Text de-sensitization method, program product, and computing device based on differential privacy

Abstract

Embodiments of the present specification relate to a text desensitization method based on differential privacy, a program product and a computing device. The method comprises: obtaining a cluster set, any target word in any cluster has a preset replacement probability distribution, the replacement probability distribution is determined based on an exponential mechanism, and is used to describe the probability of replacing the target word with each word in the cluster; performing named entity recognition on the input text to be desensitized to determine the entity type to which each word belongs, which includes an entity type preset as a sensitive word type; for any target sensitive word belonging to the sensitive word type, it is judged whether it exists in any cluster of the cluster set, when the target sensitive word exists in a first target cluster, a target replacement word is obtained by sampling according to the replacement probability distribution of the target sensitive word in the first target cluster; and the target sensitive word in the text to be desensitized is replaced with the target replacement word to obtain a desensitized text.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification belong to the technical field of privacy computing, and particularly relate to a text desensitization method based on differential privacy, a program product and a computing device. BACKGROUND

[0002] Large language models (hereinafter also referred to as large models) have achieved great success in recent years and are widely used in various fields, and data privacy in the application process of large language models has also attracted attention. A pre-trained large model is usually fine-tuned before performing a specific downstream task, and the process of performing a downstream task often includes an inference process based on the large model. In the two processes of fine-tuning and inference, there is a significant risk of privacy leakage.

[0003] In the fine-tuning process, the downstream task party needs to use its own unique data set to fine-tune a large model in a vertical field. Directly using domain-specific data for training can easily make the final model vulnerable to white-box attacks, resulting in privacy leakage. An alternative solution is to fine-tune the model using differential privacy technology, but this will bring huge time and memory overhead, and also have a significant impact on model performance. Moreover, fine-tuning a large model is difficult for downstream task parties with limited computing power, and such downstream task parties may choose to delegate a third-party agency to help them fine-tune the model, but this requires data to be transmitted to the third party, and direct data transmission still has a high risk of privacy leakage.

[0004] In the inference process, users often use the interface provided by the large model service provider to perform inference, and the large model service provider is often untrusted in practice. When the user inputs a prompt to perform inference, sensitive information involved in the prompt can also pose a privacy risk.

[0005] In the above scenarios, using text desensitization technology can efficiently protect data privacy, and compared with other privacy protection technologies, text desensitization is more lightweight and has the characteristics of desensitization once and use multiple times. Some text desensitization methods already exist in related technologies, however, these methods all have their own shortcomings.

[0006] Some related technologies use a word-by-word replacement strategy. For each word in a fixed vocabulary, the Euclidean distance between the word and other words in the vocabulary is calculated, and a word is selected for replacement in a manner similar to an exponential mechanism (therefore, the technology uses a relaxed definition of differential privacy). In addition, it also screens out insensitive words according to the frequency of word occurrence, and does not replace the insensitive words with a certain probability. However, this technology has the following problems: because the relaxed definition of differential privacy is used, the actual privacy budget is related to the maximum distance between the words. When the vocabulary is too large, a very large probability matrix needs to be saved. In addition, the definition of insensitive words in this technology is not accurate, and when the vocabulary is too large, it is easy to replace into irrelevant words.

[0007] Some other technologies desensitize data and call remote reasoning, and then desensitize the reasoning results, which consists of two processes of desensitization and reverse desensitization. There are two schemes for the desensitization process. One is to use fixed named entity recognition to extract sensitive words and replace the sensitive words with entity category labels. Then remote reasoning is performed. The reverse desensitization process is to use a large language model, input the replacement relationship of the replaced word as a prompt text, input the remote reasoning result and the prompt text into the model, and thus obtain the restored result. This technology has the following problems: first, as a whole, this technology needs to train a large language model, and at the same time needs to deploy the model locally to perform reasoning, which is relatively heavy. Using named entity recognition will replace the word with a special mark, which will affect the readability of the sentence, and the special mark is also easy for the remote to know which information in the sentence is important, so as to combine some other knowledge to make some reasoning, which has the risk of privacy leakage.

[0008] According to the above, the existing text desensitization technology has the problems of not strict privacy protection, great influence on the text, poor readability of the desensitized text, etc. Therefore, a text desensitization method is needed, which can improve privacy protection and prevent privacy leakage, reduce the degree of influence on the original text, and improve the readability of the desensitized text. SUMMARY

[0009] The purpose of the present specification is to provide a text desensitization method based on differential privacy, a program product and a computing device, which aims to prevent privacy leakage during text desensitization, improve the readability of the desensitized text, and improve the speed of the desensitization process.

