Spatial heterogeneous differential privacy computing method and system for national space partition planning

Abstract

The present application provides a kind of spatial heterogeneous differential privacy calculation method and system for land space zoning planning, comprising: obtaining land space zoning planning vector data containing land attribute, planning purpose and plot area, and carrying out encoding and normalization preprocessing;Based on the spatial geometry of plot, topological graph is constructed, and after spatial autocorrelation test, heterogeneous partition is carried out, to form several spatial clusters and independent areas;For each spatial cluster, the spatial expansion sensitivity considering planning consistency constraint is calculated, the constraint is embodied as the change of central plot triggers the cascade adjustment of its multi-order spatial neighbors;According to the structure privacy leakage degree of each spatial cluster, a convex optimization model is established to allocate heterogeneous privacy budget, and the structure privacy leakage degree comprehensively reflects the size of spatial cluster, the strength of spatial correlation and the sensitivity level;Through spectral norm constraint, it is ensured to meet the mathematical definition of approximate differential privacy;Adaptive iterative optimization is executed, and the privacy parameter is dynamically adjusted according to the spatial weighted relative error until convergence.

Description

Technical Field

[0001] This invention relates to the field of data analysis, and in particular to a spatial heterogeneous differential privacy computing method and system for national land spatial zoning planning. Background Technology

[0002] Land spatial zoning planning vector data contains sensitive information such as land parcel types, planned uses, and spatial locations. Direct release of this data could lead to the identification of specific land parcels or the inference of undisclosed planning intentions. Differential privacy (DP), as a strict mathematical privacy protection framework, achieves privacy protection by adding calibrated noise to statistical queries. Traditional differential privacy is divided into pure ε-differential privacy (Pure DP) and (ε,δ)-approximate differential privacy (Approximate DP). The former requires strict probability ratio constraints, while the latter allows for privacy failure with an extremely small probability of δ, but can generate relevant noise through Gaussian mechanisms, making it more suitable for high-dimensional spatial data. Existing technologies applied to land spatial data have the following drawbacks: Mismatch between privacy definition and mechanism: Existing technology CN118504659A uses LFL-DP, which mathematically cannot meet the strict definition, leading to privacy guarantee failure. Traditional DP assumes that data records are independent, but land spatial data has significant spatial autocorrelation. When noise is added to the query results for parcel A, the spatial correlation between parcel A and its neighboring parcel B can be used to partially reconstruct the noise value through inference attacks, leading to privacy budget leakage. The standard Laplace mechanism adds independent and identically distributed noise, which disrupts the inherent spatial autocorrelation structure (Moran's I) of land spatial data, causing subsequent applications such as spatial interpolation and cluster analysis to fail.

[0003] This demonstrates that traditional data processing methods struggle to effectively protect data privacy while ensuring data availability. Current differential privacy calculation methods for vector data in land spatial zoning planning are inadequate, lacking efficient, secure, and easily implemented solutions. This necessitates that those skilled in the art address these technical challenges. Summary of the Invention

[0004] To achieve the above-mentioned objectives of this invention, this invention provides a Spatially Heterogeneous Approximate Differential Privacy (SH-ADP) computation method, uniformly defined within the (ε,δ)-differential privacy framework. Through a spatial extension sensitivity model, a privacy leakage compensation mechanism, and a spatially correlated Gaussian noise mechanism, it achieves efficient privacy computation of spatially correlated data under strict mathematical guarantees.

[0005] This invention discloses a spatial heterogeneous differential privacy calculation method for national land spatial zoning planning, comprising: acquiring national land spatial zoning planning vector data containing land type attributes, planned uses, and plot areas, and performing encoding and normalization preprocessing; constructing a topology map based on plot spatial geometry, and performing heterogeneous zoning after spatial autocorrelation testing to form several spatial clusters and independent regions; calculating the spatial expansion sensitivity of each spatial cluster considering planning consistency constraints, wherein the planning consistency constraints are reflected in the cascading adjustments of its multi-order spatial neighbors triggered by changes in the central plot; establishing a convex optimization model to allocate heterogeneous privacy budget based on the structural privacy leakage degree of each spatial cluster, wherein the structural privacy leakage degree comprehensively reflects the size of the spatial cluster, the strength of spatial correlation, and the level of sensitivity; generating a spatially correlated Gaussian noise mechanism based on the spatial covariance matrix and Cholesky decomposition, and ensuring that the mathematical definition of approximate differential privacy is met through spectral norm constraints; and performing adaptive iterative optimization, dynamically adjusting the privacy failure probability according to the spatial weighted relative error until convergence.

[0006] In the preferred embodiment of the above technical solution, the normalization preprocessing specifically includes: establishing a mapping function from the set of land category names to the set of identifiers, and a mapping function from the set of planned uses to the set of identifiers; performing minimum-maximum normalization processing on the land parcel area to map the numerical range to the interval between 0 and 1; constructing an undirected graph based on the polygon coordinates of the land parcels to determine the spatial adjacency relationship, spatial neighbor set, and spatial degree between land parcels.

