A multi-agent privacy protection method based on private-public space paradigm

Abstract

This invention belongs to the field of artificial intelligence and multi-agent systems, specifically relating to a multi-agent privacy protection method based on a private-public space paradigm. The method comprises three stages: privacy desensitization, semantic and logical enhancement in the public space, and answer restoration. This method performs multi-perspective privacy identification on the original data in the private space and constructs anonymized data using privacy box components. Subsequently, in the public space, it utilizes domain rule-based knowledge enhancement (DRKE) and proof-by-contradiction-based logic enhancement (DLE) mechanisms to extract and repair semantic and logical features from the desensitized data. Finally, in the private space, a deanonymized agent restores the original privacy information, thereby achieving high-performance multi-agent task processing under strong privacy protection.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and multi-agent systems, and specifically relates to a multi-agent privacy protection method based on a private-public space paradigm. Background Technology

[0002] Computational multi-agent systems (MAS) refer to a method that utilizes multiple large language model (LLM) agents to collaborate in predicting, reasoning, and processing complex tasks. In recent years, MAS has achieved significant success in numerous fields, including automated programming, complex decision analysis, and intelligent customer service. Recent research shows that using high-performance managed LLMs (such as GPT-4o and Claude 3.5), agents can achieve human-like information exchange and logical reasoning. Ongoing research indicates that MAS can significantly improve productivity in various fields such as finance, healthcare, and law. Despite these significant advancements, accurately protecting user privacy when handling sensitive private data remains a major challenge.

[0003] Traditional research on privacy protection in multi-agent systems mainly relies on differential privacy, federated learning, or hardware-based trusted execution environments (TEEs). The core idea behind these methods is to block the exposure of raw data through mathematical noise or distributed computing. However, in dynamic collaborative scenarios based on LLM, traditional methods face severe challenges.

[0004] Currently, privacy protection methods in MAS are mainly limited by the following aspects: (1) The dilemma of balancing privacy and utility. Existing desensitization methods (such as masking techniques or simple named entity replacement) often lead to serious semantic loss. In the MAS collaboration process, due to the removal of original sensitive information, agents in the public space often cannot obtain sufficient background context, resulting in a significant drop in the accuracy of task reasoning and making it difficult to achieve a balance between privacy protection and model utility. (2) Insufficient recognition accuracy and context awareness. Traditional named entity recognition (NER) methods mainly rely on predefined rules or static models and cannot understand common sense and complex contextual situations in human society. This makes the system prone to false positives (incorrectly desensitizing non-privacy public information) or false negatives (omitting private information implied in semantics), which seriously affects the fluency of multi-agent collaboration. (3) Logical illusion caused by anonymization. In the context of large language models, the lack of information can induce the model to produce "logical illusions", that is, agents will generate seemingly reasonable but logically incorrect answers when lacking key facts. Existing multi-agent architectures lack an automatic error correction and logic repair mechanism, and cannot maintain high-confidence inference results under anonymization conditions. (4) Static protection strategies are difficult to cope with dynamic collaboration. Information exchange in a multi-agent environment is dynamic and multi-round, and traditional static filtering strategies cannot handle the complex logical dependencies and knowledge transfer between multiple agents.

[0005] In summary, existing MAS privacy protection methods, while ensuring data security, often sacrifice task performance and logical consistency, and lack the ability to supplement with domain expertise. Therefore, how to design a general multi-agent system that can achieve strong privacy isolation while improving system utility through semantic and logical enhancement mechanisms is a problem that researchers in this field urgently need to solve. Summary of the Invention

[0006] Existing methods for protecting agent privacy employ various anonymization or encryption techniques to mitigate privacy risks, often resulting in the loss of some semantic and logical information from the original task. This invention proposes a novel General Anonymized Multi-Agent System Model (GAMA) that can recover key information from anonymized placeholder text through domain knowledge completion and logical game theory, thereby achieving strong privacy protection. This method references Domain Rule-Based Knowledge Enhancement (DRKE) and Proof-of-Law Logic Enhancement (DLE), enabling the multi-agent system to focus on important domain components missing from anonymized text and suppress logical illusions, thus achieving efficient and accurate multi-agent collaboration and reasoning tasks under privacy-preserving conditions.

