Differential privacy defense method and device for semantic embedding space, equipment and storage medium

Abstract

The invention provides a semantic embedding space-oriented differential privacy defense method and device, equipment and a storage medium, and relates to the technical field of artificial intelligence security and privacy protection. The method comprises the following steps: acquiring an original text and cleaning the original text; encoding the cleaned text into a semantic vector and then executing L2 normalization processing; calculating the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in a predefined harmful seed library, and determining a risk tag; the disturbance intensity is dynamically adjusted according to the risk label, L2 norm clipping is conducted on the normalized semantic vector, and isotropic Gaussian noise meeting the differential privacy requirement is overlaid; and based on a preset compliance candidate text pool, calculating cosine similarity between the semantic vector after disturbance and candidate text semantic embedding as a utility value, and performing probability sampling on the candidate text through an index mechanism to obtain a final security response text. According to the method, jailbreak attacks, parameter-independent attacks such as cue word injection and member inference can be effectively resisted.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security and privacy protection technology, and in particular to a differential privacy defense method, apparatus, device and storage medium for semantic embedding space. Background Technology

[0002] With the widespread application of Large Language Models (LLMs) in fields such as intelligent dialogue and content generation, the security and privacy risks they face are becoming increasingly prominent. Attackers can induce models to generate illegal, harmful, or privacy-disclosing information by designing carefully crafted prompts. Typical attacks include jailbreaking, prompt injection, membership inference, and attribute inference. To address these threats, existing defense technologies mainly focus on rule filtering, output rewriting, adversarial training, and differential privacy mechanisms.

[0003] Currently, the technical solutions that are closest to this application in the market mainly fall into the following categories: 1. Output filtering method based on keyword matching and rule system These methods set up a rule engine after the model outputs, which scans the generated text using a predefined sensitive word library, regular expressions, or syntax patterns. Once a match is detected, the response is blocked or replaced. For example, Google's Perspective API and OpenAI's Content Moderation API both use this mechanism, jointly determining the safety of the output through blacklisted keywords (such as violence and hate speech) and semantic classification models.

[0004] Structural features: The scheme consists of a three-layer structure: (1) an input text receiving module; (2) a rule matching engine (including a keyword library, a set of regular expressions, and a classification model); and (3) a response interception or replacement module. The system performs a matching operation immediately after generating the text, and returns a preset security response if a rule is triggered.

[0005] Disadvantages and their causes: The core flaw of this method lies in its surface-symbol-based matching mechanism, which cannot handle adversarial inputs that are semantically equivalent but lexically different. For example, attackers can bypass keyword detection through synonym substitution ("explosives" → "C4"), spelling variations ("b0mb"), and language obfuscation ("how to make something go boom"). Its structural flaw stems from: (1) The rule space is discrete: the keyword library cannot cover all semantically equivalent expressions, and there are a lot of semantic blind spots; (2) Lack of context awareness: The rule system has difficulty distinguishing the pragmatic differences between "discussing violence" and "describing violent scenes"; (3) Passive response mechanism: Filtering only after generation cannot prevent harmful semantic paths from being generated within the model.

[0006] 2. Differential privacy training methods based on gradient space or embedding layers This type of method introduces differential privacy into the model training process. By adding Gaussian noise (Differentially Private Stochastic Gradient Descent, DP-SGD) during gradient updates, it prevents the model from memorizing individual information from the training data, thereby resisting member inference attacks. Representative systems include Google's DP-Framework and Meta's Opacus toolkit.

[0007] This method introduces two key modules during the model training phase: (1) a gradient clipping module, which clips the gradients of each batch of samples using the L2 norm; and (2) a noise injection module, which adds Gaussian noise to the clipped gradients. The entire process relies on access to the model parameters and the backpropagation mechanism.

[0008] The fundamental limitation of this method lies in its scope being confined to the training phase and parameter space, making it unsuitable for direct output defense during the inference phase. Its structural flaws manifest as follows: (1) Strong deployment dependency: It must be integrated during training and cannot be deployed independently as a post-processing module; (2) Misalignment of the action level: The perturbation is applied to the gradient or word embedding layer, rather than the semantic representation of the final output, making it difficult to control the semantic direction of the generated content; (3) Ineffective against jailbreak attacks: DP-SGD mainly prevents data memory leakage and cannot prevent attackers from manipulating the output semantics through prompts; (4) High performance cost: It significantly reduces the utility of the model and requires retraining, making it difficult to adapt to the already deployed model.

