Private data security sharing system based on generative model isolation

Abstract

The invention discloses a private data security sharing system based on generative model isolation. The private data security sharing system comprises a model local generation module, a model distribution scheduling module and a security monitoring management module, wherein the model local generation module is used for training local privacy data to obtain a simulation data generation model; the model distribution scheduling module is used for performing compliance review on the data request of the user and realizing secure transmission and distribution of the generator on a trusted channel; and the security monitoring management module is used for monitoring the data request and model transmission process of the whole data sharing system, protecting the compliance and security of the operation process of the whole system, and giving an alarm and responding to the found abnormal behavior in time. According to the method, limitation and hindrance in practical application caused by the risk that a traditional privacy protection technology is large in calculation overhead, high in hardware requirement and subjected to AI model-oriented attacks such as reverse engineering are relieved, and support is provided for joint calculation analysis of large-scale cross-domain joint data.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection and privacy computing technology, and in particular to a privacy data security sharing system based on generative model isolation. Background Art

[0002] With the rapid development of artificial intelligence (AI) technology, AI big models, such as DeepSeek, are gaining widespread application across various fields due to their powerful data analysis capabilities for massive amounts of data. AI big models can provide strong support for the joint analysis of massive amounts of heterogeneous data across multiple departments or social organizations, ensuring the privacy and security of data during their application, which is of great significance to social development and governance.

[0003] Over the past few years, the application of multi-party data federation based on large models has been a significant challenge. High-powered government departments, such as public security, require access to cross-domain data from other government departments for joint analysis. However, with the growing emphasis on privacy protection, data barriers are becoming increasingly severe, leading to a reluctance among all parties to share private data. Traditional privacy protection technologies also face practical challenges such as high computational complexity and high communication overhead. Therefore, innovation and improvement are urgently needed for privacy protection technologies for large AI models.

[0004] Traditional technologies for protecting privacy data during multi-party joint data analysis primarily rely on encryption-based privacy computing solutions for AI models. However, these solutions have limitations in terms of computational overhead and hardware requirements, making it difficult to efficiently analyze massive amounts of multi-domain data. Furthermore, these solutions pose the risk of AI model attacks, such as reverse engineering, which can be catastrophic.

[0005] 1) Difficulty in cost control: Traditional AI model privacy protection technologies are usually based on federated learning and cryptography to implement encrypted computing on AI models. They have high computational complexity and large communication overhead. In terms of hardware, they require the support of specialized hardware acceleration such as GPUs and ASICs. In terms of communication, frequent encrypted data interactions consume a large amount of network bandwidth, resulting in high overall computing and communication costs. In practical applications, they have significant limitations and are generally unable to support computing tasks on large models.

[0006] 2) Security risks: Traditional privacy protection solutions may be subject to attacks targeting AI models such as reverse engineering, and have certain security deficiencies. In recent years, attack methods against AI models such as member inference and model theft have increased. By analyzing the query results or intermediate parameters of the AI ​​model, the original data or model information can be reversely obtained, which seriously threatens the security of private data.

[0007] In general, the existing technologies for privacy data security protection in large AI model applications have certain limitations. Therefore, there is an urgent need for a privacy data security sharing system based on generative model isolation, which comprehensively considers security and usability to innovate the overall framework or technology. Summary of the Invention

[0008] In view of the above problems, the present invention is proposed to provide a private data security sharing system based on generative model isolation that overcomes the above problems or at least partially solves the above problems.

[0009] In order to solve the above technical problems, the embodiments of the present application disclose the following technical solutions:

[0010] A privacy data security sharing system based on generative model isolation includes: a model local generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein:

[0011] The local model generation module is used to train local private data to obtain a simulation data generation model;

[0012] Model distribution scheduling module, which is used to conduct compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels;

[0013] The security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors discovered.

[0014] Furthermore, the local model generation module is used to train the local private data to obtain a simulation data generation model. The specific method includes:

[0015] S101. Preprocessing various heterogeneous data in different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models;

[0016] S102. Design the model architecture. Based on the generative and model isolation concepts, construct an overall model architecture capable of generating simulated private data. Specifically, it includes a feature extraction sub-model and a data generation sub-model.

[0017] S103. Build and train the model to implement model instantiation and parameter learning, including the configuration of model structure and hyperparameters, and the selection of training strategies.

