Large model guided biological data privacy protection method and system

Abstract

The present application relates to the technical field of data privacy protection, and particularly relates to a large model guided biological data privacy protection method and system, which converts time series signals in biological data into medical semantic description texts by using a large model, so that each client generates robust biological data samples by using a data generator locally, and performs local model training based on the robust biological data samples and local biological data samples; each client uploads model gradients of the local model training to a server, the server performs double verification on the model gradients of each client and aggregates the model gradients by using an adaptive aggregation strategy, updates a global model, distributes the updated global model back to each client for the next round of federated training, and stops until convergence. The present application realizes privacy-utility collaborative optimization through semantic data reconstruction, and provides an auditable and landable new paradigm for federated learning in a medical Internet of Things scenario, which takes into account high privacy compliance and clinical usability.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a large model-guided method and system for protecting the privacy of biological data. Background Technology

[0002] Under the medical data compliance framework of the Personal Information Protection Law and the EU GDPR, the privacy protection of biometric data has become a core bottleneck in intelligent diagnosis and treatment. Physiological signals such as electrocardiograms (ECG), photoplethysmography (PPG), and electroencephalograms (EEG) contain rich health information, but their distributed storage characteristics expose traditional centralized learning to extremely high privacy risks. Federated learning, through a collaborative mechanism of "data remains stationary while the model moves," avoids the direct transmission of raw biometric data. However, recent research shows that attackers can infer fine-grained signal morphology by analyzing model gradients—the reconstruction success rate on ECG data is as high as 42%, and members can infer that the attack can identify the patient. This threat is particularly severe in medical IoT scenarios, where existing cryptographic methods are difficult to deploy due to resource limitations of wearable devices.

[0003] Federated adversarial training has proven to be one of the most effective strategies for defending against anti-sample attacks. However, two inherent characteristics of biometric data cause traditional federated adversarial training to fall into performance dilemmas: first, the heterogeneity of physiological structure. ECG QRS complex waveform sensitivity reaches 0.9, while baseline drift is only 0.3, and fixing the noise level will lead to excessive perturbation of key waveforms; second, semantic-level data drift. Differences in device sampling rates and patient groups among different medical institutions cause client data to exhibit nonlinear drift in the decision space, and traditional FedAvg aggregation will smooth out waveform details with diagnostic value. Existing studies such as FedProx alleviate the Non-IID problem through regularization, but fail to protect temporal structure; DP-FedGAN uses generative adversarial networks to synthesize alternative data, but lacks provable privacy boundaries and cannot guarantee the physiological validity of generated samples. Large Language Models (LLM) have shown powerful capabilities in medical semantic understanding, but their application in privacy-preserving federated learning is still limited. Existing LLM-assisted methods focus on natural language processing and have not fully explored their potential in the semantic quantification of biometrics. Summary of the Invention

[0004] To address the gradient leakage problem in biometric data processing during federated learning, this invention provides a large-model-guided method and system for protecting biometric data privacy. By reconstructing semantic data, it achieves privacy-utility synergistic optimization, providing an auditable and implementable new paradigm for federated learning in the medical IoT scenario that balances high privacy compliance with clinical usability.

[0005] According to the design scheme provided by this invention, on the one hand, a method for protecting biological data privacy guided by a large model is provided, comprising:

[0006] A large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Local model training is then performed based on these robust biological data samples and the local biological data samples. The data generator utilizes a multi-objective collaborative optimization strategy to generate adversarial examples in the biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in the model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples.

[0007] Each client uploads the model gradients trained on its local model to the server. The server performs double verification on the model gradients of each client and aggregates the model gradients using an adaptive aggregation strategy, updates the global model, and distributes the updated global model back to each client for the next round of federated training until convergence. The double verification includes numerical integrity verification and biological structure integrity verification. The adaptive aggregation strategy aggregates the client model gradients that have passed the double verification based on the proportion of client data volume.

[0008] As a biological data privacy protection method guided by the large model of this invention, further, the large model is used to convert time-series signals in biological data into medical semantic description text, including:

[0009] Acquire clinical-grade biological data and perform heterogeneous partitioning of the clinical-grade biological data to obtain a local training dataset for federated learning. The heterogeneous partitioning is a data simulation partitioning that simulates the non-independent and identically distributed characteristics of data volume and data category distribution among medical institutions.

[0010] Extract clinical diagnosis-related statistical features from the local training dataset and construct a structured prompt template based on these features;

[0011] Biological data samples from the local training dataset are embedded into structured prompt templates, and the corresponding medical semantic description text is obtained using a large model.

[0012] The medical semantic description text and biological data samples are hashed and encoded to generate a text summary. The text summary is then mapped to a specified vector dimension through a fixed projection matrix to obtain the medical semantic space embedding vector.

[0013] As a large-scale model-guided biological data privacy protection method of this invention, further, acquiring clinical-grade biological data includes:

[0014] Relevant medical signals are acquired through medical acquisition equipment, including ECG signals, PPG signals, and EEG signals.

[0015] Based on the physiological dynamics equation, the distribution of multi-source heterogeneous data in the medical Internet of Things is simulated to obtain synthetic medical signals, which include: ECG synthetic signals, PPG synthetic signals and EEG synthetic signals;

[0016] Relevant medical signals and synthetic medical signals are purified and preprocessed to obtain standardized clinical-grade biological data.

[0017] As a biological data privacy protection method guided by the large model of the present invention, the data generator further adopts a three-stage structure of encoder, attention layer and decoder. The encoder encodes the input biological data by three layers of one-dimensional convolution. The attention layer uses the SE-Net channel attention mechanism to generate a weight vector for adaptive weighting of the encoded features. The decoder uses a one-dimensional convolution transpose structure symmetrical to the encoder to reconstruct and output biological sample data.

[0018] As a large-scale model-guided method for protecting biological data privacy in this invention, further, a multi-objective collaborative optimization strategy is used to generate adversarial examples for biological data, comprising:

[0019] Construct gradient utility loss function, structure preservation loss function, semantic privacy loss function, and visual privacy loss function;

[0020] Set the collaborative scheduling loss weights for each loss function to obtain the adversarial training loss function of the data generator based on the loss weights. The collaborative scheduling loss weights are dynamically adjusted through Bayesian optimization search.

[0021] The data generator is trained adversarially using an adversarial training loss function and biological data samples and medical semantic description text.