[0007] The technical solution of the present invention is as follows: A multi-agent privacy protection method based on a private-public space paradigm has a core process consisting of three stages: privacy desensitization, public space semantic and logical enhancement, and answer restoration.

[0008] Phase 1: This phase is the privacy desensitization phase, which includes two steps: multi-view privacy identification and anonymization mapping using privacy boxes. The specific steps are as follows: Step 1: Perform Multi-View Privacy Recognition (MVPI). Utilize dual-view parallel detection within the private space to balance accuracy and breadth: PNER views use a pre-trained model to identify physical entities. The calculation process is shown in formula (1): ; PIA View leverages intelligent agents to determine contextual privacy based on common sense. As shown in formula (2): ; Finally, the fusion function is used. Obtain the final privacy set ; Step 2: Perform privacy box mapping. Establish a set of mapping relationships. Using mapping functions to Replace entities in the text with random placeholders to generate anonymized text. The calculation process is shown in formula (3): ; The second stage: This stage is the semantic and logical enhancement stage of the public space. This stage includes two steps: performing knowledge enhancement based on domain rules and performing logical enhancement based on proof by contradiction. The specific steps are as follows: Step 3: Perform Domain Rule-Based Knowledge Enhancement (DRKE). Identify the target domain of the task by calculating the domain attribution matrix: first, calculate the high-order association matrix. Next, an attribution matrix is ​​constructed based on the characteristics of the task content. Finally, the background knowledge is supplemented by calling an expert intelligent agent (DEA) based on the target domain.

[0009] Step 4: Perform logical enhancement based on proof by contradiction (DLE). To eliminate logical illusions, this invention employs an iterative game mechanism: an expert agent generates counterfactual answers. Then, the auxiliary intelligent agent judges whether there is a logical contradiction, as shown in formula (4):

[0010] If a contradiction is detected, the original proposition is confirmed. If true, output the result. The calculation process is shown in formula (5):

[0011] The third stage: This stage is the answer restoration stage, which includes three steps: receiving anonymous answers from the public space, performing reverse mapping of the privacy box, and generating the deanonymized final answer. The specific steps are as follows: Step 5: Receive Anonymous Answers from the Public Space. After the multi-agent collaborative task is completed, the private space receives the anonymized output from the public space through an encrypted channel. The result includes the logically enhanced text generated in the second stage, and key privacy-sensitive parts are still represented by placeholders (such as...). <name-1> 、 <location-1>Fill in (etc.).

[0012] Step 6: Perform the Privacy Box reverse mapping. The private space agent accesses the protected privacy box components. This component stores the bidirectional mapping between privacy entities and placeholders established in the first phase. By calling the reverse mapping function The system accurately locates the answer. Each placeholder in and replace it with the original corresponding real privacy entity. The mapping and restoration process is shown in formula (6):

[0013] Step 7: Generate the deanonymized final answer. The deanonymizing agent performs a final semantic check and layout optimization on the restored text to ensure a perfect integration of the original privacy information with the professional advice and logical reasoning results generated in the public space. The final result is an original answer that contains both complete privacy details and high-quality professional insights. The final output process is shown in formula (7) and presented to the end user.

[0014] Existing methods for protecting agent privacy employ various anonymization or encryption techniques to mitigate privacy risks, often resulting in the loss of some semantic and logical information from the original task. This invention proposes a novel General Anonymized Multi-Agent System Model (GAMA) that can recover key information from anonymized placeholder text through domain knowledge completion and logical game theory, thereby achieving strong privacy protection. This method references Domain Rule-Based Knowledge Enhancement (DRKE) and Proof-of-Law Logic Enhancement (DLE), enabling the multi-agent system to focus on important domain components missing from anonymized text and suppress logical illusions, thus achieving efficient and accurate multi-agent collaboration and reasoning tasks under privacy-preserving conditions.

