A privacy data secure sharing system based on generative model isolation

Abstract

A kind of privacy data security sharing system based on generative model isolation includes: model local generation module, model allocation scheduling module and safety monitoring management module;Wherein: model local generation module is used to train local privacy data, and obtain simulation data generation model;Model allocation scheduling module is used to carry out compliance review to the data request of user, and realizes the safe transmission distribution of generator on trusted channel;Safety monitoring management module is used to monitor the data request, model transmission process of entire data sharing system, protects the compliance and security of entire system running process, and timely alarm and response are carried out to the abnormal behavior found.The present application alleviates the limitation and hindrance in practical application caused by the risk of traditional privacy protection technology, such as large calculation overhead, high hardware requirement and AI model attack risk of suffering from reverse engineering, and provides support for large-scale cross-domain joint data joint computing analysis.

Description

Technical Field

[0001] This invention relates to the field of privacy protection and privacy computing technology, and in particular to a privacy data security sharing system based on generative model isolation. Background Technology

[0002] With the rapid development of artificial intelligence technology, AI big data models, represented by DeepSeek, have been widely used in various fields due to their powerful data analysis capabilities for massive datasets. AI big data models can provide strong support for the joint analysis of massive heterogeneous data from multiple departments or social organizations, ensuring privacy and data security during the application of AI big data models, which is of great significance to social development and governance.

[0003] Over the past few years, the application of large-scale models and multi-party data joint computation has consistently presented a significant challenge. High-authority government departments such as public security agencies need to obtain cross-domain data from other government departments for joint analysis. However, with increasing emphasis on privacy protection and the growing severity of data silos, parties are unwilling to share private data. Furthermore, traditional privacy protection technologies face challenges in practical applications, such as high computational complexity and significant communication overhead. Therefore, privacy protection technologies for large-scale AI models urgently need innovation and improvement.

[0004] In terms of privacy data protection during multi-party collaborative data analysis, traditional technologies mainly rely on encryption-based AI model privacy computing solutions. These solutions have certain limitations in terms of computational overhead and hardware requirements, making it difficult to support efficient analysis of massive amounts of multi-domain data. Furthermore, they are susceptible to AI model attacks such as reverse engineering, which manifests in the following two aspects:

[0005] 1) Difficulty in cost control: Traditional AI model privacy protection technologies are usually based on federated learning and cryptography to achieve encrypted computation on AI models. This results in high computational complexity and large communication overhead. On the hardware side, it requires the support of dedicated hardware acceleration such as GPUs and ASICs. On the communication side, frequent encrypted data interaction consumes a lot of network bandwidth. Overall, it requires high computational and communication costs, which has significant limitations in practical applications and is usually difficult to support computational tasks on large models.

[0006] 2) Security risks exist: Traditional privacy protection solutions may be vulnerable to attacks targeting AI models, such as reverse engineering, and have certain security deficiencies. In recent years, attack methods targeting AI models, such as member inference and model theft, have been increasing. By analyzing the query results or intermediate parameters of AI models, it is possible to reverse engineer the original data or model information, which seriously threatens the security of privacy data.

[0007] In general, existing technologies for protecting privacy data security in AI large-scale model applications have certain limitations. Therefore, there is an urgent need for a privacy data security sharing system based on generative model isolation, which requires innovative design of the overall framework or technology, taking into account both security and usability. Summary of the Invention

[0008] In view of the above problems, the present invention is proposed to provide a privacy-preserving data sharing system based on generative model isolation that overcomes or at least partially solves the above problems.

[0009] To address the aforementioned technical problems, the embodiments of this application disclose the following technical solutions:

[0010] A privacy-preserving data sharing system based on generative model isolation includes: a local model generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein:

[0011] The local model generation module is used to train local privacy data to generate a model from simulation data;

[0012] The model allocation and scheduling module is used to perform compliance reviews of user data requests and to achieve secure transmission and distribution of the generator on a trusted channel.

[0013] The security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors detected.

[0014] Furthermore, the model local generation module is used to train local privacy data to obtain a simulation data generation model. Specific methods include:

[0015] S101. Preprocess various heterogeneous data from different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models;

[0016] S102. Design the model architecture. Based on the idea of ​​generative and model isolation, construct an overall model architecture that can generate simulated privacy data, specifically including a feature extraction sub-model and a data generation sub-model.

