A federated learning-based cross-domain collaborative construction method for graph data sets

Abstract

This invention discloses a cross-domain collaborative construction method for graph datasets based on federated learning. It is applied to the field of high-quality cross-domain graph dataset construction, comprising: each participant performing multi-dimensional quality pre-checks on the graph dataset locally, generating quality metadata after differential privacy processing; performing a two-dimensional matching and admission process based on information-theoretic contribution scores and attribute distribution complementarity measures; aligning nodes using a privacy set intersection protocol and applying differential privacy protection to edge existence; decoupling missing attribute semantic completion and graph structure edge repair into two independent subtasks, which are completed collaboratively through federated aggregation; and finally, performing multi-dimensional automated evaluation based on node attribute completeness, edge relationship accuracy, and topological structure rationality, and generating a report. This invention achieves the collaborative construction and standardized evaluation of high-quality cross-domain graph datasets without sharing the original graph data.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of privacy computing and graph data engineering, specifically relating to a method for constructing high-quality graph datasets across domains and automating quality assessment through multi-institutional collaboration within a federated learning framework. This invention is applicable to application scenarios such as knowledge graphs, financial risk control, healthcare, and social networks, which require cross-institutional integration of graph-structured data and have strict requirements for data privacy protection. Background Technology

[0002] Graph datasets hold core value in fields such as knowledge graphs, social network analysis, drug development, and financial risk control. The scale and quality of high-quality graph datasets directly determine the performance ceiling of graph neural network models. For example, in financial risk control, the legal integration of transaction relationship graphs across institutions can significantly improve fraud detection accuracy; in drug development, joint analysis of patient knowledge graphs across hospitals can accelerate target discovery. However, in reality, institutions possessing graph data are constrained by data security regulations and barriers to commercial competition, preventing them from directly sharing the original graph structure and creating serious data silos.

[0003] Existing data sharing solutions mainly include the following paths: First, data exchange platforms, which exchange data after anonymization. However, the structural information (edge ​​relationships) of graphs is inherently highly correlated, making it difficult to completely anonymize and posing a risk of privacy leakage. Second, federated learning solutions, where existing frameworks (such as FATE and FedML) focus on model gradient aggregation and do not involve cross-institutional construction of the dataset itself. Third, data markets, which rely on legal contracts rather than technical means to protect privacy and lack reliable technical endorsement.

[0004] In the field of cross-institutional dataset construction, existing research has proposed entity alignment schemes based on Private Set Intersection (PSI) and statistical protection methods based on differential privacy. Some works attempt to extend federated learning to the collaborative training of graph data (such as federated graph neural networks), but the goal of these schemes is to collaboratively train models rather than to build reusable cross-domain graph datasets. Regarding data quality assessment, existing general data quality standards (such as ISO / IEC 25012) do not cover the topological rationality evaluation dimension specific to graph data and do not provide privacy budget tracking mechanisms for privacy-preserving computing scenarios.

[0005] The existing technology has the following two core shortcomings: First, the existing federated framework lacks a theoretically supported data value quantification mechanism in the participant selection stage. Traditional quality scoring only reflects the surface attributes of the data and cannot measure the real marginal information contribution of the participant data to the construction of the global dataset. Furthermore, it does not consider the complementarity of data distribution among participants, resulting in insufficient diversity of the synthetic dataset. Second, the existing cross-organizational graph data cleaning scheme cannot complete attribute completion with high quality while protecting the privacy of the graph structure. Traditional completion methods strongly couple attribute completion with edge structure repair. If the spurious edges introduced by differential privacy noise are directly used as positive samples for training the edge predictor, it will lead to a noise cycle problem in which the systematic training bias is continuously amplified. Summary of the Invention