[0022] Biological data adversarial examples are generated using a data generator trained on adversarial data.

[0023] As a large-model-guided method for protecting biological data privacy in this invention, the adversarial training loss function of the data generator is further expressed as:

[0024]

[0025] in, , , , These are the gradient utility loss function, the structure preservation loss function, the semantic privacy loss function, and the visual privacy loss function, respectively. These are the loss weights for the corresponding loss functions, and , , , , The generated adversarial examples are shown, where x is the original biological data sample. For parameters of the federated learning model, For medical physiological structure and morphology operators, This is an index set of key physiological structures. The weights of the corresponding physiological structures in the sensitivity mapping table. These are the medical semantic space embedding vectors of the original biological data sample and the adversarial sample, respectively. Let KL divergence be the KL divergence. To balance the coefficients of cosine distance and distribution divergence, This represents the model's predicted probability distribution for the samples.

[0026] As a biological data privacy protection method guided by the large model of this invention, further, in the local model training based on robust biological data samples and local biological data samples, the client adopts a hybrid loss function composed of cross-entropy loss, data generator loss and DP gradient loss for local model training, and configures an early stopping mechanism to prevent overfitting. The DP gradient loss differentiates the weights of corresponding physiological structures by pruning the norm of feature gradients and using explicit encoding of clinical knowledge.

[0027] As a biological data privacy protection method guided by the large model of the present invention, the DP gradient loss further adds feature-level adaptive noise to the gradient space in the differential protection of physiological structure weights by using a two-dimensional dynamic noise adjustment strategy of rounds and features. In the round dimension, an exponential decay budget is used to allocate the privacy budget in the training rounds, and in the feature dimension, the noise scale of each feature is dynamically adjusted according to the semantic privacy loss change in each round.

[0028] As a method for protecting biological data privacy guided by the large model of this invention, the server further performs dual verification on the gradients of each client model, including:

[0029] In the numerical integrity check, it is checked whether there are undefined or unrepresentable values ​​in the gradient of the client model, and it is verified whether the gradient norm is within the historical distribution range. If it exceeds the historical distribution range, the gradient of the client model is determined to be abnormal, and the gradient aggregation of the client is rejected.

[0030] In the biological structural integrity verification, the model layer corresponding to the gradient of the client model is parsed, and the critical structure update rate is calculated using a sensitivity mapping table. If the critical structure update rate exceeds the threshold, it is determined that the client has a structurally destructive update, and the gradient aggregation of the client is rejected.

[0031] Furthermore, this invention also provides a large-model-guided biological data privacy protection system, comprising: several clients and servers, wherein,

[0032] In the client, a large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Based on these robust biological data samples and the local biological data samples, a local model is trained. The gradient of the trained model is then uploaded to the server. The data generator uses a multi-objective collaborative optimization strategy to generate adversarial examples in biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in terms of model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples.

[0033] In the server, the model gradients uploaded by each client are double-validated and aggregated using an adaptive aggregation strategy. The global model is then updated and distributed back to each client for the next round of federated training until convergence. The double validation includes numerical integrity validation and biological structure integrity validation. The adaptive aggregation strategy aggregates the client model gradients that have passed the double validation based on the proportion of client data volume.

[0034] The beneficial effects of this invention are:

[0035] 1. The data generator of this invention extracts deep semantic features of signals through DeepSeek-API, constructs a differentiable semantic privacy loss, drives the generated samples to be far away from the original data in the embedding space (maximizing privacy), and forces the gradient direction of the generated samples to be consistent with the original samples through gradient alignment loss (preserving utility). Furthermore, it introduces structure preservation loss to constrain key morphologies such as QRS complex waves and contraction peaks to remain unchanged (maintaining clinical interpretability). This breaks through the limitation of traditional adversarial training that only optimizes the input space, and realizes a paradigm shift from "numerical perturbation" to "semantic-level privacy-utility joint optimization".

[0036] 2. This invention utilizes a four-objective collaborative optimization framework of gradient, structure, semantics, and vision. The data generator adopts a channel attention-enhanced CNN architecture, compressing the number of parameters to less than 10K. It dynamically calculates the decision boundary distance through medical semantic embedding extracted from a large language model. While driving the generation of samples in the embedding space to maximize the privacy distance, it forces the model to maintain the consistency of gradient direction to maintain training effectiveness. Furthermore, it utilizes structure-preserving loss to constrain key diagnostic morphologies such as QRS complex waves and contraction peaks, achieving a real-time generation rate of 42ms per sample. This breaks through the theoretical bottleneck of the traditional GAN ​​method where computational redundancy and physiological effectiveness cannot be simultaneously achieved, providing a robust alternative to biometric data that is "usable but invisible".

[0037] 3. This invention utilizes a clinical knowledge-driven biometric sensitivity mapping system to quantify the diagnostic value of key physiological structures such as the QRS complex wave in ECG and the contraction peak in PPG into differential sensitivity weights. Based on a round-feature dual-dimensional adaptive noise scheduling strategy, the privacy budget decays exponentially with each training round, while the noise scale of each feature dimension is dynamically adjusted according to semantic evaluation, achieving adaptive differential privacy protection for biometric perception. This mechanism is rigorously proven to satisfy... It achieves differential privacy and a federated convergence rate of O(A / (ρε)), which is 30% higher than static differential privacy, fundamentally overcoming the shortcomings of traditional methods that suffer from both "overprotection" and "underprotection" of key physiological structures.

[0038] 4. This invention constructs a cross-modal mapping from time-series signals to the medical semantic space, uses a large language model to perform zero-sample clinical diagnostic descriptions of biological signals, and can reduce the cross-modal mapping latency to 5ms and increase the hit rate to 67% by introducing LRU (Least Recently Used) caching optimization. It provides interpretable and auditable quantitative indicators for biometric privacy and directly supports the compliance requirements of Article 35 of the GDPR for data protection impact assessment.

