AI data privacy enhancement method and system

Abstract

The invention discloses an AI data privacy enhancement method and system, and relates to the technical field of data privacy enhancement and information security, and the method comprises the steps: collecting multi-terminal sample data for preprocessing, and generating a sample data set; the method comprises the following steps: generating a local model at a client, setting a data sampling rate, sampling a sample data set, generating a sampling subset as input of the local model, obtaining a sampling gradient vector, executing gradient cutting operation, and generating a normalized gradient vector; based on the normalized gradient vector, constructing a Renyi differential privacy closed upper bound inequality in combination with a data sampling rate to perform inverse solution, obtaining a minimum noise standard deviation, superposing Gaussian noise to generate a disturbance gradient vector, and performing Renyi differential privacy analysis on the disturbance vector to obtain a Renyi differential privacy loss value; according to the method, the anti-theft and anti-inversion capabilities of the AI data in communication and aggregation links are remarkably improved, and long-term training-oriented adaptive AI data privacy enhancement is realized.

Description

Technical Field

[0001] This invention relates to the field of data privacy enhancement and information security technology, and in particular to an AI data privacy enhancement method and system. Background Technology

[0002] In recent years, with the integrated development of big data, cloud computing, and deep learning technologies, artificial intelligence models have become increasingly reliant on high-dimensional, multi-source, and cross-domain data. Data-driven intelligent decision-making has widely penetrated into scenarios such as mobile terminals, the Internet of Things, edge computing, and federated collaboration. Simultaneously, increasingly stringent data compliance and privacy protection requirements have spurred the rapid evolution of the "data not leaving the domain" training paradigm. Distributed collaborative training mechanisms, represented by federated learning, have become a crucial direction: each client completes gradient calculation and parameter updates locally, only uploading model update information for aggregation by the server, thereby reducing the risk of raw data leakage to some extent. To further enhance privacy protection, differential privacy mechanisms have been introduced into federated learning. Common methods include performing norm pruning on gradients and adding Gaussian noise, and tracking privacy budget consumption through privacy accounting. Furthermore, to prevent aggregation servers or communication links from snooping on model updates, homomorphic encryption, especially Paillier additive homomorphic encryption, is used to achieve secure aggregation of encrypted domains. In addition, the demand for mobile deployments has driven lightweight deep networks and transfer learning to become the mainstream of terminal-side modeling, making privacy-enhanced training under resource-constrained conditions a viable engineering trend.

[0003] Existing technologies struggle to maintain stable sensitivity constraints under heterogeneous data across different terminals, and lack a design that links noise scale and sampling rate. This can easily lead to decreased training efficiency or even convergence failure under limited computing power and bandwidth. Furthermore, there is a lack of trigger-based enhancement strategies and interpretable feedback optimization mechanisms to address the risk of privacy budget exhaustion. In particular, in mobile transfer learning scenarios, the dynamic adjustment of sampling rate and noise standard deviation without rigorous mathematical constraints can easily lead to distortion of privacy constraints, parameter oscillations, or rapid degradation of model performance. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides an AI data privacy enhancement method and system, which solves the problems of existing technologies that are difficult to maintain stable sensitivity constraints under the heterogeneity of data from different terminals, lack linkage design between noise scale and sampling rate, which easily leads to a decrease in training efficiency or even convergence failure under limited computing power and bandwidth conditions. Secondly, it lacks a trigger-based enhancement strategy and an interpretable feedback optimization mechanism to address the risk of privacy budget exhaustion.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides an AI data privacy enhancement method, which includes, Collect sample data from multiple terminals, preprocess it, and generate a sample dataset; A local model is generated on the client side. After sampling the sample dataset by setting the data sampling rate, a sample subset is generated as input to the local model. The sampled gradient vector is then used to perform gradient clipping operation to generate a normalized gradient vector. Based on the normalized gradient vector, the Rényi differential privacy closed upper bound inequality is constructed by combining the data sampling rate and inversely solved to obtain the minimum noise standard deviation. Gaussian noise is then superimposed to generate a perturbation gradient vector. Rényi differential privacy analysis is performed on the perturbation vector to obtain the Rényi differential privacy loss value. The Rényi differential privacy loss value is encrypted using Paillier homomorphic encryption and then uploaded to the server for homomorphic aggregation. The client then decrypts the data and updates the model parameters. After the model parameters are updated, a privacy enhancement mechanism is triggered based on the Rényi differential privacy loss value. A joint optimization objective function is constructed, and the data sampling rate and noise standard deviation are dynamically adjusted through Riemann projection and projection gradient descent method to obtain the privacy enhancement result.

[0007] As a preferred embodiment of the AI ​​data privacy enhancement method of the present invention, the step of generating a local model on the client, sampling the sample dataset by setting a data sampling rate, generating a sampled subset as input to the local model, obtaining the sampled gradient vector, performing gradient clipping operation, and generating a normalized gradient vector includes: Each data terminal is treated as a client, and a pre-trained MobileNetV2 neural network model is loaded on the client side. The parameters are fine-tuned through transfer learning to obtain a local model. The data sampling rate is set, and Bernoulli sampling is performed on each sample data in the sample dataset using the data sampling rate to generate a sample subset. Using a sampled subset as input to the local model, after calculating the forward output, the cross-entropy loss function is used to calculate the local loss function value, and the partial derivatives of the local model parameters are obtained using the backpropagation algorithm to obtain the sampled gradient vector of the sampled subset. Based on the sampled gradient vector, the L2 norm and gradient clipping threshold of the sampled gradient vector are calculated respectively. Then, gradient clipping operation is performed on each sampled gradient vector according to the L2 norm and gradient clipping threshold to generate a normalized gradient vector.

