is easy to replace them with irrelevant words when the vocabulary is too large.

[0007] Other technologies desensitize data and call remote reasoning, and then desensitize the reasoning results, which consists of two processes: desensitization and desensitization. There are two schemes for the desensitization process. One is to use fixed named entity recognition to extract sensitive words and replace them with entity category tags. Then perform remote reasoning. The desensitization process uses a large language model, and the replacement relationship of the replaced words is used as the prompt text input. The remote reasoning results and the prompt text are input into the model together to obtain the restored result. This technology has the following problems: First, overall, this technology requires training a large language model, and the model needs to be deployed locally to perform reasoning, which is relatively heavyweight. Using named entity recognition will replace words with special tags, which will affect the readability of the sentence. Special tags also make it easy for the remote end to know which information in the sentence is important, so as to combine some other knowledge for some reasoning, which poses a risk of privacy leakage.

[0008] Based on the above content, it can be seen that the existing text desensitization technology has problems such as lax privacy protection, great impact on text, and poor readability of desensitized text. Therefore, a text desensitization method is needed to improve privacy protection and prevent privacy leakage while reducing the impact on the original text and improving the readability of the desensitized text. Summary of the invention

[0009] The purpose of this specification is to provide a text desensitization method, program product and computing device based on differential privacy, aiming to desensitize text to prevent privacy leakage while improving the readability of the desensitized text and increasing the speed of the desensitization process.

[0010] The first aspect of this specification provides a text desensitization method based on differential privacy, including:

[0011] Acquire a set of clusters, wherein any target word in any cluster has a preset replacement probability distribution, wherein the replacement probability distribution is determined based on an exponential mechanism and is used to describe the probability of replacing the target word with each word in the cluster;

[0012] Perform named entity recognition on the input text to be desensitized to determine the entity type to which each word belongs, including the entity type preset as a sensitive word type;

[0013] For any target sensitive word belonging to the sensitive word type, determine whether it exists in any cluster of the cluster set; when the target sensitive word exists in the first target cluster, sample the target sensitive word according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word;

[0014] The target sensitive word in the text to be desensitized is replaced with the target replacement word to obtain a desensitized text.

[0015] The second aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect.

[0016] A third aspect of the specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0017] The fourth aspect of this specification provides a computer program product, including a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0018] The text desensitization method, program product and computing device for differential privacy proposed in the embodiments of this specification first cluster and divide each word in a preset vocabulary (word set) based on clustering, so that words of the same type are divided into the same cluster. Then, for the words in each cluster, an exponential mechanism is used to determine the probability of each word being replaced by other words in the cluster. This approach can ensure the pure differential privacy (Epsilon Differential Privacy, ε-DP) protection of the text desensitization process. For words not included in the word set, this specification proposes a bottom-up processing method. By matching the entity type of the word and the cluster, it can ensure that some unseen words (words not in the word set) can also be replaced by semantically similar words, ensuring the stability of the system. In addition, this specification arranges the word clustering and differential privacy calculations with large time overhead in the preprocessing stage, and the generated cluster set can be reused in the subsequent online text desensitization process. Make the desensitization process fast, efficient and save computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 It is a schematic diagram of an implementation scenario of a text desensitization method based on differential privacy in an embodiment;

[0021] Figure 2 is a flow chart of a method for determining a cluster set in an embodiment of this specification;

[0022] Figure 3 is a flowchart of a text desensitization method based on differential privacy in an embodiment of this specification;

[0023] Figure 4 It is a schematic block diagram of a text desensitization device based on differential privacy in one embodiment of this specification. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0025] Figure 1 : is a schematic diagram of an implementation scenario of a text desensitization method based on differential privacy in one embodiment. Figure 1 In the example, the overall text desensitization process can be divided into a preprocessing stage and a text desensitization stage. In the preprocessing stage, a pre-formed word set (vocabulary) is obtained, which includes multiple words (tokens). The method first performs a word embedding operation on each word in the word set to obtain a word embedding representation (embedding) corresponding to each word. The word embedding operation can use a pre-set word embedding table to directly query the word embedding representation corresponding to each word from the table, or it can be obtained by text encoding each word using a pre-trained text encoder. After obtaining the word embedding representation of each word, a clustering algorithm is used to cluster each word based on the word embedding representation of each word to obtain multiple word cluster clusters (clusters, hereinafter referred to as clusters), and multiple clusters can form a cluster set.

