Private data compliance auxiliary evaluation method and system based on large language model

Abstract

The invention discloses a privacy data compliance auxiliary evaluation method and system based on a large language model, and belongs to the technical field of data security and privacy computing. Firstly, program source codes of a to-be-analyzed data set are analyzed and generated, and syntactic units are formed based on syntactic boundaries; secondly, constructing cue words, and carrying out step-by-step layered extraction on each syntactic unit by utilizing a large language model to obtain basic elements of the data flow diagram; constructing basic unit structures of the data flow diagram by the basic elements, and connecting the basic unit structures according to the data flow direction to construct the data flow diagram; and finally, extracting a data processing path from the data flow diagram according to an evaluation target, and performing compliance judgment. According to the method, the bottleneck in the prior art can be effectively overcome, unstructured source code logic is accurately converted into structured expression containing fine-grained change semantics, and quantifiable privacy compliance evaluation is realized on the basis.

Description

Technical Field

[0001] This invention belongs to the field of data security and privacy computing technology, specifically involving a privacy data compliance auxiliary assessment method and system based on a large language model. It is used to automatically analyze the source code of the generated dataset product in data transaction or sharing scenarios and display the data flow path and change logic to assist reviewers in conducting privacy compliance assessments. Background Technology

[0002] With the rapid development of generative artificial intelligence technology, high-quality training datasets have become core strategic assets driving the global digital economy. Dataset producers can gain significant commercial value by providing high-quality datasets to the market; for example, leading technology companies are investing heavily in acquiring large-scale, high-quality datasets from news, social media platforms, and vertical industries. However, unlike ordinary commodities, these high-quality datasets often contain sensitive personally identifiable information, such as patient identifiers in medical records or borrower information in financial data. If these datasets enter the market without adequate compliance processing, they can easily lead to the leakage of individual privacy information, triggering strict regulatory penalties in major jurisdictions worldwide (such as the US HIPAA, the EU GDPR, and China PIPL). Therefore, dataset producers urgently need efficient and reliable privacy compliance review tools to ensure the compliance of their data products before release.

[0003] Current privacy compliance assessments of the data generation process heavily rely on manual review. While manual review offers advantages in accuracy, it is extremely inefficient. Given the highly customized nature of dataset products, assessment efficiency has become a core bottleneck restricting enterprises' product delivery capabilities. Drawing a data flow diagram reflecting the entire data lifecycle's path and processing logic is a crucial step in manual review and forms the basis for understanding where data "flows" and "is processed" to complete compliance assessments (such as determining whether k-anonymity or differential privacy budgets are met). However, this diagram-drawing process heavily relies on the deep involvement of specialized teams and often takes days or even months, representing the main bottleneck to efficiency.

[0004] While automated tools have attempted to replace manual data flow diagram drawing to improve efficiency, their capabilities are fundamentally limited: they typically only identify "how data flows," not "how data is processed." For example, such tools struggle to distinguish whether a piece of code simply "reads" an ID number or performs effective "de-identification" or "differential privacy perturbation." This lack of semantic-level understanding results in reports that are mostly isolated lists of vulnerabilities, unable to correlate the state evolution of data in complex transformation chains, and even less able to support quantitative assessments of whether the final output data meets specific privacy protection thresholds (such as k-anonymity or privacy budget ε).

[0005] Large language models, with their powerful semantic understanding and reasoning capabilities, offer a new solution for automated privacy compliance assessment. However, directly applying general-purpose large language models to the automatic generation of data flow graphs faces significant bottlenecks: (1) Cognitive overload: Data processing code often has lengthy and complex contexts, exceeding the effective attention window of large language models, causing the models to ignore key fine-grained privacy operation details. (2) Hierarchical confusion: Data flow graphs require the simultaneous and accurate extraction of three types of elements: data entities, processing logic, and data flow direction, and there are multiple layers of dependencies between these elements. Large language models are prone to logical mismatches, dependency illusions, or blurred hierarchical boundaries during parsing, resulting in insufficient reliability of the generated results.

[0006] Therefore, the current technology field urgently needs an innovative method that can effectively overcome the above-mentioned bottlenecks, accurately transform unstructured source code logic into structured expressions containing fine-grained change semantics, and based on this, achieve quantifiable privacy compliance assessments. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of low efficiency in existing manual review and insufficient semantic understanding capabilities of existing automated tools, and to provide a privacy data compliance auxiliary assessment method and system based on a large language model. This method constructs a data flow graph containing fine-grained change semantics as the intermediate reasoning basis, assisting reviewers in achieving quantitative calculation and visual assessment of the privacy compliance of datasets.

