Privacy policy compliance assessment method and device based on large model, medium and product

Abstract

The invention discloses a privacy policy compliance evaluation method and device based on a large model, a medium and a product, and relates to the technical field of computer information process.The method comprises the steps that intelligent blocking is conducted on a privacy policy, the data size needing to be processed by the large model at a time is shortened, and the data processing efficiency is improved. The problem that the large model physically cuts off the text when the input text is too long is solved, and in addition, the problem that the attention degree and the memory effect of a large model core algorithm on remote position information are remarkably reduced when the large model core algorithm processes the super-long text, namely, the problem that the long text is forgotten is also avoided; in addition, by constructing an assessment knowledge graph and a navigation semantic tree, structural mapping from legal rules to specific texts is realized through vector matching and screening, specific terms of policies can be traced according to assessment rules, and the requirement for generating specific assessment records in assessment tasks is met.

Description

Technical Field

[0001] This application relates to the field of computer information processing technology, and in particular to a method, device, medium, and product for privacy policy compliance assessment based on a large model. Background Technology

[0002] In the wave of the digital age, data, as a core production factor, plays an increasingly significant supporting role in various industries, and the resulting data security risks have also increased dramatically. Frequent data breaches, misuse, and tampering not only threaten personal privacy and trade secrets but may also escalate to a strategic level affecting national security, posing a severe challenge to the robust operation of new digital infrastructure.

[0003] Privacy policy texts are often lengthy, with a single privacy policy text for complex businesses often containing tens of thousands of words. Traditional methods for conducting policy compliance assessments based on large models suffer from the problem of forgetting long texts, making it impossible to trace the specific policy clauses for the assessment details, and failing to meet the need to generate specific assessment records in the assessment task. Summary of the Invention

[0004] The purpose of this application is to provide a method, device, medium, and product for privacy policy compliance assessment based on a large model, which can effectively solve the problem of long texts and establish a traceable mapping relationship. During the assessment, any judgment can be reversed to locate the specific sentence in the original text, thus meeting the rigid requirement of the assessment task for the chain of evidence.

[0005] To achieve the above objectives, this application provides the following solution: In a first aspect, this application provides a privacy policy compliance assessment method based on a large model, comprising: constructing an assessment knowledge graph based on a first document; the assessment knowledge graph includes hierarchical concept nodes constructed based on the first document, wherein there are association edges between the hierarchical concept nodes, the association edges are used to link the hierarchical concept nodes, and the hierarchical concept nodes include first-level concept nodes, second-level concept nodes and third-level concept nodes; Based on the aforementioned evaluation knowledge graph, a navigation semantic tree is constructed for the privacy policy, specifically including: The privacy policy is intelligently segmented to obtain text blocks, and then the text blocks are vectorized to obtain block vectors; Templates are selected from the case template set of the secondary concept nodes and quantized to obtain template vectors. The similarity between the block vector and the template vector is calculated, and matching results that meet the criteria are selected based on the similarity. The navigation semantic tree is constructed based on the hierarchical outline of the privacy policy, the matching results, and the preset prompts; Based on the evaluation knowledge graph and the navigation semantic tree, a structured evaluation record is generated using a large model.

[0006] Optionally, the attribute set of the first-level concept node includes the unique identifier of the first-level concept node, the name of the first-level concept node, and the clauses of the first document; the attribute set of the second-level concept node includes the unique identifier of the second-level concept node, the name of the second-level concept node, the associated unique identifier of the first-level concept node, and a set of case templates; the attribute set of the third-level concept node includes the unique identifier of the third-level concept node, the name of the third-level concept node, the associated unique identifier of the second-level concept node, and evaluation rules.

[0007] Optionally, the privacy policy is intelligently segmented to obtain text blocks, and then the text blocks are vectorized to obtain block vectors. The steps include: Convert the privacy policy into plain text content; The plain text content is segmented into paragraphs to obtain paragraph blocks; Calculate the character length of the paragraph block and output the text block; If the character length of the paragraph block is less than or equal to the standard character length, then the paragraph block is output as the text block; If the character length of the paragraph block is greater than the standard character length, then it is divided into sub-paragraph blocks according to specific punctuation marks, and the sub-paragraph blocks are output as the text blocks. The character length of the sub-paragraph blocks is less than or equal to the standard character length. The embedding model is invoked to vectorize each text block to obtain the block vector.

