A privacy data desensitization optimization method and system for document archives

Abstract

The application discloses a kind of private data desensitization optimization methods and systems for archives, belong to natural language processing technical field.The method is by constructing the semantic space hetero-graph that fuses text semantic logic and layout space structure, it is converted into the topological structure that can be calculated to unstructured archives;Adopt the disambiguation sensitive entity recognition method that combines space correction attention and document theme constraint, realize the accurate positioning of polysemy sensitive entity;Based on information entropy risk assessment and access permission constraint, generate adaptive generalization instruction, dynamically match different desensitization strategies;Finally, through desensitization data stream reorganization mechanism, complete sensitive information replacement and format repair under the premise of maintaining original layout structure and semantic coherence.The scheme can effectively solve the problems of semantic ambiguity, desensitization strategy rigidity and layout distortion after desensitization in the existing document desensitization process, improve the accuracy, availability and compliance of document archive desensitization processing.

Description

Technical Field

[0001] This invention relates to the field of natural language processing technology, specifically to a method and system for de-identifying and optimizing privacy data in document archives. Background Technology

[0002] The privacy-sensitive data desensitization optimization method for official documents is an intelligent processing approach that accurately identifies, hierarchically generalizes, and compliantly replaces sensitive privacy information in unstructured or semi-structured official documents while maintaining the integrity of the original semantic logic and layout. This method maps document content into a computational graph structure that integrates semantic relationships and spatial layout, introduces an anti-ambiguous sensitive entity recognition mechanism and an adaptive desensitization strategy based on risk and permissions, and achieves flexible control over the strength of privacy protection under different usage scenarios. This maximizes the preservation of the usability of document data while ensuring privacy security, making it suitable for applications with high requirements for data compliance and usability, such as government affairs, judicial systems, and archives management.

[0003] However, existing methods for desensitizing privacy data in document archives have technical problems. The desensitization process is based on linear text or simple field matching, which makes it difficult to simultaneously take into account the semantic logic of the document content and the consistency of the page structure. Furthermore, it is prone to semantic breaks, layout errors, or compliance verification failures after desensitization.

[0004] In the existing process of constructing heterogeneous semantic space graphs, there are technical problems that rely solely on text order or page spatial proximity for structural modeling. This can easily lead to cross-semantic error aggregation in scenarios such as multi-column layout, mixed table layout, or page-skipping, resulting in inaccurate subsequent entity recognition and localization.

[0005] In the existing process of anti-ambiguity sensitive entity recognition, there are technical problems that rely solely on contextual semantic features for judgment, making it difficult to distinguish homographs, and that non-sensitive general words that appear repeatedly in documents are easily misjudged as sensitive information.

[0006] In the existing adaptive generalization instruction generation process, there is a technical problem that the desensitization strategy and access permissions are decoupled. The uniform masking rules are usually adopted, which cannot be finely controlled according to different access subjects and risk levels, resulting in excessive loss of data value or insufficient privacy protection. Summary of the Invention

[0007] To address the above issues and overcome the shortcomings of existing technologies, this invention provides a method and system for de-identifying and optimizing privacy data in document archives. The technical solution adopted by this invention is as follows: This invention provides a method for de-identifying and optimizing privacy data in document archives, which includes the following steps:

[0008] Step S1: Construction of a heterogeneous semantic space graph;

[0009] Step S2: Anti-ambiguity sensitive entity recognition;

[0010] Step S3: Adaptive generalization instruction generation;

[0011] Step S4: Reconstruct the de-identified data stream.

[0012] Further, in step S1, the construction of the semantic spatial heterogeneous graph is used to transform the unstructured document archive data stream into a computable topological structure containing content semantic logic and layout spatial logic. Specifically, it adopts a document semantic spatial heterogeneous graph construction method with spatial semantic double consistency constraints. By parsing the data stream of the original document archive, the text encoding attributes and layout spatial attributes of each character object in the document are extracted. Based on the layout spatial attributes, adjacent character objects are aggregated into text block nodes according to a preset coordinate proximity threshold. Semantic connection edges are established between the text block nodes based on the natural language order of the characters in the original document. At the same time, spatial neighborhood connection edges are established between the text block nodes based on the Euclidean distance relationship between each text block node. A document-level semantic spatial heterogeneous graph object containing text block nodes, semantic connection edges, and spatial neighborhood connection edges is constructed.

[0013] The construction of the heterogeneous semantic space graph specifically includes the following steps:

[0014] Step S11: Character-level basic attribute parsing, used to construct the basic data units for subsequent graph generation from the data stream of the original document archive. Specifically, it parses the data stream of the original document archive, using character objects as the smallest processing unit, and extracts the text encoding attribute and page space attribute of each character object. The text encoding attribute includes at least the character encoding value, the word identifier to which the character belongs, and the position of the syntactic sequence. The page space attribute includes at least the two-dimensional coordinate value of the character in the page coordinate system, the size of the character's page space range, and the page number identifier, thus obtaining a set of character-level attributes.

[0015] Step S12: Primary character aggregation based on spatial proximity constraints, used to construct character aggregation units that conform to the document layout structure without introducing semantic information. Specifically, based on the layout space attributes in the character-level attribute set, the spatial distance relationship between character objects is calculated, and according to the preset coordinate proximity threshold, character objects whose spatial distance meets the threshold condition and are located on the same page are aggregated to generate candidate character space aggregation clusters.

[0016] Step S13: Generate text block nodes with semantic continuity constraints to avoid cross-semantic errors caused by spatial proximity alone. Specifically, for character objects within the candidate aggregation cluster of the character space, the original logical flow index identifier in the text encoding attribute is introduced, and local semantic coherence calculation is performed in combination with character semantic vector features. Only when adjacent characters have continuity in the original logical flow index, or when the result of the local semantic coherence calculation is higher than the preset confidence threshold, is the character set determined to conform to the document reading logic, and the corresponding character set is aggregated to generate text block nodes.

[0017] Step S14: Heterogeneous relation modeling, used to establish multi-type connection structures between text block nodes that reflect the logical relationship between the document content and the layout relationship. Specifically, based on the natural language order relationship of text block nodes in the original document, semantic connection edges are established between adjacent text block nodes, and based on the Euclidean distance relationship between the page space range of text block nodes, spatial neighborhood connection edges are established between text block nodes that meet the preset spatial neighborhood threshold.

[0018] Step S15: Semantic space heterogeneous graph encapsulation is used to form a unified computing structure that can be directly used in the subsequent sensitive entity recognition step. Specifically, the text block nodes, semantic connection edges and spatial neighborhood connection edges are encapsulated to construct a document-level semantic space heterogeneous graph object containing text block node attributes and multi-type edge relationships. The document-level semantic space heterogeneous graph object is used as the input data structure for anti-ambiguity sensitive entity recognition in the subsequent step S2.