[0018] Furthermore, in S101, various heterogeneous data in different fields are preprocessed. The specific methods include:

[0019] S1011. Clean the data by going through each item in the original data and, based on the statistical values ​​and empirical knowledge of each item, filtering out and removing abnormal and erroneous data, aggregating duplicate and redundant data, and deleting missing value data.

[0020] S1012. Extract data features, perform feature extraction and encoding on different types of heterogeneous data such as text, images, and videos, and convert them into unified structured data;

[0021] S1013. Normalize the data, perform numerical processing on the encoded data, and scale it to the interval (0, 1) using the Min-Max normalization method;

[0022] S1014. Fusing the data, fusing the heterogeneous data in vector form of different modalities obtained in S103;

[0023] S1015. Enhance the data by oversampling and undersampling the vector data set obtained in S104 to obtain a data set with a balanced number of samples in various categories.

[0024] Furthermore, in S102, the model architecture is designed, and the specific method includes:

[0025] S1021. Design a feature extraction sub-model, using an autoencoder model structure to extract features of the input private data. The encoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding. The decoder reconstructs the reduced-dimensional data by increasing its dimensionality and extracts the output of the intermediate layer as the feature data of the private data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional and effective representation of the original data.

[0026] S1022. Design a data generation sub-model, using a conditional generative adversarial model structure to generate high-quality simulated data. The generator takes noise and conditional information as input to generate synthetic data; the discriminator takes synthetic data and real data as input to determine whether it is real or synthetic. The generator and discriminator are trained alternately to obtain highly simulated synthetic data.

[0027] S1023. Model interaction is designed. The feature extraction sub-model and the data generation sub-model work together to realize simulation data generation and isolate the gradient propagation process between sub-models to block the reverse engineering attack path. The feature data output by the feature extraction sub-model is used as the real data input sample of the data generation sub-model to guide the generation of highly simulated feature data. Overall, while protecting the original privacy data, it realizes simulation data sharing and tolerates reverse engineering attacks.

[0028] Furthermore, in S103, the model is constructed and trained, and the specific method includes:

[0029] S1031. Design the model structure parameters. Initial model structure parameters are set based on prior knowledge. Then, a grid search method is used to fine-tune the model structure hyperparameters. Grid search can ensure that a better solution is found. By setting appropriate grid gaps and initial solutions, it can also reduce search time and avoid falling into local optimal solutions.

[0030] S1032. Design a model training strategy, using a two-stage training strategy. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth (GT) guidance for adversarial training of the data generation sub-model. The model training hyperparameters are initialized based on prior knowledge. Then, the model is trained on a small amount of data, and a grid search method is used to obtain the final hyperparameters.

[0031] S1033. Train the model. Based on the parameter configuration obtained in S1031 and S1032, use programming to build the model and train it. Finally, extract the generator in the data generation sub-model as the model to be distributed.

[0032] Furthermore, the model allocation and scheduling module is used to conduct compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels. The specific methods include:

[0033] S201. Control permissions by configuring an initial permission table and assigning corresponding permission levels to each department or organization. When a department or organization requests data from the distribution and dispatch center, the request is determined based on its permission level. Only if the permission level of the data requester is higher than that of the data provider, the request is approved; otherwise, the request is rejected.

[0034] S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, use a rule-based abnormal behavior detection method, and reject the data request from the requester who may have malicious behavior;

[0035] S203. Perform encrypted transmission, use the SM4 encryption algorithm to encrypt the model parameters, and use the SSL / TLS protocol to perform encryption and identity authentication on the transmission link to protect the security of the model parameter transmission process.

[0036] Furthermore, the security monitoring management module is used to monitor the data request and model transmission process of the entire data sharing system. The specific methods include:

[0037] S301 monitors the system process, stores the basic information of the participant ID and authority level of the entire data sharing system in the database, monitors the data request and model transmission communication process, and stores it in the form of logs;

[0038] S302 analyzes abnormal behavior, regularly retrieves log information within a certain time window from the log library, combines the basic information stored in the database, and uses a rule-based method to detect and analyze abnormal communication behavior of each node in the entire system;

[0039] S303. Respond to abnormal behavior. Based on the detection results in S302, trace the source of the abnormal communication process, control access to possible risk nodes and malicious nodes, or add them to the blacklist, and then notify the administrator to implement further control measures.

