A heterogeneous sensitive data privacy protection method and system

Abstract

The present application relates to the technical field of information security, and more particularly to a heterogeneous sensitive data privacy protection method and system. The method comprises the following steps: acquiring multi-source heterogeneous sensitive data, and performing cross-modal semantic unit extraction according to the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data; constructing an object-level semantic trajectory according to the multi-domain semantic primitive data to obtain semantic trajectory fingerprint data; performing cross-modal coupling analysis on the semantic trajectory data to obtain semantic reconstruction risk data; identifying semantic path positioning on the semantic reconstruction risk data to obtain sensitive path data; performing disturbance suppression processing according to the sensitive path data to obtain privacy protection output data; and performing counterfactual re-identification verification according to the privacy protection output data to obtain protection effectiveness evaluation data. The present application realizes directional protection of privacy leakage by constructing a cross-modal semantic trajectory and positioning a minimum identifiable path, thereby reducing the risk of re-identification while maintaining usability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for protecting the privacy of heterogeneous sensitive data. Background Technology

[0002] With the development of big data technology, the application of heterogeneous data from different sources (such as user behavior logs, text records, business data, and relational data) in fusion analysis is becoming increasingly widespread. However, the fusion of multi-source data not only enhances data analysis capabilities but also brings new privacy leakage risks. Existing privacy protection methods mainly focus on single data domains, such as processing structured data through data anonymization, field generalization, or differential privacy. These methods typically involve perturbations at the field or record level, making it difficult to address the semantic relationships between multimodal data.

[0003] In practical applications, implicit semantic mapping relationships often exist between different data modalities. Even if the data of each modality is anonymized separately, attackers can still re-identify the object's identity through cross-modal semantic combinations. For example, by jointly analyzing behavioral time features, textual descriptions, and structured attributes, a unique combination of semantic features can be constructed, thereby recovering the user's identity information. Furthermore, existing methods typically focus on protecting the overall data and cannot effectively pinpoint the path that truly leads to privacy breaches. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention proposes a method and system for protecting the privacy of heterogeneous sensitive data, thereby resolving at least one of the aforementioned technical issues.

[0005] This application provides a method for protecting the privacy of heterogeneous sensitive data, the method comprising:

[0006] Acquire multi-source heterogeneous sensitive data, and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data;

[0007] Object-level semantic trajectories are constructed based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data;

[0008] Cross-modal coupling analysis is performed on semantic trajectory data to obtain semantic reconstruction risk data;

[0009] Semantic path localization is performed on semantic reconstruction risk data to obtain leakage sensitive path data;

[0010] Perturbation suppression processing is performed on the leaked sensitive path data to obtain privacy-protected output data;

[0011] Based on the privacy protection output data, counterfactual re-identification and verification are performed to obtain protection effectiveness assessment data.

[0012] This invention unifies features scattered across different data sources into a semantically related expression through cross-modal semantic unit extraction and object-level semantic trajectory construction, providing an analyzable foundation for implicit identity fingerprints. Through cross-modal coupling analysis and semantic reconstruction risk assessment, it identifies high-risk semantic relationships that may lead to re-identification under multi-source information combinations, improving risk perception accuracy from the source. By identifying semantic path localization and selecting the minimum identifiable path, the privacy leakage problem is refined from the overall data level to the path structure level, thereby representing key leakage links. Combined with a path-oriented targeted perturbation suppression strategy, intervention is only applied to high-risk semantic anchors, effectively weakening semantic fingerprint consistency while ensuring data availability. Through counterfactual re-identification verification, the processing results are evaluated from the attacker's perspective, examining whether identifiable paths still exist under information compression and perturbation conditions, achieving quantification and closed-loop optimization of privacy protection effectiveness.

[0013] Optionally, the cross-modal semantic unit extraction includes:

[0014] Modality segmentation is performed on multi-source heterogeneous sensitive data to obtain heterogeneous modal data;

[0015] Modal semantic feature data is obtained by parsing intramodal semantic features based on heterogeneous modal data;

[0016] By performing a unified semantic granularity mapping on modal semantic feature data, unified semantic data is obtained.

[0017] Semantic units are segmented based on unified semantic data to obtain multi-domain semantic primitive data.

[0018] In this invention, modality partitioning allows structured data, text data, and behavioral sequence data to be independently parsed within their respective semantic spaces, avoiding semantic confusion caused by direct cross-modal fusion. Key semantic information with expressive power is extracted through intra-modal semantic feature parsing, transforming the raw data into semantic feature representations usable for computational analysis. Through unified semantic granularity mapping, features expressing the same or similar semantics in different modalities are mapped to a unified semantic space, enabling cross-modal data to be aligned and compared. Semantic unit segmentation decomposes semantic expressions into semantic primitives with the smallest analyzable granularity, thereby constructing structured, multimodal consistent semantic foundation data.

[0019] Optionally, the object-level semantic trajectory construction includes:

[0020] Object-attribution aggregation is performed on multi-domain semantic primitive data to obtain object semantic data;

[0021] Semantic evolution sequence data is obtained by reconstructing temporal associations based on object semantic data.

[0022] Cross-modal coupling alignment is performed on semantic evolution sequence data to obtain multimodal semantic trajectory data;

[0023] Semantic trajectory fingerprint data is obtained by encoding the trajectory structure based on multimodal semantic trajectory data.

[0024] In this invention, object-level aggregation integrates semantic primitives from different data sources under a unified entity, avoiding the loss of associations caused by the fragmentation of cross-source information. Temporal association reconstruction restores the sequential relationships and evolutionary logic of semantic occurrences, transforming data from a static feature set into a dynamic behavioral sequence. Cross-modal coupling alignment fuses information expressing the same semantic or behavioral features from different modalities, enabling trajectory nodes to possess multi-dimensional semantic consistency, thereby improving the integrity and stability of semantic expression. Trajectory structure encoding unifies the sequential relationships, transition patterns, and combination features in the semantic sequence, forming a semantic trajectory fingerprint with discriminative capabilities.

[0025] Optionally, the cross-modal coupling analysis includes:

[0026] Modal decomposition is performed on semantic trajectory data to obtain cross-modal semantic data;

[0027] Semantic co-occurrence stability is calculated based on cross-modal semantic data to obtain semantic co-occurrence stability data;

[0028] Combinatorial uniqueness is evaluated based on semantic co-occurrence stability data to obtain semantic uniqueness data;

[0029] Based on semantic uniqueness data, reconfigurability inference is performed to obtain semantic reconstruction risk data.

[0030] This invention uses modal decomposition to restore the fused semantic trajectory into an independently analyzable cross-modal semantic set, allowing explicit expression of the relationships between different modalities. Semantic co-occurrence stability calculation represents the co-occurrence patterns of each semantic feature across different modalities and time dimensions, thereby screening out key semantic combinations with long-term consistent expression. Combinatorial uniqueness assessment analyzes the distribution characteristics of semantic combinations in the overall data space, identifying highly recognizable semantic structures that possess both rarity and stability. Reconstructability deduction verifies, from an attacker's perspective, whether the aforementioned semantic combinations can still recover the object's identity under incomplete information conditions, thus forming semantic reconstruction risk data.

[0031] Optionally, the semantic path identification and localization includes:

[0032] Semantic association graphs are constructed based on semantic reconstruction risk data to obtain semantic association graph data;

[0033] The semantic association graph data is used to extract identification paths, resulting in identification path data.

[0034] The recognition maintenance score is evaluated based on the recognition path data to obtain the recognition maintenance score data;

[0035] Based on the identification and maintenance data, path filtering is performed to obtain data on leaked sensitive paths.

[0036] This invention constructs a semantic association graph to structurally express the dependencies and propagation relationships between cross-modal semantics, explicitly presenting potential privacy leakage links in graph form. Through path extraction, candidate paths capable of supporting identity reconstruction are selected from complex semantic networks, avoiding reliance on single features or local relationships for judgment. By evaluating the recognition maintenance capability, the stability of paths is quantitatively analyzed based on their ability to maintain recognition under information perturbation or semantic compression conditions, thereby distinguishing high-risk paths with sustained recognition capabilities. Through path screening, only key paths that can maintain recognition capability under various perturbation scenarios are retained as leakage-sensitive paths.

[0037] Optionally, the path extraction includes:

[0038] The semantic association graph data is decomposed into path semantic units to obtain path node sequence data;

[0039] Based on the path node sequence data, node redundancy contribution is screened to obtain the retained node data;

[0040] The sub-path identifiability is verified on the retained node data to obtain sub-path identification data;

[0041] Minimum structure preservation extraction is performed on the sub-path identification data to obtain the identified path data.

[0042] This invention decomposes the path into semantic units, expanding the overall path into a sequence structure that can be analyzed node by node, allowing the role of each semantic node to be independently evaluated. By screening for redundant contributions, redundant semantics with little or no impact on the identification results are identified and eliminated, thus retaining the key nodes truly involved in identity differentiation. Through identifiability verification of sub-paths, different node combinations are reverse-checked at the identification result level to ensure that the retained structure is not only formally concise but also functionally effective in identification. Finally, through minimum-preservation structure extraction, the path skeleton that maintains unique object identification under minimal semantic information is determined.

[0043] Optionally, the recognition maintenance assessment includes:

[0044] The path semantic node structure is expanded on the identified path data to obtain path node structure data;

[0045] Path perturbation is performed based on the path node structure data to obtain path perturbation data;

[0046] The path disturbance data is identified and preserved through extrapolation to obtain identified and preserved data.

