Data circulation risk identification method and system based on cognitive games of multiple vertical class large models

Abstract

The invention discloses a data circulation risk identification method and system based on a multi-droop large model cognitive game, and belongs to the technical field of artificial intelligence. The method comprises the steps that a corpus containing multi-source data is constructed, and a vector knowledge base supporting mixed retrieval is established after processing; designing a compliance evaluation system fusing the general dimension and the dynamic scene dimension; training by utilizing domain data to obtain a vertical class large model of a data compliance domain; based on an intelligent body examination enhancement generation and thinking chain technology, driving a plurality of vertical class large models to perform a structured cognitive game and iterative convergence, and forming a consensus risk list; and finally, generating a risk identification report through case matching verification. According to the method, through multi-source knowledge fusion and a multi-vertical-class large model cognitive game mechanism, the randomness of large model output is inhibited, the problems of low manual auditing efficiency and insufficient professional property of a general large model are solved, and efficient and reliable data circulation risk identification is realized.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a data circulation risk identification method and system based on cognitive game theory using multiple vertical models, for automatically identifying security risks in different data application scenarios. Background Technology

[0002] With the advent of the digital economy era, data has become a new type of production factor. The healthy development of the data factor market requires ensuring the security and compliance of data during its circulation and application. Currently, compliance audits of data application scenarios mainly rely on manual work by domain experts. This work is highly complex and interdisciplinary, requiring auditors to be familiar with both data security laws and regulations and specific industry knowledge.

[0003] In existing technologies, data compliance auditing mainly suffers from the following problems: First, manual auditing is inefficient, time-consuming, and labor-intensive, making it difficult to cope with rich and rapidly changing data usage scenarios; second, audit quality relies on personal experience, lacking unified and objective standards, and is prone to omissions and biases; third, the audit knowledge system cannot be dynamically updated, making it difficult to quickly adapt to newly issued policy documents or newly occurring security cases. In recent years, large-scale artificial intelligence models have demonstrated powerful natural language understanding and reasoning capabilities, providing potential for automated auditing. However, directly applying large-scale models to the highly specialized field of data compliance auditing has two shortcomings: First, insufficient ability to contextualize abstract legal principles. The data compliance legal system contains a large number of abstract clauses, and the compliance boundaries of these clauses need to be professionally interpreted and contextualized in conjunction with specific business scenarios. Although general-purpose large-scale models can memorize legal provisions, they lack an analytical framework that combines abstract principles with specific business practices, making it difficult to form accurate compliance judgments in the ambiguity of "what is necessary" and "what is sufficient," resulting in audit opinions lacking practical guidance value. Second, inconsistent results lead to low reliability. The answers of large-scale models are based on probability generation and have inherent randomness. When faced with multiple questions in the same audit scenario, the large model may provide different or even contradictory answers. This uncertainty makes the results unreliable and fails to meet the high standards of consistency and accuracy required by compliance audits.

[0004] Therefore, there is an urgent need in this field for a technical solution that can overcome the above-mentioned defects, which can integrate professional domain knowledge and ensure the stability and reliability of the output results, thereby achieving efficient, automated and intelligent data compliance auditing. Summary of the Invention

[0005] The purpose of this invention is to provide a method that can effectively utilize the knowledge and reasoning capabilities of large models to achieve multi-source knowledge fusion and cognitive game theory among multiple vertical models, thereby solving the existing problems in the background technology, realizing automatic identification of security risks in data application scenarios, and improving audit efficiency and accuracy.

[0006] To achieve the above objectives, the present invention provides the following two technical solutions. Firstly, the present invention provides a method for identifying data flow risks based on cognitive game theory using multiple vertical category models. The method includes the following steps:

[0007] 1. Construct a data security compliance corpus, which contains four types of multi-source data: laws and regulations, standards and norms, real-world cases, and opinion discussions. The corpus is managed efficiently through systematic collection, preprocessing, annotation, and vectorization.

