Cross-border personal data transmission security detection method and system based on differential privacy

Abstract

The invention belongs to the technical field of cross-border data security, and provides a cross-border personal data transmission security detection method and system based on differential privacy, and the method comprises the steps of multi-dimensional situation awareness, privacy budget allocation, interpretability and audit, and execution and response. By synchronously sensing technical environment risks, multi-national regulation constraints and multi-modal data features, comprehensive control of the cross-border transmission security situation is realized, and one-sidedness of single-dimensional sensing is avoided; privacy budget is dynamically allocated under multiple constraints based on a deep Q network algorithm, so that the protection intensity of high-sensitivity data is ensured, and excessive loss of effectiveness of low-sensitivity data is avoided; an interpretable report is generated in combination with causal analysis, full-process evidence storage is realized by relying on an alliance chain, the problems of decision black box and audit tracing are solved, cross-border supervision requirements are met, and the balance of cross-border transmission in the aspects of safety, compliance and availability is improved.

Description

Technical Field

[0001] This application relates to the field of cross-border data security technology, and in particular to a method and system for security detection of cross-border personal data transmission based on differential privacy. Background Technology

[0002] Cross-border personal data transfer refers to the electronic transmission of personal data across countries or jurisdictions, involving privacy protection regulations in different jurisdictions. In international cooperation in fields such as healthcare and finance, such transfers need to simultaneously meet requirements for technical security, regulatory compliance, and data availability, creating a complex environment of dual technical and regulatory constraints.

[0003] Currently, existing technologies mainly employ traditional differential privacy mechanisms, which achieve privacy protection through a unified privacy budget allocation and noise addition. These methods are typically based on a fixed budget allocation strategy and provide overall protection for a single data type.

[0004] Existing technologies suffer from the following problems: Firstly, privacy budget allocation lacks intelligent and dynamic adaptability. Current technologies allocate privacy budgets at a fixed ratio; however, real-time attack risk levels, link budget margins, and data attribute sensitivity all affect the allocation. Allocating too high a budget to low-sensitivity background areas results in data utility loss, while allocating too low a budget to highly sensitive disease areas fails to meet compliance requirements. Secondly, decision interpretability and audit traceability are insufficient. Existing technologies do not clearly define the key influencing factors of privacy budget allocation, nor do they establish an immutable evidence storage mechanism. Regulatory agencies cannot verify the budget allocation logic, making it difficult to balance security, compliance, and availability in cross-border transmissions. Summary of the Invention

[0005] The purpose of this application is to propose a method and system for security detection of cross-border personal data transmission based on differential privacy, so as to solve the technical problem of balancing security, compliance and availability in cross-border transmission as mentioned in the background art.

[0006] To address the aforementioned technical problems, this application provides a method for secure detection of cross-border personal data transmission based on differential privacy, employing the following technical solution: A method for secure detection of cross-border personal data transmission based on differential privacy includes the following steps: Multidimensional situational awareness processing is performed on three types of information: technical environment risks, multi-country regulatory constraints, and multimodal data characteristics in cross-border personal data transmission environments. This results in structured situational awareness results that include attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity scores. Based on the deep Q-network algorithm, the structured situational awareness results are integrated, and privacy budget allocation is performed on each data attribute. The constraints of the allocation process include that the privacy budget of each data attribute is not lower than the preset technical lower limit, does not exceed the maximum privacy budget allowed by the corresponding regulations, and the sum of the budgets of all attributes does not exceed the link budget margin, thus obtaining the attribute-level privacy budget vector. Causal analysis of the decision-making process of the deep Q network model is performed. At the same time, the key information of the entire cross-border data transmission process is stored and audited by smart contracts in conjunction with the consortium blockchain. The result is a causally explainable report and an immutable audit record. The key information of the entire cross-border data transmission process includes the digital signatures of the participants. Based on the attribute-level privacy budget vector, attribute-level noise is injected into different types of data attributes to monitor sudden risks during transmission in real time. Based on the sensitivity level of data attributes and the priority of transmission links, adaptive dynamic adjustments are made to obtain secure data that can be transmitted across borders.

[0007] Preferably, the multi-dimensional situational awareness processing includes: Technical environment risk perception: The isolated forest algorithm is used to extract the request frequency, data access range and transmission latency characteristics of cross-border transmission requests, and perform member inference attack detection to obtain the attack risk level; the legal big model is called to determine the maximum privacy budget for each cross-border transmission link, and the link budget margin is calculated by the difference between the maximum privacy budget and the privacy budget used in the link's history; the real-time electromagnetic signals of the transmission equipment are collected by electromagnetic radiation sensors, and the variance of the real-time electromagnetic signals is compared with the preset normal signal baseline to calculate the side channel attack strength value; Multi-country regulatory constraint perception: Extract entities such as jurisdiction, data attributes and regulatory clauses from privacy law texts of multiple countries, label the constraint relationships between entities and store them in a graph database to form a cross-border compliance knowledge graph; Adjust the legal big model, input the target region name and data attribute type, and quantify fuzzy regulatory clauses to obtain compliance rules. Multimodal data feature perception: A lightweight image model is used to extract medical image features, which are then divided into lesion regions and background regions, and attribute-level sensitivity scores are calculated; a text model is used to extract semantic features of diagnostic text, which are then divided into diagnostic conclusions and symptom descriptions, and attribute-level sensitivity scores are calculated.

[0008] Preferably, the compliance rules include the maximum privacy budget allowed by regulations and the anonymization requirements; based on the attribute-level sensitivity score, the data attribute sensitivity level is divided into high-sensitivity attributes, medium-sensitivity attributes, and low-sensitivity attributes; the transmission link priority is divided into high-priority links and low-priority links.

[0009] Preferably, the privacy budget allocation process includes: constructing the state space of a deep Q-network model, with the input information being structured situational awareness results; defining the model action space as an attribute-level privacy budget vector; initializing the model's experience replay pool, main network, and target network; selecting actions using an ε-greedy strategy; updating the main network parameters by extracting samples from the experience replay pool; updating the target network parameters at preset training time steps; and maximizing the cumulative reward value using a composite reward function to obtain the attribute-level privacy budget vector.

[0010] Preferably, the causal analysis includes: constructing a causal relationship graph, where the nodes are structured data attribute sensitivity scores, multimodal data attribute sensitivity scores, maximum privacy budget allowed by regulations, attack risk level, and side-channel attack strength value; using an intervention analysis method to fix the node values ​​and observe changes in the privacy budget, deriving the contribution of each node, and generating a causal explainable report; The smart contract auditing process includes: storing structured situational awareness results, attribute-level privacy budget vectors, causal interpretable reports, digital signatures and timestamps of participating parties using a consortium blockchain framework; deploying smart contracts on the consortium blockchain; calculating the cumulative privacy budget of sequential links and the cumulative privacy budget of parallel links; and automatically freezing links and issuing alarms when the total cumulative privacy budget reaches a preset global budget threshold.

[0011] Preferably, the attribute-level noise injection includes: for numerical data, using the Laplace mechanism; for discrete data, using the exponential mechanism; for medical image data, using the feature-level Laplace mechanism to add noise; and for text data, using the word embedding perturbation mechanism to add noise.

[0012] Preferably, the adaptive dynamic adjustment process includes: using an extreme gradient boosting model, combining link type and data sensitivity mean to predict the dynamic threshold of side-channel attacks and the dynamic warning value of link budget; when the side-channel attack intensity value is detected to exceed the dynamic threshold, the link budget margin is lower than the dynamic warning value, or a regulatory update in the target area is detected, the following adjustments are triggered: adjusting the privacy budget value according to the data attribute sensitivity level; freezing low-priority links and stopping the allocation of new budgets, transferring the saved budget to high-priority links; interrupting the current transmission, reacquiring the structured situational awareness results, and initiating a new round of deep Q network model decision-making.

[0013] Preferably, the composite reward function includes: privacy protection benefits that are negatively correlated with the success rate of member inference attacks, the weight of which is dynamically adjusted according to the attack risk level; data utility loss that is correlated with data perplexity, the weight of which is fixed; and compliance score that is positively correlated with the degree of compliance of attribute-level privacy budget vector, the weight of which is fixed; the reward value is calculated as privacy protection benefits - data utility loss deduction item + compliance score.