[0019] The text encoding attribute includes at least the character encoding value, the word identifier to which the character belongs, and the position of the syntactic sequence; the page space attribute includes at least the two-dimensional coordinate value of the character in the page coordinate system, the size of the character's page space range, and the page number identifier.

[0020] The document-level semantic space heterogeneous graph object serves as the input data structure for anti-ambiguity sensitive entity recognition in the subsequent step S2.

[0021] Further, in step S2, the anti-ambiguity sensitive entity recognition eliminates semantic ambiguity of polysemous words in the heterogeneous graph and accurately locks the position and attributes of target privacy data nodes by combining layout features. Specifically, it adopts an anti-ambiguity sensitive entity recognition method based on spatial correction attention and document topic constraints. The text block nodes in the document-level semantic space heterogeneous graph obtained in step S1 are used as basic processing units and input into a two-stream neural network model. The two-stream attention mechanism is used to perform weighted fusion of spatial position embedding vector and text semantic feature vector, calculate the correction weight of spatial features on semantic discrimination results, and obtain fused node features. The document topic vector obtained based on the global statistics of the document-level semantic space heterogeneous graph is introduced to perform binary classification on the fused node features to obtain a sensitive entity index table corresponding to each text block node.

[0022] The dual-stream neural network model includes a text semantic feature extraction stream and a spatial location feature extraction stream; the text semantic feature extraction stream is used to extract the text semantic feature vector of the text block node, and the spatial location feature extraction stream is used to extract the spatial location embedding vector of the corresponding text block node.

[0023] The sensitive entity index table includes at least a unique identifier for the sensitive entity, the original layout coordinates of the corresponding text block node, the privacy category marker to which the sensitive entity belongs, and the contextual association identifier of the entity in the document;

[0024] The anti-ambiguity sensitive entity recognition specifically includes the following steps:

[0025] Step S21: Text block node input, used to clarify the basic processing unit and data source for sensitive entity recognition. Specifically, the text block nodes in the document-level semantic space heterogeneous graph constructed in step S1 are used as the basic processing unit. The text content, original page coordinate information and connection relationship of each text block node in the document-level semantic space heterogeneous graph object are read as the input data for subsequent feature extraction.

[0026] Step S22: Text semantic feature extraction, used to obtain the semantic discrimination basis of text block nodes, specifically, inputting the text content of the text block node into the text semantic feature extraction stream, performing semantic encoding on the text block node, and extracting the corresponding text semantic feature vector;

[0027] Step S23: Spatial location embedding feature extraction, which is used to transform the page spatial information into a feature representation that can participate in learning. Specifically, based on the original page coordinate information, page spatial range size and page number identifier of the text block node, the information is input into the spatial location feature extraction stream to extract the corresponding spatial location embedding vector.

[0028] Step S24: Spatial correction attention fusion, used to correct the text semantic discrimination result by spatial location features. Specifically, it uses a two-stream attention mechanism to perform weighted fusion of the text semantic feature vector and the spatial location embedding vector, calculates the correction weight of spatial features on semantic features, and generates fused text block node features.

[0029] Step S25: Document topic vector construction, used to introduce overall semantic constraints of the document to reduce node-level misjudgment, specifically, based on the fusion features of all text block nodes in the heterogeneous graph of the document-level semantic space, aggregate to construct a document topic vector representing the overall semantic scene of the current document;

[0030] Step S26: Sensitive entity determination, used to output structured sensitive entity recognition results, specifically, inputting the fused text block node features and document topic vector into the classification determination model, performing sensitive entity determination on the text block nodes, and generating a sensitive entity index table based on the determination results;

[0031] The sensitive entity index table serves as the input data for the adaptive generalization instruction generated in step S3.

[0032] Further, in step S3, the adaptive generalization instruction generation is used to quantify the privacy leakage risk of sensitive entities and dynamically match differentiated desensitization strategies according to the permission level of external access requests, avoiding the loss of value caused by a one-size-fits-all approach to data. Specifically, an adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints is adopted. Based on each sensitive entity in the sensitive entity index table, combined with a preset privacy category specific weight and an information entropy value calculated based on information theory formulas, a comprehensive privacy risk score of the sensitive entity in the current document context is calculated. The comprehensive privacy risk score and the accessor's permission level label are used as joint inputs and input into a preset rule decision tree. According to predefined mapping rules, the corresponding generalization operator is matched. Based on the matching generalization operator, a corresponding set of operation parameters is generated to obtain a hierarchical desensitization operation instruction set.

[0033] The comprehensive privacy risk score is used to characterize the sensitivity of the sensitive entity's information in the document archives, its ability to point to individual uniqueness, and its level of identifiable risk.

[0034] The generalization operator includes at least full mask generalization, range generalization, and substitution identifier;

[0035] The hierarchical desensitization operation instruction set includes at least the target sensitive entity identifier, the corresponding generalization operator type, the generalization execution parameters, and the execution order constraints;

[0036] The adaptive generalization instruction generation specifically includes the following steps:

[0037] Step S31: Sensitive Entity Index Table Parsing, used to clarify the object and context of the desensitization decision. Specifically, it involves parsing the sensitive entity index table output in step S2, reading the unique identifier, privacy category tag, context association identifier of the entity in the document, and original page coordinate information corresponding to each sensitive entity, as the basic input data for subsequent privacy risk assessment.

[0038] Step S32: Calculate the information entropy based on the document context to quantify the privacy leakage risk of sensitive entities in the current document archive. Specifically, based on the context association identifier, count the frequency and distribution characteristics of sensitive entities in the current document context, calculate the information entropy value of each sensitive entity based on information theory formulas, retrieve the specific weight operator corresponding to the privacy category label, and calculate the risk correction factor based on the uniqueness of the sensitive entity in the document. Use the specific weight operator and the risk correction factor to perform a nonlinear weighted mapping on the basic information entropy value to obtain a comprehensive privacy risk score.

[0039] Step S33: Joint risk input construction, which is used to introduce the access subject's permission constraints into the desensitization decision process. Specifically, it encodes the permission level mark carried by the external access request and constructs the permission level mark and the comprehensive privacy risk score of the corresponding sensitive entity into a joint risk input, which is used to characterize the comprehensive privacy risk status under specific access permission conditions.

[0040] Step S34: Generalization operator matching decision, used to achieve an adaptive balance between privacy protection strength and data availability, specifically, inputting the joint risk input into a preset rule decision tree or policy matching model, and matching a generalization operator type that is suitable for the current sensitive entity and access permissions according to predefined mapping rules; wherein, the generalization operator includes at least full mask generalization, interval range generalization and pseudonym or substitution permutation identifier;

[0041] Step S35: Generate generalization execution parameters, which is used to convert the decision result of the generalization operator into executable control parameters. Specifically, based on the type of the matched generalization operator, a corresponding set of generalization execution parameters is generated. The generalization execution parameters include at least the generalization strength level, mask length or interval boundary and alternative identification rules.