[0047] Based on the identification and preservation data, the minimum maintenance substructure is identified to obtain the maintenance substructure data;

[0048] The identification maintenance degree is calculated based on the maintenance substructure data and path perturbation data to obtain the identification maintenance degree data.

[0049] This invention structurally expands the semantic nodes of a path, making the composition and relationships of nodes within the path operable and providing a foundation for subsequent refined analysis. By constructing a path perturbation mechanism, it simulates various information compression scenarios such as node loss, modality weakening, and semantic ambiguity, thereby restoring the changes in actual data when it is perturbed or attacked. Through identification and preservation inference, it determines whether the path can still maintain its unique identification capability under different perturbation conditions, transforming path analysis from static structural judgment to dynamic identification capability assessment. Through minimum maintenance substructure identification, it extracts the core structure that still has identification capability under minimal semantic information, thus revealing the key supporting framework of the path. Combining perturbation response characteristics and the size of the maintenance substructure, it quantitatively calculates the path identification maintenance degree.

[0050] Optionally, the disturbance suppression process includes:

[0051] Semantic anchor point identification is performed based on the leaked sensitive path data to obtain sensitive anchor point data;

[0052] Based on the sensitive anchor point data, a path chain breaking strategy is generated to obtain disturbance constraint rule data;

[0053] The perturbation constraint rule data is used to perform targeted perturbation processing on multi-source heterogeneous sensitive data to obtain intermediate protection data;

[0054] The intermediate protected data is optimized by applying availability constraints to obtain privacy-preserving output data.

[0055] This invention utilizes semantic anchor point identification to extract key semantic nodes that play a crucial role in identity reconstruction from high-risk paths, shifting privacy protection from the overall data level to the critical structural level. Through path disruption strategies, differentiated perturbation rules are constructed for different types of semantic anchors, effectively weakening stable associations between semantic elements and blocking the formation of highly recognizable paths at their source. Targeted perturbation processing is applied to multimodal data, intervening only in key semantics involved in sensitive paths to avoid unnecessary impact on non-critical data, thereby reducing overall data information loss. Through availability constraint optimization, consistency correction and performance balancing are performed on the perturbed data, ensuring that the processing results maintain good analytical and modeling capabilities while meeting privacy protection requirements.

[0056] Optionally, the counterfactual re-identification verification includes:

[0057] Counterfactual attack samples are constructed based on privacy-preserving output data to obtain counterfactual input data.

[0058] Cross-modal re-identification data is obtained by performing cross-modal re-identification deduction based on counterfactual input data;

[0059] Minimum identifiable subset analysis is performed on cross-modal re-identification data to obtain identifiability assessment data;

[0060] Based on the identifiability assessment data, path recovery capability analysis is performed to obtain path residual risk data;

[0061] By integrating identifiability assessment data and path residual risk data, we obtain protection effectiveness assessment data.

[0062] This invention constructs counterfactual attack samples to simulate real-world attack scenarios without relying on explicit identity identifiers, making the evaluation process closer to the real threat environment. Through cross-modal re-identification deduction, it examines whether the perturbated data still possesses identity recovery capabilities under multi-source semantic combinations, thereby revealing potential privacy leakage risks. Through minimum identifiable subset analysis, it identifies key semantic combinations that still achieve recognition with minimal information, representing the recognition capability. Through path recovery capability analysis, it determines whether a reconstructable, highly identifiable path still exists after perturbation, assessing the effectiveness of privacy protection at the structural level. The identifiability assessment results are integrated with path residual risk to form multi-dimensional protection effectiveness assessment data.

[0063] Optionally, this application also provides a heterogeneous sensitive data privacy protection system for performing the heterogeneous sensitive data privacy protection method described above, the heterogeneous sensitive data privacy protection system comprising:

[0064] The cross-modal semantic unit extraction module is used to acquire multi-source heterogeneous sensitive data and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data.

[0065] The object-level semantic trajectory construction module is used to construct object-level semantic trajectories based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data.

[0066] The cross-modal coupling analysis module is used to perform cross-modal coupling analysis on semantic trajectory data to obtain semantic reconstruction risk data;

[0067] The semantic path identification and localization module is used to identify and locate the semantic path of semantic reconstruction risk data to obtain leaked sensitive path data.

[0068] The disturbance suppression processing module is used to perform disturbance suppression processing on the leaked sensitive path data to obtain privacy-protected output data;

[0069] The counterfact re-identification verification module is used to perform counterfact re-identification verification based on the privacy protection output data to obtain protection effectiveness assessment data.

[0070] The purpose of this invention is to transform heterogeneous information scattered across different data sources into a unified semantic expression with associated structure and temporal features through cross-modal semantic unit extraction and object-level semantic trajectory construction, enabling implicit identity features to be explicitly represented in the form of trajectory fingerprints. Through cross-modal coupling analysis and semantic reconstruction risk assessment, potential re-identifiable structures are identified from the perspective of semantic combination stability and uniqueness, effectively revealing implicit risks that are difficult to detect using traditional methods. By identifying semantic path localization and minimum maintenance structure analysis, risks are refined to the path level, accurately locating key leakage links that can maintain identification capabilities with minimal information. Through path breakage perturbation based on semantic anchors, high-risk paths are targeted and weakened, achieving efficient privacy protection while avoiding overall data distortion. Through counterfactual re-identification verification, the processing results are evaluated from the attacker's perspective in multiple dimensions. Combined with the analysis of the minimum identifiable subset and path recovery capability, quantitative feedback and closed-loop optimization of the protection effect are achieved. Attached Figure Description

[0071] Other features, objects, and advantages of this application will become more apparent from the following detailed description of the non-limiting embodiments, taken with reference to the accompanying drawings:

[0072] Figure 1 A flowchart illustrating the steps of a method for protecting privacy of heterogeneous sensitive data according to an embodiment is shown.

[0073] Figure 2 A flowchart illustrating the steps of a cross-modal semantic unit extraction method according to an embodiment is shown.

[0074] Figure 3 A flowchart illustrating the steps of an object-level semantic trajectory construction method according to an embodiment is shown.

[0075] Figure 4 A flowchart illustrating the steps of a cross-modal coupling analysis method according to one embodiment is shown.

[0076] Figure 5 A flowchart illustrating the steps of a semantic path identification and localization method according to an embodiment is shown.

[0077] Figure 6 A flowchart illustrating the steps of a disturbance suppression processing method according to one embodiment is shown.

[0078] Figure 7 A flowchart illustrating the steps of a counterfactual re-identification verification method according to an embodiment is shown.

[0079] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0080] The technical method of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0081] Furthermore, the accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. Functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor methods and / or microcontroller methods.

[0082] It should be understood that although the terms "first," "second," etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are used merely to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0083] Please see Figures 1 to 7 This application provides a method for protecting the privacy of heterogeneous sensitive data, the method comprising:

[0084] S1. Obtain multi-source heterogeneous sensitive data, and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data.

[0085] In one embodiment, the system accesses three types of data: structured tables (attribute fields), text logs (sentences / paragraphs), and behavioral sequences (event streams). The system performs modality segmentation and normalization, unifying timestamps to UTC, encoding category fields as discrete labels, and discretizing numerical fields into intervals based on quantiles. Subsequently, intra-modal semantic parsing is performed: for structured tables, (attribute name, interval / category) pairs are extracted; for text, (entity, relation, keyword) is extracted based on word segmentation and entity recognition; and for behaviors, event frequency and transition pairs are statistically analyzed within a preset time window. , As a precursor event, For subsequent events. The system constructs a cross-modal semantic mapping function. , This is a semantic mapping function (used to map features from different modalities to a unified semantic label space). These are the original modal semantic features (such as text entities or structured field values). To unify semantic labels, when two features satisfy semantic similarity ≥ Or, when the co-occurrence probability is ≥ p, it is mapped to the same semantic label. For example, this mapping function is constructed in the following way: combining a predefined semantic rule base with data-driven statistical results, when the semantic similarity of two features is not lower than a threshold... (For example, taking 0.7), or when the co-occurrence probability of the object semantic data is not lower than the threshold p (for example, taking 0.6), it is mapped to the same semantic label. The system performs semantic unit segmentation, breaking down the complex expression into the smallest semantic primitive. The source mode m, time t, and context c are added to form a triple. The system performs semantic unit segmentation, breaking down complex expressions into the smallest semantic primitives: for complex fields (such as "high-frequency users at night"), it is broken down into "time features (nighttime)" and "behavioral features (high-frequency access)"; for text phrases, it is broken down into independent entity and attribute semantics; for combined behavioral events, it is broken down into single event semantic units. Each semantic primitive is appended with a source modality. (e.g., structured, textual, or behavioral modalities), time and location (Time stamp or time interval) and context identifier c (such as the original sentence or record fragment) form semantic primitive data.