[0007] In the preferred embodiment of the above technical solution, the heterogeneous partitioning and spatial expansion sensitivity specifically include: calculating the global Moran's I index to assess spatial autocorrelation, and triggering spatial heterogeneous partitioning if it exceeds a set threshold; using spatial constraint spectral clustering to divide the spatial topology map into several spatial clusters and independent regions to ensure spatial continuity within the spatial clusters, high internal correlation, and low boundary correlation; redefining the adjacent datasets based on spatial cascade changes, and calculating the spatial expansion sensitivity of each spatial cluster, wherein the sensitivity is determined comprehensively based on local sensitivity, spatial neighbor order, average spatial degree, and spatial decay coefficient.

[0008] In the preferred embodiment of the above technical solution, the cascading adjustment of multi-level spatial neighbors specifically includes: selecting a central plot and modifying its land type or area attribute; triggering a set number of spatial neighbors to perform cascading adjustments, wherein the number of neighbors is determined by the planned spatial influence radius; the adjustment range decreases exponentially as the map distance between the plot and the central plot increases; and the spatial expansion sensitivity is the sum of the local sensitivity and the sensitivity contributions of each level of neighbors.

[0009] In the preferred embodiment of the above technical solution, the allocation of structural privacy leakage degree and heterogeneous privacy budget specifically includes: quantifying structural privacy leakage degree based on the proportion of plots in spatial clusters, the absolute value of Moran's I index, and the normalized relative value of local sensitivity; establishing a convex optimization model with the objectives of minimizing total noise variance and weighted privacy leakage penalty, and solving the privacy budget of each spatial cluster that satisfies the total budget constraint through the Lagrange duality method, wherein spatial clusters with high leakage degree are subject to relatively higher privacy costs.

[0010] In the preferred embodiment of the above technical solution, the spatially correlated Gaussian noise mechanism specifically includes: constructing a spatial covariance matrix reflecting the exponential decay relationship of Euclidean distance between plots based on the spatial expansion sensitivity and privacy budget of each spatial cluster; performing Cholesky decomposition on the covariance matrix to obtain a decomposition factor; using this factor to transform the standard Gaussian noise vector into a spatially correlated noise vector; and ensuring that the noise mechanism strictly meets the calibration conditions for approximate differential privacy by constraining the upper limit of the spectral norm of the decomposition factor.

[0011] In the preferred embodiment of the above technical solution, the adaptive iterative optimization specifically includes: evaluating the calculation accuracy based on a relative error index weighted by the size of the spatial cluster, wherein the index comprehensively considers the deviation between the differential privacy results and the true values ​​of each spatial cluster; setting a target error threshold and a privacy failure probability threshold; when the calculation error exceeds the target value or the privacy failure probability exceeds the upper limit, adaptively adjusting the planned spatial influence radius, spatial attenuation coefficient, or privacy failure probability, and re-executing partitioning, budget allocation, and noise generation until the convergence condition is met.

[0012] The present invention also discloses a computer system, comprising:

[0013] processor;

[0014] Memory used to store processor-executable instructions;

[0015] The processor is configured to implement the method when executing the executable instructions.

[0016] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0017] The definition of adjacent datasets for "spatial cascading changes" based on planning consistency constraints extends dynamic programming (DP) theory from independent records to structurally related data, thereby establishing structural privacy leakage levels. The quantitative model achieves heterogeneous budget allocation through convex optimization, addressing the privacy-utility imbalance problem among spatial clusters. By employing Cholesky decomposition and spectral norm constraints, it realizes the generation of spatially correlated Gaussian noise satisfying (ε,δ)-ADP adaptive dynamic programming, breaking through the traditional independent noise assumption.

[0018] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0020] Figure 1 This is a schematic diagram of the overall invention. Detailed Implementation

[0021] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0022] like Figure 1 As shown, this invention discloses a spatial heterogeneous differential privacy computing method and system for territorial spatial zoning planning, comprising the following steps:

[0023] S1 retrieves vector data D from the national land spatial zoning plan, containing the attribute set Attr (land type name, planned use, land parcel area) and spatial geometric information. (Polygon coordinates, topological relationships) to ensure the accuracy and integrity of the data.

