Privacy risk detection method, device and equipment of medical RAG system and storage medium

Abstract

The application discloses a privacy risk detection method, device and equipment of a medical RAG system and a storage medium, wherein a cascade design of a Bloom filter and a MinHash is used to greatly reduce the similarity detection complexity on a large-scale document set, millisecond-level response can be realized under typical hardware conditions, the delay is low, the online medical RAG scene is suitable, not only the text surface similarity is considered, but also medical entities and identifiable information are comprehensively analyzed to form a multi-dimensional risk score, which helps to reduce missed detection and false positives, the detection accuracy is high, the fine-grained risk score and level can be output for each query, resource consumption is controllable, easy to expand, and system integration is friendly.

Description

Technical Field

[0001] This invention belongs to the field of privacy risk detection technology, and in particular relates to a method, apparatus, device and storage medium for privacy risk detection of a medical RAG system. Background Technology

[0002] With the development of Large Language Models (LLM), medical question-answering and decision support systems based on Retrieval Augmentation (RAG) are gradually being applied in scenarios such as internet healthcare services, online consultation platforms, and in-hospital clinical decision support. These systems typically retrieve relevant documents from a knowledge base containing patient medical records, clinical notes, medical literature, etc., and combine the retrieval results with the large model to generate answers.

[0003] When a user's query is highly similar to a sensitive patient record in the knowledge base, the RAG system may expose patient privacy information during the retrieval or generation phase, posing the following typical risks:

[0004] 1. If the query text is highly similar to a patient's actual medical record, the system may directly or indirectly return sensitive information about that patient;

[0005] 2. Queries containing identifiable or semi-identifiable information such as blood pressure, blood sugar, age, gender, and geographic location may lead to the re-identification of specific patients;

[0006] 3. Malicious attackers can construct queries to detect whether the system stores information about a certain type of patient, thereby making privacy inferences.

[0007] In existing technologies, little attention is paid to the preliminary step of "privacy risk detection," which mainly presents the following problems:

[0008] 1. Most systems directly focus on "privacy protection strategies" (such as differential privacy, k-anonymity, federated learning, etc.), but lack a privacy risk detection method that is computationally resource-controlled and can be run in real time, i.e.:

[0009] It is impossible to quickly determine whether a user query is "highly similar" to a sensitive internal record every time it arrives.

[0010] It is not possible to classify the risk level of the query so that subsequent modules can select different processing strategies.

[0011] 2. Existing similarity calculation methods (such as exact Jaccard, TF-IDF cosine similarity, BERT embedding cosine similarity, etc.) are still insufficient to meet the latency requirements of medical interaction systems (such as <50ms) when dealing with millions of documents, even if only "detection" is performed.

[0012] 3. Many methods rely solely on overall sentence similarity for coarse-grained judgment, resulting in biased and inaccurate privacy detection, which is prone to missed detections and false alarms. Summary of the Invention

[0013] Based on this, and in response to the aforementioned technical problems, a method, apparatus, device, and storage medium for detecting privacy risks in a medical RAG system are provided.

[0014] The technical solution adopted in this invention is as follows:

[0015] As a first aspect of the present invention, a method for detecting privacy risks in a medical RAG system is provided, comprising:

[0016] S101. Obtain the query text input by the user into the medical RAG system;

[0017] S102. The query text is preprocessed and features are extracted. The query text is represented as a set of discrete features. The preprocessed and feature-extracted query text is hashed using k1 preset hash functions. The corresponding positions of the bit groups of the Bloom filter are checked according to the k1 hash mapping results. If they are all 1, S103 is executed. Otherwise, the query text is determined to have no privacy risk and the medical RAG system is notified.

[0018] The construction process of the Bloom filter includes:

[0019] For each sensitive document in the set of sensitive documents pre-selected from the knowledge base, the preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed using the pre-set k1 hash functions. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1.

[0020] S103. Using k2 preset hash functions, calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare Jaccard similarities and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim;

[0021] Specifically, the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes:

[0022] For each document, the preprocessing and feature extraction are performed. Using the preset k2 hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated.d ;

[0023] S104. Calculate the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text:

[0024] Extract medical entities and medical identifiable information from the query text;

[0025] Based on the number of medical entities, a medical sensitivity risk index R_sens is determined in the interval [0,1]. The more medical entities there are, the higher R_sens is.