[0010] The first aspect of the present specification provides a text desensitization method based on differential privacy, comprising:

[0011] obtaining a cluster set, any target word in any cluster has a preset replacement probability distribution, the replacement probability distribution is determined based on an exponential mechanism, and is used to describe the probability of replacing the target word with each word in the cluster;

[0012] perform named entity recognition on the input text to be desensitized to determine the entity type to which each word in the text belongs, wherein the entity types include an entity type that is preset as a sensitive word type;

[0013] For any target sensitive word belonging to the sensitive word type, it is determined whether the target sensitive word exists in any cluster of the cluster set. When the target sensitive word exists in a first target cluster, a target replacement word is obtained by sampling according to a replacement probability distribution of the target sensitive word in the first target cluster.

[0014] The target replacement word is used to replace the target sensitive word in the text to be desensitized to obtain a desensitized text.

[0015] The second aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed in a computer, causes the computer to perform the method of the first aspect.

[0016] The third aspect of the present specification provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method of the first aspect.

[0017] The fourth aspect of the present specification provides a computer program product, comprising a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the method of the first aspect.

[0018] The method for text desensitization under differential privacy, program product and computing device provided by the embodiments of the present specification, the method first clusters and divides each word in a preset word table (word set) based on clustering, so that words of the same type are divided into the same cluster. Then, for the words in each cluster, the probability of each word being replaced by other words in the cluster is determined using an exponential mechanism, which can ensure the pure differential privacy (Epsilon Differential Privacy, ε-DP) guarantee of the text desensitization process. For words not included in the word set, the present specification proposes a bottom-up processing method, which can ensure that some unseen words (words not in the word set) can also be replaced by semantically similar words by matching the entity types of the words and the clusters, ensuring the stability of the system. In addition, the present specification arranges the word clustering and differential privacy calculation with large time overhead in the preprocessing stage, and the generated cluster set can be repeatedly used in the subsequent online text desensitization process. The desensitization process is fast, efficient and saves computing resources. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present specification, the drawings needed to be used in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0020] Figure 1 is an implementation scenario diagram of a text desensitization method based on differential privacy in an embodiment of the present specification.

[0021] Figure 2 is a flowchart of a method for determining a cluster set in an embodiment of the present specification.

[0022] Figure 3 is a flowchart of a text desensitization method based on differential privacy in an embodiment of the present specification.

[0023] Figure 4 is a schematic block diagram of a text desensitization device based on differential privacy in an embodiment of the present specification. DETAILED DESCRIPTION

[0024] In order for those skilled in the art to better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be described clearly and completely in the following with reference to the drawings in the embodiments of the present specification. Obviously, the described embodiments are only some embodiments of the present specification, not all embodiments. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present specification.

[0025] Figure 1 is an implementation scenario diagram of a text desensitization method based on differential privacy in an embodiment. In the example of Figure 1 The overall text desensitization process can be divided into a preprocessing stage and a text desensitization stage. In the preprocessing stage, a pre-formed word set (word table) is obtained, which includes a plurality of words (tokens). The method first performs word embedding operation on each word in the word set to obtain the word embedding representation corresponding to each word. The word embedding operation can use a pre-set word embedding table to directly query the word embedding representation corresponding to each word from the table, or use a pre-trained text encoder to obtain the text encoding of each word. After obtaining the word embedding representation of each word, based on the word embedding representation of each word, a clustering algorithm is used to cluster each word to obtain a plurality of word cluster clusters (hereinafter also referred to as clusters), and the plurality of clusters can form a cluster set.

[0026] Next, for any cluster in the cluster set, the word distance between each word in the cluster and other words is calculated, which can be calculated based on the word embedding representation. Then the distance function between words is used as the scoring function in the Exponential Mechanism to determine the probability of replacing the word in the cluster with each word in the cluster. The probability of each word replacing the word in the cluster can form the replacement probability distribution of the word. At the same time, named entity recognition (NER) is also performed on each word in the cluster to determine the entity type to which each word belongs, and the entity type of the word with the highest proportion in the cluster is determined as the cluster entity type of the cluster, and the proportion of the number of words belonging to the entity type to the total number of words in the cluster is taken as the entity type confidence of the cluster.

[0027] For other word clusters in each word cluster, the replacement probability distribution of each word in each cluster and the entity type of each cluster are determined according to the foregoing process.