[0040] Furthermore, in S1015, the SMOTE algorithm is used for oversampling, and then the Tomek Links algorithm is used for undersampling to obtain a data set with a balanced number of samples of various categories; the specific method includes: identifying minority class samples, determining the samples belonging to the minority class in the data set; selecting k nearest neighbors, for each minority class sample, randomly selecting its k nearest neighbors; generating synthetic samples, randomly selecting a point between each sample and its selected nearest neighbor to generate new minority class samples; adding to the data set, adding the generated synthetic samples to the original data set; identifying Tomek Links pairs, for each sample, finding its nearest neighbor; if the pair of samples belong to different categories, they constitute a Tomek Links pair; removing samples, removing the majority class samples in the Tomek Links pair.

[0041] The beneficial effects of the above technical solutions provided by the embodiments of the present invention include at least:

[0042] The present invention discloses a privacy data security sharing system based on generative model isolation, comprising: a model local generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein: the model local generation module is used to train local privacy data to obtain a simulation data generation model; the model allocation and scheduling module is used to perform compliance review on user data requests and realize the secure transmission and distribution of generators on trusted channels; the security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protect the compliance and security of the entire system operation process, and promptly issue warnings and respond to any abnormal behaviors discovered.

[0043] This invention uses a generative model isolation-based method to analyze private data, providing a secure and efficient solution for the joint analysis of proprietary data from multiple fields. This represents a completely new technical approach compared to traditional privacy protection technologies. The invention generates low-dimensional simulation data based on a generative model isolation method, solving the high computational cost of large amounts of encrypted data. Furthermore, the use of model distribution rather than data transmission significantly reduces communication bandwidth requirements, significantly reducing the operational costs of the AI ​​service platform. The invention's data sharing approach, based on generative and model isolation concepts, can block attack paths to a certain extent, improve resistance to reverse engineering attacks, and protect the security of local training data.

[0044] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0046] Figure 1 This is a structural diagram of a privacy data security sharing system based on generative model isolation in Example 1 of the present invention;

[0047] Figure 2 Schematic diagram of a private data secure sharing system based on generative model isolation in Example 1 of the present invention;

[0048] Figure 3 This is a schematic diagram of a simulated private data generation model based on an autoencoder and CGAN in Example 1 of the present invention;

[0049] Figure 4 Schematic diagram of a test platform for a privacy data sharing system based on generative model isolation in Example 1 of the present invention. DETAILED DESCRIPTION

[0050] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0051] In order to solve the problems existing in the prior art, an embodiment of the present invention provides a privacy data security sharing system based on generative model isolation.

[0052] Example 1

[0053] In response to the above-mentioned defects or improvement needs of the existing technology, this embodiment provides a privacy data security sharing system based on generative model isolation. The purpose of this invention is to break through the limitations of existing privacy protection technologies for AI model applications in terms of security and cost consumption, and provide a set of data sharing frameworks with complete cost control optimization and reverse engineering tolerance for multi-party joint privacy computing services based on large AI models, to ensure the security and efficiency of multi-party joint data analysis, and to perform fine-grained supervision of various data flows and control flows in the system for real-time management and regulation.

[0054] This embodiment discloses a privacy data security sharing system based on generative model isolation, such as Figure 1 , including: model local generation module, model allocation and scheduling module and security monitoring and management module; among which:

[0055] The model local generation module is used to train the local privacy data to obtain the simulation data generation model; in this embodiment, the model local generation module is used to train the local privacy data to obtain the simulation data generation model, such as Figure 2 Specific methods include:

[0056] S101. Preprocessing various heterogeneous data in different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models;

[0057] S102. Design the model architecture. Based on the generative and model isolation concepts, construct an overall model architecture capable of generating simulated private data. Specifically, it includes a feature extraction sub-model and a data generation sub-model.

[0058] S103. Build and train the model to implement model instantiation and parameter learning, including the configuration of model structure and hyperparameters, and the selection of training strategies.