[0039] 5. This invention provides a biometric federated platform covering the entire chain of preprocessing, generation, training, aggregation, and evaluation. It integrates dual security mechanisms of adaptive moment estimation aggregation and physiological structure integrity verification, supports collaborative training of multiple heterogeneous modalities such as ECG / PPG / EEG, and can be equipped with a fine-grained privacy reporting module to record feature-level noise distribution, semantic evaluation logs, and attack resistance test results, thus meeting the traceability and accountability requirements of medical AI systems. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the biological data privacy protection process guided by a large model in the embodiment;

[0041] Figure 2 This is a schematic diagram of a large-scale model-guided biometric data privacy protection architecture in the embodiment. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0043] Recent research on federated learning for biometrics has focused on maintaining clinical effectiveness and defending against privacy attacks. The fundamental limitation of existing methods on biometric data lies in their failure to balance the integrity of physiological structure with privacy protection. Traditional federated learning treats physiological signals as ordinary time-series data, neglecting the diagnostic value of key morphologies such as the QRS complex in ECG and the contraction peak in PPG. While it can synthesize substitute data, it fails to deeply couple with the federated training objective. Current privacy protection technologies in federated learning face three fundamental limitations in biometric scenarios: First, privacy measurements remain at the numerical level, lacking the ability to quantify diagnostic semantics such as the QRS complex in ECG and the contraction peak in PPG; second, adversarial generation methods have not yet been integrated with the clinical knowledge base of large language models, resulting in insufficient effectiveness of synthesized data and a large number of parameters; third, existing frameworks cannot provide interpretable privacy reports that meet GDPR audit requirements. These gaps directly limit the transition of privacy-preserving federated learning from theoretical research to clinical deployment.

[0044] Therefore, in the embodiments of the present invention, such as Figure 1 As shown, a large model-guided method for protecting biological data privacy is provided, comprising:

[0045] A large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Local model training is then performed based on these robust biological data samples and the local biological data samples. The data generator utilizes a multi-objective collaborative optimization strategy to generate adversarial examples in the biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in the model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples.

[0046] Each client uploads the model gradients trained on its local model to the server. The server performs double verification on the model gradients of each client and aggregates the model gradients using an adaptive aggregation strategy, updates the global model, and distributes the updated global model back to each client for the next round of federated training until convergence. The double verification includes numerical integrity verification and biological structure integrity verification. The adaptive aggregation strategy aggregates the client model gradients that have passed the double verification based on the proportion of client data volume.

[0047] Specifically, using large models to convert time-series signals in biological data into medical semantic description text can be designed to include:

[0048] Acquire clinical-grade biological data and perform heterogeneous partitioning of the clinical-grade biological data to obtain a local training dataset for federated learning. The heterogeneous partitioning is a data simulation partitioning that simulates the non-independent and identically distributed characteristics of data volume and data category distribution among medical institutions.

[0049] Extract clinical diagnosis-related statistical features from the local training dataset and construct a structured prompt template based on these features;

[0050] Biological data samples from the local training dataset are embedded into structured prompt templates, and the corresponding medical semantic description text is obtained using a large model.

[0051] The medical semantic description text and biological data samples are hashed and encoded to generate a text summary. The text summary is then mapped to a specified vector dimension through a fixed projection matrix to obtain the medical semantic space embedding vector.

[0052] The acquisition of clinical-grade biological data involves obtaining relevant medical signals through medical acquisition devices, including ECG, PPG, and EEG signals; simulating the distribution of multi-source heterogeneous data in the medical Internet of Things based on physiological dynamics equations to obtain synthetic medical signals, including ECG synthetic signals, PPG synthetic signals, and EEG synthetic signals; and pre-processing the relevant medical signals and synthetic medical signals to obtain standardized clinical-grade biological data.

[0053] The data generator adopts a three-stage structure of encoder, attention layer and decoder. The encoder encodes the features of the input biological data by three layers of one-dimensional convolution. The attention layer uses the SE-Net channel attention mechanism to generate a weight vector for adaptive weighting of the encoded features. The decoder uses a one-dimensional convolution transpose structure symmetrical to the encoder to reconstruct and output the biological sample data.

[0054] Among them, the generation of adversarial examples for biological data using a multi-objective collaborative optimization strategy can be designed to include:

[0055] Construct gradient utility loss function, structure preservation loss function, semantic privacy loss function, and visual privacy loss function;

[0056] Set the collaborative scheduling loss weights for each loss function to obtain the adversarial training loss function of the data generator based on the loss weights. The collaborative scheduling loss weights are dynamically adjusted through Bayesian optimization search.

[0057] The data generator is trained adversarially using an adversarial training loss function and biological data samples and medical semantic description text.

[0058] Biological data adversarial examples are generated using a data generator trained on adversarial data.

[0059] Furthermore, in the local model training based on robust biological data samples and local biological data samples, the client can use a hybrid loss function consisting of cross-entropy loss, data generator loss and DP gradient loss for local model training, and configure an early stopping mechanism to prevent overfitting. The DP gradient loss uses feature-wise gradient pruning norm and clinical knowledge explicit encoding to differentiate the weights of corresponding physiological structures.

[0060] In the differential protection of physiological structure weights, the DP gradient loss adds feature-level adaptive noise to the gradient space by using a two-dimensional dynamic noise adjustment strategy of rounds and features. In the round dimension, an exponential decay budget is used to allocate the privacy budget in the training rounds, and in the feature dimension, the noise scale of each feature is dynamically adjusted according to the semantic privacy loss change in each round.

[0061] Specifically, the server performs dual verification of the gradients of each client model, which can be designed to include:

[0062] In the numerical integrity check, it is checked whether there are undefined or unrepresentable values ​​in the gradient of the client model, and it is verified whether the gradient norm is within the historical distribution range. If it exceeds the historical distribution range, the gradient of the client model is determined to be abnormal, and the gradient aggregation of the client is rejected.

[0063] In the biological structural integrity verification, the model layer corresponding to the gradient of the client model is parsed, and the critical structure update rate is calculated using a sensitivity mapping table. If the critical structure update rate exceeds the threshold, it is determined that the client has a structurally destructive update, and the gradient aggregation of the client is rejected.

