Application program authorization protocol analysis method, computer device, medium and product

Abstract

The invention discloses an application program authorization protocol analysis method, a computer device, a medium and a product. The method comprises the following steps: capturing a permission request initiated by an application in real time, identifying a permission type corresponding to the permission request, and obtaining an associated user protocol of the permission type; a preset legal text is constructed based on the multi-source text information of the target domain, the text is adopted to train a target AI model, the trained model serves as a target domain fine tuning model, and an associated user protocol is analyzed through the model. The method comprises the following steps: acquiring named entities in an associated user protocol, related legal clauses and predicted risk levels corresponding to each legal clause, then synthesizing the information to generate protocol analysis information, and displaying the protocol analysis information to a user in a multi-layer display system. According to the method, the complex protocol content can be automatically and accurately analyzed, the requirements of the user can be presented in different display systems, the protocol understanding threshold is reduced, the privacy disclosure risk caused by blind authorization is reduced, and the method is simple, efficient and safe.

Description

Technical Field

[0001] The present disclosure relates to the technical field of mobile terminal security, and particularly to a method for parsing an application authorization protocol, a computer device, a medium, and a product. Background Art

[0002] In the existing mobile application permission management technology, when an application requests permissions from a user (such as permissions for a camera, an album, location, etc.), it usually only simply prompts the type of permission. For example, the user is only informed that "access to the album". For the specific terms in the user agreement associated with these permissions, there is a lack of effective display and association. These specific terms include key information such as the location where data is stored, the scope of data shared with third parties, and the duration of data retention.

[0003] At the same time, the user agreement itself has problems such as long clauses and complex technical terms, which makes it difficult for users to quickly understand the actual scope of data use after the data is obtained by the application and the potential risks they may face. Users can only manually click to authorize, but they cannot clearly know the details of data use behind the relevant permissions during the authorization process, which brings great troubles to users in protecting personal data security and privacy. Summary of the Invention

[0004] In view of this, the embodiments of the present disclosure provide a method for parsing an application authorization protocol, a computer device, a medium, and a product, which can solve the problems in the prior art that when an application requests permissions, it only simply prompts the type of permission, lacks effective display and association of the specific terms of the associated user agreement, and the user agreement has long clauses and complex terms, resulting in users' difficulty in quickly understanding the scope of data use and potential risks, and being unable to know the details of data use during authorization, which brings great troubles to the protection of personal data security and privacy.

[0005] In a first aspect, the embodiments of the present disclosure provide a method for parsing an application authorization protocol, including: Real-time capturing a permission request initiated by an application, identifying the type of permission corresponding to the permission request, and obtaining the associated user agreement of the type of permission; Constructing a preset legal text based on multi-source text information in the target field, training a target AI model using the preset legal text, and using the trained target AI model as a fine-tuning model for the target field; Inputting the associated user agreement into the fine-tuning model for the target field to obtain the named entities, legal clauses involved, and the predicted risk level corresponding to each legal clause in the associated user agreement; Generating protocol parsing information according to the named entities, legal clauses involved, and the predicted risk level corresponding to each legal clause in the associated user agreement; Present the protocol parsing information to the user in a multi-layer display system.

[0006] Optionally, constructing a preset legal text based on multi-source text information in the target domain includes: Construct a basic corpus; the basic corpus includes one or more of global privacy policies, mobile application user agreements, and judicial interpretations of data abuse in court cases; Perform dynamic masking on legal terms in the basic corpus to obtain a first text set; Perform data augmentation processing on the first text set, and use the processed first text set as the preset legal text.

[0007] Optionally, the method for constructing the target AI model includes: Determine a pre-trained language model, where the pre-trained language model includes Lawformer, MultiLegalPile, or Qianwen AI large model; Train the pre-trained language model with preset texts in the target domain, and use the trained pre-trained language model as the underlying shared encoder; Construct a named entity recognition task-specific head, an attention mechanism-based classification task-specific head, and a risk prediction task-specific head on top of the underlying shared encoder; The named entity recognition task-specific head uses a conditional random field layer to extract named entities in the associated user agreement; The classification task-specific head is used to output the clause category, The risk prediction task-specific head is used to output the predicted risk level of the corresponding clause; Configure a weighted loss function; The weighted loss function is: , where , α is the weight for identifying named entities, β is the weight for clause classification, γ is the weight for risk prediction, is the named entity loss value, is the clause classification loss value; is the risk prediction loss value; The target AI model includes the underlying shared encoder, the named entity recognition task-specific head, the classification task-specific head, the risk prediction task-specific head, and the loss function.

[0008] Optionally, the method for obtaining named entities in the associated user agreement includes: Input the associated user agreement into the underlying shared encoder to obtain a general semantic representation of the associated user agreement; Input the general semantic representation into the named entity recognition task-specific head for processing to identify the named entities in the associated user agreement.

[0009] Optionally, the method for obtaining the legal provisions involved includes: Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement; Input the general semantic representation into the classification task-specific head based on the attention mechanism to obtain the legal provisions involved.

[0010] Optionally, the method for obtaining the predicted risk level corresponding to each legal provision includes: Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement; Obtain the standard rule information formulated based on legal regulations or industry standards; Jointly train the standard rule information and the general semantic representation through the risk prediction task-specific head, and predict the risks involved in each legal provision based on the training results to determine the predicted risk level corresponding to each legal provision.

[0011] Optionally, the multi-layer display system includes an abstract layer, a details layer, and an original text layer; The display of the protocol parsing information to the user in a multi-layer display system includes: Generate an abstract based on the protocol parsing information through natural language and display the abstract in the abstract layer; the abstract includes key information and risk level information, and the key information includes one or more of data usage information, shared object information, and storage location information; Obtain the semantic similarity between the permission request and the legal provisions involved, and display the legal provisions with a semantic similarity greater than the preset threshold in the details layer according to the preset visualization configuration; Identify the professional legal terms in the protocol parsing information and obtain the popular explanations of the professional legal terms; Locate the professional legal terms in the original text layer and configure highlights and floating corresponding popular explanations; Obtain the protocol clauses in the protocol parsing information that conflict with the General Data Protection Regulation, and record them as non-compliant clauses; Locate the non-compliant clauses in the original text layer and configure warning signs.

[0012] Optionally, before generating the protocol parsing information, it further includes: Determine whether the predicted risk level corresponding to each obtained legal clause is consistent with the preset risk rule base. If not, use the result in the preset risk rule base as the predicted risk level of the corresponding legal clause; The preset risk rule base stores several legal clauses and their corresponding preset risk levels.

[0013] In a second aspect, an embodiment of the present disclosure further provides an application program authorization protocol parsing system, including: A monitoring module, configured to capture in real time a permission request initiated by an application, identify the permission type corresponding to the permission request, and obtain the associated user agreement of the permission type; A model training module, configured to construct a preset legal text based on multi-source text information in a target domain, train a target AI model using the preset legal text, and use the trained target AI model as a fine-tuning model for the target domain; An analysis module, configured to input the associated user agreement into the fine-tuning model for the target domain to obtain the named entities in the associated user agreement, the legal clauses involved, and the predicted risk level corresponding to each legal clause; An interaction module, configured to generate protocol parsing information according to the named entities in the associated user agreement, the legal clauses involved, and the predicted risk level corresponding to each legal clause, and display the protocol parsing information to the user in a multi-layer display system.

[0014] In a third aspect, an embodiment of the present disclosure further provides a computer device, adopting the following technical solution: The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the application program authorization protocol parsing method described above.

[0015] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions for causing a computer to execute the application program authorization protocol parsing method described above.

[0016] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the method described above are implemented.