[0059] In S101 of some preferred embodiments, various heterogeneous data in different fields are preprocessed, and the specific method includes:

[0060] S1011. Clean the data by going through each item in the original data and, based on the statistical value and empirical knowledge of each item, filtering out and eliminating abnormal and erroneous data, aggregating duplicate and redundant data, and deleting missing value data. Specifically, go through each item in the original data and calculate the mean μ and variance σ of each item. 2 , set the upper and lower boundary thresholds λ + ,λ - , remove outliers that fall outside the boundaries, delete duplicate and redundant data and keep only one, and delete data with missing values.

[0061] S1012. Extract data features. Perform feature extraction and encoding on different types of heterogeneous data, such as text, images, and videos, and convert them into unified structured data. Specifically, perform feature extraction and encoding on heterogeneous data and convert them into unified structured data. Transformer Encoder is used for encoding text and time series data, Convolutional Neural Network (CNN) is used for encoding image data, and a vertical serial stacking structure of CNN and LSTM is used for encoding video data.

[0062] S1013. Normalize the data, perform numerical processing on the encoded data, and scale it to the interval (0, 1) using the Min-Max normalization method;

[0063] S1014. Fusing the data, fusing the heterogeneous data in vector form of different modalities obtained in S103;

[0064] S1015. Enhance the data by oversampling and undersampling the vector-based dataset obtained in S104 to obtain a dataset with a balanced number of samples in various categories. Specifically, the SMOTE algorithm is used for oversampling, and then the TomekLinks algorithm is used for undersampling to obtain a dataset with a balanced number of samples in various categories. The specific method includes: identifying minority class samples, determining the samples belonging to the minority class in the dataset; selecting k nearest neighbors, for each minority class sample, randomly selecting its k nearest neighbors; generating synthetic samples, randomly selecting a point between each sample and its selected nearest neighbor to generate a new minority class sample; adding to the dataset, adding the generated synthetic samples to the original dataset; identifying Tomek Links pairs, for each sample, finding its nearest neighbor; if the pair of samples belongs to different categories, then they constitute a Tomek Links pair; removing samples, removing the majority class samples in the Tomek Links pair.

[0065] In S102 of some preferred embodiments, the model architecture is designed to construct an overall model architecture capable of generating simulated privacy data. Figure 3 This is a schematic diagram of the overall architecture, which includes a feature extraction sub-model and a data generation sub-model. The model architecture is designed using the following methods:

[0066] S1021. Design a feature extraction sub-model, using an autoencoder model structure to extract features of the input private data. The encoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding. The decoder reconstructs the reduced-dimensional data by increasing its dimensionality and extracts the output of the intermediate layer as the feature data of the private data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional and effective representation of the original data.

[0067] S1022. Design a data generation sub-model, using a conditional generative adversarial model structure to generate high-quality simulated data. The generator takes noise and conditional information as input to generate synthetic data; the discriminator takes synthetic data and real data as input to determine whether it is real or synthetic. The generator and discriminator are trained alternately to obtain highly simulated synthetic data.

[0068] S1023. Model interaction is designed. The feature extraction sub-model and the data generation sub-model work together to realize simulation data generation and isolate the gradient propagation process between sub-models to block the reverse engineering attack path. The feature data output by the feature extraction sub-model is used as the real data input sample of the data generation sub-model to guide the generation of highly simulated feature data. Overall, while protecting the original privacy data, it realizes simulation data sharing and tolerates reverse engineering attacks.

[0069] In S103 of some preferred embodiments, the model is constructed and trained, and the specific method includes:

[0070] S1031. Design the model structure parameters. Initial model structure parameters are set based on prior knowledge. Then, a grid search method is used to fine-tune the model structure hyperparameters. Grid search can ensure that a better solution is found. By setting appropriate grid gaps and initial solutions, it can also reduce search time and avoid falling into local optimal solutions.