[0026] Based on the sensitivity of medical identifiable information, scores are assigned in the range [0,1]. The scores of all medical identifiable information are summed to obtain R_id.

[0027] S105. Calculate the total risk score R_total of the query text = w1·R_sim + w2·R_sens + w3·R_id, where w1, w2 and w3 are the weights of R_sim, R_sens and R_id;

[0028] S106. Determine the risk level of the query text based on the total risk score R_total, and send the risk level to the medical RAG system.

[0029] As a second aspect of the present invention, a privacy risk detection device for a medical RAG system is provided, comprising:

[0030] The first module is used for S101, to obtain the query text input by the user into the medical RAG system;

[0031] The second module is used for S102, which preprocesses and extracts features from the query text, represents the query text as a set of discrete features, and performs hash mapping on the preprocessed and feature-extracted query text through k1 preset hash functions respectively. Based on the k1 hash mapping results, it checks whether the corresponding positions of the bit groups of the Bloom filter are all 1. If so, it executes S103; otherwise, it determines that the query text has no privacy risk and informs the medical RAG system.

[0032] The construction process of the Bloom filter includes:

[0033] For each sensitive document in the set of sensitive documents pre-selected from the knowledge base, the preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed using the pre-set k1 hash functions. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1.

[0034] The third module, used in S103, employs k2 preset hash functions to calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare Jaccard similarities and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim;

[0035] Specifically, the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes:

[0036] For each document, the preprocessing and feature extraction are performed. Using the preset k2 hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated. d ;

[0037] The fourth module, used in S104, calculates the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text:

[0038] Extract medical entities and medical identifiable information from the query text;

[0039] Based on the number of medical entities, a medical sensitivity risk index R_sens is determined in the interval [0,1]. The more medical entities there are, the higher R_sens is.

[0040] Based on the sensitivity of medical identifiable information, scores are assigned in the range [0,1]. The scores of all medical identifiable information are summed to obtain R_id.

[0041] The fifth module is used in S105 to calculate the total risk score R_total = w1·R_sim + w2·R_sens + w3·R_id of the query text, where w1, w2 and w3 are the weights of R_sim, R_sens and R_id.

[0042] The sixth module is used in S106 to determine the risk level of the query text based on the total risk score R_total, and send the risk level to the medical RAG system.

[0043] As a third aspect of the present invention, an electronic device is provided, including a storage module, the storage module including instructions loaded and executed by a processor, the instructions, when executed, causing the processor to perform a privacy risk detection method for a medical RAG system according to the first aspect described above.

[0044] As a fourth aspect of the present invention, a computer-readable storage medium is provided that stores one or more programs, which, when executed by a processor, implement the privacy risk detection method for a medical RAG system described in the first aspect above.

[0045] The beneficial effects of this invention are as follows:

[0046] 1. Superior real-time performance:

[0047] By cascading Bloom filters and MinHash, a two-layer detection process is formed: "first, Bloom filters exclude safe queries, and then MinHash is used to calculate approximate similarity." This significantly reduces the complexity of similarity detection on large-scale document sets and can achieve millisecond-level response under typical hardware conditions, making it suitable for online medical RAG scenarios.

[0048] 2. More comprehensive privacy detection:

[0049] It not only considers the surface similarity of text, but also comprehensively analyzes medical entities and identifiable information to form a multi-dimensional risk score, which helps to reduce missed detections and false alarms, has high detection accuracy, and can output fine-grained risk scores and levels for each query.

[0050] 3. Controllable resource consumption and easy expansion:

[0051] Bloom filters have a small memory footprint and can be flexibly expanded according to document size. The MinHash parameter can be adjusted as needed, and they support deployment in single-machine or cluster environments.