[0086] S2. Construct object-level semantic trajectories based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data;

[0087] In one embodiment, semantic primitives are aggregated into a set based on object identifier IDs (which can be obtained from user IDs, device IDs, or rule matching). , For object o, Identify the object with an ID. Let be the semantic primitives in the set. Sort the temporal primitives by t to obtain the sequence. , The semantic sequence ordered by time. As the earliest semantic primitive in time, These serve as semantic primitives for subsequent processing. For primitives with missing time signatures, relative sorting is performed based on dependency rules (derived from predefined business rules or historical data statistics, such as "browse → add to cart → pay"), in which case the primitives are sorted relatively. The system performs cross-modal alignment: if primitives from different modalities satisfy… and , For semantic similarity function, For the first A semantic primitive that participates in alignment. For the first A semantic primitive that participates in alignment. This is the semantic similarity threshold (e.g., 0.7). For the first The temporal positions corresponding to the semantic primitives involved in the alignment For the first The temporal positions corresponding to the semantic primitives involved in the alignment If the time proximity threshold is used (e.g., 30 minutes), then the nodes are merged into a single node. Through the above aggregation, sorting, and fusion processes, the system obtains multimodal trajectories. Encoding is based on multimodal trajectories, extracting features such as sequence features (n-gram transitions), frequency features (number of occurrences), periodic features (repetition rate within period P), and cross-modal coupling features. For example, sequence features are the transition patterns of n consecutive semantic units in a semantic sequence (e.g., 2-gram or 3-gram sequences; 2-gram is an ordered combination of any two adjacent semantic units in the semantic trajectory sequence, and 3-gram is an ordered subsequence of three consecutive semantic units in the semantic trajectory); frequency features are the number of times each semantic unit appears in the trajectory; periodic features are the proportion of semantic repetition within a preset period P (e.g., 24 hours) (i.e., the proportion of the number of times the same semantic unit appears repeatedly within that period relative to the total number of occurrences in that period); and cross-modal coupling features are the proportion of fused nodes to all nodes (i.e., the proportion of the number of fused nodes to the total number of trajectory nodes). These features are then concatenated into a fingerprint vector. Or stored in the form of a directed sequence graph (nodes are...) (The edges represent the transition relationship).

[0088] S3. Perform cross-modal coupling analysis on semantic trajectory data to obtain semantic reconstruction risk data;

[0089] In one embodiment, the trajectory is split into sets according to mode. , Let m be the set of semantic primitives for the m-th modality (e.g., text modality set, behavioral modality set, etc.). For cross-modal primitive pairs (obtained by pairwise combinations of different modality subsets)... ( As the first semantic primitive, Calculate co-occurrence stability for the second semantic primitive. ,in For the co-occurrence stability of semantic pairs, As the first semantic primitive, As the second semantic primitive, For the number of co-occurrences, To use the smaller frequency of occurrence as the normalization benchmark, For the number of occurrences of a single semantic term, and constrain time consistency. , For semantics Time and location, For semantics Time and location, The time threshold is a constraint, and is a preset value. Semantic combinations (the system combines and expands semantic pairs that satisfy the stability condition to form semantic combinations) are then defined. (that is, a set consisting of multiple semantic primitives) ( For semantic combination, This is the first semantic primitive in the composition. Calculate the uniqueness of the k-th semantic primitive. , It serves as a uniqueness indicator (the fewer the number of objects, the higher the uniqueness). For each object identifier (such as a user or device), the number of objects containing the combination g is obtained through matching. For semantic combination, This is the semantic set of object o. The system performs reconfigurability deduction, such as gradually reducing the compositional size k (compositional size k represents the compositional size). The number of semantic primitives is gradually reduced (k represents the sequential removal of semantic primitives to simulate information loss scenarios). If a minimum subset exists... If the unique identification condition is still met (the number of matching objects = 1 or the confidence score ≥ θ, i.e., the number of matching objects is 1, or the matching confidence score of the first candidate object is not lower than the threshold θ, where the confidence score comes from the aforementioned matching score normalization result, and the first candidate object refers to the object with the highest matching score in the object sample library after matching with the input semantic data), then risk is defined. , The reconstruction risk value of semantic composition. For semantic combination, This is the uniqueness index corresponding to the smallest subset (the fewer the number of objects, the higher the uniqueness). The average co-occurrence stability of semantic pairs within this subset. Output semantic reconstruction risk data for the smallest reconstructable subset. .

[0090] S4. Identify and locate the semantic path of the semantic reconstruction risk data to obtain the leakage sensitive path data;

[0091] In one embodiment, the system constructs a semantic association graph. ,node For semantic primitives / fusion nodes (semantic primitive nodes are derived from the aforementioned multi-domain semantic primitive data; fusion nodes are derived from merging multimodal semantics that satisfy semantic similarity and temporal proximity conditions in the cross-modal coupling alignment step), edge E includes temporal edges (adjacent transitions), co-occurrence edges (C≥τ), and cross-modal mapping edges (established by semantic granularity unified mapping and semantic correspondence obtained in the cross-modal alignment step). Risk combinations in semantic reconstruction risk data are then used. The path is mapped to a subset of nodes in the graph. The system extracts paths, for example, starting with high-R nodes (where risk combinations in semantic reconstruction risk data are mapped to a subset of nodes in the graph. The system selects high-risk nodes as the starting point of the path, where high-R nodes are nodes whose corresponding semantic reconstruction risk values ​​are higher than a preset threshold (e.g., risk values ​​in the top 20% or exceeding a fixed threshold)). A constraint search (path length ≤ L, cross-modal coverage ≥ m, where L is 5–8 and m is greater than or equal to 2) is used to generate candidate paths P. The system performs maintenance evaluation by constructing a perturbation set (node ​​deletion / modal reduction / time shuffling) for each path. This involves performing single-node deletion, modal deletion, or time-sequence perturbation on the path, generating multiple perturbation path samples, and statistically analyzing the proportion of paths that can still be uniquely identified under N perturbations (total number of perturbation samples (e.g., 10–20 different perturbation combinations)). , For each perturbation path, an identification and judgment process is performed. The proportion of times a path can still be uniquely identified after the perturbation is defined as the identification maintenance rate. The k-th perturbation sample is numbered. This is for identifying the decision function (used to determine whether a path can still uniquely match an object). The path after the kth perturbation. The total number of perturbation samples (e.g., 10-20 different perturbation combinations) is used to extract the minimum maintenance subpath. The identification function `identify` is a judgment function based on semantic matching results. It is used to determine whether a given path or semantic subset can form a unique match in the object set. For example, the semantic set corresponding to the input path is matched with the semantic sets of each object in the object sample library to obtain a candidate object set and its matching score. When any of the following conditions are met, it is determined that the unique identification is established: (1) the number of candidate objects is 1; (2) the matching score of the first candidate object is higher than the preset threshold, and the score difference with the second candidate object is greater than the confidence difference threshold; otherwise, it is determined that the identification is not unique. The system performs a filtering rule and retains those that simultaneously meet the following conditions. and ( The semantic reconstruction risk value corresponding to the path. This is the risk threshold (e.g., 0.7). To identify the maintenance degree, This is the maintenance threshold (e.g., 0.5). The path (as candidate paths) is output as data on leaked sensitive paths.

[0092] S5. Perform perturbation suppression processing on the leaked sensitive path data to obtain privacy-protected output data;

[0093] In one embodiment, a set of key anchor points A is identified for each sensitive path P (located in...). The system generates a chain-breaking strategy (for each semantic anchor, it analyzes its role in the path (such as cross-modal connection node, time-series node, or key co-occurrence node) and assigns at least one weakening operation to it, thereby breaking the original high-risk semantic connection), such as numerical generalization, such as mapping specific numerical values ​​to intervals or levels (e.g., mapping "27 years old" to "25-30 years old interval"), and performs interval merging. , To retrieve values ​​from the original numeric field, The values ​​are obtained after range mapping; text abstraction, and the execution entity is replaced with a superordinate class (e.g., "Oncology Department → Department"); smooth behavior, and jitter in execution time. , This is the original time position. This is a time offset (e.g., a value randomly selected within ±1 hour). It is a uniform distribution function (meaning that the time offset is randomly generated with equal probability within a given interval). The upper limit of the time jitter range (representing the maximum absolute value of the time offset, e.g., 1 hour or 30 minutes) is set. If the relationship weakens, key edges are removed / deweighted. Key edges refer to associated edges that connect semantic anchors and play a major supporting role in path identification (such as edges with high co-occurrence stability or cross-modal mapping edges). For directional perturbations, only A and its adjacent edges are processed; other data remains unchanged. If a conflict occurs (such as a violation of time order), it is restored through local rearrangement. After a link break, the system performs availability constraints and monitors statistical deviations. (mean / frequency) This refers to the statistics after perturbation (such as frequency or proportion). This is the statistic before the disturbance. A permissible deviation threshold (e.g., 5%) is set. When the deviation exceeds the range, the perturbation rule is rolled back or weakened as necessary. The system outputs a privacy-preserving dataset.

[0094] S6. Perform counterfactual re-identification and verification based on the privacy protection output data to obtain protection effectiveness assessment data.