[0017] S103. Construct and train the model, realize model instantiation and parameter learning, specifically including the configuration of model structure and hyperparameters, and the selection of training strategy.

[0018] Furthermore, in S101, various heterogeneous data from different fields are preprocessed, specifically through methods including:

[0019] S1011. Clean the data by iterating through each item in the original data, filtering out and removing abnormal and erroneous data based on the statistical values ​​and empirical knowledge of each data item, aggregating duplicate and redundant data, and deleting missing value data.

[0020] S1012. Extract data features, extract and encode features from heterogeneous data of different types such as text, images and videos, and convert them into unified structured data;

[0021] S1013. Normalize the data. Perform numerical processing on the encoded data and scale it to the (0, 1) interval using the Min-Max normalization method.

[0022] S1014. Fusion of data: Fusion of heterogeneous vector data of different modalities obtained in S103;

[0023] S1015. Augment the data by oversampling and undersampling the vector-form dataset obtained in S104 to obtain a dataset with a balanced number of samples for each class.

[0024] Furthermore, in S102, the model architecture is designed, and the specific methods include:

[0025] S1021. The feature extraction sub-model is designed, and an autoencoder model structure is used to extract features of the input privacy data. The encoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding, and the decoder performs dimensionality increase reconstruction on the dimensionality-reduced data. The output of the intermediate layer is extracted as the feature data of the privacy data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional effective representation of the original data.

[0026] S1022. The data generation sub-model is designed, and a conditional generative adversarial model structure is adopted to generate high-quality simulation data. The generator takes noise and conditional information as input to generate synthetic data; the discriminator takes synthetic data and real data as input to determine whether it is real or synthetic data; the generator and discriminator are trained alternately to obtain highly simulated synthetic data.

[0027] S1023. The model interaction design involves the feature extraction sub-model and the data generation sub-model working together to generate simulation data and isolate the gradient propagation process between sub-models, thus blocking reverse engineering attack paths. The feature data output by the feature extraction sub-model serves as the real data input sample for the data generation sub-model, guiding the generation of highly simulated feature data. Overall, this approach protects the original privacy data while enabling simulation data sharing and tolerating reverse engineering attacks.

[0028] Furthermore, in S103, the model is constructed and trained, and the specific methods include:

[0029] S1031. Design the model structure parameters. Set the initial model structure parameters based on prior knowledge, and then use the grid search method to fine-tune the model structure hyperparameters. Grid search can ensure that a better solution is found. With appropriate grid spacing and initial solution, it can reduce the search time to a certain extent and avoid getting trapped in local optima.

[0030] S1032. The model training strategy is designed, and a two-stage training strategy is adopted. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth guide data for adversarial training of the sub-model. The hyperparameters of the model training are set with initial values ​​based on prior knowledge. Then, the model is trained on a small amount of data, and the final hyperparameters are obtained by using a grid search method.

[0031] S1033. Train the model. Based on the parameter configuration obtained in S1031 and S1032, build the model using programming and train it. Finally, extract the generator from the data generation sub-model as the model to be distributed.

[0032] Furthermore, the model allocation and scheduling module is used to perform compliance reviews of user data requests and to ensure the secure transmission and distribution of the generator on a trusted channel. Specific methods include:

[0033] S201. Control permissions, configure an initial permission table, assign corresponding permission levels to each department or organization, and when it requests data from the allocation and scheduling center, determine whether the request is allowed based on its permission level. Only if the permission level of the data requester is higher than the permission level of the data provider, the data request is approved; otherwise, the data request is rejected.

[0034] S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, adopt a rule-based abnormal behavior detection method, and reject the data request of the requester who may have malicious behavior.

[0035] S203. Encrypted transmission is performed. The SM4 encryption algorithm is used to encrypt the model parameters, and the SSL / TLS protocol is used for encryption and authentication on the transmission link to protect the security of the model parameter transmission process.

[0036] Furthermore, the security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system. Specific methods include:

[0037] S301. Monitor the system process, store the basic information of the participants' IDs and permission levels in the database, monitor the data request and model transmission communication process, and store it in the form of logs;

[0038] S302. Analyze abnormal behavior, periodically retrieve log information within a certain time window from the log library, combine it with the basic information stored in the database, and use a rule-based method to detect and analyze the communication behavior of each node in the entire system.