[0071] Specifically, the obtained model structure parameters are as follows:

[0072] Table 1. Structural parameters of feature extraction sub-model

[0073]

[0074]

[0075] Table 2 Data generation sub-model generator structure parameters

[0076] Layer Name Layer Type Input Dimension Output dimension Kernel size step length filling Activation Function Input layer - 100+20 - - - - Splicing layer Concatenate 100+20 120 - - - ConvT1 ConvTranspose1d 120 241 3 2 1 ReLU BN1 BatchNorm1d 241 241 - - - - ConvT2 ConvTranspose1d 241 483 3 2 1 ReLU BN2 BatchNorm1d 483 483 - - - - ConvT3 ConvTranspose1d 483 967 3 2 1 ReLU BN3 BatchNorm1d 967 967 - - - - FC1 Linear 967 512 - - - ReLU BN4 BatchNorm1d 512 512 - FC2 Linear 512 256 - - - ReLU BN5 BatchNorm1d 256 256 - - - - FC3 Linear 256 128 - - - - Output layer - - 128 - - - -

[0077] Table 3. Data generation sub-model discriminator structure parameters

[0078] Layer Name Layer Type Input Dimension Output dimension Kernel size step length filling Activation Function Input layer - 128 - - - - Conv1 Conv1d 128 128 3 1 1 ReLU Pool1 MaxPooling1D 128 64 2 2 - - BN1 BatchNorm1d 64 64 - - - - Conv2 Conv1d 64 64 3 1 1 ReLU Pool2 MaxPooling1D 64 32 2 2 - BN2 BatchNorm1d 32 32 - - - - FC1 Linear 32 32 - - - ReLU BN3 BatchNorm1d 32 32 - FC2 Linear 32 1 - - - - Output layer - - 1 - - - -

[0079] S1032. Design a model training strategy, using a two-stage training strategy. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth (GT) guidance for adversarial training of the data generation sub-model. The model training hyperparameters are initialized based on prior knowledge. Then, the model is trained on a small amount of data, and a grid search method is used to obtain the final hyperparameters.

[0080] Among them, the hyperparameter configuration of autoencoder training is shown in Table 4.1-4.2, and the loss function uses mean square error:

[0081]

[0082] Table 4.1 Autoencoder training hyperparameters

[0083] Learning rate 0.005 Batch size 128 Number of training rounds 50 Optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Regularization L2

[0084] The training hyperparameter configuration of the conditional generative adversarial network is shown in Table 5, and the loss function is as follows:

[0085]

[0086] Table 4.2 CGAN training hyperparameters

[0087] Learning rate 0.001 Batch size 64 Number of training rounds 100 Generator Optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Discriminator Optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Regularization L2 Generator and discriminator training frequency ratio 5：1

[0088] S1033. Train the model. Based on the parameter configuration obtained in S1031 and S1032, use programming to build the model and train it. Finally, extract the generator in the data generation sub-model as the model to be distributed.

[0089] Model distribution scheduling module, which is used to conduct compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels;

[0090] In this embodiment, the model allocation and scheduling module is used to perform compliance review on user data requests and implement secure transmission and distribution of generators on trusted channels. The specific methods include:

[0091] S201. Control permissions. Configure an initial permission table and assign corresponding permission levels to each institution, department, or organization. When a department or organization requests data from the allocation and scheduling center, its permission level determines whether the request is permitted. Only if the requester's permission level is higher than the provider's permission level is the request approved; otherwise, the request is rejected. Table 5 shows a description of permission levels and the permission levels of each device. When each component in the system requests data from the model allocation and scheduling module, data access control is performed based on the permission level configuration table. For organizations with permission level I, only local data contributions are permitted; requests to obtain data from other participants are denied. For organizations with permission level II, local data contributions are permitted, but requests to obtain data from organizations with permission levels I and II are permitted. For organizations with permission level III, requests to obtain data from organizations with permission levels I and II are permitted, but requests to obtain data from organizations with permission level III are denied. All requests from unauthorized organizations or devices (permission level 0) are denied.

[0092] Table 5 Authority level description and configuration table

[0093]

[0094] S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, use a rule-based abnormal behavior detection method, and reject the data request from the requester who may have malicious behavior;

[0095] Specifically, record each data request and model distribution behavior, according to the ID of the data requester request , the ID of the requested data provider response , data request time t request , model provides time t response A record of each data request is generated and stored in a log library. The historical data request behavior of each participant is audited according to the audit cycle, using a rule-based approach to detect abnormal behavior. If the number of data requests within a certain time window exceeds a threshold of λ1, subsequent data requests are rejected and the event is reported to the security monitoring management module. If the number of requests for data exceeding the authorized limit within a certain time window exceeds a threshold of λ2, subsequent data requests are rejected and the event is reported to the security monitoring management module. If the data requester is an unauthorized device, its device ID is blacklisted.

