Financial privacy security alignment method and system based on federated learning and adversarial training

Abstract

The invention discloses a financial privacy security alignment method and system based on federated learning and adversarial training, and the method comprises the steps: enabling a plurality of financial institution clients to obtain local financial data, and carrying out the semantic analysis and sensitivity grading; constructing a federated learning framework, performing homomorphic encryption on a local model gradient by adopting Paillier, uploading the local model gradient to an aggregation server for secure aggregation, and generating global gradient update parameters; dynamically selecting a desensitization strategy based on the business scene weight and the data sensitivity, and executing field-level desensitization processing on the financial data; an adversarial sample is injected in local model training, and a task loss function and an adversarial loss function are jointly optimized; and mapping compliance terms into technical rules, and completing privacy protection and compliance alignment. According to the method, data privacy protection is enhanced, the data leakage risk is effectively reduced, and financial data privacy security is ensured. Safe transmission and effective aggregation of data are ensured, and the global model training efficiency and safety are improved. An adversarial sample is injected, and high accuracy and stability are kept.

Description

Technical Field

[0001] The present invention relates to the technical field of financial data security and privacy protection, and specifically to a financial privacy security alignment method and system based on federated learning and adversarial training. Background Art

[0002] In the field of financial data security and privacy protection, with the rapid development of big data and artificial intelligence technologies, financial institutions face significant challenges in data security and privacy protection while providing personalized services and products. Traditional data processing methods often require centralized collection and storage of user data, which not only increases the risk of data leakage and misuse but also, in many cases, fails to meet compliance requirements due to privacy protection restrictions. Therefore, how to safely and efficiently utilize financial data while protecting user privacy has become a pressing technical challenge in this field.

[0003] Federated learning, an emerging distributed machine learning technology, offers a new approach to addressing these issues. It allows multiple participants to jointly train a shared model without directly sharing the original data. By training the model locally and sharing only updated model parameters, federated learning effectively protects data privacy while leveraging the combined value of data from multiple parties. However, federated learning also faces numerous challenges in practical applications, including model generalization, data heterogeneity, and potential security threats such as model poisoning attacks.

[0004] The patent with publication number CN117853212B discloses a vertical federated financial risk control solution and device that combines knowledge transfer and self-supervised learning. The solution first implements pre-training for the local data sets of financial institutions and Internet e-commerce respectively. For labeled financial institution data, supervised learning is used to construct a local pre-training model including the representation layer and the reasoning layer; while for unlabeled Internet e-commerce data, self-supervised learning is used to obtain only the local pre-training model of the representation layer. Subsequently, based on the overlapping data sets, a vertical federated risk control model is constructed, and the local pre-training model obtained in the pre-training stage is used to assist the training process of the vertical federated model, thereby optimizing its performance. With the help of the vertical federated learning mechanism, the dimension of user features is successfully expanded while ensuring data security and privacy; at the same time, through the combination of knowledge transfer and self-supervised learning, non-overlapping data is effectively utilized, which significantly improves the prediction accuracy of the vertical federated financial risk control model.

[0005] Adversarial training is a technique for enhancing the robustness of machine learning models by introducing adversarial examples during training, making the models more resilient to adversarial attacks. In the context of financial privacy and security, adversarial training can be used to improve the security of federated learning models, preventing malicious actors from manipulating local data or model updates to undermine model performance. Combining federated learning with adversarial training not only improves the model's privacy protection capabilities but also enhances its robustness against complex attacks, providing a new technical solution for the security and privacy protection of financial data. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a financial privacy security alignment method and system based on federated learning and adversarial training, aiming to effectively enhance the privacy protection of financial data by combining federated learning and adversarial training technology.

[0007] The object of the present invention is achieved through the following technical solutions:

[0008] A financial privacy and security alignment method based on federated learning and adversarial training, including the following:

[0009] S1: Multiple financial institution clients obtain local financial data and perform semantic analysis and sensitivity classification on the data fields;

[0010] S2: Build a federated learning framework. Each client uses Paillier homomorphic encryption to encrypt the local model gradient, uploads it to the aggregation server for secure aggregation, and generates global gradient update parameters.

[0011] S3: Dynamically selects a desensitization strategy based on business scenario weights and data sensitivity levels, and performs field-level desensitization on financial data participating in federated training.

[0012] S4: Inject adversarial examples into local model training and jointly optimize the task loss function and the adversarial loss function to improve model robustness;

[0013] S5: Map compliance clauses to technical rules and use a modular compliance engine to verify data operations in real time, dynamically aligning privacy protection with compliance requirements.

[0014] S6: Use blockchain to store data operation logs across institutions and generate auditable privacy and security alignment reports.

[0015] As a preferred embodiment, S2 includes:

[0016] S21: Each client uses the pre-trained model to initialize the local model parameters, performs forward calculation based on the local desensitized data, and obtains the gradient matrix Gi;

[0017] S22: Use Paillier algorithm to encrypt the gradient matrix;

[0018] S23: The aggregation server calculates the encrypted gradient product and obtains the global gradient after decryption;

[0019] S24: Update the model parameters of each client according to the global gradient, perform differential privacy processing simultaneously, and add Gaussian noise to the gradient.

