Sensitive data protection-oriented generative model differential privacy leakage prevention method and system

Abstract

The invention discloses a sensitive data protection-oriented generative model differential privacy leakage prevention method and system, and belongs to the technical field of artificial intelligence and data privacy protection. Constructing a forward diffusion and reverse sampling process based on sample information and a diffusion generation model framework; calculating the semantic sensitivity of the current generation state in each step of reverse sampling through a self-adaptive differential disturbance regulation algorithm, and regulating the noise intensity of the current step according to self-adaption; privacy expenditure brought by each round of disturbance is monitored through a verifiable privacy budget tracking mechanism, and real-time tracking privacy budget consumption is obtained; identifying high-similarity samples as high-risk areas in each round of generation by generating a risk perception feedback optimization strategy; and the model is guided to be far away from the privacy sensitive area by dynamically enhancing the disturbance intensity of high-similarity samples. According to the method, the privacy protection capability of the model in the sensitive field is effectively improved while high-quality data generation is realized.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and data privacy protection technology, specifically relating to a generative model differential privacy prevention method and system for sensitive data protection. Background Technology

[0002] With the rapid development of artificial intelligence technology, generative models (such as GANs, VAEs, and Diffusion Models) have been widely used in scenarios such as data augmentation, data completion, and data sharing, especially in highly sensitive fields, such as industrial IoT data simulation generation. Since raw sensitive data is often difficult to share directly, generative models can generate high-quality synthetic samples without exposing real data, thus facilitating model training or cross-agency collaboration.

[0003] However, traditional generative models still face significant privacy risks during training and generation. For example, by back-reaming the parameters or outputs of the generative model, attackers could reconstruct sensitive information from the original training samples, leading to data reconstruction or attribute inference attacks. Although some research has introduced differential privacy (DP) mechanisms to mitigate the leakage problem during training, most methods focus only on perturbations during model parameter updates, lacking effective privacy constraints for the generation stage. Particularly in diffusion models, the backsampling process is characterized by multi-step iterations, and the intermediate states generated at each step can potentially leak information. Traditional differential privacy mechanisms are difficult to directly adapt to and are prone to introducing excessive noise that affects generation quality.

[0004] Currently, there is a lack of methods that can introduce fine-grained perturbation control during the generation stage while balancing sample quality and privacy budget controllability, especially in implementing end-to-end privacy budget tracking and risk perception adjustment mechanisms in the backsampling path of diffusion models. Therefore, a novel differential privacy protection scheme for generative models is urgently needed to meet the practical needs of complex and sensitive application scenarios such as cross-institutional data sharing and privacy-inducing synthetic data generation. Summary of the Invention

[0005] Purpose of the invention: Given that existing generative models are difficult to avoid privacy leakage risks in sensitive data processing, and that traditional differential privacy methods mostly focus on the training phase while neglecting privacy control issues in the generation phase, this invention proposes a differential privacy leakage prevention method for generative models aimed at sensitive data protection.

[0006] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0007] A differential privacy-prevention method for generative models aimed at protecting sensitive data includes the following steps:

[0008] Step S10: Construct the forward diffusion and reverse sampling process based on sample information and the diffusion generation model framework.

[0009] Step S20: Calculate the current generated state in each backsampling step using the adaptive differential perturbation control algorithm. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step .

[0010] Step S30: Monitor the privacy expenditures resulting from each round of perturbation through a verifiable privacy budget tracking mechanism to obtain real-time tracking of privacy budget consumption.

[0011] Step S40: In each round of generation, highly similar samples are identified as high-risk areas by generating a risk perception feedback optimization strategy.

[0012] Step S50: By dynamically increasing the perturbation intensity of highly similar samples, the model is guided away from privacy-sensitive areas.

[0013] Preferred: Step 1 includes the following steps:

[0014] Step S101: Construct from the original sample to a degenerate state The diffusion sequence is defined, the perturbation form for each round is defined, and the network structure and prediction function are initialized.

[0015] Step S102: Define semantic sensitivity using the mean squared error between each round state in the diffusion sequence and the original sample. This leads to the derivation of the current disturbance intensity. and its fluctuation threshold .

[0016] Step S103: Completed and After initialization, it enters the backsampling phase.

[0017] Preferably, step S101 includes:

[0018] Step S1011: Input the original sample Set the number of diffusion steps Initialize parameter set This includes model structure, diffusion depth, initial learning rate, and temporal encoding.