[0095] In one embodiment, the system constructs counterfactual input data based on privacy-preserving output data. It randomly extracts continuous semantic segments from object-level semantic trajectories to form random sub-trajectories, or extracts semantic sequences within corresponding time periods according to fixed time windows, or generates path fragment samples by deleting some semantic nodes from identified sensitive leakage paths. The system matches each counterfactual input data with an object sample library, calculates matching results for all candidate objects, and selects the set of objects with the highest scores and their corresponding matching confidence. The candidate set represents the set of potentially matching objects, and the matching confidence represents the degree of semantic matching between the sample and the candidate objects. The system performs progressive semantic pruning on the counterfactual input data, identifying the smallest subset size that can still achieve a unique match with minimal semantic information. It maps the counterfactual input data to a semantic association graph, determines whether the original sensitive leakage path or its sub-paths can be reconstructed, and statistically analyzes the proportion of recoverable paths. The system's recognition success rate, minimum identifiable subset size, and path recovery capability are used to evaluate the privacy protection effect. (When the recognition success rate is lower than a preset threshold (e.g., not more than 10%), the minimum identifiable subset size is not lower than a preset threshold (e.g., not less than 3 semantic units), and the path recovery ratio is not higher than a preset threshold (e.g., not more than 20%), the privacy protection effect is deemed satisfactory. If only some indicators are close to the threshold range (e.g., within 10% above or below the threshold), they are marked as boundary states. If any indicator clearly does not meet the above conditions, it is deemed unsatisfactory.) Based on the evaluation results, it is determined whether it is necessary to revert to the disturbance suppression processing step for optimization, thereby achieving closed-loop adjustment of the privacy protection effect.

[0096] Optionally, the cross-modal semantic unit extraction includes:

[0097] S11. Perform mode segmentation processing on multi-source heterogeneous sensitive data to obtain heterogeneous mode data;

[0098] In one embodiment, the data accessed by the system includes at least structured business tables, text records, behavior logs, and relational data. The system first classifies data into modalities based on data storage format, field organization, and semantic representation: if data is stored in fixed field formats with explicit field names and stable value types, it is classified as a structured modality; if data exists in sentence, paragraph, or free description format, it is classified as a text modality; if data is generated continuously over time as event sequences, operation flows, or access records, it is classified as a behavior modality; if data represents relationships between objects in a node-edge format, it is classified as a relational modality. The system performs basic normalization processing on each modal data, including unified field naming, timestamp format conversion, category encoding normalization, and missing value marking. For example, "login time," "access time," and "operation date" are uniformly mapped to a time field 't', and "region," "location," and "IP geographic location" are uniformly mapped to a region field 'r'. After the above processing, heterogeneous modal data is formed.

[0099] S12. Perform intra-modal semantic feature parsing based on heterogeneous modal data to obtain modal semantic feature data;

[0100] In one embodiment, the system extracts semantic features using differentiated parsing rules for different modalities. For structured modalities, the system processes data according to field type: numerical fields are segmented according to interval discrete rules, such as dividing age fields into intervals like "18-25" and "26-35", and dividing monetary fields into low, medium, and high levels based on quantiles; categorical fields directly extract semantic pairs between field values ​​and field names, such as "occupation-teacher" and "region-East China". For text modalities, the system first performs word segmentation, stop word filtering, and named entity recognition, then extracts entities, relationships, and keywords from sentences, such as extracting semantic fragments like "nighttime activity," "high-frequency access," and "oncology department." For behavioral modalities, the system performs sliding window segmentation of the event stream according to a preset time window, and statistically analyzes event frequency, event transition pairs, and temporal rhythm features within the window, such as generating behavioral features like "high-frequency login in the early morning" and "browsing → adding to cart → payment." For relational modalities, the system extracts node types, edge relationships, and multi-hop relationship fragments. Each modality outputs modal semantic feature data in a unified format. ,in For semantic features, For modal identification, This is time information.

[0101] S13. Perform semantic granularity unified mapping on the modal semantic feature data to obtain unified semantic data;

[0102] In one embodiment, the system constructs a cross-modal semantic mapping rule base to map features expressing the same concept or similar meanings in different modalities to a unified semantic space. The system first generates standard semantic labels for modal semantic features, for example, unifying "active at night" in text, "high access frequency between 00:00-04:00" in behavioral modalities, and "active time period offset = night" in structured fields as candidates for the same semantic topic. Then, it calculates the semantic similarity between feature pairs; when the similarity satisfies... ( This is a semantic similarity function (used to measure the semantic similarity between two features, for example, calculated based on word vectors or semantic mapping rules). These are first-modal semantic features (such as text keywords or structured field values). For second modality semantic features, When the semantic similarity threshold is set (e.g., 0.7), or when there is a stable co-occurrence relationship in the same object sample, the two are mapped to the same unified semantic label. Among them, the aforementioned The similarity can be determined by word vector similarity, contextual co-occurrence rate, or matching results from a predefined dictionary. For features that cannot be directly matched, the system combines field context and temporal proximity for auxiliary determination. Through this process, semantic features with inconsistent granularity and different expressions across different modalities are transformed into unified semantic data. , To unify semantic labels (representing semantic concepts after cross-modal normalization). Identify the semantic source modality (such as text modality, behavioral modality, or structured modality). This refers to the temporal location where the semantics occurred.

[0103] S14. Segment the semantic units based on the unified semantic data to obtain multi-domain semantic primitive data.

[0104] In one embodiment, the system performs minimal semantic granularity segmentation on unified semantic data, decomposing composite semantic expressions into semantic primitives that can independently participate in association analysis. If a unified semantic tag contains multiple limiting components, it is decomposed according to the rule of "core semantics + modification conditions". For example, "high-spending users at night" is split into two independent semantic primitives: "active at night" and "high-spending"; "frequent follow-up patients in the oncology department" is split into two semantic primitives: "oncology department" and "frequent follow-up". For behavioral unified semantics, the system decomposes them according to event nodes and transition relationships, such as segmenting "browse → add to cart → pay" into "browse", "add to cart", "pay" and their adjacent transition primitives. After segmentation, the system adds structural tags to each semantic primitive, including source modality, original fields, time position, and context index, forming a primitive representation. ,in For semantic primitive tags, As a modal source, For time location, For contextual association, the system obtains multi-domain semantic primitive data.

[0105] Optionally, the object-level semantic trajectory construction includes:

[0106] S21. Perform object attribution aggregation on the multi-domain semantic primitive data to obtain object semantic data;

[0107] In one embodiment, the system establishes object parsing and merging rules to combine multi-domain semantic primitives. Merge records into the same object ID. The system prioritizes using deterministic keys (such as user ID / device ID); if a key is missing, rule matching is used: two records are matched if they meet the following criteria (same device fingerprint or same account) and the time difference is... , semantic primitives The time location (e.g., timestamp or time range). For the temporal position of another semantic primitive, If a time difference threshold (e.g., 10 minutes or 1 hour to limit the time range for merging) is set, and at least one strong identifier (last four digits of a phone number / email field) is consistent, then the records are merged into the same object. Conflicting records are retained based on temporal proximity. The resulting aggregated object semantic set is then obtained. , For the set of semantic primitives corresponding to object o, For semantic primitives in a set, This is an object matching function (used to determine whether a semantic primitive belongs to object o). Identify objects (such as user or device entities) and maintain a deduplication index for each object (identical to the same object). Within the preset time window (Counted only once within a specified timeframe), the object matching function `match` is used to determine whether a semantic primitive belongs to a target object. The determination process includes comparing the semantic primitive's identifier information with the object's identifier information, where the identifier information includes user ID, device ID, or other unique identifiers. If a definite identifier matches, the semantic primitive is determined to belong to the object. If a definite identifier is missing, a further determination is made, including if the semantic primitive and the object's historical semantic data are within a temporal range and at least one auxiliary identifier matches (such as device fingerprint, account information, or some fields), then a successful match is determined. The output matching result is a binary determination result. Output object semantic data. , For object identification, This is the set of semantic primitives corresponding to this object.

[0108] S22. Perform temporal correlation reconstruction based on object semantic data to obtain semantic evolution sequence data;

[0109] In one embodiment, for Generate a sequence by timestamp. , It is an object-level semantic evolution sequence (representing a sequence of semantic primitives arranged in chronological order). It is the first semantic primitive in the sequence (i.e., the earliest semantic unit in time). This is the second semantic primitive. For primitives with missing time values, they are relatively ordered based on the dependency rule base (such as "browse → add to cart → pay" or "register → log in," predefined business rules or mined from historical data): if rules exist... ( For semantic dependency rules (e.g., "browse → add to cart"), For the preceding semantics in the rule. If both are co-occurring (for subsequent semantics), then let , For semantics Time and location, For semantics The time position. In the sliding window. Built-in transfer pairs set , It is a set of semantic transfer relations. For the k-th semantic primitive in the sequence, It is used as the successor semantic primitive, and the transition frequency and time interval are recorded. , For the temporal position of subsequent semantics, This refers to the temporal location of the preceding semantics. For noisy events (frequency below a threshold)... (And those that do not participate in any rule transitions) are removed. Output semantic evolution sequence data. , It is an object-level semantic evolution sequence (representing a sequence of semantic primitives arranged in chronological order). It is a set of semantic transfer relations.