[0026] Next, for any cluster in the cluster set, the word distance between each word in the cluster and other words is calculated. The word distance can be calculated based on the word embedding representation. Then the distance function between words is used as the scoring function in the exponential mechanism. Based on the exponential mechanism, the probability of replacing the words in the cluster with each word in the cluster is determined. The probability of replacing a word with each word in the cluster can form the replacement probability distribution of the word. At the same time, named entity recognition (NER) is performed on each word in the cluster to determine the entity type to which each word belongs, and the entity type of the word with the highest proportion in the cluster is determined as the cluster entity type of the cluster, and the proportion of words belonging to the entity type to the total number of words in the cluster is used as the entity type confidence of the cluster.

[0027] For other word clusters in each word cluster, the aforementioned process is also referred to to determine the replacement probability distribution of each word in each cluster and the entity type of each cluster.

[0028] The above describes the process of determining cluster sets, word replacement probability distribution, and cluster entity types in the preprocessing stage. In the text desensitization stage, first obtain the text to be desensitized. The text to be desensitized may contain several sensitive words. The sensitive word type is a pre-set entity type, such as a name type, a place name type, and so on. Perform named entity recognition on the desensitized text to determine the entity type to which each word in the desensitized text belongs, determine each word that belongs to the sensitive word type, and obtain a sensitive word list. For each word in the sensitive word list, determine its corresponding replacement word and perform full-text replacement.

[0029] Specifically, for any sensitive word in the sensitive word list, first determine whether it belongs to any set of the cluster set generated in the preprocessing stage (that is, whether it is in the word set processed in the preprocessing stage). If so, find the replacement probability distribution of the word in the cluster, sample in the cluster according to the replacement probability distribution, and obtain the replacement word of the sensitive word. If the above judgment result is no, it means that the word is an uncommon word relative to the word set, and its replacement probability distribution has not been calculated in the preprocessing stage, then turn to the bottom-up strategy. In the bottom-up strategy, first determine whether the word belongs to a numerical type. If so, randomly generate a string of digits with the same number of digits as the replacement word; if not, obtain the confidence of the entity type to which the word belongs obtained in the named entity recognition stage of the word, and find a cluster consistent with the entity type from the cluster set, and the entity type confidence of the cluster is close to the entity type confidence of the word (for example, the difference between the two meets the preset conditions), and randomly select a word from the cluster as the replacement word.

[0030] For other sensitive words in the sensitive word list, the above process is also referred to to determine the replacement words corresponding to each sensitive word. Then, based on each replacement word, the corresponding sensitive word is fully replaced in the desensitized text to obtain the desensitized text.

[0031] In the above process, preprocessing can be done offline, and text desensitization can be done online. That is to say, in the offline stage, the cluster set, the replacement probability distribution of each word, and the entity type of each cluster are pre-generated and stored. When performing text desensitization in the online stage, the content generated and stored in the preprocessing stage is directly called to perform the text desensitization step. In this way, the efficiency of text desensitization can be improved, and the computing resources required for text desensitization can be saved.

[0032] The following describes the specific implementation steps of the above-mentioned determination of cluster sets and the text desensitization method based on differential privacy in conjunction with specific embodiments.

[0033] First, the specific steps of determining the clustering set, word replacement probability distribution, and clustering entity type in the aforementioned preprocessing stage are described. Figure 2 FIG. 1 is a flow chart of a method for determining a cluster set in an embodiment of the present specification. Figure 2 As shown, obtaining a cluster set at least includes: step 202, obtaining the embedding representation corresponding to each word in the word set; step 204, clustering each word in the word set based on the embedding representation to obtain multiple clusters; step 208, for any first cluster among the multiple clusters, using the distance function determined between words based on the embedding representation as the utility function, and determining the replacement probability distribution of each word in the first cluster according to the exponential mechanism.

[0034] The specific execution process of each of the above steps is described below.

[0035] First, in step 202, the embedding representation corresponding to each word in the word set is obtained.