[0019] Step S1012: Model the forward diffusion as a Markov process and perform the following update:

[0020]

[0021] in, Indicates the input model number. Samples at each time step, Indicates zero mean and covariance as Gaussian perturbation, It is an identity matrix.

[0022] Step S1013: Record the diffusion sequence This serves as the input for subsequent semantic sensitivity calculations and disturbance control.

[0023] Step S1014: Initialize the conditional prediction function Initialize the placeholder for the perturbation strength in each round. .

[0024] Preferred: Step S102 includes:

[0025] Step S1021: Calculate the semantic sensitivity for each round:

[0026]

[0027] in, To generate state number dimensional features, Features of the same dimension as the original sample For sample dimensions.

[0028] Step S1022: Based on sensitivity Dynamically schedule the intensity of disturbances in each round:

[0029]

[0030] in, This represents the maximum disturbance amplitude. This is the sensitivity amplification factor. Initial term of the disturbance. Time decay coefficient.

[0031] Step S1023: Simultaneously define the perturbation fluctuation threshold function for each round:

[0032]

[0033] in, The threshold for disturbance fluctuation, , Fluctuation tolerance upper and lower limits. This is a smoothing factor.

[0034] Preferred: Step 2 includes the following steps:

[0035] Step S201: Set from degenerate state Starting from the reverse path, gradually generating In each round of backsampling, the state is generated. Sampling according to the predicted distribution:

[0036]

[0037] in, This indicates that the back diffusion process is in the first stage. The generated sample state of the step; express The mean of the prediction results at time point;

[0038] Step S202: Disturbance Intensity according to Real-time calculation; detection Does it exceed the smoothing threshold? , This represents the change in perturbation intensity between the current step and the previous diffusion step;

[0039] Step S2021: If Proceed to the next round of sampling. Recording continues simultaneously. So that it can be compared next time.

[0040] Step S2022: If Freeze the current sampling step, skip it, and keep the previous state. .

[0041] Step S203: When When the reverse process is terminated and all reverse sampling rounds are completed, the final generated sample is output. .

[0042] Preferred: Step 3 includes the following steps:

[0043] Step S301: The privacy loss of each round of the anti-disturbance generation process is modeled using the RDP theoretical framework, thereby achieving global budget accumulation and triggering risk control.

[0044] Step S3011: For the first Wheel disturbance, its privacy budget The estimation formula is as follows:

[0045]

[0046] in, This indicates the sensitivity to distributional differences between adjacent datasets; For semantic sensitivity in each round; It is the first The standard deviation of the Gaussian noise added by the wheel disturbance; 𝛿 is the fine-tuning term; is a low-noise adjustment term, controlling privacy leakage caused by excessively low noise in the initial stage; is a time decay coefficient, balancing the contributions of early and later disturbances; is a state amplification factor, used to adjust the privacy budget response speed under high-risk rounds; is a nonlinear suppression coefficient, making the privacy budget tend to saturate under high noise conditions.

[0047] Step S3012: As the generation process proceeds, the privacy budget consumption of each round is accumulated to form a cumulative privacy budget. :

[0048]

[0049] in, Indicates the number of perturbation rounds that have been executed. This reflects the total privacy loss throughout the entire process.

[0050] Step S3013: Real-time transfer of accumulated privacy budget With the user's maximum privacy budget limit The comparison will be performed, and if the threshold is exceeded, the generation process will be immediately paused to prevent excessive privacy leaks.

[0051] Step S302: Record and track the key parameters and budget values ​​for each round of generation tasks. Construct the following privacy log structure to record the core information of each round of perturbation generation process:

[0052]

[0053] in, This represents a privacy log structure used to record core parameters such as the time of each round of perturbation generation, noise intensity, and privacy budget, enabling privacy tracking and evaluation. Indicates the first The second-generation timestamp. The current disturbance intensity. Corresponding privacy budget value.

[0054] Preferred: Step 4 includes the following steps:

[0055] Step S401: In the first During the round generation process, let the generated samples be... The training set is , This indicates that for each... Calculate its with Mean square error:

[0056]

[0057] in, For each Calculate its with The mean square error, For sample dimensions, and They represent the sample number respectively. The values ​​of each feature.

[0058] Step S402: In the disturbance scheduling function Based on this, a risk-driven feedback adjustment mechanism is introduced.

[0059]

[0060] in, This is the disturbance intensity adjustment coefficient. If If the difference is minimal, the disturbance increment is the largest. The disturbance only increased slightly. If not, then the perturbation will not be adjusted. The updated perturbation value will be... Apply to the next generation task.