[0008] Optionally, the steps of selecting templates from the case template set of the secondary concept nodes and quantizing them to obtain template vectors, calculating the similarity between the block vector and the template vector, and filtering out matching results that meet the criteria based on the similarity include: Select at least one of the templates from the set of case templates for the secondary concept nodes; The template is vectorized by calling the embedding model to obtain the template vector. Calculate the cosine similarity between the block vector and the template vector; Filter out the text blocks whose cosine similarity is greater than a preset threshold; Output the matching result corresponding to the text block, the matching result including the text block, the secondary concept node, the template and the cosine similarity and the correspondence between them.

[0009] Optionally, the step of constructing the navigation semantic tree based on the hierarchical outline of the privacy policy, the matching results, and preset prompts includes: The large model is invoked to extract the hierarchical outline from the privacy policy based on preset prompts. The hierarchical outline includes multiple hierarchical headings. Based on the matching results and the hierarchical outline, each text block is labeled with a title tag corresponding to the hierarchical outline and a concept tag corresponding to the evaluation knowledge graph; the concept tag includes the first-level concept node and the second-level concept node.

[0010] The text block is divided into individual sentences. All evaluation rules under the second-level concept node of the text block corresponding to the sentence are read. The sentence is then labeled with a third-level concept node tag or "no matching" according to the evaluation rules. The navigation semantic tree is constructed with the title of the privacy policy as the root node, the statements as branch nodes, and the title tags, concept tags, and third-level concept node tags corresponding to the statements as leaf nodes, according to the hierarchical relationship of the outline and the order of the statements.

[0011] Optionally, the step of generating structured evaluation records based on the evaluation knowledge graph and the navigation semantic tree, using large model collaborative processing, includes: Traverse the third-level concept nodes in the evaluation knowledge graph, and for each third-level concept node, search for the associated statement and evaluation rules in the navigation semantic tree; The large model is invoked to generate formatted evaluation records based on the evaluation rules corresponding to the third-level concept nodes according to the prompt words; The evaluation records are extracted and saved using regular expressions.

[0012] Optionally, the large-model-based privacy policy compliance assessment method further includes: The process of generating a compliant new privacy policy based on the aforementioned assessment records includes the following steps: Obtain the negative evaluation records; the evaluation records include positive evaluation records and negative evaluation records; The large model is invoked, and the negative evaluation records are rectified based on the rectification prompts, thereby generating rectification suggestions; The large model is invoked, and the privacy policy, the positive evaluation record, and the rectification suggestions are generated based on the generated prompts, thereby generating the new privacy policy.

[0013] In a second aspect, this application provides a computer device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the privacy policy compliance assessment method based on the large model described above.

[0014] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the privacy policy compliance assessment method based on the large model described above.

[0015] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the privacy policy compliance assessment method based on the large model described above.

[0016] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application provides a method, device, medium, and product for privacy policy compliance assessment based on a large model. By intelligently segmenting privacy policies (which can be tens of thousands of words long due to the numerous regulations they involve), the amount of data that the large model needs to process at one time is reduced. This solves the problem of physical text truncation when the input text is too long. In addition, it avoids the problem of the core algorithm of the large model significantly reducing its attention to and memory of information at distant locations when processing extremely long texts, i.e., the long text forgetting problem. Furthermore, by constructing an assessment knowledge graph and a navigation semantic tree, and through vector matching and filtering, a structured mapping from legal rules to specific texts is achieved. This allows for tracing the specific policy clauses to the assessment details, meeting the need to generate specific assessment records in the assessment task. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a privacy policy compliance assessment method based on a large model, as described in one embodiment of this application. Figure 2 for Figure 1 A modular flowchart illustrating a large-scale model-based privacy policy compliance assessment method. Figure 3 A schematic diagram of the concept nodes of the evaluation knowledge graph for a privacy policy compliance evaluation method based on a large model provided in an embodiment of this application; Figure 4 This is a partial navigation semantic tree diagram illustrating a privacy policy compliance assessment method based on a large model, as presented in this application. Figure 5This provides a case study for constructing a semantic tree for the large model in this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0021] It should be noted that the large model mentioned in this application refers to an artificial intelligence model with natural language understanding and generation capabilities, including a large language model based on the Transformer architecture.

[0022] To achieve the above objectives, this application provides the following solution: Please refer to Figure 1 and Figure 2 Firstly, this application provides a privacy policy compliance assessment method based on a large model, including: S1 constructs an evaluation knowledge graph based on the first document. Please refer to [link / reference]. Figure 3 The evaluation knowledge graph contains hierarchical concept nodes built based on the first document. There are connecting edges between the hierarchical concept nodes, which are used to link the hierarchical concept nodes. The hierarchical concept nodes include first-level concept nodes, second-level concept nodes, and third-level concept nodes.