[0009] 3. Semantic Similarity-Based Response Replacement System Some systems attempt to generate secure responses through semantic matching mechanisms. For example, after encoding user input into sentence vectors, the most similar template is retrieved from a predefined secure response library and returned, avoiding the model directly generating content.

[0010] The method includes: (1) a semantic encoder (such as Sentence-BERT); (2) a vector database (for storing secure response embeddings); (3) a nearest neighbor retrieval module (such as FAISS); and (4) a response return module.

[0011] While this method possesses semantic-level processing capabilities, it lacks a formal privacy protection mechanism, and its structural flaw lies in: (1) No noise perturbation mechanism: the semantic vector is directly used for retrieval, and attackers can infer the input semantics by observing the output distribution; (2) Vulnerable to adversarial sample attacks: Small perturbations in the input may cause the semantic vector to fall into different retrieval regions, resulting in the failure of the defense; (3) Not combined with differential privacy: cannot satisfy -DP requirements cannot prevent model memory leakage or attribute inference attacks. In summary, the existing technical solutions all have the following structural problems: (1) Limited scope of action: It is either limited to the text surface (rule system) or limited to training parameters (DP-SGD), lacking a mechanism for active perturbation in the semantic output space; (2) Misalignment of defense layers: It is impossible to apply formal privacy protection to the semantic representation of the generated content during the reasoning stage; (3) Poor versatility: Most solutions require modification of the model structure or training process, making it difficult to adapt to different LLMs as a general post-processing module; (4) Lack of theoretical safeguards: Existing semantic-level methods do not introduce differential privacy mechanisms and cannot provide quantifiable privacy protection commitments.

[0012] Therefore, there is an urgent need for a defense mechanism that can operate in the inference phase, be oriented towards the output semantic space, require no access to model parameters, and has formal privacy protection, in order to solve the security and privacy problems of large language models when facing semantic manipulation attacks. Summary of the Invention

[0013] This application provides a differential privacy defense method, apparatus, device, and storage medium for semantic embedding space, to solve the problems of limited scope, lack of formal privacy protection, reliance on model parameter access, and insufficient generality of existing large language model defense technologies when dealing with semantic manipulation attacks, thereby achieving semantic-level security protection for model output content.

[0014] This application, without relying on the model's internal parameters or modifying the training process, applies a condition to the semantic vector of the response generated by the large language model. - The perturbation of differential privacy requirements interferes with the attacker's stable observation of the output semantic pattern, thereby effectively resisting parameter-independent attacks such as jailbreak attacks, prompt injection, and member inference.

[0015] Furthermore, this application aims to introduce an index mechanism to retrieve and sample compliant responses that are semantically closest to the perturbed response from a predefined pool of security candidates, thereby achieving a controllable restoration to natural language and preventing the direct exposure of sensitive semantics while ensuring the naturalness of the output language.

[0016] Firstly, this application provides a differential privacy defense method oriented towards semantic embedding space, including: The system retrieves raw text from a large language model or user input interface, and sequentially performs system marker removal, empty content filtering, text normalization, and special character filtering to obtain cleaned text. The cleaned text is encoded into a semantic vector using a pre-trained sentence encoding model, and L2 normalization is performed on the semantic vector to obtain a normalized semantic vector. Calculate the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library, and determine the risk label based on the comparison result of the cosine similarity and the preset threshold; The perturbation intensity is dynamically adjusted according to the risk label, the normalized semantic vector is clipped using the L2 norm, and isotropic Gaussian noise that meets the differential privacy requirements is superimposed to obtain the perturbated semantic vector. Based on a pre-defined pool of compliant candidate texts, the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate text is calculated as a utility value. The candidate texts are then probabilistically sampled using an exponential mechanism to obtain the final security response text.

[0017] In one possible design, the text normalization operation specifically involves: converting the text to lowercase and merging multiple consecutive spaces into a single space; the special character filtering operation uses regular expressions to remove HTML tags, encoded entities, and non-natural language symbols.

[0018] In one possible design, the pre-trained sentence encoding model is either a Sentence-BERT model or a SimCSE model; if the pre-trained sentence encoding model does not provide an output pool, then the semantic vector is obtained by average pooling of the hidden states of all tokens in the final hidden state of the model, and the average pooling formula is: In the formula, For semantic vectors, For the number of tokens, For the first The hidden state of each token; The semantic vectors are then L2 normalized using the following formula: In the formula, This is a normalized semantic vector.