[0064] like Figure 2As shown, the LBRD-PPFL (Large-model Based Robust Datageneration for Privacy-Preserving Federated Learning) algorithm framework in this embodiment adopts a layered and decoupled architecture, consisting of four parts: a data layer, a generation layer, a training layer, and an evaluation layer. It supports plug-and-play use of various heterogeneous biometric modalities such as ECG, PPG, and EEG. The core innovation of the framework lies in the semantic-gradient dual-space collaborative optimization mechanism. Traditional federated adversarial training methods only apply pixel-level or sampling-point-level perturbations to the input space, lacking explicit modeling of the clinical semantic structure of biometrics. This easily leads to the destruction of key diagnostic waveforms such as the QRS complex of ECG and the contraction peak of PPG during adversarial generation, resulting in a decrease in the model's sensitivity in ventricular arrhythmia detection tasks. LBRD-PPFL maps continuous temporal signals to a high-dimensional medical semantic embedding space through the LLMGuide module, calculates the privacy distance in this space and drives the adversarial generation process, while applying alignment constraints in the gradient space to ensure the consistency of the federated model update direction. This mechanism explicitly encodes clinical prior knowledge into a differentiable optimization objective, achieving a paradigm shift from "numerical perturbation" to "semantic privacy-utility joint optimization".

[0065] The data layer, as the system foundation, is responsible for purifying and simulating the distribution of raw biometric data. The BioPreprocessor configures specific parameters for different modalities: ECG uses a 0.5-40Hz bandpass filter to preserve the electrocardiographic frequency band, combined with sym8 wavelet level 4 decomposition for soft thresholding denoising; PPG uses a 0.5-10Hz filter supplemented with a 100ms median filter to eliminate motion artifacts; EEG uses a 0.5-45Hz filter range to preserve the whole brainwave frequency band. The BioSynthesizer generates high-fidelity synthetic data based on physiological dynamics equations, simulating real clinical distributions by implanting pathological patterns such as atrial fibrillation and premature ventricular contractions. A differentiated privacy budget is introduced during the data generation stage to decouple the statistical characteristics of the training and test sets, defending against member inference attacks at the source.

[0066] The generation layer is the core innovative module of the framework, composed of LLMGuide and LBRDGenerator. LLMGuide achieves zero-shot cross-modal mapping through the DeepSeek API, converting unlabeled temporal signals into medical semantic description text, and then generating 768-dimensional deterministic embedding vectors through SHA-256 hashing and projection matrices. This mechanism reduces API call latency from 120ms to 5ms through LRU caching optimization, and the cache hit rate remains stable at 82% after 50 rounds. LBRDGenerator adopts a lightweight CNN architecture, which is optimized through four objectives: gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss.

[0067] The training layer implements a secure federated learning protocol stack. FederatedServer integrates multiple aggregation strategies such as FedAvg, FedAdam, and FedMedian. The client uses a hybrid loss function for training, combining cross-entropy loss, LBRD-generated data loss, and DP gradient loss, and is configured with an early stopping mechanism to prevent overfitting.

[0068] The evaluation layer constructs a three-dimensional quantification system encompassing privacy, utility, and robustness. It utilizes parallel computation of privacy metrics such as PSNR, SSIM, and semantic distance; utility metrics such as task accuracy, F1 score, and gradient cosine similarity; and attack resistance metrics such as reconstruction attack, membership inference, and attribute inference. This provides an auditable and compliant chain of evidence for medical AI systems, meeting the accountability requirements of regulatory agencies.

[0069] By focusing on the core problem of robust data generation with semantic awareness, this paper constructs a lightweight generation mechanism that can achieve fine-grained privacy quantification while maintaining the integrity of physiological structure. Medical semantic embeddings are extracted through a large language model, and an adversarial generation process is driven within the embedding space, thereby achieving a dynamic balance between privacy and utility without accessing real labels. This approach fundamentally differs from existing methods based on numerical perturbation or general generation models, providing a new perspective for overcoming the performance bottleneck of federated learning of biometric features.

[0070] Compared to existing federated learning frameworks, LBRD-PPFL is the first to deeply embed the clinical reasoning capabilities of a large language model into a privacy-preserving process, enabling practical deployment under the resource constraints of edge devices and providing a complete technical path from theoretical design to engineering implementation for medical IoT scenarios.

[0071] The data layer, serving as the foundational support of the LBRD-PPFL framework, undertakes the dual functions of raw biometric signal purification and heterogeneous data distribution simulation. It is implemented collaboratively by two core components: BioPreprocessor and BioSynthesizer. This module strictly adheres to clinical signal processing standards, ensuring that the preprocessing process does not lose diagnostically relevant morphological features. Simultaneously, it constructs a federated training environment that conforms to the distribution of real-world medical IoT data through high-fidelity synthesis technology.

[0072] BioPreprocessor employs differentiated, multi-stage purification pipelines tailored to the physiological characteristics and noise distribution patterns of various biomodalities. This processor strictly adheres to technical specifications for medical signal acquisition, removing noise interference while preserving waveform details of clinical diagnostic value to the maximum extent possible.

[0073] The ECG signal processing pipeline employs a four-stage cascaded architecture. First, a 0.5Hz high-pass Butterworth filter (2nd order) eliminates baseline drift; this cutoff frequency preserves low-frequency components such as the ST segment. Next, a 0.5-40Hz bandpass filter (8th order) is implemented, covering 99% of the ECG signal's energy distribution. For 50Hz power line interference, a notch filter with a Q-factor of 30 is designed to eliminate noise while avoiding leakage from adjacent spectra. The wavelet denoising stage uses the sym8 wavelet basis for 4-level decomposition; this wavelet has approximately linear phase characteristics, minimizing phase distortion of the QRS complex.

[0074] PPG signal processing focuses on suppressing motion artifacts. Since wearable devices are susceptible to interference from limb movements, preprocessing first applies a 100ms sliding median filter to eliminate pulse artifacts; this window length covers the duration of typical motion noise. Subsequently, a 0.5-10Hz bandpass filter is used to preserve the pulse fundamental and first three harmonics, ensuring the integrity of the dicrotic notch morphology. Unlike ECG, PPG wavelet denoising uses a db4 wavelet level 3 decomposition, a configuration that better suits the time-frequency localization characteristics of the PPG signal. Finally, a 15-point Savitzky-Golay filter is used for smoothing to avoid over-smoothing that could lead to the loss of pulse waveform features.

[0075] EEG signal processing addresses the multi-rhythm characteristics of EEG by implementing a 0.5-45Hz bandpass filter to preserve information across the entire frequency band (δ, θ, α, β, γ). Wavelet decomposition employs a 5-level db4 wavelet decomposition to accurately separate each rhythm subband. Considering the significant individual variability in EEG signals, the preprocessing output additionally provides a signal-to-noise ratio (SNR) estimate, serving as a basis for subsequent adaptive privacy budget allocation.