[0020] As a preferred method, the dynamic selection desensitization strategy in S3 includes:

[0021] S31: Use the FinBERT model to parse the data field semantics and output field type labels;

[0022] S32: Match sensitivity levels based on field type: P1-level fields use partial masking, P2-level fields add Laplace noise, and P3-level fields perform generalization processing;

[0023] S33: Adjust the desensitization intensity based on the weight of the business scenario. Weak desensitization is used to preserve feature distribution in risk control scenarios, and strong desensitization is used in marketing scenarios to enhance privacy protection.

[0024] As a preferred embodiment, S4 includes:

[0025] S41: Generate adversarial samples using the FGSM algorithm;

[0026] S42: Construct joint loss function;

[0027] S43: Alternately inputting original samples and adversarial samples in local training to optimize model parameters. As a preferred method, the compliance rule mapping in S5 includes:

[0028] S51: TLS 1.3 transport protocol and AES-256 storage encryption configuration;

[0029] S52: Set up geo-fences to limit cross-border data transmission paths;

[0030] S53: Dynamically load the regional compliance module and switch the encryption algorithm and audit policy through the configuration file.

[0031] As a preferred embodiment, it also includes:

[0032] S54: Perform compliance pre-verification before federation aggregation to reject data containing blacklisted fields from participating in training;

[0033] S55: Monitor model output in real time. When the risk of privacy leakage exceeds the threshold, gradient clipping and re-encryption are triggered.

[0034] As a preferred method, blockchain evidence storage in S6 includes:

[0035] S61: Build a consortium chain network, set up financial institutions, regulatory nodes, and audit nodes;

[0036] S62: Encode data operation records into a Merkle tree structure and generate blocks every 15 minutes; S63: The smart contract automatically verifies the integrity of the evidence and rejects records with timestamp conflicts or abnormal hash values.

[0037] As a preferred method, it includes:

[0038] Data pre-processing module, used to analyze the semantics and sensitivity classification of local data of financial institution clients;

[0039] The joint training module uses Paillier homomorphic encryption to achieve secure gradient aggregation and perform differential privacy processing;

[0040] Dynamic desensitization module dynamically selects masking, generalization, or noise addition strategies based on business scenario weights and sensitivity levels;

[0041] Adversarial enhancement module, which generates adversarial samples and optimizes the joint loss function to improve model robustness;

[0042] Compliance alignment engine, which maps clauses into executable technical rules and verifies data operations in real time;

[0043] The audit evidence module records operation logs based on the blockchain and generates verifiable privacy and security reports.

[0044] As a preferred embodiment, the joint training module includes:

[0045] The encryption submodule implements the gradient encryption and decryption functions of the Paillier algorithm;

[0046] The aggregation submodule uses the gRPC protocol to transmit encrypted gradients and perform homomorphic summation operations;

[0047] The update submodule updates the model parameters of each node according to the global gradient and injects Gaussian noise. As a preferred embodiment, the dynamic desensitization module includes:

[0048] Semantic parsing unit, using FinBERT model to identify field types;

[0049] The policy decision unit selects the desensitization intensity according to the preset rule tree;

[0050] Execution unit, which implements field-level masking, data generalization, and noise addition operations.

[0051] The present invention has at least the following beneficial effects: This financial privacy security alignment method strengthens data privacy protection by combining federated learning with adversarial training. By performing semantic analysis and sensitivity grading on financial data fields, and dynamically selecting desensitization strategies for field-level desensitization processing, the risk of data leakage is effectively reduced, and the privacy security of financial data participating in federated learning is ensured. A federated learning framework is constructed, and Paillier homomorphic encryption technology is used to encrypt local model gradients, which are uploaded to the aggregation server for secure aggregation. This not only ensures the secure transmission of data, but also achieves effective aggregation of model gradients, thereby improving the training efficiency and security of the global model. Injecting adversarial samples into local model training and jointly optimizing the task loss function and the adversarial loss function effectively improves the model's anti-attack capability, allowing it to maintain high accuracy and stability in the face of malicious attacks. DETAILED DESCRIPTION

[0052] In this disclosure, terms are used to illustrate specific embodiments and do not constitute limitations of this disclosure. In this context, the use of the singular also encompasses the plural, unless the text clearly indicates otherwise. In the process of explanation, it should be understood that terms such as "including" or "having" are intended to indicate the presence of a feature, quantity, step, operation, structural component, part, or combination thereof, and do not preclude the possibility or addition of one or more other features, quantities, steps, operations, structural components, parts, or combinations thereof.

[0053] It should be understood that while the following description provides extensive specific details intended to facilitate a comprehensive understanding of the example embodiments, those skilled in the art will appreciate that the example embodiments can be implemented without these specific details. For example, systems may be presented in block diagram form to avoid excessive detail that would obscure the clarity of the examples. In other cases, unnecessary details regarding well-known processes, structures, and techniques may be omitted to maintain clarity of the examples.