[0024] Specifically, S1 includes:

[0025] S1-1, classify and encode the land category names, for example, using a numerical coding system to assign a unique integer code to each land category name. Let the original set of land category names be L, and the set of encoded land category identifiers be C, then the coding mapping function is:

[0026] ;in: C is the set of original land category names, serving as the domain; C is the set of encoded land category identifiers, serving as the codomain. This is a land category encoding mapping function;

[0027] S1-2, Encode the planned uses to convert them into numerical data. Let the original set of planned uses be P, and the set of encoded planned use identifiers be U. Then the encoding mapping function is:

[0028] Where g is the planned use coding mapping function;

[0029] S1-3, normalize the land parcel area data to make it range between [0,1], in order to reduce calculation errors; let the original land parcel area dataset be... Where n is the total number of land parcels, and the following conditions must be met: ; The smallest area among all plots; The maximum area among all plots is obtained; the area of ​​each plot is normalized by minimization and maximization, and the normalized area dataset is as follows. Then the normalization formula is:

[0030] ;in, Let be the original area of ​​the i-th plot; Let be the normalized area of ​​the i-th plot;

[0031] S1-4, Construct a spatial topology graph, building an undirected graph based on the spatial geometry of the land parcels. =(V,E), where the vertex set is... Let E represent a land parcel, and let E represent the spatial adjacency relationship. The spatial adjacency relationship is determined based on the spatial topological intersection relationship of the polygon boundaries of the land parcels: when the polygon boundaries of land parcel i and land parcel j have a non-zero length shared edge segment, it is determined that the two have a spatial adjacency relationship, which is denoted as an adjacent edge. Plots that share only vertices but no edges are not considered spatially adjacent; define an adjacency matrix W, where elements are:

[0032] ;

[0033] Define land parcel Spatial Neighbor Sets Spatial degree , .

[0034] S2, Spatial heterogeneous partitioning and spatial expansion sensitivity calculation;

[0035] S2-1: Spatial autocorrelation test, calculating the global Moran's-I index to assess spatial autocorrelation:

[0036] ;in, The mean of the normalized area. The sum of the elements of the adjacency matrix; if Spatial autocorrelation threshold The range [0.2, 0.5] is chosen. This range is determined based on the empirical grading standard of Moran's I index in spatial statistics. When I > 0.2, it indicates that the parcel attributes have a moderate or higher degree of spatial autocorrelation, making it suitable to adopt a spatial heterogeneous zoning strategy to reduce aggregation error. When I < 0.5, the degree of spatial autocorrelation has not yet reached an extremely strong level, and heterogeneous sub-regions can still be effectively separated by spectral clustering. This is considered a spatially random distribution, and there is no need to trigger a spatial heterogeneous partitioning strategy; if If the spatial autocorrelation is too strong, then take An upper limit of 0.5 can still ensure the effectiveness of spatial heterogeneous partitioning.

[0037] S2-2: Implement a spatial heterogeneous partitioning strategy and use spatially constrained spectral clustering to visualize the spatial topology. Divided into k spatial clusters and independent district The following conditions must be met:

[0038] Spatial continuity: each Connected in space;

[0039] High internal correlation: average spatial correlation coefficient within a spatial cluster ;

[0040] Low correlation at the boundary: Spatial correlation coefficient between spatial clusters , For space clusters With space clusters The mean spatial correlation coefficient of all cross-boundary adjacent block pairs.

[0041] S2-3 performs spatial expansion sensitivity calculation. Considering the planning consistency constraints of national spatial planning, with privacy budget parameter ε and upper limit of privacy failure probability δ, it redefines the neighboring datasets under the (ε,δ) differential privacy framework. Let D and D′ be the neighboring datasets, both composed of vector data preprocessed in S1, if and only if a unique central parcel exists. Its area change is Δa, and D′ is obtained from D through the following spatial cascade transformation:

[0042] Normalized area change Local sensitivity ;

[0043] Select this unique central plot. Modify its land category or area attribute;

[0044] This triggers cascading adjustments to its multi-order spatial neighbors, where the order ℓ is the planned spatial influence radius r, which can be taken as r=1 or 2; the magnitude of the cascading adjustment follows a spatial decay function. ,in To and The graph distance, γ∈(0,1) is the attenuation coefficient; the planning spatial influence radius r is taken as 1 or 2, determined according to the neighborhood propagation law of land parcel attribute changes in land spatial planning practice. r=1 corresponds to the direct influence range, i.e., the adjacent parcels, and r=2 corresponds to the indirect influence range, i.e., propagation across parcels. The planning cascading effect beyond second-order neighbors can be ignored under the conventional land spatial planning scale. The spatial attenuation coefficient γ∈(0,1) is determined according to the spatial interaction distance attenuation law. This open interval ensures that the graph distance increases with the attenuation coefficient. As γ increases, the adjustment magnitude decreases exponentially, which conforms to the basic law of geography that spatial correlation weakens with increasing distance; when γ approaches 0, the decay is extremely rapid, and when it approaches 1, the decay is gradual. The actual value needs to be determined within the range based on the transmission strength of the planning policy.

[0045] Regarding the boundedness of space expansion sensitivity, for summation queries S represents the query region. Under the (ε,δ)-differential privacy framework, the spatial expansion sensitivity is... satisfy:

[0046] ;

[0047] in, Local sensitivity after normalization Let v be the ℓth order neighbor set. ; max traverse the topology of the space For all vertices v∈V, obtain the sum of the sensitivity contributions of each level of neighbors.