[0019] In one possible design, the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library is calculated using the following formula: In the formula, For normalized semantic vectors, This is a matrix transpose operation. To normalize the semantic vector and the first one in the predefined harmful seed library i Harmful semantic embedding vectors Cosine similarity; If the maximum similarity Greater than the preset threshold If it is high-risk, it is considered high-risk; otherwise, it is considered harmless text.

[0020] In one possible design, the perturbation intensity is dynamically adjusted based on the risk label, the normalized semantic vector is L2 norm-trimmed, and isotropic Gaussian noise that meets differential privacy requirements is superimposed to obtain the perturbated semantic vector: The normalized semantic vector is obtained through the following formula. Perform L2 norm clipping: In the formula, The clipped vector, To set a threshold, It is a function for maximizing the value; After clipping the vector Add isotropic Gaussian noise to the top: In the formula, This is the perturbed semantic vector. The vector is Gaussian noise. This indicates that the expression follows a pattern with a mean of 0 and a covariance matrix of... The multivariate Gaussian distribution, for 3D identity matrix The standard deviation of noise; The formula for calculating the standard deviation of noise is: In the formula, For global sensitivity, For relaxation terms, For privacy budget, This is the noise amplification factor.

[0021] In one possible design, based on a pre-defined pool of compliant candidate texts, the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate texts is calculated as a utility value using the following formula. : In the formula, This is the perturbed semantic vector. Embed for each candidate sentence; Methods for obtaining the final security response text by probabilistically sampling candidate texts using an exponential mechanism include: Based on the index mechanism, candidate sentences are sampled using the following probability distribution: In the formula, To select candidate sentences The probability, It is an exponential function with the natural constant as its base. For privacy budget, For utility function sensitivity, i For candidate sentence index, m This represents the total number of candidate sentences. The sampling results will be used as the final security response text.

[0022] In one possible design, a contextual prior is introduced to construct an extended utility function. Based on this extended utility function, an extended utility value is calculated to replace the original utility value. The formula for the extended utility function is: In the formula, To expand utility value, and For weight parameters, The contextual conditional probabilities output by the language model.

[0023] Secondly, this application provides a differential privacy defense device for semantic embedding space, the device comprising: The text preprocessing module is configured to acquire raw text from a large language model or user input interface, and sequentially perform system marker removal, empty content filtering, text normalization and special character filtering operations to obtain cleaned text; The semantic vector encoding module is configured to encode the cleaned text into semantic vectors using a pre-trained sentence encoding model, and to perform L2 normalization on the semantic vectors to obtain normalized semantic vectors. The risk assessment and disturbance decision module is configured to calculate the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library, and determine the risk label based on the comparison result of the cosine similarity and the preset threshold. The differential privacy perturbation module is configured to dynamically adjust the perturbation intensity according to the risk label, perform L2 norm pruning on the normalized semantic vector, and superimpose isotropic Gaussian noise that meets the differential privacy requirements to obtain the perturbed semantic vector. The privacy-preserving text generation module is configured to calculate the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate text as a utility value based on a preset pool of compliant candidate texts, and to perform probability sampling on the candidate texts through an exponential mechanism to obtain the final secure response text.

[0024] Thirdly, embodiments of this application provide an electronic device, including: at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, causing the at least one processor to perform the differential privacy defense method for semantic embedding space as described in the first aspect and various possible designs of the first aspect.

[0025] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the differential privacy defense method for semantic embedding space as described in the first aspect and various possible designs of the first aspect.

[0026] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the differential privacy defense method for semantic embedding space as described in the first aspect and various possible designs of the first aspect.

[0027] The differential privacy defense method, apparatus, device, and storage medium for semantic embedding space provided in this application have at least the following beneficial effects: 1. Apply perturbations to the semantic space to improve the robustness of defense against semantic manipulation attacks.

[0028] Existing rule systems only perform keyword matching on the surface of text, and their structure cannot perceive semantic equivalence transformations (such as synonym replacement, sentence reconstruction, and metaphorical expression), making them vulnerable to attackers who can bypass detection through semantic variations.

