Data anonymization method and device, electronic equipment and computer storage medium

Abstract

The invention provides a data anonymization method and device, electronic equipment and a computer storage medium, and the method comprises the steps: carrying out the feature extraction of original data, and obtaining an original semantic vector set; the method comprises the following steps: distributing a differentiated dimension budget to each original semantic vector in an original semantic vector set, generating an anchor point constraint relationship of the original semantic vectors according to the original semantic vectors and an anchor point set, and finally processing the original semantic vectors in combination with the dimension budget corresponding to the original semantic vectors and the anchor point constraint relationship. The anonymous representation of the original semantic vector is generated, so that data privacy protection and analysis availability are considered while the anonymous representation is generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a data anonymization method and device, electronic equipment and computer storage medium. BACKGROUND

[0002] At present, the existing technology adopts uniform dimension reduction and uniform disturbance, relies on differential privacy to add noise in the whole, and other methods to perform data anonymization.

[0003] However, it is difficult to balance privacy protection and data usability in the prior art: once the disturbance intensity is increased, the semantic features related to the task are destroyed; and if the disturbance intensity is reduced, it is easy to be re-identified or attacked to recover. SUMMARY

[0004] Therefore, the present application provides a data anonymization method and device, electronic equipment and computer storage medium, which can generate an anonymous representation while balancing data privacy protection and analysis usability.

[0005] The first aspect of the present application provides a data anonymization method, comprising:

[0006] Obtaining original data and performing feature extraction on the original data to obtain a set of original semantic vectors;

[0007] For each original semantic vector in the set of original semantic vectors, determining a dimension budget corresponding to the original semantic vector;

[0008] Generating an anchor point constraint relationship of the original semantic vector according to the original semantic vector and an anchor point set; wherein the anchor points in the anchor point set are obtained based on the original semantic vectors in the set of original semantic vectors;

[0009] Processing the original semantic vector in combination with the dimension budget corresponding to the original semantic vector and the anchor point constraint relationship to generate an anonymous representation of the original semantic vector.

[0010] Optionally, the determining of the dimension budget corresponding to each original semantic vector in the set of original semantic vectors comprises:

[0011] For each original semantic vector in the set of original semantic vectors, determining a sensitivity and a relevance corresponding to the original semantic vector;

[0012] Determining the dimension budget corresponding to the original semantic vector based on a global dimension budget, the sensitivity and the relevance corresponding to the original semantic vector.

[0013] Optionally, the generating of the anchor point constraint relationship of the original semantic vector according to the original semantic vector and the anchor point set comprises:

[0014] For each original semantic vector, determine the similarity of the original semantic vector and the anchor point set;

[0015] If the similarity of the original semantic vector and the anchor point set is greater than the adaptive threshold, establish the anchor point constraint relationship of the original semantic vector; wherein the adaptive threshold is determined by the mean and standard deviation of the similarity of all original semantic vectors and anchor point sets.

[0016] Optionally, after the original semantic vector and the anchor point set are established, the anchor point constraint relationship of the original semantic vector is established, and the method further comprises:

[0017] If the dimension budget corresponding to the anchored original semantic vector is lower than the anchor point threshold, the dimension budget corresponding to the anchored original semantic vector is raised to the anchor point threshold.

[0018] Optionally, the original semantic vector is processed in combination with the dimension budget corresponding to the original semantic vector and the anchor point constraint relationship to generate an anonymous representation of the original semantic vector, comprising:

[0019] For each original semantic vector in the original semantic vector set, a projection matrix is generated according to the dimension budget corresponding to the original semantic vector, and a projection result of the original semantic vector is generated according to the projection matrix;

[0020] Differential noise is introduced into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector; wherein the anonymous representation of the original semantic vector needs to satisfy the anchor point constraint relationship of the original semantic vector.

[0021] Optionally, after the differential noise is introduced into the projection result of the original semantic vector to obtain the anonymous representation of the original semantic vector, the method further comprises:

[0022] According to the anonymous representation of the original semantic vector and the adaptive threshold, an anchor point constraint loss is generated;

[0023] According to the anchor point constraint loss and the privacy loss, an optimization target is generated; wherein the optimization target is used to iteratively adjust the projection matrix.

[0024] Optionally, the data anonymization method further comprises:

[0025] Based on the noise variance of the differential noise and the dimension budget corresponding to the original semantic vector, a privacy budget result is generated; wherein the privacy budget result and the preset privacy threshold are used to automatically adjust the noise size.

[0026] The second aspect of the present application provides a data anonymization device, comprising:

[0027] A multi-modal preprocessing module is configured to acquire original data and perform feature extraction on the original data to obtain a set of original semantic vectors.

[0028] A dimension budget module is configured to determine, for each original semantic vector in the set of original semantic vectors, a dimension budget corresponding to the original semantic vector.

[0029] A semantic anchoring module is configured to generate an anchor constraint relationship of an original semantic vector based on the original semantic vector and an anchor set, wherein the anchors in the anchor set are obtained based on the original semantic vectors in the set of original semantic vectors.