[0008] As a preferred embodiment of the AI ​​data privacy enhancement method described in this invention, the following steps are performed: Based on the normalized gradient vector, a Rényi differential privacy closed upper bound inequality is constructed and inversely solved using the data sampling rate to obtain the minimum noise standard deviation. Gaussian noise is then superimposed to generate a perturbation gradient vector. Rényi differential privacy analysis is then performed on the perturbation vector to obtain the Rényi differential privacy loss value, including: Based on the normalized gradient vector and combined with the data sampling rate, a perturbation Gaussian model is performed. After generating a closed upper bound inequality in the sense of Rényi differential privacy, a target Rényi privacy budget is set. By performing an inverse algebraic solution to the closed upper bound inequality, the minimum noise standard deviation is obtained. The normalized gradient vector is used as the input for perturbation Gaussian modeling, and Gaussian random noise with zero mean and standard deviation equal to the minimum noise standard deviation is superimposed on it dimension by dimension to form a perturbation gradient vector. Based on the perturbation gradient vector, Gaussian sampling is performed on adjacent perturbation gradient vectors according to the data sampling rate, and then Rényi differential privacy analysis is performed to obtain the Rényi differential privacy loss value for the current round.

[0009] As a preferred embodiment of the AI ​​data privacy enhancement method of the present invention, the step of uploading the Rényi differential privacy loss value to the server for homomorphic aggregation after Paillier homomorphic encryption, and then decrypting it by the client to perform model parameter updates, includes: Based on the Rényi differential privacy loss value, determine whether the Rényi differential privacy loss value is greater than the target Rényi privacy budget. If it is greater than 0, then reset the sampling gradient vector and wait for the next round of sampling and perturbation; If the value is not greater than the specified value, a Paillier homomorphic encryption key pair, including a public key and a private key, is generated on the client side. Paillier encryption is performed on each dimension of the perturbation gradient vector using the public key to obtain the encrypted gradient components. The encrypted gradient components are then concatenated in their original positions to form an encrypted gradient vector, which is then uploaded to the federated learning server. The federated learning server performs homomorphic aggregation on the encrypted gradient components in the encrypted gradient vector to obtain the homomorphic aggregation value, which is then sent to the client. When the client receives the homomorphic aggregation value, it uses the private key in the encryption key pair to perform Paillier decryption to obtain the perturbation gradient sum. Based on the perturbation gradient, the parameters of the local model are updated according to the federated averaging rule, including the weight matrix and bias vector of the convolutional layer, the scaling and offset values ​​of the normalized layer, and the weight matrix and bias vector of the fully connected layer.

[0010] As a preferred embodiment of the AI ​​data privacy enhancement method of the present invention, the step of triggering a privacy enhancement mechanism based on the Rényi differential privacy loss value after the model parameters are updated includes: After updating the parameters of the local model, calculate the Rényi differential privacy loss value for the new round, and use the mean formula to obtain the mean of the Rényi differential privacy loss values ​​for all rounds as the trigger threshold. If the Rényi differential privacy loss value in the new round is greater than the trigger threshold, it means that "the privacy loss value is about to be exhausted" and the privacy enhancement mechanism is triggered; otherwise, it means that "the privacy loss value is abundant" and the parameters of the local model continue to be updated.

[0011] As a preferred embodiment of the AI ​​data privacy enhancement method of the present invention, the step of constructing a joint optimization objective function and dynamically adjusting the data sampling rate and noise standard deviation through Riemann projection and projection gradient descent to obtain the privacy enhancement result includes: After the privacy enhancement mechanism is triggered, the loss function value of the pre-trained MobileNetV2 neural network model in the new round is extracted. The loss function value and the Rényi differential privacy loss value in the new round are normalized. The ratio of the normalized loss function value to the Rényi differential privacy loss value is taken as the weight. A joint optimization objective function is defined and minimized. Calculate the objective function value, and use the chain rule to obtain the partial derivative of the objective function value with respect to the data sampling rate and noise standard deviation. Then, perform Riemann projection on the positive number field parameter space to obtain the Riemann gradient. Based on the Riemann gradient, gradient updates are performed using projective gradient descent to generate new data sampling rate and noise standard deviation as balancing parameters. After covering the original data sampling rate and noise standard deviation with the balancing parameters, the perturbation gradient vector is reacquired, encryption and transmission are performed, homomorphic aggregation and decryption are performed, and the perturbation gradient sum is generated. The parameters of the local model are updated again according to the federated averaging rule. In subsequent updates, when the decrease in the loss function value of the local model no longer decreases significantly, the iteration stops, and the privacy enhancement training of the local model on the client side is completed, serving as the basis for AI data privacy enhancement.

[0012] As a preferred embodiment of the AI ​​data privacy enhancement method of the present invention, the step of collecting multi-terminal sample data and preprocessing it to generate a sample dataset includes: Structured or semi-structured sample data is obtained from the original data sources of multiple data terminals through API interfaces. The sample data in the structured or semi-structured sample set is preprocessed to generate a sample dataset.