[0023] The first document can be a law in a broad sense, including the sum of norms such as the constitution, laws, administrative regulations, and local regulations. It can also be a normative document issued internally by the company; that is, the first document is the superior document, and the privacy policy is the subordinate document. The first document establishes normative standards for the privacy policy, used to determine whether the privacy policy violates the first document. For example, the first document may be one or more of the Data Security Law, Cybersecurity Law, and Personal Information Protection Law, and the privacy policy may be the privacy policy to be evaluated. It can also be a policy document issued internally by the company. The first document includes, but is not limited to, the Data Security Law, Cybersecurity Law, Personal Information Protection Law, or national standards in the field of information security technology: GB / T35273, GB / T45574, GB / T42574, GB / T41391, GB / T43435-2023, GB / T39335, etc.

[0024] Optionally, the attribute set V1 of the first-level concept node includes the unique identifier of the first-level concept node, the name of the first-level concept node, and the clauses of the first document; the attribute set V2 of the second-level concept node includes the unique identifier of the second-level concept node, the name of the second-level concept node, the unique identifier of the associated first-level concept node, and the case template set; the attribute set V3 of the third-level concept node includes the unique identifier of the third-level concept node, the name of the third-level concept node, the unique identifier of the associated second-level concept node, and the evaluation details.

[0025] For example, based on data security laws, cybersecurity laws, and personal information protection laws, a primary concept node is constructed, encompassing policy framework, information compliance content, user rights protection, security guarantees, and special scenarios. The attribute set of a primary concept node includes its unique identifier (A), its name (e.g., policy framework, information compliance content, user rights protection, security guarantees, and special scenarios), and the clauses of the first document (from one or more relevant legal clauses of the data security law, cybersecurity law, or personal information protection law). The attribute set of a secondary concept node includes its unique identifier (A1), its name (i.e., scope of application), and the associated primary concept node's unique identifier A1. In this embodiment, the relationship between A1 and A is clearly evident, along with the case template set (scenario-based templates provided by legal clauses related to the scope of application). The attribute set of a Level 3 concept node includes its unique identifier (A1.1), its name (service type description), the associated Level 2 concept node's unique identifier (A1.1), and the evaluation details (whether the service type is clearly defined, such as map navigation or online shopping). For brevity, please refer to the detailed content of the knowledge graph evaluation. Figure 2 In the diagram, the case_templates column corresponds to the set of case templates, and the evaluate_rule column corresponds to the evaluation rules.

[0026] In this embodiment, there are related edges between hierarchical concept nodes. The semantic meaning between first-level and second-level concept nodes is: including, subordinate to, or divided into. Specifically, "policy framework" includes "scope of application," "responsible entity," "compliance principle," and "policy update." The semantic meaning between second-level and third-level concept nodes is: specified as, subdivided into, and assessed based on. Specifically, "responsible entity" is subdivided into "responsible entity identity" and "personal information protection specialist / dedicated department." The assessment basis for "responsible entity identity" is "whether the responsible entity (company name / organization information) is clearly defined"; the assessment basis for "personal information protection specialist / dedicated department" is "whether a dedicated personal information protection department / specialist and valid contact information have been established and publicized according to the scale of personal information processing."

[0027] In this embodiment, the evaluation knowledge graph transforms the text of the first document into a structured, semantic, and interconnected graph network. The legal text is broken down into primary concept nodes such as "policy framework," "information collection," and "user rights," which are then further refined into secondary and tertiary concept nodes, forming a clear evaluation dimension tree. Each level of concept node (such as "identity of the responsible entity") not only has a name but also is associated with specific legal basis and evaluation rules (evaluate_rule), giving it legal meaning and judgment criteria. Through the connecting edges, the hierarchical, inclusive, and referential relationships between concept nodes at each level are clarified, forming a complete knowledge system rather than an isolated list of rules.

[0028] In this embodiment, the construction of a knowledge graph-driven context navigation semantic tree is evaluated, and a concept node labeling system is provided. First-level and second-level concept nodes of the knowledge graph (e.g., V1: policy framework, V2: scope of application) are directly used as labels to annotate various parts of the privacy policy. When constructing the semantic tree, this application avoids having a large model blindly read the entire text for understanding. Instead, these templates are used as "semantic anchors," and relevant paragraphs are actively "hooked" from the text and labeled by calculating semantic similarity. This greatly improves the accuracy and efficiency of labeling and is the core of achieving automated parsing.