[0029] This application, through the synergistic effect of the semantic vector encoding module and the differential privacy perturbation module, for the first time applies perturbation to the model output representation in a high-dimensional semantic space by mapping text to continuous vectors. Furthermore, L2 pruning and Gaussian noise injection are performed on this vector, so that even if the attacker constructs a semantically equivalent input variant, the perturbed semantic path is still randomized. The perturbation in the semantic space directly interferes with the attacker's stable observation of the model's output pattern, destroys the semantic continuity assumption of the jailbreak prompt, and thus effectively resists advanced adversarial techniques such as prompt word injection and GCG attacks.

[0030] 2. It enables general and deployable post-processing defense without requiring access to model parameters.

[0031] Existing DP-SGD methods require intervention during the training phase, rely on backpropagation and gradient calculation, and are structurally tied to specific models and training processes, making them unsuitable for deployed models.

[0032] This application adopts an end-to-end post-processing architecture, where each module operates on either the model's output or input text, and is not parameter-coupled with the large language model itself. The system only needs to receive the raw text input and independently completes cleaning, encoding, perturbation, and generation. This design allows the solution to be deployed as independent middleware on the front end of any LLM service without modifying the model architecture or retraining, significantly improving engineering practicality and cross-model compatibility.

[0033] 3. Achieving a controllable balance between privacy and utility by combining index mechanisms.

[0034] While existing semantic retrieval systems can generate natural responses, they lack formal privacy protections, allowing attackers to infer the input semantics through the output distribution.

[0035] This application introduces an exponential mechanism sampling unit in the privacy-preserving text generation module, using cosine similarity as the utility function to construct a sampling unit that satisfies... - Differential privacy probability distributions, a mechanism that achieves a theoretically tunable trade-off between semantic fidelity (selecting the semantically nearest response) and privacy protection (introducing random perturbations). Privacy Budget The smaller the value, the stronger the randomness and the better the privacy protection; conversely, the larger the value, the higher the semantic fidelity. Users can flexibly configure it according to the scenario to achieve the optimal balance between security and usability.

[0036] 4. The graded disturbance strategy enhances the refined control of security protection.

[0037] Applying a uniform level of perturbation to inputs of different risk levels can easily lead to over-defense or under-defense.

[0038] This application achieves dynamic adjustment of perturbation intensity through the linkage of a risk assessment and perturbation decision module and a differential privacy perturbation module. High-risk inputs trigger noise amplification factors. The perturbation is significantly enhanced for harmless inputs, while a light noise is applied only to obscure privacy features. This hierarchical strategy ensures security while minimizing the impact on the output quality of normal users, avoiding semantic distortion due to excessive perturbation, and improving the user experience.

[0039] 5. Semantic-level detection and dual-judgment mechanism enhance the ability to identify harmful content.

[0040] Traditional rule systems rely on keyword matching, which makes it difficult to identify harmful content at the semantic level.

[0041] Structural Improvement: This invention constructs a harmful seed database within the risk assessment module, combining cosine similarity calculation with keyword rules to form a dual assessment mechanism based on semantics and rules. Even if an attacker circumvents keyword detection by using synonym substitution, their semantic vector may still be highly similar to the harmful seed, thus allowing for effective identification. This mechanism significantly improves the robustness to adversarial input detection.

[0042] 6. Supports a unified generation framework that adapts to multiple scenarios.

[0043] Existing methods often require designing dedicated branch logic for different scenarios, resulting in complex structures that are difficult to maintain.

[0044] This application designs an extensible utility function in the privacy-preserving text generation module, supporting the introduction of contextual priors (such as language model probabilities) and adjusting weights. It can be used in a single round of question and answer ( ) and multi-round dialogue ( Seamlessly switch between them to achieve a simple design with one architecture applicable to multiple scenarios.

[0045] This application addresses the fundamental problems of existing technologies in defending against semantic manipulation attacks, such as limited scope, lack of privacy protection, and poor deployment flexibility, through the collaborative design of a semantic space perturbation structure, an independent post-processing deployment architecture, an exponential sampling mechanism, and a hierarchical risk decision-making logic. Its technical effectiveness lies not only in improved security but also in achieving a balance between formal privacy protection, controllable semantic fidelity, and convenient engineering deployment, demonstrating significant advancements and practicality. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0047] Figure 1 A flowchart of a differential privacy defense device for semantic embedding space provided in this application embodiment Figure 1 ; Figure 2A structural diagram of a differential privacy defense device oriented towards semantic embedding space provided in an embodiment of this application; Figure 3 A flowchart of a differential privacy defense device for semantic embedding space provided in this application embodiment Figure 2 ; Figure 4 A structural diagram of the text preprocessing module provided in the embodiments of this application; Figure 5 This is a structural diagram of the risk assessment and disturbance decision-making module provided in an embodiment of this application; Figure 6 This is a structural diagram of the differential privacy perturbation module provided in an embodiment of this application; Figure 7 This is a structural diagram of the privacy-preserving text generation module provided in an embodiment of this application.