[0039] S303. Respond to abnormal behavior. Based on the detection results in S302, trace the abnormal communication process, implement access control for potential risk nodes and malicious nodes, or add them to the blacklist, and then notify the administrator to implement further control measures.

[0040] Furthermore, in S1015, the SMOTE algorithm is used for oversampling, and then the Tomek Links algorithm is used for undersampling to obtain a dataset with a balanced number of samples in each class. The specific methods include: identifying minority class samples, determining the samples in the dataset that belong to the minority class; selecting k nearest neighbors, randomly selecting k nearest neighbors for each minority class sample; generating synthetic samples, randomly selecting a point between each sample and its selected nearest neighbors to generate new minority class samples; adding to the dataset, adding the generated synthetic samples to the original dataset; identifying Tomek Links pairs, finding its nearest neighbor for each sample; if the pair of samples belongs to different classes, they constitute a Tomek Links pair; removing samples, removing majority class samples from the Tomek Links pairs.

[0041] The beneficial effects of the above-described technical solutions provided in the embodiments of the present invention include at least the following:

[0042] This invention discloses a privacy-preserving data sharing system based on generative model isolation, comprising: a local model generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein: the local model generation module is used to train local privacy data to obtain a simulation data generation model; the model allocation and scheduling module is used to perform compliance review on user data requests and realize secure transmission and distribution of the generator on a trusted channel; the security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors detected.

[0043] This invention employs a generative model isolation method to analyze privacy data, providing a secure and efficient solution for the joint analysis of proprietary data from multiple domains. Compared to traditional privacy protection technologies, it represents a novel technical approach. This invention generates low-dimensional simulation data using a generative model isolation method, solving the problem of high computational costs associated with large amounts of encrypted data. Furthermore, by using model distribution instead of data transmission, it significantly reduces communication bandwidth requirements, thereby substantially lowering the operational costs of the AI ​​service platform. The data sharing method based on generative and model isolation principles can, to some extent, block attack paths, improve resistance to reverse engineering attacks, and protect the security of local training data.

[0044] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0045] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0046] Figure 1 This is a structural diagram of a privacy data security sharing system based on generative model isolation in Embodiment 1 of the present invention;

[0047] Figure 2 This is a schematic diagram of a privacy data security sharing system based on generative model isolation in Embodiment 1 of the present invention;

[0048] Figure 3 This is a schematic diagram of a simulated privacy data generation model constructed based on an autoencoder and CGAN in Embodiment 1 of the present invention;

[0049] Figure 4 This is a schematic diagram of a test platform for a privacy data sharing system based on generative model isolation, as shown in Embodiment 1 of the present invention. Detailed Implementation

[0050] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0051] To address the problems existing in the prior art, embodiments of the present invention provide a privacy data security sharing system based on generative model isolation.

[0052] Example 1

[0053] To address the aforementioned deficiencies or improvement needs of existing technologies, this embodiment provides a privacy-preserving data sharing system based on generative model isolation. The purpose of this invention is to overcome the limitations of existing privacy protection technologies for AI model applications in terms of security and cost, and to provide a data sharing framework with complete cost control optimization and reverse engineering tolerance for multi-party joint privacy computing services based on large AI models. This framework ensures the security and efficiency of multi-party joint data analysis and provides fine-grained supervision of various data flows and control flows in the system for real-time management and control.

[0054] This embodiment discloses a privacy-preserving data sharing system based on generative model isolation, such as... Figure 1 It includes: a local model generation module, a model allocation and scheduling module, and a security monitoring and management module; among which:

[0055] The local model generation module is used to train a simulation data generation model on local privacy data. In this embodiment, the local model generation module is used to train a simulation data generation model on local privacy data, such as... Figure 2 Specific methods include:

[0056] S101. Preprocess various heterogeneous data from different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models;

[0057] S102. Design the model architecture. Based on the idea of ​​generative and model isolation, construct an overall model architecture that can generate simulated privacy data, specifically including a feature extraction sub-model and a data generation sub-model.

[0058] S103. Construct and train the model, realize model instantiation and parameter learning, specifically including the configuration of model structure and hyperparameters, and the selection of training strategy.