[0036] The word set contains multiple words. By performing word embedding processing on each word, the embedding representation of each word can be obtained.

[0037] In one embodiment, step 202 specifically includes:

[0038] Based on a preset word embedding table, determine the embedding representation corresponding to each word in the word set; or, based on a pre-trained text encoder, determine the embedding representation corresponding to each word in the word set.

[0039] Any text encoder can be used to perform word embedding processing on words, for example, the Word2Vec model, the BERT (Bidirectional Encoder Representations from Transformers) model, etc. can be used, and there is no limitation here.

[0040] Then, in step 204, a clustering operation is performed on each word in the word set based on the embedded representation to obtain multiple clusters.

[0041] Use the preset distance measurement method to measure the distance between words based on the word embedding representation. There are many methods that can be used to calculate the distance between two embedding representations, such as Euclidean distance, Manhattan distance, cosine distance, etc., which are not limited here.

[0042] Then, based on the distance between each word, a clustering algorithm is used to cluster each word in the word set to obtain multiple clusters. Clustering algorithms can be, for example, K-means algorithm, DBSCAN algorithm, etc., which are not limited here. Words in the same cluster can be considered to be semantically similar words. When replacing sensitive words, only the replacement words are sampled in the cluster where the sensitive word is located.

[0043] Next, in step 208, for any first cluster among the multiple clusters, the distance function between words determined based on the embedded representation is used as a utility function, and the replacement probability distribution of each word in the first cluster is determined according to an exponential mechanism.

[0044] The first cluster can be denoted as R, which includes multiple words, and the distance function can be denoted as d(). The first cluster R is used as the output range of the index mechanism. For any word x in the cluster, the probability P(x→r) of replacing word x with any word r∈R in the first cluster determined by the index mechanism can be shown as formula (1):

[0045]

[0046] Where exp() represents the natural exponential function, ε represents the privacy budget of differential privacy, d(x, r) represents the distance between word x and word r, and Δu represents the global sensitivity of the utility function. When the distance function d() is used as the utility function, the value of Δu is the distance between the two words with the largest distance in the first cluster.

[0047] By calculating the probability of replacing word x with each word in the first cluster R respectively using formula (1), the replacement probability distribution of word x can be obtained. Through the above process, the replacement probability distribution of each word in the first cluster can be determined.

[0048] In one embodiment, the distance function in step 208 is normalized.

[0049] The distances between the words in the first cluster may be normalized, for example, using a minimum-maximum normalization method. After normalization, the distance between the two words with the largest distance in the first cluster is 1, and correspondingly, the global sensitivity Δu=1 when the distance function is used as the utility function.

[0050] In this embodiment, the probability P(x→r) of replacing word x with any word r∈R in the first cluster can be expressed as formula (2):

[0051]

[0052] The above steps are performed for each cluster in the multiple clusters, and the replacement probability distribution of each word in each cluster can be obtained.

[0053] In some possible implementations, before step 208 , the method further includes step 206 .

[0054] In step 206, for a cluster including a single word among the plurality of clusters, the distance between the word and the cluster center of each other cluster is determined based on the embedded representation, and the cluster is merged into the cluster with the closest distance.

[0055] By eliminating clusters containing only single words, the requirement of differential privacy can be met.

[0056] In some possible implementations, the method further includes steps 210 to 214 .

[0057] In step 210, for any second cluster among the plurality of clusters, named entity recognition is performed on each word therein to determine the entity type to which each word belongs.

[0058] A variety of methods can be used for named entity recognition, for example, a method based on a Hidden Markov Model (HMM), a method based on a Conditional Random Field (CRF), etc., which are not limited here.

[0059] For example, when using a hidden Markov model HMM, the entity category is used as the state of the HMM, the word is used as the observation of the HMM, and the HMM model is trained, which includes calculating the initial hidden state probability, transition probability and emission probability of the HMM. Then, the trained HMM model is used to determine the entity type labeling sequence (named entity recognition) based on the Viterbi algorithm.

[0060] When using conditional random fields (CRF), the input word sequence is first labeled and feature engineered, and then the CRF model is trained based on the extracted features and corresponding labels. The trained CRF model is then used to perform word sequence labeling (named entity recognition) on the word sequence to be labeled.

