RAG data query method and device based on privacy protection, equipment and medium

Abstract

The embodiment of the invention discloses an RAG data query method and device based on privacy protection, equipment and a medium. The scheme can comprise the steps of obtaining a data query request provided by a query party; obtaining target data from the database based on the data query request; processing the target data by adopting a large model of a model party according to a preset privacy protection mode to obtain a query result; the preset privacy protection mode is used for preventing the target data from being leaked to the model party; and feeding back the query result to the query party.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a RAG data query method, device, equipment and medium based on privacy protection. Background Art

[0002] RAG (Retrieval Augmented Generation) technology is a technology that combines retrieval and generation, and is used to handle natural language processing tasks that require a lot of background knowledge to answer. RAG does not change the model, but attempts to provide more reliable and fact-based information by retrieving external knowledge bases to improve the factuality, timeliness, and interpretability of large model generation. This model is particularly suitable for tasks such as Question Answering (QA), Text Summarization, and Conversational Systems. It retrieves relevant information from a large document collection and incorporates this information into the generation model to generate responses.

[0003] The common large language models in the existing technology use public data for learning. If you want to apply the model to specific internal knowledge, such as querying the internal information of a company, the model needs to learn the company's private data. However, if the training data contains private information of the company or other objects, it will lead to the problem of privacy information leakage. The problem of data privacy security is not taken into consideration in the use of existing RAG technology.

[0004] Therefore, in the process of using large models based on RAG technology, how to ensure data security is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of this specification provide a RAG data query method, apparatus, device and medium based on privacy protection to solve the problem that existing data query methods cannot guarantee data security.

[0006] To solve the above technical problems, the embodiments of this specification are implemented as follows: The embodiment of this specification provides a RAG data query method based on privacy protection, which is applied to a data party with access rights to a database, and includes: Obtaining the data query request provided by the querying party; Based on the data query request, obtaining target data from the database; The target data is processed using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; Feedback the query result to the querying party.

[0007] An embodiment of this specification provides a RAG data query device based on privacy protection, including: A request acquisition module is used to obtain a data query request provided by a querying party; A data acquisition module, used to acquire target data from the database based on the data query request; A result acquisition module is used to process the target data using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; The result feedback module is used to feed back the query result to the query party.

[0008] A RAG data query device based on privacy protection provided in an embodiment of this specification includes: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Obtaining the data query request provided by the querying party; Based on the data query request, obtaining target data from the database; The target data is processed using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; Feedback the query result to the querying party.

[0009] An embodiment of the present specification provides a computer-readable medium on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement a RAG data query method based on privacy protection.

[0010] At least one embodiment of this specification can achieve the following beneficial effects: In the embodiment of this specification, the data party with access to the database can obtain the data query request of the query party, obtain the target data from the database, and then use the big model of the model party to process the target data in a privacy protection manner to obtain the query result. Among them, the data party performs data query from the database based on the data query request, rather than the traditional query guided by the big model, which can avoid the model party of the big model directly accessing the database, and in the embodiment of this specification, the big model of the model party can be used to process the target data in accordance with the preset privacy protection method, and the model party can also avoid obtaining the original data of the data party, which can effectively protect the data privacy of the data party and ensure the data security of the data party. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0012] Figure 1 A schematic diagram of an application scenario of a RAG data query method based on privacy protection in an embodiment of this specification; Figure 2 A flowchart of a RAG data query method based on privacy protection provided in an embodiment of this specification; Figure 3 A swim lane diagram of a RAG data query method based on privacy protection provided in an embodiment of this specification; Figure 4 A schematic diagram of the structure of a RAG data query device based on privacy protection provided in an embodiment of this specification; Figure 5 A schematic diagram of the structure of a RAG data query device based on privacy protection provided in an embodiment of this specification. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solutions and advantages of one or more embodiments of this specification clearer, the technical solutions of one or more embodiments of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of one or more embodiments of this specification.

[0014] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0015] A large model refers to a machine learning model with large-scale parameters and complex computational structures. It is usually built with deep neural networks and can handle complex tasks and data. It has a wide range of applications, including natural language processing, computer vision, speech recognition, and recommendation systems. Large models learn complex patterns and features by training massive amounts of data and have strong generalization capabilities. ChatGPT can be understood as a specific representation of a large model.

[0016] Retrieval Augmented Generation (RAG) is a technology that combines retrieval and generation. It is used to handle natural language processing tasks that require a lot of background knowledge to answer. RAG does not change the model, but attempts to provide more reliable and fact-based information by retrieving external knowledge bases to improve the factuality, timeliness and interpretability of large model generation. This model is particularly suitable for tasks such as Question Answering (QA), Text Summarization, and Conversational Systems. It retrieves relevant information from a large document collection and incorporates this information into the generative model to generate responses. In practical applications, in order to make large models more accurately applied to specific scenarios, RAG technology can be used in combination with large models.