[0014] To address the aforementioned technical problems, embodiments of this application also provide a cross-border personal data transmission security detection system based on differential privacy, including: The multi-dimensional situational awareness module collects and quantifies in real time the technical environment risks, multi-country regulatory constraints, and multi-modal data characteristics that affect the security of cross-border data transmission. It transforms fuzzy information into structured situational awareness results and outputs comprehensive data including attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity score. The privacy budget allocation module receives the structured situational awareness results, integrates the input information through the deep Q-network algorithm, and allocates the optimal privacy budget for each data attribute under the constraints that the privacy budget for each data attribute is not lower than the technical lower limit, does not exceed the maximum privacy budget allowed by regulations, and the sum of the budgets of all attributes does not exceed the link budget margin. The module outputs an attribute-level privacy budget vector. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, performs causal analysis on the decision-making process of the deep Q-network model to generate a natural language interpretable report, and uses consortium blockchain technology to store and transmit key information throughout the process. It also automatically calculates the cumulative privacy budget and triggers audit alerts through smart contracts. The execution response module receives the attribute-level privacy budget vector, performs differentiated attribute-level noise injection on different types of data attributes to generate secure data, and monitors sudden risks during transmission in real time, dynamically adjusting the privacy protection strategy based on the data attribute sensitivity level and transmission link priority.

[0015] Preferably, the multi-dimensional situational awareness module includes a technology awareness unit, a regulatory awareness unit, and a multimodal data awareness unit; the technology awareness unit receives cross-border transmission request logs and device sensor signals, detects members to infer attacks and calculates attack risk levels using the isolated forest algorithm, determines the maximum privacy budget for the link and calculates the budget margin using a legal big model, and calculates the side-channel attack strength value through electromagnetic signal analysis; the regulatory awareness unit receives multi-country regulatory texts and target region information, and outputs compliance rules through knowledge graph construction and legal big model parsing; the multimodal data awareness unit receives structured and unstructured data, and outputs attribute-level sensitivity scores through attribute splitting and sensitivity assessment; The privacy budget allocation module receives the structured situational awareness results, constructs the state space of the deep Q-network model, defines the action space as an attribute-level privacy budget vector, and outputs the optimal allocation scheme through reinforcement learning training. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, constructs a causal relationship graph, derives the contribution of each factor through intervention analysis, generates a causal interpretable report, uses the consortium blockchain to store the environment state, privacy budget vector, interpretable report, digital signature, and timestamp, and calculates the cumulative privacy budget of sequential links and parallel links through deployed smart contracts. When the global threshold is exceeded, the link is automatically frozen and an alarm is triggered; the audit record is transmitted to the regulator in real time. The execution response module receives an attribute-level privacy budget vector, employs a Laplace mechanism for numerical data, an exponential mechanism for discrete data, a feature-level Laplace mechanism for medical images, and a word embedding perturbation mechanism for text data to inject noise, generating secure data. It monitors side-channel attack strength, budget margin, and regulatory updates in real time, uses machine learning models to predict dynamic thresholds, triggers privacy budget value adjustments, link priority scheduling, and a closed loop of re-decision, and feeds the adjusted strategy back to the privacy budget allocation module for iterative optimization.

[0016] The beneficial effects of this invention are as follows: This application provides a method for security detection of cross-border personal data transmission based on differential privacy. By simultaneously sensing technological environmental risks, multi-country regulatory constraints, and multimodal data characteristics, it achieves comprehensive control over the security situation of cross-border transmission, avoiding the one-sidedness of single-dimensional perception. Based on the deep Q-network algorithm, it dynamically allocates privacy budgets under multiple constraints, ensuring the protection strength of highly sensitive data while avoiding excessive loss of utility for low-sensitivity data. Combined with causal analysis to generate interpretable reports, and relying on consortium blockchains to achieve full-process evidence storage, it solves the problems of decision-making black boxes and audit traceability, meets cross-border regulatory requirements, and improves the balance of security, compliance, and availability in cross-border transmission.

[0017] This method introduces the deep Q-network algorithm into privacy budget allocation, and achieves multi-objective optimization of privacy protection, data utility, and compliance by designing a composite reward function. Compared with existing fixed allocation methods, it is more intelligent and adaptable to different scenarios. For multimodal data, it proposes attribute-level sensitivity scoring and targeted noise injection strategies, and adopts a feature-level Laplacian mechanism for medical images and a word embedding perturbation mechanism for diagnostic texts to solve the problems of insufficient protection or wasted utility caused by traditional coarse-grained processing. It integrates a legal big data model and a machine learning model, which can not only quantitatively parse ambiguous legal provisions in different regions, but also detect risks such as member inference attacks and side-channel attacks in real time, thereby improving adaptability in cross-border scenarios.

[0018] This method breaks down the black box barrier of differential privacy technology by combining causal explainable reports with consortium blockchain evidence storage, allowing regulatory agencies to clearly understand the privacy budget allocation logic and enhancing the trust in cross-border transmissions. The adaptive dynamic adjustment mechanism can respond to sudden risks in real time, and ensure the continuous security of highly sensitive data transmissions through priority link scheduling and budget reallocation. It achieves a three-in-one protection of privacy security, data availability, and compliance traceability for cross-border personal data transmissions, providing reliable technical support for highly sensitive scenarios such as healthcare and finance. Attached Figure Description

[0019] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of Embodiment 1 of this application; Figure 2 This is a system architecture diagram of Embodiment 2 of this application. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings of this application are intended to cover non-exclusive inclusion.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0024] Example 1 like Figure 1 As shown, the cross-border personal data transmission security detection method based on differential privacy includes steps 1 to 4: Step 1: Multi-dimensional situational awareness: Perform multi-dimensional situational awareness processing on three types of information: technical environment risks, multi-country regulatory constraints, and multi-modal data characteristics of cross-border personal data transmission environment, to obtain structured situational awareness results including attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity score.

[0025] Furthermore, the multi-dimensional situational awareness processing includes: awareness of technological environment risks, awareness of multi-country regulatory constraints, and awareness of multimodal data characteristics. The compliance rules include the maximum privacy budget allowed by regulations and anonymization requirements; based on the attribute-level sensitivity score, data attribute sensitivity levels are divided into high-sensitivity attributes, medium-sensitivity attributes, and low-sensitivity attributes.

[0026] Transmission link priorities are divided into high-priority links and low-priority links based on the sensitivity of the transmitted data, and the division logic is as follows: High-priority links: These are links used to transmit highly sensitive data. The leakage of such data would cause serious harm to users, such as medical discrimination and financial loss. They also meet the regulatory requirements for a high level of privacy protection. Specifically, these include links that transmit medical data and financial data. Low-priority links: These are links used to transmit low-sensitivity data, which poses less harm to users and is subject to relatively lenient regulatory constraints. Specifically, they include links that transmit marketing data and ordinary user behavior data.

[0027] The essence of this classification is to match data sensitivity levels with link resource protection priorities to ensure that highly sensitive data receives a more sufficient privacy budget and higher priority link resources during transmission, thus avoiding insufficient protection of highly sensitive data due to low-sensitivity data occupying resources.

[0028] Step 1.1: Technical Environment Risk Perception: Attack Risk and Link Status Monitoring: Monitor technical security risks through member inference attack detection and side-channel attack quantification detection methods, while statistically analyzing the privacy budget usage of each transmission link, and finally outputting the risk level and remaining budget.

[0029] Step 1.1.1: Member inference attack detection.

[0030] The Isolation Forest algorithm is employed, which can identify anomalies without labeling attack samples. A large number of normal cross-border data transfer requests are first collected as training samples, such as normal medical data transfer requests and ordinary personal information transfer requests. Multiple isolation trees are then constructed based on these samples.

[0031] For each transmission request to be detected, the request frequency, data access range, and transmission delay characteristics need to be extracted. The extraction method is as follows: Request frequency: The total number of transmission requests initiated by the request initiator within a unit of time is counted from the cross-border transmission log. For example, if an initiator initiates 20 requests in 1 hour, the request frequency is 20 times / hour. Data access scope: This is determined by the data access permission identifier and data size carried in the transmission request. For example, if the request requests access to five types of core data such as the user's medical history and diagnosis conclusions, and the data size exceeds 100MB, it is considered a large data access scope. If only two types of basic data such as the user's age and gender are accessed, and the data size is less than 10MB, it is considered a small data access scope. Transmission delay: Records the time difference between when a request is sent by the initiator and when the receiver confirms receipt. For example, if the request is sent at 10:00:00 and the receiver confirms at 10:00:05, the transmission delay is 5 seconds.

[0032] After feature extraction, the path length from the root to the isolated tree for the request is calculated, and then compared with the average path length of normal samples to obtain an anomaly score. The closer the anomaly score is to 1, the more the request deviates from normal features, and the higher the probability of it being a member inference attack. Member inference attacks refer to attacks that infer whether data comes from the training set. The closer the anomaly score is to 0, the lower the risk.