[0052] 4. User-friendly system integration:

[0053] As a pre-retrieval filtering module, this invention does not depend on specific RAG implementation details and can be used in conjunction with different types of vector retrieval engines and large language models, exhibiting good versatility and engineering feasibility. Attached Figure Description

[0054] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments:

[0055] Figure 1 A flowchart of a privacy risk detection method for a medical RAG system provided in an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of a privacy risk detection device for a medical RAG system provided in an embodiment of the present invention;

[0057] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0058] The embodiments of the present invention will be described below with reference to the accompanying drawings. It should be noted that the embodiments described in this specification are not exhaustive and do not represent the only embodiments of the present invention. The corresponding embodiments below are only for clearly illustrating the inventive content of this patent and are not intended to limit its implementation. For those skilled in the art, different variations and modifications can be made based on the embodiments described. Any variations or modifications that fall within the technical concept and inventive content of this invention and are obvious are also within the protection scope of this invention.

[0059] like Figure 1 As shown in the figure, this application provides a method for detecting privacy risks in a medical RAG system, the specific process of which is as follows:

[0060] S101. Obtain the query text input by the user into the medical RAG system.

[0061] S102. Preprocess and extract features from the query text, representing the query text as a set of discrete features. Then, perform hash mapping on the preprocessed and feature-extracted query text using k1 preset hash functions. Check whether the corresponding positions of the bit groups in the Bloom filter are all 1 based on the k1 hash mapping results. If so, proceed to S103. Otherwise, determine that the query text has no privacy risk and inform the medical RAG system.

[0062] Preprocessing and feature extraction include word segmentation, stop word filtering, lexical reconstruction, and numerical representation preservation. Extracted features can be word-level features, character-level shingle features, or word-level n-gram features, or a combination of at least two of these features. Understandably, in practice, the appropriate preprocessing and feature extraction tools must be selected based on the specific language context (e.g., Chinese / English).

[0063] The process of building a Bloom filter includes:

[0064] For each sensitive document in the set of sensitive documents (such as records directly related to a patient's personal medical records) selected from the knowledge base in advance, preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed by k1 preset hash functions respectively. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1.

[0065] Specifically, in the offline stage, keywords such as disease, symptoms, and personal sensitive information can be extracted from each sensitive document using the NER model. For example, if a document contains the information: "Patient: Hello doctor, I have a cough recently, severe night sweats, and frequent insomnia," then the extracted keyword set would be: "cough," "night sweats," and "insomnia." Taking a sensitive document ("cough, night sweats, insomnia") after preprocessing and feature extraction as an example, assuming that eight hash functions are used for hash mapping (such as using the SHA-256 hash algorithm) to obtain eight integers, the corresponding positions of the bit array in the Bloom filter are set to 1 based on these eight integers. Assuming that the bit array has 100 positions from 1 to 100, and assuming that the above eight integers are 1-8, then positions 1-8 of the bit array are set to 1. During the online phase, after preprocessing and feature extraction of the query text, eight hash functions are used to perform hash mapping on the preprocessed and feature-extracted query text, resulting in eight integers. The corresponding positions of the bit groups in the Bloom filter are checked using these eight integers to see if they are all 1. If so, it means that the query text has an intersection with the sensitive documents in the knowledge base, and S103 is executed. Otherwise, it is determined that the query text has no privacy risk, and the medical RAG system is informed that the query text has no privacy risk.

[0066] To reduce the cost and improve performance of Bloom filter inspection in the online phase, when constructing the Bloom filter offline, the multiple hash mapping results of each sensitive document are divided into multiple groups of r equal parts. For each group, the group is re-hash-mapped using k1 preset hash functions. Based on the re-hash-mapped results, the corresponding positions of the bit groups in the Bloom filter are set to 1. Correspondingly, in the online phase, the k1 hash mapping results of the query text are divided into multiple groups of r equal parts. For each group, the group is re-hash-mapped using k1 preset hash functions. Based on all the re-hash-mapped results of each group, it is checked whether the corresponding positions of the bit groups in the Bloom filter are all 1. If so, S103 is executed; otherwise, it is determined that the query text has no privacy risk and the medical RAG system is notified.