[0015] Compared with the prior art, the present invention has the following significant advantages: (1) It possesses extremely high security and privacy protection. This invention constructs a "private-public space" isolation paradigm, restricting sensitive data to a protected private space and allowing only anonymized data to enter the public network environment for intelligent agent collaboration. Experimental data shows that the success rate of this invention in re-identification attacks in different adversarial scenarios, such as those against prosecutors, journalists, and marketers, is consistently below 0.21%. Especially in the most targeted prosecutor attack scenario, the success rate is 0.00%, which means that even if the attacker has extremely strong background knowledge, they cannot deduce the true identity of the entity from the anonymized text.

[0016] (2) A deep balance between privacy protection and task utility is achieved. Traditional anonymization methods often cause severe semantic loss, leading to a significant decline in task performance. This invention introduces a Domain Rule Knowledge Enhancement (DRKE) module, which can accurately identify the domain to which the task belongs and fill the background knowledge gap caused by anonymization. On the knowledge-intensive dataset PQA-K, this invention achieved a BLEU score of 86.10% and a text similarity index of 97.16%, proving that the system maximizes the preservation of the semantic coherence of the original task while ensuring privacy and security.

[0017] (3) Significantly enhanced logical consistency and suppressed model illusion. To address the issue that anonymization might compromise the logical integrity of the task, this invention designs a logic enhancement (DLE) module based on proof by contradiction. Through iterative game between the expert agent and the auxiliary agent, the system can automatically detect and correct logical contradictions. Experiments show that removing this module causes the score for logical reasoning tasks (such as PQA-L) to plummet from 82.0% to 42.8%, strongly demonstrating the core guarantee role and ability to suppress illusions in handling highly difficult logical reasoning tasks.

[0018] (4) It possesses strong architectural compensation capabilities and adaptability to base models. The multi-agent collaborative architecture proposed in this invention is not only applicable to the high-performance GPT-4o model, but also significantly empowers weak base models. Experiments show that even when using GPT-3.5 with limited inference capabilities as a base, its performance on the PQA-L dataset can be improved from 38.0% to 72.8% through the normalized multi-turn interaction and logical verification of this invention. This architectural compensation capability has significant engineering implications for reducing computational costs and replacing expensive large models with smaller parameter models in practical applications.

[0019] (5) A dynamic and high-precision multi-perspective privacy recognition mechanism was established. This invention effectively solves the false positive and false negative problems that are prone to occur in traditional methods by integrating the fine-grained named entity recognition capability of the PNER perspective with the global semantic and common sense judgment capability of the PIA perspective. On the core indicator F1-Score, this invention achieved 94.19% on the PQA-K dataset. It can not only accurately locate the privacy boundary, but also combine social common sense to judge the public attributes of entities (such as public figures or well-known institutions), thus avoiding information damage caused by excessive desensitization. Attached Figure Description

[0020] Figure 1 This is the rule-based knowledge enhancement graph of the present invention; Figure 2 This is the logical reasoning diagram based on proof by contradiction of the present invention; Figure 3 This is a performance comparison chart with other methods. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] Figure 1 This invention demonstrates the implementation process of Domain Rule-Based Knowledge Enhancement (DRKE). Figure 2 This demonstrates a logic enhancement (DLE) iterative reasoning mechanism based on proof by contradiction. Figure 3 This demonstrates a performance comparison of the present invention with other benchmark methods in terms of privacy protection and text quality. Figure 1 , Figure 2 As shown, the workflow of this invention is as follows: First, in the private space, a multi-view privacy identification mechanism (MVPI) is used to extract privacy entities from the original data. Second, a bidirectional mapping relationship is established through a privacy box, replacing the identified privacy entities with placeholders to generate anonymized text. Next, in the public space, a domain analysis agent identifies the domain to which the task belongs, and a domain expert agent (DEA) performs knowledge enhancement based on domain rules to compensate for the semantic loss caused by anonymization. Simultaneously, the system activates a counter-evidence logic enhancement module, where the expert agent and the auxiliary agent correct logical illusions by iteratively detecting contradictions to ensure the logical consistency of the output answer. Finally, the generated anonymized answer is transmitted back to the private space, and the reverse mapping function of the privacy box is used to restore the original privacy information, thereby achieving the final secure answer output.