[0030] An anonymization mapping execution module is configured to process the original semantic vector in combination with the dimension budget corresponding to the original semantic vector and the anchor constraint relationship to generate an anonymized representation of the original semantic vector.

[0031] Optionally, the dimension budget module comprises:

[0032] A sensitivity and correlation determination submodule is configured to determine, for each original semantic vector in the set of original semantic vectors, a sensitivity and correlation corresponding to the original semantic vector.

[0033] A dimension budget submodule is configured to determine, based on a global dimension budget, the sensitivity and correlation corresponding to the original semantic vector, a dimension budget corresponding to the original semantic vector.

[0034] Optionally, the semantic anchoring module comprises:

[0035] A similarity determination submodule is configured to determine, for each original semantic vector, a similarity between the original semantic vector and the anchor set.

[0036] A constraint relationship establishment submodule is configured to establish an anchor constraint relationship of the original semantic vector if the similarity between the original semantic vector and the anchor set is greater than an adaptive threshold, wherein the adaptive threshold is determined by a mean and a standard deviation of the similarities between all the original semantic vectors and the anchor set.

[0037] Optionally, the data anonymization device further comprises:

[0038] A dimension budget adjustment module is configured to increase the dimension budget corresponding to the anchored original semantic vector to an anchor threshold if the dimension budget corresponding to the anchored original semantic vector is lower than the anchor threshold.

[0039] Optionally, the anonymization mapping execution module comprises:

[0040] a projection module configured to, for each of the original semantic vectors, generate a projection matrix according to a dimension budget corresponding to the original semantic vector, and generate a projection result of the original semantic vector according to the projection matrix;

[0041] an anonymous representation generation submodule configured to introduce differential noise into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector, wherein the anonymous representation of the original semantic vector needs to satisfy an anchor point constraint relationship of the original semantic vector.

[0042] Optionally, the data anonymization apparatus further comprises:

[0043] an anchor point constraint loss generation module configured to generate an anchor point constraint loss according to the anonymous representation of the original semantic vector and the adaptive threshold;

[0044] an optimization target generation module configured to generate an optimization target according to the anchor point constraint loss and a privacy loss, wherein the optimization target is used to iteratively adjust the projection matrix.

[0045] Optionally, the data anonymization apparatus further comprises:

[0046] a privacy budget result generation module configured to generate a privacy budget result based on a noise variance of the differential noise and the dimension budget corresponding to the original semantic vector, wherein the privacy budget result and a preset privacy threshold are used to automatically adjust a noise scale.

[0047] The third aspect of the present application provides an electronic device comprising:

[0048] one or more processors;

[0049] a storage device having one or more programs stored thereon;

[0050] When the one or more programs are executed by the one or more processors, the one or more processors implement the data anonymization method according to any one of the first aspect.

[0051] The fourth aspect of the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the data anonymization method according to any one of the first aspect.

[0052] From the above scheme, the application provides a data anonymization method, device, electronic equipment and computer storage medium, wherein the original data is subjected to feature extraction to obtain an original semantic vector set; each original semantic vector in the original semantic vector set is allocated with a differentiated dimension budget, and then an anchor point constraint relationship of the original semantic vector is generated according to the original semantic vector and an anchor point set; finally, the original semantic vector is processed in combination with the dimension budget corresponding to the original semantic vector and the anchor point constraint relationship to generate an anonymous representation of the original semantic vector, so that the data privacy protection and analysis availability are taken into account at the same time when the anonymous representation is generated. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.

[0054] Figure 1 A specific flowchart of a data anonymization method provided by an embodiment of the present application is provided.

[0055] Figure 2 A flowchart of a method for determining a dimension budget corresponding to an original semantic vector provided by another embodiment of the present application is provided.

[0056] Figure 3 A flowchart of a method for generating an anchor point constraint relationship of an original semantic vector provided by another embodiment of the present application is provided.

[0057] Figure 4 A specific flowchart of a method for generating an anonymous representation of an original semantic vector provided by another embodiment of the present application is provided.

[0058] Figure 5 A specific flowchart of a method for generating an optimization target provided by another embodiment of the present application is provided.

[0059] Figure 6 A schematic diagram of a data anonymization device provided by another embodiment of the present application is provided.

[0060] Figure 7 A system architecture diagram of a data anonymization method provided by another embodiment of the present application is provided.

[0061] Figure 8 A schematic diagram of an electronic equipment for implementing a data anonymization method provided by another embodiment of the present application is provided. DETAILED DESCRIPTION

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0064] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this invention are all information and data authorized by the user or fully authorized by all parties.

[0065] It should be noted that the concepts of "first" and "second" mentioned in this invention are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0066] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0067] This invention provides a data anonymization method, such as... Figure 1 As shown, the specific steps include:

[0068] S101. Obtain the original data and extract features from the original data to obtain the original semantic vector set.