[0067] Taking the offline stage as an example, suppose 16 integers are hashed from a sensitive document (using 16 hash functions). The 16 integers are divided into 4 groups of 4. Each group (the 4 integers in a group are considered as a whole) is re-mapped using the 16 hash functions to obtain 16 integers, for a total of 4*16 integers.

[0068] k1 and the number of bits m in the bit array are determined by the following formula:

[0069]

[0070]

[0071] Where p is the expected false positive rate, n is the capacity of the Bloom filter, assuming n=1,000,000 and p=0.01, then m≈9.6 million bits (1.14 MB), k1≈7.

[0072] S103. Using k2 preset hash functions, calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare the Jaccard similarity (using the "equal position ratio" approximation) and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim.

[0073] Here, k is typically 64 to 256, and the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes:

[0074] For each document, preprocessing and feature extraction are performed. Using k2 predefined hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated. d .

[0075] Taking the online stage as an example, assuming the query text after preprocessing and feature extraction is: cough, night sweats, insomnia, the MinHash signature vector σ is obtained using 8 hash functions (k2=8). d , σ d It consists of 8 integers, each of which is the minimum hash value of "coughing, night sweats, and insomnia" under the corresponding hash function. The MinHash signature records the "minimum hash value" under multiple hash functions. The proportion of signatures of different texts in each dimension is the unbiased estimate of the Jaccard similarity of the set, thus giving an approximate similarity in O(k) time complexity without having to perform intersection / union calculations of the entire set.

[0076] In this embodiment, multi-process or multi-threaded parallel technology is used to improve the index building speed when building the MinHash signature and Bloom filter of the document offline.

[0077] S104. Calculate the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text:

[0078] S41. Extract medical entities and medical identifiable information from the query text.

[0079] Specifically, medical entities include diseases, symptoms, drugs, and test results, etc. Identifiable medical information includes age, gender, height, weight, geographical location, and specific values ​​of test results (such as blood pressure and BMI). Among them, diseases and drugs are identified through a medical NER model, symptoms and test results can be identified through a pre-built dictionary, and age, gender, height, weight, geographical location, and specific values ​​of test results can be extracted using regular expressions.

[0080] S42. Based on the number of medical entities, determine the medical sensitivity risk index R_sens in the interval [0,1]. The more medical entities there are, the higher R_sens will be. An example is shown below:

[0081] When the number of medical entities is 0, R_sens=0;

[0082] When the number of medical entities is less than or equal to 2, R_sens = 0.3;

[0083] When the number of medical entities is less than or equal to 4, R_sens = 0.6;

[0084] When the number of medical entities is greater than or equal to 5, R_sens = 1.

[0085] S43. Based on the sensitivity of medical identifiable information, scores are assigned in the interval [0,1]. The scores of all medical identifiable information are summed to obtain R_id, as shown in the example below:

[0086] If a name appears in the extracted medical identifiable information, then R_id=1;

[0087] If the extracted medical identifiable information includes age, gender, height, weight, and geographical location, each is scored as 0.2. If the specific numerical value of the examination indicator is included, each is scored as 0.3. The values ​​are accumulated to obtain R_id. If the accumulated value exceeds 1, then R_id = 1.

[0088] S105. Calculate the total risk score of the query text R_total = w1·R_sim + w2·R_sens + w3·R_id, where w1, w2 and w3 are the weights of R_sim, R_sens and R_id.

[0089] S106. Determine the risk level of the query text based on the total risk score R_total, and send the risk level to the medical RAG system.

[0090] Specifically, three thresholds can be set: 0.8, 0.6, and 0.4. When the total risk score R_total is greater than or equal to 0.8, the risk level of the query text is high risk; when it is greater than or equal to 0.6 and less than 0.8, the risk level of the query text is medium risk; when it is greater than or equal to 0.4 and less than 0.6, the risk level of the query text is low risk; and when it is less than 0.4, the risk level of the query text is safe.

[0091] To improve efficiency, risk assessment results for recent high-frequency or similar queries can be cached. If identical or highly similar queries occur, the cached results can be returned directly, reducing redundant calculations and improving system throughput.