[0017] The workflow of large model data query based on RAG in the prior art generally includes the following steps: The retrieval step may specifically include: given a query, such as a question, the retrieval step will find content related to the query from a predefined document collection. The document collection is usually a large knowledge base in a closed domain enterprise environment or articles on the Internet in an open domain consumer environment. This retrieval step is usually guided by a large model.

[0018] The generation step may specifically include: first, the retrieved document or document fragment is passed to the generation model; then the generation model uses the retrieved information and the original query to generate an answer or output text. The generation model is usually a large model that has been pre-trained, such as a large language model (LLM). The large language model is a deep learning model trained based on massive text data. The large language model can not only generate natural language text, but also deeply understand the meaning of the text and handle various natural language tasks, such as text summarization, question and answer, translation, etc. The RAG-based large model in the prior art can be understood as a large model that includes a RAG retrieval module. The large model can directly retrieve the external database and generate answers based on the given questions.

[0019] In actual applications, a company's data is often stored locally, but it may use a large online model to complete the inductive generation function. In the existing technology, the general large language model uses public data for learning. If you want to apply the model to answer a company's internal knowledge, you must learn or obtain the company's private data. However, if the training data or the data obtained by the model contains the company's private information, it will lead to the problem of privacy information leakage. For example, the key leakage of a certain platform. Similarly, if the company's internal information is exposed, the consequences will be more serious.

[0020] In order to solve the defects in the prior art, this solution provides the following embodiments.

[0021] Figure 1 FIG. 1 is a schematic diagram of an application scenario of a RAG data query method based on privacy protection in an embodiment of this specification. Figure 1 As shown, the scheme may include a data party 1, a database 2, and a large model 3. Among them, the data party 1 has the authority to access the database 2, and may also be the holder of the database. The large model 3 may be a large model that the data party 1 can use. The data party 1 can use RAG technology to provide plug-in data for the large model by retrieving the database, so as to use the large model to obtain query results that are more in line with the user's language habits. In the embodiment of this specification, the data party 1 can obtain the target data from the database based on the data query request provided by the query party and use the large model of the model party to process the target data in accordance with the preset privacy protection method to obtain the query result, and can also feed back the query result to the query party so that the query user can obtain the query result. The method in the embodiment of this specification can prevent the model party from obtaining the original data in the database, complete the data query service on the basis of ensuring data privacy security, and can be applied to the scenario of privacy data query.

[0022] Next, a RAG data query method based on privacy protection provided in an embodiment of the specification will be specifically described in conjunction with the accompanying drawings.

[0023] Figure 2 A flowchart of a privacy protection-based RAG data query method provided in an embodiment of this specification. From a program perspective, the execution subject of the process can be a program or application client installed on an application server, and can be specifically applied to a server of a data party with access to a database.

[0024] like Figure 2 As shown, the process may include the following steps.

[0025] Step 202: Obtain a data query request provided by the querying party.

[0026] In actual applications, data query requests can be generated based on questions provided by the querying user. For example, the user can input the questions he wants to ask through a terminal application, a mini-program, a web page, or other carrier. Data query requests can be generated based on requests describing content such as text, characters, and voice. The querying party can represent a server that accepts questions provided by the querying user. In actual applications, the data party server and the querying party server can be the same server or different servers, and no specific limitation is made here.

[0027] Step 204: Based on the data query request, obtain target data from the database.

[0028] The database can be a private database containing private data, a knowledge database containing professional knowledge, or a database containing other content, etc. The specific type of the database is not limited here. The specific content of the private data that is inconvenient to disclose can be determined according to relevant regulations and is not specifically limited here.

[0029] In the embodiments of this specification, the data party has the right to access the database, and can also be the holder, manager, etc. of the database. The data party can obtain a data query request and query the target data from the database. The target data can be understood as data that matches the data query request, and can be used to solve the query requirements of the data query request. In practical applications, some matching algorithms can be used to determine the target data that matches the query request. For example, if an employee wants to query the company's reward system, the target data can be the content of the file of the company's management system that records the reward system, which is used to solve the problem that the employee wants to consult.

[0030] Step 206: Process the target data using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party.

[0031] The model party can be the manager, generator or maintainer of the big model, and can be a server other than the data party and the query party. Without the authorization of the model party, the data party or the query party cannot know the specific logic of the big model, and can only provide data to the big model and obtain the output of the big model. In practical applications, usually in the process of using the big model, the data party can use the big model through the access interface set by the model party, and the model party can obtain the data input into the big model. In the embodiments of this specification, in order to further ensure data security, the big model of the model party can be used to process the target data according to the preset privacy protection method, which can prevent the model party from obtaining the original target data. Among them, the preset privacy protection method can be used to protect the privacy of the target data, which can prevent the target data from being leaked to the model party. For example, it can be a method that can protect the target data, such as encryption, desensitization, etc. The big model can include a big model suitable for tasks such as question and answer, text summarization, and dialogue systems, such as the big language model introduced above.