[0061] Preferred: Step 5 includes the following steps:

[0062] Step S501: Embed the detected high similarity results as constraint terms into the generation loss function. The overall optimization objective function is designed as follows:

[0063]

[0064] in, Represents the overall loss function. This represents the original generation error loss; It is the risk adjustment weighting coefficient; Indicates the generated sample The expected value, that is, the average calculated result over all generated samples; This represents the error threshold, used to limit the maximum allowable reconstruction error range; Indicates the generation of samples Compared with real samples The mean square error; This is a balancing coefficient used to reduce fluctuations in error between different samples; This represents the variance of the error across different samples.

[0065] Step S502: The entire perturbation adjustment and training optimization process will stop when one of the following conditions is met: the model has reached the maximum number of training epochs. Overall budget It is close to the set threshold. .

[0066] Another objective of this invention is to provide a generative model differential privacy leakage prevention system for sensitive data protection, comprising an input unit, a forward diffusion and backsampling process construction unit, an adaptive differential perturbation control algorithm unit, a verifiable privacy budget tracking unit, a generation risk perception feedback optimization strategy unit, and an output unit, wherein:

[0067] The input unit is used to input sample information.

[0068] The forward diffusion and reverse sampling process construction unit is used to construct the forward diffusion and reverse sampling process based on sample information and the diffusion generation model framework.

[0069] The adaptive differential perturbation control algorithm unit is used to obtain backsampling information in each backsampling step based on the sample information using the adaptive differential perturbation control algorithm, and to calculate the current generation state. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step By dynamically increasing the perturbation intensity on highly similar samples, the model is guided away from privacy-sensitive areas.

[0070] The verifiable privacy budget tracking unit is used to monitor the privacy expenditures caused by each round of perturbation through a verifiable privacy budget tracking mechanism, thereby obtaining real-time tracking of privacy budget consumption.

[0071] The risk perception feedback optimization strategy unit is used to identify highly similar samples as high-risk areas in each round of generation by generating a risk perception feedback optimization strategy.

[0072] The output unit is used to output reverse sampling information.

[0073] Another object of the present invention is to provide a non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the aforementioned generative model differential privacy leakage prevention method for sensitive data protection.

[0074] Compared with the prior art, the present invention has the following advantages:

[0075] This invention first trains the diffusion model on privacy-sensitive data and initializes differential privacy perturbation control parameters. Then, during the backsampling phase, the system dynamically selects an appropriate noise intensity based on the gradient sensitivity and semantic density of the current generated state, and a controllable noise injection module adds perturbation. A Rényi differential privacy mechanism is employed to track privacy expenditures at each noise injection step, ensuring the entire generation process remains within the user-defined privacy budget ε. The similarity between the generated samples and the original data is assessed, and subsequent generation strategies are adjusted in real time to prevent leakage of privacy information in highly semantically overlapping regions. This invention effectively enhances the model's privacy protection capabilities in sensitive domains while achieving high-quality data generation. Attached Figure Description

[0076] Figure 1 This is a framework diagram of a differential privacy-prevention method for generative models aimed at protecting sensitive data.

[0077] Figure 2 This is a flowchart of a generative model differential privacy protection method for sensitive data protection.

[0078] Figure 3 This is a flowchart of the adaptive differential perturbation control algorithm.

[0079] Figure 4 Flowchart for a verifiable privacy budget tracking mechanism.

[0080] Figure 5 A flowchart for generating risk perception feedback optimization strategies. Detailed Implementation

[0081] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these examples are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0082] Example 1

[0083] Given that existing generative models are difficult to avoid privacy leakage risks in industrial IoT data simulation generation and processing, and that traditional differential privacy methods mostly focus on the training phase while neglecting privacy control issues in the generation phase, generative models in industrial IoT data simulation generation and processing face privacy leakage risks during training and inference, thus threatening user data security. Existing differential privacy protection is mainly applied to the training phase, but it is difficult to cover the generation process and often causes performance degradation, failing to balance generation quality and privacy protection. This embodiment provides a differential privacy anti-leakage method for generative models oriented towards sensitive data protection. It designs a differential privacy embedding mechanism specifically for the backsampling phase of diffusion models, including three key parts: an adaptive differential perturbation control algorithm, a verifiable privacy budget tracking mechanism, and a generation risk perception feedback optimization strategy. First, within the diffusion generative model framework, sensitive data is subjected to multiple rounds of Gaussian perturbation to construct a degenerate generation trajectory. The system introduces a semantic sensitivity index and dynamically calculates the perturbation intensity through mean square error, making the privacy perturbation more targeted and stable. During the back generation process, the system gradually samples to restore the original structure and monitors perturbation fluctuations in real time to ensure the smoothness of the generation path. Subsequently, the Rényi differential privacy mechanism is introduced to estimate and accumulate the privacy budget consumption caused by each round of perturbation, constructing a verifiable budget control path. If the budget is exceeded, the generation strategy is automatically adjusted to avoid leakage risks. After generation, the system uses a semantic embedding model to determine the similarity between the generated samples and the original samples, identifying potential reconstruction risk areas. Finally, this risk information is fed back to the perturbation control module and incorporated into the loss function, guiding the model to increase perturbation and suppress semantic reconstruction in high-risk areas, forming a closed-loop leakage prevention mechanism of "generation-evaluation-feedback-adjustment," effectively balancing data availability and privacy security. Figure 1 and 2 As shown, it includes the following steps:

[0084] Step S10: Construct the forward diffusion and reverse sampling process based on sample information and the diffusion generation model framework.

[0085] Initialize the neural network structure and parameter configuration of the diffusion model, and perform multiple rounds of forward diffusion to generate perturbation sequences. And by calculating semantic sensitivity Derivation of the perturbation intensity in each round and disturbance fluctuation threshold This provides a controllable perturbation path for the backsampling process.

[0086] First, a training process based on a diffusion model is constructed. This involves applying multiple rounds of Gaussian perturbation to the original sensitive samples to form a model from... arrive The evolutionary trajectory is used as a privacy-preserving representation of degradation. Based on this, the system introduces a semantic gradient sensitivity function. This is used to dynamically evaluate the semantic difference between the current generated state and the original sample. High sensitivity indicates that the generated state has a strong reconstruction capability, requiring increased perturbation strength. Therefore, the system uses the following perturbation scheduling function to calculate the standard deviation parameter for each round:

[0087]

[0088] in, Indicates the first The noise standard deviation in wheel generation; , Control the magnitude and rate of change of the sensitivity response to disturbances; This is the initial noise reference value; This is the time decay coefficient.

[0089] Specifically, the following steps are included:

[0090] Step S101: Construct from the original sample to a degenerate state The diffusion sequence is defined, the perturbation form for each round is defined, and the network structure and prediction function are initialized. The original samples (sample information) are industrial IoT data sample information.

[0091] Step S1011: Input the original sample Set the number of diffusion steps Initialize parameter set This includes model structure, diffusion depth, initial learning rate, and temporal encoding.

[0092] Step S1012: Model the forward diffusion as a Markov process and perform the following update:

[0093]

[0094] in, Indicates the input model number. Samples at each time step, Indicates zero mean and covariance as Gaussian perturbation, It is an identity matrix.

[0095] Step S1013: Record the diffusion sequence This serves as the input for subsequent semantic sensitivity calculations and disturbance control.

[0096] Step S1014: Initialize the conditional prediction function Initialize the placeholder for the perturbation strength in each round. .

[0097] Step S102: Define semantic sensitivity using the mean squared error between each round state in the diffusion sequence and the original sample. This leads to the derivation of the current disturbance intensity. and its fluctuation threshold .

[0098] Step S1021: Calculate the semantic sensitivity for each round:

[0099]

[0100] in, To generate state number dimensional features, Features of the same dimension as the original sample For sample dimensions.

[0101] Step S1022: Based on sensitivity Dynamically schedule the intensity of disturbances in each round:

[0102]

[0103] in, This represents the maximum disturbance amplitude. This is the sensitivity amplification factor. Initial term of the disturbance. Time decay coefficient.

[0104] Step S1023: Simultaneously define the perturbation fluctuation threshold function for each round:

[0105]

[0106] in, The threshold for disturbance fluctuation, , Fluctuation tolerance upper and lower limits. This is a smoothing factor.

[0107] Step S103: Completed and After initialization, it enters the backsampling phase.

[0108] Step S20, as follows Figure 3 As shown, the adaptive differential perturbation control algorithm calculates the current generated state in each step of backsampling. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step .

[0109] From Gaussian degenerate state To begin, use a prediction network. Guide each round of backsampling to generate state And inject the scheduled Gaussian perturbation. During this period, the changes in disturbances were continuously monitored. And based on the threshold Perform dynamic suppression and finally output the generated sample. .