[0096] S203. Perform encrypted transmission, use the SM4 encryption algorithm to encrypt the model parameters, and use the SSL / TLS protocol to perform encryption and identity authentication on the transmission link to protect the security of the model parameter transmission process.

[0097] The security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors discovered.

[0098] In this embodiment, the security monitoring management module is used to monitor the data request and model transmission process of the entire data sharing system. The specific method includes:

[0099] S301. Monitor system processes, storing basic information such as the IDs and permission levels of all data sharing system participants in a database. Monitor data requests and model transmissions and other communication processes, and store these information in log format. Specifically, store basic information such as the IDs and permission levels of all data sharing system participants in a database. Monitor data requests, model transmissions, and other communication processes, and store these information in log format. Store data packets from the communication between each data participant and the model allocation and scheduling module in the database as PCAP files.

[0100] S302. Analyze abnormal behavior. Regularly retrieve log information within a specific time window from the log library. Combined with basic information stored in the database, a rule-based approach is used to detect and analyze abnormalities in the communication behavior of each node in the entire system. Specifically, regularly retrieve data packets from the database for parsing, extracting information such as source IP, destination IP, source MAC, destination MAC, source port, destination port, and payload length. Combined with the log information within a specific time window retrieved from the log library and basic device information retrieved from the database, a complete session flow representation is constructed. Using the Snort rule library, abnormalities in the communication behavior of each node in the entire system are detected and analyzed.

[0101] S303. Respond to abnormal behavior. Based on the detection results in S302, trace the source of the abnormal communication process and perform access control on possible risky and malicious nodes, or add them to a blacklist, and then notify the administrator to implement further control measures. Based on the detection results, trace the source of the abnormal communication process and perform access control on possible risky and malicious nodes, limiting their request frequency and request time period to the model allocation scheduling module, or add them to a blacklist to filter their data requests. For serious network attacks or attacks on AI models, notify the administrator to implement further control measures.

[0102] In this example, an attack library and attack execution program are constructed based on network attack methods and attack methods targeting AI models. The specific attack methods and descriptions are shown in Table 6.

[0103] Table 6 Network attack and AI model attack configuration

[0104]

[0105] The system disclosed in this embodiment is used to simulate various entities and functions, such as Figure 4, mainly includes three domains, namely the bank domain, the hospital domain and the attack domain. The bank domain and the hospital domain build corresponding AI service simulation platforms according to their respective requirements for AI services. At the hardware device level, they both include a high-performance computing server for deploying large models and performing corresponding computing tasks. In addition, it is also equipped with a data server for storing local privacy data and simulation data generated in other fields. The attack domain is used to simulate malicious attackers. Its main function is to attack the data sharing process between the bank domain and the hospital domain and steal privacy data. At the hardware device level, it includes a data server and a host. The data server is used to store relevant knowledge of various attack methods for AI models, and the host is used to construct and execute corresponding attack scripts based on the knowledge of attack methods. Regarding the deployment of various modules of the privacy data security sharing system based on generative model isolation of the present invention, the model local generation module is distributedly deployed on the high-performance computing servers of banks and hospitals, and the model allocation and scheduling module and the security management and monitoring module are respectively deployed on a separate computing server. The local model generation module is responsible for processing local private data and obtaining local simulation data to generate models. The model allocation and scheduling module handles data requests from banks and hospitals and executes model transmission. The security management and monitoring module monitors and manages all processes in the entire system. These modules work together to ensure secure data sharing between the banking and hospital domains.

[0106] This embodiment discloses a privacy data security sharing system based on generative model isolation, including: a local model generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein: the local model generation module is used to train local privacy data to obtain a simulation data generation model; the model allocation and scheduling module is used to perform compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels; the security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protect the compliance and security of the entire system operation process, and promptly issue alerts and respond to any abnormal behavior discovered.

[0107] This embodiment uses a generative model isolation-based method to analyze private data, providing a secure and efficient solution for joint analysis of proprietary data from multiple fields. Compared with traditional privacy protection technologies, it develops a new technical route. The present invention generates low-dimensional simulation data based on the generative model isolation method, solving the high computational cost problem of large amounts of encrypted data. It also uses model distribution rather than data transmission, greatly reducing the communication bandwidth requirements and significantly reducing the operation and maintenance costs of the AI ​​service platform. The data sharing method based on the generative and model isolation ideas of the present invention can block attack paths to a certain extent, improve resistance to reverse engineering attacks, and protect the security of local training data.