[0048] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0049] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0050] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0051] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0052] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0053] This application provides a differential privacy defense method oriented towards semantic embedding space, such as... Figure 1 As shown, the implementation process of this differential privacy defense method for semantic embedding space is as follows: Initially, an attack request X input by the user is obtained. This request carries instruction injection or jailbreaking attack content targeting the Large Language Model (LLM), thus forming the attack request to be processed. R harmful ; Regarding the attack request R harmful The process involves several steps: First, text preprocessing is performed to clean and normalize the requested content. The preprocessed content is then input into the semantic vector encoding module to encode the semantic vector. Based on this, a risk assessment is conducted, calculating the similarity between the semantic vector and a predefined harmful semantic embedding. The result is compared to a threshold of 0.67. If the similarity is ≥0.67, differential privacy perturbation is applied directly to the current semantic vector. If the similarity is <0.67, the corresponding content is re-encoded using the Sentence-BERT model and normalized. Then, differential privacy perturbation is applied to the normalized vector. The vector after differential privacy perturbation is retrieved from a pre-defined security response candidate pool, and an exponential mechanism is used to sample the candidate content. Based on the sampled candidate content, a privacy-protecting defensive text is generated. This defensive text is then fed back to the user as an interactive security response Y, thus completing the entire differential privacy defense process for the semantic embedding space.

[0054] This application also provides a differential privacy defense device oriented towards semantic embedding space, used to implement the above-described differential privacy defense method oriented towards semantic embedding space. Figure 2 As shown, the differential privacy defense device for semantic embedding space includes a text preprocessing module 101, a semantic vector encoding module 102, a risk assessment and perturbation decision module 103, a differential privacy perturbation module 104, and a privacy-enhancing text generation module 105. These modules are respectively configured to implement the following... Figure 3 Steps S10-S30 in the differential privacy defense method flow for semantic embedding space shown.

[0055] S10: Obtain the raw text from the large language model or user input interface, and sequentially perform system mark removal, empty content filtering, text normalization and special character filtering operations to obtain the cleaned text.

[0056] Step S10 is implemented through the text preprocessing module 101, whose output is connected to the input of the semantic vector encoding module 102. For example... Figure 4 As shown, the text preprocessing module 101 includes: System tag removal unit 101a is used to identify and remove dialogue system meta tags in input text; Empty content filtering unit 101b is used to detect and discard inputs that are zero in length or contain only whitespace characters; Text normalization unit 101c is used to uniformly convert text to lowercase and merge consecutive spaces; Special character filtering unit 101d is used to remove HTML tags and encoded entities.

[0057] The text preprocessing module 101 receives raw text from a large language model or a user input interface. Enter text First, the text is processed by the system's marker removal unit, then sequentially filtered for empty content, normalized, and cleaned for special characters, before being output as the cleaned text. In one specific embodiment, the following standardized cleaning operation is performed through the four sub-units contained within the text preprocessing module 101: (1) The system tag removal unit 101a identifies and deletes meta tags in the dialogue system, such as ( <sys> >、< <user>assistant:) etc.; (2) Empty content filtering unit 101b detects and removes invalid inputs that are pure blank, contain only blank characters, or have a length of zero; (3) Text normalization unit 101c converts the text to lowercase and merges multiple consecutive spaces into a single space; (4) Special character filtering unit 101d uses regular expressions to remove HTML tags (such as...). , ), encoded entities (such as &) and other non-natural language symbols.

[0058] S20: The cleaned text is encoded into a semantic vector using a pre-trained sentence encoding model, and L2 normalization is performed on the semantic vector to obtain a normalized semantic vector.

[0059] Step S20 can be implemented through the semantic vector encoding module 102, whose input is connected to the output of the text preprocessing module 101; its output is connected to the risk assessment and perturbation decision module 103 and the differential privacy perturbation module 104, which receives... Call local or remote semantic encoding services to generate sentence vectors It outputs the normalized semantic vector. .