[0017] The application program authorization protocol parsing method disclosed in this application includes: capturing in real time the permission requests initiated by the application, identifying the permission types corresponding to the permission requests, and obtaining the associated user agreements of the permission types; constructing a preset legal text based on multi-source text information in the target field, training a target AI model using the preset legal text, using the trained target AI model as a fine-tuning model for the target field, inputting the associated user agreement into the fine-tuning model for the target field, obtaining the named entities, legal provisions involved, and predicted risk levels corresponding to each legal provision in the associated user agreement, generating protocol parsing information based on the named entities, legal provisions involved, and predicted risk levels corresponding to each legal provision in the associated user agreement, and presenting the protocol parsing information to the user in a multi-layer display system; by capturing permission requests in real time and parsing the associated user agreement, it is possible to clearly understand the permissions that the application program wants to obtain and the legal provisions and risks involved in the agreement, so as to make a more informed authorization decision. By performing multiple tasks through the fine-tuning model for the target field, the problem of misjudgment of legal terms by the general model can be solved, avoiding misjudgment of the agreement terms caused by incorrect understanding of the terms, so as to more accurately identify the named entities, legal provisions involved, and predicted risk levels in the associated user agreement, greatly improving the accuracy of protocol parsing, completing multiple tasks at one time without having to perform reasoning for each task separately like traditional methods, thus significantly shortening the time for protocol parsing and improving the overall parsing efficiency, and being able to quickly provide the user with the protocol parsing result; parsing the agreement based on laws and regulations can help application developers discover possible legal problems in the agreement, prompting them to comply with relevant laws and regulations and protecting the legitimate rights and interests of users; the information display method of the multi-layer display system allows the user to obtain information with different levels of detail according to their own needs, improving the efficiency and convenience of information acquisition, thereby enhancing the user experience. This solution helps to standardize the authorization behavior of application programs, reduce illegal operations, and promote the healthy and orderly development of the application market.

[0018] The above description is only an overview of the technical solution of this disclosure. In order to understand the technical means of this disclosure more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features, and advantages of this disclosure more obvious and understandable, the following specifically gives preferred embodiments and, in conjunction with the drawings, details are described as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0020] Figure 1Schematic flowchart of the application program authorization protocol parsing method provided by an embodiment of the present disclosure.

[0021] Figure 2 Schematic flowchart of the method for constructing a preset legal text provided by an embodiment of the present disclosure.

[0022] Figure 3 Schematic flowchart of the method for constructing a target AI model provided by an embodiment of the present disclosure.

[0023] Figure 4 Schematic flowchart of the method for obtaining named entities in an associated user agreement provided by an embodiment of the present disclosure.

[0024] Figure 5 Schematic flowchart of the method for obtaining legal terms involved provided by an embodiment of the present disclosure.

[0025] Figure 6 Schematic flowchart of the method for obtaining the predicted risk level corresponding to each legal term provided by an embodiment of the present disclosure.

[0026] Figure 7 Schematic flowchart of the method for presenting protocol parsing information to a user in a multi-layer display system provided by an embodiment of the present disclosure.

[0027] Figure 8 Schematic diagram of the structure of a computer device provided by an embodiment of the present disclosure. Detailed implementation manners

[0028] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0029] It should be clear that the following specific examples illustrate the implementation manners of the present disclosure, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific implementation manners, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present disclosure without creative efforts belong to the scope of protection of the present disclosure.

[0030] It should be noted that the following describes various aspects of embodiments within the scope of the appended claims. It will be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is illustrative only. Based on this disclosure, those skilled in the art should understand that one aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of the aspects set forth herein may be used to implement an apparatus and / or practice a method. Additionally, this apparatus and / or method may be implemented using other structures and / or functionality in addition to one or more of the aspects set forth herein.

[0031] It should also be noted that the diagrams provided in the following embodiments only illustrate the basic concept of the present disclosure schematically. Only the components related to the present disclosure are shown in the diagrams, rather than being drawn according to the number, shape, and size of the components in actual implementation. The type, quantity, and ratio of each component in actual implementation may be arbitrarily changed, and the layout type of its components may also be more complex.

[0032] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the aspects may be practiced without these specific details.

[0033] Referring to Figure 1 , the first aspect of this application discloses a method for parsing an application authorization protocol, including: S100, capturing in real time a permission request initiated by an application, identifying the permission type corresponding to the permission request, and obtaining the associated user protocol of the permission type.

[0034] Among them, the permission types include one or more of registration, camera use, microphone use, and album access.

[0035] Through this step, the permission requests of the application can be discovered in a timely manner, enabling the user to understand which permissions the application is attempting to obtain. Accurately identifying the permission type helps to subsequently analyze the relevant protocols targeted, improving the accuracy and efficiency of the parsing. Obtaining the associated user protocol provides the basic data for subsequent protocol parsing.

[0036] Specifically, it is possible to monitor the underlying interfaces of the application system, capture the permission request information initiated by the application (such as CAMERA, READ_CONTACTS) through system-level Hook technology (Android Binder / iOS XPC), and search for the corresponding parts in the privacy policy or user agreement text of the application according to the permission type. For example, dynamically associate the current permission with the privacy policy or user agreement text of the application to identify the permission request formats and characteristics under different operating systems (such as Android, iOS, etc.). This dynamic association enables users to promptly understand the specific regulations of the permission in the application's privacy policy or user agreement when the application requests the permission; they can clearly know how the application will use the relevant data after obtaining the permission, thereby more comprehensively evaluating whether to grant the permission and enhancing users' right to know and control over the use of application data.

[0037] Furthermore, a permission type mapping table can be established to associate common permission requests with their corresponding permission types. For example, a request to access the camera permission corresponds to "hardware device access permission", and a request to access the contact list permission corresponds to "personal information access permission". When a permission request is captured, its corresponding permission type can be identified by querying this mapping table. Each application has a corresponding user agreement during development, and these agreements are usually stored on the application's server or in local storage; after identifying the permission type, the user agreement related to this permission type is obtained from the application's server or local storage according to preset rules. For example, if the permission type is "personal information access permission", then the parts of the agreement regarding the collection, use, and sharing of personal information are obtained.

[0038] S200, construct a preset legal text based on multi-source text information in the target field, and use the preset legal text to train the target AI model, and use the trained target AI model as the target field fine-tuning model.

[0039] The preset legal text constructed based on multi-source text information can cover comprehensive information in the target field and provide rich data for model training; through fine-tuning training, the target AI model can better adapt to specific tasks in the target field and improve the ability to identify and analyze legal clauses in the application authorization agreement.

[0040] S300, input the associated user agreement into the target field fine-tuning model to obtain the named entities, legal clauses involved, and the predicted risk level corresponding to each legal clause in the associated user agreement.

[0041] Among them, the named entities include one or more of the data subject, purpose, third party, storage location; the predicted risk level corresponding to each legal clause refers to the predicted risk level corresponding to each legal clause involved.

[0042] Accurately identifying named entities helps to clarify the subjects and objects in the agreement, providing a clear basis for subsequent analysis; finding out the legal provisions involved enables users to understand whether the agreement complies with the requirements of laws and regulations; predicting the risk level allows users to intuitively understand the degree of risk that the agreement may bring, facilitating decision-making.

[0043] S400 generates agreement analysis information based on the named entities, legal provisions involved, and the predicted risk level corresponding to each legal provision in the associated user agreement.

[0044] The generated agreement analysis information integrates the scattered information, facilitating users to comprehensively and clearly understand the content and risks of the agreement; the explanatory part can help users better understand the agreement analysis information and improve their decision-making ability.

[0045] S500 displays the agreement analysis information to users in a multi-layer display system.

[0046] Among them, the multi-layer display system includes an abstract layer, a details layer, and an original text layer.

[0047] The multi-layer display system can meet the needs of different users. For users who only need to understand the general situation, they can obtain information in the overview layer; for users who need in-depth understanding, they can obtain more comprehensive information through the details layer and the in-depth layer. This display method improves the readability and usability of the information, enabling users to more conveniently obtain and understand the agreement analysis information.