[0069] The original data can be, but is not limited to, multimodal data (text, images, structured fields) from different institutions or systems; no restrictions are imposed here.

[0070] In the practical application of this invention, text may be segmented and vectorized, images may be extracted using a convolutional neural network to extract high-dimensional features, and structured fields may be normalized and embedded using mapping, ultimately unifying them into a multimodal semantic space to form an original set of semantic vectors. :

[0071] ,in, A raw semantic vector representing a text fragment, image region, or structured field.

[0072] S102. For each original semantic vector in the original semantic vector set, determine the dimension budget corresponding to the original semantic vector.

[0073] This invention dynamically allocates the dimension budget of the anonymous subspace for different original semantic vectors, avoiding the privacy and utility contradictions caused by the "one-size-fits-all" dimensionality reduction or uniform noise addition in traditional methods.

[0074] Optionally, in another embodiment of the present invention, one implementation of step S102 is as follows: Figure 2 As shown, it includes:

[0075] S201. For each original semantic vector in the original semantic vector set, determine the sensitivity and relevance corresponding to the original semantic vector.

[0076] In the practical application of this invention, sensitivity may consist of one or more of the following three parts: explicit sensitivity, potential sensitivity, and business and regulatory weight, without limitation here.

[0077] Among them, dominant sensitivity It can identify personally identifiable information (PII) fields such as names, ID numbers, and mobile phone numbers based on regular expression rules and Named Entity Recognition (NER) models, and assign weights to matches. ;

[0078] Potential sensitivity A "re-identifiable predictor" model can be trained. Output probability value:

[0079] Among them, the model The input consists of a semantic vector, the proportion of unique values, and frequency features; the output is... The probability of.

[0080] Regulatory weight You can set a fixed sensitivity coefficient for certain fields in accordance with GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Responsibility Act), or local regulations.

[0081] In the specific implementation of this invention, the following calculation formula can be used to calculate the original semantic vector. Corresponding sensitivity :

[0082] ;in, The weights of the corresponding parameters can be adjusted according to the business scenario, for example: 0.3, 0.4, 0.3, without limitation here.

[0083] In the practical application of this invention, relevance Similarity is used to measure the importance of semantic units to downstream tasks. Different methods can be used to calculate similarity depending on the scenario; for example, in classification or prediction scenarios, SHAP values ​​or gradient attribution can be used.

[0084] ;

[0085] In clustering or statistical tasks, mutual information or variance contribution rate are used for calculation.

[0086] Understandably, the final calculation results need to undergo normalization management to ensure that... .

[0087] S202. Based on the global dimension budget, the sensitivity and relevance corresponding to the original semantic vector, determine the dimension budget corresponding to the original semantic vector.

[0088] Among them, global dimension budget The system will pre-configure this information; no specific restrictions will be imposed here.

[0089] Specifically, the dimension allocation method based on global dimension budget can be as follows:

[0090] ;

[0091] in, Increase the parameter for task relevance; For smoothing terms; the clip function ensures that the dimensional budget is allocated within... Within the range; , .

[0092] The steps of the above algorithm can be summarized as follows: First, calculate the raw value:

[0093] ;

[0094] Then normalization is performed:

[0095] ;

[0096] Finally, perform the initial allocation:

[0097] ;

[0098] like Then according to The size is incremented by 1 each time until the total budget is met.

[0099] And by using clip to define boundaries, ensure that each .

[0100] The above scheme highlights semantic importance by applying exponential and smooth adjustments to relevance and sensitivity.

[0101] The present invention also provides pseudocode for the above-described solution, as shown below:

[0102] def allocate_budget(S, T, B_total, kappa=1.0, lambda_val=1e-3, B_min=1, B_max_ratio=0.5):

[0103] raw = [T[i]**kappa / (S[i] + lambda_val) for i in range(len(S))]

[0104] p = [r / sum(raw) for r in raw]

[0105] B_init = [int(B_total * pi) for pi in p]

[0106] while sum(B_init) < B_total:

[0107] idx = max(range(len(p)), key=lambda i: p[i])

[0108] B_init[idx] += 1

[0109] B_max = int(B_total * B_max_ratio)

[0110] B_final = [min(max(B_i, B_min), B_max) for B_i in B_init]

[0111] return B_final.

[0112] Specifically, the dimension allocation method based on global dimension budget can also be as follows:

[0113] Based on the original semantic vector Corresponding sensitivity and relevance The comprehensive weight is calculated. :

[0114] ;

[0115] in, and For assignable weights, when ( , Values ​​and parameters ( , When they match, the two will maintain or nearly match the allocation results.

[0116] According to the total budget Assign anonymity dimension to each semantic unit :

[0117] ;

[0118] Specifically, semantic units with high sensitivity but low relevance receive a smaller dimensional budget, reducing the risk of leakage; semantic units with low sensitivity but high relevance receive a larger dimensional budget, maintaining task availability.