[0048] S2-4, perform heterogeneous sensitivity stratification for each spatial cluster. calculate:

[0049] Spatial expansion sensitivity within a spatial cluster ,in The average ℓ-order degree within the spatial cluster. ;, Let l be the degree of vertex v. For independent regions Sensitivity to spatial expansion of independent zones Unaffected by cascading effects; subscript 0 corresponds to an independent region. ;

[0050] S3: Privacy breach compensation and heterogeneous budget allocation;

[0051] S3-1: Quantifying Privacy Leaks in Spatial Clusters Define the degree of privacy leakage in the structure:

[0052] ;in, Let k be the number of plots in cluster k. Let be the Moran's I index of cluster k, calculated on the intra-cluster subgraph and adjacency submatrix according to the S2-1 formula; This refers to the maximum absolute value of Moran's I index for each cluster. The larger the cluster size, the stronger the correlation, and the higher the sensitivity, the greater the risk of privacy breach.

[0053] S3-2: Implement a privacy breach compensation mechanism, assuming a total privacy budget of [missing information]. , need to Assigned to various spatial clusters and independent regions. Establish a convex optimization model:

[0054] ;

[0055] The constraints are: , λ≥0 is the penalty coefficient. The privacy budget is allocated to cluster k; the objective function is analyzed, the first term is the utility loss total noise variance, which minimizes the query error; the second term is the weighted privacy leakage penalty, which imposes additional privacy costs on high-leakage spatial clusters; using the Lagrange dual method, a closed-form solution is obtained: Where μ is a Lagrange multiplier that satisfies the total budget constraint, and is solved through a binary search to ensure that... .

[0056] S4: Spatial correlated Gaussian noise mechanism (SCGM)

[0057] S4-1 defines a differential privacy mechanism. The random mechanism M satisfies (ε,δ)-approximate differential privacy if and only if for any spatially adjacent datasets D and D′, denoted as... and any set of outputs :

[0058] ;

[0059] Where ε>0 is the privacy budget parameter, δ∈(0,1) is the upper limit of the privacy failure probability, and the initial value of 0.01 is set according to the conventional calibration practice of approximate differential privacy, and is adjusted during the iterative optimization process according to... Range adjusted downwards; e is the natural constant; Range( ) represents a random mechanism The output range.

[0060] S4-2, construct the spatial covariance matrix and generate noise for each spatial cluster. Constructing the spatial covariance matrix :

[0061] ; among which, according to ( ,δ)-Differential privacy Gaussian mechanism calibration theorem, Here, dist(i,j) represents the differential privacy noise variance, and dist(i,j) represents the Euclidean distance between plots i and j. >0 represents the spatially relevant scale parameter; determined based on the positive definiteness requirement of the spatial covariance function and the effective range of geographical phenomena: taking a positive value ensures the covariance matrix... It is strictly positive definite and ensures that spatial correlation decreases monotonically with increasing Euclidean distance, which is consistent with the law that the correlation of geographic elements in territorial spatial data weakens with increasing distance.

[0062] Generate noise vector Follows a multivariate Gaussian distribution Based on the summation query defined in S2-3, the spatial clusters are... Get the query range S= To obtain the spatial cluster-level summation query Its true value is .because For | The |-dimensional noise vector, whose total noise contribution to the spatial cluster-level summation query is the sum of the components of the noise vector, is denoted as the noise-added differential privacy query output.

[0063] ,in Represents the noise vector The j-th component, to ensure that ( ,δ) - Differential privacy, calibrated via Cholesky decomposition of the covariance matrix: ;in, for The Cholesky decomposition factor needs to satisfy the following conditions: , Let be a standard Gaussian noise vector, where for 3D identity matrix;

[0064] Privacy calibration conditions through constraints The spectral norm satisfies: ;

[0065] Ensuring Mechanism Strictly meet ( ,δ) - Differential privacy; where ε k For spatial cluster C k The allocated privacy budget uses a uniform upper limit δ for the probability of privacy failure across all spatial clusters.

[0066] S5: Adaptive Verification and Iterative Optimization

[0067] S5-1: Perform error evaluation. Suppose that the same query is subjected to K independent repeated experiments, K≥100; each experiment independently executes the spatial correlation Gaussian noise mechanism in S4 to obtain a differential privacy query output, and denotes the true query result of the k-th cluster as... The differential privacy query result is The superscript 'true' represents the undenoised true value, and 'dp' represents the differential privacy value after adding noise. The spatially weighted relative error is calculated as follows:

[0068] ;

[0069] S5-2: Perform adaptive adjustment and set the target error threshold. Privacy failure probability threshold ,in Based on the industry accuracy requirements for land and space planning statistics, a relative error of 5% to 10% is considered within the theoretical accuracy loss range in application scenarios such as planning land area aggregation, plot ratio statistics, and ecological red line calculation. Based on engineering practices in the field of differential privacy and security, this magnitude is comparable to δ= widely used in federated learning and privacy-preserving database systems. Consistent safety standards For higher security requirements, both together constitute an implementable security boundary. If Or the current probability of privacy failure δ> Then, the following adaptive adjustments will be performed: increase the spatial influence radius r of the planning area, setting r = r + 1; or decrease the spatial attenuation coefficient γ, setting γ = γ·0.9; or lower the upper limit of the privacy failure probability, setting δ = δ / 2, and recalibrate the Cholesky decomposition factor according to S4. ;because The spectral norm constraint is related to δ; if δ is reduced, it needs to be recalculated. To meet the updated ( ,δ)-Differential privacy conditions.