[0048] The application authorization protocol parsing method disclosed in this application is applicable to user privacy protection scenarios in mobile operating system environments such as Android and iOS. By capturing the permission requests initiated by the application in real time, identifying the permission types corresponding to the permission requests, and obtaining the associated user agreements of the permission types; constructing a preset legal text based on multi-source text information in the target field, and training a target AI model with the preset legal text. The trained target AI model is used as a fine-tuning model for the target field. The associated user agreement is input into the fine-tuning model for the target field to obtain the named entities in the associated user agreement, the legal clauses involved, and the predicted risk level corresponding to each legal clause. Protocol parsing information is generated based on the named entities, legal clauses involved, and predicted risk level corresponding to each legal clause in the associated user agreement, and the protocol parsing information is presented to the user in a multi-layer display system; by capturing permission requests in real time and parsing the associated user agreement, it is possible to clearly understand the permissions that the application wants to obtain and the legal clauses and risks involved in the agreement, so as to make a more informed authorization decision. By performing multiple tasks through the fine-tuning model for the target field, the problem of misjudgment of legal terms by the general model can be solved, avoiding misjudgment of agreement clauses caused by incorrect understanding of terms, so as to more accurately identify the named entities, legal clauses involved, and predicted risk level in the associated user agreement, greatly improving the accuracy of protocol parsing. Multiple tasks can be completed at one time without reasoning for each task separately like the traditional method, thus significantly shortening the time for protocol parsing and improving the overall parsing efficiency, and being able to quickly provide the protocol parsing result for the user; protocol parsing based on laws and regulations can help application developers discover potential legal problems in the agreement, prompt them to comply with relevant laws and regulations, and protect the legitimate rights and interests of users; the information display method of the multi-layer display system allows users to obtain information with different levels of detail according to their own needs, improving the efficiency and convenience of information acquisition, thereby enhancing the user experience. This solution helps to standardize the authorization behavior of application programs, reduce illegal operations, promote the healthy and orderly development of the application market, lower the threshold of protocol understanding, reduce the risk of privacy leakage caused by blind authorization, and is simple, efficient, and safe.

[0049] Referring to Figure 2 , for the method of "constructing a preset legal text based on multi-source text information in the target field" in S200, that is, the construction method of the preset legal text, specifically includes: S201, constructing a basic corpus; the basic corpus includes one or more of global privacy policies, mobile application user agreements, and judicial interpretations of data abuse in court cases.

[0050] Among them, the global privacy policies include compliance text documents such as GDPR, CCPA, and the Personal Information Protection Law; for example, through web crawler technology, privacy policy texts of companies in different industries and of different scales worldwide can be collected from channels such as the official websites of major well-known Internet companies and privacy policy databases. For example, collect the privacy policies of companies such as Google, Apple, and Alibaba, which elaborate on the company's rules regarding the collection, use, and protection of users' personal information.

[0051] The user agreements of mobile applications include agreement texts covering mainstream fields such as social, e-commerce, and finance; for example, a large number of popular applications can be downloaded from app stores (such as the Apple App Store and Android app stores), and the user agreements therein can be extracted. For example, the user agreements of social applications (WeChat, Facebook) and shopping applications (Taobao, Amazon), which contain agreements between the application operators and users regarding service use, permission granting, etc.

[0052] The judicial interpretations regarding data abuse in court judgments can be obtained by accessing legal databases (such as China Law Info and Westlaw), searching for court judgment texts regarding data abuse, and organizing the judicial interpretations therein. For example, in some judgments involving personal information leakage and illegal data trading, the judicial interpretations will explain the application and interpretation of relevant legal provisions.

[0053] This step covers various types of texts, which can reflect the legal information in the target field from different perspectives, making subsequent analysis and processing more comprehensive. For example, privacy policies focus on the rules of data collection and use, while court judgments provide the interpretations and judgment criteria of laws in actual applications. The texts from these sources have high authority and provide a reliable basis for subsequent model training and legal analysis.

[0054] S202, dynamically mask the legal terms in the basic corpus to obtain the first text set.

[0055] Specifically, masked legal entity prediction (MLEP) can be used to dynamically mask the legal terms in the basic corpus; masked legal entity prediction (MLEP) is a technology or method specifically used for processing legal text data. "Masking" is a common technical means in natural language processing, and "legal entity prediction" clarifies the application scenario and goal of this technology, that is, to predict and identify various entities in the legal field.

[0056] The legal field has its specific professional terms, such as "data controller" and "anonymization processing", etc. These terms have precise legal definitions and specific meanings, which are different from everyday language and are crucial for accurately understanding and processing legal texts.

[0057] Traditional masking strategies may be static, that is, certain words or parts of the text are masked in a fixed manner; while dynamic masking strategies are more flexible. They will dynamically select the parts to be masked according to different contexts, task requirements, and the characteristics of legal terms.

[0058] For legal terms such as "data controller" and "anonymization", the dynamic masking strategy will mask some parts of these terms according to specific situations. For example, in a sentence "The data controller is responsible for the collection and management of data", it may mask "controller" in "data controller" and let the model predict the masked part; in this way, the model can learn more deeply about the structure, semantics, and usage of legal terms.

[0059] Suppose we have a legal text: "According to relevant regulations, the data controller must anonymize the personal information collected". When using the dynamic masking strategy, it may mask "controller" in "data controller" as "[MASK]" and "anonymization" in "anonymization" as "[MASK]", resulting in "According to relevant regulations, the data [MASK] must [MASK] the personal information collected"; then let the model predict these two masked parts. Through a large number of such trainings, the model can gradually learn the characteristics and meanings of legal terms such as "data controller" and "anonymization", thereby strengthening the understanding of professional terms.

[0060] Through masking, during the training process, the model needs to learn to predict the masked legal terms according to the context, so as to improve the understanding and adaptation ability to different text contexts and enhance the generalization ability; in actual legal text analysis, some unseen legal terms or incomplete expressions may be encountered. Dynamic masking can simulate this situation and enable the model to better handle practical problems.

[0061] S203, perform data augmentation on the first text set and use the processed first text set as the preset legal text.

[0062] Specifically, the key entities in the first text set can be replaced, and the multilingual agreements (such as Chinese-English bilingual clauses) in the first text set after replacement can be aligned and trained, and the trained first text set is used as the preset legal text.

[0063] Furthermore, some words in the first text set can be replaced with synonyms. For example, "data collection" can be replaced with "data acquisition", and "privacy protection" can be replaced with "personal information security protection", etc. The sentence structure can also be adjusted. For example, an active sentence can be changed to a passive sentence. "The application collects the user's personal information" can be transformed into "The user's personal information is collected by the application". The scale of the corpus can also be increased by means of copying, splicing, etc. For example, some similar sentences can be spliced to form longer sentences, or some sentences can be copied to increase the quantity of the corpus.

[0064] Data augmentation processing can generate more different forms of text, making the corpus more rich and diverse. This helps the model learn more language patterns and semantic information, improving the model's performance. Facing different input texts, the model trained with data augmentation can analyze and predict more stably, reducing the overfitting problem caused by insufficient data or uneven data distribution.

[0065] Furthermore, adversarial samples can be generated by replacing key entities (such as changing "shared with a third party" to "partner"). The original sample and the generated adversarial samples are mixed together as the preset legal text.

[0066] Specifically, for the identified key entities, synonyms, near-synonyms or similar expressions are used for replacement. For example, "shared with a third party" can be replaced with "shared by partners", "shared with collaborators", etc. A thesaurus can be established and replacement operations can be carried out according to this thesaurus. To avoid the generated adversarial samples being too different from the original samples, the replacement ratio of key entities needs to be controlled. A replacement ratio threshold can be set. For example, each replacement does not exceed 30% of the total number of key entities in the text. For the same agreement text, multiple different replacement operations can be carried out to generate multiple different adversarial samples to increase the diversity of the samples.

[0067] The method for constructing the preset legal text disclosed in S201 - S203 provides rich, diverse and high-quality data for model training by constructing a comprehensive basic corpus, performing dynamic masking and data augmentation processing, which helps to improve the model's ability to understand and analyze legal texts, enabling it to more accurately identify legal terms, analyze risks, etc. in practical applications. The solution considers various actual scenarios and possible problems, such as unseen legal terms, different expression ways, etc., enabling the model to better adapt to the complex and changeable legal text environment and improving its applicability and reliability in different situations. The preset legal text provides a solid foundation for artificial intelligence-based legal analysis, which can promote the automation and intelligent development of legal analysis work, improve work efficiency and reduce labor costs.

[0068] Refer to Figure 3, A method for constructing a target AI model in S200, including: A100, determining a pre-trained language model, which includes Lawformer, MultiLegalPile, or Qianwen AI large model.

[0069] A200, training the pre-trained language model with preset texts in the target domain, and using the trained pre-trained language model as the underlying shared encoder.