[0061] After obtaining the entity type of each word, in step 212, a target entity type with a higher ranking in terms of the number of words in the second cluster is determined as the cluster entity type of the second cluster.

[0062] In step 214, the ratio of the number of words belonging to the target entity type to the total number of words in the second cluster is determined as the second confidence of the second cluster.

[0063] Through step 210 to step 214, the entity type of the cluster can be determined and the corresponding confidence can be calculated according to the proportion of words belonging to each entity type in the cluster. The cluster entity type and confidence can be used in the bottom-up strategy of the text desensitization stage to select a suitable cluster for the unseen word for replacement word sampling.

[0064] The above describes the specific steps of determining cluster sets, word replacement probability distribution and cluster entity types in the preprocessing stage. The following describes the specific steps of desensitizing the text to be desensitized in the text desensitization stage.

[0065] Figure 3 This is a flowchart of a text desensitization method based on differential privacy in an embodiment of this specification. The execution subject of the method can be any platform or server or device cluster with computing and processing capabilities. Figure 3 As shown, the method at least includes: step 302, obtaining a cluster set, any target word in any cluster has a preset replacement probability distribution, and the replacement probability distribution is determined based on an exponential mechanism to describe the probability of replacing the target word with each word in the cluster; step 304, performing named entity recognition on the input text to be desensitized, and determining the entity type to which each word belongs, including the entity type preset as the sensitive word type; step 306, for any target sensitive word belonging to the sensitive word type, judging whether it exists in any cluster of the cluster set, when the target sensitive word exists in the first target cluster, sampling according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word; step 312, using the target replacement word to replace the target sensitive word in the text to be desensitized to obtain a desensitized text.

[0066] The specific execution process of each of the above steps is described below.

[0067] First, in step 302, a cluster set is obtained, and any target word in any cluster has a preset replacement probability distribution, which is determined based on an exponential mechanism and is used to describe the probability of replacing the target word with each word in the cluster.

[0068] The clustering set can be based on Figure 2 The steps in the above are pre-generated and then stored in a specific storage location. Then in step 302, the pre-generated clustering set is directly read from the corresponding storage location. It can also be directly obtained from a third party, which is not limited here.

[0069] The cluster set includes multiple clusters, and any cluster contains multiple words. Generally speaking, since multiple clusters are obtained based on the original word set through the clustering algorithm, different clusters will not contain the same words.

[0070] The target word is replaced with each word in the cluster (including the target word itself) with a preset replacement probability, and these probabilities can form a replacement probability distribution of the target word. In order to meet pure differential privacy, the replacement probability distribution is determined based on an exponential mechanism. In the exponential mechanism, the utility function can be a distance function between words in a cluster.

[0071] Then, in step 304, named entity recognition is performed on the input text to be desensitized to determine the entity type to which each word therein belongs, including the entity type preset as a sensitive word type.

[0072] The text to be desensitized can be the sample text in the training set used in the aforementioned process of fine-tuning the large prediction model, or it can be the prompt word text in the process of reasoning using the large prediction model, or it can be text in other scenarios that require privacy protection, which is not limited here.

[0073] The specific method of named entity recognition can refer to step 210, which will not be repeated here. The entity types preset in named entity recognition include one or more entity types preset as sensitive word types. The words belonging to the sensitive word type in the desensitized text are regarded as sensitive words. Direct use may cause privacy leakage and need to be replaced in subsequent steps.

[0074] Next, in step 306, for any target sensitive word belonging to the sensitive word type, it is determined whether it exists in any cluster of the cluster set. When the target sensitive word exists in the first target cluster, sampling is performed according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word.

[0075] The first target cluster includes a replacement probability distribution of the target sensitive word being replaced by each word in the first target cluster. Based on the replacement probability distribution, sampling is performed in the first target cluster, and the sampled words are used as target replacement words corresponding to the target sensitive word.

[0076] Since words in the same cluster can be semantically similar to each other, by sampling semantically similar words as replacement words for sensitive words, the semantics of the original text can be retained to a large extent and the readability of the desensitized text can be improved.