[0108] It should be understood that the specific order or hierarchy of steps in the disclosed processes is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of the present disclosure. The accompanying method claims present elements of the various steps in an exemplary order and are not intended to be limited to the specific order or hierarchy described.

[0109] In the foregoing detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that embodiments of the claimed subject matter require more features than are expressly recited in each claim. On the contrary, as reflected in the appended claims, the invention comprises less than all the features of any individual disclosed embodiment. The appended claims are therefore hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0110] Those skilled in the art will also appreciate that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in conjunction with the embodiments herein may be implemented as electronic hardware, computer software, or a combination thereof. In order to clearly illustrate the interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps described above are generally described around their functions. Whether such functions are implemented as hardware or software depends on the specific application and the design constraints imposed on the entire system. A skilled person may implement the described functions in an adaptable manner for each specific application, but such implementation decisions should not be interpreted as departing from the scope of protection of this disclosure.

[0111] The steps of the methods or algorithms described in conjunction with the embodiments herein may be directly embodied as hardware, software modules executed by a processor, or a combination thereof. The software module may be located in a RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, register, hard disk, removable disk, CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and storage medium may be located in an ASIC. The ASIC may be located in a user terminal. Of course, the processor and storage medium may also be present in a user terminal as discrete components.

[0112] For software implementation, the techniques described in this application can be implemented using modules (e.g., procedures, functions, etc.) that perform the functions described in this application. These software codes can be stored in a memory unit and executed by a processor. The memory unit can be implemented within the processor or external to the processor. In the latter case, it is communicatively coupled to the processor via various means, which are well known in the art.

[0113] The foregoing description includes examples of one or more embodiments. Of course, it is not possible to describe all possible combinations of components or methods for the purposes of describing the above embodiments, but one of ordinary skill in the art will recognize that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to encompass all such changes, modifications and variations that fall within the scope of the appended claims. Furthermore, to the extent the term "comprising" is used in the specification or claims, the term is intended to be encompassed in a manner similar to the term "including," as explained in terms of "including," used as a transitional word in the claims. Furthermore, any use of the term "or" in the specification of the claims is intended to mean a "non-exclusive or."

Claims

1. A privacy data security sharing system based on generative model isolation, characterized by: include: Model local generation module, model allocation and scheduling module, and security monitoring and management module; among which: The local model generation module is used to train local private data to obtain a simulation data generation model; Model distribution scheduling module, which is used to conduct compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels; The security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors discovered.

2. A privacy data security sharing system based on generative model isolation as described in claim 1, characterized in that: The local model generation module is used to train local private data to obtain a simulation data generation model. The specific methods include: S101. Preprocessing various heterogeneous data in different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models; S102. Design the model architecture. Based on the concepts of generative and model isolation, construct an overall model architecture capable of generating simulated private data, specifically including a feature extraction sub-model and a data generation sub-model. S103. Build and train the model to implement model instantiation and parameter learning, including the configuration of model structure and hyperparameters, and the selection of training strategies.

3. A privacy data security sharing system based on generative model isolation as described in claim 2, characterized in that: In S101, various heterogeneous data from different fields are preprocessed. The specific methods include: S1011. Clean the data by going through each item in the original data and, based on the statistical values ​​and empirical knowledge of each item, filtering out and removing abnormal and erroneous data, aggregating duplicate and redundant data, and deleting missing value data. S1012. Extract data features, perform feature extraction and encoding on different types of heterogeneous data such as text, images, and videos, and convert them into unified structured data; S1013. Normalize the data, perform numerical processing on the encoded data, and scale it to the interval (0, 1) using the Min-Max normalization method; S1014. Fusing the data, fusing the heterogeneous data in vector form of different modalities obtained in S1013; S1015. Enhance the data by oversampling and undersampling the vector data set obtained in S1014 to obtain a data set with a balanced number of samples in various categories.