[0028] The above describes the process of determining the cluster set, word replacement probability distribution, and cluster entity type in the preprocessing stage. In the text desensitization stage, first, the text to be desensitized is obtained, which can contain several sensitive words, and the sensitive word type is a pre-set entity type, such as a person name type, a place name type, etc. Named entity recognition is performed on the text to be desensitized to determine the entity type to which each word in the text to be desensitized belongs, and the words belonging to the sensitive word type are determined to obtain a sensitive word list. For each word in the sensitive word list, a corresponding replacement word is determined, and full-text replacement is performed.

[0029] Specifically, for any sensitive word in the sensitive word list, first, it is determined whether it belongs to any cluster in the cluster set generated in the preprocessing stage (i.e., whether it is in the word set processed in the preprocessing stage). If yes, find the replacement probability distribution of the word in the cluster, sample in the cluster according to the replacement probability distribution, and obtain the replacement word of the sensitive word. If the foregoing determination result is no, it means that the word is a rare word relative to the word set, and its replacement probability distribution is not calculated in the preprocessing stage, so the fallback strategy is entered. In the fallback strategy, first, it is determined whether the word belongs to the numerical type, if yes, a numerical string with the same number of digits as the word is randomly generated as the replacement word; if not, the confidence of the entity type to which the word belongs obtained in the named entity recognition stage is obtained, and a cluster consistent with the entity type is found from the cluster set, and the entity type confidence of the cluster is close to the entity type confidence of the word (e.g., the difference between the two satisfies a pre-set condition), and a word is randomly selected from the cluster as the replacement word.

[0030] For other sensitive words in the sensitive word list, the corresponding replacement words of each sensitive word are determined according to the foregoing process. Then, based on each replacement word, the corresponding sensitive word in the text to be desensitized is replaced in the full text to obtain the desensitized text.

[0031] In the foregoing process, the preprocessing can be completed offline, and the text desensitization can be completed online. That is, in the offline stage, the cluster set, the replacement probability distribution of each word, and the entity type of each cluster are generated and stored in advance. When text desensitization is performed in the online stage, the content generated and stored in the preprocessing stage is directly called to perform the text desensitization step. In this way, the text desensitization efficiency can be improved, and the computing resources required for text desensitization can be saved.

[0032] The specific implementation steps of the foregoing method for determining a cluster set and text desensitization based on differential privacy are described below in combination with specific embodiments.

[0033] First, the specific steps of determining the cluster set, the word replacement probability distribution, and the cluster entity type in the foregoing preprocessing stage are described. Figure 2 is a flowchart of the method for determining a cluster set in an embodiment of the present specification. As shown in Figure 2 , obtaining a cluster set at least includes: step 202, obtaining an embedding representation corresponding to each word in a word set; step 204, clustering each word in the word set based on the embedding representation to obtain a plurality of clusters; and step 208, for any first cluster in the plurality of clusters, taking a distance function between words determined based on the embedding representation as a utility function, and determining a replacement probability distribution of each word in the first cluster according to an exponential mechanism.

[0034] The specific execution process of each step is described below.

[0035] First, in step 202, the embedding representation corresponding to each word in the word set is obtained.

[0036] The word set contains a plurality of words, and the embedding representation of each word can be obtained by performing word embedding processing on each word.

[0037] In an embodiment, step 202 specifically includes:

[0038] Based on a preset word embedding table, the embedding representation corresponding to each word in the word set is determined; or, based on a pre-trained text encoder, the embedding representation corresponding to each word in the word set is determined.

[0039] The word embedding processing can be performed on the words using any text encoder, for example, a Word2Vec model, a BERT (Bidirectional Encoder Representations from Transformers) model, or the like, which is not limited herein.

[0040] Then, in step 204, clustering operations are performed on the words in the word set based on the embedding representations, to obtain a plurality of clusters.

[0041] The distance between the words is measured based on the embedding representations of the words using a preset distance measurement method. The distance between two embedding representations can be calculated using various methods, such as Euclidean distance, Manhattan distance, cosine distance, or the like, which is not limited herein.

[0042] Then, based on the distance between the words, clustering algorithms are used to perform clustering operations on the words in the word set, to obtain a plurality of clusters. The clustering algorithm can use, for example, a K-means algorithm, a DBSCAN algorithm, or the like, which is not limited herein. The words belonging to the same cluster can be considered as semantically similar words. When performing sensitive word replacement, only the replacement words in the cluster where the sensitive word is located are sampled.

[0043] Next, in step 208, for any first cluster in the plurality of clusters, the distance function between the words determined based on the embedding representations is used as the utility function, and the replacement probability distribution of each word in the first cluster is determined according to the exponential mechanism.