[0070] The pre-trained language model has been trained on a large scale of general texts and has certain language understanding capabilities; through further training with preset texts in the target domain, general knowledge can be transferred to the target domain, reducing the training time and data requirements of the model in the target domain; training for the target domain can make the model better adapt to the language characteristics and task requirements of the target domain, thereby improving the performance of the model in the target domain, such as the ability to understand and analyze legal texts.

[0071] A300, constructing a named entity recognition task-specific head, an attention mechanism-based classification task-specific head, and a risk prediction task-specific head on top of the underlying shared encoder.

[0072] Among them, the named entity recognition (NER) task-specific head adopts a conditional random field (CRF) layer, which is used to determine whether each word in the associated user agreement belongs to a certain entity and the boundary position of the entity according to the context relationship between the elements in the sequence, and at the same time identify the nested entities existing in the associated user agreement, extract and label each independent entity, so as to extract the named entities in the associated user agreement. That is, the construction of the named entity recognition task-specific head includes: adding a conditional random field (CRF) layer on top of the output of the underlying shared encoder. For example, for a user agreement text "This application will collect personal information such as the user's name, phone number, and address", the CRF layer will judge whether each word belongs to a certain entity (such as "name", "phone number", "address" belong to the "personal information" entity) according to the context relationship between the words in the sequence, and determine the boundary position of the entity; at the same time, it can also identify nested entities. For example, in a more complex text, there may be "the name provided by the user at the time of registration (real name)", and the CRF layer can accurately identify nested entities such as "name" and "real name", and extract and label them.

[0073] The classification task-specific head is used to output clause categories; specifically, the construction of the classification task-specific head includes: designing a classification task-specific head based on the attention mechanism, which classifies the clauses in the user agreement according to the output of the underlying shared encoder; for example, classifying clauses into different categories such as "data collection clauses", "data usage clauses", "data sharing clauses", etc. The attention mechanism can help the model focus on the key information in the text and improve the accuracy of classification.

[0074] The risk prediction task-specific head is used to output the predicted risk level of the corresponding clause. For example, for a clause like "This application may share the user's personal information with third-party partners", this head will predict the risk level of this clause, such as "low risk", "medium risk", or "high risk", according to the content of the clause and the output of the underlying shared encoder.

[0075] Each task-specific head is designed for a specific task and can complete its respective task more effectively; for example, the CRF layer can make full use of context information in named entity recognition to improve the accuracy of entity recognition; the classification head based on the attention mechanism can better handle complex information in the text and improve the performance of classification; all task-specific heads are based on the underlying shared encoder, which means they can share the general language knowledge and features learned by the underlying encoder, reducing the number of model parameters and training costs, and at the same time improving the overall efficiency of the model.

[0076] A400, configure the weighted loss function; The target AI model includes an underlying shared encoder, a named entity recognition task-specific head, a classification task-specific head, a risk prediction task-specific head, and a loss function.

[0077] Specifically, the weighted loss function is: , , ensuring that the magnitude of gradient update is controllable.

[0078] where α is the weight for identifying named entities, β is the weight for clause classification, γ is the weight for risk prediction, is the named entity loss value, is the clause classification loss value; is the risk prediction loss value, where α is used to control the loss weight of the NER task to ensure that the model preferentially optimizes the entity extraction accuracy (such as "data usage", "sharing object"); β is used to adjust the weight of the clause classification task to assist the model in distinguishing clause types (such as "data collection" or "data sharing"); γ is used to control the weight of the risk prediction task to avoid secondary tasks from overly interfering with the main tasks (NER and classification).

[0079] Among them, the named entity loss value, clause classification loss value, and risk prediction loss value can be calculated through common loss functions (such as the cross-entropy loss function). For example, in the named entity recognition task, the cross-entropy loss function is used to calculate the difference between the entity labels predicted by the model and the true labels, obtaining the named entity loss value.

[0080] For example, if in the current task, the accuracy of named entity recognition is crucial for subsequent analysis, α can be set to a relatively high value, such as 0.5; while the importance of clause classification and risk prediction is relatively low, β and γ can be set to 0.3 and 0.2 respectively.

[0081] The weighted loss function can weight the losses according to the importance of different tasks, ensuring that the model can pay attention to multiple tasks simultaneously during training, and preventing the model from only optimizing a certain task while ignoring others; by reasonably configuring the weights, the model can achieve better performance on each task, improving the overall effectiveness and practicality of the model.

[0082] The target AI model constructed by the construction method of the target AI model disclosed in A100 - A400 integrates multiple tasks such as named entity recognition, clause classification, and risk prediction. It can comprehensively analyze legal texts (such as user agreements), providing users with richer information and deeper insights; adopting the architecture of a bottom-layer shared encoder and task-specific heads, as well as the training method of a weighted loss function, reduces the number of model parameters and training costs, improving the training efficiency and inference speed of the model; through the training of preset texts in the target domain and the targeted design of task-specific heads, the model can better adapt to the characteristics and requirements of the target domain, improving the accuracy and reliability of each task. This solution has good scalability and can add more task-specific heads as needed to support more tasks, such as the compliance check of legal clauses, etc.

[0083] Furthermore, in this embodiment, in the model architecture of multi-task learning, the task-specific head is a model component specifically designed for different specific tasks. After obtaining the general semantic representation using a bottom-layer shared encoder (such as Legal - BERT, etc.), different tasks require different processing methods to output task-related results, and the task-specific head undertakes such a function. Each head focuses on a specific task and further processes the features output by the shared encoder to complete the corresponding task.

[0084] The task-specific head for named entity recognition, i.e., the NER (Named Entity Recognition) task-specific head, refers to identifying entities with specific meanings from text, such as person names, place names, organization names, legal terms, etc.; in the context of legal text processing, the role of the NER head is to accurately identify various entities in legal texts.

[0085] In the NER task-specific head, a CRF (Conditional Random Field) layer is adopted. CRF is a commonly used sequence labeling model that takes into account the context relationships among elements in the sequence. In the NER task, using the CRF layer can better handle the problem of identifying entity boundaries because it can comprehensively consider the context information before and after to determine whether each word belongs to a certain entity and the boundary position of the entity.

[0086] The NER task-specific head in this embodiment supports nested entities. Specifically, in legal texts, there are many cases of nested entities. For example, in "third-party advertiser", both "third party" and "advertiser" are entities, and "advertiser" is nested in the larger entity of "third-party advertiser". The NER head should be able to recognize this nested relationship and accurately label each entity.

[0087] The main task of the task-specific head for classification is to classify legal provisions, such as classifying provisions into different business types, etc.; introducing an attention mechanism in the task-specific head for classification can enable the model to dynamically focus on the important parts of the provisions when processing them; in legal provisions, there are some keywords that can reflect the degree of risk, such as "permanently retained" and "unencrypted", etc. Through the attention mechanism, these keywords can be automatically focused on, thereby more accurately judging the category of the provisions. The attention mechanism will calculate the weight of each word according to the input provision text, and the higher the weight, the more important the word is in the classification task.

[0088] The goal of the task-specific head for risk prediction is to predict the risks involved in legal provisions, such as predicting whether there are risks of violations and data leakage during the data processing process, etc. Specifically, it can be jointly trained by combining rule features and semantic features. Rule features are some clear rules formulated based on legal regulations or industry standards, such as whether the data retention period exceeds the standard. Semantic features are semantic information extracted from the text by the underlying shared encoder; the task-specific head for risk prediction combines these two features for training, on the one hand, using the certainty of rule features, and on the other hand, using the flexibility of semantic features, thereby improving the accuracy of risk prediction. For example, when judging the risk of a data processing provision, both consider whether the data retention period complies with the regulations (rule features) and the overall semantics of the provision text (semantic features).

[0089] Furthermore, this application also includes: constructing a terminology library in the field of privacy protection (such as "data subject", "processor", "anonymization"), adding vectors corresponding to the terminology library of privacy protection terms to the input layer of the target AI model to enhance semantic discrimination. It is also possible to convert terms such as GDPR / CCPA / Personal Information Protection Law into logical rules (such as "data retention period ≤ 6 months") and input them as features into the task-specific head of risk prediction.

[0090] Refer to Figure 4 , the method for obtaining named entities in the associated user agreement in S300 includes: S311, input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement.