[0008] 2. Design a multi-dimensional compliance evaluation index system, which includes a general review dimension preset by humans and a personalized review dimension dynamically instantiated based on a "principle-scenario" mapping rule base, so as to guide the large model to conduct structured and standardized quantitative evaluation;

[0009] 3. Domain-adaptive model training: Supervised fine-tuning of the basic large language model using opinion argument data, enabling it to deeply master professional knowledge and reasoning patterns in the field of data compliance;

[0010] 4. Based on agent retrieval-enhanced generation and thought chain-based multi-model cognitive game, agent retrieval-enhanced generation provides accurate knowledge support for the model, integrates creative problem-solving models from the field of psychology into the thought chain, forms a critical thinking path that combines divergent and convergent thinking, enhances the reliability of reasoning, and drives multiple models to conduct multiple rounds of structured debate and iterative convergence to form a consensus risk list.

[0011] 5. Verification and report generation: The consensus-based risk list is matched and verified with real-world cases in the corpus, and a structured data compliance review report is output based on the verification results.

[0012] Secondly, the present invention provides a data flow risk identification system based on cognitive game theory with multiple vertical categories, used to implement the method described in the first aspect above. The system includes five modules corresponding one-to-one with the steps of the method:

[0013] 1. Corpus Management Module: This module stores and manages four types of multi-source data related to data security and compliance: laws and regulations, standards and specifications, real-world cases, and opinion discussions. It also enables dynamic updates to the corpus.

[0014] 2. Compliance evaluation system module, used to configure and manage a multi-dimensional compliance evaluation indicator system, including manually preset general review dimensions and personalized review dimensions dynamically instantiated based on the "principle-scenario" mapping rule base;

[0015] 3. Domain-adaptive model training module, used to perform supervised fine-tuning of the basic large language model using opinion argument data, producing a model with domain-specific knowledge of data compliance;

[0016] 4. Cognitive game theory module, used to realize multi-model initialization and role allocation, business scenario analysis and intelligent agent retrieval enhancement generation, thought chain-guided multi-round structured debate, and the formation of consensus risk list;

[0017] 5. Verification and report generation module, used to match and verify the consensus risk list with corpus cases, and generate a structured data compliance review report.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0019] First, enhance the professionalism of risk identification. On the one hand, by building a multi-source compliance corpus, large models can gain a deep understanding of professional knowledge in the field of data compliance; on the other hand, by designing a multi-dimensional compliance evaluation index system that includes general review dimensions and personalized review dimensions, abstract legal principles can be transformed into assessable and quantifiable review points in specific business scenarios.

[0020] Second, improve the reliability of risk identification. By using intelligent agent retrieval to enhance the cognitive game mechanism of multiple large-scale vertical models guided by thought chains, the model is provided with accurate knowledge support, and its reasoning process is made transparent and verifiable. Through multiple rounds of debate and consensus iteration, the randomness and contradictions of the large model output are effectively suppressed, resulting in stable, consistent, and highly reliable risk identification results.

[0021] Third, automation and high efficiency. Automating the risk identification process improves identification efficiency and overcomes the bottleneck of manual review.

[0022] Fourth, continuous evolution. The dynamic update mechanism of the corpus and evaluation system enables the system to adapt to continuous changes in laws, regulations, and business scenarios. Attached Figure Description

[0023] Figure 1 The flowchart illustrates a data flow risk identification method based on cognitive game theory with multiple vertical categories, as provided in this embodiment of the invention.

[0024] Figure 2 This is a framework diagram of a data flow risk identification system based on cognitive game theory with multiple vertical models, provided in an embodiment of the present invention.

[0025] Figure 3 This is a schematic diagram of the composition of a computer system provided in an embodiment of the present invention. Detailed Implementation

[0026] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Please refer to... Figure 1 The specific implementation process of this method is as follows:

[0027] Step S1: Construct a comprehensive and dynamic data security compliance corpus to support subsequent identification of data circulation risks. The corpus contains four types of multi-source data related to data security: laws and regulations, standards and specifications, real-world cases, and opinions and arguments. It is managed efficiently through systematic collection, preprocessing, annotation, and vectorization.