[0008] The technical solution adopted in this invention is as follows:

[0009] This invention provides a privacy data compliance auxiliary assessment method based on a large language model, comprising:

[0010] S1: Parse the source code of the program that generates the dataset to be analyzed, and form several syntactic units based on the syntactic boundaries in the code;

[0011] S2, construct prompt words, and use a large language model to extract each syntactic unit step by step in a hierarchical manner to obtain the basic elements of the data flow graph, including source data items, target data items, change rules, key parameters, and degree of change;

[0012] S3: Construct the basic unit structure of the data flow graph using basic elements, and connect the basic unit structures according to the data flow direction to obtain the data flow graph;

[0013] S4. Extract the data processing path from the data flow diagram based on the assessment objectives and make a compliance determination.

[0014] Furthermore, S1 specifically involves obtaining the source code of the dataset to be analyzed, parsing the source code using a decomposition strategy based on an abstract syntax tree, identifying syntactic boundaries in the code, aggregating the source code into several syntactic units that maintain semantic integrity, and retaining the line number range of each syntactic unit as an index.

[0015] Furthermore, S2 includes:

[0016] S2.1 Input the syntactic unit into the large language model to construct the first-level prompt words, guiding the large language model to identify the change patterns of the syntactic unit; wherein, the first-level prompt words integrate "role-playing", "task description" and "domain knowledge injection";

[0017] S2.2, Based on the identified change pattern, construct second-level prompt words to guide the large language model to identify the data items changed by the change pattern, including the source data items before the change and the target data items after the change; wherein, the second-level prompt words integrate "role-playing", "task description" and the change pattern identified by the first-level task.

[0018] S2.3 For each pair of source and target data items, construct third-level prompt words to guide the large language model in extracting the three elements of change logic, including change rules, key parameters, and degree of change; among them, the third-level prompt words integrate the extraction results of "role-playing", "task description" and the first two levels of tasks;

[0019] S2.4 performs integrity verification on the output of the large language model. If the missing basic elements are detected, a loop extraction task is triggered until all basic elements are completely extracted.

[0020] Furthermore, pre-designed extraction examples are set in the third-level prompt words to help the large language model understand the boundaries of the extraction task. The extraction examples include the three elements of change logic specific to different change modes.

[0021] Furthermore, S3 specifically involves sorting the basic elements of each syntactic unit according to the row number order; for each syntactic unit, using the source data item and the target data item as nodes, establishing directed edges from the source data item to the corresponding target data item, and assigning the edge attributes to the corresponding three elements of change logic, thereby constructing several basic unit structures of the data flow graph; for each syntactic unit, sequentially traversing its subsequent syntactic units, finding the syntactic unit with the same name as its source data item and the closest distance, establishing directed edges from the target data item of the preceding syntactic unit to the source data item of the following syntactic unit to represent the data flow direction and connect each basic unit structure, ultimately generating the data flow graph.

[0022] Furthermore, S4 specifically involves setting review questions based on the assessment objectives, retrieving the required subgraphs from the data flow graph and extracting the data processing paths, quantifying the probability of risk occurrence and the degree of impact based on the relevant edge attributes on the data processing paths, drawing a risk map, assessing the risk of privacy leakage, and completing the compliance determination.

[0023] In a specific embodiment of the present invention, the dataset to be analyzed is defined as follows: {"Patient Unique Identifier", "Inpatient Unique Identifier", "Gender", "Age Group", "Emergency Admission", "Medical Insurance Type Group", "ICU Admission", "Number of Abnormal Laboratory Tests", "Total Number of Laboratory Tests", "Abnormal Laboratory Test Rate", "Number of Independent Diagnoses", "Comorbidity Score", "Major Surgery", "Total Antibiotic Dosage", "Antibiotic Dosage", "Longest ICU Stay", "ICU Stay Duration Group", "Mean Heart Rate", "Mean Oxygen Saturation", "Mean Systolic Blood Pressure", "Mean Diastolic Blood Pressure", "Mean Body Temperature", "Mean Respiratory Rate", "Mean Infusion Rate", "Infusion Rate Group"}.

[0024] Another aspect of the present invention provides a privacy data compliance auxiliary assessment system based on a large language model, comprising:

[0025] The program decomposition module is used to parse the dataset to be analyzed to generate program source code. Based on the syntactic boundaries in the code, it forms several syntactic units and maintains the line number information of the code.

[0026] The data flow graph element extraction module is used to construct prompt words and extract basic elements of the data flow graph by progressively extracting each syntactic unit using a large language model. These elements include source data items, target data items, change rules, key parameters, and degree of change. A verification mechanism ensures the completeness of the extracted information.

[0027] The data flow graph construction module is used to construct a data flow graph by using source data items and target data items as nodes, change rules, key parameters, and degree of change as edge attributes, and combining the data flow direction between nodes.

[0028] The compliance assessment module is used to extract data processing paths from the data flow graph based on the assessment objectives, and to determine compliance based on the edge attributes on the paths.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] 1. This invention addresses the pain point of existing automation tools that "understand the flow but not the logic." By extracting "change logic" triples containing change rules, parameters, and degrees, the data flow graph generated by this invention not only shows "where the data went," but also accurately records "how the data changed" (such as specific generalization intervals and noise parameters), providing indispensable semantic evidence for privacy compliance reviews.