[0032] In practical applications, when answering questions through a large model, the questions are usually provided to the large model so that the large model can give corresponding answers to the questions. In the embodiments of this specification, the query request provided by the query party can also be provided to the large model so that the large model can generate query results in combination with the request and the data provided by the data party. If the query request contains privacy information, the query request can also be processed in a privacy-preserving manner, such as splicing the acquired target data and the query request, and processing the spliced ​​data using the large model of the model party in a privacy-preserving manner to obtain the query result.

[0033] Step 208: Feedback the query result to the querying party.

[0034] The query party can feed back the query results to the query user terminal so that the user can view the query results. In actual applications, if the query party and the data party are the same server or service party, the execution subject of this embodiment can also be the query party, and the query party can also obtain the query results provided by the big model, and provide the query results or information generated based on the query results for the user to view to the query user.

[0035] It should be understood that the order of some steps in the methods described in one or more embodiments of this specification can be interchanged according to actual needs, or some steps can be omitted or deleted.

[0036] Figure 2In the method, the data party with access to the database can obtain the data query request of the query party, and obtain the target data from the database, and then use the big model of the model party to process the target data in a privacy-protected manner to obtain the query result. Among them, the data party performs data query from the database based on the data query request, rather than the traditional query guided by the big model, which can avoid the model party of the big model directly accessing the database and query request, and in the embodiment of this specification, the big model of the model party can be used to process the target data in accordance with the preset privacy protection method, and the model party can also avoid obtaining the original data of the data party, which can effectively protect the data privacy of the data party and further ensure the data security of the data party.

[0037] In addition, if the data query request sent by the querying party involves privacy data, the large model can be used to obtain accurate query results according to the method in the embodiments of this specification, and the application scenarios of the large model can be expanded to improve the user experience.

[0038] It should be noted that in actual applications, the data party server and the query party server can be the same server or different servers. If the data party server and the query party server are different servers, if the execution subject in the embodiments of this specification can be the data party server, the above data acquisition request can be sent by the query party server to the data party server; if the data party server and the query party server are the same server, the execution subject in the embodiments of this specification can be the data party and the query party server. The above data acquisition request can be generated based on the user's query operation, and the above acquisition of target data from the database can be the query party server sending a data query request to the data party server, and the data party server obtains the target data based on the request and feeds it back to the query party server, or the data party and the query party server access the database through a preset communication protocol to obtain the data.

[0039] based on Figure 2 The method of this specification also provides some specific implementation plans of the method, which are described below. To improve query efficiency, in the embodiment of this specification, a multi-level data index can be constructed for the data in the database, and the data can be queried based on the multi-level data index. Optionally, the method in the embodiment of this specification can also include: Constructing a multi-level data index for the database based on a pre-trained machine learning model for constructing a multi-level data index; The acquiring target data from the database specifically includes: Based on the multi-level data indexes, target data matching the data query request is determined.

[0040] In practical applications, an index directory with more than or equal to two layers of indexes can be constructed based on the data content in the database. Among them, a pre-selected and trained machine learning model can be used for construction. In practical applications, the data in different fields may be quite different. In order to improve the accuracy of the index, the machine learning model can be trained with data in the same field as the data in the database, or with data in the database to obtain a machine model that can construct a multi-level index. The model can include a small-scale classification model, such as a Bert model.

[0041] If the database contains multiple documents, as an implementation method, a summary of each document can be generated, and the document can be divided into one or more document blocks. The summary can be used as an upper index and the document block can be used as a lower index.

[0042] In actual applications, the hierarchy can also be constructed according to at least one of the attributes of region, document type, and document content. For example, a company has branches and document libraries applicable to different local regulations. For example, the company has branches in Country A and Country B, which hold different data privacy regulations and paper reward regulations. The hierarchy can be divided into region-document type-document content. For example, a hospital includes multiple departments, a department can also include multiple doctors, and each doctor can manage the cases of multiple patients. The constructed multi-level data index can be department type-doctor name-case content, etc. The specific form of the multi-level data index can be set according to actual needs, and no specific limitation is made here.

[0043] In the embodiments of this specification, multi-level data indexes can be used for hierarchical indexing to query the target data required by the data query request. Assuming that the upper index has m entries and the lower index has n entries, the number of retrievals can be reduced from O(m×n) to O(m+n), which can effectively reduce the number of retrievals and improve retrieval efficiency.

[0044] In actual applications, data query requests can be matched from top to bottom according to the levels of the multi-layer index. The data query request can be matched with the items of the first level first, and one or more first-level matching items that meet the conditions can be determined. Then, the items of the next level of the first-level matching items that meet the conditions can be matched with the data query request again, and the second-level matching items that meet the conditions can be selected. In this way, layer-by-layer screening is performed to finally determine the target data that matches the data query request items. The above-mentioned matching items that meet the conditions can be set according to actual needs, such as the similarity is greater than or equal to the preset threshold, the vector distance is less than or equal to the preset threshold, etc., which are not specifically limited here.