[0006] To address the aforementioned problems in existing technologies, this invention provides a method for cross-domain collaborative construction of graph datasets based on federated learning. This method enables multiple institutions to collaboratively construct high-quality cross-domain graph datasets without sharing the original graph data, and ensures dataset quality through a multi-dimensional automated evaluation system.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A cross-domain collaborative construction method for graph datasets based on federated learning includes: multiple participants performing multidimensional quality pre-checks on their locally held graph datasets to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics; generating quality metadata after local differential privacy processing of the multidimensional information, without sharing the original graph data externally; and using the quality metadata to perform admission screening of the multiple participants using an information-theoretic contribution scoring mechanism, and performing greedy sequence selection in conjunction with attribute distribution complementarity measures to determine a set of participants with quality scores higher than a first threshold and complementary distributions. The nodes of the participating party set are aligned using a privacy set intersection protocol, and differential privacy protection is applied to the existence of cross-party edges to obtain an aligned node set and a privacy-preserving prior edge set. Using the aligned node set and the privacy-preserving prior edge set, the missing attribute semantic completion and graph structure edge repair are decoupled into two independent subtasks, and the two independent subtasks are completed collaboratively through federated aggregation to output cleaned cross-domain graph data. The cleaned cross-domain graph data is then subjected to multi-dimensional automated evaluation of node attribute completeness, edge relationship accuracy, and topological structure rationality to generate a quality evaluation report.

[0009] Furthermore, multiple participants perform multidimensional quality pre-checks on their local graph datasets to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics. This multidimensional information is then processed locally using differential privacy to generate quality metadata, which is not shared with the original graph data. This includes: multiple participants locally calculating node attribute missing rate, edge hole rate, attribute value range violation rate, and duplicate node rate, outputting integrity and consistency statistics; performing timeliness checks on the integrity and consistency statistics, calculating the proportion of nodes with timestamps exceeding a preset update cycle, obtaining timeliness statistics; for the graph dataset corresponding to the timeliness statistics, extracting the marginal distribution histogram of each node attribute in the corresponding graph dataset, adding Laplace noise locally using the L1 sensitivity of the marginal distribution histogram as a scaling parameter, obtaining a privacy-enhanced attribute distribution histogram that satisfies differential privacy constraints; and encapsulating the integrity and consistency statistics, the timeliness statistics, and the privacy-enhanced attribute distribution histogram to generate quality metadata.

[0010] Further, based on the quality metadata, an information-theoretic contribution scoring mechanism is used to screen the multiple participants, and a greedy sequence selection is performed in conjunction with an attribute distribution complementarity measure to determine the set of participants with quality scores higher than a first threshold and complementary distributions, along with their corresponding data weights. This includes: uploading the quality statistical vector in the quality metadata to the central node after homomorphic encryption; the central node performing joint statistical decryption on a randomly sampled subset of permutations in the ciphertext domain; estimating the marginal information contribution of the multiple participants to the global dataset based on conditional mutual information; outputting the information-theoretic contribution scores of the multiple participants; filtering the information-theoretic contribution scores using an admission threshold, and including participants with scores not lower than the admission threshold in the candidate set to obtain a candidate participant set; performing a greedy sequence selection in conjunction with an attribute distribution complementarity measure for the candidate participant set to determine the set of participants with quality scores higher than the first threshold and complementary distributions; and normalizing the information-theoretic contribution scores to obtain the data weights corresponding to the participant set.

[0011] Preferably, for the candidate participant set, a greedy sequence selection is performed in conjunction with an attribute distribution complementarity metric to determine a participant set with a quality score higher than the first threshold and complementary distributions. This includes: for the candidate participant set, in each round of selection, calculating the attribute distribution complementarity metric value of each candidate participant based on the privacy attribute distribution histogram of each candidate participant and the average distribution of the currently selected participant set, to obtain the complementarity score of each candidate participant; weighting and summing the information theory contribution score and the complementarity score according to a preset tradeoff coefficient to obtain the comprehensive score of each candidate participant; including the candidate participant with the highest comprehensive score in the selected set, updating the average distribution, and repeating the above process until the size of the selected set reaches the target size, thereby obtaining a participant set with a quality score higher than the first threshold and complementary distributions.

[0012] Furthermore, a privacy set intersection protocol is used to align the nodes of the participating party set, and differential privacy protection is applied to the existence of cross-party edges to obtain an aligned node set and a privacy-preserving prior edge set. This includes: each participating party performs an elliptic curve blinded hash mapping on its local node identifier, exchanges the blinded hash value with other participating parties, takes the intersection of the blinded hash values ​​of multiple parties, and restores the node identifier that exists across parties to obtain the aligned node set; differential privacy noise is added to the intersection potential of the aligned node set to prevent any participating party from inferring the node member information of other participating parties from the intersection size; regarding the edge existence between node pairs in the aligned node set, the multiple participating parties report the edge status according to a preset flip probability using a randomized response mechanism, and the central node aggregates the reporting results of the multiple participating parties and performs deviation correction to obtain the privacy-preserving prior edge set.