[0042] Step S36: Constructing a hierarchical desensitization operation instruction set, which is used to form control instructions that can be directly called by subsequent desensitization execution steps. Specifically, the target sensitive entity identifier, the corresponding generalization operator type, the generalization execution parameters and the execution order constraints are encapsulated to construct a hierarchical desensitization operation instruction set, and the hierarchical desensitization operation instruction set serves as the control input for the desensitized data stream reorganization in step S4.

[0043] The hierarchical desensitization operation instruction set serves as the control input for the desensitized data stream reconstruction in step S4.

[0044] Further, in step S4, the desensitized data stream reorganization is used to perform desensitization operations and repair syntactic errors or format verification failures that may be caused by changes in text length or content, ensuring the availability and compliance of the output data. Specifically, it involves parsing the hierarchical desensitization operation instruction set, locating the corresponding target text block node in the document-level semantic space heterogeneous graph object, replacing the original sensitive entity data in the node with generalized data generated according to the corresponding generalization operator, and obtaining updated text block node data. After the replacement is completed, local text fragments composed of adjacent text block nodes are extracted with the replacement position as the center, and the syntactic fluency of the local text fragments is checked using the N-gram language model. If necessary, the connecting words or word order are fine-tuned to eliminate semantic breaks caused by the desensitization operation. The updated text block node data is then repackaged into the target document output format according to the original page coordinate constraint relationship retained in step S1.

[0045] The target document output format includes at least an XML stream or an OFD data stream, thereby obtaining a de-identified document archive data package that meets the requirements of hierarchical privacy compliance while maintaining the original layout structure.

[0046] This invention provides a privacy data desensitization optimization system for document archives, comprising a data preparation module, a core computing module, a decision generation module, and an execution output module;

[0047] The data preparation module is used for constructing a heterogeneous semantic space graph. Through the construction of the heterogeneous semantic space graph, a document-level heterogeneous semantic space graph object is obtained, and the document-level heterogeneous semantic space graph object is sent to the core computing module.

[0048] The core computing module is used for anti-ambiguity sensitive entity identification. Through anti-ambiguity sensitive entity identification, a sensitive entity index table is obtained, and the sensitive entity index table is sent to the decision generation module.

[0049] The decision generation module is used for adaptive generalization instruction generation. Through adaptive generalization instruction generation, a hierarchical desensitization operation instruction set is obtained, and the hierarchical desensitization operation instruction set is sent to the execution output module.

[0050] The execution output module is used for de-identified data stream reassembly, and through de-identified data stream reassembly, de-identified document archive data packets are obtained.

[0051] The beneficial effects achieved by the present invention using the above solution are as follows:

[0052] (1) In response to the technical problems in existing methods for desensitizing privacy data for document archives, such as the desensitization process being based solely on linear text or simple field matching, which makes it difficult to simultaneously consider the semantic logic of the document content and the consistency of the page structure, and the potential for semantic breaks, layout errors, or compliance verification failures after desensitization, this solution creatively adopts a comprehensive desensitized data stream reorganization method that integrates heterogeneous semantic space graphs, anti-ambiguous sensitive entity recognition, and adaptive generalization instruction generation. This method achieves accurate location and replacement of sensitive information under multi-level structural constraints at the character level, text block level, and document level. Through local semantic verification and page coordinate reflection mechanisms, in real-world scenarios such as administrative decisions and judicial judgments, it can complete hierarchical desensitization without disrupting the original layout and semantic coherence, thereby significantly improving the usability, compliance, and stability of the desensitization results.

[0053] (2) In the process of constructing the existing heterogeneous semantic space graph, there is a problem that the structural modeling relies solely on the text order or the spatial proximity relationship of the page, which is prone to cross-semantic error aggregation in multi-column layout, table mixed layout or page jump scenarios, resulting in inaccurate subsequent entity recognition and positioning. This solution creatively adopts the document semantic space heterogeneous graph construction method with spatial semantic double consistency constraints. It realizes the simultaneous introduction of page coordinate proximity constraints and natural language order continuity verification on the basis of character level, so that the generated text block nodes not only conform to the real page layout of the document, but also maintain semantic continuity. For example, in document instances where the name and position are displayed in separate lines and the ID number is broken across lines, the correct text block node structure can still be stably constructed, thereby providing a highly reliable structured input foundation for subsequent sensitive entity recognition and desensitization execution.

[0054] (3) In the existing anti-ambiguity sensitive entity recognition process, there is a technical problem that it is difficult to distinguish homomorphic entities based solely on contextual semantic features, and non-sensitive general words that appear repeatedly in the document are easily misjudged as sensitive information. This solution creatively adopts an anti-ambiguity sensitive entity recognition method based on spatial correction attention and document topic constraints. It realizes dynamic correction of semantic discrimination results through spatial position embedding, and global constraints on node-level judgments by combining the overall topic semantics of the document. For example, in the judgment documents where multiple similar placeholder words such as "Zhang Mou", "a company", and "a department" appear at the same time, it can effectively distinguish the natural person's name that really needs to be desensitized from the institutional references used as background descriptions, thereby significantly reducing the probability of false desensitization and missed desensitization, and improving the accuracy and consistency of sensitive entity recognition.

[0055] (4) In response to the technical problem that existing adaptive generalization instruction generation processes have decoupling between desensitization strategies and access permissions, and usually adopt uniform masking rules, it is impossible to carry out fine-grained control according to different access subjects and risk levels, resulting in excessive loss of data value or insufficient privacy protection, this solution creatively adopts an adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints. This method realizes the quantitative modeling of the identifiable risks of sensitive entities in specific document contexts, and makes joint decisions on the risk and the access permission level of the visitor. For example, in the access scenarios of internal auditors and external public query users for the same document, it can generate differentiated desensitization instructions such as interval generalization or full masking, thereby maximizing the preservation of document information value while ensuring privacy and security, and improving the flexibility and practical application adaptability of the desensitization system. Attached Figure Description

[0056] Figure 1 A flowchart illustrating an optimized method for desensitizing privacy data in document archives provided by this invention;

[0057] Figure 2 A schematic diagram of a privacy data desensitization optimization system for document archives provided by the present invention;

[0058] Figure 3 A flowchart illustrating the process of constructing the semantic space heterogeneous graph in step S1;

[0059] Figure 4 This is a flowchart illustrating the process of anti-ambiguity sensitive entity identification in step S2.

[0060] Figure 5 This is a flowchart illustrating the process of generating the adaptive generalization instruction in step S3.