[0044] The first cluster can be denoted as R, which includes a plurality of words, and the distance function can be denoted as d(). The first cluster R is used as the output range of the exponential mechanism. For any word x, the probability P(x→r) of replacing the word x with any word r in the first cluster R is determined according to the exponential mechanism, which can be shown in formula (1):

[0045]

[0046] where exp() represents the natural exponential function, ε represents the privacy budget of differential privacy, d(x, r) represents the distance between the words x and r, and Δu represents the global sensitivity of the utility function. When the distance function d() is used as the utility function, the value of Δu is the distance between the two words with the largest distance in the first cluster.

[0047] The replacement probability distribution of the word x can be obtained by calculating the probability of replacing the word x with each word in the first cluster R according to formula (1). The replacement probability distribution of each word in the first cluster can be determined through the foregoing process.

[0048] In one embodiment, the distance function in step 208 is normalized.

[0049] The distance between each word in the first cluster can be normalized, for example, using a min-max normalization method. After normalization, the distance between the two words with the largest distance in the first cluster is 1, and the global sensitivity Δu of the utility function when the distance function is used as the utility function is 1.

[0050] In this embodiment, the probability P(x→r) of replacing the word x with any word r∈R in the first cluster can be shown as formula (2):

[0051]

[0052] The replacement probability distribution of each word in each cluster can be obtained by performing the above steps for each cluster in the plurality of clusters.

[0053] In some possible implementations, before step 208, the method further includes step 206.

[0054] In step 206, for a cluster containing a single word in the plurality of clusters, the distance between the word and the cluster centers of other clusters is determined based on the embedding representation, and the cluster is merged into the cluster with the closest distance.

[0055] By eliminating clusters containing only a single word, the requirement of differential privacy can be met.

[0056] In some possible implementations, the method further includes steps 210 to 214.

[0057] In step 210, for any second cluster in the plurality of clusters, named entity recognition is performed on each word in the cluster to determine the entity type to which each word belongs.

[0058] A variety of methods can be used for named entity recognition, for example, a method based on Hidden Markov Model (HMM), a method based on Conditional Random Field (CRF), etc., which are not limited here.

[0059] For example, when using Hidden Markov Model (HMM), the entity category is used as the state of HMM, and the word is used as the observation of HMM. The HMM model is trained, including calculating the initial hidden state probability, transition probability and emission probability of HMM. Then, the trained HMM model is used to determine the entity type annotation sequence (named entity recognition) based on the Viterbi algorithm.

[0060] When a conditional random field (CRF) is used, firstly, the input word sequence is labeled, and feature engineering is performed on the words, and then a CRF model is trained based on the extracted features and corresponding labels. Then, the trained CRF model is used to perform word sequence labeling (named entity recognition) on the word sequence to be labeled.

[0061] After obtaining the entity types of the respective words, in step 212, a target entity type ranking high in the number of words in the second cluster is determined as the cluster entity type of the second cluster.

[0062] In step 214, the proportion of the number of words belonging to the target entity type to the total number of words in the second cluster is determined as the second confidence of the second cluster.

[0063] Through steps 210 to 214, the entity type of the cluster and the corresponding confidence can be determined according to the proportion of the words belonging to each entity type in the cluster. The cluster entity type and the confidence can be used in the bottom-up strategy in the text desensitization stage to select a suitable cluster for the unobserved word to replace the word sampling.

[0064] The above describes the specific steps of determining the cluster set, the word replacement probability distribution, and the cluster entity type in the preprocessing stage. The following describes the specific steps of the desensitization processing of the text desensitization stage.

[0065] Figure 3 is a flowchart of a text desensitization method based on differential privacy in an embodiment of the present specification. The execution subject of the method can be any platform or server or device cluster with computing and processing capabilities. As shown in Figure 3 the method at least includes: step 302, obtaining a cluster set, any target word in any cluster has a preset replacement probability distribution, the replacement probability distribution is determined based on an exponential mechanism, and is used to describe the probability of replacing the target word with each word in the cluster; step 304, performing named entity recognition on the input text to be desensitized to determine the entity type to which each word belongs, including the entity type which is preset as a sensitive word type; step 306, for any target sensitive word belonging to the sensitive word type, it is judged whether it exists in any cluster of the cluster set, when the target sensitive word exists in a first target cluster, sampling is performed according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word; step 312, using the target replacement word to replace the target sensitive word in the text to be desensitized to obtain a desensitized text.