[0110] S23. Perform cross-modal coupling alignment on the semantic evolution sequence data to obtain multimodal semantic trajectory data;

[0111] In one embodiment, in the sequence Perform cross-modal alignment: if primitives come from different modalities ( It is the first semantic primitive (e.g., a semantic unit from text or a structured modality). For second semantic primitives (e.g., semantic units from behavioral modalities) to satisfy semantic similarity ( This is a semantic similarity function (used to measure the degree of similarity between two semantic labels, which can be obtained based on semantic mapping or vector similarity). semantic primitives The corresponding semantic tags, semantic primitives The corresponding semantic tags, The semantic similarity threshold (e.g., 0.7) is used. The value range of the semantic label is the set of semantic categories in a unified semantic space, used to normalize the representation of cross-modal semantic features. The set of semantic categories is obtained by mapping structured fields, text features, and behavioral features through a semantic mapping function. For example, semantic labels may include predefined or data-driven semantic categories such as "active at night," "high-frequency access," "cross-device login," and "abnormal time access," and the tags should be time-proximity. ( semantic primitives Time and location, semantic primitives Time and location, If the time proximity threshold is used (e.g., 10 minutes or 1 hour), then the nodes are merged into a single node. , This is a fusion node (representing a node after cross-modal semantic merging). This is for merging semantic tags (representing the unified semantic expression after merging). semantic primitives Modal type, semantic primitives Modal type, , The time position of the fusion node (take the earlier time of the two semantic primitives). To perform the minimum value operation, semantic primitives Time and location, semantic primitives The time position is considered. For cases with more than two modalities, iterative union fusion is performed according to the above rules. To avoid over-merging, the maximum number of modalities in the fusion node within the same window is limited. The system updates and transfers the edge; if... And any one is replaced with Then, the edges are reconnected synchronously. This yields the multimodal semantic trajectory. ,in For multimodal semantic trajectories, For the fusion of node sets, This is the updated transfer relationship.

[0112] S24. Perform trajectory structure encoding based on multimodal semantic trajectory data to obtain semantic trajectory fingerprint data.

[0113] In one embodiment, the system performs structured encoding on multimodal semantic trajectory data to form semantic trajectory fingerprints. The system extracts sequence features, i.e., extracts fixed-length continuous semantic subsequences from the semantic trajectory to represent the sequential relationship of semantic occurrences; secondly, it extracts transition features, statistically analyzing the connection relationships between semantic nodes and their frequency of occurrence in the trajectory to represent the transition patterns between semantics; the system extracts periodic features, statistically analyzing the recurrence of semantics within a preset time period to represent their temporal regularity; and simultaneously extracts fusion features, calculating the proportion of cross-modal fusion nodes among all nodes to represent the degree of cross-modal coupling of semantics. The system uniformly encodes the above features in a preset order to form semantic trajectory fingerprint data; or it constructs an adjacency matrix using the connection relationships between nodes and combines it with node attribute vectors for joint representation.

[0114] Optionally, the cross-modal coupling analysis includes:

[0115] S31. Perform modal decomposition on the semantic trajectory data to obtain cross-modal semantic data;

[0116] In one embodiment, the system receives object-level semantic trajectory data. ,in This is object-level semantic trajectory data (representing the semantic evolution trajectory of an object in a multimodal context). This is a set of trajectory nodes (representing a set of semantic nodes). The system uses a set of trajectory edges (representing connections between nodes, such as temporal sequence or semantic association), and each trajectory node carries a set of modal identifiers. The system splits the trajectory according to its modal origin, reprojecting the nodes into sub-trajectories corresponding to the structured modality, text modality, behavioral modality, and relational modality. For fused nodes, the system retains their corresponding semantic labels in each participating modality and generates cross-modal correspondence records. , As the first semantic tag, For the first modality type (e.g., text modality). For the second semantic tag, This is a second modality type (e.g., behavioral modality). This refers to the temporal location (e.g., timestamp or time interval) of the semantic pair. If a node belongs to multiple modalities simultaneously, a mapping copy is synchronously registered in each sub-trajectory, but the same source node number is retained. Through the above processing, a cross-modal semantic dataset is obtained. ( For semantic primitive tags, The modal type to which this semantic belongs. (This refers to the temporal location of semantic occurrence) and an intermodal mapping table (the mapping table is a set of cross-modal corresponding records used to represent the alignment relationship between semantics of different modalities). .

[0117] S32. Calculate the semantic co-occurrence stability based on the cross-modal semantic data to obtain the semantic co-occurrence stability data;

[0118] In one embodiment, the system counts the co-occurrence of semantic primitives from different modalities within the same object trajectory. For any cross-modal semantic pair... , It is the first semantic primitive (e.g., a semantic unit from text or a structured modality). For a second semantic primitive (e.g., a semantic unit from a behavioral modality), if the two satisfy the condition of temporal proximity. , semantic primitives Time and location, semantic primitives Time and location, If a temporal proximity threshold is used (e.g., 10 minutes or 1 hour to limit the time range of co-occurrence), it is counted as one valid co-occurrence. The system counts the occurrences of this semantic pair within multiple time windows. and the number of times each appears independently. , Semantic co-occurrence stability is defined as follows: ,in, The closer the value is to 1, the more stably the two co-occur simultaneously in different segments. For cases of multiple short-term occasional co-occurrences with large intervals, the system sets a continuity constraint. If the interval between two adjacent co-occurrences exceeds a threshold, they are considered different co-occurrence clusters, and semantic co-occurrence stability data are generated after separate statistics.

[0119] S33. Based on the semantic co-occurrence stability data, perform combinatorial uniqueness evaluation to obtain semantic uniqueness data;

[0120] In one embodiment, the system expands and combines cross-modal semantic pairs with co-occurrence stability higher than a threshold to form candidate semantic combinations. , Semantic composition (representing a combined structure consisting of multiple semantic units). This is the first semantic unit in the combination. As the second semantic unit, Let k be the k-th semantic unit. Search the entire object sample for the range of occurrences of this semantic combination, and count the number of objects that satisfy this combination. If only a few objects simultaneously contain the same combination, it indicates that the combination has high distinguishability. The system defines semantic uniqueness as... ,when When the condition is met, it indicates that the combination corresponds to only one unique object, and its uniqueness is the highest. To prevent misjudgment caused by accidental rare combinations, the system requires that any adjacent semantic pairs in the combination satisfy the stability constraint. , Set a co-occurrence stability threshold (e.g., 0.5–0.7, used to filter stable co-occurrence relationships). Output the combinations that meet the conditions and their uniqueness values ​​as semantically unique data.

[0121] S34. Based on the semantic uniqueness data, perform reconfigurability deduction to obtain semantic reconstruction risk data.

[0122] In one embodiment, the system starts with each highly unique semantic combination and simulates the reconstruction process of an attacker without knowing the explicit identity field. The highly unique semantic combination is defined as a semantic combination in the object set whose corresponding object count does not exceed a preset threshold (e.g., corresponding to only one object or no more than two objects). The system performs item-by-item elimination on candidate combinations g, that is, the system gradually removes semantic units according to their importance from low to high or in a random order to generate several subsets. And then retrieve the matching results from the object set again. If a subset Still satisfied This means that even with incomplete information, the target identity can still be reconstructed from the combined data. The system denotes the smallest subset that satisfies the condition of unique identification as the smallest reconstructable subset. The system will determine its uniqueness. Average co-occurrence stability with internal semantic pairs Collectively record and form semantic reconstruction risk items ,in, The smaller The higher, The more stable the data, the higher the risk. The system outputs semantic reconstruction risk data.

[0123] Optionally, the semantic path identification and localization includes:

[0124] S41. Construct a semantic association graph based on the semantic reconstruction risk data to obtain semantic association graph data;

[0125] In one embodiment, the system uses semantic primitives or fused semantic nodes as graph nodes V, and the relationships between nodes as graph edges E, to construct a semantic association graph G=(V,E). The association relationships include at least three types: first, temporal continuity relationships, i.e., directed edges are established between semantic nodes in adjacent time slices of the same object's trajectory; second, cross-modal mapping relationships, i.e., alignment edges are established between nodes with consistent semantics or those that have completed unified mapping in different modalities; and third, stable co-occurrence relationships, i.e., association edges are established between semantic pairs whose co-occurrence stability in semantic reconstruction risk data meets a threshold. For high-risk semantic combinations... In the graph, the system marks risk attributes for each node and records its corresponding uniqueness value and stability information. The high-risk semantic combination... To ensure high semantic uniqueness and unique identification with a limited number of semantic units in semantic reconstruction risk data (e.g., the number of objects corresponding to the combination is 1, and the minimum identifiable subset size does not exceed 3 semantic units), the system retains the multiple risk labels if a node belongs to multiple high-risk combinations. The system generates semantic association graph data, which includes node sets, edge sets, edge types, and node risk attributes.

[0126] S42. Extract identification paths from the semantic association graph data to obtain identification path data;

[0127] In one embodiment, the system starts from a high-risk node and performs a constrained path search on the semantic association graph. It prioritizes starting from the smallest reconfigurable subset. Starting from the covered node, expand along the time edge, alignment edge, and stable co-occurrence edge to obtain candidate paths. , For candidate path identification, This is the starting node of the path (a semantic node representing the starting point of a high-risk path). This is an intermediate node in the path. The path termination node (usually the semantic node that ultimately forms the recognition capability) is used. The following constraints are set during the search process: the path length does not exceed L (5-8 nodes); the path covers at least two modalities; any adjacent nodes in the path must be connected by a graph edge; if the path contains a risk-free marked node, it must have a direct semantic connection with its adjacent high-risk node. For multiple candidate paths sharing most of their nodes, the system performs redundancy removal based on node differences, retaining only paths with significant structural differences. Each candidate path undergoes a recognition validity test, i.e., determining whether the semantic combination corresponding to the path can still form a unique match in the object set. Paths that meet the test conditions are output as the identified path data.