[0013] Secondly, this invention provides an AI data privacy enhancement system, comprising, The initial generation module is used to collect sample data from multiple terminals, preprocess it, and generate a sample dataset. The collaborative design module is used to generate a local model on the client side. After setting the data sampling rate to sample the sample dataset, a sample subset is generated as input to the local model. The sampled gradient vector is then used to perform gradient clipping operations to generate a normalized gradient vector. The inverse analysis module is used to construct the Rényi differential privacy closed upper bound inequality based on the normalized gradient vector and the data sampling rate, and then perform inverse analysis to obtain the minimum noise standard deviation and add Gaussian noise to generate a perturbation gradient vector. Rényi differential privacy analysis is then performed on the perturbation vector to obtain the Rényi differential privacy loss value. The aggregation update module is used to upload the Rényi differential privacy loss value to the server after Paillier homomorphic encryption, and then the client decrypts it to update the model parameters. The enhanced feedback module is used to trigger a privacy enhancement mechanism based on the Rényi differential privacy loss value after the model parameters are updated. It constructs a joint optimization objective function and dynamically adjusts the data sampling rate and noise standard deviation through Riemann projection and projection gradient descent to obtain the privacy enhancement result.

[0014] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein the computer program, when executed by the processor, implements any step of the AI ​​data privacy enhancement method as described in the first aspect of the present invention.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the AI ​​data privacy enhancement method as described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: This invention uses Rényi differential privacy based on a Gaussian sampling mechanism as a privacy enhancement metric, utilizes the closed upper bound to solve for the minimum noise standard deviation and performs precise privacy auditing, making the privacy strength of the AI ​​training process calculable, verifiable, and constrainable. Furthermore, through the collaborative design of "sampling-pruning-Gaussian perturbation," the privacy loss increases controllably with the square of the sampling rate, thus maintaining model training stability while enhancing privacy protection. Secondly, by superimposing Paillier homomorphic encryption aggregation on the perturbation gradient that satisfies the constraints and employing a privacy loss triggering and joint optimization feedback mechanism, the anti-theft and anti-inversion capabilities of AI data in the communication and aggregation stages are significantly improved, and adaptive AI data privacy enhancement for long-term training is achieved. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the AI ​​data privacy enhancement method in Example 1.

[0019] Figure 2 This is a structural diagram of the AI ​​data privacy enhancement system in Example 1.

[0020] Figure 3 This is a flowchart of client-side local privacy perturbation and encrypted upload in Example 1. Detailed Implementation

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0022] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0023] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0024] Example 1, referring to Figures 1-3 This is the first embodiment of the present invention, which provides an AI data privacy enhancement method, including the following steps: S1. Collect multi-terminal sample data, preprocess it, and generate a sample dataset; Specifically, multi-terminal sample data is collected, preprocessed, and used to generate a sample dataset, including: Structured or semi-structured sample data can be obtained from raw data sources of multiple data terminals (mobile devices, industrial control systems, edge devices, or data gateway servers) through API interfaces. Structured data includes tabular data (such as CSV, SQL tables, etc.), while semi-structured data includes data types with tagged and parsable characteristics such as logs, JSON, XML, and industrial protocol messages. Preprocess the sample data in a structured or semi-structured sample set to generate a sample dataset; Preprocessing includes field parsing, vectorization encoding, dimension alignment, and normalization, for example: Normalization, categorical coding, and principal component analysis (PCA) compression were performed on the tabular data; Extract keywords and event sequences from log data and encode them into time feature vectors; Perform structural parsing and key-value expansion on JSON / XML data to form a fixed-length feature tensor.

[0025] The system collects data from mobile devices, industrial systems, and edge nodes via API interfaces, supporting the access and parsing of various data formats such as tables, logs, JSON, and XML, significantly improving data fusion capabilities. In structured data processing, normalization, categorical encoding, and PCA dimensionality reduction are introduced to effectively reduce interference from redundant features, improving model training efficiency and stability. In semi-structured data processing, keyword extraction, event sequence modeling, and key-value expansion achieve vectorized encoding and dimensionality alignment of complex data, ensuring the consistency and integrity of feature representation. Furthermore, a unified feature tensor generation strategy provides standard input guarantees for subsequent privacy enhancement modules such as differential privacy, Gaussian perturbation, and encrypted aggregation, giving the system good versatility and deployability.