[0061] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0062] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0063] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0064] Example 1, see Figure 1 This invention provides a privacy data anonymization optimization method for document archives, which includes the following steps:

[0065] Step S1: Construction of a heterogeneous semantic space graph;

[0066] Step S2: Anti-ambiguity sensitive entity recognition;

[0067] Step S3: Adaptive generalization instruction generation;

[0068] Step S4: Reconstruct the de-identified data stream.

[0069] By performing the above operations, this solution addresses the technical problems inherent in existing methods for desensitizing privacy data in document archives. These methods rely solely on linear text or simple field matching, making it difficult to simultaneously consider the semantic logic of the document content and the consistency of the layout structure. Furthermore, they can easily lead to semantic breaks, layout errors, or compliance verification failures after desensitization. This solution creatively employs a comprehensive desensitized data stream reconstruction method that integrates heterogeneous semantic space graphs, anti-ambiguous sensitive entity recognition, and adaptive generalization instruction generation. This method achieves accurate location and replacement of sensitive information under multi-layered structural constraints at the character, text block, and document levels. Through local semantic verification and layout coordinate mapping mechanisms, it can complete hierarchical desensitization processing in real-world scenarios such as administrative decisions and judicial rulings, without disrupting the original layout and semantic coherence. This significantly improves the usability, compliance, and stability of the desensitization results in engineering implementation.

[0070] Example 2, see Figure 1 and Figure 3This embodiment is based on the above embodiment. In step S1, the construction of the semantic space heterogeneous graph is used to transform the unstructured document archive data stream into a computable topological structure containing content semantic logic and page layout spatial logic. Specifically, it adopts a document semantic space heterogeneous graph construction method with spatial semantic double consistency constraints. By parsing the data stream of the original document archive, the text encoding attributes and page layout spatial attributes of each character object in the document are extracted. Based on the page layout spatial attributes, adjacent character objects are aggregated into text block nodes according to a preset coordinate proximity threshold. Semantic connection edges are established between the text block nodes based on the natural language order of the characters in the original document. At the same time, spatial neighborhood connection edges are established between the text block nodes based on the Euclidean distance relationship between each text block node. A document-level semantic space heterogeneous graph object containing text block nodes, semantic connection edges, and spatial neighborhood connection edges is constructed.

[0071] The construction of the heterogeneous semantic space graph specifically includes the following steps:

[0072] Step S11: Character-level basic attribute parsing, used to construct the basic data units for subsequent graph generation from the data stream of the original document archive. Specifically, it parses the data stream of the original document archive, using character objects as the smallest processing unit, and extracts the text encoding attribute and page space attribute of each character object. The text encoding attribute includes at least the character encoding value, the word identifier to which the character belongs, and the position of the syntactic sequence. The page space attribute includes at least the two-dimensional coordinate value of the character in the page coordinate system, the size of the character's page space range, and the page number identifier, thus obtaining a set of character-level attributes.

[0073] Step S12: Primary character aggregation based on spatial proximity constraints, used to construct character aggregation units that conform to the document layout structure without introducing semantic information. Specifically, based on the layout space attributes in the character-level attribute set, the spatial distance relationship between character objects is calculated, and according to the preset coordinate proximity threshold, character objects whose spatial distance meets the threshold condition and are located on the same page are aggregated to generate candidate character space aggregation clusters.

[0074] Preferably, the spatial distance relationship can be calculated using a dynamic threshold method based on character height, with the following formula:

[0075] ;

[0076] In the formula, It is the first character With the second character The weighted Euclidean distance between them, where (x, y) are the coordinates of the character center. It is the horizontal coordinate of the center of the first character. It is the horizontal coordinate of the center of the second character. It is the vertical coordinate of the center of the first character. It is the vertical coordinate of the center of the second character. It is the height of the first character. It is the height of the second character. It is the proximity expansion coefficient, and its preferred value range is [1.1, 1.3]. It is a horizontal weight adjustment factor used to compensate for the characteristic that the spacing between characters within a line is usually smaller than the spacing between lines in document typesetting. The preferred value range is [1.5, 2.0].

[0077] More preferably, the preset coordinate proximity threshold is specifically an adaptive bounding box expansion criterion based on the average font size of the document. That is, when the horizontal projection overlap of the bounding rectangles of two characters is greater than 0.5 and the vertical distance is less than 0.3 times the average height of the characters on the current page, it is determined that the primary aggregation condition is met, thereby ensuring that the text in a single line can be preferentially divided into the same candidate cluster.

[0078] Step S13: Generate text block nodes with semantic continuity constraints to avoid cross-semantic errors caused by spatial proximity alone. Specifically, for character objects within the candidate aggregation cluster of the character space, the original logical flow index identifier in the text encoding attribute is introduced, and local semantic coherence calculation is performed in combination with character semantic vector features. Only when adjacent characters have continuity in the original logical flow index, or when the result of the local semantic coherence calculation is higher than the preset confidence threshold, is the character set determined to conform to the document reading logic, and the corresponding character set is aggregated to generate text block nodes.

[0079] Preferably, the calculation formula for the local semantic coherence calculation is as follows:

[0080] ;

[0081] In the formula, It is the first character With the second character The corresponding first deep semantic feature vector Second deep semantic feature vector The cosine similarity between the vectors, where n is the vector dimension and k is the vector dimension index. It is the first deep semantic feature vector in the k-th dimension. It is the second deep semantic feature vector of the k-th dimension;

[0082] When the calculated similarity value is greater than the preset confidence threshold TS (preferably 0.85), even if there is a slight break in the page coordinates (such as cross-page layout), they are still determined to belong to the same text block in semantic logic, thereby realizing the logical repair of physical defects in the page layout.

[0083] Step S14: Heterogeneous relation modeling, used to establish multi-type connection structures between text block nodes that reflect the logical relationship between the document content and the layout relationship. Specifically, based on the natural language order relationship of text block nodes in the original document, semantic connection edges are established between adjacent text block nodes, and based on the Euclidean distance relationship between the page space range of text block nodes, spatial neighborhood connection edges are established between text block nodes that meet the preset spatial neighborhood threshold.

[0084] Step S15: Semantic space heterogeneous graph encapsulation is used to form a unified computing structure that can be directly used in the subsequent sensitive entity recognition step. Specifically, the text block nodes, semantic connection edges and spatial neighborhood connection edges are encapsulated to construct a document-level semantic space heterogeneous graph object containing text block node attributes and multi-type edge relationships. The document-level semantic space heterogeneous graph object is used as the input data structure for anti-ambiguity sensitive entity recognition in the subsequent step S2.

[0085] As a further optimization of this embodiment, Table 1 is an example table of attributes of the document-level semantic space heterogeneous graph object. As shown in the table, by defining the main attributes of nodes and the association attributes of edges, the static layout of document archives is transformed into a topological structure that can be directly processed by neural networks.