[0110] In each round of backsampling, the system adjusts the current generated state accordingly. and prediction distribution generation In each round of backsampling, the sensitivity measure function The mean squared error (MSE) between generated and original samples is used to dynamically evaluate the gradient response or semantic distance between the current generated state and the original sensitive samples. This is combined with local semantic sensitivity. Real-time calculation of disturbance intensity To avoid generation instability caused by drastic fluctuations in disturbances, a smoothing threshold is introduced into the system. As the amplitude of the disturbance change The adjustment boundary is determined by a local sensitivity adjustment function, which exhibits adaptive adjustment characteristics. This means it grants greater tolerance in high semantic density regions while strictly constraining perturbation changes in low semantic density regions, thus achieving a robust balance between privacy protection and sample quality. Specifically, it includes the following steps:

[0111] Step S201: Set from degenerate state Starting from the reverse path, gradually generating In each round of backsampling, the state is generated. Sampling according to the predicted distribution:

[0112]

[0113] in, This indicates that the back diffusion process is in the first stage. The generated sample state of the step; express The mean of the prediction results at time point;

[0114] Step S202: Disturbance Intensity according to Real-time calculation; detection Does it exceed the smoothing threshold? , This represents the change in perturbation intensity between the current step and the previous diffusion step;

[0115] Step S2021: If Proceed to the next round of sampling. Recording continues simultaneously. So that it can be compared next time.

[0116] Step S2022: If Freeze the current sampling step, skip it, and keep the previous state. .

[0117] Step S203: When When the reverse process is terminated and all reverse sampling rounds are completed, the final generated sample is output. .

[0118] Step 2: In each round of reverse generation, the system determines the current state... and prediction function The state of the previous moment is obtained by sampling. This process gradually generates the final data. The system dynamically calculates the disturbance intensity. And detect the magnitude of its change in each round. If the magnitude exceeds the adaptive threshold If the current disturbance fluctuation is too large, it may lead to unstable generation or overfitting behavior. At this time, the system will automatically suppress the current disturbance, limit the growth rate of the disturbance parameters, and ensure the stability and privacy consistency of the generated trajectory.

[0119] Step S30, as follows Figure 4 As shown, a verifiable privacy budget tracking mechanism monitors the privacy expenditure resulting from each round of perturbation, enabling real-time tracking of privacy budget consumption.

[0120] To effectively assess and dynamically control privacy budget consumption during the perturbation process of the generative model, this step integrates differential privacy accumulation computation and verifiability tracking mechanism to achieve accurate calculation, dynamic comparison, and traceability log recording of the privacy budget, ensuring the auditability of the overall generation process and the security of privacy expenditures.

[0121] To ensure the overall generation process complies with differential privacy constraints, the system tracks privacy budget consumption in real time after each round of perturbation is applied via the Rényi Differential Privacy (RDP) mechanism. By calculating the privacy loss caused by the current perturbation and adding it to the historical cumulative value, the system constructs a dynamic privacy budget control path. Once the accumulated budget approaches the user's maximum tolerance for privacy breaches... The system will mitigate the current disturbance to prevent the leakage of original data features in the generated samples. Specifically, this includes the following steps:

[0122] Step S301: The privacy loss of each round of the anti-disturbance generation process is modeled using the Rényi Differential Privacy (RDP) theoretical framework, thereby achieving global budget accumulation and triggering risk control.

[0123] Step S3011: For the first Perturbation of the wheel, its privacy budget (loss). The estimation formula is as follows:

[0124]

[0125] in, This indicates the sensitivity to distributional differences between adjacent datasets; For semantic sensitivity in each round; It is the first The standard deviation of the Gaussian noise added by the wheel disturbance; 𝛿 is the fine-tuning term; is a low-noise adjustment term, controlling privacy leakage caused by excessively low noise in the initial stage; is a time decay coefficient, balancing the contributions of early and later disturbances; is a state amplification factor, used to adjust the privacy budget response speed under high-risk rounds; is a nonlinear suppression coefficient, making the privacy budget tend to saturate under high noise conditions.

[0126] Step S3012: As the generation process proceeds, the privacy budget consumption of each round is accumulated to form a cumulative privacy budget. :

[0127]

[0128] in, Indicates the number of perturbation rounds that have been executed. This reflects the total privacy loss throughout the entire process.

[0129] Step S3013: Real-time transfer of accumulated privacy budget With the user's maximum privacy budget limit The comparison will be performed, and if the threshold is exceeded, the generation process will be immediately paused to prevent excessive privacy leaks.