[0077] Finally, in step 312, the target sensitive word in the text to be desensitized is replaced with the target replacement word to obtain a desensitized text.

[0078] By replacing sensitive words in the text to be desensitized with replacement words, the desensitization operation of the text to be desensitized can be achieved.

[0079] In some possible implementations, the aforementioned fallback strategy is also used for target sensitive words that do not belong to any cluster in the cluster set. In this implementation, performing named entity recognition on the input text to be desensitized in step 304 also includes determining a first confidence level of the entity type to which each word belongs; any cluster in the cluster set also has a preset cluster entity type and a corresponding second confidence level; before step 312, the method also includes steps 308 and 310.

[0080] In step 308, when the target sensitive word does not exist in any cluster, it is determined whether it is of a numerical type; when the target sensitive word is of a numerical type, a digit string with the same number of digits as the target sensitive word is randomly generated as a target replacement word.

[0081] Numerical types can be numbers representing quantities, dates, times, numbers, etc. Since sensitive words of numerical types are often very sensitive in themselves, and there is no concept of semantically similar words. Therefore, the embodiments of this specification directly replace the numerical values ​​randomly, which can better protect the privacy of the numerical values. At the same time, for sensitive words of numerical types with fixed digits such as identity identifiers and telephone numbers, in order to ensure semantics, the embodiments of this specification randomly replace the numbers with numbers with the same digits, which can effectively ensure the readability of the desensitization results.

[0082] In one embodiment, the value type includes at least one of the following: number, date, time, serial number.

[0083] Then, in step 310, when the target sensitive word is not of a numerical type, a second target cluster is determined from each cluster, and a word is randomly selected from the second target cluster as a target replacement word; the cluster entity type of the second target cluster is the same as the entity type to which the target sensitive word belongs, and the difference between the second confidence of the second target cluster and the first confidence of the target sensitive word meets a preset condition.

[0084] Each cluster in the cluster set has its own cluster entity type and a corresponding second confidence. Step 310 finds one or more clusters whose cluster entity type is the same as the word entity type of the target sensitive word from the cluster set, and then determines among these clusters a cluster whose second confidence is close to the first confidence of the target sensitive word (the difference meets a preset condition, which may be, for example, less than 5%) as the second target cluster.

[0085] Exemplarily, in a specific example, the cluster set contains two clusters, for example, cluster A and cluster B. The cluster entity types of cluster A and cluster B are both "fruit" type, and the second confidence of cluster A is 80%, and the second confidence of cluster B is 60%. The text to be desensitized is "I want to buy an apple", in which the word "apple" is recognized as a sensitive word by the named entity, the word entity category is "fruit", and the corresponding first confidence is 57%. Then, for cluster A and cluster B, step 310 will select cluster B as the second target cluster, and randomly select a word from it as the target replacement word for "apple".

[0086] Through step 310, a cluster that is consistent with the entity type of the sensitive word and has a similar confidence level can be selected. The replacement word randomly selected from the cluster can be expected to be closer to the semantics of the sensitive word in the desensitized text, further improving the readability of the desensitized text.

[0087] Through the fallback strategy for words not included in the word set in step 308 and step 310, by matching the entity type of words and clusters, it can be ensured that some unknown words can also be replaced with semantically similar words. New words are always generated in human society. The fallback strategy of the embodiment of this specification can reduce the frequency of updating the original word set, reduce the cost of the system, and improve the stability of the system.

[0088] In some possible implementations, after obtaining the target replacement word corresponding to the target sensitive word in steps 306, 308, and 310, a first mark is added to the target sensitive word. The first mark is used to indicate that the target sensitive word has determined a corresponding target replacement word. Correspondingly, before determining whether the target sensitive word exists in any cluster of the cluster set in step 306, the method further includes:

[0089] Determine whether the target sensitive word has the first tag, if not, determine whether the target sensitive word exists in any cluster of the cluster set. If yes, end the process of determining a replacement word for the target sensitive word.

[0090] Through the judgment of the above steps, it can be ensured that when the same sensitive word appears multiple times in the text to be desensitized, the step of determining the replacement word is only performed once, thereby ensuring that the same sensitive word in the text to be desensitized will be replaced with the same replacement word, thereby preventing the desensitized text from deviating too much from the semantics of the original text to be desensitized.