[0086] Table 1. Example of attributes for document-level semantic space heterogeneous graph objects;

[0087]

[0088] The text encoding attribute includes at least the character encoding value, the word identifier to which the character belongs, and the position of the syntactic sequence; the page space attribute includes at least the two-dimensional coordinate value of the character in the page coordinate system, the size of the character's page space range, and the page number identifier.

[0089] The document-level semantic space heterogeneous graph object serves as the input data structure for anti-ambiguity sensitive entity recognition in the subsequent step S2.

[0090] By performing the above operations, this solution addresses the technical problem in the existing process of constructing heterogeneous semantic spatial graphs. Relying solely on text order or page spatial proximity for structural modeling can easily lead to cross-semantic error aggregation in scenarios with multi-column layouts, mixed tables, or line breaks within a page, resulting in inaccurate subsequent entity recognition and localization. This solution creatively adopts a document semantic spatial heterogeneous graph construction method with dual spatial semantic consistency constraints. It simultaneously introduces page coordinate proximity constraints and natural language sequence continuity verification at the character level, ensuring that the generated text block nodes conform to the actual page layout of the document while maintaining semantic continuity. For example, in document instances where names and titles are displayed on separate lines, or ID numbers are broken across lines, the correct text block node structure can still be stably constructed. This provides a highly reliable structured input foundation for subsequent sensitive entity recognition and de-identification.

[0091] Example 3, see Figure 1 , Figure 4 This embodiment is based on the above embodiment. In step S2, the anti-ambiguity sensitive entity recognition eliminates the semantic ambiguity of polysemous words in the heterogeneous graph and accurately locks the position and attributes of the target privacy data node by combining layout features. Specifically, it adopts an anti-ambiguity sensitive entity recognition method based on spatial correction attention and document topic constraints. The text block nodes in the document-level semantic space heterogeneous graph obtained in step S1 are used as basic processing units and input into a two-stream neural network model. The two-stream attention mechanism is used to perform weighted fusion of spatial position embedding vector and text semantic feature vector, calculate the correction weight of spatial features on semantic discrimination results, and obtain the fused node features. The document topic vector obtained based on the global statistics of the document-level semantic space heterogeneous graph is introduced to perform binary classification judgment on the fused node features to obtain a sensitive entity index table corresponding to each text block node.

[0092] The dual-stream neural network model includes a text semantic feature extraction stream and a spatial location feature extraction stream; the text semantic feature extraction stream is used to extract the text semantic feature vector of the text block node, and the spatial location feature extraction stream is used to extract the spatial location embedding vector of the corresponding text block node.

[0093] The text semantic feature vector, spatial location embedding vector, and fused node feature vector are all mapped to a unified feature dimension D. The dimension D is a preset constant, such as 128 or 256 dimensions, to ensure the dimensionality consistency of multi-source features during the fusion calculation process.

[0094] The sensitive entity index table includes at least a unique identifier for the sensitive entity, the original layout coordinates of the corresponding text block node, the privacy category marker to which the sensitive entity belongs, and the contextual association identifier of the entity in the document;

[0095] The anti-ambiguity sensitive entity recognition specifically includes the following steps:

[0096] Step S21: Text block node input, used to clarify the basic processing unit and data source for sensitive entity recognition. Specifically, the text block nodes in the document-level semantic space heterogeneous graph constructed in step S1 are used as the basic processing unit. The text content, original page coordinate information and connection relationship of each text block node in the document-level semantic space heterogeneous graph object are read as the input data for subsequent feature extraction.

[0097] Step S22: Text semantic feature extraction, used to obtain the semantic discrimination basis of text block nodes, specifically, inputting the text content of the text block node into the text semantic feature extraction stream, performing semantic encoding on the text block node, and extracting the corresponding text semantic feature vector;

[0098] Step S23: Spatial location embedding feature extraction, used to transform the page layout spatial information into a feature representation that can participate in learning. Specifically, based on the original page layout coordinate information, page layout spatial range size, and page number identifier of the text block node, the corresponding spatial location embedding vector is extracted by inputting it into the spatial location feature extraction stream. The calculation formula is as follows:

[0099] ;

[0100] In the formula, It is a spatial location embedding vector. MLP is a multilayer perceptron function that maps the original coordinate data to a dimension aligned with semantic features through at least one hidden layer and a non-linear activation function (such as ReLU). W represents the horizontal coordinate of the top-left corner of the bounding rectangle of the text block in the current page's coordinate system, where W is the total width of the corresponding page. H represents the vertical coordinates of the top-left corner of the bounding rectangle of the text block in the current page coordinate system, where H is the total height of the corresponding page. It represents the horizontal coordinates of the bottom right corner of the bounding rectangle of the text block in the current page coordinate system. This represents the vertical coordinates of the bottom-right corner of the bounding rectangle of the text block in the current page coordinate system, where P is the page number of the current text block. It is the total number of pages in the document archive;

[0101] Step S24: Spatial correction attention fusion, used to correct the text semantic discrimination result by spatial location features. Specifically, it uses a two-stream attention mechanism to perform weighted fusion of the text semantic feature vector and the spatial location embedding vector, calculates the correction weight of spatial features on semantic features, and generates fused text block node features.

[0102] The formula for calculating the weighted fusion is as follows:

[0103] ;

[0104] In the formula, These are the features of the merged text block nodes. It is a sigmoid activation function. It is a gated weight matrix. It is the original semantic feature vector extracted from the text stream. It is the semantic transformation weight matrix;

[0105] Step S25: Document topic vector construction, used to introduce overall document semantic constraints to reduce node-level misjudgments. Specifically, it involves aggregating the fusion features of all text block nodes in the document-level semantic space heterogeneous graph to construct a document topic vector representing the overall semantic scene of the current document. The calculation formula is as follows:

[0106] ;

[0107] In the formula, This is the document topic vector, where N is the total number of text block nodes, and n is the index of each text block node. It is the significance weighting coefficient. It is the fusion feature corresponding to the nth text block node;

[0108] Step S26: Sensitive Entity Determination, used to output structured sensitive entity recognition results. Specifically, the fused text block node features and document topic vectors are input into the classification and determination model to perform sensitive entity determination on the text block nodes, and a sensitive entity index table is generated based on the determination results. The calculation formula is as follows:

[0109] ;

[0110] In the formula, y is the probability distribution of the classification results, and Softmax is the normalization exponential function. is the classification decision weight matrix, and b is the classification decision bias term;

[0111] Preferably, Table 2 is an example table defining the data items of the sensitive entity index table, and the table standardizes the structured storage of the identification results;

[0112] Table 2. Example table of data item definitions for the sensitive entity index table;

[0113]

[0114] The sensitive entity index table serves as the input data for generating the adaptive generalization instruction in step S3.