[0028] As one implementation method, step S1 can be specifically implemented as the following steps S11-S14:

[0029] Step S11: Data Collection. Data collection is a process of legally gathering multi-source data from authoritative and publicly available channels, using a combination of automated collection and expert screening. Multi-source data includes four categories: laws and regulations, standards and norms, real-world cases, and opinions and arguments.

[0030] Step S12: Data Preprocessing. Data preprocessing is the process of standardizing the collected multi-source data and transforming it into standardized text data that can be recognized by the large model. Specific processing includes: for unstructured data such as images and documents, the system routes the data to the corresponding dedicated parser based on the file type, uniformly encoding the extracted text into Markdown standard format text, which serves as the standard input for subsequent processing; cleaning the converted standard text data, including removing irrelevant content based on predefined regular expression rules, and filtering advertisements and redundant information by combining keyword blacklists and rule-based pattern matching. Legal and regulatory data is organized into a uniformly structured text file for subsequent prompt input; opinion and argument data is organized into a standardized text file for model training.

[0031] Step S13: Data Labeling. Data labeling is the process of parsing and adding semantic tags to preprocessed standard and normative data and real-world case data to support subsequent accurate retrieval and risk analysis. Labeling is based on a finely tuned large language model, automatically generating four types of semantic tags for each data entry: domain tag, data subject nature tag, data nature tag, and data usage scenario tag. The domain tag identifies the main industry or field involved in the data content, with values ​​including manufacturing, finance, healthcare, transportation, and public services; for general content, it is labeled "general". The data subject nature tag identifies the nature of the data processor or responsible organization involved in the data content, with values ​​including government agencies, public institutions, limited liability companies, and individuals; for content covering multiple subjects, multiple tags are used. The data nature tag identifies the core data type defined by the data content, with values ​​including personal information, organizational data, and public data; for data involving multiple data types, multiple tags are used. Data usage scenario tags are metadata used to identify the data processing and application scenarios that the data content focuses on. Their values ​​include internal management and operation, product and service delivery, marketing campaign support, R&D and technology improvement, compliance and security monitoring, and data sharing and transactions. For general scenarios, they are labeled as "general".

[0032] Step S14: Construct a vector retrieval library. The vector is a fixed-length numerical array that converts the semantic information of text. Each numerical value represents a feature of the text in a certain semantic dimension, thus transforming the semantic content of the text into a numerical form that can be processed by a computer and supports mathematical operations. The vector retrieval library is a knowledge index library that supports a hybrid retrieval mechanism, constructed separately for standard and normative data and real-world case data corpora. First, based on an open-source text embedding model, the corpus text and its associated multi-dimensional semantic tags are jointly vectorized and encoded to generate a unified high-dimensional vector representation. Then, using vector database technology, independent approximate nearest neighbor indexes are constructed for the two types of corpora, forming a standard and normative vector library and a real-world case vector library. The hybrid retrieval mechanism is a multi-stage retrieval strategy that integrates precise matching based on metadata and semantic similarity matching based on vector space. First, based on business scenario requirements, semantic tags are used as filtering conditions for preliminary retrieval to narrow down the candidate set. Within the filtered candidate set, deep semantic matching is performed by calculating the cosine similarity between the query vector and the corpus vector, ultimately realizing a hybrid retrieval process of "keyword filtering + vector semantic retrieval," providing accurate knowledge support for the risk review process.

[0033] Step S2: Design a multi-dimensional compliance evaluation index system. This compliance evaluation index system is a quantitative assessment framework that integrates expert wisdom and references multi-source knowledge bases. Its purpose is to guide large-scale models in conducting structured and standardized compliance reviews and quantitative scoring of data application scenarios. The system consists of general review dimensions applicable to all scenarios, and personalized review dimensions that need to be instantiated based on specific business scenarios.