[0029] When a statement needs to be evaluated, the large model finds the associated third-level concept node label (e.g., A1.1) through the semantic tree, and then immediately indexes the corresponding highly specific `evaluate_rule` (e.g., "whether the service type is clearly defined (e.g., map navigation, online shopping, etc.)") from the knowledge graph. This rule is the precise instruction for the large model to make a judgment.

[0030] Because each evaluation conclusion is linked to a specific node in the evaluation knowledge graph, the system can automatically categorize and statistically analyze the evaluation results by first-level concept nodes (generating pie charts) or locate the third-level concept nodes with the most problems (generating bar charts). This makes the evaluation results no longer a vague overall score, but rather attributable, statistically significant, and manageable.

[0031] When non-compliance issues are detected, the system can pinpoint the specific assessment rule violated (derived from the knowledge graph). When generating rectification suggestions, the legal provisions of that rule can be cited to propose targeted modification plans. Finally, when generating new policies, the overall model is also created and optimized within the compliance framework defined by the assessment knowledge graph.

[0032] S2 constructs a navigation semantic tree for the privacy policy based on the evaluation knowledge graph, specifically including: S21 performs intelligent segmentation of the privacy policy to obtain text blocks, and then vectorizes the text blocks to obtain block vectors.

[0033] Step S21 specifically includes: S211 converts the privacy policy into plain text. It uses Python libraries to read the privacy policy, removes non-text elements such as headers, footers, tables, and images, and extracts the plain text content.

[0034] S212 performs paragraph segmentation on the plain text content to obtain paragraph blocks. The plain text content is segmented into paragraph blocks based on line breaks.

[0035] S213 calculates the character length of the paragraph block and outputs the text block.

[0036] If the character length of a paragraph block is less than or equal to the standard character length, the paragraph block will be output as a text chunk.

[0037] If the character length of a paragraph block is greater than the standard character length, it is split into sub-paragraph blocks according to specific punctuation marks. The sub-paragraph blocks are then output as text blocks, and the character length of each sub-paragraph block is less than or equal to the standard character length.

[0038] S214 calls an embedding model (such as Bge-m3 or Bert) to vectorize each text block to obtain a block vector.

[0039] This step employs an intelligent segmentation strategy, prioritizing segmentation based on line breaks within natural paragraphs to ensure that each "paragraph block" is a complete semantic unit. A standard character length is then set; if a paragraph block becomes too long, secondary segmentation is performed based on statement boundaries (punctuation marks, .;), ensuring that the length of each final segment is controllable.

[0040] Optionally, S213 can also use the following strategies to calculate the character length of the paragraph block and output the text block: B1 initializes the current paragraph block length len_current=0, the current paragraph block content B_temp="null", and the paragraph block index i=1; B2 for each paragraph block P j Calculate its character length len(P) j ); B3 If len_current + len(P) j )≤base_length, then B_temp=B_temp+P j ,len_current=len_current+len(P j ); B4 If len_current + len(P) j )>base_length, and len(P jIf B_temp ≤ base_length, then store B_temp in the text chunk set B, and B_temp = P. j len_current=len(P j ), i = i + 1; B5 If len(P) j If )>base_length, then P is split by punctuation marks ".". j For sub-paragraph P j1 ,P j2 ,...,P jk In steps B3 and B4, P j Change to P jk Repeat steps B3 and B4 to ensure that the final output text chunks do not exceed the standard character length `base_length`. The standard character length is obtained based on the maximum context window of the large language model or embedding model being called. For example, if GPT-3.5-turbo is used, its typical input limit is 4096 tokens. `base_length` must be significantly smaller than this value because: space needs to be reserved for the model's output; and the prompt words themselves will occupy a large number of tokens. `base_length = maximum model context length - estimated system prompt word length - safety margin`. For example, for a model with 4096 tokens, `base_length` might be set to 1024 characters (note: tokens and character count are not equivalent and need to be converted according to encoding). In this embodiment, the standard character length is between 800 and 1200 characters, including 800, 850, 900, 950, 1000, 1024, 1050, 1100, 1150, and 1200 characters. It can maintain the relative semantic integrity of text segments while enabling the model to process them stably and efficiently.

[0041] This processing strategy employs an intelligent segmentation approach, prioritizing segmentation based on line breaks within natural paragraphs to ensure that each "paragraph block" is a complete semantic unit. A standard character length is then set; when a paragraph becomes too long, secondary segmentation is performed based on sentence boundaries (punctuation marks, ., ;), ensuring that the length of each final block is controllable. Short paragraphs are merged into the same block based on the current paragraph's accumulated value, avoiding the generation of too many meaningless micro-blocks.