[0130] Step S302: To ensure the auditability, traceability, and compliance of the privacy spending process, key parameters and budget values ​​for each round of generation tasks are recorded and tracked. The following privacy log structure is constructed to record the core information of each round of perturbation generation:

[0131]

[0132] in, This represents a privacy log structure used to record core parameters such as the time of each round of perturbation generation, noise intensity, and privacy budget, enabling privacy tracking and evaluation. Indicates the first The second-generation timestamp. The current disturbance intensity. Corresponding privacy budget value.

[0133] In step 3, to ensure that the entire generation process strictly meets the differential privacy requirements, after each round of perturbation is applied, the current privacy budget consumption is calculated based on the Rényi differential privacy mechanism. And it is cumulatively tracked. In privacy budget tracking, the privacy expenditure resulting from each perturbation step is calculated and accumulated through the RDP mechanism. This establishes a privacy budget control pathway.

[0134] Step S40, as follows Figure 5 As shown, a risk perception feedback optimization strategy is used to identify highly similar samples as high-risk areas in each round of generation.

[0135] In generating each round of samples Then, a semantic embedding model is used to determine the semantic similarity between the generated sample and the data in the original sample set, identifying potential reconstruction risks. If the similarity between the generated sample and the original data in the embedding space exceeds a preset threshold... The system will mark it as "high risk," indicating a potential leakage problem and providing feedback for further adjustments to the perturbation strategy. This includes the following steps:

[0136] Step S401: In the first During the round generation process, let the generated samples be... The training set is , This indicates that for each... Calculate its with Mean square error:

[0137]

[0138] in, For each Calculate its with The mean square error, For sample dimensions, and They represent the sample number respectively. The values ​​of each feature.

[0139] Step S402: To further reduce the semantic reconstruction probability of high-risk samples, the perturbation scheduling function will be... Based on this, a risk-driven feedback adjustment mechanism is introduced.

[0140]

[0141] in, This is the disturbance intensity adjustment coefficient. If If the difference is minimal (almost reconstructing the original data), the disturbance increment is the largest; if The disturbance only increased slightly; If the disturbance value is not adjusted, the system will update the disturbance value. Apply to the next generation task.

[0142] In step 4, to identify potential reconstruction leakage risks, samples are generated after each round of generation. Compared with the original samples in the training set Perform semantic similarity matching and calculate their MSE similarity. If any similarity result exceeds a set threshold... If the generated sample is not found to be in a high-risk area, it is marked as a "high-risk area," indicating a potential for semantic leakage.

[0143] This invention identifies high-risk regions in each generation round by calculating the mean squared error (MSE) between generated samples and training samples, and feeds the results back to the perturbation scheduling module. This module dynamically increases the perturbation intensity for highly similar samples, guiding the model away from privacy-sensitive regions and improving differential privacy protection capabilities. A semantic embedding model is used to perform semantic similarity discrimination on the generated samples to identify high-risk samples.

[0144] Step S50 involves dynamically increasing the perturbation intensity for highly similar samples to guide the model away from privacy-sensitive regions. For highly similar regions, a stronger noise injection strategy is implemented to dynamically optimize the generation path and enhance privacy robustness.

[0145] Step S501: To effectively guide the model away from semantically overlapping regions, the detected high similarity results are embedded as constraints into the generation loss function. The overall optimization objective function is designed as follows:

[0146]

[0147] in, Represents the overall loss function. This represents the original generation error loss; It is the risk adjustment weighting coefficient; Indicates the generated sample The expected value, that is, the average calculated result over all generated samples; This represents the error threshold, used to limit the maximum allowable reconstruction error range; Indicates the generation of samples Compared with real samples The mean square error; This is a balancing coefficient used to reduce fluctuations in error between different samples; The first term represents the variance of the error across different samples. The second and third terms represent the risk-perceived loss, used to penalize semantically similar generated results.

[0148] Step S502: The entire perturbation adjustment and training optimization process will stop when one of the following conditions is met: the model has reached the maximum number of training epochs. Overall budget It is close to the set threshold. .

[0149] This invention marks highly similar samples as high-risk regions, and then updates the perturbation mapping function in step 2 accordingly. The scheduling strategy increases the noise injection amplitude in the risk area in subsequent generation steps, and repeats the model training iteratively until the model training is completed.

[0150] A semantic risk-aware feedback mechanism is introduced into the loss function to penalize generated samples with excessively high similarity, thereby suppressing the emergence of high-risk samples. This optimization strategy effectively guides the generative model away from easily leaky areas, ensuring that generated samples maintain quality while possessing stronger privacy irreversibility.