[0034] As one implementation method, step S2 can be specifically implemented as the following steps S21-S23:

[0035] Step S21: Manually Pre-set General Review Dimensions. General review dimensions are universal and fundamental compliance requirements covering the entire data lifecycle, extracted by domain experts based on the fundamental legal framework of the *Cybersecurity Law*, *Data Security Law*, and *Personal Information Protection Law*. These dimensions serve as review benchmarks applicable to all data application scenarios. The dimensions include "Legality of Data Source," "Clear Purpose and Limitation Principle," "Minimum Necessity Principle," "User Notification and Consent," and "Data Security Measures." Each dimension is transformed into a set of standardized scoring questions, employing a quantitative scoring system or binary judgment. The scoring rules are based on clear right-or-wrong judgments or factual existence, and are automatically executed by the system's pre-set logical decision tree.

[0036] Step S22: Dynamic Instantiation of Personalized Review Dimensions. Personalized review dimensions are the process of dynamically generating specific and evaluable evaluation points for specific business scenarios by using an expert-preset "principle-scenario" mapping rule base for abstract legal principles whose compliance boundaries depend on specific scenarios. This rule base is stored in a structured form and clearly defines which aspects of the abstract compliance principles should be concretized into when a business scenario has certain label characteristics.

[0037] Step S23: Indicator System Synthesis and Quantitative Standard Binding. Indicator system synthesis is the process of integrating general and personalized dimensions, binding quantitative scoring standards to all dimensions, and ultimately forming a complete and executable evaluation indicator system. The system merges general and personalized review dimensions to form a complete set of review dimensions for the current business scenario. Subsequently, referencing standard specifications and real-world cases in the corpus, the system generates clear scoring rules and evidence requirements for each personalized dimension, ensuring that the large model has a basis for subsequent reviews. Finally, the system outputs a complete, highly adapted structured compliance evaluation indicator system to the specific business scenario to guide subsequent quantitative scoring.

[0038] Step S3: Domain-Adaptive Model Training. Domain-adaptive model training involves supervised fine-tuning of the basic large language model using opinion argument data to enable it to deeply grasp professional knowledge, contextualized reasoning patterns, and risk assessment logic within the data compliance domain. This step aims to build a domain expert model, providing core intellectual support for subsequent complex risk reasoning and cognitive game theory. The training process uses next-word prediction based on cross-entropy loss as the standard language modeling objective. By inputting opinion argument data that integrates specific scenarios, legal provisions, and professional judgments, and is constructed in an "instruction-output" format, the model learns to predict the next word that best fits the domain knowledge given compliance review instructions and context. To achieve efficient and stable parameter updates, the model training employs a parameter efficiency fine-tuning method, specifically the Low-Rank Adaptation (LoRA) method. This method optimizes only the trainable low-rank matrix (typically less than 8 rank) injected into the model's Transformer layer, while freezing most of the original model parameters, thus achieving domain adaptation of the model with lower computational cost. During training, the system evaluates model performance and determines optimal checkpoints by monitoring the decreasing trend of validation loss and accuracy on a separate validation set for compliance question answering tasks. Through this process, the model internalizes expertise in data compliance, thereby improving its accuracy in making compliance judgments in ambiguous areas.

[0039] Step S4: Cognitive Game Theory Based on Agent Retrieval Enhanced Generation and Thinking Chain of Multiple Vertical Large Models. This step provides real-time and accurate knowledge support to the model through agent retrieval enhanced generation technology, requires the model to demonstrate its reasoning process through thinking chain technology to enhance logical reliability, and uses a cognitive game theory mechanism of multiple vertical large models to examine risks from different perspectives, ultimately iteratively converging to form a highly credible consensus risk list.