[0119] It should be noted that the dimension budget allocation process in this invention is reproducible, auditable, and consistent across domains. Experimental simulations show that, compared with uniform projection, this invention reduces the re-identification rate by more than 20% at the same noise level, while improving the classification accuracy by approximately 8–10%.

[0120] The original semantic vector output in this invention is not only used for subsequent projection dimension configuration, but also prioritizes the dimension requirements of the anchored original semantic vector through the anchor point collaboration mechanism, ensuring the effectiveness of subsequent optimization.

[0121] S103. Generate the anchor constraint relationship of the original semantic vector based on the original semantic vector and the anchor point set.

[0122] The anchor points in the anchor point set are obtained based on the original semantic vectors in the original semantic vector set.

[0123] This invention introduces reference anchors in the anonymous space, so that the original semantic vector (anonymous representation) after anonymization can both meet the requirements of privacy protection and maintain a certain degree of semantic consistency.

[0124] In practical applications of this invention, semantic units of the same type can be clustered (e.g., K-means, spectral clustering), and the cluster centers can be used as anchor points. :

[0125] ;

[0126] in, For the first There are several clusters. The choice of K value when using K-means can be automatically determined using the silhouette coefficient.

[0127] .

[0128] In the practical application of this invention, specific anchor points can be added according to regulations or business scenarios. For example, in the medical scenario, disease category anchor points (such as "cardiovascular disease" category centers); in the financial scenario, transaction type anchor points (such as "cross-border transfer" category centers). No limitation is made here.

[0129] Optionally, in another embodiment of the present invention, one implementation of step S103 is as follows: Figure 3 As shown, it includes:

[0130] S301. For each original semantic vector, determine the similarity between the original semantic vector and the anchor point set.

[0131] Specifically, the similarity calculation method can use, but is not limited to, cosine similarity; no limitation is made here. The specific implementation is as follows:

[0132] ;

[0133] S302. If the similarity between the original semantic vector and the anchor point set is greater than the adaptive threshold, then the anchor point constraint relationship of the original semantic vector is established.

[0134] The adaptive threshold is determined by the mean and standard deviation of the similarity between all original semantic vectors and the anchor set.

[0135] Specifically, adaptive threshold It can be determined by the following formula:

[0136] ;

[0137] in, and Here, represents the mean and standard deviation of all similarities, respectively. As a regulating factor, it can be set to No restrictions are imposed here.

[0138] like Then, anchor point constraints are established:

[0139] ;

[0140] To prevent anchor constraints from failing due to insufficient budget, the following strategy can be introduced during dimension budget allocation: When an original semantic vector is anchored, if the dimension budget corresponding to the anchored original semantic vector is lower than the anchor threshold, the dimension budget corresponding to the anchored original semantic vector will be increased to or not lower than the anchor threshold (the dimension budgets corresponding to other original semantic vectors will be reduced proportionally). This ensures that anchor constraints do not fail due to insufficient budget, thus forming a two-way collaborative mechanism between dimension budget and anchors. This mechanism feeds back anchor priority to the budget allocation logic, creating a closed-loop binding between budget allocation and anchor constraints, ensuring that the key semantics of the task are fully expressed during anonymous mapping. Conversely, the budget engine also feeds back anchor priority to budget weight updates, ensuring that anchor unit dimensions are always prioritized. The anchor threshold is... It can be No restrictions are imposed here.

[0141] Unlike traditional anonymization methods that rely solely on random projection or global noise, this invention generates anchor points through a combination of data-driven clustering and rule-driven supplementation, and designs an anchor-budget coordination mechanism to achieve stable constraints on the semantic structure. This anchor point selection mechanism enables the anonymity space to possess cross-institutional interpretability and compliance traceability, distinguishing it from existing schemes that rely solely on data clustering to generate anchor points.

[0142] S104. Combine the dimension budget and anchor point constraint relationship corresponding to the original semantic vector to process the original semantic vector and generate an anonymous representation of the original semantic vector.

[0143] Specifically, by projecting and perturbing the original semantic vectors based on the dimensional budget and anchor point constraints corresponding to the original semantic vectors, an anonymous representation of the original semantic vectors is generated.

[0144] In simulated attack tests, the anonymized representation of the original semantic vector generated by this invention reduced the re-identification rate from 35% to 14%, while the accuracy of downstream classification tasks decreased by only 3%.

[0145] Optionally, in another embodiment of the present invention, one implementation of step S104 is as follows: Figure 4 As shown, it includes:

[0146] S401. For each original semantic vector in the original semantic vector set, generate a projection matrix based on the dimension budget corresponding to the original semantic vector.

[0147] In practical applications of this invention, KeySeed can be used as input to a pseudo-random number generator to produce a Gaussian matrix, but is not limited to this. Element obeys Then to Perform QR decomposition: ,Pick The former Columns as projection matrices , .

[0148] KeySeed is the system key seed, which is shared across domains and requires a time window and a signature mechanism.