[0042] S22 selects templates from the case template set of secondary concept nodes and quantizes them to obtain template vectors. It then calculates the similarity between the block vectors and the template vectors and filters out matching results that meet the criteria based on the similarity.

[0043] S221 Select at least one template from the set of case templates for secondary concept nodes.

[0044] This step requires selecting at least one template from the template library of each secondary concept node as the "semantic representative" of that node, which limits the scope and direction of matching and greatly improves the efficiency and accuracy of subsequent matching.

[0045] S222 calls the embedding model (e.g., Bge-m3, Bert) to vectorize the template to obtain the template vector.

[0046] This step transforms unstructured text templates into computable data.

[0047] S223 calculates the cosine similarity between the block vector and the template vector. This step replaces keyword-based fuzzy matching, achieving precise association based on deep semantic understanding.

[0048] S224 filters out text blocks with a cosine similarity greater than a preset threshold.

[0049] The preset threshold value ranges from 0.6 to 0.7, including 0.6, 0.65, and 0.7. This step introduces a quality control mechanism. The threshold is an adjustable parameter, allowing the system to be configured according to different evaluation stringency requirements, enhancing the flexibility and practicality of the solution, filtering out weak correlations and noisy matches, and ensuring the reliability of the matching results.

[0050] S225 outputs the matching results corresponding to the text blocks. The matching results include text blocks, secondary concept nodes, templates, and cosine similarity, as well as the correspondence between them.

[0051] This step outputs a structured matching result. It explicitly includes: Text chunks: the original text fragments; Secondary concept nodes: the matched terms; Templates used: the specific cases used for matching; Cosine similarity: a quantified value of the matching strength. The correspondence between them clearly indicates which text chunk, which template, which concept node was matched, and the confidence level. This is the cornerstone for achieving interpretability and traceability of the assessment. Each matching step is documented, providing direct input for generating "assessment records with a chain of evidence." It makes the entire matching process transparent, auditable, and verifiable.

[0052] These five steps constitute a complete "semantic retrieval and alignment" subsystem, which aligns unstructured privacy policy text (through chunk vectors) with structured compliance knowledge (through template vectors) in the semantic space. The output matching results (especially the matched secondary concept nodes) directly serve as the core basis for labeling text chunks with concepts in step S23.

[0053] By segmenting long texts (privacy policy texts can be tens of thousands of words long) into text blocks and matching them with specific concept nodes, it transforms the difficult problem of "finding relevant parts in the entire long text" into a solvable problem of "using concept nodes as queries and performing semantic retrieval in the text block index," thereby avoiding the problem of forgetting long texts in large models.

[0054] S23 constructs a navigation semantic tree based on the hierarchy outline of the privacy policy, matching results, and preset prompts. This includes the following steps: S231 invokes a large model to extract a hierarchical outline from the privacy policy based on preset prompts. The hierarchical outline includes multiple hierarchical headings.

[0055] Construct a large model prompt, such as "

Task Description

Example

[0056] Based on the matching results and the hierarchical outline, S232 labels each text block with the title tag corresponding to the hierarchical outline and the concept tag corresponding to the evaluation knowledge graph; the concept tag includes first-level concept nodes and second-level concept nodes.

[0057] A text chunk may span multiple outline headings (e.g., the end of a paragraph belongs to section 1.1, and the beginning belongs to section 1.2). Assign a most relevant heading label based on the position of the majority of sentences within the text chunk, or the position of the chunk's opening sentence. This ensures the appropriateness of the label's placement.

[0058] In this step, all V2 nodes (and their parent nodes V1) that meet the conditions in the S22 matching results are used as the concept labels for the text block.

[0059] This step designs an intermediate processing module specifically for integrating the "hierarchical outline" and "matching results". It defines a specific method for converting two types of heterogeneous information into unified label objects, thereby preparing the data for building a multi-dimensional queryable navigation semantic tree.

[0060] S233 divides the text block into individual statements, reads all the evaluation rules under the second-level concept node of the text block corresponding to the statement, and labels the statement with a third-level concept node or a no-match message according to the evaluation rules.

[0061] This step constructs a strict evaluation scenario, judging the object - a single statement; the scope of the judgment is limited to all the third-level evaluation rules under the second-level concept node (v2) obtained in S232 for the text block to which the statement belongs; the judgment rule is that each evaluation rule (v3.evaluate_rule) itself is an operable judgment standard (e.g., "whether the service type is clearly defined (such as map navigation, online shopping, etc.)").