[0033] The final attack risk level is determined by a three-tiered risk standard based on anomaly scores: anomaly score ≥ 0.7 indicates high risk, 0.5 ≤ anomaly score < 0.7 indicates medium risk, and anomaly score < 0.5 indicates low risk. Each cross-border transmission request will have a corresponding attack risk level.

[0034] Step 1.1.2: Multi-link privacy budget margin monitoring.

[0035] For each cross-border transmission link, such as from the first country to the first alliance or from the first country to the second alliance, the maximum privacy budget for that link is first determined according to the regulations of the target region. The specific determination method is as follows: First, clarify the target region corresponding to the link. For example, the target region of the link from the first country to the first alliance is the first alliance. Call the trained legal big data model LawGPT, input the target region name and the data attribute type of the link transmission, such as medical data or general personal information. For details on LawGPT, see step 1.2. The legal big data model analyzes the privacy regulations of the target region, such as the GDPR of the first consortium, and outputs the upper limit of the level of privacy protection allowed for the corresponding data attribute types in that region. This upper limit is the maximum privacy budget for the link. For example, if the first consortium regulations have strict privacy protection requirements for medical data, the legal big data model outputs a maximum privacy budget of 1.0 for the link from the first country to the first consortium; if the second consortium regions have lower protection requirements for general personal information, the maximum privacy budget for the link from the first country to the second consortium is 2.0.

[0036] After determining the maximum privacy budget, the privacy budget used in all historical transmissions of this link is accumulated, which is the sum of the privacy budget allocated for data attributes in each transmission of this link. The maximum privacy budget is then subtracted from the used budget to obtain the link's budget margin. If the link's budget margin is lower than a preset warning value, such as 0.2, a budget warning is triggered, indicating that the privacy budget allocation for this link needs to be reduced in the future to avoid violations.

[0037] Step 1.1.3: Quantitative detection of side-channel attacks.

[0038] Real-time electromagnetic signals from transmission devices, including servers and terminals, are collected using electromagnetic radiation sensors. A baseline of the electromagnetic signal during normal data transmission is pre-stored; this baseline serves as a reference standard for signal stability, for example, the fluctuation range of the electromagnetic signal during normal transmission is between 100μV and 120μV. The fluctuation level of the real-time signal is compared with that of the baseline. The fluctuation level is measured by variance, a statistical indicator describing the dispersion of data, i.e., the magnitude of fluctuation. The specific calculation steps are as follows: To calculate the mean of a real-time electromagnetic signal sequence, for example, collect 1000 real-time signal sampling points, add the values ​​of all sampling points together and divide by 1000 to obtain the mean. Calculate the deviation of each sample value from the mean, and then square each deviation. Calculate the average of the squared deviations of all samples; this average is the variance of the real-time electromagnetic signal. For example, if the mean of the real-time signal is 110 μV, and the value at a certain sampling point is 130 μV with a deviation of 20 μV, the squared deviation is 400 μV². The average of the squared deviations of all sampling points is 60 μV², and the variance of the real-time signal is 60 μV².

[0039] The side-channel attack strength value is calculated as follows: Side-channel attack strength value = |Real-time signal variance - Normal signal baseline variance| ÷ Normal signal baseline variance. A higher side-channel attack strength value indicates that the device may be under a side-channel attack, such as a power analysis attack that leaks data through electromagnetic radiation. A side-channel attack strength value ≥ 0.8 is set as a high-risk standard. When a detected side-channel attack strength value reaches or exceeds 0.8, subsequent emergency adjustments are triggered.

[0040] Step 1.2: Multi-country regulatory constraint perception: Quantitative analysis of multi-country regulations: Transform vague regulatory clauses from different countries or regions into enforceable technical requirements, and output data attributes - compliance rules corresponding to the target region.

[0041] Step 1.2.1: Construction of cross-border compliance knowledge graph.

[0042] First, key entities are extracted from regulatory texts from multiple countries, such as jurisdictions like the First and Second Coalitions, data attributes like names, medical history, and lesion areas, and regulatory clauses like GDPR Article 44. These regulatory texts include GDPR and the Personal Information Protection Act. Next, legal experts annotate the binding relationships between entities; for example, the First Coalition has stricter privacy protection requirements for medical history data, while the Second Coalition has lower requirements for anonymizing general personal information. Finally, this entity-relationship information is stored in a specialized graph database, such as Neo4j, forming a queryable cross-border compliance knowledge graph. For example, querying the First Coalition's requirements for lesion area data can directly retrieve specific rules from the knowledge graph.

[0043] Step 1.2.2: Quantify vague legal provisions.

[0044] Using a specially trained legal big data model, LawGPT, with training data covering privacy regulations in more than 120 countries, and inputting customized queries, for example, transforming the requirements of the First Coalition GDPR regarding the adequacy of medical history data into privacy protection strength and de-identification operations.

[0045] The structured output of the legal big data model includes a maximum privacy budget and anonymization requirements. The maximum privacy budget is a quantitative indicator of the strength of privacy protection; a smaller maximum privacy budget indicates stronger privacy protection. For example, the legal big data model outputs a maximum privacy budget of 0.2 for medical history data in the first consortium, indicating that medical history data requires strong privacy protection in the first consortium region. The output for the second consortium is a maximum privacy budget of 1.5 for general personal information, indicating that the privacy protection strength for general personal information in the second consortium region is relatively low. Anonymization requirements include, for example, fully adding noise to medical history data and partially masking names, such as changing "Zhang San" to "Zhang *San".

[0046] The output of the LawGPT big data model needs to be specially adapted to cross-border scenarios: for the same data attribute, such as medical history, a differentiated maximum privacy budget needs to be output according to the differences in regulations in the target region, such as 0.2 for the first consortium and 1.5 for the second consortium. At the same time, it is clear that the budget is tied to the anonymization requirements of the data attribute. For example, medical history data in the first consortium needs to be completely noise-added, while ordinary personal information in the second consortium can be partially masked. This ensures that the regulatory quantification results directly serve the subsequent privacy budget allocation and noise injection, achieving a seamless transformation from regulatory requirements to technical parameters.

[0047] Step 1.3: Multimodal data feature awareness: Attribute-level sensitivity scoring: Attributes are split into structured and unstructured data, and the privacy protection priority of each attribute in the two types of data is evaluated, and the corresponding sensitivity score is output.

[0048] Step 1.3.1: Score the structured data.

[0049] Step 1.3.1.1: For structured data such as name, age, and medical history, score each attribute across three dimensions. Each dimension has a score range of 1 to 5, with 5 indicating the highest priority for that dimension. The three dimensions are: Impact of leakage: This refers to the degree of harm to users after data attributes are leaked. For example, the leakage of medical history data may lead to medical discrimination against users, and the impact of leakage is scored 5 points; the leakage of age data has a smaller impact on users, and the impact of leakage is scored 3 points. Compliance requirements: refers to the strictness of the regulations on the data attribute. For example, the First Alliance has stricter regulations on name than on age. The compliance requirement for name is 5 points, while the compliance requirement for age is 3 points. Data value: refers to the importance of data attributes to the business. For example, medical history data is more valuable for medical diagnosis than age. Medical history data is worth 5 points, while age data is worth 4 points.

[0050] Step 1.3.1.2: After scoring, the scores of 1 to 5 across the three dimensions of impact of leakage, compliance requirements, and data value need to be standardized using linear normalization, as detailed below: For each dimension, find the highest and lowest scores for all structured data attributes in that dimension; For each attribute's raw score in that dimension, the normalized score is calculated as (raw score - lowest score in that dimension) ÷ (highest score in that dimension - lowest score in that dimension). The normalized score ranges from 0 to 1. For example, the highest score for the leakage impact dimension is 5, and the lowest score is 3. If the raw score for a certain attribute is 5, the normalized score is (5-3) ÷ (5-3) = 1; if the raw score is 3, the normalized score is (3-3) ÷ (5-3) = 0.

[0051] Step 1.3.1.3: After standardizing the scale, calculate the sensitivity weights for structured data. The specific method is as follows: For each dimension, the entropy value is calculated based on the normalized score. The smaller the entropy value, the greater the difference in scores of each attribute under that dimension, and the more significant the impact on sensitivity. Subtract the entropy value of each dimension from 1 to obtain the difference coefficient for that dimension; Add up the difference coefficients of all dimensions, then divide the difference coefficient of each dimension by the total difference coefficient to obtain the structured data sensitivity weight for that dimension. For example, if the difference coefficient for the impact of a leak is 0.37, compliance requirements are 0.37, data value is 0.26, and the total difference coefficient is 1.0, the corresponding structured data sensitivity weights are 0.37, 0.37, and 0.26, respectively.