[0045] In the embodiments of this specification, the data query request can be vectorized data, which can be obtained after embedding vectorization of the query question provided by the user; the constructed multi-level data retrieval can also be vectorized data, and data matching can be performed based on vector calculation. In practical applications, existing matching technologies can also be used for data matching, which can be determined according to actual needs and will not be described here. The vectorization processing method can adopt the existing vectorization processing method, which will not be described here.

[0046] In order to improve the query efficiency, index identifiers may also be generated for each document data in the database, such as determining some keywords, labeling, etc. Optionally, the database in the embodiment of this specification includes several documents, and the method may also include: For any document in the database, determining a search identifier corresponding to the document; the search identifier includes at least one of metadata and a query question; the document content of the document is used to answer the query question corresponding to the document; A corresponding relationship between any of the documents and the corresponding search identifier is established.

[0047] The above-mentioned determining to obtain the target data from the database based on the data query request may specifically include: determining a target query identifier matching the data query request based on the data query request; and determining a target document corresponding to the target query identifier according to the corresponding relationship.

[0048] Metadata can be understood as data such as keywords, descriptive sentences, etc. that can represent the attributes of the content recorded in the document, such as the document title, application area, creation date, tags, etc. In actual applications, metadata can be extracted through language models, or a metadata database can be set up based on expert experience, and the metadata contained in each document can be determined based on the metadata database as a retrieval identifier for the document. For example, for a document on company management regulations, which contains provisions on rewards, vacations, etc., the retrieval identifier of the document can include keywords such as rewards and vacations.

[0049] The query question can be a question generated based on the content of the document, and the document can serve as the answer to the query question. In practical applications, a machine learning model for generating query questions can be pre-trained, and query questions can be generated for each or at least one document in the database through the model. The machine learning model can be similar to a small model of the Bert-type model, and can be generated based on training of known data. In practical applications, in order to improve the accuracy of generating query questions, the data training model in the database can be used, or other data training models that are the same or similar to the field to which the data in the database belong can be used. The retrieval identifier can also be in vector form as a vector index of the document.

[0050] In practical applications, if a document contains a lot of content, the document may be divided into several document blocks, or a retrieval identifier may be constructed for at least one document block.

[0051] In the embodiments of the present specification, the server can match the acquired data query request with the retrieval identifier in the database, determine the target retrieval identifier that meets the preset matching conditions with the data query request, and then determine the document corresponding to the target retrieval identifier based on the correspondence between the retrieval identifier and the document, and further determine the target data corresponding to the data query request.

[0052] In the embodiments of this specification, the data query request can be understood as a query question provided by the query user. In order to query quickly and accurately, the data query request can also be searched and decomposed, and the query is performed based on the decomposition result. Optionally, the method in the embodiments of this specification can also include: Decomposing the data query request by using a named entity recognition and intent recognition model to determine a query object corresponding to the data query request; Based on the data query request, obtaining target data from the database specifically includes: Based on the query object, target data related to the query object is determined from the database.

[0053] The query object can be used to represent entities, query intent, and other contents contained in the data query request. The data query request can be a question text entered by the user, or a data representation of the question text. Decomposition can be performed by sentence splitting, semantic clustering, and semantic rewriting of the query request to convert the question into multiple related sub-sentences or words. The decomposition can be performed using an existing decomposition model, or a model can be trained according to actual needs and decomposed using the trained model.

[0054] For example, if the query question is "Is the personal data forgetting law in country A more stringent than the personal data forgetting law in country B?", the server uses named entity recognition and intent recognition through a small model deployed locally to decompose the search into "country A-personal data-forgetting-punishment" and "country B-personal data-forgetting-punishment". There is no need for a large generative model, and a small understanding model can be used, such as a Bert-type small model.

[0055] In practical applications, the query request can also be decomposed in combination with the hierarchical division conditions in the multi-level search constructed above. It can be decomposed into the types of the above-mentioned hierarchical attributes, such as decomposing the request into the format of "region-question type-question content". In this way, the above-mentioned multi-level search can be used to determine the target data more quickly and accurately.

[0056] In the embodiments of this specification, the above-mentioned processing of the target data using a large model according to the preset privacy protection method may include desensitizing and encrypting the target data, and may also include privacy protection methods such as data processing in a secure and reliable environment. In practical applications, the privacy protection method can be selected according to actual needs.

[0057] Optionally, as an implementation mode, the target data is processed using a large model according to a preset privacy protection method to obtain a query result, which may specifically include: Desensitizing the target data according to a preset desensitization rule to obtain desensitized data; providing the desensitized data to the macromodel; Obtain query results generated by the large model based on the desensitized data.

[0058] In the embodiments of this specification, the server can desensitize the target data based on the named entity, send the desensitized data to the big model, and obtain the result generated by the big model. In practical applications, the data that needs to be desensitized can be set according to actual needs, such as setting a sensitive word library, where sensitive words can be understood as words or sentences involving privacy information, such as company name, address, user name, salary, etc.