[0040] As one implementation method, step S4 can be specifically implemented as the following steps S41-S44:

[0041] Step S41: Initialization and Role Assignment of Multiple Vertical Large Models. Vertical large models refer to large language models that have undergone in-depth fine-tuning or training with domain-specific data, thereby possessing expert-level knowledge, terminology comprehension, and professional reasoning capabilities within a specific vertical domain. This process instantiates the trained domain-adaptive models into multiple independently running models and assigns them complementary cognitive roles through carefully designed prompt word engineering for game-like interaction. The system loads the domain-adaptive models as multiple completely isolated reasoning instances in memory (Model A and Model B), ensuring that the parameters of each model do not interfere with the dialogue context. Role assignment is achieved by injecting exclusive system prompt words into each model: the divergent model (Model A) is configured as a "risk explorer," employing higher temperature parameters to encourage diversity in generation. Its core responsibility is to engage in creative and associative thinking, striving to maximize the discovery of potential risk points. The convergent model (Model B) is configured as a "risk verifier," employing lower temperature parameters to ensure the determinism and rigor of the output. Its core responsibility is to conduct critical and rigorous logical review, verifying the authenticity of risk points.

[0042] Step S42: Business Scenario Analysis and Agent-Based Retrieval Enhancement Generation. Agent-Based Retrieval Enhancement Generation (AgenticRAG) is an intelligent retrieval method that dynamically supplements the initial retrieval results through a recall mechanism and an agent. First, the system receives a textual description of a compliance scenario input by the user and uses it as a query condition to retrieve relevant precedents or compliance examples from the case library. These cases typically cite specific legal provisions (such as "Article X of the XX Law"), but generally do not contain the complete content of that provision. To compensate for this information gap, this patent designs a probability-based legal regulation recall mechanism. It utilizes a trained Cross-Encoder ranking model, taking the input compliance scenario and the retrieved cases as model inputs to predict the probability of its relevance to various laws and regulations in the knowledge base. The ranking model outputs a score indicating the likelihood that each law or regulation is touched by the scenario or case. Subsequently, the system selects the top K laws and regulations by probability, retrieves their full text from the legal knowledge base, and then submits it to an agent driven by a large language model for provision condensation processing. This intelligent agent can combine the original scenario and case context to extract the specific legal provisions most likely to be triggered, forming a structured and interpretable compliance basis. Ultimately, the accurate and complete knowledge set obtained by this intelligent agent will be used as key context inputs to various models participating in cognitive game, achieving high-quality intelligent agent retrieval enhancement generation, ensuring that the model's judgment is based on specific domain knowledge, rather than relying solely on internal parameter memory.

[0043] Step S43: Multi-round Structured Cognitive Game Guided by Thinking Chains. Thinking Chain (COT) technology is a prompting method that guides large language models to externalize their internal reasoning processes. This technology requires the model to generate a series of intermediate reasoning steps to arrive at the answer, making the model's logical chain transparent and traceable, thus enhancing the reliability and verifiability of the generated results. The system drives multiple large vertical models to engage in multi-round cognitive games around the retrieved knowledge, requiring each party to output its complete reasoning process in the form of thinking chains, not just the final conclusion. The specific cognitive game process is as follows:

[0044] First, each model performs simultaneous independent reasoning. The system simultaneously provides the divergent model (Model A) and the convergent model (Model B) with a description of the business scenario and relevant knowledge retrieved from S42. Model A, acting as a "risk explorer," engages in creative and associative thinking to generate a preliminary risk list that is as comprehensive as possible; Model B, acting as a "risk verifier," conducts rigorous and prudent assessments to generate a risk list supported by strict evidence. Both are required to output in a thought chain format, meaning that each risk point must be accompanied by its reasoning basis.

[0045] Secondly, the models engage in a debate and revision process. The system exchanges risk lists and their complete thought processes generated by each party. Model B is required to rigorously examine Model A's thought process, scrutinizing its logical flaws, insufficient evidence, or over-inferences, and provide targeted rebuttals. Simultaneously, Model A is required to examine Model B's thought process, reviewing its potential conservatism and omissions, identifying unincorporated potential risks, and providing defense and supplementary arguments for these risks. Based on the other party's review comments, each model revises its risk list and thought process, resulting in an updated version.