[0059] In S101 of some preferred embodiments, various heterogeneous data from different fields are preprocessed, and the specific methods include:

[0060] S1011. Clean the data by iterating through each item in the original data. Based on the statistical values ​​and empirical knowledge of each item, filter out and remove abnormal and erroneous data, aggregate duplicate and redundant data, and delete missing values. Specifically, iterate through each item in the original data and calculate the mean μ and variance σ of each item. 2 Set upper and lower boundary thresholds λ + , λ - Remove outliers that fall outside the boundaries, delete duplicate or redundant data and keep only one record, and delete data with missing values.

[0061] S1012. Extract data features. Perform feature extraction and encoding on heterogeneous data of different types, such as text, images, and videos, and convert them into unified structured data. Specifically, perform feature extraction and encoding on heterogeneous data and convert them into unified structured data. For text data and time-series data, use Transformer Encoder for encoding; for image data, use Convolutional Neural Network (CNN) for encoding; and for video data, use a vertically stacked structure of CNN and LSTM for encoding.

[0062] S1013. Normalize the data. Perform numerical processing on the encoded data and scale it to the (0, 1) interval using the Min-Max normalization method.

[0063] S1014. Fusion of data: Fusion of heterogeneous vector data of different modalities obtained in S103;

[0064] S1015. Data augmentation: Oversampling and undersampling are performed on the vector-form dataset obtained in S104 to obtain a dataset with a balanced number of samples across all classes. Specifically, the SMOTE algorithm is used for oversampling, followed by the TomekLinks algorithm for undersampling to obtain a dataset with a balanced number of samples across all classes. The specific methods include: identifying minority class samples; selecting k nearest neighbors: for each minority class sample, randomly selecting its k nearest neighbors; generating synthetic samples: randomly selecting a point between each sample and its selected nearest neighbors to generate a new minority class sample; adding to the dataset: adding the generated synthetic samples to the original dataset; identifying Tomek Links pairs: for each sample, finding its nearest neighbor; if this pair of samples belongs to different classes, they constitute a Tomek Links pair; removing samples: removing majority class samples from the Tomek Links pairs.

[0065] In S102 of some preferred embodiments, the model architecture is designed to construct an overall model architecture capable of generating simulated privacy data. Figure 3 This is a schematic diagram of the overall architecture, including a feature extraction sub-model and a data generation sub-model. The model architecture is designed using specific methods, including:

[0066] S1021. The feature extraction sub-model is designed, and an autoencoder model structure is used to extract features of the input privacy data. The encoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding, and the decoder performs dimensionality increase reconstruction on the dimensionality-reduced data. The output of the intermediate layer is extracted as the feature data of the privacy data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional effective representation of the original data.

[0067] S1022. The data generation sub-model is designed, and a conditional generative adversarial model structure is adopted to generate high-quality simulation data. The generator takes noise and conditional information as input to generate synthetic data; the discriminator takes synthetic data and real data as input to determine whether it is real or synthetic data; the generator and discriminator are trained alternately to obtain highly simulated synthetic data.

[0068] S1023. The model interaction design involves the feature extraction sub-model and the data generation sub-model working together to generate simulation data and isolate the gradient propagation process between sub-models, thus blocking reverse engineering attack paths. The feature data output by the feature extraction sub-model serves as the real data input sample for the data generation sub-model, guiding the generation of highly simulated feature data. Overall, this approach protects the original privacy data while enabling simulation data sharing and tolerating reverse engineering attacks.

[0069] In S103 of some preferred embodiments, the model is constructed and trained, and the specific methods include:

[0070] S1031. Design the model structure parameters. Set the initial model structure parameters based on prior knowledge, and then use the grid search method to fine-tune the model structure hyperparameters. Grid search can ensure that a better solution is found. With appropriate grid spacing and initial solution, it can reduce the search time to a certain extent and avoid getting trapped in local optima.