[0062] In this step, a prompt is constructed: "[Task Requirements] Please determine whether the statement meets the corresponding requirements according to the following evaluation criteria. If it does, strictly follow the given example format to label the corresponding third-level concept node. If it does not meet the requirements, label it 'No Match'. [Example]: xxx." The task in this step changes from the open-ended "understand this passage" to the closed "determine whether this sentence meets specific rules A, B, and C." If the statement simultaneously meets multiple evaluation criteria, the large model is allowed to output multiple matching labels.

[0063] This step is the final link in solving the "long text forgetting" problem: by decomposing the evaluation task to the sentence level and injecting only a small number of relevant rules, the contextual memory of the large model is enhanced. The model only needs to focus on the micro-matching of short sentences with specific rules. This achieves the final implementation of the "evaluation knowledge graph": the pre-installed, structured `evaluate_rule` in the evaluation knowledge graph is transformed into an "instruction set" driving the large model's judgments in this step. The evaluation knowledge graph transforms from a "static knowledge base" into the driving source of a "dynamic case generator." It generates raw data for an "auditable chain of evidence": the v3 tag (or "no match") of each sentence is a direct source of "judgment basis" when generating future evaluation records. This ensures that the evaluation conclusion is not generated out of thin air, but is based on the explicit association between sentences and rules.

[0064] S234 uses the title of the privacy policy as the root node, statements as branch nodes, and the corresponding title tags, concept tags, and third-level concept node tags as leaf nodes, constructing a navigation semantic tree according to the hierarchical relationship of the outline and the order of statements.

[0065] Please see Figure 4 and Figure 5In this step, the title (XX Instant Messaging App Privacy Policy Navigation Semantic Tree) serves as the root node R, answering the question "Which document is this being evaluated?". This enables the data structure to have document-level encapsulation capabilities, supporting the separate construction and management of multiple policy documents. Statements, as branch nodes C, ensure that any conclusion can be traced back precisely to the original text's specific wording, meeting the rigid requirement of "original text basis" in review. This reduces the risk that the large model might "fabricate" or "summarize" the original text. Leaf nodes L are a composite data structure. The title label records the statement's "physical coordinates" in the document (e.g., ### Chapter 3, Article 2.1), addressing the question "In which chapter of the document does this sentence appear?". Concept labels (v1, v2) record the statement's "regulatory category coordinates" (e.g., [Level 1: User Rights, Level 2: Informed Consent]), addressing the question "Which regulatory section does this sentence relate to?". The third-level concept node label (v3) records the statement's "specific compliance attribute" ("B1.3"), addressing the question "Which specific rule does this sentence comply with or violate?".

[0066] Optionally, it also includes S235, which uses regular expressions to extract and save the semantic tree.

[0067] S3 is based on an evaluation knowledge graph and a navigation semantic tree, utilizing a large model to generate structured evaluation records. Specifically, it includes: S31 traverses the third-level concept nodes in the evaluation knowledge graph, and for each third-level concept node, searches for its associated statements and evaluation rules in the navigation semantic tree.

[0068] Traverse all level 3 concept nodes v_3ϵV_3, extract their evaluation rules rule=Attr(V_3)["evaluation_rule"]. In the semantic tree T, match the statement S containing the level 3 concept tag L_level3=v_3.id. Use the matching symbols "####、&&&、@、@@、@@@" in the semantic tree T to associate the statement with the evaluation rules. The matching rule is: if the tag set of S contains the unique identifier of the level 3 concept node v_3, i.e. v_3.id, then establish the association relationship to form the level 3 concept node-evaluation rule-statement association relationship, which is formally expressed as R(S,v_3).

[0069] S32 invokes the large model to generate formatted evaluation records based on the prompt words and the evaluation rules corresponding to the three-level concept nodes.

[0070] The purpose of this step is to act as an evaluation expert, strictly adhering to the matched evaluation criteria, to determine whether the given statements conform to the rules, and to provide professional justification. The large model generates evaluation justification by tracing the original text of the privacy policy based on the relationship R(S,v_3), specifically the location of the original sentence (i.e., the title tag such as ###Introduction) + the original sentence. The prompt is: Please act as a privacy policy evaluation expert and generate a detailed evaluation record (Rec) for V_3.evaluate_rule; Rec_item={"rule_id":v_3.id,"rule_content":v_3.evaluate_rule,"match_sentence":S.content,"sentence_position":S.title_label,"compliance_result":"If S conforms to v3.evaluate_rule, it is considered compliant; otherwise, it is considered partially compliant or not compliant,"judgment_basis":"The judgment basis for the large model output"}. Please strictly output according to the JSON format of Rec_item and do not output content other than JSON.