[0046] Finally, iterative convergence and consensus are formed. The above process of "synchronous generation-exchange-adversarial-correction" constitutes a complete cognitive game round and is iterated multiple times. After each round of the game, the system executes a quantitative consensus extraction process. The consensus extraction process is an iterative process based on semantic comparison using a large language model: the system calls a large language model as the consensus extraction model, inputs the results generated by each model after the current round of correction into the model, and requires it to identify and list all consensus risk points that are judged to describe the same risk entity, as well as risk points unique to each model (also known as divergence points). Consensus degree is a quantitative indicator used to measure the consistency of the output results of each model. The system presets a consensus degree threshold and a maximum divergence point number threshold. The system will execute iterative decisions: if the consensus degree of the current round reaches the preset consensus degree threshold, and the total number of divergence points in the current round is less than or equal to the preset maximum divergence point number threshold, then consensus is determined to have been fully formed, and the cognitive game iteration terminates. If the above conditions are not met, the system will take all divergence point sets identified in the current round as the core focus of the next round of cognitive game and proceed to the next round of iteration. The process iterates until the consensus requirements are met or the preset maximum number of iterations is reached. When the iteration terminates, the system synthesizes a list of outcome risks, including current consensus risk points and disagreement risk points.

[0047] Step S44: Formation of the Consensus Risk List. The system performs a final synthesis of the risk list output after the termination of the cognitive game iteration. For risk points where consensus is reached, they are directly included in the consensus risk list; for risk points where disagreements remain, the system retains the main arguments of each party and marks them as "disputed items," presenting them in the final report to provide reviewers with comprehensive decision-making references.

[0048] Step S5: Verification and Report Generation. Verification and report generation involves case matching and validation of the consensus risk list, and automatically outputting a structured risk identification report. Each risk point in the risk list obtained in Step S4 is used as query input. After vectorization through a BGE embedding model, an approximate nearest neighbor search is performed in the vector index of the real-world case sub-library, setting a similarity threshold to filter out highly relevant real-world cases. By comparing the handling results of risk points with similar cases, dual verification is achieved: if a risk point is identified as a violation in a similar case, the severity level of the risk point and the confidence of the review conclusion are significantly enhanced; if no similar cases are found or similar behaviors are deemed compliant in cases, it provides important reference for reviewers to further assess the situation. Subsequently, the system converts the verified risk list into a unified, machine-readable and human-readable structured format according to a preset standardized report template. The final output includes at least the following structured fields: risk point name, risk point description, cited compliance clauses, case source, and status flag (consensus reached / disputed).

[0049] Corresponding to the data flow risk identification method based on cognitive game theory with multiple vertical categories described in the first aspect above, this invention also provides a systematic implementation method. Please refer to... Figure 2 , Figure 2 This is a system framework diagram provided for an embodiment of the present invention. The system includes the following modules: A corpus management module, serving as the system's basic data support, is responsible for the collection, preprocessing, semantic annotation, and vectorized storage of multi-source data, and maintains two independent vector retrieval libraries: standard specifications and real-world cases, supporting a hybrid retrieval mechanism based on tags and semantics. A compliance evaluation system module receives general review dimensions preset by experts through a configuration management interface, and dynamically instantiates personalized review dimensions for specific business scenarios based on a "principle-scenario" mapping rule library, constructing a complete multi-dimensional evaluation index system. A domain-adaptive model training module is responsible for efficiently fine-tuning the parameters of selected large language models using opinion argument data to produce domain expert models. A cognitive game module, as the core analysis engine, first initializes multiple vertical large models participating in cognitive game and assigns roles, then analyzes the input business scenarios and uses intelligent agent retrieval enhancement generation technology to acquire relevant knowledge, and finally drives multiple vertical large models to conduct multi-round structured cognitive game and iterative convergence guided by thought chains, outputting a consensus risk list. A verification and report generation module performs case matching verification of consensus risks and automatically generates a structured data flow risk identification report according to a standardized template.