[0066] The specific execution process of each of the above steps is described below.

[0067] Firstly, in step 302, a cluster set is obtained, any target word in any cluster has a preset replacement probability distribution, and the replacement probability distribution is determined based on an exponential mechanism, and is used to describe the probability of replacing the target word with each word in the cluster.

[0068] The cluster set can be generated in advance according to the steps in the cluster set generation method, and then saved in a specific storage location. Then in step 302, the pre-generated cluster set is directly read from the corresponding storage location. It can also be directly obtained from a third party, which is not limited here. Figure 2

[0069] The cluster set includes multiple clusters, and each cluster includes multiple words. Generally, since multiple clusters are obtained based on the original word set through a clustering algorithm, different clusters will not include the same word.

[0070] The target word is replaced by each word (including the target word itself) in the cluster with a preset replacement probability, and these probabilities can form a replacement probability distribution of the target word. In order to meet pure differential privacy, the replacement probability distribution is determined based on an exponential mechanism. In the exponential mechanism, the utility function can be a distance function between words in the cluster.

[0071] Then, in step 304, named entity recognition is performed on the input text to be de-sensitized to determine the entity type to which each word belongs, including the entity type preset as the sensitive word type.

[0072] The text to be de-sensitized can be a sample text in the training set used in the process of fine-tuning the large pre-trained model, or can be a prompt word text in the inference process using the large pre-trained model, or can be a text in other privacy protection scenarios, which is not limited here.

[0073] The specific method of named entity recognition can refer to step 210, which will not be repeated here. Among the preset entity types in the named entity recognition, one or more entity types are preset as sensitive word types, and the words in the text to be de-sensitized that belong to the sensitive word type are regarded as sensitive words, which may directly cause privacy leakage and need to be replaced in subsequent steps.

[0074] Next, in step 306, for any target sensitive word belonging to the sensitive word type, it is determined whether the target sensitive word exists in any cluster of the cluster set. When the target sensitive word exists in a first target cluster, a target replacement word is obtained by sampling according to the replacement probability distribution of the target sensitive word in the first target cluster.

[0075] ​The target sensitive word in the first target cluster is replaced by a replacement probability distribution of each word in the first target cluster. Sampling is performed in the first target cluster based on the replacement probability distribution, and the sampled word is used as the target replacement word corresponding to the target sensitive word.

[0076] Since the words in the same cluster can be semantically similar words, sampling semantically similar words as replacement words of sensitive words can largely preserve the semantics of the original text and improve the readability of the desensitized text.

[0077] Finally, in step 312, the target sensitive word in the text to be desensitized is replaced by the target replacement word to obtain a desensitized text.

[0078] By using the replacement word to replace the sensitive word in the text to be desensitized, the desensitization operation of the text to be desensitized can be realized.

[0079] In some possible embodiments, the aforementioned bottom-up strategy is also used for target sensitive words that do not belong to any cluster in the cluster set. In this embodiment, the named entity recognition of the input text to be desensitized in step 304 also includes determining the first confidence of the entity type to which each word belongs; any cluster of the cluster set also has a preset cluster entity type and a corresponding second confidence; before step 312, the method further includes steps 308 and 310.

[0080] In step 308, when the target sensitive word does not exist in any cluster, it is determined whether it belongs to a numerical type; when the target sensitive word belongs to a numerical type, a numerical string with the same number of digits as the target sensitive word is randomly generated as a target replacement word.

[0081] The numerical type can be a number representing a quantity, a date, a time, a number, etc. Since the sensitive word of the numerical type is often very sensitive itself, and there is no concept of semantically similar words. Therefore, the embodiment of the present specification directly randomly replaces the numerical value, which can better protect the numerical privacy. At the same time, for numerical type sensitive words such as identity, phone number, etc. with fixed number of digits, in order to ensure semantics, the embodiment of the present specification randomly replaces the number with a number of the same number of digits, which can effectively guarantee the readability of the desensitization result.

[0082] In one embodiment, the numerical type at least includes one of the following: number, date, time, number.

[0083] Then, in step 310, when the target sensitive word does not belong to the numerical type, a second target cluster is determined from each cluster, and a word is randomly selected from the second target cluster as a target replacement word; the cluster entity type of the second target cluster is the same as the entity type to which the target sensitive word belongs, and the second confidence of the second target cluster and the first confidence of the target sensitive word satisfy a preset condition.