[0071] The evaluation record is as follows: Assessment Record ID: REC2025001 rule_id: A1.1 rule_content: Whether the service type (e.g., instant messaging, online office, etc.) and core functions are clearly defined. match_sentence: XX Instant Messaging App (hereinafter referred to as "this App") is an instant messaging and online office application developed by XX Technology Co., Ltd., providing users with core services such as text chat, voice and video calls, file transfer, and online collaborative editing. ### Introduction @A@@A1@@@A1.1 sentence_position:###Introduction compliance_result: Compliant judgment_basis: Upon review, the "match_sentence" in the Privacy Policy's ### introduction clearly states that the service type is instant messaging and online office, and the core function description is complete, meeting the requirements of the assessment criteria.

[0072] S33 uses regular expressions to extract and save the evaluation records.

[0073] Optionally, the large-model-based privacy policy compliance assessment methodology also includes S4 generating a new compliant privacy policy based on assessment records.

[0074] Step S4 specifically includes the following steps: S41 Obtain evaluation records; evaluation records include positive evaluation records and negative evaluation records.

[0075] Positive evaluation records are those that, after evaluation, meet the requirements of the evaluation criteria. Negative evaluation records are those that, after evaluation, do not meet the requirements of the evaluation criteria.

[0076] S42 invokes the large model and, based on the rectification prompts, rectifys the negative assessment records, thereby generating rectification suggestions. Specifically, these include: S421 Construct rectification prompts.

[0077] The rectification prompt is as follows: [Task Requirements] Please act as a privacy policy evaluation expert. Diagnose the problem attributes of negative evaluation records, such as "missing clauses," "vague wording," or "violation of regulations," and propose specific and actionable rectification suggestions for the problem attributes according to the example format. This includes the clauses that need to be supplemented, the wording modification plan, and the compliance basis. Please strictly output in JSON format and do not output content other than JSON.

[0078] S422 uses regular expressions to extract and save rectification suggestions.

[0079] Examples of rectification suggestions are as follows:

Example

[0080] S43 invokes the large model and generates a new privacy policy based on generated prompts, including the privacy policy, positive evaluation records, and rectification suggestions. Specifically, this includes: S431 constructs prompt words.

[0081] In this step, the privacy policy refers to the existing privacy policy text, and the new privacy policy refers to the new privacy policy text.

[0082] [Task Requirements] Please act as a privacy policy writing expert. Please study the reference template and, based on the original privacy policy text and its hierarchical outline, assessment records, and rectification suggestions, write a compliant, comprehensive, and practical new privacy policy.

[0083] S432 automatically saves the new privacy policy text.

[0084] This application achieves a "detection-rectification" closed loop in the assessment results output stage, improving the consistency and repeatability of the assessment process, and providing relevant organizations with a scalable, verifiable, intelligent, large-model-based privacy policy compliance assessment method.

[0085] Optionally, in some embodiments, step S3, which generates structured evaluation records using a large model based on the evaluation knowledge graph and navigation semantic tree, further includes: Statistical evaluation records are then used to generate visual statistical charts. Specifically, this includes: Based on the classification of primary concept nodes in the assessment knowledge graph, calculate the compliance rate η of the assessment records under each node. i =Number of compliant records / Total number of records × 100%; Calculate the distribution of non-compliant records N across each level 3 concept node, etc.

[0086] Use Python libraries to generate charts, such as a compliance rate pie chart showing the percentage of compliant and non-compliant records for each first-level concept node; and a problem distribution bar chart showing the top 10 knowledge graph third-level concept nodes with the most non-compliant records.

[0087] Output statistical results; charts can be saved in formats such as PNG and JPG; and related data tables can be exported.

[0088] Secondly, this application provides a computer device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described large-model-based privacy policy compliance assessment method.

[0089] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described methods for assessing compliance with a privacy policy based on a large model.

[0090] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described large-model-based privacy policy compliance assessment method.

[0091] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0092] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0093] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A privacy policy compliance assessment method based on a large model, characterized in that, The privacy policy compliance assessment method based on the large model includes: An evaluation knowledge graph is constructed based on the first document; the evaluation knowledge graph contains hierarchical concept nodes constructed based on the first document, and there are association edges between the hierarchical concept nodes, which are used to link the hierarchical concept nodes. The hierarchical concept nodes include first-level concept nodes, second-level concept nodes and third-level concept nodes. Based on the aforementioned evaluation knowledge graph, a navigation semantic tree is constructed for the privacy policy, specifically including: The privacy policy is intelligently segmented to obtain text blocks, and then the text blocks are vectorized to obtain block vectors; Templates are selected from the case template set of the secondary concept nodes and quantized to obtain template vectors. The similarity between the block vector and the template vector is calculated, and matching results that meet the criteria are selected based on the similarity. The navigation semantic tree is constructed based on the hierarchical outline of the privacy policy, the matching results, and the preset prompts; Based on the evaluation knowledge graph and the navigation semantic tree, a structured evaluation record is generated using a large model.