[0052] Step 1.3.1.4: Finally, multiply the structured data sensitivity weight of each dimension by the original score of that attribute in that dimension, and then add the results of the three dimensions to obtain the structured data attribute sensitivity score. For example, if name scores 5 points for impact of leakage, 5 points for compliance requirements, and 3 points for data value, the structured data attribute sensitivity score is approximately 0.37×5 + 0.37×5 + 0.26×3 ≈ 4.4. A higher structured data attribute sensitivity score requires stronger privacy protection. For example, a structured data sensitivity score of 5.0 for medical history requires stronger privacy protection than age data with a score of 3.3.

[0053] Step 1.3.2: Multimodal data attribute sensitivity scoring: For unstructured data, attribute splitting is performed first, and then sensitivity scores are calculated.

[0054] Step 1.3.2.1: Medical Image Attribute Decomposition and Scoring: For medical images, such as CT images, the lightweight image model MobileNet is used to extract image features and decompose them into two attributes: lesion area and background area.

[0055] The lesion area is a highly sensitive attribute, containing key information such as tumor location and size, while the background area is a low-sensitivity attribute, such as normal lung tissue. When calculating the sensitivity weights for multimodal data, adjustments are made based on the characteristics of the medical scenario: leakage impact weight 0.4, compliance requirement weight 0.4, and data value weight 0.2.

[0056] Each attribute is scored from 1 to 5 across three dimensions: 5 points for the impact of leakage in the lesion area, 5 points for compliance requirements, and 5 points for data value; 1 point for the impact of leakage in the background area, 1 point for compliance requirements, and 2 points for data value.

[0057] The multimodal data sensitivity score is obtained by multiplying the multimodal data sensitivity weight of each dimension by the score of that attribute in that dimension, and then summing the results of the three dimensions. For example, the multimodal data sensitivity score of the lesion area = 0.4×5 + 0.4×5 + 0.2×5 = 5.0; the multimodal data sensitivity score of the background area = 0.4×1 + 0.4×1 + 0.2×2 = 1.2.

[0058] Step 1.3.2.2: Diagnostic Text Attribute Decomposition and Scoring: For diagnostic text, such as medical records, the DistilBERT text model is used to extract semantic features, which are then decomposed into two attributes: diagnostic conclusion and symptom description. The diagnostic conclusion is a high-sensitivity attribute, such as late-stage lung cancer, while the symptom description is a medium-sensitivity attribute, such as cough and chest pain.

[0059] Using the same multimodal data sensitivity weights, with leakage impact at 0.4, compliance requirements at 0.4, and data value at 0.2, the multimodal data attribute sensitivity score is calculated after scoring: leakage impact of diagnostic conclusions scores 5 points, compliance requirements at 5 points, and data value at 4.8 points, so the multimodal data attribute sensitivity score = 0.4×5 + 0.4×5 + 0.2×4.8 ≈ 4.96; leakage impact of symptom descriptions scores 3 points, compliance requirements at 3 points, and data value at 3.5 points, so the multimodal data attribute sensitivity score = 0.4×3 + 0.4×3 + 0.2×3.5 ≈ 3.1.

[0060] After the above processing, the limitations of traditional unstructured data privacy protection are overcome. Medical CT images are split into highly sensitive lesion areas and low-sensitivity background areas, and diagnostic texts are split into highly sensitive diagnostic conclusions and moderately sensitive symptom descriptions. Combined with cross-border regulatory requirements, such as the strict constraints of the First Alliance GDPR on lesion data, attribute-level sensitivity scores are calculated to achieve fine-grained privacy protection of unstructured data and adapt to cross-border multimodal data transmission scenarios.

[0061] Step 2: Privacy Budget Allocation: Based on the deep Q-network algorithm, the structured situational awareness results are integrated, and privacy budget allocation is performed on each data attribute. The constraints of the allocation process include that the privacy budget of each data attribute is not lower than the preset technical lower limit, does not exceed the maximum privacy budget allowed by the corresponding regulations, and the sum of the budgets of all attributes does not exceed the link budget margin, thus obtaining the attribute-level privacy budget vector.

[0062] Furthermore, the privacy budget allocation process includes: Construct the state space of the deep Q-network model. The input information is the structured situational awareness results, including the attribute-level sensitivity scores of all data attributes, the maximum privacy budget allowed by regulations, the anomaly scores corresponding to the attack risk level, the side-channel attack strength value, and the link budget margin. Define the model action space as an attribute-level privacy budget vector; The model's experience replay pool, main network, and target network are initialized. An ε-greedy strategy is used to select actions. Samples are extracted from the experience replay pool to update the parameters of the main network. The parameters of the target network are updated at preset training time steps. The attribute-level privacy budget vector is obtained by maximizing the cumulative reward value using a composite reward function.

[0063] Furthermore, the composite reward function includes: a privacy protection benefit negatively correlated with the success rate of member inference attacks, the weight of which is dynamically adjusted according to the attack risk level; a data utility loss related to data perplexity, the weight of which is fixed; and a compliance score positively correlated with the degree of compliance of the attribute-level privacy budget vector, the weight of which is fixed.

[0064] Step 2.1: State space construction.

[0065] All key information output from the situational awareness phase is integrated into a structured environmental state, which serves as input to the deep Q-network model. The environmental state contains the following specific information: The sensitivity scores for all structured data attributes are as follows: name 4.4, age 3.3, medical history 5.0. Multimodal data attribute sensitivity scores for all multimodal data attributes, such as lesion area 5.0, background area 1.2, diagnosis conclusion 4.96, and symptom description 3.1; Each data attribute is assigned a maximum privacy budget according to the regulations of the target region, for example, name 0.8, age 1.5, medical history 0.2, lesion area 0.15, background area 1.8, diagnosis conclusion 0.2, and symptom description 1.5; Members infer the anomaly score corresponding to the attack risk level, for example, 0.68 for medium risk; Side-channel attack strength value, for example, 1.4; The budget margin for the transmission link, for example, 0.3.

[0066] For example, for a medical data transmission link from the first country to the first alliance, the environmental status can be described as: [Name 4.4, Age 3.3, Medical History 5.0, Lesion Area 5.0, Background Area 1.2, Diagnosis Conclusion 4.96, Symptom Description 3.1, Name 0.8, Age 1.5, Medical History 0.2, Lesion Area 0.15, Background Area 1.8, Diagnosis Conclusion 0.2, Symptom Description 1.5, 0.68, 1.4, 0.3], ensuring that the deep Q-network model can fully perceive the current transmission environment.

[0067] Step 2.2: Define the action space.

[0068] The action of a deep Q-network model is an attribute-level privacy budget vector, which means assigning a specific privacy budget value to each data attribute. This assignment must satisfy three constraints: The privacy budget for each data attribute cannot exceed the maximum privacy budget allowed by regulations in the target region. For example, the maximum privacy budget allowed by regulations for a lesion area in the First Alliance region is 0.15, and the allocated privacy budget for the lesion area cannot exceed 0.15. The privacy budget for each data attribute must not be lower than the technical lower limit, which is set at 0.1 to avoid the data becoming completely unusable due to excessive noise. For example, the privacy budget for age data must not be lower than 0.1. The sum of the privacy budget values ​​for all data attributes must not exceed the budget margin of the transmission link. For example, if the link budget margin is 0.3, the sum of the privacy budget values ​​for all attributes must be ≤0.3.

[0069] For example, when allocating a privacy budget for a medical data transmission link from the first country to the first alliance, the attribute-level privacy budget vector that meets the constraints can be set as follows: name 0.04, age 0.04, medical history 0.04, lesion area 0.04, background area 0.04, diagnosis conclusion 0.04, symptom description 0.04, with the sum of all values ​​being 0.28, and each value satisfying the first two constraints.

[0070] Step 2.3: Design of reward function.

[0071] A composite reward function is designed to quantify the quality of privacy budget allocation decisions in each round, guiding a deep Q-network model to learn the optimal policy. The result of the composite reward function is called the reward value, which consists of three parts, as follows: Privacy protection benefits are negatively correlated with the success rate of member-inferred attacks. The lower the success rate of member-inferred attacks, such as 10%, the higher the privacy protection benefits. The weight of privacy protection benefits is dynamically adjusted according to the risk level of member-inferred attacks: when the attack risk level is high, the weight is set to 0.5; when it is medium risk, the weight is set to 0.4; and when it is low risk, the weight is set to 0.3. For example, if the weight corresponding to medium risk is 0.4 and the success rate of member-inferred attacks is 10%, the privacy protection benefit = 0.4 × (1 - 10%) = 0.36.