[0023] from Figure 3 As can be seen, this invention achieves F1 scores of 94.19% and 93.6% respectively when processing the knowledge-based dataset PQA-K and the reasoning-based dataset PQA-L, and significantly outperforms existing benchmark methods such as NER-PRE, RPR, and AgentSafe in both text similarity and BLEU metrics. This strongly demonstrates that this invention effectively mitigates semantic loss through a dual enhancement mechanism while ensuring strong privacy and security, achieving a deep balance between privacy protection and task utility.

[0024] Example 1 In Example 1, this invention was used to build and evaluate models on five public and self-built datasets: TCW5, TCW10, LGP, PQA-K, and PQA-L. The models were also compared with three mainstream methods: Standard, SPP, and AutoAgents. Standard is a basic single-turn question-answering agent; SPP (Self-Persona Prompting), proposed in 2024, improves cognitive collaboration through multi-role self-cooperation; and AutoAgents, also proposed in 2024, is a framework that dynamically generates specialized expert teams based on the task. The task scores of this invention (GAMA) on different datasets are shown in Table 1.

[0025] By observing Table 1 and Figure 1 (Based on rule-based knowledge enhancement graphs) the following conclusions can be drawn: (1) This invention achieved the highest scores on all five datasets, especially on the complex logic reasoning dataset PQA-L, where it improved performance by nearly 85% compared to the Standard method (from 44.4% to 82.0%). This is because this invention introduces a logic enhancement (DLE) module based on proof by contradiction, which effectively identifies and corrects logical gaps caused by anonymization through a game between the expert agent and the auxiliary agent, and significantly suppresses logical illusions.

[0026] (2) In the knowledge-based task PQA-K, the performance of this invention (54.8%) is significantly better than that of the advanced multi-agent framework AutoAgents (50.8%). This is because the invention has a domain-based rule-based knowledge enhancement (DRKE) module, which can accurately retrieve and inject domain-specific knowledge from the local private space, thus repairing the "semantic gaps" caused by desensitization. General frameworks have difficulty handling such domain-specific privacy data tasks.

[0027] (3) Regardless of whether the high-performance GPT-4o or the less capable GPT-3.5 is used as the base model, the performance gains of this invention are very robust. In particular, on GPT-3.5, this invention improves the PQA-L score from 38.0% to 72.8%. This demonstrates that the architecture of this invention has extremely strong compensation capabilities and can make up for the shortcomings of the base model's logical capabilities through multiple rounds of verification and collaboration.

[0028] Table 1. Accuracy comparison between GAMA and benchmark methods on multi-class question answering datasets.

[0029] Example 2 To further evaluate the performance of the proposed method in privacy identification, we analyzed the prediction performance of GAMA on the PQA-K and PQA-L datasets compared with NER-PRE, RPR, and AgentSafe. Specifically, this invention used five evaluation metrics: BLEU (text fluency), Similarity (semantic consistency), Precision, Recall, and F1-score. The comparison results are shown in Table 2.