[0026] S2. Generate a local model on the client side, set the data sampling rate to sample the sample dataset, generate a sample subset as input to the local model, obtain the sampled gradient vector, perform gradient clipping operation, and generate a normalized gradient vector. Specifically, a local model is generated on the client side. After sampling the sample dataset at a set data sampling rate, a sampled subset is generated as input to the local model. The resulting sampled gradient vectors are then subjected to gradient clipping to generate normalized gradient vectors, including: Each data terminal is used as a client, and a pre-trained MobileNetV2 neural network model is loaded on the client side. The parameters are fine-tuned through transfer learning to obtain a local model. The data sampling rate is set according to the optimal efficiency range of the sampling Gaussian mechanism in the Rényi differential privacy amplification theory (the optimal efficiency range of the sampling Gaussian mechanism in the differential privacy amplification theory is usually 0 to 0.2, while this invention can take 0.1 as the default value of the data sampling rate. When it is taken as 0.1, it can be ensured that the subsequent privacy loss increases within a controllable range with the square of the data sampling rate, while maintaining a sufficient number of effective samples in each round of training, thereby achieving a balance between the strength of privacy protection and the stability of model training). Bernoulli sampling is performed on each sample data in the sample dataset using the data sampling rate to generate a sample subset. The sampled subset is used as the input to the local model. After calculating the forward output (sample prediction value), the cross-entropy loss function is used to calculate the local loss function value. The partial derivative of the local model parameters is obtained by using the backpropagation algorithm to obtain the sampling gradient vector of the sampled subset. Based on the sampled gradient vector, the L2 norm and gradient clipping threshold of the sampled gradient vector are calculated respectively. Then, a gradient clipping operation is performed on each sampled gradient vector according to the L2 norm and gradient clipping threshold to generate a normalized gradient vector. The formula for calculating the L2 norm of the sampling gradient vector is as follows: In the formula, Describing the L2 norm, Indicates client Based on data sampling rate Generate the sampling gradient vector of the sampling subset. This represents the total length of the sampled gradient vector. Indicates client Based on data sampling rate The sampling gradient vector of the generated sampling subset One component; The formula for calculating the gradient clipping threshold is: In the formula, Indicates the gradient clipping threshold. Represents the quantile function. This represents the quantile threshold (in real-world scenarios, the value typically ranges from 0 to 1, while this invention uses 0.9 as the default value, thus allowing estimation of feature locations with larger gradient norms). Indicates client In the In this training, based on the data sampling rate Generate the sampling gradient vector of the sampling subset. Indicates the total number of training rounds; The gradient clipping operation is performed on each sampled gradient vector based on the L2 norm and the gradient clipping threshold, as shown in the formula: In the formula, Indicates client The normalized gradient vector, This indicates the operation of retrieving the maximum value.

[0027] By basing its approach on Rényi differential privacy amplification theory, this invention directly incorporates the mathematical properties of the Gaussian sampling mechanism into the federated training process. This allows for precise quantification and strict control of privacy loss, fundamentally avoiding the problems of relaxed privacy budget estimation and empirical parameter settings inherent in traditional differential privacy schemes. By employing a pre-trained lightweight neural network on the client side and combining it with transfer learning for local model fine-tuning, this invention effectively stabilizes the gradient distribution, providing a controllable premise for subsequent gradient pruning and noise injection, ensuring model convergence even under privacy enhancement conditions. Furthermore, the Bernoulli sampling-based data subset construction method establishes a strict correspondence with Rényi differential privacy amplification theory, keeping privacy loss within a controllable range as the sampling rate quadratically increases, thus achieving a balance between privacy strength and the number of effective training samples. In addition, by introducing a gradient pruning threshold estimation mechanism based on quantile statistics, this invention achieves adaptive constraints on gradient sensitivity, avoiding the failure of fixed thresholds in multi-round training and heterogeneous terminal scenarios, and providing a stable foundation for subsequent Gaussian noise scaling inverse solutions. The normalized gradient vector obtained after pruning allows privacy enhancement and security aggregation to coexist within the same numerical space. Finally, this invention achieves high-intensity, auditable, and sustainable AI data privacy enhancement for federated learning scenarios through the collaborative design of model structure, data sampling, gradient processing, and differential privacy analysis mechanisms.

[0028] S3. Based on the normalized gradient vector, the Rényi differential privacy closed upper bound inequality is constructed in combination with the data sampling rate and inversely solved to obtain the minimum noise standard deviation. Gaussian noise is then superimposed to generate a perturbation gradient vector. Rényi differential privacy analysis is performed on the perturbation vector to obtain the Rényi differential privacy loss value. Specifically, based on the normalized gradient vector, the Rényi differential privacy closed upper bound inequality is constructed by combining the data sampling rate and then inversely solved to obtain the minimum noise standard deviation. Gaussian noise is then added to generate a perturbed gradient vector. Rényi differential privacy analysis is performed on the perturbed vector to obtain the Rényi differential privacy loss value, including: Based on the normalized gradient vector and combined with the data sampling rate, a perturbation Gaussian model is performed. After generating a closed upper bound inequality in the sense of Rényi differential privacy, a target Rényi privacy budget is set. (Target Rényi Privacy Budget) The value ranges from 0.01 to 5, when the target Rényi privacy budget When the value is less than 0.01, it indicates that the required Gaussian noise standard deviation will increase significantly, causing the gradient signal-to-noise ratio after adding noise to be lower than the model's convergence threshold. This prevents the federated learning training process from converging effectively. Furthermore, when the objective is Rényi privacy budget... When the Rényi divergence is greater than 5, under the Rényi differential privacy definition, the Rényi divergence between the output distributions of adjacent datasets increases significantly, making the influence of a single sample on model updates no longer sufficiently masked. This makes it unable to effectively resist gradient-based membership inference attacks and inversion attacks. Therefore, this invention can use 1 as the target Rényi privacy budget. (default value), perform inverse algebraic solution on the closed upper bound inequality to obtain the minimum noise standard deviation; The formula for generating the closed upper bound inequality in the sense of Rényi differential privacy is as follows: In the formula, express Rényi differential privacy loss value. The Rényi differential privacy order is represented (based on the privacy-precision trade-off commonly used in actual federated learning, the value range is set from 1 to 500, but to ensure numerical stability and analytical controllability, this invention uses 16 as the default value for the Rényi differential privacy order). Indicates the standard deviation of Gaussian noise; The inverse algebraic solution to the closed upper bound inequality is given by the following formula: In the formula, Indicates the minimum noise standard deviation. express The target Rényi privacy budget value; The normalized gradient vector is used as input for perturbation Gaussian modeling, and Gaussian random noise with zero mean and standard deviation equal to the minimum noise standard deviation is superimposed on it dimension by dimension to form the perturbation gradient vector, as shown in the formula: In the formula, Indicates client The perturbation gradient vector, Indicates Gaussian noise. Represents the identity matrix with the same dimensions as the normalized gradient vector (a diagonal matrix generated based on the dimensions of the normalized gradient vector). Based on the perturbation gradient vector, and using the data sampling rate as a basis, Gaussian sampling is performed on adjacent perturbation gradient vectors, followed by Rényi differential privacy analysis to obtain the Rényi differential privacy loss value for the current round. The formula is as follows: In the formula, Represents the natural logarithm function. express The normalized probability expectation term of order; The specific form of the normalized probability expectation term of the order is: In the formula, Represents random variables Follows a normal distribution Expectations Representing components , Indicates a normal distribution. Indicates in the component The probability density function value at point (obtained by the formula: In the formula, Represents pi (π). The base of the natural logarithm. This represents the mean of a normal distribution. (represents the square of the Euclidean distance). Indicates the exponentiation operation; And when When the integer is , the normalized probability expectation term is calculated using the following analytical expansion: In the formula, Indicates from Take from the middle of the order Number of combinations, This represents the natural exponential function. This represents the number of combinations (the formula is: ).