[0128] S43. Evaluate the recognition maintenance based on the recognition path data to obtain the recognition maintenance data;

[0129] In one embodiment, the system constructs a set of perturbation scenarios for each identification path to evaluate the path's ability to maintain recognition under information weakening conditions. The perturbation scenarios include: deleting a single node, deleting a node of a specific modality, shuffling the local temporal order, and replacing semantic labels with higher-level classes. For each perturbation scenario, the system generates a perturbated path. The system then re-executes object matching to determine if the path can still achieve unique identification. If it still achieves unique identification, it is recorded as a successful maintenance. The system defines the path identification maintenance degree as... ,in The number of times the unique identifier remains after the perturbation. This represents the total number of perturbation scenarios. Simultaneously, the system extracts the sub-path with the fewest nodes among all successful scenarios, as the path's minimum maintenance substructure. Finally, the maintenance score and the corresponding minimum maintenance substructure are output together as the identification maintenance score data.

[0130] S44. Path filtering is performed based on the identification and maintenance data to obtain sensitive leakage path data.

[0131] In one embodiment, the system filters identification paths based on identification maintenance scores to determine truly sensitive paths with persistent leakage capabilities. The system sets a maintenance score threshold. , retain satisfaction The system identifies paths with low maintenance (below a threshold) that only have temporary identification capabilities with complete information and is not considered a primary leakage path. For retained paths, the minimum maintenance substructure size is compared. If two paths have similar maintenance, the path with the shorter minimum maintenance substructure is retained, as it represents the attacker's ability to complete identification with less information. For paths with highly overlapping node sets, the system retains only the one with higher maintenance or a more concise minimum maintenance structure to avoid duplication. The selected set of paths is output as leakage-sensitive path data.

[0132] Optionally, the path extraction includes:

[0133] The semantic association graph data is decomposed into path semantic units to obtain path node sequence data;

[0134] In one embodiment, the system reads the identification path to be analyzed from the semantic association graph data and expands the path according to the connection order of the nodes in the path. The system parses each graph node in the path into a corresponding semantic unit, which includes at least a semantic label, source modality, time position, context identifier, and the original number of the node in the semantic association graph. If a node is a cross-modal fusion node, the system splits the node into its corresponding multiple modal sub-units and retains the mapping relationship markers between the sub-units.

[0135] During the unfolding process, the system records the connection relationships between adjacent semantic units according to the edge type in the path. If the adjacent nodes are time-sequential edges, their sequential order is recorded; if they are cross-modal mapping edges, their semantic alignment relationship is recorded; if they are stable co-occurrence edges, their co-occurrence association relationship is recorded. For semantic nodes of the same type that appear repeatedly in the path, the system compares their semantic labels, source modalities, and temporal positions. When the semantic labels are consistent, the source modalities are consistent, and the time interval is less than a preset threshold, the later-appearing node is marked as a duplicate node, and a merge identifier is established with the first-appearing node; when the semantic labels are consistent but the temporal positions are clearly separated, they are retained as independent nodes.

[0136] The system generates path node sequence data according to the original traversal order of the path, so that each position in the sequence corresponds to a clear semantic unit and its connection attributes. The resulting path node sequence data not only preserves the original topological order of the path, but also explicitly records the semantic composition of each node and the relationships between nodes.

[0137] Based on the path node sequence data, node redundancy contribution is screened to obtain the retained node data;

[0138] In one embodiment, the system performs a single-node elimination probe for each node in the path node sequence. For each node... ,structure Candidate sequences after deletion and utilize Re-match the object set. If the removed objects still meet the criteria for unique identification or the confidence level of the matching results is not lower than the threshold, proceed accordingly. Then determine the node Nodes that do not provide necessary support for path identification are marked as redundant nodes; conversely, if multiple object confusion, matching failures, or confidence levels (based on matching values) fall below a threshold occur after deletion, the node is marked as a critical node. For cases where multiple consecutive nodes point to the same higher-level semantics, the system performs a trial-and-error approach to remove groups of redundant nodes to avoid misclassifying them as multiple independent critical nodes. All critical nodes are aggregated to form retained node data. Based on the path node sequence data, node redundancy reduction analysis is performed to identify redundant nodes that do not substantially affect path identifiability, while retaining the basic nodes necessary to maintain the path's validity, thus obtaining retained node data.

[0139] The sub-path identifiability is verified on the retained node data to obtain sub-path identification data;

[0140] In one embodiment, the system constructs multiple candidate sub-paths based on the order of the retained nodes in the original path. Using the retained nodes as a foundation, it generates node combinations of different lengths according to their order in the original path, requiring that any adjacent nodes in the combination have a reachable relationship in the original graph to ensure the sub-paths still maintain structural rationality. For each candidate sub-path... The system extracts the semantic combinations it contains and performs matching and recognition in the object database; when the number of matching objects is 1, or the matching confidence of the unique candidate object reaches a threshold. When a subpath is deemed identifiable, it is considered to be valid only within the complete context. Subpaths that cannot be uniquely identified when removed from the context are directly discarded by the system. Verified subpaths and their corresponding identification results are recorded as subpath identification data, including the subpath node set, matching results, and identification confidence level.

[0141] Minimum structure preservation extraction is performed on the sub-path identification data to obtain the identified path data.

[0142] In one embodiment, the system performs minimum structure preservation extraction on all subpaths that pass the identifiability verification. Subpaths are sorted by the number of nodes from smallest to largest, with the subpath having the fewest nodes being selected first. If multiple candidate subpaths have the same number of nodes, their cross-modal coverage, temporal continuity, and recognition stability are compared. Subpaths that maintain unique identification with less semantic information and have more complete cross-modal relationships are prioritized for retention. The system defines subpaths that meet the above conditions as having minimum structure preservation. If a minimum preserving structure still contains consecutive equivalent nodes that can be further merged, then a final merge simplification is performed to form the final identified path data. This identified path data not only represents the skeleton structure of the identifiable path, but also characterizes the core path through which an attacker can achieve object identification with minimal semantic information.

[0143] Optionally, the recognition maintenance assessment includes:

[0144] The path identification data is expanded by semantic node structure to obtain path node structure data;

[0145] In one embodiment, the system identifies the path. ( To identify paths (path structures composed of semantic nodes in sequence). This is the starting node of the path (e.g., the earliest time or the first semantic node). The second node in the path, For path termination nodes (e.g., semantic nodes that trigger recognition results), perform node-level structural expansion to restore each path node to its complete set of semantic attributes. Extract semantic tags for each node. Source modality Time and location Context identifier The set of adjacent edges in the original semantic association graph If a node is a cross-modal fusion node, it is split into modal child node groups. , This refers to the child nodes of this node in the first modality (such as semantic units corresponding to the text modality). This identifies the child nodes of the node in the second modality (e.g., semantic units corresponding to the behavioral modality) and preserves the coupling mapping relationships between child nodes. The system also records the connection types between adjacent nodes in the path, including temporal continuation connections, semantic co-occurrence connections, and cross-modal correspondence connections. For recurring semantic nodes of the same type, if their time interval is less than a threshold... If they are, they are marked as repeating nodes from the same origin. The path is represented as an ordered structure with attributes. , For path node structure data, Let i be the i-th node in the path. For node semantic tags, For the source modality, For time location, For context identifiers, Given a set of adjacent edges, the output is path node structure data.

[0146] Path perturbation is performed based on the path node structure data to obtain path perturbation data;

[0147] In one embodiment, the system constructs various perturbation scenarios around the path node structure data to simulate changes in the path under conditions of information compression, semantic ambiguity, or partial missing data. The perturbations include at least the following types: first, node deletion perturbation, which involves deleting a single node or a continuous segment of nodes from the path; second, modality weakening perturbation, which involves deleting all nodes under a certain modality or replacing nodes of that modality with higher-level abstract semantics; third, temporal perturbation, which involves disrupting the order of adjacent nodes or compressing timestamps to a coarser-grained interval; and fourth, edge breaking perturbation, which involves severing semantically co-occurring edges or cross-modal mapping edges. The system generates a perturbation sample set according to the rule of prioritizing single perturbations and then applying combined perturbations later. ,in Let be the set of path perturbation samples, representing the set of all perturbation paths generated based on the original path. This is the first type of perturbation path (e.g., the path after deleting only one node). This is the second type of perturbation path (e.g., only the path after modal attenuation is performed). This represents the Nth type of perturbation path (e.g., the path resulting from combining multiple perturbations). This represents the path structure after the k-th perturbation. Perturbation samples that clearly do not satisfy basic connectivity are discarded by the system and not included in subsequent deductions. The system obtains the path perturbation data.

[0148] The path disturbance data is identified and preserved through extrapolation to obtain identified and preserved data.

[0149] In one embodiment, the system targets each perturbation sample. The system performs object recognition inference to determine whether the path can maintain its original recognition capability after perturbation. It extracts the remaining semantic node set and their order relationships from the perturbed path and searches the object sample library for matching object sets. If only one object exists in the matching results, or if the matching confidence of the first candidate object (the object with the highest matching score (i.e., the first-ranked object in the sorting results) is higher than a threshold, the system considers the result. If the perturbation path still retains its identification ability, it is considered a successful retention; otherwise, it is considered a failed retention. For cases with multiple candidate objects, but where the difference between the first and second candidate objects (the second candidate object is the object with the second highest matching score (i.e., the second-ranked object in the sorting results) is greater than a threshold... In such cases, a weakly maintained state can be identified and recorded separately. The system represents the deduction result for each perturbation sample as follows: , The value 1 indicates successful hold, and the value 0 indicates hold failure. Alternatively, it can be expanded into a three-level label of "strong hold / weak hold / failure", which is then summarized to form the hold identification data.