2. The privacy policy compliance assessment method based on a large model according to claim 1, characterized in that, The attribute set of the first-level concept node includes the unique identifier of the first-level concept node, the name of the first-level concept node, and the clauses of the first document; the attribute set of the second-level concept node includes the unique identifier of the second-level concept node, the name of the second-level concept node, the unique identifier of the associated first-level concept node, and the case template set; the attribute set of the third-level concept node includes the unique identifier of the third-level concept node, the name of the third-level concept node, the unique identifier of the associated second-level concept node, and the evaluation rules.

3. The privacy policy compliance assessment method based on a large model according to claim 2, characterized in that, The privacy policy is intelligently segmented into text blocks, and then the text blocks are vectorized to obtain block vectors. The steps include: Convert the privacy policy into plain text content; The plain text content is segmented into paragraphs to obtain paragraph blocks; Calculate the character length of the paragraph block and output the text block; If the character length of the paragraph block is less than or equal to the standard character length, then the paragraph block is output as the text block; If the character length of the paragraph block is greater than the standard character length, then it is divided into sub-paragraph blocks according to specific punctuation marks, and the sub-paragraph blocks are output as the text blocks. The character length of the sub-paragraph blocks is less than or equal to the standard character length. The embedding model is invoked to vectorize each text block to obtain the block vector.

4. The privacy policy compliance assessment method based on a large model according to claim 2, characterized in that, The steps of selecting templates from the case template set of the secondary concept nodes and quantizing them to obtain template vectors, calculating the similarity between the block vector and the template vector, and filtering out matching results that meet the criteria based on the similarity include: Select at least one of the templates from the set of case templates for the secondary concept nodes; The template is vectorized by calling the embedding model to obtain the template vector. Calculate the cosine similarity between the block vector and the template vector; Filter out the text blocks whose cosine similarity is greater than a preset threshold; Output the matching result corresponding to the text block, the matching result including the text block, the secondary concept node, the template and the cosine similarity and the correspondence between them.

5. The privacy policy compliance assessment method based on a large model according to claim 2, characterized in that, The step of constructing the navigation semantic tree based on the hierarchical outline of the privacy policy, the matching results, and preset prompts includes: The large model is invoked to extract the hierarchical outline from the privacy policy based on preset prompts. The hierarchical outline includes multiple hierarchical headings. Based on the matching results and the hierarchical outline, each text block is labeled with a title tag corresponding to the hierarchical outline and a concept tag corresponding to the evaluation knowledge graph; the concept tag includes the first-level concept node and the second-level concept node. The text block is divided into individual sentences. All evaluation rules under the second-level concept node of the text block corresponding to the sentence are read. The sentence is then labeled with a third-level concept node tag or "no matching" according to the evaluation rules. The navigation semantic tree is constructed with the title of the privacy policy as the root node, the statements as branch nodes, and the title tags, concept tags, and third-level concept node tags corresponding to the statements as leaf nodes, according to the hierarchical relationship of the outline and the order of the statements.

6. The privacy policy compliance assessment method based on a large model according to claim 5, characterized in that, The step of generating structured evaluation records based on the evaluation knowledge graph and the navigation semantic tree, using large model collaborative processing, includes: Traverse the third-level concept nodes in the evaluation knowledge graph, and for each third-level concept node, search for the associated statement and evaluation rules in the navigation semantic tree; The large model is invoked to generate formatted evaluation records based on the evaluation rules corresponding to the third-level concept nodes according to the prompt words; The evaluation records are extracted and saved using regular expressions.

7. The privacy policy compliance assessment method based on a large model according to claim 6, characterized in that, The privacy policy compliance assessment method based on the large model also includes: The process of generating a compliant new privacy policy based on the aforementioned assessment records includes the following steps: Obtain the evaluation records; the evaluation records include positive evaluation records and negative evaluation records; The large model is invoked, and the negative evaluation records are rectified based on the rectification prompts, thereby generating rectification suggestions; The large model is invoked, and the privacy policy, the positive evaluation record, and the rectification suggestions are generated based on the generated prompts, thereby generating the new privacy policy.

8. A computer device, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the privacy policy compliance assessment method based on any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the privacy policy compliance assessment method based on any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the privacy policy compliance assessment method based on any one of claims 1-7.

Images