[0029] By using the Rényi differential privacy loss value as the core privacy metric and introducing a closed upper bound inequality of the sampling Gaussian mechanism under the Rényi differential privacy meaning, a clear and analytical functional relationship is established between privacy strength and data sampling rate, Gaussian noise standard deviation, and privacy order. This avoids the inaccurate privacy assessment problem caused by relying on empirical parameters or relaxed privacy accounting in existing technologies. By performing an algebraic inverse solution to this closed upper bound, this invention can directly determine the minimum noise standard deviation that meets privacy requirements under a given target privacy budget, realizing the deterministic generation of privacy enhancement parameters. This transforms the privacy protection process from "post-evaluation" to "pre-constraint," significantly improving the controllability and verifiability of privacy enhancement. Furthermore, using the normalized gradient vector as input for perturbation Gaussian modeling ensures that the gradient sensitivity under different clients and different training epochs is within a uniform scale space, thereby guaranteeing the consistency and stability of privacy protection effects during noise injection. By incorporating the privacy amplification effect introduced by the data sampling rate, the privacy loss is limited to a controllable range as the sampling rate quadratically increases. This enhances privacy protection while maintaining the effective sample size required for model training, preventing convergence difficulties due to excessive noise. Furthermore, by performing precise Rényi differential privacy analysis on the perturbation gradient and quantifying the privacy loss per round based on the normalized probability expectation term, the system can perceive the privacy budget consumption status in real time, providing a reliable basis for subsequent privacy enhancement triggering and parameter feedback adjustment. This privacy loss calculation method based on probability expectation, unlike the coarse-grained cumulative estimation method in traditional differential privacy, more realistically reflects the distinguishability of adjacent datasets under random mechanisms, fundamentally improving the security and reliability of AI data privacy enhancement.

[0030] S4. After Paillier homomorphic encryption of the Rényi differential privacy loss value, it is uploaded to the server for homomorphic aggregation, and then the client decrypts it to update the model parameters. Specifically, the Rényi differential privacy loss value is homomorphically encrypted using Paillier encryption and uploaded to the server for homomorphic aggregation. The client then decrypts the data and updates the model parameters, including: Based on the Rényi differential privacy loss value, determine whether the Rényi differential privacy loss value is greater than the target Rényi privacy budget. If it is greater than 0, then reset the sampling gradient vector and wait for the next round of sampling and perturbation; If it is not greater than (i.e., the Rényi differential privacy loss value is less than or equal to the target Rényi privacy budget) If so, a Paillier homomorphic encryption key pair, including a public key and a private key, is generated on the client side; Paillier encryption is performed on each dimension of the perturbation gradient vector using the public key to obtain the encrypted gradient component. The encrypted gradient components are then concatenated in their original positions to form the encrypted gradient vector, which is then uploaded to the federated learning server. The federated learning server performs homomorphic aggregation on the encrypted gradient components in the encrypted gradient vector to obtain the homomorphic aggregation value, which is then sent to the client. The homomorphic aggregation of the cryptographic gradient components in the cryptographic gradient vector is performed using the following formula: In the formula, Represents homomorphic aggregation value, Indicates the total number of clients. Indicates client The perturbation gradient vector of the th The encrypted gradient component of the perturbation gradient component; When the client receives the homomorphic aggregate value, it performs Paillier decryption using the private key in the encryption key pair to obtain the perturbation gradient sum. Based on the perturbation gradient, the parameters of the local model are updated according to the federated averaging rule, including the weight matrix and bias vector of the convolutional layer, the scaling and offset values ​​of the normalized layer, and the weight matrix and bias vector of the fully connected layer.