[0150] Based on the identification and preservation data, the minimum maintenance substructure is identified to obtain the maintenance substructure data;

[0151] In one embodiment, the system extracts the path structure with the smallest node size from all successfully preserved perturbation samples (path perturbation data based on the identified preservation data) and uses it as a candidate preservation substructure. The system first sorts the path structures by the number of nodes from smallest to largest. If multiple preservation paths have the same number of nodes, it prioritizes retaining candidate structures with higher cross-modal coverage, more complete temporal order, or a larger proportion of common edges with the original path. For example, the system prioritizes paths with higher cross-modal coverage, where cross-modal coverage refers to the number of modal types involved in the path (e.g., coverage of two or more of the three modalities: structured, text, and behavioral). Secondly, it retains paths with more complete temporal order, where complete temporal order refers to the proportion of adjacent nodes in the path whose temporal relationship matches the original semantic trajectory (e.g., reaching 80% or more). Thirdly, it retains paths with a larger proportion of common edges with the original path, where the proportion of common edges is the ratio of the number of original path connections still retained in the candidate path to the total number of original path connections (e.g., not less than 70%). For candidate structures that still contain mergeable duplicate equivalent nodes, the system performs a final simplification, retaining only nodes that provide necessary support for the recognition results. The sub-path that can maintain its recognizability with minimal semantic information is defined as the minimal sustaining substructure. The system outputs data that maintains the substructure, including at least: the set of nodes maintaining the substructure, the set of edges, the node size, and their corresponding maintenance states.

[0152] The identification maintenance degree is calculated based on the maintenance substructure data and path perturbation data to obtain the identification maintenance degree data.

[0153] In one embodiment, the system combines the perturbation preservation results with the minimum maintainable substructure to quantify the path identification and maintenance capability. The system counts the number of successfully maintained paths out of all perturbation samples. The maintenance ratio is calculated based on the total number of disturbance samples N. Based on the minimum node size for maintaining the substructure Compared to the original path size Calculate the structural compression retention ratio ,in The smaller the value, the more easily the path can be identified even with limited information, but the higher the risk. The system will... and The data are recorded together, and the modal coverage corresponding to the minimum maintenance substructure is added to form the identification maintenance data.

[0154] Optionally, the disturbance suppression process includes:

[0155] S51. Based on the leaked sensitive path data, perform semantic anchor point identification to obtain sensitive anchor point data;

[0156] In one embodiment, the system identifies each leakage-sensitive path. , To reveal sensitive paths, it represents an identification path composed of multiple semantic nodes in sequence. This is the starting node of the path (e.g., the earliest time or the first semantic unit to appear). For path termination nodes (e.g., the semantic unit that ultimately triggers the recognition result), determine node importance. Prioritize the minimum maintainable substructure. Select nodes as candidate anchor point set Perform a single-node removal experiment on the path nodes: Construct If the identification changes from unique to non-unique after removal (or the confidence level falls below the threshold), The confidence level is the normalized result of the matching score (for example, linearly normalizing the matching score to the interval of 0 to 1). Marked as key anchor points. For cross-modal fusion nodes, if any of their modal child nodes satisfy the key condition, the entire node is marked as an anchor point. To avoid redundancy, if a node pair always appears simultaneously in all samples (complete dependency), it is merged into a composite anchor point. The system obtains a set of sensitive anchor points. , As the key anchor point, The identification and judgment function is used to determine whether a given path can uniquely match a certain object (a return value of 1 indicates that the unique identification is successful, otherwise it is not unique), and records the modal label, time position, and adjacent edges of each anchor point. Based on the leaked sensitive path data, key semantic nodes that simultaneously play the roles of cross-modal connection, semantic continuation, or path closure in the minimum maintenance substructure are identified as semantic anchor points.

[0157] S52. Generate path chain breaking strategy based on sensitive anchor point data to obtain disturbance constraint rule data;

[0158] In one embodiment, the system generates path-oriented chain-breaking rules around the anchor point set A. Differentiated constraints are formulated for different modalities, such as for the structured modality: range generalization is performed on fields with rare values. ( Retrieve values ​​for the original field (such as a specific age or monetary value). For interval mapping functions (e.g., mapping "27 years old" to "25-30 years old interval"), or performing category merging (e.g., merging subcategories into higher-level categories) or category merging; for text modality: performing higher-level semantic replacement (e.g., "oncology department → department") or synonym rewriting on entities or keywords; for behavioral modality: performing jitter on key time rhythms. , This is the original timestamp. This is a time offset (e.g., a value randomly selected within ±1 hour). The system sets an upper limit for time jitter (e.g., 1 hour) or breaks up fixed sequences; for relational modalities, it removes or downgrades key edges (e.g., co-occurrence edges / mapping edges). The system sets path-level constraints: at least one weakening operation is applied to each anchor point; more than K (e.g., K=2) operations are prohibited from being applied to the same anchor point to avoid excessive distortion; if there is a direct dependency between two anchor points, their connecting edges are weakened first. Each specific perturbation operation targeting a semantic anchor point or its adjacency is treated as a single perturbation rule. These rules are then organized into a constraint set. , For the set of perturbation constraint rules, This is the first single disturbance rule. For the second single perturbation rule, the output is the perturbation constraint rule data.

[0159] S53. Perform directional perturbation processing on the multi-source heterogeneous sensitive data using the perturbation constraint rule data to obtain intermediate protection data;

[0160] In one embodiment, the system applies rules only to anchor points and their adjacent edges that participate in the sensitive path. (This refers to the perturbation constraint rule data generated in the previous step of path breakage strategy generation), implementing targeted perturbation. This involves performing bucket replacement on structured fields, such as mapping specific values ​​to intervals; abstracting or rewriting text fragments according to rules; shuffling the order of behavioral sequences within a local window (e.g., ±2-hour range) or injecting time jitter; and deleting specified edges or reducing their validity labels on the relationship graph. If an anchor point has mapping relationships in multiple modalities, the corresponding modality's perturbation is executed synchronously (e.g., time adjustments require simultaneous updating of time description labels in the text). Other data that does not match anchor points are left unprocessed. The processed data yields an intermediate protection dataset, recording the breakage result for each path (whether existing high-risk connections were broken).

[0161] S54. Optimize the intermediate protection data by applying availability constraints to obtain privacy-protected output data.

[0162] In one embodiment, the system for Perform consistency and availability corrections. The system performs a consistency check: if time sequence conflicts or semantic contradictions occur (such as "early morning" and "daytime" coexisting), a local rearrangement with minimal modifications is performed based on the original order. The system applies distribution constraints: allowable deviations are set for key statistics (frequency, interval percentage). ,when , This refers to the statistics after perturbation (e.g., the frequency or proportion of a certain semantic term after perturbation). This represents the original statistics before perturbation; if these conditions are not met, the perturbation rule is weakened or rolled back. For model usability scenarios (such as training / analysis), the performance change on the validation set is checked to see if it falls below a threshold. A performance change threshold is set (e.g., accuracy decrease of no more than 2%); otherwise, rule combinations with less impact are retained. The model usability scenario refers to application scenarios where downstream tasks are processed using privacy-preserving output data, including but not limited to model training, model prediction, and statistical analysis. In this scenario, the privacy-preserving data must maintain its effective support for the target task without disclosing sensitive information. The sensitive path is then checked again to see if it has been broken (i.e., no longer meeting the unique identification or maintenance threshold), thus forming privacy-preserving output data.

[0163] Optionally, the counterfactual re-identification verification includes:

[0164] S61. Construct counterfactual attack samples based on privacy-protected output data to obtain counterfactual input data;

[0165] In one embodiment, data is output from a privacy-preserving source. For each object o, a set of counterfactual samples is generated. Three types of samples are constructed: (1) Sub-trajectory samples: from semantic trajectory data / object trajectory The length of the random sample is ( The length of the sub-trajectory (e.g., 3 to 8 semantic units). This is the minimum length of the sub-trajectory (e.g., 3). (1) Continuous segments of the sub-trajectory with the maximum length (e.g., 8); (2) Incomplete path samples: fragments of historical sensitive paths (leaked sensitive path data extracted from historical data) P, obtained from randomly deleted nodes. (3) Modal subset samples: Only retain modal subsets (e.g., text + behavior only). Apply a slight perturbation (time jitter) to each sample. , This is a time offset (e.g., a value randomly selected within ±2 hours). This involves setting an upper limit for the time jitter range (e.g., taking 2 hours) and semantic superposition replacement, and removing explicit identity fields. This forms... , For object o, the set of counterfactual samples This is a specific sample obtained using the first construction method. The specific samples obtained by the second construction method are used as counterfactual input data to cover attack scenarios with incomplete information and slight perturbations.

[0166] S62. Perform cross-modal re-identification deduction based on counterfactual input data to obtain cross-modal re-identification data;

[0167] In one embodiment, for each sample Perform a matching search in the object library. Define the matching score as consisting of three parts: semantic matching rate (the intersection-union ratio of the sample semantic set and the object semantic set), order consistency rate (the hit rate of adjacent transitions in the object trajectory), and cross-modal consistency rate (alignment hits of the same semantic meaning in multiple modalities). For each candidate object... Calculate scores and sort them to obtain the candidate set. , Let x be the candidate object set, representing the set of objects that have a matching relationship with sample x. For the j-th candidate object, Candidates The corresponding matching score, This is a threshold for the number of candidate objects, used to limit the range of candidates for the output. The candidate objects are sorted by index, and the Top-K results are output (the matching scores of all candidate objects are sorted in descending order, and the top K objects with the highest scores are selected as the Top-K results (e.g., K is 3 or 5)) and their scores are used as cross-modal re-identification data; the difference between Top-1 and Top-2 is also recorded. As the confidence difference.