[0054] A financial privacy security alignment method based on federated learning and adversarial training, or a financial data processing method based on federated learning and adversarial training, comprising the following:

[0055] S1: Multiple financial institution clients obtain local financial data and perform semantic analysis and sensitivity classification on the data fields;

[0056] S2: Build a federated learning framework. Each client uses Paillier homomorphic encryption to encrypt the local model gradient, uploads it to the aggregation server for secure aggregation, and generates global gradient update parameters.

[0057] S3: Dynamically selects a desensitization strategy based on business scenario weights and data sensitivity levels, and performs field-level desensitization on financial data participating in federated training.

[0058] S4: Inject adversarial examples into local model training and jointly optimize the task loss function and the adversarial loss function to improve model robustness;

[0059] S5: Map compliance policy clauses to technical rules and use a modular compliance engine to verify data operations in real time, dynamically aligning privacy protection with compliance requirements.

[0060] S6: Use blockchain to store data operation logs across institutions and generate auditable privacy and security alignment reports.

[0061] This method achieves a high degree of alignment between financial data privacy protection and compliance requirements through the collaboration of multiple layers of technology. First, each institution analyzes data features locally and divides them into sensitivity levels. Advanced encryption technology is used to ensure the security of gradient transmission when building a federated learning framework. Second, the intensity of data desensitization is dynamically adjusted according to business needs to maximize data value while protecting privacy. By introducing simulated attack samples during training, the model's ability to resist malicious attacks is enhanced. At the same time, complex legal, policy, or regulatory clauses are converted into executable technical rules to monitor data processing procedures in real time for compliance. Finally, all operation records are encrypted and stored on the blockchain to form an unalterable audit chain. The entire solution enables financial institutions to jointly train efficient risk control models while ensuring that user privacy is not leaked, strictly meeting regulatory requirements in different regions.

[0062] A financial privacy and security alignment method based on federated learning and adversarial training effectively protects and leverages financial data privacy through data processing and model training strategies. Specifically, semantic parsing, sensitivity grading, and dynamic desensitization strategies ensure data privacy during federated learning. Simultaneously, the robustness of the model is enhanced by injecting adversarial examples and jointly optimizing the loss function. Furthermore, by mapping compliance policy clauses into technical rules and storing data operation logs on the blockchain, the dynamic alignment of privacy protection and compliance requirements is further strengthened, providing strong support for data security and compliance utilization in the financial industry.

[0063] This invention dynamically aligns privacy protection with compliance requirements. By mapping compliance clauses into technical rules and using a modular compliance engine to verify data operations in real time, this ensures that data operations comply with both privacy protection requirements and relevant regulations and industry standards. This approach also achieves dynamic alignment between privacy protection and compliance requirements. The use of blockchain technology for cross-institutional storage of data operation logs generates auditable privacy and security alignment reports, enhancing the transparency and traceability of data operations and providing strong technical support for data privacy and security.

[0064] In a preferred embodiment, S2 includes:

[0065] S21: Each client uses the pre-trained model to initialize the local model parameters, and performs forward calculation based on the local desensitized data to obtain the gradient matrix G i ;

[0066] S22: Use Paillier algorithm to encrypt the gradient matrix;

[0067] S23: The aggregation server calculates the encrypted gradient product and obtains the global gradient after decryption;

[0068] S24: Update the model parameters of each client according to the global gradient, perform differential privacy processing simultaneously, and add Gaussian noise to the gradient.

[0069] The input of local gradient calculation includes the initial parameters of the pre-trained model (such as BERT Financial Edition) and local desensitized data (such as masked user transaction records). Each client calculates the model parameter update direction (gradient) based on local data. The gradient matrix G in the formula is i Indicates the amplitude and direction of parameter adjustment, and its mathematical form is: (Partial derivative of loss function L with respect to model parameter θ) The partial derivative here is calculated by back propagation algorithm, which reflects the influence of data features on model decision. Output unencrypted gradient matrix G i (a numerical matrix where each element corresponds to the adjustment amount of the parameter).

[0070] Paillier encrypted gradient, input includes gradient matrix G i , use the Paillier homomorphic encryption algorithm to protect the gradient. Key generation: Generate a public key (n, g) and a private key λ, where n = p·q (p, q are large prime numbers). For each gradient value g i To encrypt: (r is a random number to ensure unpredictability). 2 Expand the range of encrypted values from [0,n) to [0,n 2 ), providing enough space to embed randomness and avoid repeated encryption results. This formula converts the gradient value into ciphertext through exponential operation and random mask, ensuring that even if the data is intercepted, the original value cannot be cracked. Output encrypted gradient matrix Enc(G i )(ciphertext matrix).

[0071] Secure gradient aggregation: Encrypted gradients Enc(G1), Enc(G2), ..., Enc(G k ); the aggregation server uses Paillier's additive homomorphism to perform mathematical operations directly on the ciphertext: When decrypting, use the private key λ to extract the aggregated result:

[0072]

[0073] Where L is the decryption function. The final G = ΣG i It is the sum of the gradients of all clients, used to guide the optimization direction of the global model and output the global aggregate gradient G (plaintext numerical matrix).