[0031] By introducing the Rényi differential privacy loss assessment mechanism and the Paillier homomorphic encryption aggregation mechanism, dual protection of data privacy during AI training is achieved, significantly improving the system's security and controllability. On one hand, by comparing the privacy loss after each training round in real time, if it exceeds the preset budget, the upload is terminated and the sampling gradient is reset, avoiding the risk of privacy leakage and fundamentally enhancing the dynamic auditing capability of privacy protection. On the other hand, under the condition of meeting the privacy budget, the client performs Paillier encryption on the perturbation gradient vector dimensionally and uploads it to the server for homomorphic aggregation. The aggregation result is decrypted by the client and used for model parameter updates, realizing a closed-loop protection process of "privacy perturbation first, then ciphertext aggregation." This method not only ensures the confidentiality of data during transmission and aggregation but also avoids the private key security risks brought about by centralized decryption.

[0032] S5. After the model parameters are updated, a privacy enhancement mechanism is triggered based on the Rényi differential privacy loss value. A joint optimization objective function is constructed, and the data sampling rate and noise standard deviation are dynamically adjusted through Riemann projection and projection gradient descent method to obtain the privacy enhancement result. Specifically, after the model parameters are updated, a privacy enhancement mechanism is triggered based on the Rényi differential privacy loss value, including: After updating the parameters of the local model, calculate the Rényi differential privacy loss value for the new round, and use the mean formula to obtain the mean of the Rényi differential privacy loss values ​​for all rounds as the trigger threshold. If the Rényi differential privacy loss value in the new round is greater than the trigger threshold, it means that "the privacy loss value is about to be exhausted" and the privacy enhancement mechanism is triggered; otherwise, it means that "the privacy loss value is abundant" and the parameters of the local model continue to be updated.

[0033] By introducing a trigger threshold mechanism based on the average Rényi differential privacy loss, dynamic and refined management of the privacy budget is achieved. Compared to traditional differential privacy methods that rely on static parameter settings, this mechanism can accurately assess the current privacy loss after each training round and compare it with the historical average level. This allows for timely triggering of privacy enhancement operations before the budget is exhausted, preventing uncontrolled privacy strength or a sudden drop in system performance. Furthermore, this mechanism provides quantitative evidence for compliance auditing and optimization adjustments of privacy protection strategies.

[0034] Furthermore, a joint optimization objective function is constructed, and the data sampling rate and noise standard deviation are dynamically adjusted using Riemann projection and projection gradient descent methods for feedback, resulting in privacy-enhancing outcomes, including: After triggering the privacy enhancement mechanism, the loss function value of the pre-trained MobileNetV2 neural network model in the new round is extracted. The loss function value and the Rényi differential privacy loss value in the new round are normalized, and the ratio of the normalized loss function value to the Rényi differential privacy loss value is used as the weight. A joint optimization objective function is defined, and the objective function is minimized. The formula is: In the formula, Represents the objective function value. Indicates a new round The loss function value at that time, Indicating a new round Weight of time, Indicates a new round time Rényi differential privacy loss value; Calculate the objective function value, and use the chain rule to obtain the partial derivative of the objective function value with respect to the data sampling rate and noise standard deviation. Then, perform Riemann projection on the positive number field parameter space to obtain the Riemann gradient. The formula for performing Riemann projection on the positive number field parameter space is: In the formula, Represents the Riemann gradient. The partial derivative representing the data sampling rate, The partial derivative representing the standard deviation of noise; Based on the Riemann gradient, gradient updates are performed using the projected gradient descent method to generate new data sampling rate and noise standard deviation as balancing parameters. After covering the original data sampling rate and noise standard deviation with the balancing parameters, the perturbation gradient vector is reacquired, encryption and transmission are performed, homomorphic aggregation and decryption are performed, the perturbation gradient sum is generated, and the parameters of the local model are updated again according to the federated averaging rule. The gradient update is performed using the projected gradient descent method, and the formula is as follows: In the formula, Indicates the new data sampling rate. Indicates the new noise standard deviation. and These represent the update step size for the data sampling rate and the noise standard deviation, respectively (since the update step size is affected by...). and Multiplicative amplification, if an excessively large learning rate is used (such as a conventional one), can lead to problems. or This can easily lead to rapid parameter overflow or oscillation. Therefore, this invention can... and All set to This can both generate effective optimization progress and avoid excessively rapid drift or numerical explosion, thus meeting the dual requirements of stability and security in differential privacy optimization. In subsequent updates, when the decrease in the loss function value of the local model no longer decreases significantly, the iteration stops, and the privacy-enhancing training of the local model on the client side is completed, serving as the basis for AI data privacy enhancement.