[0071] Specifically, the obtained model structure parameters are as follows:

[0072] Table 1 Structural parameters of the feature extraction sub-model

[0073]

[0074]

[0075] Table 2. Data Generation Sub-model Generator Structure Parameters

[0076] Input layer - 100+20 - - - - splicing layer Concatenate 100+20 120 - - - ConvT1 ConvTranspose1d 120 241 3 2 1 ReLU BN1 BatchNorm1d 241 241 - - - - ConvT2 ConvTranspose1d 241 483 3 2 1 ReLU BN2 BatchNorm1d 483 483 - - - - ConvT3 ConvTranspose1d 483 967 3 2 1 ReLU BN3 BatchNorm1d 967 967 - - - - FC1 Linear 967 512 - - - ReLU BN4 BatchNorm1d 512 512 - FC2 Linear 512 256 - - - ReLU BN5 BatchNorm1d 256 256 - - - - FC3 Linear 256 128 - - - - Output layer - - 128 - - - -

[0077] Table 3. Data Generation Sub-model Discriminator Structure Parameters

[0078] Input layer - 128 - - - - Conv1 Conv1d 128 128 3 1 1 ReLU Pool1 MaxPooling1D 128 64 2 2 - - BN1 BatchNorm1d 64 64 - - - - Conv2 Conv1d 64 64 3 1 1 ReLU Pool2 MaxPooling1D 64 32 2 2 - BN2 BatchNorm1d 32 32 - - - - FC1 Linear 32 32 - - - ReLU BN3 BatchNorm1d 32 32 - FC2 Linear 32 1 - - - - Output layer - - 1 - - - -

[0079] S1032. The model training strategy is designed, and a two-stage training strategy is adopted. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth guide data for adversarial training of the sub-model. The hyperparameters of the model training are set with initial values ​​based on prior knowledge. Then, the model is trained on a small amount of data, and the final hyperparameters are obtained by using a grid search method.

[0080] The hyperparameter configurations for the autoencoder training are shown in Tables 4.1-4.2, and the loss function uses mean squared error.

[0081]

[0082] Table 4.1 Autoencoder training hyperparameters

[0083] Batch size 128 Number of training rounds 50 Optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Regularization L2

[0084] The training hyperparameter configurations for the Conditional Generative Adversarial Network are shown in Table 5, and the loss function is as follows:

[0085]

[0086] Table 4.2 CGAN Training Hyperparameters

[0087] Batch size 64 Number of training rounds 100 Generator optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Discriminator Optimizer <![CDATA[Adam,β1=0.9,β2=0.999]]> Regularization L2 Generator and discriminator training frequency ratio 5：1

[0088] S1033. Train the model. Based on the parameter configuration obtained in S1031 and S1032, build the model using programming and train it. Finally, extract the generator from the data generation sub-model as the model to be distributed.

[0089] The model allocation and scheduling module is used to perform compliance reviews of user data requests and to achieve secure transmission and distribution of the generator on a trusted channel.

[0090] In this embodiment, the model allocation and scheduling module is used to perform compliance reviews on user data requests and to achieve secure transmission and distribution of the generator on a trusted channel. The specific methods include:

[0091] S201. Access control is implemented by configuring an initial access control table and assigning corresponding access levels to each department or organization. When an organization requests data from the allocation and scheduling center, the access level determines whether the request is allowed. The request is only approved if the access level of the data requester is higher than that of the data provider; otherwise, the request is rejected. The access level descriptions and the access levels of each machine are shown in Table 5. When any part of the system requests data from the model allocation and scheduling module, data access control is implemented based on the access level configuration table. For organizations with access level I, only local data contributions are allowed; requests to obtain data from other participants are rejected. For organizations with access level II, local data contributions are allowed, and data requests from organizations with access level I and other organizations with access level II are permitted. For organizations with access level III, data requests from organizations with access levels I and II are permitted, but requests from other organizations with access level III are rejected. For unauthorized organizations or devices (access level 0), all requests are rejected.

[0092] Table 5. Permission Level Description and Configuration Table

[0093]

[0094] S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, adopt a rule-based abnormal behavior detection method, and reject the data request of the requester who may have malicious behavior.

[0095] Specifically, record each data request and model distribution action, based on the data requester's ID. request Requested data provider ID response Data request time t request The model provides time t response Each data request is recorded and stored in a log database. The historical data request behavior of each participant is audited according to an audit cycle, using a rule-based anomaly detection method. If the number of data requests exceeds a threshold λ1 within a certain time window, subsequent data requests are rejected, and the event is reported to the security monitoring and management module. If the number of requests for data exceeding the permitted permissions exceeds a threshold λ2 within a certain time window, subsequent data requests are rejected, and the event is reported to the security monitoring and management module. If the data requester is an unauthorized device, its device ID is blacklisted.