[0074] S24: Differential privacy protection and parameter update, input global gradient G, noise parameter σ. To prevent the original data from being inferred from the gradient, Gaussian noise is added to the aggregated gradient: (Noise variance σ 2 The addition of noise causes random deviations in the gradient value, ensuring that attackers cannot restore sensitive information through statistical methods. When updating model parameters: (η is the learning rate), the mean-zero property of the noise ensures that the convergence direction of the model is not affected by the system. The updated model parameters θ new .

[0075] The above process builds a secure federated learning mechanism through four steps: First, each institution initializes parameters using a pre-trained baseline model and calculates the model update direction (gradient matrix) based on locally desensitized data. Next, a special encryption algorithm mathematically transforms the gradients, rendering the data like a see-through safe, enabling mathematical operations without exposing the original content. The aggregation server securely merges the encrypted gradients from each institution into an overall optimization direction using specific decryption rules. Finally, carefully designed random noise is injected during the model update, acting like a mask over the data, ensuring that individual information cannot be inferred from the model. This entire process achieves secure collaboration in which data is "available but invisible," protecting privacy while ensuring model accuracy.

[0076] In a preferred embodiment, the dynamic selection of the desensitization strategy in S3 includes:

[0077] S31: Use the FinBERT model to parse the data field semantics and output field type labels;

[0078] S32: Match sensitivity levels based on field type: P1-level fields use partial masking, P2-level fields add Laplace noise, and P3-level fields perform generalization processing;

[0079] S33: Adjust the desensitization intensity based on the weight of the business scenario. Weak desensitization is used to preserve feature distribution in risk control scenarios, and strong desensitization is used in marketing scenarios to enhance privacy protection.

[0080] In the dynamic desensitization strategy, the system achieves a balance between data privacy and business needs through three steps of intelligent decision-making. Semantic recognition: Utilizing a specialized model for the financial sector (FinBERT), the system automatically parses the meaning of data fields, distinguishing between types such as "ID number" and "transaction amount," essentially attaching an "identity tag" to each piece of data. Tiered processing: Three levels of protection are implemented based on sensitivity: P1 core data (e.g., ID number): Partial masking (e.g., "110101*******1234"), retaining essential fragments. P2 important data (e.g., transaction amount): Adding random noise to blur the precise value (e.g., "10,000 yuan" becomes "9,980 yuan"). P3 general data (e.g., address): Generalization to a wider range (e.g., "No. 5, XX Road, Chaoyang District" becomes "Beijing City"). Scenario adaptation: Flexible adjustment of the intensity based on business objectives. For example, desensitization can be weakened in risk control analysis to preserve data patterns and ensure the model accurately identifies fraud; desensitization can be strengthened in customer marketing to prevent the leakage of user profile information. This dynamic strategy protects privacy while maximizing the value of data under a secure premise. In a preferred embodiment, S4 includes:

[0081] S41: Generate adversarial samples using the FGSM algorithm. Mathematical expression: x is the original input sample (such as the user transaction feature vector), ∈ is the perturbation step size (taken as 0.05 to control the attack intensity), is the gradient of the loss function with respect to the input x (reflecting the model's sensitivity to input changes). By calculating the gradient direction of the input data (the perturbation direction to which the model is most sensitive), we add small perturbations along this direction to generate adversarial samples. S42: Constructing a joint loss function: L task is the task loss (such as cross entropy loss, accounting for 70%), L adv L is the adversarial loss (such as KL divergence, accounting for 30%), α is the main task loss weight, β is the adversarial loss weight, α = 0.7, β = 0.3, balancing the main task performance and robustness. total is the total loss function, y is the true label, is the model’s predicted value for the original sample, x adv For adversarial samples, is the model's prediction value for the adversarial sample.

[0082] S43: Alternately input original samples and adversarial samples in local training to optimize model parameters. In each training batch, original samples and adversarial samples are mixed in a 1:1 ratio, and the total loss function is jointly optimized through backpropagation. θ old is the current model parameter, η is the learning rate, is the gradient of the total loss function with respect to the parameter θ, neware the updated model parameters.

[0083] In the stage of model robustness enhancement, anti-attack capabilities are built through three steps. Adversarial sample generation: Based on the original data (such as transaction records), small disturbances are superimposed along the most sensitive direction of the model (such as adjusting the decimal point of the amount) to generate a "disguised sample" to confuse the model. For example, the normal transaction amount of 5,000 yuan is fine-tuned to 4,987 yuan to simulate abnormal fluctuations. Dual-objective optimization: The model learns normal tasks (such as identifying transaction risks) and adversarial defense tasks at the same time. A weight ratio of 7:3 is set to prioritize business accuracy while improving the recognition of malicious inputs. Alternating training mechanism: Each round of training alternates between original data and adversarial samples, forcing the model to take into account both accuracy and robustness. This training method enables the model to capture real risk patterns and resist forged data attacks in anti-fraud scenarios, achieving a dual improvement in security and utility. In a preferred embodiment, the compliance rule mapping in S5 includes:

[0084] S51: Parses the data encryption requirements of Article 32 of the GDPR and converts them to TLS 1.3 transport protocol and AES-256 storage encryption configuration;

[0085] S52: Setting up geo-fences in accordance with Article 21 of the Data Security Law to restrict cross-border data transmission paths;

[0086] S53: Dynamically load the regional compliance module and switch the encryption algorithm and audit policy through the configuration file.