[0072] Data utility loss: Negatively correlated with the usability of the noisy data. The lower the usability of the noisy data, for example, if the diagnostic accuracy of medical data drops from 95% to 70%, the higher the data utility loss. The weight of data utility loss is fixed at 0.3, which is set through expert experience to balance privacy protection and data usability. The calculation method for data utility loss is: (Perplexity of the noisy data - Perplexity of the original data) ÷ Perplexity of the original data. Perplexity is an indicator of data usability; the higher the perplexity, the lower the data usability. For example, if the perplexity of the original data is 100 and the perplexity of the noisy data is 105, the data utility loss = (105 - 100) ÷ 100 = 0.05, and the corresponding deduction item = 0.3 × 0.05 = 0.015.

[0073] Compliance Score: Positively correlated with the compliance level of the attribute-level privacy budget vector. If the privacy budget values ​​of all data attributes comply with the maximum privacy budget allowed by regulations, and no attribute exceeds the limit, the compliance score is 1 point. If any attribute exceeds the limit, the score is deducted based on the average of (the value exceeding the limit ÷ the maximum privacy budget allowed by regulations). For example, if an attribute exceeds the limit by 0.1, and the maximum privacy budget allowed by regulations is 0.2, the deduction score = 0.1 ÷ 0.2 = 0.5, and the compliance score = 1 - 0.5 = 0.5. The weight of the compliance score is fixed at 0.3 to ensure compliance priority. For example, a compliance score of 1 corresponds to a compliance benefit of 0.3 × 1 = 0.3.

[0074] The final reward value is calculated as follows: Privacy protection benefit - Data utility loss deduction + Compliance benefit. For example, in the example above, the reward value = 0.36 - 0.015 + 0.3 = 0.645. The Deep Q-Network model learns a privacy budget allocation method that maximizes cumulative reward value, achieving high privacy, high utility, and high compliance.

[0075] Step 2.4: Training and inference of the deep Q-network model.

[0076] Step 2.4.1: Initialize the core components of the deep Q-network model, specifically including: Experience replay pool: Used to store sample data during training, with a capacity of 10,000 samples. Each sample contains the current environment state, current action, current reward value, and next environment state. The current action is an attribute-level privacy budget vector. Main network: Used to predict the value of each action, i.e. the expected reward value corresponding to the action. The network structure includes an input layer, two fully connected hidden layers and an output layer. The input layer dimension is consistent with the environmental state dimension, for example, 17 dimensions. The first fully connected hidden layer has 64 neurons and the second layer has 32 neurons, both using the ReLU activation function. The output layer dimension is consistent with the action space size, for example, 1000 possible action combinations correspond to 1000 dimensions. Target network: Used to stabilize the training process. Its initial parameters are exactly the same as those of the main network. The parameters are updated every 100 training time steps to reflect the current parameters of the main network.

[0077] Step 2.4.2: The training process is carried out in cycles, with a total of 1000 training cycles. Each training cycle contains 50 training time steps. The specific steps are as follows: The initial environmental state is obtained from the multi-dimensional situational awareness stage and input into the main network; Within each training time step, an ε-greedy strategy is used to select actions: the ε value is set to 0.1, meaning that there is a 90% probability of selecting the action with the highest prediction value from the main network, and a 10% probability of randomly selecting an action to explore more potential optimal strategies. Perform the selected action, namely, allocate the privacy budget according to the attribute-level privacy budget vector, calculate the corresponding reward value, and obtain the next environmental state after the action is performed; Store the current environment state, current action, current reward value, and next environment state into the experience replay pool; When the number of samples in the experience replay pool is ≥32, 32 samples are randomly drawn from the experience replay pool. The target network is used to predict the maximum action value corresponding to the next environmental state, and the target action value is calculated by combining the current reward value. The target action value = current reward value + discount factor × maximum action value of the next environmental state. The discount factor is set to 0.9. The main network is used to predict the current environmental state and the predicted action value corresponding to the current action. The mean square error between the predicted action value and the target action value is calculated, which is the loss value. Minimize the loss value using the Adam optimizer, set the learning rate to 0.001, and update the parameters of the main network; Every 100 training time steps, the parameters of the main network are copied to the target network, and the parameters of the target network are updated.

[0078] After training, the real-time environment state is input into the main network, which outputs the predicted value of each action. The action with the highest predicted value is selected as the final attribute-level privacy budget vector for subsequent data processing.

[0079] Step 3: Explainability and Auditability: Conduct causal analysis on the decision-making process of the deep Q network model, and combine the consortium blockchain to perform evidence storage and smart contract auditing on key information of the entire cross-border data transmission process, to obtain a causally explainable report and tamper-proof audit records. The key information of the entire cross-border data transmission process includes the digital signatures of the participants.

[0080] Furthermore, the causal analysis includes: constructing a causal relationship graph, where nodes represent structured data attribute sensitivity scores, multimodal data attribute sensitivity scores, maximum privacy budget allowed by regulations, attack risk level, and side-channel attack strength value. The causal relationship is as follows: the higher the sensitivity score, the smaller the maximum privacy budget allowed by regulations; the higher the attack risk level, the greater the side-channel attack strength value, and the smaller the privacy budget value of the corresponding data attribute. An intervention analysis method is used to fix the node values ​​and observe changes in the privacy budget, derive the contribution of each node, and generate a causally explainable report. The smart contract auditing process includes: storing structured situational awareness results, attribute-level privacy budget vectors, causal interpretable reports, digital signatures and timestamps of participating parties using a consortium blockchain framework; deploying smart contracts on the consortium blockchain; calculating the cumulative privacy budget of sequential links and the cumulative privacy budget of parallel links; and automatically freezing links and issuing alarms when the total cumulative privacy budget reaches a preset global budget threshold.

[0081] Step 3.1: Generate a causal explainable report.

[0082] Step 3.1.1: First, construct a causal relationship diagram to clarify the causal relationship between the key factors affecting the allocation of the privacy budget and the value of the privacy budget. The specific nodes and relationships are as follows: Nodes: Structured data attribute sensitivity score, multimodal data attribute sensitivity score, maximum privacy budget allowed by regulations, member inference attack risk level, and side-channel attack strength value; Causal relationships: The higher the sensitivity score of structured data attributes, the smaller the corresponding privacy budget; the higher the sensitivity score of multimodal data attributes, the smaller the corresponding privacy budget; the smaller the maximum privacy budget allowed by regulations, the smaller the corresponding privacy budget; the higher the risk level of member inference attacks and the larger the anomaly score, the smaller the corresponding privacy budget; the larger the side-channel attack strength value, the smaller the corresponding privacy budget.

[0083] Step 3.1.2: Based on the causal relationship diagram, use intervention analysis to deduce the contribution of each factor to the privacy budget value. Intervention analysis refers to fixing the value of a certain factor and observing the change in the privacy budget value. For example, fix the sensitivity score of the multimodal data attribute of the lesion area to 5.0, keep other factors unchanged, observe the change in the privacy budget value of the lesion area, and then determine the contribution of the factor.

[0084] Step 3.1.3: Finally, invoke the LawGPT large-scale legal model to generate a causal interpretable report in natural language format. The report should include the following: The reasons for determining the privacy budget value for each data attribute are as follows: For example, the privacy budget value for the lesion area is 0.04, and the reasons include: the multimodal data attribute sensitivity score is 5.0, the maximum privacy budget allowed by the First Consortium regulations is 0.15, and the current side-channel attack strength value is 1.4, which is high risk. Counterfactual results refer to the direction in which the privacy budget value is adjusted if a key factor changes. For example, if the side-channel attack strength value drops from 1.4 to 0.5 (low risk), the privacy budget value for the lesion area can be increased to 0.08, still in compliance with regulatory requirements.

[0085] Causal explanation reports need to ensure that non-technical personnel, such as regulatory staff, can clearly understand the decision-making logic.

[0086] Step 3.2: Consortium blockchain notarization and smart contract auditing.

[0087] Step 3.2.1: Use a consortium blockchain to store key data throughout the entire cross-border data transmission process. The specific framework of the consortium blockchain is Hyperledger Fabric, and the stored data content is as follows: Environmental state information, namely the structured environmental state constructed in step 2.1; The final output is the attribute-level privacy budget vector; A report on causal explanation; Digital signatures from all participating parties, including data senders, data receivers, and regulatory agencies, are used to ensure the traceability of data sources. A timestamp records the exact time when the data was generated, accurate to the second.

[0088] The consortium blockchain uses a blockchain-style storage method. Each block contains the aforementioned data and the hash value of the previous block. The hash value is a unique string generated by an encryption algorithm. If the data in the previous block is tampered with, the hash value will change, thus ensuring that the stored data cannot be tampered with.