[0149] The present invention also provides pseudocode for the above-described solution, as shown below:

[0150] def generate_projection(key_seed, d_i, B_i):

[0151] G = seeded_gaussian(key_seed, d_i, B_i) # controlled by KeySeed

[0152] Q, R = np.linalg.qr(G)

[0153] return Q[:, :B_i]

[0154] z_i = generate_projection(KeySeed, d_i, B_i).T @ v_i

[0155] The present invention ensures that different organizations can obtain a consistent projection matrix by sharing the KeySeed, and the original semantic vector cannot be derived in reverse through the above method.

[0156] S402. Generate the projection result of the original semantic vector based on the projection matrix.

[0157] Continuing with the example above, the final projection result is: .

[0158] S403. Introduce differential noise into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector.

[0159] Among them, the anonymous representation of the original semantic vector must satisfy the anchor point constraint relationship of the original semantic vector.

[0160] In the practical application of this invention, the noise variance of differentiated noise For sensitivity Relevance Related, specific:

[0161] ;in, This is a global adjustment factor (or proportionality factor), based on the current global privacy budget. and upper limit Dynamic calculations are used for overall noise level control. This is a smoothing term, used to prevent the denominator from being 0 or... The constant is set so that excessive noise is caused by a value that is too small. Generally, a small value (such as 10) is chosen. -3 10 -4 (etc., no specific limit is specified here).

[0162] The final anonymous representation of the original semantic vector is as follows: .

[0163] in, The identity matrix ensures that the noise is independently and identically distributed in all dimensions. This indicates that the mean is 0 and the covariance is... A multidimensional Gaussian noise vector is used to achieve differential privacy.

[0164] It is understandable that the anonymous representation of the original semantic vector also needs to satisfy the anchor constraint relationship of the original semantic vector, that is:

[0165] .

[0166] This invention uses a keyed orthogonal projection matrix to ensure the irreversibility and cross-institutional consistency of anonymous mapping, and uses anchor constraints to prevent the complete loss of task-related features, thus ensuring semantic fidelity.

[0167] Optionally, in another embodiment of the invention, after generating an anonymous representation of the original semantic vector, as... Figure 5 As shown, it includes:

[0168] S501. Generate anchor point constraint loss based on the anonymous representation of the original semantic vector and the adaptive threshold.

[0169] In the practical application of this invention, the following formula can be used to calculate the anchor point constraint loss:

[0170] .

[0171] S502. Generate an optimization objective based on anchor point constraint loss and privacy loss.

[0172] The optimization objective is used to iteratively adjust the projection matrix, achieving a balance between privacy protection and anchor point preservation. (Privacy loss) To measure the strength of anonymization, measures such as re-identification risk metric and KL divergence can be used, but are not limited to these.

[0173] The final optimization objective L can be expressed as: ;in, for It can be set to This is used to adjust the weight between the two.

[0174] In the practical application of this invention, a semantic utility loss term can also be introduced. This refers to the degree of deviation between the anonymized semantic expression and the original semantic expression. This achieves a balance between privacy protection, anchor preservation, and semantic utility.

[0175] At this point, the final optimization objective L can be expressed as: ;in, and for This is used to adjust the weights among the three.

[0176] in, The anonymized vector can be obtained by calculating the distance between the original semantic vector and the anonymized vector (such as Euclidean distance or cosine similarity), or indirectly estimated by the changes in the performance of downstream tasks. This is not limited here, and it is used to evaluate the effectiveness of anonymized mapping in maintaining semantic consistency. The smaller the value, the higher the semantic preservation and the better the information usability.

[0177] This invention determines the anonymity dimension budget available for each semantic vector through budget allocation, and the optimization objective is to seek the optimal mapping method under the budget constraint so as to preserve the semantic structure as much as possible while reducing the identifiability of sensitive information.

[0178] Optionally, in another embodiment of the present invention, one implementation of the data anonymization method further includes: generating a privacy budget result based on the noise variance of the differential noise and the dimension budget corresponding to the original semantic vector.

[0179] The privacy budget result and the preset privacy threshold are used to automatically adjust the noise level.

[0180] Specifically, first define Then, it can be obtained through, but is not limited to, Advanced Composition:

[0181] ;

[0182] in, This represents the overall privacy budget result, i.e., the privacy budget already used. The growth rate is the upper bound, representing the order of magnitude of overall privacy as a function of the number of occurrences.

[0183] Specifically, the method of automatically adjusting the noise level based on the privacy budget result and the preset privacy threshold can be as follows:

[0184] (1) Calculate the remaining privacy budget It is understandable that if If this happens, it will stop generating additional privacy consumption and return a budget exhaustion warning.

[0185] (2) Determine the privacy budget to be consumed this time according to the preset allocation strategy. and satisfy .

[0186] The preset allocation strategies include, but are not limited to, using all remaining budget at once, distributing it evenly according to the remaining number of operations, or distributing it according to the importance weight of semantic units; no specific restrictions are imposed here.