[0087] In a preferred embodiment, it also includes:

[0088] S54: Perform compliance pre-verification before federation aggregation, and reject data containing blacklisted fields (such as race and religion) from participating in training;

[0089] S55: Monitor model output in real time. When the risk of privacy leakage exceeds the threshold, gradient clipping and re-encryption are triggered.

[0090] In the compliance rule mapping, the system achieves the precise implementation of legal clauses to technical measures through three steps. Encryption compliance conversion: converting the "encrypted data transmission" required by GDPR into specific technical configurations, such as using the TLS1.3 protocol to encrypt communication channels and using the AES-256 algorithm to encrypt stored data, which is like wearing a bulletproof vest for the data. Data sovereignty control: delineating the geographical boundaries of data in accordance with the "Data Security Law", for example, Chinese user data is only stored on domestic servers, and cross-border transmissions automatically trigger interception, like setting up an electronic border to guard data flow. Dynamic compliance adaptation: supporting multi-regional regulations through modular design, such as loading the GDPR module in the EU (mandatory masking of the first 6 digits of the ID number), and switching to local privacy law rules in Southeast Asia to achieve "one place, one policy" automatic adaptation.

[0091] We have also enhanced the double protection and pre-inspection interception: automatically scan the data before training, and if sensitive fields such as race and religion are found, directly refuse to participate in federal training, eliminating the risk of violations from the source. Real-time protection: monitor the prediction results when the model is running. If it is detected that the user privacy may be leaked (such as the probability that the output contains a personal address exceeds the threshold), immediately initiate an emergency response: clip abnormal gradients and re-encrypt the transmission, dynamically blocking the leakage channel like a firewall. This design changes compliance from passive compliance to active defense, taking into account both legal compliance and technical feasibility. In a preferred embodiment, the semantic parsing in S1 adopts multi-stage processing: S11: the first layer BiLSTM network identifies field named entities;

[0092] S12: The second layer of attention mechanism parses the field context semantics;

[0093] S13: The third layer classifier outputs P1-P4 sensitivity labels.

[0094] In data semantic analysis, the system accurately identifies sensitive information through multi-stage processing. Entity recognition: The first-layer network (BiLSTM) scans data fields and identifies key entities such as "ID number" and "bank account number," similar to a scanner capturing keywords in a document. Semantic understanding: The second-layer attention mechanism analyzes contextual relationships. For example, it determines that "ID" represents an identity identifier in "user ID" but is only a serial number in "transaction ID," thus avoiding misjudgment of sensitivity. Sensitivity classification: The third-layer classifier labels the data as P1-P4 based on the results of the first two steps. For example, "ID number" is marked as the highest sensitivity level P1, and the address is marked as P3.

[0095] In a preferred embodiment, a semantic parsing error correction mechanism is also included:

[0096] S14: Construct a dictionary of obfuscated fields. When "ID" and "ID card" are detected as synonyms, they are uniformly labeled as P1 sensitivity.

[0097] S15: Use adversarial training to enhance the robustness of the parsing model and add character-level perturbations to the input field.

[0098] Synonym normalization: The built-in financial terminology library automatically standardizes terms, such as "ID card," "ID," and "identity certificate" as P1, preventing missed detections due to discrepancies in terminology. Anti-interference training: By injecting slight perturbations into input data (e.g., "ID card" mistakenly written as "ID card"), the model is forced to learn error correction capabilities, ensuring accurate interpretation of sensitivity levels even with typos or abbreviations in data entry. This mechanism acts like "error-proof glasses" for the system, improving both interpretation accuracy and resilience to real-world data noise.

[0099] In a preferred embodiment, the blockchain evidence storage in S6 includes:

[0100] S61: Build a Hyperledger Fabric consortium chain network and set up financial institutions, regulatory nodes, and audit nodes;

[0101] S62: Encode data operation records into a Merkle tree structure and generate blocks every 15 minutes; S63: The smart contract automatically verifies the integrity of the evidence and rejects records with timestamp conflicts or abnormal hash values.

[0102] In the blockchain evidence storage process, the system builds a trusted data tracking system through three steps. Multi-party network construction: A dedicated blockchain (such as Hyperledger Fabric) is built with the participation of financial institutions, regulators, and auditors. Each node performs its own role: Financial institutions upload data, regulators set rules, and auditors verify records, forming a transparent network with checks and balances. Data fingerprinting: Every 15-minute operation record (such as data access and model updates) is packaged into "data blocks." Using Merkle tree technology, a unique fingerprint (similar to a file verification code) is generated. Any tampering will cause the fingerprint to be abnormal, like an unforgeable electronic seal on each operation. Intelligent rule-based control: An automated verification program is deployed to scan new data blocks in real time. If a chronological disorder (such as a later event being recorded earlier) or a fingerprint mismatch (such as a log entry being tampered with) is detected, the data is immediately rejected from the blockchain and an alarm is triggered, similar to the automatic interception of suspicious packages by customs security scanners. This mechanism ensures that all operations are traceable and non-repudiable, providing solid evidence for financial compliance audits.