[0050] Please see Figure 3 , Figure 3 This is a schematic diagram of a computer system provided in an embodiment of the present invention. The computer system includes at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 can be connected via a bus or other means. The processor 101 (or central processing unit, CPU) is the computing and control core of the computer system, capable of parsing various instructions and processing various data within the computer system. The communication interface 102 may optionally include a standard wired interface or a wireless interface (such as WIFI, mobile communication interface, etc.), and can be used to send and receive data under the control of the processor 101; the communication interface 102 can also be used for data transmission and interaction within the computer system. The memory 103 is a memory device in the computer system used to store programs and data. It is understood that the memory 103 here can include the computer system's built-in memory, or it can include extended memory supported by the computer system. The memory 103 provides storage space, which stores the computer system's operating system.

[0051] In one embodiment, the processor 101 executes the data flow risk identification method based on cognitive game theory with multiple vertical categories provided above by running a computer program in the memory 103.

Claims

1. A method for identifying data flow risks based on cognitive game theory using multiple vertical models, characterized in that, Includes the following steps: A data security compliance corpus is constructed, which contains four types of multi-source data: laws and regulations, standards and norms, real-world cases and opinions. The corpus is managed efficiently through systematic collection, preprocessing, annotation and vectorization. Design a multi-dimensional compliance evaluation index system, which includes manually preset general review dimensions and personalized review dimensions dynamically instantiated based on a "principle-scenario" mapping rule base, to guide the large model to conduct structured and standardized quantitative evaluation; Domain-adaptive model training utilizes opinion and argumentation data to perform supervised fine-tuning of the basic large language model, in order to produce a vertical large model with data-compliant domain expertise and reasoning patterns; Based on agent retrieval enhancement generation and thought chain, multiple vertical large-scale models engage in cognitive game. Agent retrieval enhancement generation technology provides accurate knowledge support for the model, thought chain technology enhances the reliability of reasoning, and drives multiple vertical large-scale models to conduct multi-round structured cognitive game and iterative convergence to form a consensus risk list. The verification and report generation process involves matching the consensus-based risk list with real-world cases in the corpus based on vector similarity, and outputting a structured data circulation risk identification report based on the verification results.

2. The method according to claim 1, characterized in that, The steps for constructing the data security compliance corpus specifically include: Data from multiple sources is collected from authoritative and publicly available channels by combining automated collection based on a distributed web crawler framework with expert screening. The automated collection includes DOM tree parsing of static web page content and headless browser simulation of dynamically loaded content. The collected data is preprocessed, including routing to a dedicated parser based on file type for text extraction and conversion, encoding it into Markdown standard format text, and cleaning the data to obtain standardized text data. The large language model, after being fine-tuned by instructions, is invoked to automatically perform multi-dimensional semantic annotation on standard and normative data and real-world case data corpora, generating four types of semantic tags, including the domain, the nature of the data subject, the nature of the data, and the scenario in which the data is used. Based on an open-source text embedding model, the corpus and its semantic tags are jointly vectorized and encoded. Vector database technology is used to build independent vector indexes for standard specification data and real-world case data, forming a vector knowledge base that supports a hybrid retrieval mechanism.

3. The method according to claim 2, characterized in that, The hybrid retrieval mechanism is a two-stage retrieval method comprising the following steps: In the first stage, keyword matching is performed based on multi-dimensional semantic tags of business scenarios. The semantic tags are used as metadata filtering conditions, and Boolean queries are used in the vector database to filter out an initial set of documents with matching tags from the full corpus. In the second stage, vector similarity retrieval is performed based on the complete description text of the business scenario. The text is encoded into a query vector through a text embedding model, and an approximate nearest neighbor search is performed in the vector subspace corresponding to the initial document set. The most relevant target documents are returned in order of similarity.

4. The method according to claim 1, characterized in that, The steps for designing the multi-dimensional compliance evaluation index system specifically include: Domain experts pre-define common review dimensions, with each dimension corresponding to a set of standardized scoring questions based on logical decision trees; A "principle-scenario" mapping rule base is constructed. The rule base is stored in a structured form and clearly defines the auditable key points that abstract compliance principles should be concretized into when a business scenario has specific semantic tag features. Based on the semantic tags obtained from the business scenario analysis, the "principle-scenario" mapping rule library is queried, and all applicable specific review points are matched and summarized to form a personalized review dimension set. By merging general review dimensions and personalized review dimensions, and referencing standard specifications and real-world cases in the corpus, quantitative scoring criteria are bound to each dimension, forming a complete multi-dimensional compliance evaluation indicator system that is highly adapted to business scenarios.