[0060] The semantic vector encoding module 102 is equipped with a pre-trained sentence encoding model, specifically a Sentence-BERT or SimCSE model, whose output is a d-dimensional sentence vector or semantic vector of the input text. It then performs L2 normalization and outputs the normalized semantic vector. .

[0061] In one specific embodiment, the semantic vector encoding module 102 encodes the cleaned text. Encoded as 3D semantic vector Its core is a pre-trained sentence encoding model, preferably Sentence-BERT or SimCSE.

[0062] If the model provides an output pool, the vector is directly used as the sentence vector; if not (such as the RoBERTa variant), the hidden states of all tokens in the final hidden state are averaged. In the formula, For semantic vectors, For the number of tokens, For the first The hidden state of each token.

[0063] Then, L2 normalization is performed on the vector: In the formula, This is a normalized semantic vector.

[0064] S30: Calculate the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library, and determine the risk label based on the comparison result of the cosine similarity and the preset threshold.

[0065] Step S30 can be implemented through the risk assessment and perturbation decision module 103, which is used to determine the risk level of the input text and decide the intensity of subsequent perturbations. Its input end is connected to the semantic vector encoding module 102; its output end sends a risk label to the differential privacy perturbation module 104. .

[0066] In one specific embodiment, such as Figure 5 As shown, the risk assessment and disturbance decision module 103 includes three sub-modules: a harmful seed library 103a, a similarity assessment unit 103b, and a threshold comparison unit 103c.

[0067] The pre-built harmful seed library 103a in the risk assessment and disturbance decision module 103 stores a set of semantic embedding vectors of harmful texts. It can cover categories such as violence, hate, and illegality.

[0068] The similarity determination unit 103b is used to calculate the normalized semantic vector of the input text. The cosine similarity between the vector and various subvectors is calculated using the following formula: In the formula, For normalized semantic vectors, This is a matrix transpose operation. To normalize the semantic vector and the first one in the predefined harmful seed library i Harmful semantic embedding vectors The cosine similarity.

[0069] Threshold comparison unit 103c is used to set the similarity threshold. If the maximum similarity exceeds this threshold, i.e. If it is, it is judged as high risk and a high risk flag is output. Otherwise, it is determined to be harmless text and a harmless marker is output. In some embodiments, keyword matching rules can be integrated as a supplementary determination method.

[0070] S40: Dynamically adjust the perturbation intensity according to the risk label, perform L2 norm pruning on the normalized semantic vector, and superimpose isotropic Gaussian noise that meets the differential privacy requirements to obtain the perturbed semantic vector.

[0071] Step S40 can be implemented through the differential privacy perturbation module 104, whose input receives data from the semantic vector encoding module 102. and risk labels from risk assessment module 103 The output of the differential privacy perturbation module 104 is connected to the privacy-enhanced text generation module 105, and outputs the perturbated semantic vector. .

[0072] In one specific embodiment, such as Figure 6 As shown, the differential privacy perturbation module 104 applies a condition satisfying the following in the semantic vector space: - Differential privacy noise perturbation, comprising two sub-units: L2 norm clipping unit 104a and Gaussian noise injection unit 104b.

[0073] The L2 norm clipping unit 104a is used to clip the input semantic vector Clipping to L2 norm not exceeding a set threshold Within the sphere. Specifically, the L2 norm clipping unit 104a applies the normalized semantic vector of the input. Perform L2 norm clipping to ensure that its modulus does not exceed a set threshold. (Usually set to 1): In the formula, The clipped vector, To set a threshold, It is a function for maximizing the value.

[0074] Gaussian noise injection unit 104b is used to superimpose isotropic Gaussian noise onto the clipped vector. The noise standard deviation Differential privacy parameters and noise amplification factor Jointly determined; the noise amplification factor The value is determined by the risk flag output by the risk assessment module. Control: When hour, ;when hour, .

[0075] Specifically, the Gaussian noise injection unit 104b injects noise into the clipped vector. Add isotropic Gaussian noise to the top: In the formula, This is the perturbed semantic vector. The vector is Gaussian noise. This indicates that the expression follows a pattern with a mean of 0 and a covariance matrix of... The multivariate Gaussian distribution, for 3D identity matrix The standard deviation of noise; Noise Standard Deviation Differential privacy parameters Decide: in This is the noise amplification factor; when the risk is assessed as high risk, (like This enhances the intensity of the disturbance.