[0103] In a preferred embodiment, a cross-chain audit mechanism is also included: S64: When cross-border data transmission is involved, data is synchronized to the target region's compliance blockchain via a cross-chain protocol; S65: Zero-knowledge proof is used to verify data operation compliance and hide sensitive transaction details. In cross-border data compliance processing, cross-chain trusted synchronization and a privacy verification black box enable security audits. Cross-chain trusted synchronization: When data needs to be transmitted abroad (e.g., from the EU to Singapore), operation records are automatically synchronized to the target region's compliance blockchain via a dedicated protocol, similar to the use of special channels for international express delivery, ensuring that the package complies with customs regulations in both the departure and destination countries and can be tracked throughout the entire process. Privacy verification black box: Using zero-knowledge proof technology, regulators can verify data operation compliance (e.g., "data has been desensitized") without having to review the specific content (e.g., hiding transaction amounts and user identities). This is similar to a customs X-ray machine that only checks the legality of the cargo category without opening the package to view product details. This mechanism meets cross-border audit requirements while completely eliminating the risk of sensitive information leakage. A financial privacy security alignment system based on federated learning and adversarial training, or a financial data processing system based on federated learning and adversarial training, comprises:

[0104] Data pre-processing module, used to analyze the semantics and sensitivity classification of local data of financial institution clients;

[0105] The joint training module uses Paillier homomorphic encryption to achieve secure gradient aggregation and perform differential privacy processing;

[0106] Dynamic desensitization module dynamically selects masking, generalization, or noise addition strategies based on business scenario weights and sensitivity levels;

[0107] Adversarial enhancement module, which generates adversarial samples and optimizes the joint loss function to improve model robustness;

[0108] Compliance alignment engine, which maps legal / compliance clauses into executable technical rules and verifies data operations in real time;

[0109] The audit evidence module records operation logs based on the blockchain and generates verifiable privacy and security reports.

[0110] This system achieves a precise balance between data value mining and privacy compliance through the collaborative efforts of multiple modules. Data preprocessing utilizes semantic parsing technology to automatically identify field meanings (e.g., distinguishing between "ID number" and "transaction amount") and label sensitivity levels, establishing classification standards for subsequent processing, much like attaching a "security warning label" to the data. The joint training module utilizes encrypted transmission and noise injection (e.g., the Paillier algorithm hides gradient details) to achieve "data availability without visibility" during cross-institutional model collaboration, ensuring that all participants share knowledge while isolating privacy risks. The dynamic desensitization module intelligently adjusts protection intensity based on business needs, retaining key features in risk control scenarios and enhancing obfuscation in marketing scenarios, like an adjustable valve controlling the balance between data accuracy and privacy. The adversarial enhancement module generates disguised samples (e.g., fine-tuning transaction amounts) and optimizes the model's anti-interference capabilities, enabling the system to both identify real risks and defend against malicious data fabrication attacks. The compliance engine translates legal provisions (e.g., GDPR data minimization principles) into technical actions (e.g., field-level masking) in real time, building a "translation bridge" between law and code. Blockchain evidence records data operations throughout the entire process, and any modification triggers on-chain verification, providing an unalterable chain of evidence for audits.

[0111] The federated learning framework of this invention permeates the entire data collaboration process, with Paillier encryption and differential privacy as its privacy foundation. Adversarial training techniques are used to both generate attack samples to test the system and to inversely strengthen the model's own defense capabilities. The compliance rules engine dynamically maps static legal provisions into executable code, forming a closed-loop regulatory framework. This dual-driven "technology-compliance" architecture enables the system to achieve both efficient utilization of financial data and the rigid legal constraints of privacy protection, forming a new type of infrastructure that combines intelligence and security.

[0112] In a preferred embodiment, the joint training module includes:

[0113] The encryption submodule implements the gradient encryption and decryption functions of the Paillier algorithm;

[0114] The aggregation submodule uses the gRPC protocol to transmit encrypted gradients and perform homomorphic summation operations;

[0115] The update submodule updates the model parameters of each node according to the global gradient and injects Gaussian noise.

[0116] The joint training module of this embodiment builds a secure collaborative closed loop through three links. Encryption protection: The client uses the Paillier algorithm to encrypt the model update parameters (gradients) into a "password box". Even if it is intercepted during transmission, the content cannot be cracked, ensuring zero exposure of the original data; Secure aggregation: The server collects the encrypted gradients of each end through the gRPC high-speed channel, and completes the summation operation directly in the ciphertext state, just like completing the splicing of fragments in a closed safe to obtain the global model update direction; Noise update: The aggregated global gradient is injected with random Gaussian noise, which not only ensures the normal convergence of the model, but also prevents the inference of individual data through reverse engineering. The whole mechanism is like a relay race, encryption locks the starting security, aggregation ensures collaboration in the middle, and noise strengthens the end point protection, achieving dual standards of privacy and model effect.