[0187] (3) Calculate the noise scale, which can automatically calculate the noise standard deviation based on the sufficient condition of the Gaussian mechanism:

[0188] ;

[0189] in, For the sensitivity of the mapping function, This represents the tolerance probability of mismatch. This formula ensures that the current mechanism satisfies... Differential privacy.

[0190] (4) After the noisy mapping is executed, Accumulate to ,Right now It is also written to the privacy accounting log for subsequent budget updates and audit traceability.

[0191] This invention achieves a precise balance between privacy and usability by combining differentiated noise with differential privacy accounting.

[0192] In the practical application of this invention, the anonymous representation of the generated original semantic vector can be evaluated for both privacy and usability. Based on feedback, the dimensional budget, noise, and anchor constraints can be dynamically adjusted to form a closed-loop optimization mechanism, ensuring that the anonymization result always meets the privacy protection threshold and business task requirements.

[0193] Specifically, multi-dimensional metrics can be used to evaluate the privacy strength of anonymized results, such as using pre-trained adversarial detectors. It predicts whether the original features can be reconstructed from the anonymous vectors and outputs a risk score. :

[0194] ;in, This represents the number of semantic units (samples) sampled or tested, i.e., the number of anonymous semantic samples participating in the detection.

[0195] For example: Calculating anonymous distributions Compared with the original distribution Differences:

[0196] ;

[0197] For example: comparison With system threshold If it exceeds the limit, it is considered a risk.

[0198] Specifically, the performance of anonymized data in downstream tasks can be tested, such as classification / prediction accuracy: Cluster purity: Statistical consistency: .in, This represents the number of vector dimensions, that is, the length of the semantic representation.

[0199] If the above assessment results do not meet the preset conditions, an adjustment mechanism will be triggered, for example: if If so, increase the dimensionality budget of the original semantic vectors with high relevance, and reduce the dimensionality budget of the original semantic vectors with low relevance; if or If the threshold is exceeded, the noise variance of the sensitive original semantic vector will increase. If task performance degrades significantly, the threshold should be lowered appropriately. Relax the anchor point constraints.

[0200] The present invention also provides pseudocode for the above-described solution, as shown below:

[0201] def adjust_parameters(R_reid, epsilon_total, Acc, budgets, noise_vars, tau,

[0202] R_thresh, epsilon_max, Acc_min):

[0203] if R_reid > R_thresh or epsilon_total > epsilon_max:

[0204] for i in sensitive_units:

[0205] noise_vars[i] *= 1.2 # Enhance privacy protection

[0206] if Acc < Acc_min:

[0207] redistribute_budget(budgets,increase_on="high_T", decrease_on="low_T")

[0208] tau *= 0.9 # Relax anchor point constraints

[0209] return budgets, noise_vars, tau

[0210] In the practical application of this invention, audit log entries will also be output synchronously, including but not limited to budget allocation results, anchor mapping relationships, noise intensity, adjustment instructions, adjustment reasons, adjustment range, timestamps, hashes, etc., which are not limited here. The audit logs are guaranteed to be tamper-proof and traceable through hash signatures and cross-institutional verification mechanisms, thereby achieving the unification of technical and compliance closed loops.

[0211] This invention maintains a dynamic balance between privacy and usability in anonymization results through continuous evaluation and adjustment; adjustment records are written to audit logs to ensure cross-organizational verifiability; even in the face of new attack models or task changes, this invention can quickly adjust parameters to avoid failure. In test data, after incorporating the adjustment mechanism, this invention can achieve [the desired anonymization result] within 3 iterations. Reduce the accuracy to below the threshold while maintaining a classification accuracy of over 90% of the original accuracy.

[0212] As shown in the above scheme, this invention provides a data anonymization method. It involves extracting features from the original data to obtain a set of original semantic vectors; assigning differentiated dimensional budgets to each original semantic vector in the set; generating anchor constraint relationships for the original semantic vectors based on the original semantic vectors and the anchor point set; and finally processing the original semantic vectors by combining the corresponding dimensional budgets and anchor constraint relationships to generate an anonymous representation of the original semantic vectors. This method balances data privacy protection with analytical usability. Compared to traditional anonymization methods, this invention significantly reduces the risk of privacy leakage while preserving data value, helps reduce compliance risks and human anonymization costs, and improves the efficiency of data utilization in cross-organizational collaborations.

[0213] Another embodiment of the present invention provides a data anonymization device, such as... Figure 6 As shown, it specifically includes:

[0214] The multimodal preprocessing module 601 is used to acquire raw data and extract features from the raw data to obtain a set of raw semantic vectors.

[0215] The dimension budget module 602 is used to determine the dimension budget corresponding to each original semantic vector in the original semantic vector set.

[0216] Optionally, in another embodiment of the present invention, one implementation of the dimension budgeting module 602 includes:

[0217] The sensitivity and relevance determination submodule is used to determine the sensitivity and relevance of each original semantic vector in the original semantic vector set.

[0218] The Dimension Budget submodule is used to determine the Dimension Budget corresponding to the original semantic vector based on the global Dimension Budget, the sensitivity and relevance corresponding to the original semantic vector.