[0070] Re-execute S2-S4 until... and .

[0071] This invention also provides a spatial heterogeneous differential privacy computing system for territorial spatial zoning planning, the system comprising:

[0072] The data acquisition module is used to acquire vector data D from the national land spatial zoning plan, encode and map land category names and planned uses, normalize land parcel areas, and construct a spatial topology map. =(V,E), outputs the preprocessed attribute set and adjacency matrix;

[0073] The spatial heterogeneous partitioning module, connected to the data acquisition module, receives preprocessed vector data, calculates the global Moran's I index, and, when significant spatial autocorrelation exists, uses spatially constrained spectral clustering to divide the land parcels into k spatial clusters. with independent district And calculate the spatial expansion sensitivity of each spatial cluster. Sensitivity to independent regions ;

[0074] The privacy budget allocation module, connected to the spatial heterogeneous partitioning module, is used to allocate privacy based on the structural privacy leakage level of each spatial cluster. A convex optimization model is established, and the privacy budget of each spatial cluster is solved using the Lagrange duality method. This ensures that the total privacy budget meets ;

[0075] The spatially relevant noise generation module, connected to the privacy budget allocation module, is used to allocate privacy budgets for each spatial cluster. With sensitivity Calculate noise variance Construct the spatial covariance matrix Gaussian noise vectors with spatial correlation structure are generated through Cholesky decomposition. And noise is added to the query results of each spatial cluster;

[0076] The adaptive verification module, connected to the spatial correlation noise generation module, is used to calculate the spatial weighted relative error. When the error or privacy failure probability exceeds the threshold, the spatial influence radius r, spatial attenuation coefficient γ, or upper limit of privacy failure probability δ is adaptively adjusted, and the spatial heterogeneous partitioning module, privacy budget allocation module, and spatially related noise generation module are triggered to re-execute, forming a closed-loop iteration.

[0077] The implementation example of this solution is as follows:

[0078] S1. Obtain the land spatial zoning planning vector data containing 6 plots. The original plot attributes are as follows: Plot 1 is cultivated land, planned use is agricultural area, area 120.5 hectares; Plot 2 is cultivated land, planned use is agricultural area, area 95.3 hectares; Plot 3 is forest land, planned use is ecological protection area, area 200.0 hectares; Plot 4 is forest land, planned use is ecological protection area, area 175.5 hectares; Plot 5 is construction land, planned use is urban construction area, area 80.0 hectares; Plot 6 is construction land, planned use is urban construction area, area 65.2 hectares.

[0079] Establish a mapping function from the set of land category names to the set of identifiers: arable land is mapped to 1, forest land to 2, and construction land to 3, resulting in the land category code set C={1,1,2,2,3,3}. Establish a mapping function from the set of planned uses to the set of identifiers: agricultural areas → 1, ecological protection areas → 2, urban construction areas → 3, resulting in the planned use identifier set U={1,1,2,2,3,3}.

[0080] Normalize the land parcel areas. The original land parcel area dataset A={120.5,95.3,200.0,175.5,80.0,65.2}, with a total of n=6 parcels; the calculated values ​​are... =65.2, =200.0. Minimum-maximum normalization is applied to the area of ​​each plot:

[0081] =(120.5−65.2) / (200.0−65.2)=55.3 / 134.8=0.4102,

[0082] =(95.3−65.2) / (200.0−65.2)=30.1 / 134.8=0.2233,

[0083] =(200.0−65.2) / (200.0−65.2)=134.8 / 134.8=1.0000,

[0084] =(175.5−65.2) / (200.0−65.2)=110.3 / 134.8=0.8182,

[0085] =(80.0−65.2) / (200.0−65.2)=14.8 / 134.8=0.1098,

[0086] =(65.2−65.2) / (200.0−65.2)=0 / 134.8=0.0000.

[0087] The normalized area dataset A'={0.4102,0.2233,1.0000,0.8182,0.1098,0.0000}.

[0088] Constructing a spatial topology map based on the coordinates of land parcel polygons =(V,E), where the vertex set is... Edge set E={( ),( ),( The adjacency matrix W is:

[0089] W=[0 1 0 0 0 0; 1 0 0 0 0 0; 0 0 0 1 0 0; 0 0 1 0 0 0; 0 0 0 0 0 1; 00 0 0 1 0].