[0117] In a preferred embodiment, the dynamic desensitization module includes:

[0118] Semantic parsing unit, using FinBERT model to identify field types;

[0119] The policy decision unit selects the desensitization intensity according to the preset rule tree;

[0120] Execution unit, which implements field-level masking, data generalization, and noise addition operations.

[0121] The dynamic desensitization module of this embodiment implements intelligent privacy protection through three steps. Semantic recognition: Utilizes a financial-specific model (FinBERT) to automatically parse the meaning of fields, for example, accurately distinguishing between types such as "ID number" and "transaction amount", just like labeling data with classification labels; Strategy matching: Automatically selects processing intensity based on field type and business scenario, partially masks ID numbers (such as "110101******1234"), adds random noise to transaction amounts (such as "5000 yuan" becomes "5032 yuan"), and generalizes addresses to regional ranges (such as "XX Road, Chaoyang District" becomes "Beijing City"), forming a hierarchical protection network. Precise execution: Perform "surgical" modifications to data according to strategy, stripping off sensitive details (such as hiding the last 6 digits of the ID card) while retaining the features required for the business (such as the fluctuation trend of the transaction amount). This modular processing is like an intelligent filter, dynamically adjusting data transparency to maximize data value under the premise of compliance.

[0122] In a preferred embodiment, the compliance alignment engine includes: a rule mapping unit, which converts legal provisions like the GDPR into encryption algorithm configurations; a geofencing unit, which limits data transmission ranges based on IP addresses and GPS data; and a real-time monitoring unit, which detects privacy leakage risk indicators in model outputs. The compliance alignment engine bridges the gap between law and technology through three modules. The rule translator converts abstract provisions like the GDPR (such as the "data minimization principle") into specific technical actions, such as automatically configuring the AES-256 encryption algorithm, essentially compiling the provisions into machine-executable cryptographic instructions. The geofencing unit uses GPS and IP addresses to define data flow boundaries, such as limiting EU user data to only domestic servers. If data is detected being transmitted overseas, it triggers an immediate interception, like a digital cordon. The real-time monitoring unit scans model outputs (such as prediction results and gradient parameters) in real time. If a potential user privacy leak is detected (for example, the probability of the output containing the full ID number exceeds a threshold), it automatically initiates an emergency response, such as freezing the suspicious data stream and triggering secondary encryption. This design transforms compliance from paper provisions into a real-time safety net, achieving a precise alignment between legal requirements and technical implementation.

[0123] In a preferred embodiment, the audit evidence module includes: a blockchain network, which is a consortium chain composed of financial institution nodes and regulatory nodes; a smart contract unit, which automatically performs compliance verification and interception of abnormal operations; and a cross-chain gateway, which realizes data verification and synchronization between compliance chains in different regions.

[0124] The audit evidence module establishes a multi-party co-governance ledger. Financial institutions and regulators jointly build a blockchain network. Each data operation (such as model updates and data access) is recorded in real time and confirmed by multiple parties, forming an unalterable electronic evidence chain, just like a multi-party co-managed anti-counterfeiting ledger; deploy automatic verification procedures, such as intercepting the upload of unmasked data and blocking illegal cross-border transmissions. For example, automatic security gates are set up at key nodes of the data flow, and illegal operations immediately trigger alarms and freeze them. When data needs to flow across regions (such as between China and Europe), the cross-chain gateway automatically synchronizes the operation fingerprint and verifies compliance, just like an international logistics transit station, verifying the sealing of the cargo box without opening the box to inspect the contents, realizing global audit collaboration.

[0125] The present invention is based on a collaborative framework of federated learning and adversarial training. The data preprocessing module analyzes and classifies sensitive fields, driving the dynamic desensitization module to adapt privacy strength according to the scenario. The joint training module uses homomorphic encryption and differential privacy to achieve gradient security aggregation, and the adversarial enhancement module generates perturbation samples to improve the model's anti-attack capabilities. The compliance alignment engine maps legal terms into technical rules in real time, combining geographic fencing to constrain data flow boundaries. The audit evidence module solidifies operation logs through the blockchain network and verifies them across chains, forming a full-link closed loop of data classification, encryption training, compliance control, and audit traceability. Each module uses federated learning as its foundation, the adversarial mechanism as its defense network, and the compliance engine as its control center, achieving efficient and compliant utilization of multi-institutional data value while ensuring privacy and security.

[0126] Although the preferred embodiments of the present invention have been described in detail, those skilled in the art may still make further adjustments and improvements to these embodiments after understanding their basic innovative concepts. Therefore, the appended claims are intended to cover these preferred embodiments and all changes and modifications that fall within the scope of the present invention. The above content is only an elaboration of the preferred embodiments of the present invention and is not intended to limit its scope. It should be emphasized that any modifications, equivalent substitutions or improvements made under the guidance of the spirit and principles of the present invention should be deemed to be included in the scope of protection of the present invention.