5. The method according to claim 1, characterized in that, The training of the domain adaptation model specifically involves: We employ a low-rank adaptive parameter efficiency fine-tuning method, which injects a trainable low-rank matrix into the Transformer layer of the basic large language model and performs supervised fine-tuning based on the constructed "instruction-output" format training data, with cross-entropy loss and next word prediction as the objectives. During training, model performance is evaluated and optimal checkpoints are determined by monitoring validation loss and task accuracy on an independent validation set, thereby producing large-scale vertical models with expert-level knowledge, terminology understanding, and professional reasoning capabilities in the field of data compliance.

6. The method according to claim 1, characterized in that, The cognitive game steps of the multi-vertical large-scale model based on agent retrieval enhancement generation and thought chain specifically include: The trained domain-adaptive models are loaded as completely isolated inference instances in memory. Each model is then configured as a divergent model and a convergent model with complementary cognitive roles by injecting exclusive system prompts into each model. The divergent model is guided to engage in creative and associative thinking to uncover risks, while the convergent model is guided to engage in critical and rigorous logical examination to verify risks. The input business scenario description is parsed, and preliminary relevant knowledge is obtained from the vector knowledge base through a hybrid retrieval mechanism. The preliminary retrieval results are dynamically evaluated and supplemented by an intelligent agent driven by a large language model to realize intelligent agent retrieval enhancement generation. The final accurate knowledge set is then used as context to input into the large model. Each vertical category's large model is driven to synchronously and independently generate a risk list with accompanying thought chains based on the retrieved knowledge. The risk lists and thought chains generated by each model are exchanged, guiding the models to conduct multiple rounds of viewpoint confrontation and cognitive game process. After each round, the consensus degree is calculated based on semantic comparison until the consensus formation conditions are met or the maximum number of iterations is reached, forming a consensus-based risk list.

7. The method according to claim 6, characterized in that, The iterative convergence and consensus formation in the multi-round structured cognitive game guided by the thought chain specifically include: After each round of cognitive game, the consensus extraction model is invoked to perform semantic comparison on the risk list updated by each model, and to identify consensus risk points and points of disagreement. Calculate the consensus level for this round, which is the ratio of the number of consensus risk points to the total number of risk points in all models; If the consensus level in the current round reaches the preset consensus level threshold and the number of disagreements is lower than the preset maximum number of disagreements threshold, the iteration will terminate. Otherwise, the disagreements will be used as the core focus of the next round of cognitive game and the iteration will continue until the consensus formation conditions are met or the maximum number of iterations is reached.

8. A data flow risk identification system based on cognitive game theory with multiple vertical categories for implementing the method as described in any one of claims 1 to 7, characterized in that, include: The corpus management module is used to manage multi-source data through distributed crawler collection, multi-format parsing and preprocessing, automated annotation of large models, and vector index construction. The compliance evaluation system module is used to manage general review dimensions through the configuration interface and dynamically instantiate personalized review dimensions based on the "principle-scenario" mapping rule base to build a multi-dimensional compliance evaluation indicator system. The domain-adaptive model training module is used to perform supervised fine-tuning of the basic large language model using opinion argument data, and produce a vertical large model with domain-specific expertise in data compliance. The cognitive game reasoning module is used to initialize and assign roles to multiple vertical large models, analyze business scenarios and enhance the generation of intelligent agent retrieval, conduct multi-round structured cognitive games guided by thought chains, and form a consensus-based risk list. The verification and report generation module is used to verify the consensus risk list by matching it with the case library through vector similarity and automatically generate a structured data circulation risk identification report.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data flow risk identification method based on cognitive game theory with multiple vertical categories as described in any one of claims 1 to 7.

Images