[0076] The preprocessor output undergoes a standardized process: the signal is z-score normalized to achieve a mean of zero and a standard deviation of 1, and then the data is reshaped into a tensor format of [number of samples, 1, sequence length] to adapt to subsequent deep learning model input. All filter parameters in this layer can be dynamically adjusted via YAML configuration files to meet the customized needs of different clinical application scenarios.

[0077] BioSynthesizer constructs a generative model based on physiological dynamics equations, simulating the complex distribution of multi-source heterogeneous data in the medical Internet of Things by implanting real pathological patterns. This synthesizer breaks through the simplistic assumption of traditional Gaussian additive noise, establishing a data generation paradigm that conforms to bioelectrophysiological mechanisms.

[0078] The ECG synthesis model uses the Gaussian function superposition method to model typical ECG cycles. The sinus P wave, QRS complex, and T wave are generated by equations (1), (2), and (3), respectively.

[0079]

[0080]

[0081]

[0082] Timing parameters Adjusted dynamically according to heart rate, the PR interval is 120-200ms, the QRS width is 80-120ms, and the QT interval is corrected according to the Bazett formula. Pathological patterns are adjusted... Achievement of standard deviation of interval: atrial fibrillation setting The premature implantation of ventricular premature beats is characterized by a wide QRS complex (width > 0.12s) and a subsequent compensatory pause.

[0083] The PPG synthesis model introduces a coupling equation between vascular elasticity and respiratory modulation. As shown in equation (4), the contraction peak is generated by the elastic cavity model:

[0084]

[0085] in Characterizing vascular stiffness, it decreases with age. The dicrotic notch is modeled using secondary reflected waves, whose time delay... Related to arterial compliance. Respiratory modulation uses a 0.1-0.4 Hz sinusoidal envelope to modulate pulse amplitude, simulating real physiological conditions. Arrhythmia patterns are achieved by randomizing the RR interval; in atrial fibrillation, the RR interval follows an exponential distribution (mean 0.6 s), while in tachycardia, the RR interval shortens to 0.3-0.5 s.

[0086] The EEG synthetic model is based on the Jansen-Rit neuronal mass model, which equates the cortical neuronal population to a nonlinear oscillator, generating δ (0.5-4Hz), θ (4-8Hz), α (8-13Hz), and β (13-30Hz) rhythms.

[0087] Epilepsy spikes are simulated using transient pulse perturbations, with pulse amplitudes randomly sampled from [2,5] mV and widths ranging from 10 to 30 ms. The rhythm energy ratio is dynamically adjusted according to sleep stages: delta waves account for >50% during deep sleep, and theta and beta waves are enhanced during REM sleep.

[0088] The core innovation lies in the privacy budget decoupling mechanism of the synthesis process. The system allocates independent differential privacy budgets to the training and test sets. By adding differentiated Laplace noise, the statistical properties of the two are decoupled. This design effectively defends against membership inference attacks because attackers cannot infer the membership of training set samples from the test set distribution. After being processed by BioPreprocessor, the statistical fidelity error (mean deviation <2%, spectral mean square error <5%) of the synthesized data meets the distribution consistency requirements of federated learning, while ensuring that the synthesized data does not expose real patient privacy information.

[0089] This module outputs data through a FederatedDataset for heterogeneous partitioning, simulating the non-independent and identically distributed characteristics of data volume and category distribution among medical institutions. It supports heterogeneous label generation based on Dirichlet distribution (concentration parameter α=0.3) and feature heterogeneous simulation based on differences in device sampling rates, providing a benchmark testing environment that closely resembles real-world scenarios for the LBRD-PPFL framework.

[0090] As the core innovative module of the LBRD-PPFL framework, the generation layer constructs an end-to-end transformation paradigm from raw biological signals to privacy-hardened robust data by leveraging the clinical knowledge understanding capabilities of a large language model. The semantic extraction engine, implemented by the LLMGuide module, overcomes the limitations of traditional feature engineering in two dimensions: zero-shot cross-modal mapping and deterministic embedding encoding.

[0091] LLMGuide achieves zero-sample mapping of time-series signals to the medical semantic space through the DeepSeek-API, innovatively transforming physiological waveforms into clinically interpretable high-dimensional semantic embeddings without requiring paired (signal, report) labeled data.

[0092] For the input signal First, extract the statistical feature set relevant to clinical diagnosis. ,in The mean, Standard deviation Main frequency, Hurst exponent This is the skewness coefficient. The scheme is based on the feature set. Build a structured prompt template:

[0093] P(x) = "As a cardiac electrophysiology expert, please analyze electrocardiogram signals with the following statistical characteristics: mean..." Standard deviation main frequency Hurst index (H) and skewness (S) describe the rhythmic regularity, P-QRS-T wave morphology, and potential clinical significance.

[0094] The design achieves a high degree of consistency between the semantic descriptions generated on the DeepSeek-API and professional physician reports. Significantly superior to unstructured prompts ( ).

[0095] LLMGuide employs hashed deterministic embeddings. To avoid the unreproducible training caused by the randomness of LLM, a two-stage deterministic encoding is designed: first, the returned text is processed... Generate a 256-bit digest using SHA-256 hashing. Then through a fixed projection matrix Map to a 768-dimensional vector and L2 normalize:

[0096]

[0097] Built-in LRU cache (capacity 1000) reduces average API latency from 2.3 seconds without cache to 5ms after cache hit, with a hit rate of 67% in round 10 and stabilizing at 82% in round 50.

[0098] LBRDGenerator, as the core of the generation layer, abandons the traditional generator-discriminator adversarial architecture of GANs and innovatively adopts a federated model as the discriminant guide. It achieves a multi-dimensional balance of privacy, utility, and structure through a four-objective collaborative optimization function. This breaks through the deployment bottleneck of adversarial generation on edge medical devices.

[0099] As shown in Table 1, the generator adopts a three-stage structure of encoder-attention-decoder. The encoder consists of three layers of one-dimensional convolutions. The kernel size is 7 / 5 / 3, with a stride of 1 to maintain the sequence length. Each layer is followed by instance normalization and ReLU. The attention module adopts SE-Net-style channel attention and uses global average pooling. Fully connected (64→16) → ReLU → Fully connected (16→64) → Sigmoid generates a weight vector, adaptively weighting the encoded features to enhance the representation of key time-step features such as QRS complex waves and contraction peaks. The decoder is a symmetric transposed convolutional structure. Finally, the robust output signal is activated. Ensure that the amplitude is in the range of [-1, 1].