[0096] S203. Encrypted transmission is performed. The SM4 encryption algorithm is used to encrypt the model parameters, and the SSL / TLS protocol is used for encryption and authentication on the transmission link to protect the security of the model parameter transmission process.

[0097] The security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors detected.

[0098] In this embodiment, the security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system. Specific methods include:

[0099] S301. Monitor the system process, store basic information such as participant IDs and permission levels of the entire data sharing system in the database, monitor the data request and model transmission communication processes, and store the data in log form; specifically, store basic information such as participant IDs and permission levels of the entire data sharing system in the database, monitor the communication processes such as data requests and model transmission, and store the data in log form. Store the data packets of the communication process between each data participant and the model allocation and scheduling module in the database in the form of PCAP files.

[0100] S302. Analyze abnormal behavior by periodically retrieving log information from the log database within a specific time window. Combined with basic information stored in the database, a rule-based approach is used to detect and analyze anomalies in the communication behavior of each node in the entire system. Specifically, data packets are periodically retrieved from the database for parsing, extracting information such as source IP, destination IP, source MAC, destination MAC, source port, destination port, and payload length. This information is then combined with log information retrieved from the log database within a specific time window and basic device information retrieved from the database to establish a complete session flow representation. The Snort rule base is used to detect and analyze anomalies in the communication behavior of each node in the entire system.

[0101] S303. Respond to abnormal behavior. Based on the detection results in S302, trace the source of abnormal communication processes and implement access control for potentially risky and malicious nodes, or add them to a blacklist. Then, notify the administrator to implement further control measures. Based on the detection results, trace the source of abnormal communication processes and implement access control for potentially risky and malicious nodes, restricting the frequency and time period of their requests to the model allocation and scheduling module, or adding them to a blacklist to filter their data requests. For serious network attacks or attacks on AI models, notify the administrator to implement further control measures.

[0102] In this example, an attack library and attack execution program are constructed based on network attack methods and attack methods targeting AI models. The specific attack methods and descriptions are shown in Table 6.

[0103] Table 6 Configuration of Network Attacks and AI Model Attacks

[0104]

[0105] The system disclosed in this embodiment is used to simulate various entities and functions, such as... Figure 4The system primarily comprises three domains: a banking domain, a hospital domain, and an attack domain. The banking and hospital domains, based on their respective AI service requirements, have established corresponding AI service simulation platforms. At the hardware level, each domain includes a high-performance computing server for deploying large models and executing corresponding computational tasks. Additionally, a data server is provided for storing local privacy data and generated simulation data from other domains. The attack domain is used to simulate malicious attackers. Its main function is to attack the data sharing process between the banking and hospital domains to steal privacy data. At the hardware level, it includes a data server and a host computer. The data server stores knowledge related to various attack methods targeting AI models, while the host computer constructs and executes corresponding attack scripts based on this attack method knowledge. Regarding the deployment of the various modules of this invention's privacy data security sharing system based on generative model isolation, the local model generation module is distributed across the high-performance computing servers in the banking and hospital domains, while the model allocation and scheduling module and the security management and monitoring module are each deployed on a separate computing server. The local model generation module is responsible for processing local privacy data, obtaining local simulation data to generate models, while the model allocation and scheduling module handles data requests from banks and hospitals and executes model transmission. The security management and monitoring module is responsible for monitoring and managing all processes within the entire system. These modules work collaboratively to ensure secure data sharing between the bank and hospital domains.

[0106] This embodiment discloses a privacy data security sharing system based on generative model isolation, including: a local model generation module, a model allocation and scheduling module, and a security monitoring and management module; wherein: the local model generation module is used to train local privacy data to obtain a simulation data generation model; the model allocation and scheduling module is used to perform compliance review on user data requests and realize secure transmission and distribution of the generator on a trusted channel; the security monitoring and management module is used to monitor the data requests and model transmission process of the entire data sharing system, protect the compliance and security of the entire system operation process, and provide timely alarms and responses to any abnormal behaviors detected.

[0107] This embodiment employs a generative model isolation method to analyze privacy data, providing a secure and efficient solution for the joint analysis of proprietary data from multiple domains. Compared to traditional privacy protection technologies, it represents a novel technical approach. This invention generates low-dimensional simulation data based on generative model isolation, solving the problem of high computational costs associated with large amounts of encrypted data. Furthermore, by using model distribution instead of data transmission, it significantly reduces communication bandwidth requirements, thereby substantially lowering the operational costs of the AI ​​service platform. The data sharing method based on generative and model isolation principles can, to some extent, block attack paths, improve resistance to reverse engineering attacks, and protect the security of local training data.