[0168] S63. Perform minimum identifiable subset analysis on cross-modal re-identification data to obtain identifiability assessment data;

[0169] In one embodiment, a stepwise reduction is performed on each sample x: semantic units are removed sequentially according to node importance from low to high, resulting in a subset sequence. For each Perform identification and deduction; if unique identification is satisfied (Top-1 correct and...) , The confidence difference represents the difference in matching scores between the first and second candidate objects. If the confidence difference threshold is matched (to limit the discriminative power of the recognition results), then the labeling is successful. The minimum subset size that maintains unique identification is recorded. , The minimum identifiable subset size represents the minimum number of semantic units required to achieve unique identification. To retrieve the minimum value that meets the conditions, The subset size, i.e., the number of semantic units in the subset. This is a recognition function used to determine whether a given semantic subset can uniquely match a certain object. For a subset containing k semantic units, calculate the success rate. Output As identifiability assessment data, it represents the degree to which the minimum amount of information is still identifiable.

[0170] S64. Analyze the path recovery capability based on the identifiability assessment data to obtain path residual risk data;

[0171] In one embodiment, the semantic nodes of sample x are mapped back to the semantic association graph G, attempting to reconstruct historical sensitive paths or their sub-paths. The definition of when a path exists... Make its node set satisfy If a path is connected in G and can be verified, it is considered recoverable. The proportion of recoverable paths is then statistically analyzed. And record the minimum length of the recovery path. With cross-modal coverage. For high or smaller Objects are marked as having a high residual risk. Output This serves as path residual risk data.

[0172] S65. Integrate the identifiability assessment data and the path residual risk data to obtain the protection effectiveness assessment data.

[0173] In one embodiment, identifiability assessment data and path residual risk data are jointly used for determination. A threshold set is defined. , The upper limit threshold for the success rate of identification (e.g., 0.1, used to limit the proportion of counterfactual samples that are successfully and uniquely identified to no more than 10%). This is the minimum threshold for the size of the identifiable subset (for example, a value of 3 indicates that at least 3 semantic units are required to complete unique identification). Set a threshold for the upper limit of path recovery ratio (e.g., 0.2, to limit the proportion of recoverable paths to no more than 20%), when the condition is met. , The success rate is represented by the proportion of counterfactual attack samples that are uniquely identified. The minimum identifiable subset size represents the number of semantic units required to achieve unique identification with minimal semantic information. The path recovery ratio represents the proportion of counterfactual samples that can reconstruct the original leaked sensitive path or its sub-paths. If this ratio is met, privacy protection is deemed satisfactory; otherwise, it is marked as requiring enhanced protection. Output evaluation vector. , To evaluate the vector, To identify the success rate, To be the minimum identifiable subset size, The path recovery ratio, To match the confidence difference (i.e., the difference in matching scores between the first and second candidate objects, used to characterize the discriminative power of the identification results), a hierarchical label (compliant / boundary / incompatible) is generated. For example, when all three core indicators meet the threshold requirements, it is marked as "compliant"; when only one indicator is close to the threshold boundary (e.g., within 10% above or below the threshold), it is marked as "boundary"; and when any indicator clearly fails to meet the threshold requirements, it is marked as "incompatible". For incompatible samples, the corresponding anchor point and path information are returned to drive the upstream perturbation strategy adjustment, achieving iterative optimization.

[0174] Optionally, this application also provides a heterogeneous sensitive data privacy protection system for performing the heterogeneous sensitive data privacy protection method described above, the heterogeneous sensitive data privacy protection system comprising:

[0175] The cross-modal semantic unit extraction module is used to acquire multi-source heterogeneous sensitive data and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data.

[0176] The object-level semantic trajectory construction module is used to construct object-level semantic trajectories based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data.

[0177] The cross-modal coupling analysis module is used to perform cross-modal coupling analysis on semantic trajectory data to obtain semantic reconstruction risk data;

[0178] The semantic path identification and localization module is used to identify and locate the semantic path of semantic reconstruction risk data to obtain leaked sensitive path data.

[0179] The disturbance suppression processing module is used to perform disturbance suppression processing on the leaked sensitive path data to obtain privacy-protected output data;

[0180] The counterfact re-identification verification module is used to perform counterfact re-identification verification based on the privacy protection output data to obtain protection effectiveness assessment data.

[0181] Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended application documents rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of the equivalents of the application documents be incorporated into the invention.

[0182] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features of the invention herein.

Claims

1. A method for protecting the privacy of heterogeneous sensitive data, characterized in that, The method includes: Acquire multi-source heterogeneous sensitive data, and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data; Object-level semantic trajectories are constructed based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data; Modal decomposition is performed on semantic trajectory data to obtain cross-modal semantic data; semantic co-occurrence stability is calculated based on cross-modal semantic data to obtain semantic co-occurrence stability data; combinatorial uniqueness is evaluated based on semantic co-occurrence stability data to obtain semantic uniqueness data; and reconfigurability is deduced based on semantic uniqueness data to obtain semantic reconstruction risk data. A semantic association graph is constructed based on the semantic reconstruction risk data to obtain semantic association graph data; identification paths are extracted from the semantic association graph data to obtain identification path data; identification maintenance is evaluated based on the identification path data to obtain identification maintenance data; and path filtering is performed based on the identification maintenance data to obtain leakage sensitive path data. Semantic anchor point identification is performed based on the leaked sensitive path data to obtain sensitive anchor point data; path chain breaking strategy is generated based on the sensitive anchor data to obtain perturbation constraint rule data; the perturbation constraint rule data is used to perform targeted perturbation processing on multi-source heterogeneous sensitive data to obtain intermediate protection data; availability constraint optimization is performed on the intermediate protection data to obtain privacy protection output data. Counterfactual attack samples are constructed based on privacy-protected output data to obtain counterfactual input data; cross-modal re-identification inference is performed based on counterfactual input data to obtain cross-modal re-identification data; minimum identifiable subset analysis is performed on cross-modal re-identification data to obtain identifiability assessment data; path recovery capability analysis is performed based on identifiability assessment data to obtain path residual risk data; and the identifiability assessment data and path residual risk data are integrated to obtain protection effectiveness assessment data.

2. The method according to claim 1, characterized in that, The cross-modal semantic unit extraction includes: Modality segmentation is performed on multi-source heterogeneous sensitive data to obtain heterogeneous modal data; Modal semantic feature data is obtained by parsing intramodal semantic features based on heterogeneous modal data. By performing a unified semantic granularity mapping on modal semantic feature data, unified semantic data is obtained. Semantic units are segmented based on unified semantic data to obtain multi-domain semantic primitive data.

3. The method according to claim 1, characterized in that, The object-level semantic trajectory construction includes: Object-attribution aggregation is performed on multi-domain semantic primitive data to obtain object semantic data; Semantic evolution sequence data is obtained by reconstructing temporal associations based on object semantic data. Cross-modal coupling alignment is performed on semantic evolution sequence data to obtain multimodal semantic trajectory data; Semantic trajectory fingerprint data is obtained by encoding the trajectory structure based on multimodal semantic trajectory data.

4. The method according to claim 1, characterized in that, The path extraction includes: The semantic association graph data is decomposed into path semantic units to obtain path node sequence data; Based on the path node sequence data, node redundancy contribution is screened to obtain the retained node data; The sub-path identifiability is verified on the retained node data to obtain sub-path identification data; Minimum structure preservation extraction is performed on the sub-path identification data to obtain the identified path data.

5. The method according to claim 1, characterized in that, The recognition maintenance assessment includes: The path semantic node structure is expanded on the identified path data to obtain path node structure data; Path perturbation is performed based on the path node structure data to obtain path perturbation data; The path disturbance data is identified and preserved through extrapolation to obtain identified and preserved data. Based on the identification and preservation data, the minimum maintenance substructure is identified to obtain the maintenance substructure data; The identification maintenance degree is calculated based on the maintenance substructure data and path perturbation data to obtain the identification maintenance degree data.

6. A heterogeneous sensitive data privacy protection system, characterized in that, For executing the heterogeneous sensitive data privacy protection method as described in claim 1, the heterogeneous sensitive data privacy protection system includes: The cross-modal semantic unit extraction module is used to acquire multi-source heterogeneous sensitive data and extract cross-modal semantic units based on the multi-source heterogeneous sensitive data to obtain multi-domain semantic primitive data. The object-level semantic trajectory construction module is used to construct object-level semantic trajectories based on multi-domain semantic primitive data to obtain semantic trajectory fingerprint data. The cross-modal coupling analysis module is used to perform cross-modal coupling analysis on semantic trajectory data to obtain semantic reconstruction risk data; The semantic path identification and localization module is used to identify and locate the semantic path of semantic reconstruction risk data to obtain leaked sensitive path data. The disturbance suppression processing module is used to perform disturbance suppression processing on the leaked sensitive path data to obtain privacy-protected output data; The counterfact re-identification verification module is used to perform counterfact re-identification verification based on the privacy protection output data to obtain protection effectiveness assessment data.

Images