[0100] Table 1 LBRDGenerator Network Structure Configuration

[0101]

[0102] The core innovation of the robust generator lies in its four-objective collaborative optimization function. This mechanism breaks through the limitations of traditional adversarial training, which focuses solely on minimizing loss, and constructs a four-dimensional collaborative framework of gradient, structure, semantics, and vision. The four objective functions independently undertake specific optimization responsibilities, while also forming a dynamic balance through weight scheduling, achieving Pareto optimality between privacy protection strength, model convergence rate, and clinical effectiveness.

[0103]

[0104] The calculation process for each indicator can be summarized as follows:

[0105] 1) Gradient Utility Loss

[0106]

[0107] As shown in equation (7), this loss constraint generates samples. Compared with the original sample x in the federated model The gradient direction is consistent. From the perspective of optimization dynamics, if... Then use Model update trajectory and usage during training Equivalent. Theoretical analysis shows that, Under the condition of federated convergence rate The theoretical community remains unchanged, among which For smoothing coefficients, This is a strongly convex constant. In practice, this loss only increases the actual number of training epochs by 5.2%, far lower than the 15-20% convergence delay cost of traditional adversarial training. It ensures that the privacy-preserving data generated by LBRD does not impair the training efficiency of the federated model, avoids sacrificing model accuracy for privacy, and resolves the fundamental contradiction of the privacy-utility trade-off.

[0108] 2) Structure Preservation Loss

[0109]

[0110] As shown in equation (8), structural retention loss Through morphological operator sets (Including QRS width detection, PPG contraction peak localization, PPG band energy ratio, etc.) constrain key physiological characteristics. This is an index set of key physiological structures.

[0111] Weight The sensitivity mapping table is from Section 2.5. This loss ensures that the generation process does not destroy the waveform morphology that has diagnostic value.

[0112] 3) Semantic Privacy Loss

[0113]

[0114] As shown in equation (9), semantic privacy loss The medical semantic space extracted by LLM drives the embedding vectors to move away from each other, where For cosine similarity, This represents the KL divergence. The negative sign indicates maximizing the semantic distance, making the original signal and the generated signal indistinguishable at the "clinical concept" level (e.g., the semantic gap between normal sinus rhythm and atrial fibrillation rhythm). Used to balance cosine distance and distribution divergence.

[0115] It provides a quantifiable and auditable semantic-level privacy metric.

[0116] 4) Visual Privacy Loss

[0117]

[0118] As shown in equation (10), visual privacy loss The goal is to maximize the difference in the predicted distributions of the original and generated samples. From an information theory perspective, if the model's predicted probability distributions differ significantly, an attacker cannot infer the training sample affiliation through gradient similarity. This loss is related to... Forming spatial complementarity: the former is embedded in spatial defense at the feature level, while the latter is predicted in spatial defense at the decision level.

[0119] The four-objective loss weights employ a collaborative scheduling method. Dynamic scheduling strategy, in the early stages of training Dominance is key to ensuring convergence stability; mid-term improvement Enhanced privacy; minor adjustments made later. Maintaining structural integrity is crucial. The final configuration is determined through Bayesian optimization search. Compared to fixed weights, dynamic scheduling can significantly improve performance.

[0120] The application of traditional differential privacy (DP) in federated learning faces structural limitations, as its globally uniform noise scale cannot meet the requirements for protecting the heterogeneity of biometric data. The QRS complex on ECG, as the core of ventricular arrhythmia diagnosis, has a much lower perturbation tolerance than baseline drift; the PPG systolic peak directly reflects stroke volume, while the dicrotic notch only characterizes arterial elasticity. Homogeneous noise injection inevitably leads to an imbalance of "underprotection of key waveforms and overprotection of redundant information," impairing clinical effectiveness. To address this, a clinical knowledge-driven sensitivity mapping system and a round-feature dual-dimensional dynamic noise scheduling strategy are constructed. For the first time, physiological priors are encoded as computable privacy weights, achieving semantically aware fine-grained differential privacy protection.

[0121] Table 2 Sensitivity Mapping Table

[0122]

[0123] As shown in Table 2, the construction of the sensitivity mapping table is the core of the adaptive mechanism. Based on the American Heart Association (AHA) ECG diagnostic guidelines and the MIT-BIH arrhythmia database, the ECG signal is decomposed into 8 physiological structural units and assigned sensitivity weights. The QRS complex, due to its role in determining heart rate and rhythm and the serious consequences of misdiagnosis, has a weight of 0.9; the P wave, as a marker of atrial arrhythmias, has a weight of 0.7; the ST segment is a core indicator for locating myocardial ischemia, with a weight of 0.8; the T wave, PR interval, and QT interval are weighted at 0.6, 0.5, and 0.6, respectively; baseline drift is a respiratory motion artifact, with a weight of only 0.3; and heart rate variability (HRV) reflects autonomic function, with a weight of 0.7. The Cohen's Kappa consistency coefficient from the original MIT-BIH literature... PPG mapping is based on photoplethysmography, with a systolic peak weight of 0.8 (sensitive to stroke volume), a dicrotic notch weight of 0.6 (arterial elasticity index), and a pulse rate variability weight of 0.7. EEG follows international clinical neuroelectrophysiological standards, with a spike weight of 0.9 (gold standard for epilepsy diagnosis). Wavelength 0.5 (deep sleep background) Rhythm 0.8 (consciousness state assessment). As shown in Equation (11), the weights are differentiated by feature-wise gradient pruning norm:

[0124]

[0125] High sensitivity Corresponding to a tighter clipping boundary, the QRS composite wave gradient is strictly limited to Baseline drift allows The difference in noise injection amount is 4.7 times.

[0126] Building upon this, a two-dimensional dynamic noise scheduling strategy based on rounds and features is proposed. The round dimension employs an exponentially decaying budget allocation, while the privacy budget increases with each training round. according to Evolution, in which , This design leverages the characteristics of federated learning: high noise aids in early exploration and low noise convergence in later stages. Sufficient budget is allocated in the early training phase to allow for a larger noise-based parameter space, which is then tightened in the later stages. Fine-tune the model.