[0076] S50: Based on a preset pool of compliant candidate texts, calculate the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate text as a utility value, and perform probability sampling on the candidate texts through an exponential mechanism to obtain the final security response text.

[0077] Step S50 can be implemented through the privacy-enhancing text generation module 105, whose input is connected to the output of the differential privacy perturbation module 104 to obtain... The output end connects to the system response interface and outputs the final security response text. .

[0078] In one specific embodiment, such as Figure 7 As shown, the privacy-preserving text generation module 105 includes a candidate text pool 105a, a utility function calculation unit 105b, and an exponential mechanism sampling unit 105c.

[0079] Candidate text pool 105 stores a set of predefined compliance response texts. Each response text generates its semantic embedding using the same semantic encoding model as the input text. .

[0080] For example, predefined compliance response text The sources include: Security response templates (e.g., "I cannot answer this type of question"); cleaned generic dialogue corpora (e.g., DailyDialog); domain knowledge base summary sentences.

[0081] All candidate sentences are embedded using the same semantic encoding model as the input. And indexed to a vector database (such as FAISS).

[0082] Utility function calculation unit 105b is used to calculate the perturbed semantic vector. Embedded with each candidate response Cosine similarity between As a utility value, the calculation formula is: In the formula, This is the perturbed semantic vector. Embed for each candidate sentence.

[0083] The exponential mechanism sampling unit 105c is used to sample candidate responses according to the probability distribution and output the sampling results.

[0084] Based on the exponential mechanism, the following probability distribution is used to sample candidate sentences: In the formula, To select candidate sentences The probability, It is an exponential function with the natural constant as its base. For privacy budget, For utility function sensitivity, i For candidate sentence index, m This represents the total number of candidate sentences. The sampling result is the final output, namely the final security response text. .

[0085] In some embodiments, a contextual prior is introduced to construct an extended utility function, and an extended utility value is calculated based on the extended utility function to replace the utility value. The formula for the extended utility function is: In the formula, To expand utility value, and For weight parameters, The contextual conditional probabilities output by the language model.

[0086] This application provides an electronic device. The electronic device may include a processor and a memory, wherein the processor and the memory can communicate; exemplarily, the processor and the memory communicate via a communication bus.

[0087] The processor executes computer execution instructions stored in memory, causing the processor to perform the scheme in the above embodiments. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0088] The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. Transceivers are used to enable communication between database access devices and other computers (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) and may also include non-volatile memory.

[0089] The electronic device provided in this application embodiment can be the terminal device described in the above embodiments.

[0090] This application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer performs the technical solution of the differential privacy defense method for semantic embedding space described in the above embodiments.

[0091] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When the at least one processor executes the computer program, it can implement the technical solution of the differential privacy defense method for semantic embedding space described in the above embodiments.

[0092] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0093] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0094] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0095] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0096] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0097] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0098] Buses can be Industry Standard Architecture (ISA) buses, Peripheral Component Interconnect (PCI) buses, or Extended Industry Standard Architecture (EISA) buses, etc. Buses can be categorized into address buses, data buses, control buses, etc.

[0099] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0100] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.

[0101] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.< / user> < / sys>

Claims

1. A differential privacy defense method oriented towards semantic embedding space, characterized in that, The method includes: The system retrieves raw text from a large language model or user input interface, and sequentially performs system marker removal, empty content filtering, text normalization, and special character filtering to obtain cleaned text. The cleaned text is encoded into a semantic vector using a pre-trained sentence encoding model, and L2 normalization is performed on the semantic vector to obtain a normalized semantic vector. Calculate the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library, and determine the risk label based on the comparison result of the cosine similarity and the preset threshold; The perturbation intensity is dynamically adjusted according to the risk label, the normalized semantic vector is clipped using the L2 norm, and isotropic Gaussian noise that meets the differential privacy requirements is superimposed to obtain the perturbated semantic vector. Based on a pre-defined pool of compliant candidate texts, the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate text is calculated as a utility value. The candidate texts are then probabilistically sampled using an exponential mechanism to obtain the final security response text.