[0035] By introducing a joint optimization objective function, the model loss function and Rényi differential privacy loss are modeled in a unified manner, forming a dynamic weight adjustment mechanism. This structure not only achieves a real-time balance between model performance and privacy budget but also provides a mathematically differentiable basis for subsequent parameter adjustment, breaking the problem of "noise injection cannot be controlled by feedback" in traditional privacy mechanisms. Secondly, using the closed upper bound formula of Rényi differential privacy, this invention establishes an analytical expression relationship between the data sampling rate and the standard deviation of Gaussian noise, so that the perturbation strength no longer depends on empirical settings but can be dynamically optimized with the privacy budget, significantly improving the system's controllability and privacy audit accuracy. To ensure that the updates of the sampling rate and noise parameters are stable and always within the positive real number domain, this invention uses Riemann projection and projective gradient descent to construct a mathematically rigorous and engineering-stable perturbation parameter adjustment path, avoiding model training failure due to parameter anomalies. In addition, based on the optimization results, this invention constructs a linkage chain that synchronizes perturbation gradient generation and Paillier homomorphic encryption, realizing closed-loop control of the entire process of "perturbation—encryption—aggregation—decryption—update," effectively resisting gradient inversion and communication leakage attacks.

[0036] This embodiment also provides an AI data privacy enhancement system, including: The initial generation module is used to collect sample data from multiple terminals, preprocess it, and generate a sample dataset. The collaborative design module is used to generate a local model on the client side. After setting the data sampling rate to sample the sample dataset, a sample subset is generated as input to the local model. The sampled gradient vector is then used to perform gradient clipping operations to generate a normalized gradient vector. The inverse analysis module is used to construct the Rényi differential privacy closed upper bound inequality based on the normalized gradient vector and the data sampling rate, and then perform inverse analysis to obtain the minimum noise standard deviation and add Gaussian noise to generate a perturbation gradient vector. Rényi differential privacy analysis is then performed on the perturbation vector to obtain the Rényi differential privacy loss value. The aggregation update module is used to upload the Rényi differential privacy loss value to the server after Paillier homomorphic encryption, and then the client decrypts it to update the model parameters. The enhanced feedback module is used to trigger a privacy enhancement mechanism based on the Rényi differential privacy loss value after the model parameters are updated. It constructs a joint optimization objective function and dynamically adjusts the data sampling rate and noise standard deviation through Riemann projection and projection gradient descent to obtain the privacy enhancement result.

[0037] This embodiment also provides a computer device applicable to the AI ​​data privacy enhancement method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the AI ​​data privacy enhancement method proposed in the above embodiment. The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0038] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the AI ​​data privacy enhancement method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0039] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An AI data privacy enhancement method, characterized in that: include, Collect sample data from multiple terminals, preprocess it, and generate a sample dataset; A local model is generated on the client side. After sampling the sample dataset by setting the data sampling rate, a sample subset is generated as input to the local model. The sampled gradient vector is then used to perform gradient clipping operation to generate a normalized gradient vector. Based on the normalized gradient vector, the Rényi differential privacy closed upper bound inequality is constructed by combining the data sampling rate and inversely solved to obtain the minimum noise standard deviation. Gaussian noise is then superimposed to generate a perturbation gradient vector. Rényi differential privacy analysis is performed on the perturbation vector to obtain the Rényi differential privacy loss value. The Rényi differential privacy loss value is encrypted using Paillier homomorphic encryption and then uploaded to the server for homomorphic aggregation. The client then decrypts the data and updates the model parameters. After the model parameters are updated, a privacy enhancement mechanism is triggered based on the Rényi differential privacy loss value. A joint optimization objective function is constructed, and the data sampling rate and noise standard deviation are dynamically adjusted through Riemann projection and projection gradient descent method to obtain the privacy enhancement result.

2. The AI ​​data privacy enhancement method as described in claim 1, characterized in that: The process of generating a local model on the client side, sampling the sample dataset at a set data sampling rate, generating a sampled subset as input to the local model, obtaining the sampled gradient vector, performing gradient clipping operations, and generating a normalized gradient vector includes: Each data terminal is treated as a client, and a pre-trained MobileNetV2 neural network model is loaded on the client side. The parameters are fine-tuned through transfer learning to obtain a local model. The data sampling rate is set, and Bernoulli sampling is performed on each sample data in the sample dataset using the data sampling rate to generate a sample subset. Using a sampled subset as input to the local model, after calculating the forward output, the cross-entropy loss function is used to calculate the local loss function value, and the partial derivatives of the local model parameters are obtained using the backpropagation algorithm to obtain the sampled gradient vector of the sampled subset. Based on the sampled gradient vector, the L2 norm and gradient clipping threshold of the sampled gradient vector are calculated respectively. Then, gradient clipping operation is performed on each sampled gradient vector according to the L2 norm and gradient clipping threshold to generate a normalized gradient vector.

3. The AI ​​data privacy enhancement method as described in claim 2, characterized in that: The process involves constructing a Rényi differential privacy closed-form upper bound inequality based on the normalized gradient vector and combining it with the data sampling rate. This inequality is then inversely solved to obtain the minimum noise standard deviation, which is then superimposed with Gaussian noise to generate a perturbation gradient vector. Rényi differential privacy analysis is performed on this perturbation vector to obtain the Rényi differential privacy loss value, including: Based on the normalized gradient vector and combined with the data sampling rate, a perturbation Gaussian model is performed. After generating a closed upper bound inequality in the sense of Rényi differential privacy, a target Rényi privacy budget is set. By performing an inverse algebraic solution to the closed upper bound inequality, the minimum noise standard deviation is obtained. The normalized gradient vector is used as the input for perturbation Gaussian modeling, and Gaussian random noise with zero mean and standard deviation equal to the minimum noise standard deviation is superimposed on it dimension by dimension to form a perturbation gradient vector. Based on the perturbation gradient vector, Gaussian sampling is performed on adjacent perturbation gradient vectors according to the data sampling rate, and then Rényi differential privacy analysis is performed to obtain the Rényi differential privacy loss value for the current round.