[0059] In practical applications, when using a large model for data processing, a model prompt word prompt can be generated based on the query question and related data, and the large model can generate query results based on the model prompt word prompt. In the embodiments of this specification, the desensitization of the target data can also be understood as desensitizing the model prompt word prompt generated based on the target data. Among them, a model prompt word prompt containing the target data and the data query request is generated according to the target data and the data query request. In order to enable the large model to provide query results more accurately, the model prompt word prompt can also include a description of the expected output format, the role of the large model, etc. In the embodiments of this specification, the model prompt word prompt can be desensitized. In practical applications, a prompt word template can be used to generate a model prompt word prompt, and the prompt word template can be a template determined based on expert experience according to the actual application scenario.

[0060] In actual applications, the correspondence between sensitive words and corresponding replaceable words may also be preset, and the sensitive words in the target data or prompt words may be replaced according to the correspondence to obtain desensitized data.

[0061] As another implementation method, the embodiments of this specification may also use cryptographically secure methods such as secure multi-party computing (MPC) for privacy protection. Optionally, the above-mentioned use of a large model to process the target data according to the preset privacy protection method to obtain the query result may specifically include: Based on secure multi-party computing, the large model is used to perform data analysis on the target data to obtain query results.

[0062] Among them, the model party and the data party can use secure multi-party computing to process the operations between the target data and the large model, such as homomorphic encryption, secret sharing algorithm, etc. Using secure multi-party computing, the model party cannot know the original target data, and the data party cannot know the processing logic of the large model, which can effectively protect the data security of both parties.

[0063] In practical applications, the existing SPU (Secure Processing Unit) can be used to execute the secure multi-party computing protocol. The basic processing process may include: the model party can provide the model parameter shards processed by the large model shards to each participating node participating in the multi-party computing. It can be understood that each participating node can obtain the shards of the large model or become a model copy of the large model, but cannot know the original parameters of the large model; the data party can provide the obtained target data or the spliced ​​data of the target data and the query request after sharding to each participating node participating in the multi-party computing. It can be understood that each node can obtain the shards of the calculated data, but cannot obtain the original data. Each participating point can be regarded as an SPU processing unit. According to the preset secure computing protocol, the model result shards of the large model can be calculated using the data shards and the model parameter shards. Then the data party can obtain the result shards provided by each participant and integrate the result shards, such as obtaining the final query result. In actual applications, the data shards that each participant can obtain can also be encrypted data, and the result shards obtained in an encrypted state can also be encrypted. The data party can merge the result shards and use its own secret key to decrypt the result to obtain the plaintext answer. In actual applications, if the querying party has a data merging protocol, the querying party can also obtain the result shards and perform operations such as integration and decryption.

[0064] The computing nodes participating in secure multi-party computing may include the data party, the model party, and if the query party has computing capabilities, it may also include the query party. Of course, other computing nodes besides the data party, the model party and the query party may also be used. There is no specific limitation here and it can be set according to actual needs.

[0065] In practical applications, if the prompt words generated based on the target data are provided to the large model, the prompt words can be used as input data of the large model, and the above data slices can be data slices of the prompt words. Specifically, they can be data in vector form.

[0066] As another implementation mode, in the embodiments of this specification, data processing can also be completed with the help of a secure environment trusted by both the data party and the model party. Optionally, the above-mentioned use of a large model to process the target data in accordance with a preset privacy protection method to obtain a query result may specifically include: Sending the target data to a secure execution environment where the computing logic of the large model is deployed; A query result is obtained by processing the target data using the large model in the secure execution environment.

[0067] The secure execution environment can be a software environment or a hardware security node. The specific secure execution environment can include at least one of the TEE trusted execution environment and the cloud sandbox. The model party can deploy the computing logic of the large model in the secure execution environment, and the data party can provide the determined target data to the secure execution environment. In the secure execution environment, the large model can process the target data to obtain the query results. Neither the model party nor the data party can know the data in the secure execution environment. The access rights of the data party and the model party to the secure execution environment can be restricted, so that the model party cannot know the original target data, and the data party cannot know the processing logic of the large model. This can also effectively protect the data security of both parties.

[0068] Trusted Execution Environment TEE is an independent processing environment with computing and storage functions that can provide security and integrity protection. The basic idea is to allocate an isolated memory for sensitive data in the hardware. All sensitive data calculations are performed in this memory. It is an isolation area between the memory and the CPU. It is isolated from other parts of the CPU using encryption technology. Any data in the TEE cannot be read or tampered with by any code outside the environment. Data can be operated in the TEE through properly authorized code. In practical applications, the code executed inside the TEE can be processed in plain text, and when the outside world tries to access it, it will be displayed in encrypted form. This protection can be managed by the platform security processor embedded in the CPU chip. In the embodiments of this specification, the trusted execution environment TEE can be an isolation area isolated by the data party, or it can be an isolation area isolated by the model party, which can be set according to actual needs. The data party has the authority to transmit data to the trusted execution environment TEE and obtain the processing results of the large model. The model party has the authority to transmit the large model logic or code to the trusted execution environment TEE. The model party cannot know the specific data processed in the trusted execution environment TEE, and the data party cannot know the logic of the large model running in the trusted execution environment TEE.