[0219] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0220] The semantic anchoring module 603 is used to generate anchor constraint relationships for the original semantic vector based on the original semantic vector and the set of anchor points.

[0221] The anchor points in the anchor point set are obtained based on the original semantic vectors in the original semantic vector set.

[0222] Optionally, in another embodiment of the present invention, one implementation of the semantic anchoring module 603 includes:

[0223] The similarity determination submodule is used to determine the similarity between the original semantic vector and the set of anchor points for each original semantic vector.

[0224] The constraint relationship establishment submodule is used to establish anchor point constraint relationships for the original semantic vector if the similarity between the original semantic vector and the anchor point set is greater than an adaptive threshold.

[0225] The adaptive threshold is determined by the mean and standard deviation of the similarity between all original semantic vectors and the anchor set.

[0226] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0227] The anonymous mapping execution module 604 is used to process the original semantic vector by combining the dimension budget and anchor constraint relationship corresponding to the original semantic vector, and generate an anonymous representation of the original semantic vector.

[0228] For details on the specific operation of the units disclosed in the above embodiments of the present invention, please refer to the corresponding method embodiments, such as... Figure 1 As shown, it will not be elaborated further here.

[0229] Optionally, in another embodiment of the present invention, one implementation of the anonymous mapping execution module 604 further includes:

[0230] The projection module is used to generate a projection matrix for each original semantic vector in the original semantic vector set, based on the dimension budget of the original semantic vector, and to generate the projection result of the original semantic vector based on the projection matrix.

[0231] The anonymous representation generation submodule is used to introduce differential noise into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector.

[0232] Among them, the anonymous representation of the original semantic vector must satisfy the anchor point constraint relationship of the original semantic vector.

[0233] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0234] Optionally, in another embodiment of the present invention, one implementation of the data anonymization device further includes:

[0235] The dimension budget adjustment module is used to increase the dimension budget of the anchored original semantic vector to the anchor threshold if the dimension budget corresponding to the anchored original semantic vector is lower than the anchor threshold.

[0236] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0237] Optionally, in another embodiment of the present invention, one implementation of the data anonymization device further includes:

[0238] The anchor point constraint loss generation module is used to generate anchor point constraint loss based on the anonymous representation of the original semantic vector and an adaptive threshold.

[0239] An optimized target generation module is used to generate optimized targets based on anchor point constraint loss and privacy loss.

[0240] The optimization objective is used to iteratively adjust the projection matrix.

[0241] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0242] Optionally, in another embodiment of the present invention, one implementation of the data anonymization device further includes:

[0243] The privacy budget result generation module is used to generate privacy budget results based on the noise variance of the differential noise and the dimension budget corresponding to the original semantic vector.

[0244] The privacy budget result and the preset privacy threshold are used to automatically adjust the noise level.

[0245] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0246] like Figure 7 The diagram shown illustrates the system architecture of the overall solution of this invention. A multimodal preprocessing module extracts features from the raw data to obtain a set of raw semantic vectors. Then, a dimension budgeting module, combined with a policy library and regulatory templates, assigns a differentiated dimension budget to each raw semantic vector in the set. A semantic anchoring module generates anchor constraint relationships for the raw semantic vectors based on the raw semantic vectors and the anchor set. Anonymous mapping execution module retrieves a KeySeed from the KeySeed library and processes the raw semantic vectors using the corresponding dimension budget and anchor constraint relationships to generate an anonymous representation of the raw semantic vectors. This anonymous representation Z and its metadata are stored in isolation, and the data is written to an audit log and submitted to the audit log and version management module. An anonymous data analysis module analyzes the generated anonymous representation, generates analysis results and reports, and feeds these results back to the security assessment and adjustment module. Based on the current situation, the module reissues the KeySeed, updates anchor constraints, and updates the dimension budget, etc.

[0247] This invention comprises a dimensional budgeting module, a semantic anchoring module, an anonymous mapping execution module, and a security assessment and adjustment module. These four modules are not isolated but form a progressive, closed-loop feedback architecture. Specifically, dimensional budgeting lays the foundation for anonymous resource allocation, semantic anchoring provides semantic consistency constraints, anonymous mapping execution generates anonymous representations based on this, and security assessment and adjustment feeds the results back to the budgeting and anchoring modules, thereby achieving dynamic optimization and cross-domain consistency.

[0248] As can be seen from the above scheme, this invention provides a data anonymization device. It extracts features from the original data to obtain a set of original semantic vectors; assigns a differentiated dimension budget to each original semantic vector in the set; then generates anchor constraint relationships for the original semantic vectors based on the original semantic vectors and the anchor point set; finally, it processes the original semantic vectors by combining the dimension budgets and anchor constraint relationships corresponding to the original semantic vectors to generate an anonymous representation of the original semantic vectors. This allows the generation of anonymized representations to simultaneously protect data privacy and ensure analytical usability. Compared to traditional desensitization methods, this invention significantly reduces the risk of privacy leakage while preserving data value, helps reduce compliance risks and human desensitization costs, and improves the efficiency of data utilization in cross-organizational collaborations.