[0030] By observing Table 2 and Figure 3 The following conclusions can be drawn from the performance comparison chart: (1) On the core metric F1-score, GAMA achieved 94.19% and 93.6% on the two datasets, respectively, which significantly outperformed other comparison methods. This is attributed to the Multi-View Privacy Recognition (MVPI) module, which successfully integrates the fine-grained recognition capability of the local PNER view with the global semantic judgment capability of the PIA view, achieving a better balance between precision and recall.

[0031] (2) Regarding the quality (BLEU score) of the anonymized text, the present invention (86.10%) outperforms the method of directly calling GPT-4o for anonymization (82.26%). This is because the anonymization mechanism of the present invention accurately locates privacy entities by replacing placeholders, thus preserving the syntactic coherence of the original task to the maximum extent and avoiding semantic deviations that may be caused by general large models when rewriting text.

[0032] (3) Based on a comprehensive analysis of various privacy indicators, it can be concluded that the multi-perspective fusion mechanism constructed by this invention can effectively eliminate false alarms of non-privacy information such as public figures or public landmarks. At the same time, through the physical isolation of private spaces, it ensures that even in scenarios with extremely complex logic, the risk of privacy leakage is controlled at an extremely low level (re-identification rate is less than 0.21%).

[0033] Table 2. Comparison of privacy protection performance of different methods on the knowledge-based dataset PQA-K. < / name-1>

Claims

1. A multi-agent privacy protection method based on a private-public space paradigm, characterized in that, The steps are as follows: Step 1: Perform multi-view privacy identification; utilize dual-view parallel detection within the private space to balance accuracy and breadth: PNER View uses pre-trained models to identify physical entities. The calculation process is shown in formula (1): ； PIA View leverages intelligent agents to determine contextual privacy based on common sense. As shown in formula (2): ； Finally, the fusion function is used. Obtain the final privacy set ; Step 2: Perform privacy box mapping; Establish a set of mapping relationships Using mapping functions to Replace entities in the text with random placeholders to generate anonymized text. The calculation process is shown in formula (3): ； Step 3: Perform domain-rule-based knowledge enhancement; Identifying the target domain of a task by calculating the domain attribution matrix: First, calculate the higher-order correlation matrix. Next, an attribution matrix is ​​constructed based on the characteristics of the task content. Finally, based on the target domain, an expert intelligent agent is invoked to complete the background knowledge. Step 4: Perform logical enhancement based on proof by contradiction; Step 5: Receive anonymous answers in the public space; After the multi-agent collaborative task is completed, the private space receives the anonymized output from the public space through an encrypted channel. ; Step 6: Perform reverse mapping of the privacy box; Private space intelligent agents access protected privacy box components Privacy box component It stores a two-way mapping relationship between privacy entities and placeholders. By calling the reverse mapping function Accurately locate the answer Each placeholder in and replace it with the original corresponding real privacy entity. ; The mapping and restoration process is shown in formula (6): ； Step 7: Generate the deanonymized final answer; The deanonymized agent performs final semantic checks and layout optimizations on the restored text to ensure a perfect integration of the original privacy information with the professional advice and logical reasoning results generated in the public space; ultimately generating an original answer that contains both complete privacy details and high-quality professional insights. The final output process is shown in formula (7) and presented to the end user.

2. The multi-agent privacy protection method based on a private-public space paradigm as described in claim 1, characterized in that, In the fifth step described above, It includes the logically enhanced text generated in steps three and four, and key privacy-sensitive areas are still filled with placeholders.

3. The multi-agent privacy protection method based on a private-public space paradigm as described in claim 2, characterized in that, The placeholders mentioned above are adopted <name-1>or <location-1> 。< / location-1> 4. The multi-agent privacy protection method based on a private-public space paradigm as described in claim 1, characterized in that, The fourth step, specifically, involves an iterative game theory mechanism: an expert agent generates a counterfactual answer. Then, the auxiliary intelligent agent judges whether there is a logical contradiction, as shown in formula (4): ； If a contradiction is detected, the original proposition is confirmed. If true, output the result. The calculation process is shown in formula (5):

Images