[0031] 2. The hierarchical expert-guided prompting method proposed in this invention effectively overcomes the cognitive overload problem caused by general-purpose large language models when extracting basic elements of complex data flow graphs. By simulating the cognitive process of human experts, the task of extracting basic elements is decomposed into a coarse-to-refined extraction step, which involves extracting syntactic unit change patterns, data items, and logic layer by layer. Furthermore, specific extraction examples for change patterns are injected into the extraction instructions for the large model, significantly reducing the cognitive overload problem faced by large language models when extracting basic elements and greatly improving the extraction accuracy.

[0032] 3. This invention achieves the quantification and visualization of compliance review. The system can transform obscure code logic into structured graph data, supporting reviewers to quickly retrieve key parameters (such as information required for k-anonymity calculations). Compared with traditional manual code auditing, this greatly improves review efficiency and the objectivity of decision-making.

[0033] 4. This invention exhibits excellent adaptability to heterogeneous systems. By directly analyzing the source code and decomposing it based on an Abstract Syntax Tree (AST), this method is independent of specific system architectures or log formats, and can adapt to heterogeneous data processing systems in different vertical fields such as healthcare and finance, thus possessing broad application prospects. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the overall architecture of the privacy data compliance auxiliary assessment system based on a large language model according to the present invention;

[0035] Figure 2 This is a schematic diagram of the overall process of the privacy data compliance auxiliary assessment method of the present invention;

[0036] Figure 3 A detailed flowchart illustrating the hierarchical expert guidance and prompting method;

[0037] Figure 4 Define a schematic diagram of the basic unit structure of the data flow graph;

[0038] Figure 5 This is a schematic diagram of a privacy risk assessment graph generated based on a data flow graph, as shown in the example. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0040] First, it should be noted that this invention relates to the intersection of software engineering and data security, specifically to a code privacy compliance assessment technology based on large language models and static analysis techniques. The implementation of this invention involves the application of multiple software functional modules. The applicant believes that, after carefully reading the application documents and accurately understanding the implementation principles and objectives of this invention, and combining it with existing well-known technologies (such as abstract syntax tree parsing, large language model API calls, graph database operations, etc.), those skilled in the art can fully utilize their software programming skills to implement this invention. The aforementioned software functional modules include, but are not limited to: a program decomposition module, a hierarchical extraction module, a graph construction module, a compliance assessment module, etc. All modules mentioned in this application fall within this scope, and the applicant will not list them all further.

[0041] Those skilled in the art will understand that, besides implementing a portion of the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, enabling the system and its various devices, modules, and units to function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component.

[0042] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0043] To address the low efficiency of traditional manual auditing, this invention provides a privacy data compliance assistance assessment method based on a large language model. The core of this method lies in using prompting technology to guide the large language model to extract deep semantics related to data privacy from the source code and construct a data flow graph to assist reviewers in conducting privacy data compliance assessments.

[0044] To verify the effectiveness of this invention in actual compliance review, the following example illustrates the compliance assessment process of a "scientific research patient dataset product" constructed based on the mimic-iv public dataset as the original data.

[0045] The context and data processing flow of this "patient dataset product for research use" are as follows:

[0046] This scenario involves multiple raw medical data tables, including a patient personal information table containing attributes such as age and gender, and a diagnosis table containing the patient's diagnostic information, constituting the raw dataset; the raw dataset includes:

[0047] Core Database:

[0048] Patient Information Table = {"Patient Unique Identifier", "Age", "Gender"}

[0049] Admission Information Table = {"Patient Unique Identifier", "Admission Type", "Insurance Type", "Discharge Destination"}

[0050] Transfer Information Table = {"Patient Unique Identifier", "Nursing Unit", "Inpatient Transfer Record Unique Identifier"}

[0051] Hosp database:

[0052] Laboratory Test Event Table = {"Patient Unique Identifier", "Laboratory Test Item Unique Identifier", "Laboratory Result Value", "Abnormal Marker"}

[0053] International Classification of Diseases (ICD) Diagnostic Code Table = {"Patient Unique Identifier", "ICD Diagnostic Code", "ICD Diagnostic Code Version Number"}

[0054] International Classification of Diseases Diagnostic Coding Operation Table = {"International Classification of Diseases Diagnostic Coding Operation Code"}

[0055] Prescription = {"Drug Name", "Actual Dispensed Dosage", "Dosage Unit"}

[0056] Electronic Medical Record Examination Result Table = {"Examination Item Name", "Examination Result"}

[0057] ICU Database:

[0058] ICU Hospital Stay Table = {"ICU Hospital Stay Duration", "ICU Event Unique Identifier"}

[0059] ICU Chart Event Table = {"ICU Event Unique Identifier", "Measurement Value", "Unit"}