[0249] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0250] Another embodiment of the present invention provides an electronic device, such as... Figure 8 As shown, it includes:

[0251] One or more processors 801.

[0252] Storage device 802, on which one or more programs are stored.

[0253] When the one or more programs are executed by the one or more processors 801, the one or more processors 801 implement the data anonymization method as described in the above embodiments.

[0254] Another embodiment of the present invention provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data anonymization method as described in the above embodiments.

[0255] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0256] It should be noted that the computer-readable medium described above in this invention can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0257] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0258] Another embodiment of the present invention provides a computer program product, which, when executed, is used to perform the above-described data anonymization method.

[0259] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments of the present invention.

[0260] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in this invention is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely exemplary forms for implementing the invention.

[0261] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of the invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0262] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the specific combination of the above-described technical features, but also includes other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with technical features of the present invention (but not limited to) that have similar functions.

Claims

1. A data anonymization method, characterized in that, include: Obtain the raw data and extract features from the raw data to obtain the raw semantic vector set; For each original semantic vector in the original semantic vector set, determine the dimension budget corresponding to the original semantic vector; Based on the original semantic vector and the set of anchor points, an anchor point constraint relationship is generated for the original semantic vector; wherein, the anchor points in the set of anchor points are obtained based on the original semantic vectors in the set of original semantic vectors; The original semantic vector is processed by combining the dimension budget and anchor constraint relationship corresponding to the original semantic vector to generate an anonymous representation of the original semantic vector.

2. The data anonymization method according to claim 1, characterized in that, The step of determining the dimension budget corresponding to each original semantic vector in the original semantic vector set includes: For each original semantic vector in the original semantic vector set, determine the sensitivity and relevance corresponding to the original semantic vector; The dimensional budget corresponding to the original semantic vector is determined based on the global dimensional budget, the sensitivity, and the relevance of the original semantic vector.

3. The data anonymization method according to claim 1, characterized in that, The step of generating anchor constraint relationships for the original semantic vector based on the original semantic vector and the anchor point set includes: For each original semantic vector, determine the similarity between the original semantic vector and the set of anchor points; If the similarity between the original semantic vector and the anchor point set is greater than an adaptive threshold, then an anchor point constraint relationship is established for the original semantic vector; wherein, the adaptive threshold is determined by the mean and standard deviation of the similarity between all the original semantic vectors and the anchor point set.

4. The data anonymization method according to claim 3, characterized in that, If the similarity between the original semantic vector and the anchor point set is greater than an adaptive threshold, then after establishing the anchor point constraint relationship of the original semantic vector, the method further includes: If the dimensional budget corresponding to the anchored original semantic vector is lower than the anchor threshold, then the dimensional budget corresponding to the anchored original semantic vector is increased to the anchor threshold.

5. The data anonymization method according to claim 3, characterized in that, The step of processing the original semantic vector by combining the dimension budget and anchor constraint relationship corresponding to the original semantic vector to generate an anonymous representation of the original semantic vector includes: For each original semantic vector in the original semantic vector set, a projection matrix is ​​generated based on the dimension budget corresponding to the original semantic vector, and a projection result of the original semantic vector is generated based on the projection matrix; Differential noise is introduced into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector; wherein the anonymous representation of the original semantic vector must satisfy the anchor point constraint relationship of the original semantic vector.

6. The data anonymization method according to claim 5, characterized in that, After introducing differential noise into the projection result of the original semantic vector to obtain an anonymous representation of the original semantic vector, the method further includes: Anchor point constraint loss is generated based on the anonymous representation of the original semantic vector and the adaptive threshold. An optimization objective is generated based on the anchor point constraint loss and privacy loss; wherein the optimization objective is used to iteratively adjust the projection matrix.

7. The data anonymization method according to claim 5, characterized in that, Also includes: A privacy budget result is generated based on the noise variance of the differential noise and the dimension budget corresponding to the original semantic vector; wherein the privacy budget result and a preset privacy threshold are used to automatically adjust the noise scale.

8. A data anonymization device, characterized in that, include: A multimodal preprocessing module is used to acquire raw data and extract features from the raw data to obtain a set of raw semantic vectors. The dimension budget module is used to determine the dimension budget corresponding to each original semantic vector in the original semantic vector set. The semantic anchoring module is used to generate anchor constraint relationships for the original semantic vectors based on the original semantic vectors and the anchor point set; wherein the anchor points in the anchor point set are obtained based on the original semantic vectors in the original semantic vector set. The anonymous mapping execution module is used to process the original semantic vector by combining the dimension budget and anchor constraint relationship corresponding to the original semantic vector, and generate an anonymous representation of the original semantic vector.

9. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the data anonymization method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the data anonymization method as described in any one of claims 1 to 7.

Images