[0069] A sandbox is a virtual environment for isolating and managing a network environment. It can simulate real scenarios in a network and provide restrictions and monitoring of network resources. A sandbox can provide some virtual hardware and software resources, such as a file system, a network, an operating system, etc., so that an application or process can run in this virtual environment. It can achieve storage and computing separation, protect the data resources themselves, and achieve data availability and invisibility. In the embodiments of this specification, the data party can transfer the obtained target data and query requests to the sandbox, and the model party can deploy the computing logic or program of the large model in the sandbox. The large model can analyze and organize the data provided by the data party in the sandbox and obtain the query results. The data party and the model party cannot directly access the data in the sandbox and do not have access rights. In this way, the model party cannot know the target data provided by the data party, which can ensure the security of the data party's data. In addition, the data party cannot know the computing logic or program of the large model, which can also ensure the security of the large model of the model party. The sandbox used in the embodiments of this specification can be a sandbox deployed in the cloud, or a sandbox deployed at the data party, the model party or other trusted third party, which is not specifically limited here.

[0070] In order to ensure the security of data transmission in the embodiments of this specification, the data party may also encrypt the target data and send the encrypted data to a secure execution environment. The encrypted data may be decrypted in the secure execution environment and processed using a large model according to a preset decryption protocol. Similarly, in the secure execution environment, the query results obtained by the large model processing may be encrypted and fed back to the data party. The data party may decrypt the query results according to a preset protocol and feed the decrypted query results back to the query party. In actual applications, the query party may also directly obtain the query results provided by the model party, or may not be processed by the data party.

[0071] In practical applications, appropriate privacy protection methods can be selected according to actual needs. For example, if the data sensitivity is low, the above-mentioned desensitization method can be used for data processing, which is conducive to ensuring query efficiency and reducing costs; if the real-time requirements for the query are not high, cryptographic methods such as MPC secure multi-party computing can be used for data processing; if the real-time requirements are high, hardware security methods such as TEE can be used for processing; if the participants have disputes over the deployment location of the hardware node, a cloud sandbox can be used for processing. It should be noted that the various privacy protection methods provided above can be used alone or in combination, which can be determined according to actual needs, and no specific restrictions are made here. If the large model provided is a prompt word generated based on the target data, the large model can also be used to process the prompt word according to preset privacy processing methods such as desensitization, encryption, and secure multi-party computing to obtain the query result.

[0072] In actual applications, after calling the large model to process the query request, the data party can also notify the model party of the call notification so that the model party can count the number of times the large model is called. For example, a notification program can be set in a secure execution environment such as a TEE trusted execution environment and a cloud sandbox where the computing logic of the large model is deployed. After the large model completes an inference, the notification program is triggered once to notify the model party of the information that the large model has been called. In actual applications, if the large model is called more times, it can mean that the large model processes more business, or it can mean that the large model is more in line with actual needs; on the contrary, if the large model is called less times, it can also mean that there are not many users using the large model, and the model party may need to adjust the large model to adapt to actual needs. Therefore, in the embodiments of this specification, by notifying the model party of the call of the large model, it is helpful for the model party to evaluate the value of the large model, and it can also be used as a basis for judging whether the large model needs to be improved. In actual applications, the model party can also charge the data party for corresponding resources according to the number of times the large model is called.

[0073] In order to improve the accuracy of the query and provide more accurate query results to the query user, optionally, after obtaining the target data from the database in the embodiment of this specification, the following may also be included: It is determined whether the correlation between the target data and the data query request is greater than or equal to a preset threshold.

[0074] Among them, if the correlation between the target data and the data query request is greater than or equal to the preset threshold, the large model can continue to be used to process the target data; if the correlation between the target data and the data query request is less than the preset threshold, the target data can be re-selected from the database. In the embodiment of this specification, the data party can pre-judge the correlation between the target data and the data query request, and filter out data with less correlation, which can also avoid calling the large model to generate query results that do not meet the query user's questions, and can also reduce invalid calls to the large model.

[0075] In order to enable the big model to accurately summarize the query results, in the embodiment of this specification, the data query request can also be provided to the big model. Optionally, after obtaining the target data from the database, the following steps can also be included: Splicing the target data with the data query request to obtain first spliced ​​data; The process of processing the target data using a large model according to a preset privacy protection method to obtain a query result specifically includes: The first spliced ​​data is processed using a large model according to a preset privacy protection method to obtain a query result.

[0076] Splicing can splice the target data and the data query request into a whole data, which can be a text, a vector matrix, etc. The data query request can be a query question submitted by the query user, or a data request generated based on the query question. The data query request can be spliced ​​in front of the target data or after the target data. The specific position can be set according to actual needs.