[0060] ICU Infusion Event Table = {"Drug / Infusion Item Unique Identifier", "Infusion Rate"}

[0061] Using common data preprocessing and anonymization methods, a data processing pipeline with 11 main operation steps was constructed to finally generate a dataset product. The operation steps specifically involve multi-source data reading, data cleaning, sensitive data anonymization, and multi-table aggregation. The key processing logic includes: (1) generalizing the patient age to generate age groups; (2) retaining the gender field; (3) mapping the disease number to specific disease names and counting the number of unique diagnoses to generate comorbidity scores; (4) finally generating the final dataset through aggregation. The final dataset is the dataset to be analyzed = {"Patient Unique Identifier", "Inpatient Patients"}. "Unique Identifier", "Gender", "Age Group", "Emergency Admission", "Medical Insurance Type Group", "ICU Admission", "Number of Abnormal Laboratory Tests", "Total Number of Laboratory Tests", "Abnormal Laboratory Test Rate", "Number of Independent Diagnoses", "Comorbidity Score", "Major Surgery", "Total Antibiotic Dosage", "Antibiotic Dosage", "Longest ICU Stay", "ICU Stay Duration Group", "Mean Heart Rate", "Mean Oxygen Saturation", "Mean Systolic Blood Pressure", "Mean Diastolic Blood Pressure", "Mean Body Temperature", "Mean Respiratory Rate", "Mean Infusion Rate", "Infusion Rate Group"}

[0062] like Figure 2 As shown, the privacy data compliance auxiliary assessment method includes the following steps:

[0063] Step 1: Source code preprocessing and program decomposition

[0064] Obtain the source code of the program that generates the dataset to be analyzed. The source code records the complete data processing process from extraction of the original dataset to the formation of the dataset to be analyzed. In this process, the original dataset undergoes data cleaning, null value imputation, and other data preprocessing operations, as well as anonymization operations such as generalization and suppression. The dataset to be analyzed is defined as {"Patient Unique Identifier", "Inpatient Unique Identifier", "Gender", "Age Group", "Emergency Admission", "Medical Insurance Type Group", "ICU Admission", "Number of Abnormal Laboratory Tests", "Total Number of Laboratory Tests", "Abnormal Laboratory Test Rate", "Number of Independent Diagnoses", "Comorbidity Score", "Major Surgery", "Total Antibiotic Dosage", "Antibiotic Dosage", "Longest ICU Stay", "ICU Stay Duration Group", "Mean Heart Rate", "Mean Oxygen Saturation", "Mean Systolic Blood Pressure", "Mean Diastolic Blood Pressure", "Mean Body Temperature", "Mean Respiratory Rate", "Mean Infusion Rate Group"}. This step aims to solve the logical breakage problem caused by directly processing long code, transforming the source code into the smallest semantically complete analytical unit. The specific operation is as follows:

[0065] S1.1: Input and Parsing

[0066] The system receives the Python program source code to be analyzed, and uses Python's built-in ast module to parse the source code and generate an abstract syntax tree.

[0067] S1.2: Syntax Boundary Identification and Traversal

[0068] The system traverses the generated abstract syntax tree nodes to identify syntactic boundaries in the code.

[0069] S1.3: Code Aggregation and Unit Generation

[0070] Based on the identified syntactic boundaries, multiple lines of code belonging to the same syntactic structure are aggregated into an independent syntactic unit. Unlike simple line-by-line segmentation, this embodiment identifies complete syntactic structures, such as a complete function assignment statement, a chained call, or a control flow block, to ensure the semantic integrity of subsequent analysis.

[0071] S1.4: Line Number Records and Set Output

[0072] For each syntactic unit, the system records its start and end line numbers in the source code, which serve as indices for connecting subsequent syntactic units. The system determines whether there are any unprocessed nodes in the abstract syntax tree; if so, it continues traversing; otherwise, it outputs a set containing all syntactic units.

[0073] Step 2: Extract basic elements of the data flow graph based on a hierarchical expert-guided prompting method.

[0074] A hierarchical expert-guided prompting method is adopted to construct prompt words at different levels. Using a large language model, the basic elements required to construct a data flow diagram are extracted layer by layer from each syntactic unit. These elements include data items and change logic. Data items include source data items and target data items, while change logic includes change rules, key parameters, and the degree of change. (Reference) Figure 3 For each syntactic unit in the set of syntactic units, perform the following hierarchical extraction operation:

[0075] S2.1: First Level: Change Mode Classification

[0076] First-level prompt words are constructed. To improve classification accuracy, "role-playing", "task description" and "domain knowledge injection" are integrated into the prompt words. The system calls the first-level prompt words and uses the large language model to classify the syntactic units into predefined change pattern types. The change patterns include data reduction, data augmentation, data transformation, data fusion and no change.