[0084] Each cluster in the cluster set has a respective cluster entity type and has a corresponding second confidence. Step 310 finds one or more clusters from the cluster set whose cluster entity type is the same as the word entity type of the target sensitive word, and then determines, among these clusters, a cluster whose second confidence is close to the first confidence of the target sensitive word (the difference satisfies a preset condition, which may be, for example, less than 5%) as the second target cluster.

[0085] For example, in a specific example, the cluster set contains two clusters, such as cluster A and cluster B. The cluster entity types of cluster A and cluster B are both of the “fruit” type, and the second confidence of cluster A is 80% and the second confidence of cluster B is 60%. The text to be desensitized is “I want to buy an apple”, in which the word “apple” is recognized as a sensitive word by the named entity, the word entity category is “fruit”, and the corresponding first confidence is 57%. Then, for cluster A and cluster B, step 310 selects cluster B as the second target cluster, and randomly selects a word from it as the target replacement word for “apple”.

[0086] Through step 310, a cluster that is consistent with the entity type of the sensitive word and has a close confidence can be selected, and a replacement word randomly selected from the cluster can be more close to the semantics of the sensitive word in the text to be desensitized, further improving the readability of the desensitized text.

[0087] Through the bottom-up strategy of steps 308 and 310 for the word set that does not contain the word, and through the entity type matching of the word and the cluster, it can be ensured that some unseen words can also be replaced by words with similar semantics. New words have been emerging in human society, and the bottom-up strategy of the embodiments of the present specification can reduce the frequency of updating the original word set, reduce the cost of the system, and improve the stability of the system.

[0088] In some possible implementations, after obtaining the target replacement word corresponding to the target sensitive word in step 306, step 308, and step 310, a first mark is added to the target sensitive word. The first mark is used to represent that the target sensitive word has determined the corresponding target replacement word. Correspondingly, before step 306 judges whether the target sensitive word exists in any cluster of the cluster set, the method further comprises:

[0089] It is determined whether the target sensitive word has the first mark. If not, it is determined whether the target sensitive word exists in any cluster of the cluster set. If so, the process of determining the replacement word for the target sensitive word ends.

[0090] Through the determination of the above steps, it can be ensured that when the same sensitive word appears multiple times in the text to be desensitized, the step of determining the replacement word is performed only once, and further, the same sensitive word in the text to be desensitized will be replaced by the same replacement word, avoiding that the desensitized text deviates too much from the semantics of the original text to be desensitized.

[0091] By determining the respective replacement word corresponding to each sensitive word in the text to be desensitized according to the foregoing steps, and replacing the corresponding sensitive word in the text to be desensitized with the replacement word, the desensitized desensitized text can be obtained. Based on Figure 3 The desensitized text obtained by the method in the foregoing embodiment meets the pure differential privacy guarantee.

[0092] In some possible implementation manners, the method further includes:

[0093] Step 314: generating a plurality of desensitized texts of the text to be desensitized, and constructing a synthetic data set based on the plurality of desensitized texts.

[0094] By performing the steps shown in Figure 3 on the text to be desensitized multiple times, a plurality of desensitized texts are generated. The desensitized texts can be used as synthetic data to construct a synthetic data set.

[0095] In some possible implementation manners, the method further includes:

[0096] Step 316: constructing an obfuscated data set based on the text to be desensitized and the plurality of desensitized texts.

[0097] The text to be desensitized can be used as original data, and the desensitized text can be used as synthetic data, so that an obfuscated data set can be constructed.

[0098] The synthetic data set and the obfuscated data set constructed can be used in downstream tasks in the fields of privacy protection and data enhancement.

[0099] The foregoing describes the process of text desensitization on the text to be desensitized in the online phase.

[0100] According to the foregoing analysis, Figure 2 The preprocessing steps in the foregoing embodiment can be completed in the offline phase, and the cluster set and the related word replacement probability distribution and the cluster entity type are saved in a specific storage location. Figure 3 The text desensitization steps in the foregoing embodiment can be completed in the online phase.

[0101] The foregoing text de-sensitization method based on differential privacy can ensure that words of the same type are allocated together in the preprocessing stage based on clustering, and replacement in the same type of words can ensure the availability and readability of the text as much as possible. Meanwhile, the saved probability dictionary (replacement probability distribution) is smaller than the probability dictionary of the full word set. Using unsupervised clustering to classify words ensures that the words can be replaced with semantically similar words under a low privacy budget, while also reducing the time overhead and storage cost of preprocessing. The processing of the cluster of individual words also ensures that the system meets differential privacy.