[0090] The spatial degrees of each parcel are: deg1=1, deg2=1, deg3=1, deg4=1, deg5=1, deg6=1. The spatial neighbor sets are: N(1)={2}, N(2)={1}, N(3)={4}, N(4)={3}, N(5)={6}, N(6)={5}.

[0091] Step S2: Spatial autocorrelation test and heterogeneous partitioning. Calculate the global Moran's I exponent:

[0092] Normalized area mean

[0093] =(0.4102+0.2233+1.0000+0.8182+0.1098+0.0000) / 6=2.5615 / 6=0.4269.

[0094] Sum of elements in the adjacency matrix =2×3=6; 3 edges, each edge appears twice in the matrix.

[0095] molecular =1×(0.4102−0.4269)×(0.2233−0.4269)+1×(0.2233−0.4269)×(0.4102−0.4269)+1×(1.0000−0.4269)×(0.8182−0.4269)+1×(0.8182−0.4269)×(1.0000−0.4269)+1×(0.1098−0.4269)×(0.0000−0.4269)+1×(0.0000−0.4269)×(0.1098−0.4269)

[0096] =1×(−0.0167)×(−0.2036)+1×(−0.2036)×(−0.0167)+1×(0.5731)×(0.3913)+1×(0.3913)×(0.5731)+1×(−0.3171)×(−0.4269)+1×(−0.4269)×(−0.3171)

[0097] =0.00340+0.00340+0.22425+0.22425+0.13537+0.13537=0.72604.

[0098] denominator =(0.4102−0.4269) 2 +(0.2233−0.4269) 2 +(1.0000−0.4269) 2 +(0.8182−0.4269) 2 +(0.1098−0.4269) 2 +(0.0000−0.4269) 2

[0099] =0.000279+0.04145+0.32844+0.15312+0.10055+0.18225=0.80609.

[0100] Global Moran's I = (6 / 6) × (0.72604 / 0.80609) = 1 × 0.9007 = 0.9007.

[0101] Set spatial autocorrelation threshold =0.3. Since I=0.9007> =0.3, triggering heterogeneous partitioning.

[0102] Spatial constrained spectral clustering is used to divide the spatial topology graph into spatial clusters. ={Plot 1, Plot 2}, Spatial Cluster ={Plot 3, Plot 4}, Independent Zone ={Plot 5, Plot 6}. Average spatial correlation coefficient within the spatial cluster. =1.0000, =1.0000.

[0103] S2−3 performs spatial expansion sensitivity calculations. Let D and D′ be adjacent datasets, both composed of vector data preprocessed in S1. A unique central parity exists if and only if such a dataset exists. The area change Δa = 1.0 hectares causes the adjacent dataset D′ to modify the area of ​​plot 2 from 95.3 hectares to 96.3 hectares. The planning spatial influence radius r = 1, and the spatial attenuation coefficient γ = 0.5. Normalized area change. =1.0 / (200.0−65.2)=1.0 / 134.8=0.007418. Local sensitivity =0.007418.

[0104] The spatial decay function is ,in To and The graph distance of its first-order neighbors on the spatial topology graph. For spatial cluster C1, considering the worst-case scenario where the central parity is located within the spatial cluster, the graph distance of its first-order neighbors on the spatial topology graph is... =1, spatial cluster The average first degree within the cluster .

[0105] Space clusters Spatial expansion sensitivity: =0.007418×(1+0.5×1)=0.007418×1.5=0.01113. Similarly, spatial clusters Spatial expansion sensitivity: .

[0106] Independent District Spatial expansion sensitivity: =0.007418.

[0107] S3 allocates the privacy budget.

[0108] S3−1, calculates the structural privacy leakage rate. The parameters of each spatial cluster are as follows: | |=2, =0; | |=2, =0.9007; | |=2, =0.9007. =0.9007.

[0109] Structural privacy leakage =(2 / 6)×(0.9007 / 0.9007)×(0.01113 / 0.007418)=0.5; Similarly =0.5; =0.

[0110] S3−2: Convex optimization for privacy budget. Setting the total privacy budget. =1.0, penalty coefficient λ=0. Establish a convex optimization model: the differential privacy budgeting field typically... =1.0 serves as an empirical balance point between weak privacy protection and data availability, suitable for land and space planning data sharing scenarios. When the penalty coefficient λ=0, the convex optimization model degenerates into pure query utility optimization; when λ>0, a privacy leakage penalty is introduced, the magnitude of which needs to be calibrated within the range of [0,10] according to the data sensitivity level. In this embodiment, λ=0 is taken to highlight the basic allocation mechanism.