[0077] Specifically, in this embodiment, the prompt word construction template is as follows:

[0078] Character description: "You are a data lineage and privacy compliance expert."

[0079] Task Description: "Please precisely analyze the following code snippet, identify its core data operations, categorize it into one of the following strictly defined categories, and output the results in JSON format."

[0080] The change mode is defined as follows:

[0081] ① Data reduction: The operation of reducing the size of a dataset by deleting rows or columns.

[0082] ② Data augmentation: Operations that increase the size of a dataset by adding new rows or columns.

[0083] ③ Data transformation: Operations that apply specific functions to transform element values ​​without changing the row and column size of the dataset.

[0084] ④ Data fusion: The operation of merging two or more datasets into a new dataset (such as join, merge).

[0085] ⑤ No changes: Context code that does not involve data changes.

[0086] Input data: Syntactic units to be analyzed.

[0087] Output constraints: {"line number": ,"change mode":}

[0088] Syntactic units are input into a large language model, and prompt words guide the model to identify the change patterns of each syntactic unit. The large language model outputs the pattern type of each syntactic unit, for example: {"line number": "10-12", "change pattern": "data transformation"}.

[0089] S2.2. Second level: Extract source data items and target data items

[0090] A second-level prompt is constructed. In addition to "role-playing" and "task description," the prompt also incorporates the change patterns identified in the first-level task, represented as "[change patterns identified in the previous step]." Utilizing the change patterns identified in the first-level task as prior knowledge, context shrinking is achieved, limiting the search space of the large language model. The system invokes the second-level prompt to guide the large language model in identifying and extracting the data items changed by the corresponding change patterns for each syntactic unit, including the source data items before the change and the target data items after the change. Each data item is uniquely defined by its name and the changed attribute or record. For syntactic units with a change pattern of "no change," the second and third-level extraction is not performed.

[0091] Specifically, in this embodiment, the second-level prompt word construction template is as follows:

[0092] Character description: "You are a data lineage expert."

[0093] Task Description: "Please extract all data lineage pairs (source data -> result data) for the [change pattern identified in the previous step]. The source data is the input data for the [change pattern identified in the previous step], and the result data is the data after the [change pattern identified in the previous step] has been changed."

[0094] Output constraints: "Please output a valid JSON dictionary. Each output dictionary must include the following tags: "Source data item", "Destination data item". Do not output any extra content, only return the JSON dictionary."

[0095] S2.3. Third Level: Extracting the Three Elements of Change Logic

[0096] A third-level prompt is constructed. In addition to "role-playing" and "task description," the prompt also incorporates the extraction results from the first two levels of tasks to limit the search space of the large language model. The system invokes the third-level prompt to guide the large language model in extracting the three key elements of the change logic for each syntactic unit. These elements include the change rules for each source data item to change to the corresponding target data item, the key parameters on which the change is based, and the degree of change in the data size of the source data item. This information is used to quantify the degree of data privacy and serves as the basis for accurate privacy compliance assessment. Furthermore, pre-designed extraction examples are included in the prompts to assist the large language model in understanding the boundaries of the extraction task. These examples include the three key elements of the change logic specific to different change patterns.

[0097] Specifically, the prompts include [data item], [change mode], [example of change rule specific to change mode], [example of parameter specific to change mode], and [example of change degree specific to change mode]. Among them, [data item] is filled with the name of the data item extracted from the second-level extraction task, [change mode] is filled with the change mode extracted from the first-level task corresponding to the data item, and [example of change rule specific to change mode], [example of parameter specific to change mode], and [example of change degree specific to change mode] are filled with pre-designed extraction examples.

[0098] Specifically, in this embodiment, the prompt word construction template is as follows:

[0099] Character setting: "As a data lineage expert,"

[0100] Task Description: "Analyze the [change patterns] from source data to result data and extract:"

[0101] Change rules: "Describe the core logic of the [change mode] [Examples of change rules specific to the change mode],"

[0102] Key parameters: "Key parameters controlling change rules [examples of change mode-specific parameters],"

[0103] The extent of change to the source data caused by the change: "Quantify the degree of change in the size of the source data item [example of change extent specific to the change pattern]."

[0104] Output constraints: "Please output a valid JSON dictionary. Each output dictionary must include the following tags: "Change Rule", "Key Parameter", and "Degree of Change". Do not output any additional content; only return the JSON dictionary."

[0105] The pre-designed extraction examples are shown in Table 1:

[0106] Table 1. Extraction Examples for Different Change Modes

[0107]

[0108] S2.4. Extraction Integrity Verification

[0109] To ensure the reliability of the prompt output, the system implements the following verification logic:

[0110] Check if the output of the large language model contains all five basic elements, including the two data items extracted at the second level and the three elements of the change logic extracted at the third level. If any are missing, trigger a loop that requires the large language model to re-execute the extraction task until all expected elements are fully extracted. Encapsulate the five basic elements of the extracted and validated syntactic units into graph element objects and add them to the list of elements to be processed.