[0077] The data used in the big model data in the embodiments of this specification may be the data obtained by concatenating the target data and the data query request. The big model may generate query results based on the data query request and the target data, and may further ensure the rationality of the query results.

[0078] In the embodiment of this specification, the query user may also have the authority to query the data in the database. In order to facilitate the user to more clearly understand the accuracy of the obtained results, the method in the embodiment of this specification may optionally further include: Determining an access address of the target data; The access address is fed back to the querying user.

[0079] The access address may be a link address, and the user can query the target data recorded in the database by clicking the link address, and the user can query the original recorded data, such as documents, etc. For example, if the user wants to query the company's vacation days, the part of the company's rules and regulations that records the vacation days can be obtained through the access address.

[0080] In practical applications, the feedback to the querying user may also include the query question initiated by the user. As an implementation method, the user terminal may display the query question, the query result generated by the large model, and the basis for obtaining the query result, that is, the link address of the target data.

[0081] In the above embodiment, the target data may have been processed by desensitization, encryption, etc. The query result generated by the large model can be understood as the query result after security processing, such as the query result with sensitive words replaced. In order to ensure that the query user can clearly know the answer to the query question, the above-mentioned feedback of the query result to the query user may specifically include: Performing data restoration processing on the query result to obtain a plaintext query result; The plaintext query result is fed back to the query user.

[0082] The data restoration process may include desensitization restoration process, decryption process, etc. The plain text query result may be result data that can be read by the user and may include private data.

[0083] If the execution subject of the embodiment of this specification is the data party, which is a data party server, and is a different server from the query party server that obtains the query question of the query user, the data party server can send the plaintext query result to the query party server, and the plaintext query result is fed back to the query user through the query party server. The above-mentioned data restoration processing step can also be performed by the query party server, and the data party server can send the query result to the query party server, and the query party server can perform data restoration processing on the query result and feed back the obtained plaintext query result to the query user.

[0084] In order to more clearly illustrate a RAG data query method based on privacy protection provided in an embodiment of this specification, Figure 3 This is a swim lane diagram of a RAG data query method based on privacy protection provided in an embodiment of this specification. Figure 3 As shown, the method may include a request phase, a request processing phase, and a result feedback phase, which may specifically include: Step 302: The query server obtains the query requirements provided by the query user, generates a data query request and sends it to the data server.

[0085] The query server may be a server that can obtain the user's query requirements. For example, if the user initiates a query in an application, the query server may be the server of the application.

[0086] Step 304: The data cube server may obtain the data acquisition request.

[0087] The data cube server can hold a queryable database or have access to the database and can query data from the database.

[0088] In actual applications, if the data source server and the query source server are the same server, step 302 can be omitted, and the server can directly obtain the data query request.

[0089] Step 306: The data cube server may query the database for target data matching the data acquisition request based on the data acquisition request.

[0090] Step 308: The data party server may perform privacy protection processing on the target data according to preset privacy protection rules.

[0091] This can prevent the target data from being leaked. For example, the target data can be desensitized, encrypted, sent to a secure environment, processed through MPC secure multi-party computing, etc., to prevent the model party from obtaining the original target data.

[0092] The data party may also combine the matched target data and the query request provided by the query party into one document and provide it to the model party's big model according to the preset privacy protection rules.

[0093] Step 310: The data server may call the large model of the model server to summarize the data and generate query results.

[0094] The model party server can call the model party's big model to process the target data according to the preset privacy protection rules, and the big model can obtain the query results in combination with the target data.

[0095] Step 312: The data party server may obtain the query results generated by the large model, and may also feed back the query results to the query party server.

[0096] Step 314: The query server may feed back the query result to the query user.

[0097] In actual applications, if the query results obtained by the data party server or the query party server are encrypted results or results after desensitization processing, the data party server or the query party server can restore the query results and feed back the plain text information to the query user.

[0098] If the query server and the data server are the same server, step 312 and step 314 can be performed by the same server. In practical applications, the data sent to the model server can also include the identifier of the query server, and the model server can also send the query results generated by the large model to the query server without the need for transfer through the data server.

[0099] If the data is processed by a secure execution environment deployed with a large model, the above step 310 can be executed in the secure execution environment without being executed in the model server. The secure execution environment can also feed back the generated query results to the data server or the query server.

[0100] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method. Figure 4 The structure diagram of a RAG data query device based on privacy protection provided in an embodiment of this specification is shown in FIG. The device may be a device having access to a database, such as Figure 4 As shown, the device may include: The request acquisition module 402 is used to acquire the data query request provided by the querying party; A data acquisition module 404 is used to acquire target data from the database based on the data query request; A result acquisition module 406 is used to process the target data using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; The result feedback module 408 is used to feed back the query result to the querying party.

[0101] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method.