[0091] Specifically, assume we have an associated user agreement for a mobile application, which may contain various terms such as user registration, data collection, privacy protection, service usage rules, etc. This text agreement can be preprocessed, for example, removing redundant spaces, special symbols, etc., to make it in a format suitable for input into the encoder. Then, input the preprocessed text of the associated user agreement into the previously trained underlying shared encoder. Taking the Lawformer pre-trained language model as an example of the underlying shared encoder, it will encode each word in the text, consider the context relationship between words, and abstract and transform the text information through a multi-layer neural network structure. Finally, after being processed by the encoder, a vector representation will be output, and this vector is the general semantic representation of the associated user agreement. This representation contains information such as vocabulary, syntax, and semantics in the agreement text. For example, it can reflect key concepts such as "user information", "data collection method", "privacy policy", and their relationships.

[0092] In this step, the underlying shared encoder has been trained with preset texts in the target domain before, accumulating rich legal domain knowledge and language understanding capabilities. Inputting the associated user agreement into it can utilize this prior knowledge to quickly and accurately extract the semantic information of the agreement text, avoiding learning language features from scratch and improving processing efficiency; the general semantic representation provides a unified and high-quality input for the subsequent named entity recognition task. Regardless of how the length, structure, and expression of the agreement text change, it can be converted into a vector with a fixed dimension, facilitating processing by the subsequent task-specific head.

[0093] S312, input the general semantic representation into the task-specific head of named entity recognition for processing to identify the named entities in the associated user agreement.

[0094] Specifically, the named entity recognition (NER) task-specific head receives the general semantic representation from the underlying shared encoder. This head employs a conditional random field (CRF) layer, which takes into account the context relationships between individual elements in the sequence. For example, for the sentence "This application will collect the user's ID number and mobile phone number" in the protocol text, the CRF layer analyzes the semantic and syntactic information of "ID number" and "mobile phone number" in the context. The CRF layer determines whether each word in the protocol belongs to a certain entity and the boundary position of the entity according to predefined entity categories (such as "personal information", "data type", etc.). For the above example, it will identify that "ID number" and "mobile phone number" belong to the "personal information" entity and label them. At the same time, it can also handle the case of nested entities. For example, in a more complex expression, it can accurately identify nested structures such as "the user's sensitive personal information (such as ID number)".

[0095] The named entity recognition (NER) task-specific head is specifically designed for the named entity recognition task. It can make full use of the general semantic representation output by the underlying shared encoder and combine its own structures such as the CRF layer to focus on identifying named entities in the protocol, improving the accuracy and efficiency of entity recognition. The CRF layer can consider the context relationships between words, which is crucial for accurately identifying named entities. In legal texts, the meanings and boundaries of many entities need to be determined according to the context. The CRF layer can effectively capture this information and avoid errors caused by identifying individual words in isolation.

[0096] In this embodiment, through the collaborative work of the underlying shared encoder and the named entity recognition task-specific head, named entities can be efficiently and accurately identified from the associated user protocol, which is of great significance for legal text analysis, compliance inspection, etc., and can help relevant personnel quickly locate and extract key information. The underlying shared encoder can provide a general semantic representation for multiple tasks, while the named entity recognition task-specific head can be adjusted and optimized according to different requirements. This architecture has good scalability and reusability, facilitating application in different legal text processing scenarios. By using the pre-trained underlying shared encoder and the specially designed task-specific head, it is avoided to train the model from scratch for each new named entity recognition task, reducing the computational cost and time cost and improving the overall work efficiency.

[0097] Refer to Figure 5 , the method for obtaining the legal provisions involved in S300 includes: S321, input the associated user protocol into the underlying shared encoder to obtain the general semantic representation of the associated user protocol.

[0098] S322. Input the general semantic representation into the classification task-specific head based on the attention mechanism to obtain the legal provisions involved.

[0099] The classification task-specific head receives the general semantic representation from the underlying shared encoder. The attention mechanism automatically analyzes each part of the protocol text and assigns different weights to different words or phrases. For example, when processing the part of the protocol regarding "privacy policy", the attention mechanism will pay more attention to keywords such as "personal information collection" and "data sharing", and assign higher weights to these words to highlight their importance. According to the weights assigned by the attention mechanism, the classification task-specific head classifies the protocol to determine the category of the legal provisions involved. Assuming that categories such as "user registration terms", "privacy protection terms", and "transaction rule terms" are predefined, the head will classify it into the corresponding category according to the semantic information of the protocol. For example, if the protocol mainly involves information provision and identity verification requirements during user registration, it will be classified into the "user registration terms" category.

[0100] The attention mechanism can help the model focus on the key information in the protocol text and ignore the irrelevant noise information. By assigning different weights to different parts, the model can better understand the core content of the protocol, thereby improving the accuracy of clause classification. Legal provisions usually have complex semantics and structures, and there may be intersections and overlaps between different provisions. The classification task-specific head based on the attention mechanism can better handle this complexity. By dynamically adjusting the attention weights, it can capture the subtle differences in the text and accurately identify the legal provisions involved.

[0101] Refer to Figure 6 , the method for obtaining the predicted risk level corresponding to each legal provision in S300 includes: S331. Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement.

[0102] S332. Obtain the standard rule information formulated based on legal provisions or industry standards.

[0103] The standard rule information formulated based on legal provisions and industry standards is authoritative and normative, providing a reliable reference basis for risk prediction, ensuring that the prediction results comply with legal requirements and industry norms, and improving the credibility of the prediction. The standard rule information clarifies the boundaries of legality and compliance, enabling accurate judgment of whether there are risks in the protocol terms, as well as the nature and degree of the risks when conducting risk prediction.

[0104] S333: Jointly train the standard rule information and general semantic representation through the risk prediction task-specific head, and predict the risks involved in each legal clause based on the training results to determine the corresponding predicted risk level for each legal clause.

[0105] Among them, the risk levels include one or more of the risks of violations in the data processing process and the risk of data leakage.

[0106] The risk prediction task-specific head receives the standard rule information and general semantic representation as inputs. During the training process, the model will learn the mapping relationship between the standard rule information and the semantics of the protocol clauses. For example, when the clause "The platform can use the user's personal information at will" appears in the protocol, the model will learn that this clause may have a high risk according to the regulations on user privacy protection in the standard rules. After training, the model will predict the risks of each legal clause in the protocol. According to the prediction results, the risk levels are divided into three levels: low, medium, and high. For example, if a clause only slightly violates some recommended regulations of the industry standard, it may be judged as a low risk; if a clause violates important legal regulations, it may be judged as a high risk.

[0107] Through joint training, the model can comprehensively consider the standard rule information and the semantics of the protocol clauses to evaluate risks more accurately, avoid the limitations of evaluating risks based solely on rules or semantics, and improve the accuracy of risk prediction. This step realizes the automation of risk prediction, can quickly determine the corresponding risk level for each legal clause, provides decision-making support for legal professionals, enterprise managers, etc., and helps them discover and handle potential legal risks in a timely manner.

[0108] Refer to Figure 7 , for the method of S500 to display the protocol parsing information to the user in a multi-layer display system, including: S510: Generate a summary in natural language according to the protocol parsing information and display the summary at the summary layer.

[0109] Among them, the summary includes key information and risk level information, and the key information includes one or more of data usage information, sharing object information, and storage location information.

[0110] The summary layer mainly provides a concise and clear summary of key information for the user in the form of natural language. Users do not need to read the long original protocol. Through the summary, they can quickly grasp the key information and risk situation of the protocol, improving the information acquisition efficiency; especially for those important information closely related to their own rights and interests, privacy, etc., it helps users quickly grasp the general situation when browsing and decide whether they need to further understand the details.

[0111] When users don't have enough time or energy to read documents such as the privacy policy and data usage agreement of an application in detail, the summary layer can quickly provide them with key information to assist them in making preliminary judgments, such as whether to continue using the application, whether to further understand the details, etc.

[0112] Specifically, using controllable generation technology, the CTRL (Conditional Transformer Language Model) is adopted. According to the control code (such as [RISK_HIGH]), a summary is generated based on key information and risk level information to avoid deviating from the core risk points. For example, when the control code is [DATA_PHOTO][USE_AD][SHARE_3RD][STORAGE_US][RISK_HIGH], the generated text is "This application will use your album data for advertising recommendations and share it with third-party partners. The data is stored in the United States (high risk)". Through such a summary, users can quickly perceive the potential privacy and data security issues that may arise when using this application.