[0111] Step 3: Connection and graphing of syntactic unit elements based on name matching

[0112] This step connects the graph elements discrete in different syntactic units into a complete data flow graph. (Reference) Figure 4 The specific steps are as follows:

[0113] S3.1: Sorting and Initialization

[0114] After extracting the element list of different syntactic units from S2, sort them in ascending order according to the row number of the syntactic units to ensure the correct order of the data flow; initialize an empty directed graph.

[0115] S3.2: Constructing the basic unit structure

[0116] Extract the elements of the syntactic units sequentially, add the source data items and target data items of each syntactic unit as nodes to the graph, establish directed edges from the source data items to the target data items of the same syntactic unit, and assign edge attributes. The edge attributes include the three elements of the corresponding change logic, namely change rules, change key parameters, and change degree, and construct a series of basic unit structures of the data flow graph corresponding to each syntactic unit.

[0117] S3.3: Connection determination between syntactic units

[0118] After the basic unit structure is constructed, for each syntactic unit, its subsequent connectable syntactic units are searched in turn to reconstruct the data flow path in the code. Specifically, for each syntactic unit, its target data item name is extracted, and subsequent syntactic units are traversed from top to bottom in line number order. The search stops when a syntactic unit with the same target data item name is found. A directed edge is established from the target data item of the previous syntactic unit to the source data item of the subsequent syntactic unit to represent the data flow direction.

[0119] S3.5: Graph Output

[0120] Repeat the above steps until all syntactic units have been processed, output the final data flow graph, and store the graph in the graph database. In this embodiment, the data flow graph is stored in the Neo4j graph database.

[0121] Step 4: Interactive Privacy Breach Risk Assessment

[0122] Using a human-computer interaction approach, a custom query language is used to retrieve data from a graph database, resulting in a subgraph of the output data flow graph in S3. Data processing paths are extracted, and based on the relevant edge attributes along these paths—the three key elements of change logic—the probability and impact of risks are quantified. Finally, a risk graph is drawn to assess the risk of privacy breaches. The specific steps include:

[0123] S4.1, Define the evaluation objectives and retrieval subgraph

[0124] First, clearly define the assessment objective (e.g., "Does a certain sensitive field pose a risk of re-identification?"). Based on this objective, transform the natural language requirements into graph database query statements (e.g., Cypher language). The system executes the query, returns a subgraph containing all relevant nodes and edges, and extracts the change logic attributes (change rules, key parameters, change degree) attached to each edge, thus obtaining the complete processing path from the original data source to the final dataset.

[0125] Specifically, in this embodiment, based on relevant data protection design requirements, the assessment objective is determined, and a typical review question is proposed: "During the data aggregation stage, will aggregating the three fields of age group, gender, and comorbidity score create a risk of re-identification?" The challenge of this assessment question lies in the need to comprehensively evaluate the combined risk of the anonymization effect of the three fields in the preceding steps and the final aggregation operation.

[0126] Based on the target fields, write the following Cypher query to trace the complete evolution path of these three fields from the source to the aggregation point:

[0127] "MATCH path = (source:Table)-[*]->(target:Dataset {name: "aggregated_record"})

[0128] WHERE source.field IN ['anchor_age', 'gender', 'icd_code']

[0129] RETURN path, relationships(path).semantics AS operations"

[0130] The system returns the required subgraph, from which the following three complete data processing paths are extracted, clearly displaying the semantic attributes of each step. The following key information can be directly obtained through the data processing paths without requiring manual reading of the source code:

[0131] Path 1: Age -> Generalization operation (specific parameters: ['<20', '20-30', ..., '>80']) -> Age grouping -> Aggregation.

[0132] The system provides evidence that clarifies the specific interval parameters for generalization.

[0133] Path 2: Gender -> No processing -> Aggregation.

[0134] The system provides evidence that this field has not undergone any obfuscation.

[0135] Path 3: Disease ID -> Map to specific disease name -> Calculate the number of diseases for each patient -> Generalize the number to three intervals (0,1], (1,3], (>3) -> Calculate comorbidity score -> Aggregate.

[0136] The evidence provided by the system reveals the complex transformation logic (mapping -> counting -> generalization) from the original disease number to the final score.

[0137] S4.2, Quantitative analysis of the probability of risk occurrence and its impact.

[0138] Based on the information provided by the subgraph, a two-dimensional evaluation is conducted in conjunction with external background knowledge:

[0139] Risk Occurrence Probability: Select a suitable privacy model (such as K-anonymity, differential privacy, etc.) based on the requirements. Utilize the "change rules" (such as generalization, suppression) and "key parameters" (such as generalization interval, mask bit width) obtained in the previous step to deduce the changes in the data at each step, obtaining the statistical characteristics and security threshold of the final dataset. Compare the statistical characteristics and security threshold of the final dataset with preset values, and classify them into the corresponding risk occurrence probability levels according to the grading rules.