[0108] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process may be rearranged without departing from the scope of this disclosure. The appended method claims provide elements of various steps in an exemplary order and are not intended to limit the scope to the specific order or hierarchy described.

[0109] In the detailed description above, various features are combined together in a single embodiment to simplify this disclosure. This approach to disclosure should not be construed as reflecting an intention that embodiments of the claimed subject matter require more features than are explicitly stated in each claim. Rather, as reflected in the appended claims, the invention is presented with fewer features than all of the features in a single disclosed embodiment. Therefore, the appended claims are hereby explicitly incorporated into the detailed description, with each claim representing a separate preferred embodiment of the invention.

[0110] Those skilled in the art will also understand that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments herein can be implemented as electronic hardware, computer software, or a combination thereof. To clearly illustrate the interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps described above are generally described in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art can implement the described functionality in alternative ways for each specific application; however, such implementation decisions should not be construed as departing from the scope of this disclosure.

[0111] The steps of the methods or algorithms described in conjunction with the embodiments herein can be directly embodied in hardware, software modules executed by a processor, or a combination thereof. The software modules can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium well known in the art. An exemplary storage medium is connected to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. The ASIC can reside in a user terminal. Alternatively, the processor and storage medium can exist as discrete components in the user terminal.

[0112] For software implementation, the techniques described in this application can be implemented using modules (e.g., procedures, functions, etc.) that perform the functions described in this application. This software code can be stored in memory units and executed by a processor. The memory units can be implemented within the processor or outside the processor; in the latter case, they are communicatively coupled to the processor via various means, as is well known in the art.

[0113] The foregoing description includes examples of one or more embodiments. It is certainly impossible to describe all possible combinations of components or methods in order to describe the above embodiments, but those skilled in the art will recognize that further combinations and arrangements of the various embodiments are possible. Therefore, the embodiments described herein are intended to cover all such changes, modifications, and variations that fall within the scope of the appended claims. Furthermore, the term "comprising" as used in the specification or claims is interpreted in a manner similar to the term "including," as interpreted when used as a conjunction in the claims. Additionally, the use of any term "or" in the specification of the claims is intended to mean "non-exclusive or."