[0151] In another embodiment, a generative model differential privacy leakage prevention system for sensitive data protection is provided, comprising an input unit, a forward diffusion and backsampling process construction unit, an adaptive differential perturbation control algorithm unit, a verifiable privacy budget tracking unit, a generation risk perception feedback optimization strategy unit, and an output unit, wherein:

[0152] The input unit is used to input sample information.

[0153] The forward diffusion and reverse sampling process construction unit is used to construct the forward diffusion and reverse sampling process based on sample information and the diffusion generation model framework.

[0154] The adaptive differential perturbation control algorithm unit is used to obtain backsampling information in each backsampling step based on the sample information using the adaptive differential perturbation control algorithm, and to calculate the current generation state. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step By dynamically increasing the perturbation intensity on highly similar samples, the model is guided away from privacy-sensitive areas.

[0155] The verifiable privacy budget tracking unit is used to monitor the privacy expenditures caused by each round of perturbation through a verifiable privacy budget tracking mechanism, thereby obtaining real-time tracking of privacy budget consumption.

[0156] The risk perception feedback optimization strategy unit is used to identify highly similar samples as high-risk areas in each round of generation by generating a risk perception feedback optimization strategy.

[0157] The output unit is used to output reverse sampling information.

[0158] In another embodiment, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the described generative model differential privacy leakage prevention method for sensitive data protection.

[0159] This invention first constructs a forward diffusion and backsampling process during the model training phase and initializes the sensitivity estimation parameters. In each round of backsampling, the system adjusts the noise intensity based on the sensitivity of the generated state to achieve differential privacy perturbation. To avoid drastic changes in perturbation affecting the generation quality, the system introduces a perturbation smoothing mechanism and uses a privacy budget tracking module to monitor privacy expenditures in each round, ensuring that the overall generation process does not exceed a set budget threshold. Furthermore, by comparing the semantic similarity between the generated samples and the original data, potential leakage risks are detected, and subsequent generation strategies are adjusted accordingly, thereby enhancing the privacy protection effect.

[0160] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A generative model differential privacy-prevention method for sensitive data protection, characterized in that, Includes the following steps: Step S10: Construct the forward diffusion and reverse sampling process based on sample information and the diffusion generation model framework; Step S20: Calculate the current generated state in each backsampling step using the adaptive differential perturbation control algorithm. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step ; Step S30: Monitor the privacy expenditure caused by each round of perturbation through a verifiable privacy budget tracking mechanism to obtain real-time tracking of privacy budget consumption; Step S40: In each round of generation, highly similar samples are identified as high-risk areas by generating a risk perception feedback optimization strategy. Step S50: By dynamically increasing the perturbation intensity of highly similar samples, the model is guided away from privacy-sensitive areas.

2. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step 1 includes the following steps: Step S101: Construct from the original sample to a degenerate state The diffusion sequence is defined, the perturbation form for each round is defined, and the network structure and prediction function are initialized. Step S102: Define semantic sensitivity using the mean squared error between each round state in the diffusion sequence and the original sample. This leads to the derivation of the current disturbance intensity. and its fluctuation threshold ; Step S103: Completed and After initialization, it enters the backsampling phase.

3. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step S101 includes: Step S1011: Input the original sample Set the number of diffusion steps Initialize parameter set This includes model structure, diffusion depth, initial learning rate, and temporal encoding; Step S1012: Model the forward diffusion as a Markov process and perform the following update: in, Indicates the input model number. Samples at each time step, Indicates zero mean and covariance as Gaussian perturbation, It is the identity matrix; Step S1013: Record the diffusion sequence This serves as the input for subsequent semantic sensitivity calculations and disturbance control. Step S1014: Initialize the conditional prediction function Initialize the placeholder for the perturbation strength in each round. .

4. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step S102 includes: Step S1021: Calculate the semantic sensitivity for each round: in, To generate state number dimensional features, Features of the same dimension as the original sample For sample dimensions; Step S1022: Based on sensitivity Dynamically schedule the intensity of disturbances in each round: in, This represents the maximum disturbance amplitude; This is the sensitivity amplification factor; Initial disturbance term; Time decay coefficient; Step S1023: Simultaneously define the perturbation fluctuation threshold function for each round: s in which, The threshold for disturbance fluctuation, , Fluctuation tolerance limits; This is a smoothing factor.

5. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step 2 includes the following steps: Step S201: Set from degenerate state Starting from the reverse path, gradually generating In each round of backsampling, the state is generated. Sampling according to the predicted distribution: in, This indicates that the back diffusion process is in the first stage. The generated sample state of the step; express The mean of the prediction results at time point; Step S202: Disturbance Intensity according to Real-time calculation; detection Does it exceed the smoothing threshold? , This represents the change in perturbation intensity between the current step and the previous diffusion step; Step S2021: If Proceed to the next round of sampling; continue recording simultaneously. So that it can be compared next time; Step S2022: If Freeze the current sampling step, skip it, and keep the previous state. ; Step S203: When When the reverse process is terminated and all reverse sampling rounds are completed, the final generated sample is output. .

6. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step 3 includes the following steps: Step S301: The privacy loss of each round of the anti-disturbance generation process is modeled using the RDP theoretical framework, thereby achieving global budget accumulation and triggering risk control; Step S3011: For the first Wheel disturbance, its privacy budget The estimation formula is as follows: in, This indicates the sensitivity to distributional differences between adjacent datasets; For semantic sensitivity in each round; It is the first The standard deviation of the Gaussian noise added by the wheel disturbance; 𝛿 is the fine-tuning term; For low noise adjustment, 𝜆 is the time decay coefficient, 𝜅 is the state amplification factor, and 𝛾 is the nonlinear suppression coefficient; Step S3012: As the generation process proceeds, the privacy budget consumption of each round is accumulated to form a cumulative privacy budget. : in, Indicates the number of perturbation rounds that have been executed; This reflects the total privacy loss throughout the entire process; Step S3013: Real-time transfer of accumulated privacy budget With the user's maximum privacy budget limit The comparison will be made, and if the threshold is exceeded, the generation process will be immediately paused to prevent excessive privacy leaks. Step S302: Record and track the key parameters and budget values ​​for each round of generation tasks; construct the following privacy log structure to record the core information of each round of perturbation generation process: in, This indicates the structure of the privacy log. Indicates the first The second-generation timestamp; The current disturbance intensity; Corresponding privacy budget value.

7. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step 4 includes the following steps: Step S401: In the first During the round generation process, let the generated samples be... The training set is , This represents the total number of samples in the training set; for each Calculate its with Mean square error: in, For each Calculate its with The mean square error, For sample dimensions, and They represent the sample number respectively. The values ​​of each feature; Step S402: In the disturbance scheduling function Based on this, a risk-driven feedback adjustment mechanism is introduced; in, This is the disturbance intensity adjustment coefficient; if If the difference is minimal, the disturbance increment is the largest; if The disturbance only increased slightly; If the perturbation value is not adjusted, then the updated perturbation value will be updated. Apply to the next generation task.

8. The generative model differential privacy leakage prevention method for sensitive data protection according to claim 1, characterized in that: Step 5 includes the following steps: Step S501: Embed the detected high similarity results as constraint terms into the generation loss function; the overall optimization objective function is designed as follows: in, Represents the overall loss function. This represents the original generation error loss; It is the risk adjustment weighting coefficient; Indicates the generated sample Expected value Indicates the error threshold. Indicates the generation of samples Compared with real samples The mean square error; For balance coefficient, This represents the variance of the error across different samples; Step S502: The entire perturbation adjustment and training optimization process will stop when one of the following conditions is met: the model has reached the maximum number of training epochs. Overall budget It is close to the set threshold. .

9. A differential privacy leakage prevention system based on the generative model differential privacy leakage prevention method for sensitive data protection as described in claim 1, characterized in that: It includes an input unit, a forward diffusion and backward sampling process construction unit, an adaptive differential perturbation control algorithm unit, a verifiable privacy budget tracking unit, a risk-aware feedback optimization strategy generation unit, and an output unit, wherein: The input unit is used to input sample information; The forward diffusion and reverse sampling process construction unit is used to construct the forward diffusion and reverse sampling process based on sample information and diffusion generation model framework; The adaptive differential perturbation control algorithm unit is used to obtain backsampling information in each backsampling step based on the sample information using the adaptive differential perturbation control algorithm, and to calculate the current generation state. semantic sensitivity ,according to Adaptive adjustment of noise intensity in the current step By dynamically increasing the perturbation intensity on highly similar samples, the model is guided away from privacy-sensitive areas. The verifiable privacy budget tracking unit is used to monitor the privacy expenditure caused by each round of perturbation through the verifiable privacy budget tracking mechanism, so as to obtain real-time tracking of privacy budget consumption. The risk perception feedback optimization strategy unit is used to identify highly similar samples as high-risk areas in each round of generation through the risk perception feedback optimization strategy. The output unit is used to output reverse sampling information.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the generative model differential privacy leakage prevention method for sensitive data protection as described in any one of claims 1 to 8.

Images