[0140] Impact level: Taking into account the real-world context (such as whether the data recipient has local resident information, the sensitivity of the data subject, and the degree of financial / psychological damage), assess the impact of data leakage on individuals and classify it into the corresponding impact level according to the classification rules.

[0141] Specifically, in this embodiment, the K-anonymity model is first used to analyze the probability of risk occurrence:

[0142] Based on the paths and parameters provided by the system in S4.2, the structure of the final dataset is determined to be {age group, gender, comorbidity score}. The subset of records corresponding to the unique attribute combinations in the final dataset is validated using the original data distribution. It is found that for the combination (over 80 years old, female, comorbidity score > 3), only 3 records are corresponding to it in the final dataset. According to the pre-set safety threshold k=5, since the current number of records (3 < 5) indicates a very high risk of individual re-identification, the probability of this risk is determined to be significant. The probability of risk is divided into four levels based on the comparison between the number of records and the threshold k: negligible, low, significant, and high. If the number of records for a unique attribute combination is greater than the safety threshold, it is considered negligible; if the number of records for a unique attribute combination is less than the safety threshold but greater than the buffer value (4 in this example), it is considered low risk; if the number of records for a unique attribute combination is less than the buffer value but greater than 1, it is considered significant risk; and if the number of records for a unique attribute combination is equal to 1, it is considered high risk.

[0143] Secondly, an assessment of the actual social impact should be conducted in conjunction with the external context:

[0144] Based on the external background information of this embodiment, it is known that the recipient of this data product is a local enterprise with a large amount of basic demographic information on local residents. It is inferred that in the local community, "women over 80 years old with multiple complex diseases (comorbidities > 3)" constitute an extremely sparse group, making it highly easy to locate specific individuals through cross-referencing. Therefore, it is determined that once the data is leaked, it will lead to the exposure of patients' sensitive medical privacy, potentially causing serious consequences such as discrimination, social stigma, or threats to personal safety. The impact is ultimately determined to be significant. The impact level is divided into four levels based on the sensitivity of the leaked data, the potential harm to individuals after re-identification, the size of the affected group, and the severity of the social consequences: negligible, limited, significant, and catastrophic.

[0145] S4.3 Risk Mapping and Classification

[0146] A two-dimensional risk map is constructed based on the risk occurrence probability and impact level rating. The horizontal axis represents the risk occurrence probability and the vertical axis represents the impact level. The assessed objects are mapped to points on the map to intuitively show the urgency of compliance risks, thereby generating specific compliance reports and providing a basis for decision-making in subsequent risk handling (such as adjusting generalization parameters and adding noise).

[0147] Specifically, in this embodiment, the above evaluation results (probability: significant, impact: significant) are mapped onto a privacy risk map. The point falls into the "red high-risk zone" of the map, such as... Figure 5 As shown.

[0148] Final decision: The data release proposal is rejected, and code modifications are recommended, such as expanding the age binning range (e.g., changing 80+ to 70+) or generalizing the comorbidity score to a coarser granularity until k > 5 is satisfied.

[0149] This embodiment demonstrates that, through the compliance-oriented data flow diagram constructed by the present invention, reviewers can quickly obtain the "multi-step joint processing logic" and "key parameters" that are difficult to extract using traditional methods, thereby accurately completing complex compliance checks.

[0150] This embodiment also provides a privacy data compliance auxiliary assessment system based on a large language model, including:

[0151] The program decomposition module is used to parse the source code of the dataset product to be analyzed. It uses an abstract syntax tree to decompose the code into syntactic units with independent semantics and maintains the line number information.

[0152] The data flow graph element extraction module is used to execute a hierarchical expert-guided prompting process for each syntactic unit through a large language model. This includes classifying the syntactic units by change patterns; extracting the source and target data items for each syntactic unit; extracting the three elements of the change logic for each syntactic unit; and ensuring the completeness of the extracted information through a verification mechanism.

[0153] The data flow graph construction module is used to connect source and target data items as nodes, and assign edge attributes to the corresponding three elements of change logic to the edge attributes. Based on the line number order and the data dependencies between syntax units, the module connects the syntax units to form a data flow graph, which is then stored in the graph database.

[0154] The compliance assessment module provides a human-computer interaction interface, responds to query requests, traces back the specified data flow path from the graph database, calculates the probability and impact of risk occurrence, draws a risk map, and generates a compliance report.

[0155] The above description represents a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the technical scope disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A privacy data compliance auxiliary assessment method based on a large language model, characterized in that... ,include: S1: Parse the source code of the program that generates the dataset to be analyzed, and form several syntactic units based on the syntactic boundaries in the code; S2, construct prompt words, and use a large language model to extract each syntactic unit step by step in a hierarchical manner to obtain the basic elements of the data flow graph, including source data items, target data items, change rules, key parameters, and degree of change; S3: Construct the basic unit structure of the data flow graph using basic elements, and connect the basic unit structures according to the data flow direction to obtain the data flow graph; S4. Extract the data processing path from the data flow diagram based on the assessment objectives and make a compliance determination.