Claims

1. A financial privacy security alignment method based on federated learning and adversarial training, characterized by: Includes the following: S1: Multiple financial institution clients obtain local financial data and perform semantic analysis and sensitivity classification on the data fields; S2: Build a federated learning framework. Each client uses Paillier homomorphic encryption to encrypt the local model gradient, uploads it to the aggregation server for secure aggregation, and generates global gradient update parameters. S3: Dynamically selects a desensitization strategy based on business scenario weights and data sensitivity levels, and performs field-level desensitization on financial data participating in federated training. S4: Inject adversarial examples into local model training and jointly optimize the task loss function and the adversarial loss function to improve model robustness; S5: Map compliance clauses to technical rules and use a modular compliance engine to verify data operations in real time, dynamically aligning privacy protection with compliance requirements. S6: Use blockchain to store data operation logs across institutions and generate auditable privacy and security alignment reports.

2. A financial privacy security alignment method based on federated learning and adversarial training according to claim 1, characterized in that S2 include: S21: Each client uses the pre-trained model to initialize the local model parameters, performs forward calculation based on the local desensitized data, and obtains the gradient matrix Gi; S22: Use Paillier algorithm to encrypt the gradient matrix; S23: The aggregation server calculates the encrypted gradient product and obtains the global gradient after decryption; S24: Update the model parameters of each client according to the global gradient, perform differential privacy processing simultaneously, and add Gaussian noise to the gradient.

3. The financial privacy security alignment method based on federated learning and adversarial training according to claim 1 is characterized in that: Dynamically select desensitization strategies in S3 include: S31: Use the FinBERT model to parse the data field semantics and output field type labels; S32: Match sensitivity levels based on field type: P1-level fields use partial masking, P2-level fields add Laplace noise, and P3-level fields perform generalization processing; S33: Adjust the desensitization intensity based on the weight of the business scenario. Weak desensitization is used to preserve feature distribution in risk control scenarios, and strong desensitization is used in marketing scenarios to enhance privacy protection.

4. The financial privacy security alignment method based on federated learning and adversarial training according to claim 1 is characterized in that S4 include: S41: Generate adversarial samples using the FGSM algorithm; S42: Construct joint loss function; S43: Alternately input original samples and adversarial samples during local training to optimize model parameters.

5. The financial privacy security alignment method based on federated learning and adversarial training according to claim 1 is characterized in that: Compliance rule mapping in S5 includes: S51: TLS 1.3 transport protocol and AES-256 storage encryption configuration; S52: Set up geo-fences to limit cross-border data transmission paths; S53: Dynamically load the regional compliance module and switch the encryption algorithm and audit policy through the configuration file.

6. The financial privacy security alignment method based on federated learning and adversarial training according to claim 5 is characterized in that: Also includes: S54: Perform compliance pre-verification before federation aggregation to reject data containing blacklisted fields from participating in training; S55: Monitor model output in real time. When the risk of privacy leakage exceeds the threshold, gradient clipping and re-encryption are triggered.

7. A financial privacy security alignment method based on federated learning and adversarial training according to any one of claims 1 to 6, characterized in that: Blockchain evidence in S6 includes: S61: Build a consortium chain network, set up financial institutions, regulatory nodes, and audit nodes; S62: Encode data operation records into a Merkle tree structure and generate blocks every 15 minutes; S63: Smart contracts automatically verify the integrity of evidence and reject records with conflicting timestamps or abnormal hash values.

8. A financial privacy security alignment system based on federated learning and adversarial training, characterized by: include: Data pre-processing module, used to analyze the semantics and sensitivity classification of local data of financial institution clients; The joint training module uses Paillier homomorphic encryption to achieve secure gradient aggregation and perform differential privacy processing; Dynamic desensitization module dynamically selects masking, generalization, or noise addition strategies based on business scenario weights and sensitivity levels; Adversarial enhancement module, which generates adversarial samples and optimizes the joint loss function to improve model robustness; Compliance alignment engine, which maps clauses into executable technical rules and verifies data operations in real time; The audit evidence module records operation logs based on the blockchain and generates verifiable privacy and security reports.

9. A financial privacy security alignment system based on federated learning and adversarial training according to claim 8, characterized in that: The joint training module includes: The encryption submodule implements the gradient encryption and decryption functions of the Paillier algorithm; The aggregation submodule uses the gRPC protocol to transmit encrypted gradients and perform homomorphic summation operations; The update submodule updates the model parameters of each node according to the global gradient and injects Gaussian noise.

10. A financial privacy security alignment system based on federated learning and adversarial training according to claim 8 or 9, characterized in that: The dynamic desensitization module includes: Semantic parsing unit, using FinBERT model to identify field types; The policy decision unit selects the desensitization intensity according to the preset rule tree; Execution unit, which implements field-level masking, data generalization, and noise addition operations.

Images