2. The differential privacy defense method for semantic embedding space according to claim 1, characterized in that, The text normalization operation specifically involves: converting the text to lowercase and merging multiple consecutive spaces into a single space; the special character filtering operation uses regular expressions to remove HTML tags, encoded entities, and non-natural language symbols.

3. The differential privacy defense method for semantic embedding space according to claim 1, characterized in that, The pre-trained sentence encoding model is either the Sentence-BERT model or the SimCSE model; if the pre-trained sentence encoding model does not provide an output pool, then the semantic vector is obtained by average pooling of the hidden states of all tokens in the final hidden state of the model. The average pooling formula is as follows: In the formula, For semantic vectors, For the number of tokens, For the first The hidden state of each token; The semantic vectors are then L2 normalized using the following formula: In the formula, This is a normalized semantic vector.

4. The differential privacy defense method for semantic embedding space according to claim 1, characterized in that, The cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library is calculated using the following formula: In the formula, For normalized semantic vectors, This is a matrix transpose operation. To normalize the semantic vector and the first one in the predefined harmful seed library i Harmful semantic embedding vectors Cosine similarity; If the maximum similarity Greater than the preset threshold If it is high-risk, it is considered high-risk; otherwise, it is considered harmless text.

5. The differential privacy defense method for semantic embedding space according to claim 1, characterized in that, The perturbation intensity is dynamically adjusted based on the risk label, the normalized semantic vector is pruned using the L2 norm, and isotropic Gaussian noise that meets differential privacy requirements is superimposed to obtain the perturbed semantic vector: The normalized semantic vector is obtained through the following formula. Perform L2 norm clipping: In the formula, The clipped vector, To set a threshold, It is a function for maximizing the value; After clipping the vector Add isotropic Gaussian noise to the top: In the formula, This is the perturbed semantic vector. The vector is Gaussian noise. Represented as It follows a pattern with a mean of 0 and a covariance matrix of... The multivariate Gaussian distribution, for 3D identity matrix The standard deviation of noise; The formula for calculating the standard deviation of noise is: In the formula, For global sensitivity, For relaxation terms, For privacy budget, This is the noise amplification factor.

6. The differential privacy defense method for semantic embedding space according to claim 1, characterized in that, Based on a pre-defined pool of compliant candidate texts, the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate texts is calculated as a utility value using the following formula. : In the formula, This is the perturbed semantic vector. Embed for each candidate sentence; Methods for obtaining the final security response text by probabilistically sampling candidate texts using an exponential mechanism include: Based on the index mechanism, candidate sentences are sampled using the following probability distribution: In the formula, To select candidate sentences The probability, It is an exponential function with the natural constant as its base. For privacy budget, For utility function sensitivity, i For candidate sentence index, m This represents the total number of candidate sentences. The sampling results will be used as the final security response text.

7. The differential privacy defense method for semantic embedding space according to claim 6, characterized in that, An extended utility function is constructed by introducing contextual priors. Based on the extended utility function, an extended utility value is calculated to replace the original utility value. The formula for the extended utility function is as follows: In the formula, To expand utility value, and For weight parameters, The contextual conditional probabilities output by the language model.

8. A differential privacy defense device for semantic embedding space, characterized in that, The device includes: The text preprocessing module is configured to acquire raw text from a large language model or user input interface, and sequentially perform system marker removal, empty content filtering, text normalization and special character filtering operations to obtain cleaned text; The semantic vector encoding module is configured to encode the cleaned text into semantic vectors using a pre-trained sentence encoding model, and to perform L2 normalization on the semantic vectors to obtain normalized semantic vectors. The risk assessment and disturbance decision module is configured to calculate the cosine similarity between the normalized semantic vector and each harmful semantic embedding vector in the predefined harmful seed library, and determine the risk label based on the comparison result of the cosine similarity and the preset threshold. The differential privacy perturbation module is configured to dynamically adjust the perturbation intensity according to the risk label, perform L2 norm pruning on the normalized semantic vector, and superimpose isotropic Gaussian noise that meets the differential privacy requirements to obtain the perturbed semantic vector. The privacy-preserving text generation module is configured to calculate the cosine similarity between the perturbed semantic vector and the semantic embedding of the candidate text as a utility value based on a preset pool of compliant candidate texts, and to perform probability sampling on the candidate texts through an exponential mechanism to obtain the final secure response text.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the differential privacy defense method for semantic embedding space as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the differential privacy defense method for semantic embedding space as described in any one of claims 1-7.

Images