2. The privacy data compliance auxiliary assessment method based on a large language model according to claim 1, characterized in that... S1 specifically involves: obtaining the source code of the program that generates the dataset to be analyzed, parsing the source code using a decomposition strategy based on abstract syntax trees; identifying the syntactic boundaries in the code, aggregating the source code into several syntactic units that maintain semantic integrity, and retaining the line number range of each syntactic unit as an index.

3. The privacy data compliance auxiliary assessment method based on a large language model according to claim 1, characterized in that... S2 includes: S2.1 Input the syntactic unit into the large language model to construct the first-level prompt words, guiding the large language model to identify the change pattern of the syntactic unit; S2.2, Based on the identified change pattern, construct a second-level prompt word to guide the large language model to identify the data items changed by the change pattern, including the source data items and the target data items; S2.3 For each pair of source data items and target data items, construct third-level prompt words to guide the large language model to extract the three elements of change logic, including change rules, key parameters, and degree of change; S2.4 performs integrity verification on the output of the large language model. If the missing basic elements are detected, a loop extraction task is triggered until all basic elements are completely extracted.

4. The privacy data compliance auxiliary assessment method based on a large language model according to claim 3, characterized in that... The first-level prompts integrate "role-playing", "task description" and "domain knowledge injection"; the second-level prompts integrate "role-playing", "task description" and the change patterns identified by the first-level task; the third-level prompts integrate "role-playing", "task description" and the extraction results of the first two levels of tasks.

5. A privacy data compliance auxiliary assessment method based on a large language model as described in claim 3 or 4, characterized in that... In the third-level prompts, pre-designed extraction examples are also set to help the large language model understand the boundaries of the extraction task. The extraction examples include the three elements of change logic specific to different change modes.

6. The privacy data compliance auxiliary assessment method based on a large language model according to claim 1, characterized in that... S3 specifically involves sorting the basic elements of each syntactic unit according to the row number order; for each syntactic unit, using the source data item and the target data item as nodes, establishing directed edges from the source data item to the corresponding target data item, and assigning the edge attributes to the corresponding three elements of change logic, thereby constructing several basic unit structures of the data flow graph; for each syntactic unit, sequentially traversing its subsequent syntactic units, finding the syntactic unit with the same name as its source data item and the closest distance, establishing directed edges from the target data item of the preceding syntactic unit to the source data item of the following syntactic unit to represent the data flow direction and connect each basic unit structure, ultimately generating the data flow graph.

7. The privacy data compliance auxiliary assessment method based on a large language model according to claim 1, characterized in that... Specifically, S4 involves setting review questions based on the assessment objectives, retrieving the required subgraphs from the data flow graph and extracting the data processing paths, quantifying the probability of risk occurrence and the degree of impact based on the relevant edge attributes on the data processing paths, drawing a risk map, assessing the risk of privacy leakage, and completing the compliance determination.

8. The privacy data compliance auxiliary assessment method based on a large language model according to claim 1, characterized in that... The dataset to be analyzed is defined as follows: {"Patient Unique Identifier", "Inpatient Unique Identifier", "Gender", "Age Group", "Emergency Admission", "Medical Insurance Type Group", "ICU Admission", "Number of Abnormal Laboratory Tests", "Total Number of Laboratory Tests", "Abnormal Laboratory Test Rate", "Number of Independent Diagnoses", "Comorbidity Score", "Major Surgery", "Total Antibiotic Dosage", "Antibiotic Dosage", "Longest ICU Stay", "ICU Stay Duration Group", "Mean Heart Rate", "Mean Oxygen Saturation", "Mean Systolic Blood Pressure", "Mean Diastolic Blood Pressure", "Mean Body Temperature", "Mean Respiratory Rate", "Mean Infusion Rate", "Infusion Rate Group"}.

9. A privacy data compliance auxiliary assessment system based on a large language model, characterized in that... ,include: The program decomposition module is used to parse the dataset to be analyzed to generate program source code. Based on the syntactic boundaries in the code, it forms several syntactic units and maintains the line number information of the code. The data flow graph element extraction module is used to construct prompt words and extract basic elements of the data flow graph by progressively extracting each syntactic unit using a large language model. These elements include source data items, target data items, change rules, key parameters, and degree of change. A verification mechanism ensures the completeness of the extracted information. The data flow graph construction module is used to construct a data flow graph by using source data items and target data items as nodes, change rules, key parameters, and degree of change as edge attributes, and combining the data flow direction between nodes. The compliance assessment module is used to extract data processing paths from the data flow graph based on the assessment objectives, and to determine compliance based on the edge attributes on the paths.

Images