[0127]

[0128] The feature dimension changes according to the semantic privacy loss in each round. Dynamically adjust the scale of each characteristic noise, if (This indicates an increased risk of leakage for this feature), as shown in Equation (12). The noise scale for this feature increases by 20% in the next round; conversely, if it falls below a negative threshold, it decreases appropriately, achieving on-demand protection. The overall noise mechanism satisfies... - The adaptive combinatorial theorem for differential privacy, because the budget between rounds has a preset upper limit and feature adjustment is driven by public semantic loss, ensures that the overall privacy consumption satisfies The indicator function The number of semantic risk triggers was counted. Experiments showed that during 50 training rounds... The convergence rate was lower than the preset upper limit of 8.0, and the convergence speed was improved by 30% compared with static DP, which verified the effectiveness of the "early loose-late tighten" strategy.

[0129] This adaptive dynamic programming (DP) and the LBRD Generator form a double-layered nested protection: the LBRD generates privacy-hardened robust alternative data in the input space, while the DP adds feature-level adaptive noise to the gradient space. The two are linked by sensitivity weights. To achieve collaboration, the structure preservation loss of LBRD in the forward generation stage is based on... The constraint strength is assigned, and the clip norm of DP during the backpropagation phase is also based on... Scaling applies tighter pruning to the QRS gradient. This two-layer mechanism of "preserving morphology during generation and protecting gradients during training" significantly reduces the success rate of member inference attacks compared to a single strategy, achieving a multiplier effect in privacy protection. In summary, the biometric-aware adaptive differential privacy mechanism, through explicit encoding of clinical knowledge and two-dimensional dynamic scheduling, elevates differential privacy from numerical perturbation to a semantic-aware level, providing a provable, interpretable, and adaptive privacy guarantee foundation for the LBRD-PPFL framework.

[0130] The LBRD-PPFL framework's training layer achieves end-to-end privacy-preserving federated optimization through a client-server collaborative protocol. This protocol deeply integrates the LBRD generator, adaptive differential privacy, and robust verification mechanisms, forming a complete closed loop from data generation, local training, secure upload, to aggregation and update. This section details the communication protocol, loss function design, and security defense system for a single round of federated training.

[0131] 1) Local training process on the client side

[0132] At the start of each training round, the client... Receive global model parameters Compared to the current round of privacy budget Local dataset After purification by BioPreprocessor, according to the ratio Call LBRDGenerator to generate robust alternative data:

[0133]

[0134] As shown in equation (14), the training uses a hybrid loss function:

[0135]

[0136] Cross-entropy loss The calculations are performed on both the original data and the LBRD data, with a weight α = 0.5 to balance the contributions of the two. As shown in equation (15), Gradient clipping and noise injection are performed. Feature-wise adaptive clipping is implemented based on the sensitivity mapping table in Section 2.5:

[0137]

[0138]

[0139] Training employs stochastic gradient descent with momentum (momentum=0.9), a batch size of 32, and 3 local epochs. An early stop mechanism monitors and verifies the loss; if there is no improvement after 3 epochs, training is terminated and the current update is uploaded. The entire process does not require the original data to be taken out of the domain, complying with the "usable but not visible" compliance requirement for medical data.

[0140] The client synchronously maintains a local privacy accounting ledger, recording the budget consumed. With noise injection logs. When When this happens, the client will automatically terminate its participation in subsequent rounds to prevent overspending on its privacy budget.

[0141] 2) Server-side security aggregation and verification

[0142] The server is collecting client updates. Then, initiate dual verification.

[0143] The first step is numerical integrity checking. This involves checking for NaN values ​​in the update and verifying the gradient norm. Is it in the historical distribution? Within the specified interval. If it exceeds the interval, it is considered an abnormal update and aggregation is rejected. The second layer is biological structure integrity verification. The corresponding model layer for the update is analyzed (such as the first layer convolutional coding baseline, deep coding QRS), and the critical structure update rate is calculated using a sensitivity mapping table. If the QRS layer update rate or baseline layer If the update fails, it is considered a structurally destructive update. Updates that pass verification are then evaluated using an adaptive aggregation strategy. The FedAvg method is used by default.

[0144]

[0145] in The global learning rate, For client data volume, This is the set of verified clients. When the proportion of detected abnormal clients exceeds [a certain threshold]... When this happens, the server automatically switches to FedMedian aggregation to defend against Byzantine attacks. If the number of verified clients is less than [a certain threshold]... In this case, the aggregation is skipped in this round to prevent the model from being hijacked by a few malicious updates.

[0146] Global Gaussian noise is added to the aggregated global model. Noise scale Based on the remaining global privacy budget Dynamic calculations ensure that no additional privacy leaks are introduced on the server side.

[0147] Furthermore, based on the above method, this embodiment of the invention also provides a large model-guided biological data privacy protection system, comprising: several clients and a server, wherein,

[0148] In the client, a large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Based on these robust biological data samples and the local biological data samples, a local model is trained. The gradient of the trained model is then uploaded to the server. The data generator uses a multi-objective collaborative optimization strategy to generate adversarial examples in biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in terms of model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples.

[0149] In the server, the model gradients uploaded by each client are double-validated and aggregated using an adaptive aggregation strategy. The global model is then updated and distributed back to each client for the next round of federated training until convergence. The double validation includes numerical integrity validation and biological structure integrity validation. The adaptive aggregation strategy aggregates the client model gradients that have passed the double validation based on the proportion of client data volume.

[0150] To address the challenges of gradient leakage and utility-privacy imbalance in biometric processing within federated learning, this paper proposes a semantic-gradient dual-space co-optimization mechanism. This mechanism encodes clinical knowledge into computable privacy weights, achieving a paradigm shift from "numerical perturbation" to "semantic awareness." Theoretical analysis rigorously proves the convergence bound and lower bound of the adaptive differential privacy mechanism against member inference attacks. This research provides an auditable and implementable privacy protection solution for the Internet of Things (IoT) in healthcare, meeting GDPR compliance requirements.

[0151] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0152] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0153] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0154] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0155] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for protecting the privacy of biological data guided by a large model, characterized in that, Include: A large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Local model training is then performed based on these robust biological data samples and the local biological data samples. The data generator utilizes a multi-objective collaborative optimization strategy to generate adversarial examples in the biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in the model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples. Each client uploads the model gradients trained on its local model to the server. The server performs double verification on the model gradients of each client and aggregates the model gradients using an adaptive aggregation strategy, updates the global model, and distributes the updated global model back to each client for the next round of federated training until convergence. The double verification includes numerical integrity verification and biological structure integrity verification. The adaptive aggregation strategy aggregates the client model gradients that have passed the double verification based on the proportion of client data volume.