[0113] S520, obtain the semantic similarity between the permission request and the legal terms involved, and display the legal terms with a semantic similarity greater than the preset threshold in the details layer according to the preset visualization configuration.

[0114] Specifically, Sentence - BERT is used to calculate the semantic similarity between the permission description (such as "access album") and the terms, and only the terms with a correlation > 0.7 (preset threshold) are displayed.

[0115] Furthermore, visualization enhancement can be implemented, adding animated warnings (such as flashing red borders) to high-risk fields and supporting users to customize filtering conditions (such as "only display high-risk terms").

[0116] Specifically, animated warning: For high-risk fields, add an animated warning effect, such as a flashing red border. This visualization method can attract users' attention and enable users to more intuitively identify high-risk content. Support users to customize filtering conditions according to their own needs, such as "only display high-risk terms". Users can flexibly filter information according to their own concerns, improving the efficiency of information acquisition.

[0117] Furthermore, the details layer can display key fields in the form of a structured table, such as usage, sharing objects, risk levels, etc. This display method can systematically organize and clearly present complex information, facilitating users to make comparisons and analyses, deeply understand the specific situations of each key element, and thus more comprehensively evaluate relevant risks.

[0118] When users have a need to further understand the information at the summary layer, the details layer can provide them with more detailed and specific information to help them make more in-depth decisions, such as comparing and selecting among multiple applications or serving as an important reference when deciding whether to agree to data sharing.

[0119] S530, identify the professional legal terms in the protocol parsing information and obtain the popular explanations of the professional legal terms; Locate the professional legal terms in the original text layer, configure highlights and float the corresponding popular explanations.

[0120] For non-law-professional users, professional legal terms are often difficult to understand. Popular explanations can help them better understand the content of the protocol and eliminate misunderstandings caused by term barriers; through the interactive methods of highlighting and floating explanations, a convenient access way is provided for users, making the process of reading the protocol smoother and more comfortable.

[0121] S540, obtain the protocol clauses in the protocol parsing information that conflict with the General Data Protection Regulation, and record them as non-compliant clauses; Locate the non-compliant clauses in the original text layer and configure warning signs.

[0122] If a certain clause in the protocol parsing information stipulates that "the platform can collect user data at will without clearly stating the purpose", then this clause conflicts with the General Data Protection Regulation and is marked as a non-compliant clause; locate this non-compliant clause in the original text layer and mark it with a prominent warning sign (such as a red exclamation mark) to remind users to pay attention. Through this step, it can help users quickly identify the clauses in the protocol that may violate their data rights and interests, enabling users to make decisions with full knowledge, enhancing the protection of user data security and privacy; for the platform, this display method also prompts it to promptly discover and modify non-compliant protocol clauses, improving the compliance level of the protocol.

[0123] The method of presenting the protocol parsing information to users through a multi-layer display system disclosed in S510 - S540, through the multi-layer display system, from the summary to the details, and then to the special processing of professional terms and non-compliant clauses, provides users with comprehensive, clear and easy-to-understand protocol information, enabling users to more easily understand the content of the protocol and enhancing the reading experience; this solution clearly presents the key information, legal basis, professional term explanations and compliance status in the protocol to users, increasing the transparency of the platform, helping to establish user trust in the platform, and promoting a good cooperative relationship between users and the platform; for the platform, it can promptly discover non-compliant clauses in the protocol and rectify them, improving the compliance of the protocol; for users, it can better understand potential risks, take corresponding preventive measures, and reduce legal risks and data security risks.

[0124] Furthermore, the original text layer mainly provides the location of the protocol original text and the explanation of relevant terms. Its purpose is to enable users to view the most original protocol content, avoid misunderstandings or omissions in the information transmission process. At the same time, by explaining professional terms, it reduces the difficulty for users to understand the protocol and enhances users' accurate grasp of the protocol content.

[0125] When users still have questions about the information in the details layer or need to confirm the accurate meaning of certain specific terms, the original text layer can provide them with the most authoritative basis. In addition, for some users with strong legal awareness and who attach great importance to the protection of their own rights and interests, they may be more inclined to directly view the protocol original text, and the original text layer can meet this need of theirs.

[0126] Through the three-level display system, it can meet the needs of different users in different scenarios. From the summary layer for quickly understanding key information, to the details layer for in-depth analysis of the detailed situation, and then to the original text layer for consulting the original protocol and term explanations, it provides users with a gradually in-depth and well-structured information acquisition path, which helps to improve users' understanding and cognition of relevant protocols and data usage situations, and enhances users' decision-making ability when facing complex information.

[0127] Furthermore, legal agreements usually contain a large number of professional terms, which are somewhat difficult for ordinary users to understand. The role of the term explanation model is to fine-tune the model so that it can convert these professional legal terms into easy-to-understand explanations.

[0128] For the method of "obtaining easy-to-understand explanations of professional legal terms", it can be based on a pre-trained language model, use a dataset containing professional legal terms and their easy-to-understand explanations to further train the model, adjust the model's parameters, and let it learn the mapping relationship between professional terms and easy-to-understand explanations. When users encounter professional terms when viewing the original text of a legal agreement, the model will convert the professional term into an easy-to-understand explanation according to the mapping relationship learned before. For example, when inputting "anonymization processing", the model outputs "The data has been processed and cannot be associated with specific individuals". Through this method, it can effectively lower the threshold for users to understand legal agreements, enabling ordinary users to understand the meaning of key terms in the agreement without the need to have professional legal knowledge, thus understanding the protocol content more accurately.

[0129] Among them, the GDPR (General Data Protection Regulation) is a strict data protection regulation, and many agreements involving data processing need to comply with its requirements. The compliance comparison and prompt function is to compare the protocol terms with the requirements of the GDPR. If it is found that there is a conflict between the protocol terms and the regulatory requirements, corresponding prompts will be made in the original text layer.

[0130] For "obtaining the protocol terms in the protocol parsing information that conflict with the General Data Protection Regulation", specifically, each term in the protocol can be analyzed and compared one by one with the requirements stipulated in the GDPR to identify the terms in the protocol that do not meet the regulatory requirements; once a conflicting term is found, a warning sign will be added at the position of the term in the original protocol text. This warning sign can be a special icon, color marking, etc., to attract the user's attention. At the same time, the warning sign is linked to the relevant requirements part in the original text of the GDPR. When the user clicks on the warning sign, they can directly view the specific regulatory content and understand the specific situation of the conflict between the protocol terms and the regulations.

[0131] Through this method, it can help users quickly identify the parts of the protocol that do not meet the regulatory requirements, improve users' awareness of protocol compliance, and at the same time facilitate users to further consult the original text of the regulations to understand the detailed regulatory requirements; generally speaking, the explanation generation at the original text layer improves users' understanding and grasp of legal agreements through term explanations and compliance tips, and enhances users' ability to judge the compliance of agreements.

[0132] Furthermore, before generating the protocol parsing information in S400, the application program authorization protocol parsing method disclosed in this application further includes: judging whether the predicted risk level corresponding to each legal term obtained is consistent with the preset risk rule library. If not, the result in the preset risk rule library is used as the predicted risk level corresponding to the legal term. By comparing the prediction result with the preset risk rule library, possible prediction biases can be corrected, making the finally determined risk level more in line with the actual situation and historical experience.

[0133] Among them, the preset risk rule library stores several legal terms and their corresponding preset risk levels. These legal terms are common and representative terms in the application program authorization protocol. The preset risk level can be set manually according to historical experience. That is to say, legal experts or relevant practitioners, based on the experience of dealing with similar protocols in the past, combine laws, regulations and industry standards to pre-determine a reasonable risk level for different legal terms. For example, for a term like "the application program can collect users' sensitive personal information without limit", according to experience, its preset risk level is usually set as "high".

[0134] After completing the prediction of the risk level for each legal provision, the predicted risk level obtained is compared with the preset risk level of the corresponding provision in the preset risk rule library. For example, through a previous prediction model, a certain legal provision is predicted to be "low risk", but in the preset risk rule library, the preset risk level corresponding to this provision is "high risk", which results in an inconsistent situation. If the predicted risk level is inconsistent with the preset risk rule library, the result in the preset risk rule library is used as the predicted risk level of the corresponding legal provision. Continuing with the above example, the final predicted risk level of this legal provision will be adjusted to "high risk".