[0115] By performing the above operations, this solution addresses the technical problems in existing anti-ambiguity sensitive entity recognition processes, such as difficulty in distinguishing homonymous entities based solely on contextual semantic features, and the tendency for non-sensitive general terms that appear repeatedly in documents to be misclassified as sensitive information. This solution creatively employs an anti-ambiguity sensitive entity recognition method based on spatially modified attention and document topic constraints. It achieves dynamic correction of semantic discrimination results through spatial location embedding and global constraints on node-level judgments based on the overall document topic semantics. For example, in judgment documents containing multiple similar placeholder terms such as "Zhang Mou," "Company Mou," and "Department Mou," it can effectively distinguish between the names of natural persons that truly require desensitization and the institutional references used as background descriptions, thereby significantly reducing the probability of false or missed desensitization and improving the accuracy and consistency of sensitive entity recognition.

[0116] Example 4, see Figure 1 , Figure 5 This embodiment is based on the above embodiment. In step S3, the adaptive generalization instruction generation is used to quantify the privacy leakage risk of sensitive entities and dynamically match differentiated desensitization strategies according to the permission level of external access requests, avoiding the loss of value caused by a one-size-fits-all approach to data. Specifically, it adopts an adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints. Based on each sensitive entity in the sensitive entity index table, combined with the preset privacy category specific weight and the information entropy value calculated based on information theory formulas, the comprehensive privacy risk score of the sensitive entity in the current document context is calculated. The comprehensive privacy risk score and the accessor's permission level label are used as joint inputs and input into a preset rule decision tree. According to the predefined mapping rules, the corresponding generalization operator is matched. Based on the matching generalization operator, the corresponding set of operation parameters is generated to obtain a hierarchical desensitization operation instruction set.

[0117] The comprehensive privacy risk score is used to characterize the sensitivity of the sensitive entity's information in the document archives, its ability to point to individual uniqueness, and its level of identifiable risk.

[0118] The generalization operator includes at least full mask generalization, range generalization, and substitution identifier;

[0119] The hierarchical desensitization operation instruction set includes at least the target sensitive entity identifier, the corresponding generalization operator type, the generalization execution parameters, and the execution order constraints;

[0120] The adaptive generalization instruction generation specifically includes the following steps:

[0121] Step S31: Sensitive Entity Index Table Parsing, used to clarify the object and context of the desensitization decision. Specifically, it involves parsing the sensitive entity index table output in step S2, reading the unique identifier, privacy category tag, context association identifier of the entity in the document, and original page coordinate information corresponding to each sensitive entity, as the basic input data for subsequent privacy risk assessment.

[0122] Step S32: Calculate the information entropy based on the document context to quantify the privacy leakage risk of sensitive entities in the current document archive. Specifically, based on the context association identifier, count the frequency and distribution characteristics of sensitive entities in the current document context, calculate the information entropy value of each sensitive entity based on information theory formulas, retrieve the specific weight operator corresponding to the privacy category label, and calculate the risk correction factor based on the uniqueness of the sensitive entity in the document. Use the specific weight operator and the risk correction factor to perform a nonlinear weighted mapping on the basic information entropy value to obtain a comprehensive privacy risk score.

[0123] Preferably, the formula for calculating the information entropy is:

[0124] ;

[0125] In the formula, Here, K is the information entropy value, K is the total number of semantic partitions, and each semantic partition includes at least the main text, attachments, and signature. k is the semantic partition index. x is the probability that the entity appears in the k-th semantic partition. k It refers to the distribution state of entities;

[0126] More preferably, the formula for calculating the comprehensive privacy risk score is:

[0127] ;

[0128] In the formula, It is a comprehensive privacy risk score. It is a preset privacy weighting factor. These are preset privacy category-specific weights, which can be set according to predefined privacy levels. For example, an ID number can be set to 0.9, a name to 0.6, and a date of birth to 0.4. These are preset information entropy weighting coefficients. This is a risk correction factor, preferably calculated based on the uniqueness of the entity within the entire document. The calculation formula is as follows: ,in, It is the total number of times the entity appears in the current document;

[0129] Step S33: Joint risk input construction, which is used to introduce the access subject's permission constraints into the desensitization decision process. Specifically, it encodes the permission level mark carried by the external access request and constructs the permission level mark and the comprehensive privacy risk score of the corresponding sensitive entity into a joint risk input, which is used to characterize the comprehensive privacy risk status under specific access permission conditions.

[0130] Step S34: Generalization operator matching decision, used to achieve an adaptive balance between privacy protection strength and data availability, specifically, inputting the joint risk input into a preset rule decision tree or policy matching model, and matching a generalization operator type that is suitable for the current sensitive entity and access permissions according to predefined mapping rules; wherein, the generalization operator includes at least full mask generalization, interval range generalization and pseudonym or substitution permutation identifier;

[0131] Preferably, the access request level permission flag L is preset. auth The mapping logic of the preset rule decision tree follows the following criteria:

[0132] The access request level permission flag L auth The levels range from 1 to 5, with higher numbers indicating higher privileges.

[0133] High-risk / low-privilege branch: If > 0.8 and L auth < 3, Decision matching full mask generalization operator, for example, used to replace "Zhang San" with "***";

[0134] Medium risk / medium permission branch: If and Determine the range of matching intervals using a generalization operator, for example, to replace "3203211990..." with "born after 1990");

[0135] Low-risk / high-privilege branch: If or L auth =5, determine whether to match the "pseudo-substitution" operator or preserve the original text;

[0136] This decision tree enables a shift from "fixed anonymization" to "on-demand anonymization," ensuring that in scenarios such as judicial transparency, senior auditors can see more details, while the general public can only see generalized statistical information.

[0137] As a further enhancement to this embodiment, the generalization operator, when executed, preferentially employs the following existing technical means to ensure the standardization and security of the desensitization process:

[0138] The full mask generalization operator defaults to using character mapping and replacement technology. Specifically, based on the Unicode encoding range of the characters, it uniformly replaces the valid characters in the target entity with preset placeholders (such as "*" or "#"). For non-fixed-length entities such as Chinese names, full character mapping is used. For sensitive fields with fixed check bits (such as Luhn algorithm) such as ID card numbers and bank card numbers, the first and last character features are retained, and the middle characters are masked to ensure the format integrity of the data after desensitization.

[0139] The range generalization operator defaults to using a generalization technique based on data binning and hierarchy. For numerical or date-based privacy data, it uses a preset hierarchical tree structure to round up the precise value or map it to the logical range to which it belongs. For example, for birth dates, according to the offset rules in the "Information Security Technology: Guidelines for De-identification of Personal Information" (GB / T 37964), the specific year, month, and day are converted into coarse-grained categories such as "post-90s" or "1990-1995", thereby eliminating uniqueness while retaining statistical analysis value.