2. The method for protecting biological data privacy guided by a large model according to claim 1, characterized in that, Using large models to convert time-series signals in biological data into medical semantic description text, including: Acquire clinical-grade biological data and perform heterogeneous partitioning of the clinical-grade biological data to obtain a local training dataset for federated learning. The heterogeneous partitioning is a data simulation partitioning that simulates the non-independent and identically distributed characteristics of data volume and data category distribution among medical institutions. Extract clinical diagnosis-related statistical features from the local training dataset and construct a structured prompt template based on these features; Biological data samples from the local training dataset are embedded into structured prompt templates, and the corresponding medical semantic description text is obtained using a large model. The medical semantic description text and biological data samples are hashed and encoded to generate a text summary. The text summary is then mapped to a specified vector dimension through a fixed projection matrix to obtain the medical semantic space embedding vector.

3. The method for protecting biological data privacy guided by a large model according to claim 2, characterized in that, Acquire clinical-grade biological data, including: Relevant medical signals are acquired through medical acquisition equipment, including ECG signals, PPG signals, and EEG signals. Based on the physiological dynamics equation, the distribution of multi-source heterogeneous data in the medical Internet of Things is simulated to obtain synthetic medical signals, which include: ECG synthetic signals, PPG synthetic signals and EEG synthetic signals; Relevant medical signals and synthetic medical signals are purified and preprocessed to obtain standardized clinical-grade biological data.

4. The method for protecting biological data privacy guided by a large model according to claim 1, characterized in that, The data generator adopts a three-stage structure of encoder, attention layer and decoder. The encoder encodes the input biological data by three layers of one-dimensional convolution. The attention layer uses the SE-Net channel attention mechanism to generate a weight vector for adaptive weighting of the encoded features. The decoder uses a one-dimensional convolution transpose structure symmetrical to the encoder to reconstruct and output the biological sample data.

5. The method for protecting biological data privacy guided by a large model according to claim 1 or 4, characterized in that, Generate adversarial examples for biological data using a multi-objective collaborative optimization strategy, including: Construct gradient utility loss function, structure preservation loss function, semantic privacy loss function, and visual privacy loss function; Set the collaborative scheduling loss weights for each loss function to obtain the adversarial training loss function of the data generator based on the loss weights. The collaborative scheduling loss weights are dynamically adjusted through Bayesian optimization search. The data generator is trained adversarially using an adversarial training loss function and biological data samples and medical semantic description text. Biological data adversarial examples are generated using a data generator trained on adversarial data.

6. The method for protecting biological data privacy guided by a large model according to claim 5, characterized in that, The adversarial training loss function of the data generator is expressed as: in, , , , These are the gradient utility loss function, the structure preservation loss function, the semantic privacy loss function, and the visual privacy loss function, respectively. These are the loss weights for the corresponding loss functions, and , , , , The generated adversarial examples are shown, where x is the original biological data sample. For parameters of the federated learning model, For medical physiological structure and morphology operators, This is an index set of key physiological structures. The weights of the corresponding physiological structures in the sensitivity mapping table. These are the medical semantic space embedding vectors of the original biological data sample and the adversarial sample, respectively. Let KL divergence be the KL divergence. To balance the coefficients of cosine distance and distribution divergence, This represents the model's predicted probability distribution for the samples.

7. The method for protecting biological data privacy guided by a large model according to claim 1, characterized in that, In the local model training based on robust biological data samples and local biological data samples, the client uses a hybrid loss function consisting of cross-entropy loss, data generator loss and DP gradient loss for local model training, and configures an early stopping mechanism to prevent overfitting. The DP gradient loss uses feature-wise gradient clipping norm and clinical knowledge explicit encoding to differentiate the weights of corresponding physiological structures.

8. The method for protecting biological data privacy guided by a large model according to claim 7, characterized in that, In the differential protection of physiological structure weights, the DP gradient loss uses a two-dimensional dynamic noise adjustment strategy of rounds and features to add feature-level adaptive noise to the gradient space. In the round dimension, an exponential decay budget is used to allocate the privacy budget in the training rounds, and in the feature dimension, the noise scale of each feature is dynamically adjusted according to the semantic privacy loss change in each round.

9. The method for protecting biological data privacy guided by a large model according to claim 1, characterized in that, The server performs dual validation of the gradients of each client model, including: In the numerical integrity check, it is checked whether there are undefined or unrepresentable values ​​in the gradient of the client model, and it is verified whether the gradient norm is within the historical distribution range. If it exceeds the historical distribution range, the gradient of the client model is determined to be abnormal, and the gradient aggregation of the client is rejected. In the biological structural integrity verification, the model layer corresponding to the gradient of the client model is parsed, and the critical structure update rate is calculated using a sensitivity mapping table. If the critical structure update rate exceeds the threshold, it is determined that the client has a structurally destructive update, and the gradient aggregation of the client is rejected.

10. A large-model-guided biological data privacy protection system, characterized in that, Includes: several clients and servers, among which, In the client, a large model is used to convert time-series signals in biological data into medical semantic description text, enabling each client to generate robust biological data samples locally using a data generator. Based on these robust biological data samples and the local biological data samples, a local model is trained. The gradient of the trained model is then uploaded to the server. The data generator uses a multi-objective collaborative optimization strategy to generate adversarial examples in biological data. This strategy involves simultaneously optimizing gradient utility loss, structure preservation loss, semantic privacy loss, and visual privacy loss during training. The gradient utility loss constrains the gradient direction of the adversarial examples to be consistent with that of the original samples in terms of model parameters. The structure preservation loss constrains the key physiological structural features of the adversarial examples. The semantic privacy loss constrains the semantic distance of the adversarial examples in the medical semantic description space. The visual privacy loss addresses the differences in the predicted probability distribution of the adversarial examples. In the server, the model gradients uploaded by each client are double-validated and aggregated using an adaptive aggregation strategy. The global model is then updated and distributed back to each client for the next round of federated training until convergence. The double validation includes numerical integrity validation and biological structure integrity validation. The adaptive aggregation strategy aggregates the client model gradients that have passed the double validation based on the proportion of client data volume.

Images