4. A privacy data security sharing system based on generative model isolation as described in claim 2, characterized in that: In S102, the model architecture is designed. The specific methods include: S1021. Design a feature extraction sub-model, using an autoencoder model structure to extract features of the input private data. The encoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding. The decoder reconstructs the reduced-dimensional data by increasing its dimensionality and extracts the output of the intermediate layer as the feature data of the private data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional and effective representation of the original data. S1022. Design a data generation sub-model, using a conditional generative adversarial model structure to generate high-quality simulated data. The generator takes noise and conditional information as input to generate synthetic data; the discriminator takes synthetic data and real data as input to determine whether it is real or synthetic. The generator and discriminator are trained alternately to obtain highly simulated synthetic data. S1023. Model interaction is designed. The feature extraction sub-model and the data generation sub-model work together to realize simulation data generation and isolate the gradient propagation process between sub-models to block the reverse engineering attack path. The feature data output by the feature extraction sub-model is used as the real data input sample of the data generation sub-model to guide the generation of highly simulated feature data. Overall, while protecting the original privacy data, it realizes simulation data sharing and tolerates reverse engineering attacks.

5. The privacy data security sharing system based on generative model isolation according to claim 2, characterized in that: In S103, the model is constructed and trained. The specific method includes: S1031. Design the model structure parameters. Initial model structure parameters are set based on prior knowledge. Then, a grid search method is used to fine-tune the model structure hyperparameters. Grid search can ensure that a better solution is found. By setting appropriate grid gaps and initial solutions, it can also reduce search time and avoid falling into local optimal solutions. S1032. Design a model training strategy, using a two-stage training strategy. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth (GT) guidance for adversarial training of the data generation sub-model. The model training hyperparameters are initialized based on prior knowledge. Then, the model is trained on a small amount of data, and a grid search method is used to obtain the final hyperparameters. S1033. Train the model. According to the parameter configuration obtained in S1031 and S1032, program the model and train it. Finally, extract the generator in the data generation sub-model as the model to be distributed.

6. A privacy data security sharing system based on generative model isolation as claimed in claim 1, characterized in that: The model allocation and scheduling module is used to conduct compliance review of user data requests and implement secure transmission and distribution of generators on trusted channels. Specific methods include: S201. Control permissions by configuring an initial permission table and assigning corresponding permission levels to each department or organization. When a department or organization requests data from the distribution and dispatch center, the request is determined based on its permission level. Only if the permission level of the data requester is higher than that of the data provider, the request is approved; otherwise, the request is rejected. S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, use a rule-based abnormal behavior detection method, and reject the data request from the requester who may have malicious behavior; S203. Perform encrypted transmission, use the SM4 encryption algorithm to encrypt the model parameters, and use the SSL / TLS protocol to perform encryption and identity authentication on the transmission link to protect the security of the model parameter transmission process.

7. The privacy data security sharing system based on generative model isolation according to claim 1 is characterized in that: The security monitoring management module is used to monitor the data request and model transmission process of the entire data sharing system. Specific methods include: S301 monitors the system process, stores the basic information of the participant ID and authority level of the entire data sharing system in the database, monitors the data request and model transmission communication process, and stores it in the form of logs; S302 analyzes abnormal behavior, regularly retrieves log information within a certain time window from the log library, combines the basic information stored in the database, and uses a rule-based method to detect and analyze abnormal communication behavior of each node in the entire system; S303. Respond to abnormal behavior. Based on the detection results in S302, trace the source of the abnormal communication process, control access to possible risk nodes and malicious nodes, or add them to the blacklist, and then notify the administrator to implement further control measures.

8. The privacy data security sharing system based on generative model isolation according to claim 3 is characterized in that: In S1015, the SMOTE algorithm is used for oversampling, and then the Tomek Links algorithm is used for undersampling to obtain a data set with a balanced number of samples in various categories; the specific method includes: identifying minority class samples, determining the samples belonging to the minority class in the data set; selecting k nearest neighbors, for each minority class sample, randomly selecting its k nearest neighbors; generating synthetic samples, randomly selecting a point between each sample and its selected nearest neighbor to generate new minority class samples; adding to the data set, adding the generated synthetic samples to the original data set; identifying Tomek Links pairs, for each sample, finding its nearest neighbor; if the pair of samples belong to different categories, they constitute a Tomek Links pair; removing samples, removing the majority class samples in the Tomek Links pair.

Images