[0102] Figure 5 This is a schematic diagram of a RAG data query device based on privacy protection provided in an embodiment of this specification. Figure 5 As shown, the device 500 may include: at least one processor 510; and, A memory 530 in communication with the at least one processor; wherein, The memory 530 stores instructions 520 executable by the at least one processor 510. The instructions are executed by the at least one processor 510 to enable the at least one processor 510 to: Obtaining the data query request provided by the querying party; Based on the data query request, obtaining target data from the database; The target data is processed using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; Feedback the query result to the querying party.

[0103] Based on the same idea, the embodiment of this specification also provides a computer-readable medium corresponding to the above method. The computer-readable medium stores computer-readable instructions, which can be executed by a processor to implement the above RAG data query method based on privacy protection.

[0104] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. Figure 5 As for the device shown, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0105] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0106] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0107] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0108] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0109] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0110] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0112] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0114] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0115] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0116] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0117] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0118] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0119] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0120] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A RAG data query method based on privacy protection, applied to a data party with access to a database, comprising: Obtaining the data query request provided by the querying party; Based on the data query request, obtaining target data from the database; The target data is processed using the model party's big model according to a preset privacy protection method to obtain a query result; The preset privacy protection method is used to prevent the target data from being leaked to the model party; Feedback the query result to the querying party.

2. The method according to claim 1, further comprising: Constructing a multi-level data index for the database based on a pre-trained machine learning model for constructing a multi-level data index; The acquiring target data from the database specifically includes: Based on the multi-level data indexes, target data matching the data query request is determined.

3. The method according to claim 2, wherein the multi-level data index includes a level constructed according to at least one attribute of region, document type, and document content; And / or, the multi-level data index includes at least a document summary level and a document block level.

4. The method according to claim 1, wherein the database includes a plurality of documents, and the method further comprises: For any document in the database, determining a search identifier corresponding to the any document; The search identifier includes at least one of metadata and a query question; the document content of any one of the documents is used to answer the query question corresponding to the any one of the documents; Establishing a corresponding relationship between any of the documents and a corresponding search identifier; The step of determining to obtain target data from the database based on the data query request specifically includes: Based on the data query request, determining a target retrieval identifier that matches the data query request; According to the corresponding relationship, the target document corresponding to the target search identifier is determined.

5. The method according to claim 1, further comprising: Decomposing the data query request by using a named entity recognition and intent recognition model to determine a query object corresponding to the data query request; Based on the data query request, obtaining target data from the database specifically includes: Based on the query object, target data related to the query object is determined from the database.

6. According to the method of claim 1, the process of processing the target data using the big model of the model party in accordance with the preset privacy protection method to obtain the query result specifically includes: Desensitizing the target data according to a preset desensitization rule to obtain desensitized data; providing the desensitized data to the macromodel; Obtain query results generated by the large model based on the desensitized data.

7. According to the method of claim 1, the process of processing the target data using the big model of the model party in accordance with the preset privacy protection method to obtain the query result specifically includes: The target data is processed using the large model based on secure multi-party computing to obtain a query result.

8. According to the method of claim 1, the process of processing the target data using the big model of the model party in accordance with the preset privacy protection method to obtain the query result specifically includes: Sending the target data to a secure execution environment where the computing logic of the large model is deployed; A query result is obtained by processing the target data using the large model in the secure execution environment.

9. According to the method of claim 8, the secure execution environment includes at least any one of a TEE trusted execution environment and a cloud sandbox.

10. The method according to claim 1, after acquiring the target data from the database, further comprising: It is determined whether the correlation between the target data and the data query request is greater than or equal to a preset threshold.

11. The method according to claim 1, after acquiring the target data from the database, further comprising: Splicing the target data with the data query request to obtain first spliced ​​data; The method of processing the target data using the large model of the model party according to the preset privacy protection method to obtain the query result specifically includes: The first spliced ​​data is processed using the large model of the model party according to a preset privacy protection method to obtain a query result.

12. The method according to claim 1, further comprising: Determining an access address of the target data; The access address is fed back to the querying party.

13. The method according to claim 1, wherein feeding back the query result to the querying party comprises: Performing data restoration processing on the query result to obtain a plaintext query result; The plaintext query result is fed back to the querying party.

14. A RAG data query device based on privacy protection, comprising: A request acquisition module is used to obtain a data query request provided by a querying party; A data acquisition module, used to acquire target data from the database based on the data query request; A result acquisition module is used to process the target data using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is used to prevent the target data from being leaked to the model party; The result feedback module is used to feed back the query result to the query party.

15. A RAG data query device based on privacy protection, comprising: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Obtaining the data query request provided by the querying party; Based on the data query request, obtaining target data from the database; The target data is processed using the large model of the model party according to a preset privacy protection method to obtain a query result; the preset privacy protection method is a method for preventing the target data from being leaked; Feedback the query result to the querying party.

16. A computer-readable medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the RAG data query method based on privacy protection according to any one of claims 1 to 13.

Images