[0092] As can be seen from the above, the privacy risk detection method for a medical RAG system provided in this application has the following beneficial effects:

[0093] 1. Superior real-time performance:

[0094] By cascading Bloom filters and MinHash, a two-layer detection process is formed: "first, Bloom filters exclude safe queries, and then MinHash is used to calculate approximate similarity." This significantly reduces the complexity of similarity detection on large-scale document sets and can achieve millisecond-level response under typical hardware conditions, making it suitable for online medical RAG scenarios.

[0095] 2. More comprehensive privacy detection:

[0096] It not only considers the surface similarity of text, but also comprehensively analyzes medical entities and identifiable information to form a multi-dimensional risk score, which helps to reduce missed detections and false alarms, has high detection accuracy, and can output fine-grained risk scores and levels for each query.

[0097] 3. Controllable resource consumption and easy expansion:

[0098] Bloom filters have a small memory footprint and can be flexibly expanded according to document size. The MinHash parameter can be adjusted as needed, and they support deployment in single-machine or cluster environments.

[0099] 4. User-friendly system integration:

[0100] As a pre-retrieval filtering module, this invention does not depend on specific RAG implementation details and can be used in conjunction with different types of vector retrieval engines and large language models, exhibiting good versatility and engineering feasibility.

[0101] The privacy risk detection apparatus for a medical RAG system according to one or more embodiments of the present invention will be described in detail below. Those skilled in the art will understand that these apparatuses can be configured using commercially available hardware components through the steps taught in this solution. Figure 2This invention illustrates a privacy risk detection device for a medical RAG system, comprising a first module 11, a second module 12, a third module 13, a fourth module 14, a fifth module 15, and a sixth module 16.

[0102] The first module 11 is used for S101 to obtain the query text input by the user into the medical RAG system.

[0103] The second module 12 is used for S102, which preprocesses and extracts features from the query text, represents the query text as a set of discrete features, and performs hash mapping on the preprocessed and feature-extracted query text through k1 preset hash functions respectively. Based on the k1 hash mapping results, it checks whether the corresponding positions of the bit groups of the Bloom filter are all 1. If so, it executes S103; otherwise, it determines that the query text has no privacy risk and informs the medical RAG system.

[0104] Preprocessing and feature extraction include word segmentation, stop word filtering, lexical reconstruction, and numerical representation preservation. Extracted features can be word-level features, character-level shingle features, or word-level n-gram features, or a combination of at least two of these features. Understandably, in practice, the appropriate preprocessing and feature extraction tools must be selected based on the specific language context (e.g., Chinese / English).

[0105] The process of building a Bloom filter includes:

[0106] For each sensitive document in the set of sensitive documents (such as records directly related to a patient's personal medical records) selected from the knowledge base in advance, preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed by k1 preset hash functions respectively. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1.

[0107] Specifically, in the offline stage, keywords such as disease, symptoms, and personal sensitive information can be extracted from each sensitive document using the NER model. For example, if a document contains the information: "Patient: Hello doctor, I have a cough recently, severe night sweats, and frequent insomnia," then the extracted keyword set would be: "cough," "night sweats," and "insomnia." Taking a sensitive document ("cough, night sweats, insomnia") after preprocessing and feature extraction as an example, assuming that eight hash functions are used for hash mapping (such as using the SHA-256 hash algorithm) to obtain eight integers, the corresponding positions of the bit array in the Bloom filter are set to 1 based on these eight integers. Assuming that the bit array has 100 positions from 1 to 100, and assuming that the above eight integers are 1-8, then positions 1-8 of the bit array are set to 1. During the online phase, after preprocessing and feature extraction of the query text, eight hash functions are used to perform hash mapping on the preprocessed and feature-extracted query text, resulting in eight integers. The corresponding positions of the bit groups in the Bloom filter are checked using these eight integers to see if they are all 1. If so, it means that the query text has an intersection with the sensitive documents in the knowledge base, and S103 is executed. Otherwise, it is determined that the query text has no privacy risk, and the medical RAG system is informed that the query text has no privacy risk.