[0140] The pseudonym substitution operator defaults to a format-preserving encryption method, which involves performing a substitution operation on the original entity using a preset key to generate a pseudo-random character sequence with the same data type and length as the original; for example, mapping "Zhang San" to "Zhang Moujia". This scheme preferably adopts consistent pseudonym technology, that is, within the same document, the same sensitive entities point to the same pseudonym after desensitization, thereby ensuring that the internal logical relationship of the document (such as the correspondence between the plaintiff and the defendant in the judgment) is not confused due to the desensitization operation;

[0141] Step S35: Generate generalization execution parameters, which is used to convert the decision result of the generalization operator into executable control parameters. Specifically, based on the type of the matched generalization operator, a corresponding set of generalization execution parameters is generated. The generalization execution parameters include at least the generalization strength level, mask length or interval boundary and alternative identification rules.

[0142] More preferably, the logic for generating the preset set of operation parameters is as follows:

[0143] For the full mask generalization operator, the parameters include the mask character type (such as "*" or "#") and the mask ratio;

[0144] For the interval range generalization operator, the generalization step size is determined by the risk score, ensuring that the higher the risk, the larger the generalized interval range (fuzziness);

[0145] Step S36: Constructing a hierarchical desensitization operation instruction set, which is used to form control instructions that can be directly called by subsequent desensitization execution steps. Specifically, the target sensitive entity identifier, the corresponding generalization operator type, the generalization execution parameters and the execution order constraints are encapsulated to construct a hierarchical desensitization operation instruction set, and the hierarchical desensitization operation instruction set serves as the control input for the desensitized data stream reorganization in step S4.

[0146] The hierarchical desensitization operation instruction set serves as the control input for the desensitized data stream reconstruction in step S4.

[0147] By performing the above operations, this solution addresses the technical problem in existing adaptive generalization instruction generation processes: the decoupling of desensitization strategies and access permissions, the common use of uniform masking rules, and the inability to perform fine-grained control based on different access subjects and risk levels, leading to excessive loss of data value or insufficient privacy protection. This solution creatively adopts an adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints. This achieves quantitative modeling of the identifiable risks of sensitive entities within specific document contexts and jointly decides on these risks with the access level of the visitor. For example, in the same document access scenarios for internal auditors and external public query users, differentiated desensitization instructions such as interval generalization or full masking can be generated respectively. This ensures privacy and security while maximizing the preservation of document information value, improving the flexibility and practical application adaptability of the desensitization system.

[0148] Example 5, see Figure 1 , Figure 2 This embodiment is based on the above embodiment. In step S4, the desensitized data stream reorganization is used to perform desensitization operations and repair syntactic errors or format verification failures that may be caused by changes in text length or content, ensuring the availability and compliance of the output data. Specifically, it involves parsing the hierarchical desensitization operation instruction set, locating the corresponding target text block node in the document-level semantic space heterogeneous graph object, replacing the original sensitive entity data in the node with generalized data generated according to the corresponding generalization operator, and obtaining the updated text block node data. After the replacement is completed, local text fragments composed of adjacent text block nodes are extracted with the replacement position as the center. The N-gram language model is used to perform syntactic fluency verification on the local text fragments, and the connecting words or word order are fine-tuned if necessary to eliminate semantic breaks caused by the desensitization operation. The updated text block node data is then repackaged into the target document output format according to the original page coordinate constraint relationship retained in step S1.

[0149] Preferably, when parsing the hierarchical desensitization operation instruction set, according to the target sensitive entity identifier recorded in the instruction set, the text block node corresponding to the identifier is retrieved in the semantic space heterogeneous graph. Based on the entity start and end positions or character offsets given in the instruction, a character encoding alignment mechanism is introduced to accurately locate the character sequence inside the text block node. By verifying the consistency of the logical offset of the character sequence before and after replacement, cross-node, misaligned replacement, or garbled characters caused by differences in multi-byte character encoding are avoided during the generalized replacement process.

[0150] More preferably, the extraction range of the local text fragment can be limited to several text block nodes directly connected to the target text block node in the semantic space heterogeneous graph through semantic connection edges. The joint occurrence probability of N adjacent words in the local text fragment is calculated, and semantic template constraints based on dependency parsing are introduced. When the joint probability is lower than a preset threshold or the dependency parsing logic rules are violated, it is determined that there is a potential syntactic anomaly, and it is automatically corrected by replacing conjunctions, adjusting the position of modifiers, or restoring necessary function words. During the correction process, semantic vector cosine similarity comparison is used to ensure that the corrected text improves the text coherence without changing the original semantic orientation.

[0151] Meanwhile, during the repackaging process, the updated text content is mapped back to the original page position based on the page space coordinates, page number identifiers, and node hierarchy order recorded by the text block nodes. To address the risk of overflow caused by the increased length of the desensitized text, an adaptive page container scaling mechanism is introduced. By calculating the ratio between the total width of the updated text and the original text block range, within a preset visual deformation threshold, the mechanism dynamically reduces character spacing, enables multi-level font shrinking, or triggers local inline reflow logic to ensure that the desensitized document is packaged without character overlap and with a visual layout consistent with the original document.

[0152] The target document output format includes at least an XML stream or an OFD data stream, thereby obtaining a de-identified document archive data package that meets the hierarchical privacy compliance requirements while maintaining the original layout structure.

[0153] Preferably, the XML stream or OFD data stream retains the original document's structural tags, style tags, and page-level index information during the generation process, so that the de-identified document archive can be directly loaded and verified by existing document parsing or display tools without additional format adaptation processing.

[0154] Example 6, see Figure 1 and Figure 2Based on the above embodiments, this embodiment provides a privacy data desensitization optimization system for document archives, including a data preparation module, a core computing module, a decision generation module, and an execution output module;

[0155] The data preparation module is used for constructing a heterogeneous semantic space graph. Through the construction of the heterogeneous semantic space graph, a document-level heterogeneous semantic space graph object is obtained, and the document-level heterogeneous semantic space graph object is sent to the core computing module.

[0156] The core computing module is used for anti-ambiguity sensitive entity identification. Through anti-ambiguity sensitive entity identification, a sensitive entity index table is obtained, and the sensitive entity index table is sent to the decision generation module.

[0157] The decision generation module is used for adaptive generalization instruction generation. Through adaptive generalization instruction generation, a hierarchical desensitization operation instruction set is obtained, and the hierarchical desensitization operation instruction set is sent to the execution output module.

[0158] The execution output module is used for de-identified data stream reassembly, and through de-identified data stream reassembly, de-identified document archive data packets are obtained.