4. The AI ​​data privacy enhancement method as described in claim 3, characterized in that: The process of encrypting the Rényi differential privacy loss value using Paillier homomorphic encryption, uploading it to the server for homomorphic aggregation, and then decrypting it on the client side to update the model parameters includes: Based on the Rényi differential privacy loss value, determine whether the Rényi differential privacy loss value is greater than the target Rényi privacy budget. If it is greater than 0, then reset the sampling gradient vector and wait for the next round of sampling and perturbation; If the value is not greater than the specified value, a Paillier homomorphic encryption key pair, including a public key and a private key, is generated on the client side. Paillier encryption is performed on each dimension of the perturbation gradient vector using the public key to obtain the encrypted gradient components. The encrypted gradient components are then concatenated in their original positions to form an encrypted gradient vector, which is then uploaded to the federated learning server. The federated learning server performs homomorphic aggregation on the encrypted gradient components in the encrypted gradient vector to obtain the homomorphic aggregation value, which is then sent to the client. When the client receives the homomorphic aggregation value, it uses the private key in the encryption key pair to perform Paillier decryption to obtain the perturbation gradient sum. Based on the perturbation gradient, the parameters of the local model are updated according to the federated averaging rule, including the weight matrix and bias vector of the convolutional layer, the scaling and offset values ​​of the normalized layer, and the weight matrix and bias vector of the fully connected layer.

5. The AI ​​data privacy enhancement method as described in claim 4, characterized in that: The privacy enhancement mechanism, triggered based on the Rényi differential privacy loss value after the model parameters are updated, includes: After updating the parameters of the local model, calculate the Rényi differential privacy loss value for the new round, and use the mean formula to obtain the mean of the Rényi differential privacy loss values ​​for all rounds as the trigger threshold. If the Rényi differential privacy loss value in the new round is greater than the trigger threshold, it means that "the privacy loss value is about to be exhausted" and the privacy enhancement mechanism is triggered; otherwise, it means that "the privacy loss value is sufficient" and the parameters of the local model continue to be updated.

6. The AI ​​data privacy enhancement method as described in claim 5, characterized in that: The process involves constructing a joint optimization objective function and dynamically adjusting the data sampling rate and noise standard deviation using Riemann projection and projection gradient descent methods to obtain privacy-enhancing results, including: After the privacy enhancement mechanism is triggered, the loss function value of the pre-trained MobileNetV2 neural network model in the new round is extracted. The loss function value and the Rényi differential privacy loss value in the new round are normalized. The ratio of the normalized loss function value to the Rényi differential privacy loss value is taken as the weight. A joint optimization objective function is defined and minimized. Calculate the objective function value, and use the chain rule to obtain the partial derivative of the objective function value with respect to the data sampling rate and noise standard deviation. Then, perform Riemann projection on the positive number field parameter space to obtain the Riemann gradient. Based on the Riemann gradient, gradient updates are performed using projective gradient descent to generate new data sampling rate and noise standard deviation as balancing parameters. After covering the original data sampling rate and noise standard deviation with the balancing parameters, the perturbation gradient vector is reacquired, encryption and transmission are performed, homomorphic aggregation and decryption are performed, and the perturbation gradient sum is generated. The parameters of the local model are updated again according to the federated averaging rule. In subsequent updates, when the decrease in the loss function value of the local model no longer decreases significantly, the iteration stops, and the privacy enhancement training of the local model on the client side is completed, serving as the basis for AI data privacy enhancement.

7. The AI ​​data privacy enhancement method as described in claim 6, characterized in that: The collected multi-terminal sample data is preprocessed to generate a sample dataset, including: Structured or semi-structured sample data is obtained from the original data sources of multiple data terminals through API interfaces. The sample data in the structured or semi-structured sample set is preprocessed to generate a sample dataset.

8. An AI data privacy enhancement system, based on the AI ​​data privacy enhancement method according to any one of claims 1 to 7, characterized in that: include, The initial generation module is used to collect sample data from multiple terminals, preprocess it, and generate a sample dataset. The collaborative design module is used to generate a local model on the client side. After setting the data sampling rate to sample the sample dataset, a sample subset is generated as input to the local model. The sampled gradient vector is then used to perform gradient clipping operations to generate a normalized gradient vector. The inverse analysis module is used to construct the Rényi differential privacy closed upper bound inequality based on the normalized gradient vector and the data sampling rate, and then perform inverse analysis to obtain the minimum noise standard deviation and add Gaussian noise to generate a perturbation gradient vector. Rényi differential privacy analysis is then performed on the perturbation vector to obtain the Rényi differential privacy loss value. The aggregation update module is used to upload the Rényi differential privacy loss value to the server after Paillier homomorphic encryption, and then the client decrypts it to update the model parameters. The enhanced feedback module is used to trigger a privacy enhancement mechanism based on the Rényi differential privacy loss value after the model parameters are updated. It constructs a joint optimization objective function and dynamically adjusts the data sampling rate and noise standard deviation through Riemann projection and projection gradient descent to obtain the privacy enhancement result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the AI ​​data privacy enhancement method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the AI ​​data privacy enhancement method according to any one of claims 1 to 7.

Images