[0108] To reduce the cost and improve performance of Bloom filter inspection in the online phase, when constructing the Bloom filter offline, the multiple hash mapping results of each sensitive document are divided into multiple groups of r equal parts. For each group, the group is re-hash-mapped using k1 preset hash functions. Based on the re-hash-mapped results, the corresponding positions of the bit groups in the Bloom filter are set to 1. Correspondingly, in the online phase, the k1 hash mapping results of the query text are divided into multiple groups of r equal parts. For each group, the group is re-hash-mapped using k1 preset hash functions. Based on all the re-hash-mapped results of each group, it is checked whether the corresponding positions of the bit groups in the Bloom filter are all 1. If so, S103 is executed; otherwise, it is determined that the query text has no privacy risk and the medical RAG system is notified.

[0109] Taking the offline stage as an example, suppose 16 integers are hashed from a sensitive document (using 16 hash functions). The 16 integers are divided into 4 groups of 4. Each group (the 4 integers in a group are considered as a whole) is re-mapped using the 16 hash functions to obtain 16 integers, for a total of 4*16 integers.

[0110] k1 and the number of bits m in the bit array are determined by the following formula:

[0111]

[0112]

[0113] Where p is the expected false positive rate, n is the capacity of the Bloom filter, assuming n=1,000,000 and p=0.01, then m≈9.6 million bits (1.14 MB), k1≈7.

[0114] The third module 13, used in S103, employs k2 preset hash functions to calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare the Jaccard similarity (using the "equal position ratio" approximation) and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim.

[0115] Here, k is typically 64 to 256, and the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes:

[0116] For each document, preprocessing and feature extraction are performed. Using k2 predefined hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated. d .

[0117] Taking the online stage as an example, assuming the query text after preprocessing and feature extraction is: cough, night sweats, insomnia, the MinHash signature vector σ is obtained using 8 hash functions (k2=8). d , σ d It consists of 8 integers, each of which is the minimum hash value of "coughing, night sweats, and insomnia" under the corresponding hash function. The MinHash signature records the "minimum hash value" under multiple hash functions. The proportion of signatures of different texts in each dimension is the unbiased estimate of the Jaccard similarity of the set, thus giving an approximate similarity in O(k) time complexity without having to perform intersection / union calculations of the entire set.

[0118] In this embodiment, multi-process or multi-threaded parallel technology is used to improve the index building speed when building the MinHash signature and Bloom filter of the document offline.

[0119] Module 4, Section 14, is used in S104 to calculate the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text.

[0120] S41. Extract medical entities and medical identifiable information from the query text.

[0121] Specifically, medical entities include diseases, symptoms, drugs, and test results, etc. Identifiable medical information includes age, gender, height, weight, geographical location, and specific values ​​of test results (such as blood pressure and BMI). Among them, diseases and drugs are identified through a medical NER model, symptoms and test results can be identified through a pre-built dictionary, and age, gender, height, weight, geographical location, and specific values ​​of test results can be extracted using regular expressions.

[0122] S42. Based on the number of medical entities, determine the medical sensitivity risk index R_sens in the interval [0,1]. The more medical entities there are, the higher R_sens will be. An example is shown below:

[0123] When the number of medical entities is 0, R_sens=0;

[0124] When the number of medical entities is less than or equal to 2, R_sens = 0.3;

[0125] When the number of medical entities is less than or equal to 4, R_sens = 0.6;

[0126] When the number of medical entities is greater than or equal to 5, R_sens = 1.

[0127] S43. Based on the sensitivity of medical identifiable information, scores are assigned in the interval [0,1]. The scores of all medical identifiable information are summed to obtain R_id, as shown in the example below:

[0128] If a name appears in the extracted medical identifiable information, then R_id=1;

[0129] If the extracted medical identifiable information includes age, gender, height, weight, and geographical location, each is scored as 0.2. If the specific numerical value of the examination indicator is included, each is scored as 0.3. The values ​​are accumulated to obtain R_id. If the accumulated value exceeds 1, then R_id = 1.

[0130] Module 5, 15, is used in S105 to calculate the total risk score of the query text, R_total = w1·R_sim + w2·R_sens + w3·R_id, where w1, w2, and w3 are the weights of R_sim, R_sens, and R_id, respectively.