[0089] Step 3.2.2: Deploy a smart contract on the consortium blockchain. The smart contract is pre-written, automatically executed code used to calculate the cumulative privacy budget for cross-border transfers. The specific calculation rules are as follows: Sequence link refers to multiple rounds of cross-border transmissions for the same user: the cumulative privacy budget is the sum of all values ​​in the attribute-level privacy budget vector of each round of transmission. For example, if the sum of the attribute-level privacy budget vectors of a user's three rounds of transmissions are 0.3, 0.28, and 0.32 respectively, the cumulative privacy budget of the sequence link = 0.3 + 0.28 + 0.32 = 0.9; Parallel links refer to simultaneous cross-border transmission by different users: the cumulative privacy budget is the maximum sum of the privacy budget vectors at the attribute level of each link. The cumulative privacy budget of a parallel link is the maximum sum of the privacy budget vectors at the attribute level of each link among all parallel links. For example, if the sum of the privacy budget vectors at the attribute level of two parallel links is 0.3 and 0.25 respectively, the cumulative privacy budget of the parallel link is 0.3. Total cumulative privacy budget = cumulative privacy budget for sequential links + cumulative privacy budget for parallel links.

[0090] The smart contract pre-sets a global budget threshold, which is determined by the regulatory agency. For example, in version 3.0, if the total cumulative privacy budget is greater than or equal to the global budget threshold, the smart contract will automatically perform two operations: first, freeze the current cross-border transmission link and prohibit new transmission requests; second, send an alert message to the regulatory agency, such as a text message or email, to indicate that the budget has exceeded the threshold.

[0091] All audit records, including cumulative privacy budget calculation results and alarm records, are stored in the consortium blockchain in real time to ensure compliance throughout the cross-border transmission process, and the audit records are permanently traceable.

[0092] By constructing an audit closed loop of causal explanation reports and consortium blockchain evidence storage, compared to traditional consortium blockchains that only store budget allocation results, the causal explanation reports are incorporated into on-chain evidence storage. At the same time, the cumulative privacy budget is automatically calculated and triggered with over-threshold alarms through smart contracts, which solves the black box problem of reinforcement learning models and meets the compliance requirements of cross-border regulation for traceability and explainability.

[0093] Step 4: Execution and Response: Based on the attribute-level privacy budget vector, attribute-level noise is injected into different types of data attributes to monitor sudden risks during transmission in real time. Based on the sensitivity level of data attributes and the priority of transmission links, adaptive dynamic adjustments are made to obtain secure data that can be transmitted across borders.

[0094] Furthermore, the attribute-level noise injection includes: for numerical data, using the Laplace mechanism for injection; for discrete data, using the exponential mechanism for injection; for medical image data, using the feature-level Laplace mechanism to add noise; and for text data, using the word embedding perturbation mechanism to add noise.

[0095] Furthermore, the adaptive dynamic adjustment process includes: employing an extreme gradient boosting model, combining link type and data sensitivity mean to predict the dynamic threshold for side-channel attacks and the dynamic warning value for link budget; when the detected side-channel attack strength value exceeds the dynamic threshold, the link budget margin is lower than the dynamic warning value, or a regulatory update in the target area is detected, adjustments are triggered: adjusting the privacy budget value according to the data attribute sensitivity level; freezing low-priority links and stopping the allocation of new budgets, transferring the saved budget to high-priority links; interrupting the current transmission, reacquiring the structured situational awareness results, and initiating a new round of deep Q network model decision-making.

[0096] Step 4.1: Attribute-level noise injection.

[0097] The appropriate privacy protection mechanism is selected based on the type of data attribute. Noise is added to each attribute to generate secure data that can be transmitted. The types of data attributes include numerical, discrete, medical images, and text.

[0098] Step 4.1.1: Noise Injection into Numerical Data: Numerical data includes age and medical history indicators, etc. Noise is added using the Laplace mechanism. The specific steps are as follows: Determine the raw values ​​of numerical data, for example, the raw value of a medical history indicator is 120 mg / dL; The attribute sensitivity of the data attribute is determined. The attribute sensitivity is set by domain experts. The attribute sensitivity of numerical data refers to the maximum amount of change that the data may undergo. For example, the attribute sensitivity of a medical history indicator is set to 20 mg / dL. Determine the privacy budget value for the data attribute from the attribute-level privacy budget vector output in step 2.4. For example, the privacy budget value for the medical history indicator is 0.06. The Laplace distribution scale parameter is calculated as follows: attribute sensitivity ÷ privacy budget value. For example, scale parameter = 20 ÷ 0.06 ≈ 333.33 mg / dL. A noise value is randomly sampled from the Laplace distribution. The characteristic of the Laplace distribution is that the closer the value is to 0, the higher the probability of its occurrence. For example, the sampled noise value is 45.2 mg / dL. Add the noise value to the original value to obtain the noise-added safety data, for example, 120 + 45.2 = 165.2 mg / dL.

[0099] Step 4.1.2: Noise Injection into Discrete Data: Discrete data includes names, etc., and noise is added using an exponential mechanism. The specific steps are as follows: Determine the original values ​​of discrete data, for example, the original value of a name is Zhang San; Construct a fuzzy option set containing multiple fuzzy results similar to the original value. For example, the fuzzy option set for the name is Zhang San, Zhang Ming, and Li* San. Calculate the similarity score between each fuzzy option and the original value, which is the utility function value. The higher the similarity, the higher the score. For example, the similarity score between Zhang San and Zhang San is 0.9, Zhang Ming is 0.7, and Li*san is 0.3. Determine the utility function sensitivity of the data attribute. The utility function sensitivity is set by domain experts and is the maximum possible change in the similarity score. For example, the utility function sensitivity of the name is set to 0.2. Determine the privacy budget value for this data attribute, for example, the privacy budget value for name is 0.05; The probability of selecting each fuzzy option is calculated as follows: Exponential function (Privacy budget value × Similarity score ÷ (2 × Utility function sensitivity)) ÷ Sum of the exponential function results of all fuzzy options. For example, the probability of selecting Zhang*san is: Exponential function (0.05 × 0.9 ÷ (2 × 0.2)) ÷ (Exponential function (0.05 × 0.9 ÷ 0.4) + Exponential function (0.05 × 0.7 ÷ 0.4) + Exponential function (0.05 × 0.3 ÷ 0.4)) ≈ 1.119 ÷ 3.248 ≈ 0.344; A fuzzy option is randomly selected based on the selection probability and used as the safe data after adding noise, for example, Zhang*san is selected.

[0100] Step 4.1.3: Medical Image Noise Injection: Noise is added to the lesion and background areas in medical images using a feature-level Laplacian mechanism. The specific steps are as follows: Extract feature maps of lesion areas and background areas from medical images using the MobileNet model in step 1.3.2. For example, the pixel value of a certain feature map of the lesion area is 0.6. The feature sensitivity of the feature map is determined. The feature sensitivity is set by medical experts and is the maximum possible change in the pixel value of the feature map. For example, the feature sensitivity of the lesion area is set to 0.5. Determine the privacy budget value for this area; for example, the privacy budget value for the lesion area is 0.04. The Laplace distribution scale parameter is calculated as: feature sensitivity ÷ privacy budget value. For example, scale parameter = 0.5 ÷ 0.04 = 12.5. Sample noise values ​​from the Laplace distribution, for example, sample to obtain 0.3; The noise value is added to the pixel value of the feature map to obtain the noisy feature map; The image decoder reconstructs the noisy feature map into a medical image, which serves as the noisy security data. Noise is added to the lesion area to hide key privacy information, while only a small amount of noise is added to the background area to preserve the image's usability.

[0101] Step 4.1.4: Noise Injection into Text Data: Noise is added to the diagnostic conclusions and symptom descriptions in the diagnostic text using a word embedding perturbation mechanism. The specific steps are as follows: Extract the word embedding vectors of the text attributes using the DistilBERT model in step 1.3.2. For example, the word embedding vector for the diagnosis of late-stage lung cancer is [0.2, 0.5, -0.1], only the first 3 dimensions are shown, but the actual number is 768. The embedding sensitivity of the word embedding vector is determined. The embedding sensitivity is set by natural language processing experts and is the maximum possible change in the word embedding vector value. For example, the embedding sensitivity of the diagnostic conclusion is set to 0.3. Determine the privacy budget value for this text attribute; for example, the privacy budget value for a diagnostic conclusion is 0.05. The Laplace distribution scale parameter is calculated as follows: embedding sensitivity ÷ privacy budget value. For example, scale parameter = 0.3 ÷ 0.05 = 6. Sample a noise vector from the Laplace distribution, for example, sample [0.4, 0.1, -0.2]; Add the noise vector to the original word embedding vector to obtain the noisy word embedding vector; The text generation model reconstructs the noisy word embedding vectors into text, which serves as the safe data after adding noise. For example, late-stage lung cancer is reconstructed as malignant lung lesions, and mild cough and chest pain are adjusted to cough and chest discomfort.