[0135] The prediction model may be affected by factors such as data quality and algorithm limitations, resulting in deviations in the prediction results. The preset risk rule library, based on historical experience and professional judgment, can provide a relatively accurate reference standard, and calibration can improve the accuracy of risk level prediction; different prediction models or different analysts may obtain different prediction results. The preset risk rule library provides a unified standard for the determination of risk levels, ensuring the consistency of risk assessments for the same legal provisions under different circumstances; the preset risk levels set according to historical experience and laws and regulations reflect the general understanding of legal provision risks in the industry. Following the preset risk rule library for calibration helps ensure that the risk assessment of the application authorization agreement complies with industry norms and the requirements of laws and regulations.

[0136] Example 1. Take the example of "a social App applying for album permission". The specific operation process is as follows: 1) Monitoring trigger: The system captures the READ_EXTERNAL_STORAGE request and associates it with the App's "Privacy Policy"; 2) Protocol parsing: The AI extracts the key information: "Album data is used for personalized advertising recommendations and stored on an overseas server"; 3) User interface: A pop-up window displays the "Album access request", summarizes and prompts the data usage and risks, and provides a "View detailed terms" link; 4) User decision: The user can authorize with one click, reject, or enter the agreement details page for review.

[0137] Example 2. Take the example of "a financial App applying for contact list permission". The specific operation process is as follows: 1) Protocol parsing: NER extracts "Contact list data → used for credit risk assessment → shared with partner banks → stored locally → retained for 2 years"; 2) Risk determination: According to the rule library, "Financial data sharing + no clear user revocation right" is marked as high risk. 3) Three-level display; Summary layer: "XX Finance will collect your contact list information for credit assessment and share it with partner banks (high risk).". Table 1 Details layer display table The original text layer can display: Click on "User Rights" to jump to Section 6.3 of the agreement, highlight the missing terms, and prompt "According to the Personal Information Protection Law, you have the right to request the deletion of data."

[0138] The application authorization agreement parsing method disclosed in this application focuses on multiple key areas. Through advanced technical means and unique design concepts, significant progress has been made in improving the performance of AI models, optimizing the information display method, and ensuring compliance. Specifically, aiming at the deficiency of general models in understanding legal professional terms, an innovative method of "legal text pre-training + multi-task fine-tuning" is adopted. General models often misjudge legal professional terms such as "data anonymization" and "cross-border transmission". By pre-training on a large number of legal texts and performing multi-task fine-tuning on this basis, the model can deeply learn the semantics and logic in the legal field, effectively solving the problem of term misjudgment and greatly improving the accuracy and reliability of the model in legal-related tasks. Innovatively, the named entity recognition, classification, and risk prediction tasks are jointly processed. In the traditional method, these tasks often require multiple independent model inferences, resulting in a large computational overhead. However, this solution reduces the process of multiple model inferences by jointly processing these tasks, significantly reducing the computational cost and improving the running efficiency of the model, enabling the system to process complex legal data and tasks more quickly.

[0139] In this application, the agreement parsing information is presented to the user in a multi-layer display system. In the summary layer, a hybrid mode of "rule template + generation model" is adopted. The rule template can ensure the accuracy of information extraction and ensure that key information is not omitted. The generation model, on the other hand, gives the summary stronger readability and makes the summary content more fluent and natural. This hybrid mode fully combines the advantages of both, providing accurate information while also facilitating the user's quick understanding of the core content.

[0140] In the details layer, the relevance filtering technology can be used to screen and filter a large amount of information, only showing the content relevant to the user's needs, effectively reducing the problem of information overload, enabling the user to focus more on key information, avoiding being overwhelmed by a large amount of irrelevant information, and reducing the problem of information overload.

[0141] In the original text layer, a precise positioning function is achieved. When the user needs to review specific content, they can quickly locate the relevant position in the original text, greatly improving the review efficiency and saving the user's time and energy.

[0142] In this application, the constructed risk rule base supports dynamic updates and can adapt to the ever-changing policy and regulatory requirements in a timely manner. As laws and regulations are revised and updated, the system can quickly adjust the risk assessment rules to ensure that the system always complies with the latest compliance standards, providing reliable compliance guarantees for enterprises and users. To ensure users' right to know and compliance requirements, it is possible to forcibly display statutory disclosure content such as data retention periods and third-party lists. These are important contents that regulations require to be disclosed to users. By forcibly displaying them, users can clearly understand the use and sharing of data, enhancing users' trust in the system and avoiding potential compliance risks caused by insufficient information disclosure.

[0143] The method for parsing the application program authorization agreement disclosed in this application captures the permission requests initiated by the application in real time, identifies the permission types, and obtains the associated user agreement. This breaks the situation in the prior art where only the permission types are simply prompted, but there is a lack of effective display and association with the specific terms of the associated user agreement. When facing the permission application of an application, users no longer only see a single prompt such as "access album", but can obtain the complete user agreement content related to it, so as to understand the detailed regulations on data use behind the permission.

[0144] By obtaining and parsing the associated user agreement, users can clearly know key information such as the location where the data is stored, the scope of data shared with third parties, and the data retention period. During the process of authorizing the application to obtain permissions, users have a clearer understanding of the flow and usage method of their own data and are no longer in a state of information opacity, greatly enhancing users' sense of control over personal data.

[0145] Based on multi-source text information in the target domain, a preset legal text training target domain fine-tuning model is constructed. This model can accurately parse the associated user agreement, identify the named entities in the agreement, the legal provisions involved, and the predicted risk level corresponding to each legal provision. This effectively addresses the problems of long user agreement terms and complex professional terms, transforming the complex agreement content into clear and well-organized parsing information and reducing the difficulty for users to understand the agreement. The agreement parsing information is presented to users through a multi-layer display system, meeting the needs of different users in different scenarios. For users who want to quickly understand the key points of the agreement, the hybrid mode of "rule template + generation model" in the summary layer can present the core information in an accurate and readable manner; for users who need to deeply understand specific terms, the relevance filtering in the details layer can reduce interference from irrelevant information, and the accurate positioning in the original text layer facilitates users to quickly consult the original text, thus helping users quickly understand the actual usage scope of their data after being obtained by the application and the potential risks they may face.

[0146] By predicting the risk level corresponding to each legal clause, users can clearly understand the potential risks that each permission may bring during the authorization process. This provides important decision-making reference for users, enabling them to decide whether to authorize the application to obtain the corresponding permission according to the risk level, thus better protecting personal data security and privacy. This solution uses rules aligned with the regulations in the target field for model training and protocol parsing to ensure that the authorization protocol of the application complies with the requirements of relevant laws and regulations, which reduces the risk of user data security and privacy being violated due to non-compliant protocols from the source and provides more reliable protection for users.

[0147] In a second aspect, the present application discloses an application program authorization protocol parsing system for implementing the application program authorization protocol parsing method disclosed in the first aspect of the present application, including: A monitoring module for capturing in real time the permission requests initiated by the application, identifying the permission types corresponding to the permission requests, and obtaining the associated user agreements of the permission types; A model training module for constructing a preset legal text based on multi-source text information in the target field, training a target AI model using the preset legal text, and using the trained target AI model as a fine-tuning model for the target field; An analysis module for inputting the associated user agreement into the fine-tuning model for the target field to obtain the named entities, legal clauses involved, and predicted risk levels corresponding to each legal clause in the associated user agreement; An interaction module for generating protocol parsing information based on the named entities, legal clauses involved, and predicted risk levels corresponding to each legal clause in the associated user agreement, and displaying the protocol parsing information to the user in a multi-layer display system.

[0148] According to an embodiment of the present disclosure, a computer device includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0149] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform the desired functions. In an embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the computer device executes all or part of the steps of the application program authorization protocol parsing method of the foregoing embodiments of the present disclosure.

[0150] Those skilled in the art should be able to understand that, in order to solve the technical problem of how to obtain good user experience effects, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included in the protection scope of this disclosure.