[0111] The objective is to minimize The constraints are =6.0. Using the Lagrange duality method, a closed-form solution is obtained. , where μ is a Lagrange multiplier that satisfies the total budget constraint. =0.01113、 =0.01113、 Substituting 0.007418 into the constraint equation:

[0112] ;

[0113] Right now Solving for =0.01399, =0.0001958. Therefore, the privacy budget for each spatial cluster is: =(√2×0.01113) / 0.01399=1.12; =1.12; =(√2×0.007418) / 0.01399=0.75. Constraint verification: =2×1.12+2×1.12+2×0.75=2.24+2.24+1.50=5.98≈6.0, which satisfies the constraint conditions.

[0114] .

[0115] S4, spatially correlated Gaussian noise generation.

[0116] S4−1 executes the differential privacy mechanism. The random mechanism M is defined in the (ε,δ)− approximate differential privacy framework, where ε=1.0 and the upper bound of the privacy failure probability δ=0.01. For any neighboring datasets D and D′, and any output set S, the following condition is satisfied: .

[0117] S4−2, Spatial covariance matrix and noise generation process in spatial clusters For example, spatial expansion sensitivity =0.01113, Privacy Budget =1.12.

[0118] noise variance =2×(0.01113 / 1.12) 2 =2×0.00009887=0.0001977.

[0119] The Euclidean distance between plots, dist(1,2)=1.0, is the normalized unit, representing the spatially relevant scale parameter. =2.0.

[0120] covariance matrix It is a 2×2 matrix:

[0121] ;

[0122]

[0123] right Cholesky decomposition yields =[0.01406,0;0.008528,0.01113].

[0124] Verification:

[0125] =[0.01406 2 ,0.01406×0.008528;0.01406×0.008528,0.008528 2 +0.01113 2 ]

[0126] =[0.0001977,0.0001199;0.0001199,0.0001977]= The decomposition is correct.

[0127] Generate standard Gaussian noise vector , obeys N(0, ),in It is a 2×2 dimensional identity matrix.

[0128] The spatially correlated noise vector is,

[0129] .

[0130] .

[0131] Differential privacy query results .

[0132] For space clusters Perform the same spatial correlation Gaussian noise mechanism to generate a standard Gaussian noise vector. The noise component is obtained. =0.000703, =0.000897, noise sum is 0.0016. Actual query results. =1.0000 + 0.8182 = 1.8182, Differential Privacy Query Result =1.8182+0.0016=1.8198.

[0133] Independent Zone Perform the same mechanism to generate a standard Gaussian noise vector. The noise component is obtained. =0.001406, =0.001294, noise sum is 0.0027. Actual query results. =0.1098 + 0.0000 = 0.1098, Differential Privacy Query Result =0.1098+0.0027=0.1125.

[0134] S5 performs adaptive iterative optimization.

[0135] S5−1, with K=100 independent experiments, evaluate the deviation between the differential privacy query results and the true values ​​for each spatial cluster. The results for each spatial cluster are as follows: of =0.1098, =0.1125; of =0.6335, =0.6374; of =1.8182, =1.8198.

[0136] Spatial weighted relative error =[2×|0.1125−0.1098|+2×|0.6374−0.6335|+2×|1.8198−1.8182|] / [2×0.1098+2×0.6335+2×1.8182]

[0137] =[2×0.0027+2×0.0039+2×0.0016] / [0.2196+1.2670+3.6364]=[0.0054+0.0078+0.0032] / 5.1230

[0138] =0.0164 / 5.1230=0.0032=0.32%.

[0139] S5−2, Adaptive adjustment. Set the target error threshold. =0.05, or 5%, the privacy failure probability threshold. =0.001. Current =0.0032< =0.05, and the current privacy failure probability δ=0.01 satisfies the condition after S4 calibration. The iteration terminates because the convergence requirement is not met.

[0140] like If the threshold is exceeded, the spatial influence radius r is increased from 1 to 2, the spatial attenuation coefficient γ is decreased from 0.5 to 0.3, and S2 to S4 are re-executed until the threshold is met. and .

[0141] The specific beneficial effects of this invention are as follows:

[0142] Within the (ε,δ)-approximate differential privacy framework, a unified definition of spatial extension sensitivity is established, mathematically rigorously addressing privacy risks of spatially related data and avoiding contradictions in existing technologies. Based on the definition of "spatial cascading change" adjacent datasets under planning consistency constraints, DP theory is extended from independent records to structurally related data. This establishes a structural privacy leakage rate. The quantitative model achieves heterogeneous budget allocation through convex optimization, addressing the privacy-utility imbalance problem among spatial clusters. By employing Cholesky decomposition and spectral norm constraints, it realizes the generation of spatially correlated Gaussian noise satisfying (ε,δ)-ADP adaptive dynamic programming, breaking through the traditional independent noise assumption.