[0102] In the text de-sensitization stage, the embodiments of the present specification design detailed bottom-up strategies to effectively solve the challenges brought by a large number of new words and unknown words in real-world contexts. It ensures that unknown words and new words can also be replaced with semantically similar words, improves system stability, and avoids constantly updating the word set.

[0103] Meanwhile, the embodiments of the present specification separate the preprocessing and text de-sensitization stages. For the overall system, the time overhead is concentrated in the preprocessing part, but the fixed word set and bottom-up strategy of the embodiments of the present specification make it only necessary to perform preprocessing once for each privacy budget, and the results of preprocessing can be reused. Text de-sensitization only needs to read the required information from the preprocessing results, and the de-sensitization process is efficient.

[0104] In addition, the embodiments of the present specification can also achieve rapid generation of a large amount of text data by repeatedly performing text de-sensitization on the text to be de-sensitized, and the generated sentences maintain the semantics and structure of the original sentences.

[0105] According to another aspect, embodiments also provide a text de-sensitization device based on differential privacy. Figure 4 is a schematic block diagram of a text de-sensitization device based on differential privacy in an embodiment of the present specification, which can be deployed in any device, platform or device cluster with computing and processing capabilities. As shown in Figure 4 The device 400 includes:

[0106] The acquisition unit 402 is configured to acquire a cluster set, any target word in any cluster has a preset replacement probability distribution, the replacement probability distribution is determined based on an exponential mechanism, and is used to describe the probability of replacing the target word with each word in the cluster;

[0107] The sensitive word identification unit 404 is configured to perform named entity recognition on the input text to be de-sensitized to determine the entity type to which each word belongs, including the entity type preset as a sensitive word type;

[0108] The replacement word determination unit 406 is configured to, for any target sensitive word belonging to a sensitive word type, determine whether the target sensitive word exists in any cluster of the cluster set, and when the target sensitive word exists in a first target cluster, sample according to a replacement probability distribution of the target sensitive word in the first target cluster to obtain a target replacement word.

[0109] The replacement unit 412 is configured to replace the target sensitive word in the text to be desensitized with the target replacement word to obtain a desensitized text.

[0110] In some possible implementation manners, the named entity recognition on the input text to be desensitized further includes determining a first confidence degree of an entity type to which each word belongs; any cluster of the cluster set further has a preset cluster entity type and a corresponding second confidence degree; and the apparatus 400 further includes:

[0111] The first bottom-up unit 408 is configured to, when the target sensitive word does not exist in any cluster, determine whether the target sensitive word belongs to a numerical value type; and when the target sensitive word belongs to the numerical value type, randomly generate a numerical string with a same number of digits as the target sensitive word as a target replacement word.

[0112] The second bottom-up unit 410 is configured to, when the target sensitive word does not belong to the numerical value type, determine a second target cluster from each cluster, and randomly select a word from the second target cluster as a target replacement word; the cluster entity type of the second target cluster is the same as an entity type to which the target sensitive word belongs, and a difference between the second confidence degree of the second target cluster and the first confidence degree of the target sensitive word satisfies a preset condition.

[0113] According to another aspect, an embodiment also provides a computer program product including computer programs / instructions, which, when executed by a processor, implement the steps of the method described in any of the above embodiments.

[0114] According to another aspect, an embodiment also provides a computer device including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in any of the above embodiments.

[0115] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0116] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented to perform the same functions in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of logical programming of the method steps. Such a controller can thus be considered a hardware component, and the means comprised therein for performing the various functions can also be considered structures within the hardware component. Alternatively, or even, the means for performing the various functions can be considered both software modules implementing the method and structures within the hardware component.

[0117] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not rule out that with the development of future computer technology, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, email devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0118] Although the method operations of the embodiments of the present disclosure are described in a particular, sequential order, one or more of the method operations can be omitted, or the method operations can be performed in an order other than the described order. Additionally, one or more of the method operations can be performed concurrently, or with partial concurrence. Furthermore, one or more of the method operations can be performed by different entities, or over different time periods. The term "including" as well as changes thereof, is intended to encompass the inclusion of one or more elements, steps, or components, whether or not the elements, steps, or components are listed in the specification. The term "comprising" as well as changes thereof, is intended to mean a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises more elements, steps, or components than those listed in the specification are still deemed to be within the scope of the present disclosure. The terms "first", "second", and the like, do not denote any order, quantity, or importance, but rather are used to distinguish one element from another.