Claims

1. A privacy-preserving data sharing system based on generative model isolation, characterized in that, include: The system comprises a local model generation module, a model allocation and scheduling module, and a security monitoring and management module. The local model generation module is used to train local privacy data to generate a simulation data model. Specific methods include: S101. Preprocess various heterogeneous data from different fields to convert the heterogeneous data into standardized and structured data that can be used by machine learning models; S102. Design the model architecture. Based on the idea of ​​generative and model isolation, construct an overall model architecture that can generate simulated privacy data, specifically including a feature extraction sub-model and a data generation sub-model. S103. Construct and train the model to achieve model instantiation and parameter learning, specifically including the configuration of model structure and hyperparameters, and the selection of training strategies; In S101, various heterogeneous data from different fields are preprocessed, and the specific methods include: S1011. Clean the data by iterating through each item in the original data, filtering out and removing abnormal and erroneous data based on the statistical values ​​and empirical knowledge of each data item, aggregating duplicate and redundant data, and deleting missing value data. S1012. Extract data features, extract and encode features from heterogeneous data of different types such as text, images and videos, and convert them into unified structured data; S1013. Normalize the data. Perform numerical processing on the encoded data and scale it to the (0, 1) interval using the Min-Max normalization method. S1014. Fusion of data: Fusion of heterogeneous vector data of different modalities obtained in S1013; S1015. Data augmentation: Oversampling and undersampling are performed on the vector-form dataset obtained in S1014 to obtain a dataset with a balanced number of samples across all classes. In S1015, the SMOTE algorithm is used for oversampling, followed by the TomekLinks algorithm for undersampling to obtain a dataset with a balanced number of samples across all classes. Specific methods include: identifying minority class samples; selecting k nearest neighbors for each minority class sample; generating synthetic samples by randomly selecting a point between each sample and its selected nearest neighbors to generate new minority class samples; adding the generated synthetic samples to the original dataset; identifying Tomek Links pairs for each sample by finding its nearest neighbor; if these pairs of samples belong to different classes, they constitute a Tomek Links pair; and removing samples from the majority class pairs. In S102, the model architecture is designed, and the specific methods include: S1021. The feature extraction sub-model is designed, and an autoencoder model structure is used to extract features of the input privacy data. The encoder in the autoencoder performs multi-layer feature extraction on the input data to achieve dimensionality reduction encoding, and the decoder performs dimensionality increase reconstruction on the dimensionality-reduced data. The output of the intermediate layer is extracted as the feature data of the privacy data. The encoder-decoder structure ensures that the intermediate output is a low-dimensional effective representation of the original data. S1022. The data generation sub-model is designed, and a conditional generation adversarial model structure is adopted to generate high-quality simulation data. The generator takes Gaussian distributed noise and conditional information as input, and fuses the conditional information with the noise vector through concatenation to generate synthetic data. The discriminator takes synthetic data and real data as input and judges whether it is real or synthetic data. The generator and discriminator are trained alternately to obtain highly simulated synthetic data. S1023. The model interaction design involves the feature extraction sub-model and the data generation sub-model working together to generate simulation data and isolate the gradient propagation process between sub-models, thus blocking reverse engineering attack paths. The feature data output by the feature extraction sub-model serves as the real data input sample for the data generation sub-model, guiding the generation of highly simulated feature data. Overall, while protecting the original privacy data, it enables simulation data sharing and tolerates reverse engineering attacks. In S103, the model is constructed and trained, and the specific methods include: S1031. The model structure parameters are designed. The initial model structure parameters are set with reference to the conventional structure of autoencoders and conditional generative adversarial networks. Then, the model structure hyperparameters are fine-tuned using the grid search method. Grid search can ensure that a better solution is found. With appropriate grid spacing and initial solution, the search time can be reduced to a certain extent and the problem of getting stuck in local optima can be avoided. S1032. The model training strategy is designed, and a two-stage training strategy is adopted. First, the feature extraction sub-model generates a feature dataset. Then, the feature dataset is used as the ground truth to guide the adversarial training of the data generation sub-model. The hyperparameters of the model training are set with reference to the conventional training parameters of autoencoders and conditional generative adversarial networks. Then, the model is trained on a small amount of data, and the final hyperparameters are obtained by grid search. S1033. Train the model. Based on the parameter configuration obtained in S1031 and S1032, programmatically build the model and train it. Finally, extract the generator in the data generation sub-model as the model to be distributed. The model allocation and scheduling module is used to perform compliance reviews of user data requests and to ensure the secure transmission and distribution of the generator on a trusted channel; specific methods include: S201. Control permissions, configure an initial permission table, assign corresponding permission levels to each department or organization, and when it requests data from the allocation and scheduling center, determine whether the request is allowed based on its permission level. Only if the permission level of the data requester is higher than the permission level of the data provider, the data request is approved; otherwise, the data request is rejected. S202. Audit the behavior, record each data request and model distribution behavior, audit the historical behavior of the data requester, adopt a rule-based abnormal behavior detection method, and reject the data request of the requester who may have malicious behavior. S203. Encrypted transmission is performed, using the SM4 encryption algorithm to encrypt the model parameters, and the SSL / TLS protocol is used for encryption and authentication on the transmission link to protect the security of the model parameter transmission process; The security monitoring and management module is used to monitor the data requests and model transmission processes of the entire data sharing system, protecting the compliance and security of the entire system's operation, and providing timely alerts and responses to any abnormal behavior detected. Specific methods include: S301. Monitor the system process, store the basic information of the participants' IDs and permission levels in the database, monitor the data request and model transmission communication process, and store it in the form of logs; S302. Analyze abnormal behavior, periodically retrieve log information within a certain time window from the log library, and combine it with basic information such as system participant ID, permission level, and device identifier stored in the database. Using the Snort rule base, perform abnormal detection and analysis on the communication behavior of each node in the entire system. S303. Respond to abnormal behavior. Based on the detection results in S302, trace the abnormal communication process, implement access control for potential risk nodes and malicious nodes, or add them to the blacklist, and then notify the administrator to implement further control measures. The model allocation and scheduling module is used to perform compliance reviews of user data requests and to ensure the secure transmission and distribution of the generator on a trusted channel.

Images