[0151] Such as Figure 8 FIG. is a schematic structural diagram of a computer device provided by an embodiment of this disclosure. It shows a schematic structural diagram of a computer device suitable for implementing the computer device in the embodiment of this disclosure. Figure 8 The shown computer device is only an example and should not impose any limitations on the functions and usage scope of the embodiments of this disclosure.

[0152] Such as Figure 8 As shown, the computer device may include a processor (such as a central processing unit, a graphics processing unit, etc.), which may perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer device are also stored. The processor, ROM, and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0153] Generally, the following devices may be connected to the I / O interface: an input device including, for example, a sensor or a visual information acquisition device; an output device including, for example, a display screen; a storage device including, for example, a magnetic tape, a hard disk, etc.; and a communication device. The communication device may allow the computer device to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 8 the shown computer device has various devices, it should be understood that it is not required to implement or have all the shown devices. Instead, more or fewer devices may be implemented or had.

[0154] In particular, according to the embodiments of this disclosure, the process described above with reference to the flowchart may be implemented as a computer software program. For example, an embodiment of this disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes program codes for executing the method shown in the flowchart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by the processor, all or part of the steps of the application program authorization protocol parsing method in the embodiments of this disclosure are executed.

[0155] For the detailed description of this embodiment, reference may be made to the corresponding descriptions in the foregoing embodiments, and details will not be repeated here.

[0156] A computer-readable storage medium according to an embodiment of the present disclosure stores non-transitory computer-readable instructions thereon. When the non-transitory computer-readable instructions are run by a processor, all or part of the steps of the application program authorization protocol parsing method of the foregoing embodiments of the present disclosure are executed.

[0157] The above-mentioned computer-readable storage media include but are not limited to: optical storage media (such as CD-ROMs and DVDs), magneto-optical storage media (such as MOs), magnetic storage media (such as magnetic tapes or external hard drives), media with built-in rewritable non-volatile memories (such as memory cards), and media with built-in ROMs (such as ROM cartridges).

[0158] For a detailed description of this embodiment, reference may be made to the corresponding descriptions in the foregoing embodiments, and details will not be repeated here.

[0159] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, benefits, effects, etc. mentioned in the present disclosure are only examples and not limitations. It cannot be considered that these advantages, benefits, effects, etc. are essential for each embodiment of the present disclosure. In addition, the above-mentioned specific details of the disclosure are only for illustrative purposes and for ease of understanding, rather than limitations. The above details do not limit the present disclosure to necessarily adopt the above specific details for implementation.

[0160] In the present disclosure, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, equipment, and systems involved in the present disclosure are only illustrative examples and do not intend to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open-ended words, meaning "including but not limited to", and can be used interchangeably with each other. The words "or" and "and" used herein refer to the word "and / or", and can be used interchangeably with each other, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to", and can be used interchangeably with each other.

[0161] In addition, as used herein, the "or" used in the listing of items starting with "at least one" indicates a disjunctive listing, so that for example, the listing of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (that is, A and B and C). In addition, the term "exemplary" does not mean that the described examples are preferred or better than other examples.

[0162] It should also be noted that in the systems and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present disclosure.

[0163] Various changes, substitutions, and alterations to the technologies described herein can be made without departing from the teachings defined by the appended claims. Additionally, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and acts described above. Processes, machines, manufactures, compositions of events, means, methods, or acts that currently exist or will later be developed and that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Accordingly, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or acts within their scope.

[0164] The foregoing description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0165] The foregoing description has been presented for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the form disclosed herein. Although several example aspects and embodiments have been discussed above, those skilled in the art will recognize some of their variations, modifications, alterations, additions, and subcombinations.

Claims

1. A method for parsing an application authorization protocol, characterized in that Including: Real-time capture of permission requests initiated by applications, identify the permission types corresponding to the permission requests, and obtain the associated user agreements of the permission types; Construct a preset legal text based on multi-source text information in the target field, and use the preset legal text to train a target AI model, and use the trained target AI model as a fine-tuning model for the target field; Input the associated user agreement into the fine-tuning model for the target field to obtain the named entities, legal clauses involved, and the predicted risk level corresponding to each legal clause in the associated user agreement; Generate protocol parsing information based on the named entities, legal clauses involved, and the predicted risk level corresponding to each legal clause in the associated user agreement; Display the protocol parsing information to the user in a multi-layer display system.

2. The method for parsing an application program authorization protocol according to claim 1, wherein The construction of the preset legal text based on multi-source text information in the target field includes: Construct a basic corpus; the basic corpus includes one or more of global privacy policies, mobile application user agreements, and judicial interpretations of data abuse in court cases; Perform dynamic masking on the legal terms in the basic corpus to obtain a first text set; Perform data augmentation processing on the first text set, and use the processed first text set as the preset legal text.

3. The application program authorization protocol parsing method according to claim 1, wherein The construction method of the target AI model includes: Determine a pre-trained language model, and the pre-trained language model includes Lawformer, MultiLegalPile or Qianwen AI large model; Train the pre-trained language model with preset texts in the target field, and use the trained pre-trained language model as the underlying shared encoder; Construct a named entity recognition task-specific head, an attention mechanism-based classification task-specific head, and a risk prediction task-specific head on top of the underlying shared encoder; The named entity recognition task-specific head uses a conditional random field layer to extract named entities in the associated user agreement; The classification task-specific head is used to output clause categories; The risk prediction task-specific head is used to output the predicted risk level of the corresponding clause; Configure a weighted loss function; The weighted loss function is as follows: , where , α is the weight for identifying named entities, β is the weight for clause classification, and γ is the weight for risk prediction, is the loss value of named entities, is the loss value of clause classification; is the loss value of risk prediction; The target AI model includes the underlying shared encoder, the named entity recognition task-specific head, the classification task-specific head, the risk prediction task-specific head, and the loss function.

4. The method for parsing an application program authorization protocol according to claim 3, wherein The method for obtaining the named entities in the associated user agreement includes: Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement; Input the general semantic representation into the named entity recognition task-specific head for processing, and identify the named entities in the associated user agreement.

5. The application program authorization protocol parsing method according to claim 3, wherein The method for obtaining the legal clauses involved includes: Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement; Input the general semantic representation into the attention mechanism-based classification task-specific head to obtain the legal clauses involved.

6. The method for parsing an application program authorization protocol according to claim 5, wherein The method for obtaining the predicted risk level corresponding to each legal clause includes: Input the associated user agreement into the underlying shared encoder to obtain the general semantic representation of the associated user agreement; Obtain standard rule information formulated based on legal regulations or industry standards; Jointly train the standard rule information and the general semantic representation through the risk prediction task-specific head, and predict the risks involved in each legal clause based on the training results to determine the predicted risk level corresponding to each legal clause.

7. The method for parsing an application program authorization protocol according to claim 1, wherein The multi-layer display system includes an abstract layer, a details layer, and an original text layer; Display the protocol parsing information to the user in a multi-layer display system, including: Generate an abstract through natural language according to the protocol parsing information and display the abstract in the abstract layer; the abstract includes key information and risk level information, and the key information includes one or more of data usage information, shared object information, and storage location information; Obtain the semantic similarity between the permission request and the legal clauses involved, and display the legal clauses with the semantic similarity greater than the preset threshold in the details layer according to the preset visualization configuration; Identify the professional legal terms in the protocol parsing information and obtain the popular explanations of the professional legal terms; Locate the professional legal terms in the original text layer, configure highlights and float the corresponding popular explanations; Obtain the protocol clauses in the protocol parsing information that conflict with the General Data Protection Regulation, and record them as non-compliant clauses; Locate the non-compliant clauses in the original text layer and configure warning signs.

8. The method for parsing an application program authorization protocol according to claim 1, wherein Before generating the protocol parsing information, it also includes: Judge whether the predicted risk level corresponding to each obtained legal clause is consistent with the preset risk rule library. If not, use the result in the preset risk rule library as the predicted risk level corresponding to the legal clause; The preset risk rule library stores several legal clauses and their corresponding preset risk levels.

9. A computer device, characterized in that, The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the application program authorization protocol parsing method according to any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, This computer-readable storage medium stores computer instructions for causing a computer to execute the application program authorization protocol parsing method according to any one of claims 1-8.

11. A computer program product, comprising computer instructions, characterized in that, When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1-8 are implemented.

Images