[0159] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0160] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0161] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A method for optimizing privacy data anonymization in document archives, characterized in that: The method includes the following steps: Step S1: Semantic spatial heterogeneous graph construction, constructing a document-level semantic spatial heterogeneous graph object containing text block nodes, semantic connection edges, and spatial neighborhood connection edges; In step S1, the semantic spatial heterogeneous graph construction specifically adopts the document semantic spatial heterogeneous graph construction method with spatial semantic double consistency constraints. By parsing the data stream of the original document archive, the text encoding attributes and page space attributes of each character object in the document are extracted, including the following steps: character-level basic attribute parsing, character primary aggregation based on spatial proximity constraints, text block node generation with semantic continuity constraints, heterogeneous relationship modeling, and semantic spatial heterogeneous graph encapsulation; Step S2: Anti-ambiguous sensitive entity recognition. An anti-ambiguous sensitive entity recognition method based on spatially modified attention and document topic constraints is used to obtain a sensitive entity index table corresponding to each text block node. In step S2, the anti-ambiguous sensitive entity recognition method based on spatially modified attention and document topic constraints uses the text block nodes in the document-level semantic space heterogeneous graph object obtained in step S1 as basic processing units, inputting them into a two-stream neural network model. A two-stream attention mechanism is used to introduce the document topic vector obtained based on global statistics of the document-level semantic space heterogeneous graph object, and binary classification is performed on the fused node features. The two-stream neural network model includes a text semantic feature extraction stream and a spatial location feature extraction stream. The text semantic feature extraction stream is used to extract the text semantic feature vectors of the text block nodes, and the spatial location feature extraction stream is used to extract the spatial location embedding vectors of the corresponding text block nodes. Step S3: Adaptive generalization instruction generation. An adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints is used to obtain a hierarchical desensitization operation instruction set. In step S3, the adaptive desensitization instruction generation method based on information entropy risk assessment and permission constraints calculates the comprehensive privacy risk score of each sensitive entity in the sensitive entity index table, combining a preset privacy category-specific weight with the information entropy value calculated based on information theory formulas. The comprehensive privacy risk score and the visitor's permission level label are used as joint inputs and fed into a preset rule decision tree. Based on predefined mapping rules, the corresponding generalization operator is matched. Based on the matched generalization operator, a corresponding set of operation parameters is generated. Step S4: Desensitized data stream reorganization, specifically, parsing the hierarchical desensitization operation instruction set, locating the corresponding target text block node in the document-level semantic space heterogeneous graph object, replacing the original sensitive entity data in the node with generalized data generated according to the corresponding generalization operator, and obtaining the desensitized document archive data package.

2. The method for desensitizing and optimizing privacy data for document archives according to claim 1, characterized in that: The text encoding attributes include the character encoding value, the word identifier to which the character belongs, and the position of the syntactic sequence. The page space attributes include the two-dimensional coordinates of the character in the page coordinate system, the size of the character's bounding box, and the page number identifier.

3. The method for desensitizing and optimizing privacy data for document archives according to claim 2, characterized in that: In step S1, the primary character aggregation based on spatial proximity constraints specifically involves calculating the spatial distance relationship between character objects based on page space attributes, and aggregating character objects whose spatial distance meets the threshold condition and are located on the same page number according to the coordinate proximity threshold to generate candidate character space aggregation clusters. The text block node generation with semantic continuity constraints specifically involves introducing the original logical flow index identifier from the text encoding attribute into the character objects within the candidate aggregation cluster of the character space, and performing local semantic coherence calculation in combination with the character semantic vector features; only when adjacent characters have continuity in the original logical flow index, or when the result of the local semantic coherence calculation is higher than a preset confidence threshold, is the character set determined to conform to the document reading logic, and the corresponding character set is aggregated to generate text block nodes; The heterogeneous relationship modeling specifically involves establishing semantic connection edges between adjacent text block nodes based on the natural language order relationship of text block nodes in the original document, and establishing spatial neighborhood connection edges between text block nodes that meet a preset spatial neighborhood threshold based on the Euclidean distance relationship between the page space range of text block nodes.

4. The method for desensitizing and optimizing privacy data for document archives according to claim 3, characterized in that: The sensitive entity index table includes a unique identifier for the sensitive entity, the original layout coordinates of the corresponding text block node, the privacy category marker to which the sensitive entity belongs, and the contextual association identifier of the entity in the document.

5. The method for desensitizing and optimizing privacy data for document archives according to claim 4, characterized in that: The adaptive generalization instruction generation specifically includes the following steps: sensitive entity index table parsing, information entropy calculation based on document context, joint risk input construction, generalization operator matching decision, generalization execution parameter generation, and hierarchical desensitization operation instruction set construction.

6. The privacy data anonymization optimization method for document archives according to claim 5, characterized in that: The comprehensive privacy risk score is used to characterize the sensitivity of information, the ability to identify individual uniqueness, and the level of identifiable risk of the sensitive entity in the document archives. The generalization operators include full mask generalization, range generalization, and substitution identifier; The hierarchical desensitization operation instruction set includes the target sensitive entity identifier, the corresponding generalization operator type, the generalization execution parameters, and the execution order constraints.

7. The method for desensitizing and optimizing privacy data for document archives according to claim 6, characterized in that: In step S3, the information entropy calculation based on the document context specifically involves: based on the context association identifier, statistically analyzing the frequency and distribution characteristics of sensitive entities in the current document context; calculating the information entropy value of each sensitive entity based on information theory formulas; retrieving the specific weight operator corresponding to the privacy category label; and calculating the risk correction factor based on the uniqueness of the sensitive entity in the document. By using specific weight operators and risk correction factors to perform nonlinear weighted mapping on the basic information entropy value, a comprehensive privacy risk score is obtained. The construction of the joint risk input specifically involves encoding the permission level marker carried by the external access request, and constructing a joint risk input by combining the permission level marker with the comprehensive privacy risk score of the corresponding sensitive entity, which is used to characterize the comprehensive privacy risk status under specific access permission conditions.

8. A privacy data desensitization and optimization system for document archives, used to implement the privacy data desensitization and optimization method for document archives as described in any one of claims 1-7, characterized in that: It includes a data preparation module, a core computing module, a decision generation module, and an execution output module.

9. A privacy data anonymization and optimization system for document archives according to claim 8, characterized in that: The data preparation module is used for constructing a heterogeneous semantic space graph. Through the construction of the heterogeneous semantic space graph, a document-level heterogeneous semantic space graph object is obtained, and the document-level heterogeneous semantic space graph object is sent to the core computing module. The core computing module is used for anti-ambiguity sensitive entity identification. Through anti-ambiguity sensitive entity identification, a sensitive entity index table is obtained, and the sensitive entity index table is sent to the decision generation module. The decision generation module is used for adaptive generalization instruction generation. Through adaptive generalization instruction generation, a hierarchical desensitization operation instruction set is obtained, and the hierarchical desensitization operation instruction set is sent to the execution output module. The execution output module is used for de-identified data stream reassembly, and through de-identified data stream reassembly, de-identified document archive data packets are obtained.

Images