[0119] For ease of description, the above apparatuses are described as various modules to describe separately. Of course, when implementing one or more of the present disclosure, the functions of the modules can be implemented in one or more software and / or hardware, or the modules implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The above-described apparatus embodiment is only illustrative, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0120] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks. Figure 1 The apparatus that implements the functions specified in one or more flows and / or blocks.

[0121] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0123] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0124] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0125] Computer-readable media includes permanent and non-permanent, moveable and non- moveable media that can be implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile discs (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0126] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0127] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0128] The various embodiments described in this specification are described in the context of progressive embodiments, with each embodiment building on the previous one. The same or similar parts between embodiments are cross-referenced as appropriate. Each embodiment focuses on the differences between that embodiment and the previous one. In particular, the system embodiments are described relatively simply, as they are substantially similar to the method embodiments. In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific feature, structure, material or characteristic being described in connection with that embodiment or example is included in at least one embodiment or example in the specification. Illustrative representations of the above terms in the specification do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics being described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, the skilled person can combine and combine the features of different embodiments or examples and different embodiments or examples described in the specification, without contradiction.

[0129] The above description merely provides examples of the one or more embodiments described in this specification and does not limit the one or more embodiments described in this specification. The one or more embodiments described in this specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the one or more embodiments described in this specification should be included in the scope of the claims.

Claims

1. A text anonymization method based on differential privacy, comprising: Obtain a cluster set, where any target word in any cluster has a preset replacement probability distribution. The replacement probability distribution is determined based on an exponential mechanism and is used to describe the probability of replacing the target word with any word in the cluster. Named entity recognition is performed on the input text to be de-identified to determine the entity type to which each word belongs, including entity types that are preset as sensitive words; For any target sensitive word belonging to the sensitive word type, determine whether it exists in any cluster of the cluster set. When the target sensitive word exists in the first target cluster, sample according to the replacement probability distribution of the target sensitive word in the first target cluster to obtain the target replacement word; The target sensitive words in the text to be desensitized are replaced with the target replacement words to obtain the desensitized text.

2. The method according to claim 1, wherein, The method of performing named entity recognition on the input text to be de-identified also includes determining the first confidence level of the entity type to which each word belongs; Each cluster of the cluster set also has a preset cluster entity type and a corresponding second confidence level; the method further includes: If the target sensitive word does not exist in any cluster, determine whether it belongs to a numeric type; if the target sensitive word belongs to a numeric type, randomly generate a numeric string with the same number of digits as the target sensitive word as the target replacement word; When the target sensitive word does not belong to the numerical type, a second target cluster is determined from each cluster, and a word is randomly selected from the second target cluster as the target replacement word; the cluster entity type of the second target cluster is the same as the entity type to which the target sensitive word belongs, and the difference between the second confidence level of the second target cluster and the first confidence level of the target sensitive word meets the preset conditions.

3. The method according to claim 1, wherein obtaining the cluster set comprises: Obtain the embedding representation of each word in the word set; Clustering operations are performed on each word in the word set based on embedded representations to obtain multiple clusters; For any first cluster among multiple clusters, the distance function between words determined based on the embedding representation is used as the utility function, and the substitution probability distribution of each word in the first cluster is determined according to the exponential mechanism.

4. The method according to claim 3, further comprising: obtaining a cluster set For a cluster containing a single word among the multiple clusters, the distance of the word to the cluster centers of the other clusters is determined based on the embedding representation, and the cluster is merged into the nearest cluster.

5. The method according to claim 3, further comprising: obtaining a cluster set; For any second cluster among the multiple clusters, named entity recognition is performed on each word in the cluster to determine the entity type to which each word belongs; The target entity type with the highest word count in the second cluster is determined as the cluster entity type of the second cluster; The proportion of the number of words belonging to the target entity type to the total number of words in the second cluster is determined as the second confidence level of the second cluster.

6. The method according to claim 3, obtaining the embedding representation corresponding to each word in the word set, includes: Based on a pre-defined word embedding table, determine the embedding representation corresponding to each word in the word set; or, Based on a pre-trained text encoder, the embedding representation corresponding to each word in the word set is determined.

7. The method according to claim 3, wherein, The distance function has been normalized.

8. The method according to claim 1, further comprising: Multiple de-identified texts of the text to be de-identified are generated, and a synthetic dataset is constructed based on the multiple de-identified texts.

9. The method according to claim 8, further comprising: Based on the text to be de-identified and multiple de-identified texts, a scrambled dataset is constructed.

10. The method according to claim 2, wherein, The numerical data type includes at least one of the following: number, date, time, or number.

11. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-10.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-10.

Images