[0102] Step 4.2: Adaptive dynamic adjustment.

[0103] We monitor three types of unforeseen risks during cross-border data transmission in real time. Once a risk condition is triggered, we immediately adjust our privacy protection strategy, as follows: Risk triggering conditions: The side-channel attack strength value exceeds the dynamic threshold. The dynamic threshold is predicted by the extreme gradient boosting model XGBoost based on characteristics such as link type and average data sensitivity. For example, the dynamic threshold for the medical data link from the first country to the first alliance is 0.75, and the dynamic threshold for the marketing data link from the first country to the second alliance is 0.9. The budget margin of the transmission link is lower than the dynamic warning value, which is also predicted by the extreme gradient boosting model. For example, the dynamic warning value of the high-sensitivity data link is 0.3, and the dynamic warning value of the low-sensitivity data link is 0.2. The LawGPT big data model detected updates to privacy regulations in the target region, and the updates involved adjustments to privacy budget values. For example, the First Consortium lowered the maximum privacy budget allowed by regulations for the affected area from 0.15 to 0.12.

[0104] Adjust strategy: Privacy budget adjustment: Attributes with a sensitivity score of ≥4.5 for structured data attributes or ≥4.5 for multimodal data attributes are considered highly sensitive. Attributes with a sensitivity score between 3.0 and 4.5 in structured data or between 3.0 and 4.5 in multimodal data are considered moderately sensitive. Attributes with a sensitivity score of less than 3.0 in structured data or less than 3.0 in multimodal data are considered low-sensitivity attributes. Privacy budget values ​​for highly sensitive attributes are reduced by 20%, for example, the privacy budget value for lesion areas is reduced from 0.04 to 0.04 × 0.8 = 0.032; privacy budget values ​​for moderately sensitive attributes are reduced by 10%, and the reduced privacy budget value must not be lower than the technical lower limit of 0.1, for example, the privacy budget value for symptom description is reduced from 0.02 to 0.02 × 0.9 = 0.018; privacy budget values ​​for low-sensitivity attributes remain unchanged. Link priority scheduling: Freeze low-priority links, such as those transmitting marketing data or general user behavior data, stop allocating new privacy budgets to them, and transfer the saved budgets to high-priority links, such as those transmitting medical data or financial data. Re-decision closed loop: interrupt the current cross-border transmission, return to the multi-dimensional situational awareness stage, re-collect environmental state information, including updated attack intensity, regulatory requirements, and budget margin, initiate a new round of deep Q network model decision-making, generate a new attribute-level privacy budget vector, and then execute the attribute-level noise injection in step 4.1 to ensure data privacy and security under sudden risks.

[0105] By employing the XGBoost extreme gradient boosting model to predict dynamic thresholds, compared to traditional fixed thresholds (such as a high-risk threshold of 0.8 for all links' side-channel attacks), dynamic thresholds can adapt to different scenarios based on link type and average data sensitivity. For example, the threshold for the first alliance's medical link is 0.75, and the threshold for the second alliance's marketing link is 0.9. This avoids overprotection in low-risk scenarios and insufficient protection in high-risk scenarios, thus improving threshold adaptability.

[0106] Example 2 Based on the same inventive concept as the differential privacy-based cross-border personal data transmission security detection method provided in the embodiments of this application, the embodiments of this application also provide a differential privacy-based cross-border personal data transmission security detection system. If there is anything unclear about the content of the system embodiment, please refer to the corresponding content in the method embodiment.

[0107] like Figure 2 As shown, a cross-border personal data transmission security detection system based on differential privacy includes: The multi-dimensional situational awareness module collects and quantifies in real time the technical environment risks, multi-country regulatory constraints, and multi-modal data characteristics that affect the security of cross-border data transmission. It transforms fuzzy information into structured situational awareness results and outputs comprehensive data including attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity score. The privacy budget allocation module receives the structured situational awareness results, integrates the input information through the deep Q-network algorithm, and allocates the optimal privacy budget for each data attribute under the constraints that the privacy budget for each data attribute is not lower than the technical lower limit, does not exceed the maximum privacy budget allowed by regulations, and the sum of the budgets of all attributes does not exceed the link budget margin. The module outputs an attribute-level privacy budget vector. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, performs causal analysis on the decision-making process of the deep Q-network model to generate a natural language interpretable report, and uses consortium blockchain technology to store and transmit key information throughout the process. It automatically calculates the cumulative privacy budget and triggers audit alarms through smart contracts, thereby achieving interpretable decision-making and traceable processes. The execution response module receives the attribute-level privacy budget vector, performs differentiated attribute-level noise injection on different types of data attributes to generate secure data, and monitors sudden risks during transmission in real time. Based on the sensitivity level of data attributes and the priority of transmission links, it dynamically adjusts the privacy protection strategy to ensure the continuous security and compliance of cross-border data transmission.

[0108] Furthermore, the multi-dimensional situational awareness module includes a technology awareness unit, a regulatory awareness unit, and a multimodal data awareness unit. The technology awareness unit receives cross-border transmission request logs and device sensor signals, detects members using the isolated forest algorithm to infer attacks and calculates attack risk levels, determines the maximum privacy budget for the link and calculates the budget margin using a legal big model, and calculates the side-channel attack strength value through electromagnetic signal analysis. The regulatory awareness unit receives multi-country regulatory texts and target region information, and outputs compliance rules through knowledge graph construction and legal big model parsing. The multimodal data awareness unit receives structured and unstructured data, and outputs attribute-level sensitivity scores through attribute splitting and sensitivity assessment. The multi-dimensional situational awareness module transmits the integrated structured situational awareness results to the privacy budget allocation module and the interpretable audit module. The privacy budget allocation module receives the structured situational awareness results, constructs the state space of the deep Q-network model, and the inputs include the sensitivity scores of all data attributes, the maximum privacy budget allowed by regulations, the attack risk level index, the side-channel attack strength value, and the link budget margin. The action space is defined as an attribute-level privacy budget vector that satisfies multiple constraints. The optimal allocation scheme is output through reinforcement learning training, and the attribute-level privacy budget vector is transmitted to the interpretable audit module and the execution response module. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, constructs a causal relationship graph, and derives the contribution of each factor through intervention analysis to generate a causal interpretable report. Simultaneously, it uses the consortium blockchain to store the environment state, privacy budget vectors, interpretable report, digital signatures, and timestamps, and calculates the cumulative privacy budget of sequential and parallel links through deployed smart contracts. When the cumulative privacy budget exceeds a global threshold, the module automatically freezes the link and issues an alarm. Audit records are transmitted to the regulator in real time. The execution response module receives an attribute-level privacy budget vector and performs noise injection using a Laplace mechanism for numerical data, an exponential mechanism for discrete data, a feature-level Laplace mechanism for medical images, and a word embedding perturbation mechanism for text data to generate secure data. Simultaneously, it monitors the side-channel attack strength, budget margin, and regulatory updates in real time, uses a machine learning model to predict dynamic thresholds, triggers a closed loop of privacy budget value adjustment, link priority scheduling, and re-decision, and feeds the adjusted strategy back to the privacy budget allocation module for iterative optimization.

[0109] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A method for secure detection of cross-border personal data transmission based on differential privacy, characterized in that, Includes the following steps: Multidimensional situational awareness processing is performed on three types of information: technical environment risks, multi-country regulatory constraints, and multimodal data characteristics in cross-border personal data transmission environments. This results in structured situational awareness results that include attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity scores. Based on the deep Q-network algorithm, the structured situational awareness results are integrated, and privacy budget allocation is performed on each data attribute. The constraints of the allocation process include that the privacy budget of each data attribute is not lower than the preset technical lower limit, does not exceed the maximum privacy budget allowed by the corresponding regulations, and the sum of the budgets of all attributes does not exceed the link budget margin, thus obtaining the attribute-level privacy budget vector. Causal analysis of the decision-making process of the deep Q network model is performed. At the same time, the key information of the entire cross-border data transmission process is stored and audited by smart contracts in conjunction with the consortium blockchain. The result is a causally explainable report and an immutable audit record. The key information of the entire cross-border data transmission process includes the digital signatures of the participants. Based on the attribute-level privacy budget vector, attribute-level noise is injected into each type of data attribute to monitor sudden risks during transmission in real time. Based on the data attribute sensitivity level and transmission link priority, adaptive dynamic adjustment is performed to obtain secure data that can be transmitted across borders.