[0143] The entire system is defined within an (ε,δ) approximate differential privacy framework. The spatially correlated Gaussian noise mechanism strictly satisfies the privacy definition through spectral norm calibration, distinguishing it from existing technologies where the definition and mechanism do not match. A privacy leakage compensation mechanism quantifies the additional privacy risks caused by spatial correlation and prevents structural leakage by achieving heterogeneous budget allocation through convex optimization. The spatially correlated Gaussian noise mechanism maintains Moran's I exponent (retention rate >90%) while adding noise, supporting subsequent spatial analysis. A spatial cascading change model considering planning consistency constraints better reflects the actual data change patterns in national spatial planning.

[0144] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A spatially heterogeneous differential privacy computation method for territorial spatial zoning planning, characterized in that, include: Obtain vector data of national land spatial zoning planning that includes land category attributes, planned use and land parcel area, and perform encoding and normalization preprocessing; Based on the spatial geometry of the land parcels, a topology map is constructed. After spatial autocorrelation testing, heterogeneous partitioning is performed to form several spatial clusters and independent areas. For each spatial cluster, the spatial expansion sensitivity considering planning consistency constraints is calculated. The planning consistency constraints are reflected in the cascading adjustments of its multi-order spatial neighbors triggered by changes in the central land parcel. A convex optimization model is established based on the structural privacy leakage degree of each spatial cluster to allocate heterogeneous privacy budgets. The structural privacy leakage degree comprehensively reflects the size of the spatial cluster, the strength of spatial correlation, and the level of spatial expansion sensitivity. Based on the spatial covariance matrix and Cholesky decomposition, a spatially correlated Gaussian noise mechanism is generated. The mathematical definition of approximate differential privacy is ensured by spectral norm constraints. Adaptive iterative optimization is performed to dynamically adjust the privacy failure probability according to the spatial weighted relative error until convergence.

2. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The normalization preprocessing specifically includes: establishing a mapping function from the land category name set to the identifier set, and a mapping function from the planned use set to the identifier set; performing minimum-maximum normalization on the land parcel area to map the numerical range to the interval between 0 and 1; constructing an undirected graph based on the polygon coordinates of the land parcels to determine the spatial adjacency relationship, spatial neighbor set, and spatial degree between land parcels.

3. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The heterogeneous partitioning and spatial expansion sensitivity specifically include: calculating the global Moran's I index to assess spatial autocorrelation, and triggering spatial heterogeneous partitioning if it exceeds a set threshold; using spatially constrained spectral clustering to divide the spatial topology map into several spatial clusters and independent regions to ensure spatial continuity within the spatial clusters, high internal correlation, and low boundary correlation; redefining the neighboring datasets based on spatial cascading changes, and calculating the spatial expansion sensitivity of each spatial cluster, wherein the spatial expansion sensitivity is determined comprehensively based on local sensitivity, spatial neighbor order, average spatial degree, and spatial decay coefficient.

4. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The cascading adjustment of multi-level spatial neighbors specifically includes: selecting a central plot and modifying its land type or area attribute; triggering cascading adjustments of its spatial neighbors of a set order, wherein the order is determined by the planned spatial influence radius; the adjustment magnitude decreases exponentially as the map distance between the plot and the central plot increases; and the spatial expansion sensitivity is the sum of the local sensitivity and the sensitivity contributions of each level of neighbors.

5. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The structural privacy leakage degree and heterogeneous privacy budget allocation specifically include: quantifying the structural privacy leakage degree based on the proportion of plots in the spatial cluster, the absolute value of Moran's I exponent, and the normalized relative value of local sensitivity; establishing a convex optimization model with the objectives of minimizing the total noise variance and weighted privacy leakage penalty, and solving the privacy budget of each spatial cluster that satisfies the total budget constraint through the Lagrange dual method, wherein spatial clusters with high leakage degree are subject to relatively higher privacy costs.

6. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The spatially correlated Gaussian noise mechanism specifically includes: constructing a spatial covariance matrix reflecting the exponential decay relationship of Euclidean distance between plots based on the spatial expansion sensitivity and privacy budget of each spatial cluster; performing Cholesky decomposition on the spatial covariance matrix to obtain a decomposition factor; using this factor to transform the standard Gaussian noise vector into a spatially correlated noise vector; and ensuring that the noise mechanism strictly meets the calibration conditions for approximate differential privacy by constraining the upper limit of the spectral norm of the decomposition factor.

7. The spatial heterogeneous differential privacy calculation method for territorial spatial zoning planning according to claim 1, characterized in that, The adaptive iterative optimization specifically includes: evaluating the computational accuracy based on a relative error index weighted by the size of the spatial clusters, wherein the index comprehensively considers the deviation between the differential privacy results and the true values ​​of each spatial cluster; setting a target error threshold and a privacy failure probability threshold; when the computational error exceeds the target value or the privacy failure probability exceeds the upper limit, adaptively adjusting the spatial influence radius, spatial attenuation coefficient, or privacy failure probability, and re-executing partitioning, budget allocation, and noise generation until the convergence condition is met.

8. A computer system, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to implement the method of any one of claims 1 to 7 when executing the executable instructions.

Images