[0091] By determining the replacement words corresponding to each sensitive word in the text to be desensitized according to the above steps, and replacing the corresponding sensitive words in the text to be desensitized with the replacement words, the desensitized text can be obtained. Figure 3 The desensitized text obtained by the method meets the pure differential privacy guarantee.

[0092] In some possible implementations, the method further includes:

[0093] Step 314, generating multiple desensitized texts of the text to be desensitized, and constructing a synthetic data set based on the multiple desensitized texts.

[0094] By treating the desensitized text multiple times Figure 3 The steps shown in the figure generate multiple anonymized texts. The anonymized texts are used as synthetic data to construct a synthetic dataset.

[0095] In some possible implementations, the method further includes:

[0096] Step 316: construct an obfuscated data set based on the text to be desensitized and multiple desensitized texts.

[0097] By taking the to-be-mass-encrypted text as the original data and the masked text as the synthetic data, a confusion dataset can be constructed.

[0098] The constructed synthetic datasets and obfuscated datasets can be used in downstream tasks in areas such as privacy protection and data enhancement.

[0099] The above describes the process of performing text desensitization on the text to be desensitized in the online stage.

[0100] According to the above analysis, Figure 2 The various preprocessing steps in the process can be completed in an offline stage, and the clustering set and the related word replacement probability distribution and clustering entity type are stored in a specific storage location. Figure 3 Each text desensitization step in the process can be completed in an online stage.

[0101] In the aforementioned text desensitization method based on differential privacy, in the preprocessing stage, word division is performed based on clustering, which can ensure that similar words are assigned together, and replacement among similar words can ensure the availability and readability of the text as much as possible. At the same time, the saved probability dictionary (replacement probability distribution) is also smaller than the probability dictionary of the entire word set. Unsupervised clustering is used to classify words to ensure that words can be replaced with semantically similar words under a low privacy budget, while also reducing the time overhead and storage cost of preprocessing. The processing of clustering clusters of individual words also ensures that the system meets differential privacy.

[0102] In the text desensitization stage, the embodiments of this specification design a detailed backup strategy to effectively solve the challenges brought by a large number of new and unseen words in real contexts. It ensures that unseen and new words can also be replaced with semantically similar words, improves system stability, and avoids constantly updating the word set.

[0103] At the same time, the embodiments of this specification separate the preprocessing and text desensitization stages. For the overall system, the time overhead is concentrated in the preprocessing part, but the fixed word set and the bottom-line strategy of the embodiments of this specification make it only necessary to perform preprocessing once for each privacy budget, and the preprocessing results can be reused. Text desensitization only needs to read the required information from the preprocessing results, and the desensitization process is efficient.

[0104] In addition, the embodiments of the present specification can also realize fast and large-scale text data generation by repeatedly performing text desensitization on the text to be desensitized, and the generated sentences maintain the semantics and structure of the original sentences.

[0105] According to an embodiment of another aspect, a text desensitization device based on differential privacy is also provided. Figure 4 This is a schematic block diagram of a text desensitization device based on differential privacy in an embodiment of this specification. The device can be deployed in any device, platform or device cluster with computing and processing capabilities. Figure 4 As shown, the device 400 includes:

[0106] The acquisition unit 402 is configured to acquire a cluster set, wherein any target word in any cluster has a preset replacement probability distribution, wherein the replacement probability distribution is determined based on an exponential mechanism and is used to describe the probability of replacing the target word with each word in the cluster;

[0107] The sensitive word identification unit 404 is configured to perform named entity recognition on the input text to be desensitized, and determine the entity type to which each word belongs, including the entity type preset as the sensitive word type;

[0108] The replacement word determination unit 406 is configured to, for any target sensitive word belonging to the sensitive word type, determine whether the target sensitive word exists in any cluster of the cluster set, and when the target sensitive word exists in the first target cluster, perform sampling according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word;

[0109] The replacement unit 412 is configured to use the target replacement word to replace the target sensitive word in the text to be desensitized to obtain a desensitized text.