2. The cross-border personal data transmission security detection method based on differential privacy according to claim 1, characterized in that, The multi-dimensional situational awareness processing includes: Technical environment risk perception: The isolated forest algorithm is used to extract the request frequency, data access range and transmission latency characteristics of cross-border transmission requests, and perform member inference attack detection to obtain the attack risk level; the legal big model is called to determine the maximum privacy budget for each cross-border transmission link, and the link budget margin is calculated by the difference between the maximum privacy budget and the privacy budget used in the link's history; the real-time electromagnetic signals of the transmission equipment are collected by electromagnetic radiation sensors, and the variance of the real-time electromagnetic signals is compared with the preset normal signal baseline to calculate the side channel attack strength value; Multi-country regulatory constraint perception: Extract entities such as jurisdiction, data attributes and regulatory clauses from privacy law texts of multiple countries, label the constraint relationships between entities and store them in a graph database to form a cross-border compliance knowledge graph; Adjust the legal big model, input the target region name and data attribute type, and quantify fuzzy regulatory clauses to obtain compliance rules. Multimodal data feature perception: A lightweight image model is used to extract medical image features, which are then divided into lesion regions and background regions, and attribute-level sensitivity scores are calculated; a text model is used to extract semantic features of diagnostic text, which are then divided into diagnostic conclusions and symptom descriptions, and attribute-level sensitivity scores are calculated.

3. The cross-border personal data transmission security detection method based on differential privacy according to claim 2, characterized in that, The compliance rules include the maximum privacy budget allowed by regulations and anonymization requirements; Based on the attribute-level sensitivity score, the data attribute sensitivity level is divided into high-sensitivity attributes, medium-sensitivity attributes, and low-sensitivity attributes. The transmission link priority is divided into high-priority links and low-priority links.

4. The cross-border personal data transmission security detection method based on differential privacy according to claim 1, characterized in that, The privacy budget allocation process includes: Construct the state space of the deep Q-network model. The input information is the structured situational awareness results, including the attribute-level sensitivity scores of all data attributes, the maximum privacy budget allowed by regulations, the anomaly scores corresponding to the attack risk level, the side-channel attack strength value, and the link budget margin. Define the model action space as an attribute-level privacy budget vector; The model's experience replay pool, main network, and target network are initialized. An ε-greedy strategy is used to select actions. Samples are extracted from the experience replay pool to update the parameters of the main network. The parameters of the target network are updated at preset training time steps. The attribute-level privacy budget vector is obtained by maximizing the cumulative reward value using a composite reward function.

5. The cross-border personal data transmission security detection method based on differential privacy according to claim 1, characterized in that, The causal analysis includes: A causal relationship graph was constructed, with nodes representing the sensitivity scores of structured data attributes, the sensitivity scores of multimodal data attributes, the maximum privacy budget allowed by regulations, the attack risk level, and the side-channel attack strength value. The causal relationship was as follows: the higher the sensitivity score, the smaller the maximum privacy budget allowed by regulations; the higher the attack risk level, the greater the side-channel attack strength value, and the smaller the privacy budget value of the corresponding data attribute. An intervention analysis method was used to fix the node values ​​and observe the changes in the privacy budget, derive the contribution of each node, and generate a causal interpretable report. The smart contract auditing process includes: The system uses a consortium blockchain framework to store structured situational awareness results, attribute-level privacy budget vectors, causal interpretable reports, digital signatures and timestamps of participating parties; smart contracts are deployed on the consortium blockchain to calculate the cumulative privacy budget of sequential links and the cumulative privacy budget of parallel links. When the total cumulative privacy budget reaches the preset global budget threshold, the link is automatically frozen and an alarm is triggered.

6. The cross-border personal data transmission security detection method based on differential privacy according to claim 1, characterized in that, The attribute-level noise injection includes: For numerical data, the Laplace mechanism is used to calculate the Laplace distribution scale parameter based on the data attribute sensitivity and attribute-level privacy budget. The sampled noise value is added to the original value to obtain secure data. For discrete data, an exponential mechanism is used to construct a fuzzy option set and calculate the similarity score. The selection probability is determined based on the utility function sensitivity and the corresponding privacy budget, and the safe data is obtained by randomly selecting options. For medical imaging data, a feature-level Laplacian mechanism is used to add noise; For text data, noise is added using a word embedding perturbation mechanism.

7. The cross-border personal data transmission security detection method based on differential privacy according to claim 3, characterized in that, The adaptive dynamic adjustment includes: An extreme gradient boosting model is used, combined with the link type and the mean of data sensitivity, to predict the dynamic threshold of side-channel attacks and the dynamic early warning value of link budget; When the side-channel attack strength value exceeds the dynamic threshold, the link budget margin is lower than the dynamic warning value, or the target region's regulations are updated, an adjustment is triggered: the privacy budget value is adjusted according to the data attribute sensitivity level. Freeze low-priority links and stop allocating new budgets, transferring the saved budgets to high-priority links; interrupt the current transmission, reacquire structured situational awareness results, and initiate a new round of deep Q-network model decision-making.

8. The cross-border personal data transmission security detection method based on differential privacy according to claim 4, characterized in that, The composite reward function includes: Privacy protection benefits are negatively correlated with the success rate of member-inferred attacks, and the weight of privacy protection benefits is dynamically adjusted according to the attack risk level. Data utility loss related to data perplexity, with fixed weights; and The compliance score is positively correlated with the level of compliance of the attribute-level privacy budget vector, and the weight of the compliance score is fixed.

9. A cross-border personal data transmission security detection system based on differential privacy, used in accordance with the cross-border personal data transmission security detection method based on differential privacy as described in any one of claims 1 to 8, characterized in that, include: The multi-dimensional situational awareness module collects and quantifies in real time the technical environment risks, multi-country regulatory constraints, and multi-modal data characteristics that affect the security of cross-border data transmission, transforms them into structured situational awareness results, and outputs comprehensive data including attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity score. The privacy budget allocation module receives the structured situational awareness results, integrates the input information through the deep Q-network algorithm, and allocates the optimal privacy budget for each data attribute under the constraints that the privacy budget for each data attribute is not lower than the technical lower limit, does not exceed the maximum privacy budget allowed by regulations, and the sum of the budgets of all attributes does not exceed the link budget margin. The module outputs an attribute-level privacy budget vector. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, performs causal analysis on the decision-making process of the deep Q-network model to generate a natural language interpretable report, and uses consortium blockchain technology to store and transmit key information throughout the process. It also automatically calculates the cumulative privacy budget and triggers audit alerts through smart contracts. The execution response module receives the attribute-level privacy budget vector, performs differentiated attribute-level noise injection for each type of data attribute to generate secure data, and monitors sudden risks during transmission in real time, dynamically adjusting the privacy protection strategy based on the data attribute sensitivity level and transmission link priority.

10. The cross-border personal data transmission security detection system based on differential privacy according to claim 9, characterized in that, The multi-dimensional situational awareness module includes a technology awareness unit, a regulatory awareness unit, and a multimodal data awareness unit. The technology awareness unit receives cross-border transmission request logs and device sensor signals, detects members using the isolated forest algorithm to infer attacks and calculate attack risk levels, determines the maximum privacy budget for the link using a legal big data model and calculates the budget margin, and calculates the side-channel attack strength value through electromagnetic signal analysis. The regulatory awareness unit receives multi-national regulatory texts and target region information, and outputs compliance rules through knowledge graph construction and legal big data model parsing. The multimodal data awareness unit receives structured and unstructured data, and outputs attribute-level sensitivity scores through attribute splitting and sensitivity assessment. The privacy budget allocation module receives the structured situational awareness results, constructs the state space of the deep Q-network model, defines the action space as an attribute-level privacy budget vector, and outputs the optimal allocation scheme through reinforcement learning training. The interpretable audit module receives attribute-level privacy budget vectors and structured situational awareness results, constructs a causal relationship graph, derives the contribution of each factor through intervention analysis, generates a causal interpretable report, uses the consortium blockchain to store the environment state, privacy budget vector, interpretable report, digital signature, and timestamp, and calculates the cumulative privacy budget of sequential links and parallel links through deployed smart contracts. When the global threshold is exceeded, the link is automatically frozen and an alarm is triggered; the audit record is transmitted to the regulator in real time. The execution response module receives an attribute-level privacy budget vector, employs a Laplace mechanism for numerical data, an exponential mechanism for discrete data, a feature-level Laplace mechanism for medical images, and a word embedding perturbation mechanism for text data to inject noise, generating secure data. It monitors side-channel attack strength, budget margin, and regulatory updates in real time, uses machine learning models to predict dynamic thresholds, triggers privacy budget value adjustments, link priority scheduling, and a closed loop of re-decision, and feeds the adjusted strategy back to the privacy budget allocation module for iterative optimization.

Images