[0131] Module 6, 16, is used in S106 to determine the risk level of the query text based on the total risk score R_total, and then send the risk level to the medical RAG system.

[0132] Specifically, three thresholds can be set: 0.8, 0.6, and 0.4. When the total risk score R_total is greater than or equal to 0.8, the risk level of the query text is high risk; when it is greater than or equal to 0.6 and less than 0.8, the risk level of the query text is medium risk; when it is greater than or equal to 0.4 and less than 0.6, the risk level of the query text is low risk; and when it is less than 0.4, the risk level of the query text is safe.

[0133] To improve efficiency, risk assessment results for recent high-frequency or similar queries can be cached. If identical or highly similar queries occur, the cached results can be returned directly, reducing redundant calculations and improving system throughput.

[0134] In summary, the privacy risk detection device for the medical RAG system provided in the above embodiments can execute the privacy risk detection method for the medical RAG system provided in the foregoing embodiments.

[0135] Similar to the above concept, the above Figure 2 The privacy risk detection device of the medical RAG system shown can be implemented as an electronic device. Figure 3 A schematic block diagram of the structure of an electronic device provided by an embodiment of the present invention is shown.

[0136] For example, the electronic device includes a storage module 21 and a processor 22. The storage module 21 includes instructions loaded and executed by the processor 22. When executed, the instructions cause the processor 22 to perform the steps described in the section on a privacy risk detection method for a medical RAG system described above, according to various exemplary embodiments of the present invention.

[0137] It should be understood that processor 22 can be a Central Processing Unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, the general-purpose processor can be a microprocessor or any conventional processor.

[0138] This invention also provides a computer-readable storage medium that stores one or more programs, which, when executed by a processor, implement the steps described in the above-described method for detecting privacy risks in a medical RAG system according to various exemplary embodiments of the invention.

[0139] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer-readable storage media (or non-transitory media) and communication media (or transient media).

[0140] As is known to those skilled in the art, the term computer-readable storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0141] For example, the computer-readable storage medium may be an internal storage unit of the electronic device described in the foregoing embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium may also be an external storage device of the electronic device, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc., provided on the electronic device.

[0142] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting privacy risks in a medical RAG system, characterized in that, include: S101. Obtain the query text input by the user into the medical RAG system; S102. The query text is preprocessed and features are extracted. The query text is represented as a set of discrete features. The preprocessed and feature-extracted query text is hashed using k1 preset hash functions. The corresponding positions of the bit groups of the Bloom filter are checked according to the k1 hash mapping results. If they are all 1, S103 is executed. Otherwise, the query text is determined to have no privacy risk and the medical RAG system is notified. The construction process of the Bloom filter includes: For each sensitive document in the set of sensitive documents pre-selected from the knowledge base, the preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed using the pre-set k1 hash functions. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1. S103. Using k2 preset hash functions, calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare Jaccard similarities and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim; Specifically, the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes: For each document, the preprocessing and feature extraction are performed. Using the preset k2 hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated. d ; S104. Calculate the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text: Extract medical entities and medical identifiable information from the query text; Based on the number of medical entities, a medical sensitivity risk index R_sens is determined in the interval [0,1]. The more medical entities there are, the higher R_sens is. Based on the sensitivity of medical identifiable information, scores are assigned in the range [0,1]. The scores of all medical identifiable information are summed to obtain R_id. S105. Calculate the total risk score R_total of the query text = w1·R_sim + w2·R_sens + w3·R_id, where w1, w2 and w3 are the weights of R_sim, R_sens and R_id; S106. Determine the risk level of the query text based on the total risk score R_total, and send the risk level to the medical RAG system.

2. The privacy risk detection method for a medical RAG system according to claim 1, characterized in that, The preprocessing and feature extraction include word segmentation, stop word filtering, word form restoration, and numerical representation preservation.

3. The privacy risk detection method for a medical RAG system according to claim 1, characterized in that, The features are word-level features, character-level shingle features, word-level n-gram features, or a combination of at least two of these features.