[0110] In some possible implementations, the performing named entity recognition on the input text to be desensitized further includes determining a first confidence level of an entity type to which each word belongs; any cluster of the cluster set also has a preset cluster entity type and a corresponding second confidence level; the device 400 further includes:

[0111] The first backup unit 408 is configured to, when the target sensitive word does not exist in any cluster, determine whether it is of a numerical type; when the target sensitive word is of a numerical type, randomly generate a string of digits with the same number of digits as the target sensitive word as a target replacement word;

[0112] The second backup unit 410 is configured to, when the target sensitive word does not belong to a numerical type, determine a second target cluster from each cluster, and randomly select a word from the second target cluster as a target replacement word; the cluster entity type of the second target cluster is the same as the entity type to which the target sensitive word belongs, and the difference between the second confidence of the second target cluster and the first confidence of the target sensitive word meets a preset condition.

[0113] According to another aspect of the embodiment, a computer program product is also provided, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

[0114] According to yet another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the above embodiments is implemented.

[0115] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0116] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0117] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0118] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0119] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0120] This specification is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0125] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0126] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0128] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0129] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A text desensitization method based on differential privacy, comprising: Acquire a set of clusters, wherein any target word in any cluster has a preset replacement probability distribution, wherein the replacement probability distribution is determined based on an exponential mechanism and is used to describe the probability of replacing the target word with each word in the cluster; Perform named entity recognition on the input text to be desensitized to determine the entity type to which each word belongs, including the entity type preset as a sensitive word type; For any target sensitive word belonging to the sensitive word type, determine whether it exists in any cluster of the cluster set; when the target sensitive word exists in the first target cluster, sample the target sensitive word according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word; The target sensitive word in the text to be desensitized is replaced with the target replacement word to obtain a desensitized text.

2. The method according to claim 1, wherein: The performing named entity recognition on the input text to be desensitized further includes determining a first confidence level of the entity type to which each word belongs; Any cluster of the cluster set also has a preset cluster entity type and a corresponding second confidence level; the method further includes: When the target sensitive word does not exist in any cluster, determine whether it is of a numerical type; when the target sensitive word is of a numerical type, randomly generate a string of digits with the same number of digits as the target sensitive word as a target replacement word; When the target sensitive word is not of a numerical type, a second target cluster is determined from each cluster, and a word is randomly selected from the second target cluster as a target replacement word; the cluster entity type of the second target cluster is the same as the entity type to which the target sensitive word belongs, and the difference between the second confidence of the second target cluster and the first confidence of the target sensitive word meets a preset condition.

3. The method according to claim 1, obtaining a cluster set, comprising: Get the embedding representation corresponding to each word in the word set; Clustering operations are performed on each word in the word set based on the embedded representation to obtain multiple clusters; For any first cluster among the multiple clusters, a distance function determined between words based on the embedded representation is used as a utility function, and a replacement probability distribution of each word in the first cluster is determined according to an exponential mechanism.

4. The method according to claim 3, obtaining a cluster set, further comprising: For a cluster containing a single word among the multiple clusters, the distance between the word and the cluster center of each other cluster is determined based on the embedded representation, and the cluster is merged into the cluster with the closest distance.

5. The method according to claim 3, obtaining a cluster set, further comprising: For any second cluster among the plurality of clusters, performing named entity recognition on each word therein to determine the entity type to which each word belongs; Determine a target entity type with a higher word count in the second cluster as the cluster entity type of the second cluster; The ratio of the number of words belonging to the target entity type to the total number of words in the second cluster is determined as the second confidence of the second cluster.

6. According to the method of claim 3, obtaining the embedding representation corresponding to each word in the word set comprises: Based on the preset word embedding table, determine the embedding representation corresponding to each word in the word set; or, Based on the pre-trained text encoder, determine the embedding representation corresponding to each word in the word set.

7. The method according to claim 3, wherein: The distance function is normalized.

8. The method according to claim 1, further comprising: Generate multiple desensitized texts of the text to be desensitized, and construct a synthetic data set based on the multiple desensitized texts.

9. The method according to claim 8, further comprising: Based on the text to be desensitized and multiple desensitized texts, a confusion data set is constructed.

10. The method according to claim 2, wherein: The value type includes at least one of the following: number, date, time, serial number.

11. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 10.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 10 is implemented.

Images