4. The privacy risk detection method for a medical RAG system according to claim 1, characterized in that, S102 further includes: The k1 hash mapping results of the query text are divided into multiple groups of r each. For each group, the group is re-hash mapped using the preset k1 hash functions. Based on all the re-hash mapping results of each group, it is checked whether the corresponding positions of the bit groups of the Bloom filter are all 1. If so, S103 is executed; otherwise, it is determined that the query text has no privacy risk and the medical RAG system is notified. The construction process of the Bloom filter further includes: The multiple hash mapping results of each document are divided into multiple groups of r each. For each group, the group is re-hash mapped using the preset k1 hash functions. Based on the re-hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1.

5. The privacy risk detection method for a medical RAG system according to claim 1, characterized in that, The medical entities include diseases, symptoms, drugs, and examination indicators, and S104 further includes: When the number of medical entities is 0, R_sens=0; when 0 < the number of medical entities <= 2, R_sens=0.3; when 2 < the number of medical entities <= 4, R_sens=0.6; when the number of medical entities >= 5, R_sens=1.

6. The privacy risk detection method for a medical RAG system according to claim 1, characterized in that, The medical identifiable information includes age, gender, height, weight, geographical location, and specific values ​​of examination indicators. S104 further includes: If a name appears in the extracted medical identifiable information, then R_id=1; If the extracted medical identifiable information includes age, gender, height, weight, and geographical location, each is scored as 0.

2. If the specific numerical value of the examination indicator is included, each is scored as 0.

3. The values ​​are accumulated to obtain R_id. If the accumulated value exceeds 1, then R_id = 1.

7. A privacy risk detection device for a medical RAG system, characterized in that, include: The first module is used for S101, to obtain the query text input by the user into the medical RAG system; The second module is used for S102, which preprocesses and extracts features from the query text, represents the query text as a set of discrete features, and performs hash mapping on the preprocessed and feature-extracted query text through k1 preset hash functions respectively. Based on the k1 hash mapping results, it checks whether the corresponding positions of the bit groups of the Bloom filter are all 1. If so, it executes S103; otherwise, it determines that the query text has no privacy risk and informs the medical RAG system. The construction process of the Bloom filter includes: For each sensitive document in the set of sensitive documents pre-selected from the knowledge base, the preprocessing and feature extraction are performed. For each sensitive document after preprocessing and feature extraction, it is hashed using the pre-set k1 hash functions. Based on the hash mapping results, the corresponding position of the bit group of the Bloom filter is set to 1. The third module, used in S103, employs k2 preset hash functions to calculate the MinHash signature vector σ of the preprocessed and feature-extracted query text. d , and the MinHash signature σ of each sensitive document in the pre-computed knowledge base or each document d Compare Jaccard similarities and extract the maximum Jaccard similarity value as the similarity risk indicator R_sim; Specifically, the MinHash signature σ of each sensitive document or each document in the knowledge base is calculated. d The process includes: For each document, the preprocessing and feature extraction are performed. Using the preset k2 hash functions, the MinHash signature vector σ of each document after preprocessing and feature extraction is calculated. d ; The fourth module, used in S104, calculates the medical sensitivity risk index R_sens and the identifiability risk index R_id of the query text: Extract medical entities and medical identifiable information from the query text; Based on the number of medical entities, a medical sensitivity risk index R_sens is determined in the interval [0,1]. The more medical entities there are, the higher R_sens is. Based on the sensitivity of medical identifiable information, scores are assigned in the range [0,1]. The scores of all medical identifiable information are summed to obtain R_id. The fifth module is used in S105 to calculate the total risk score R_total = w1·R_sim + w2·R_sens + w3·R_id of the query text, where w1, w2 and w3 are the weights of R_sim, R_sens and R_id. The sixth module is used in S106 to determine the risk level of the query text based on the total risk score R_total, and send the risk level to the medical RAG system.

8. An electronic device, characterized in that, The system includes a storage module comprising instructions loaded and executed by a processor, which, when executed, cause the processor to perform a privacy risk detection method for a medical RAG system according to any one of claims 1-6.

9. A computer-readable storage medium storing one or more programs, characterized in that, When the one or more programs are executed by the processor, they implement the privacy risk detection method for a medical RAG system as described in any one of claims 1-6.

Images