[0013] Preferably, the multiple participants report edge states according to a preset flip probability using a randomized response mechanism. The central node aggregates the reported results from the multiple participants and performs bias correction to obtain a privacy-preserving prior edge set. This includes: the multiple participants determining the edge state flip probability using a preset privacy budget parameter, and reporting the edge existence of multiple node pairs according to the flip probability in a randomized response manner to obtain a noisy edge state report; the central node summarizing the noisy edge state reports from the multiple participants, performing linear unbiased correction on the aggregated results based on the flip probability to eliminate the systematic bias introduced by the randomized response, and obtaining the privacy-preserving prior edge set; and recording the privacy budget parameter in a privacy budget tracking log for cumulative privacy budget statistics in the quality evaluation report.

[0014] Furthermore, utilizing the aligned node set and the privacy-preserving prior edge set, semantic completion of missing attributes and edge repair of graph structure are decoupled into two independent subtasks. These two independent subtasks are collaboratively completed through federated aggregation, outputting cleaned cross-domain graph data. This includes: obtaining the missing attributes of each node in the aligned node set; for nodes with a missing rate exceeding a preset missing threshold, multiple participants locally generate candidate values ​​for missing attributes using existing node attributes and neighborhood attributes as context through a language model; the generated quality score is encrypted and uploaded to the central node for aggregation into a global reflection signal; multiple participants adjust their local generation strategies based on the global reflection signal, iteratively executing until the early stopping condition is met. The system obtains semantically completed node attributes and completes node attributes for nodes with a missing rate exceeding a preset missing threshold. Based on the semantically completed node attributes and the privacy-preserving prior edge set, the edge state labels in the privacy-preserving prior edge set are reverse-corrected according to the flip probability to eliminate training bias introduced by differential privacy noise. The multiple participants train an edge relationship prediction model locally with the corrected labels. After gradient encryption and aggregation, a global edge relationship prediction model is obtained. The global edge relationship prediction model is used to infer the edge relationships between aligned nodes to obtain the repaired graph structure. The semantically completed node attributes are merged with the repaired graph structure to output cleaned cross-domain graph data.

[0015] Preferably, the missing attributes of each node in the aligned node set are obtained. For nodes with a missing rate exceeding a preset missing threshold, the multiple participants locally generate candidate values ​​for missing attributes using a language model, with existing node attributes and neighborhood attributes as context. The generated quality scores are encrypted and uploaded to the central node to be aggregated into a global reflection signal. The multiple participants adjust their local generation strategies based on the global reflection signal, iteratively executing until the early stopping condition is met, to obtain the semantically completed node attributes. This includes: for nodes with a missing rate exceeding the preset threshold, the multiple participants process the nodes in batches according to a preset batch size, using the existing attributes and neighborhood attributes of each batch of nodes as contextual prompts to drive the local node generation strategy. The local language model generates candidate values ​​for missing attributes to obtain initial completion results. Multiple participants calculate semantic consistency and value range compliance scores for the initial completion results, encrypt the scores, and upload them. The central node aggregates the scores from the multiple participants to obtain a global reflection signal, which is then broadcast to the participants. Based on the global reflection signal, the participants adjust the generation strategy of their local language model and iteratively optimize the initial completion results. The iteration terminates when the improvement in the global reflection signal of adjacent iterations falls below a preset early stopping threshold. Nodes with missing attributes whose missing rates do not exceed a preset threshold are completed using a graph autoencoder, and the results are merged to obtain semantically completed node attributes.

[0016] Furthermore, before merging the semantically completed node attributes with the repaired graph structure to output the cleaned cross-domain graph data, the method further includes: the multiple participants performing isolated forest anomaly detection on the nodes corresponding to the semantically completed node attributes to obtain local anomaly node labels; summarizing the local anomaly node labels through secure multi-party computation, and removing nodes marked as anomaly by more than half of the participants to obtain a filtered aligned node set; merging the filtered aligned node set with the repaired graph structure to output the cleaned cross-domain graph data.

[0017] Furthermore, the cleaned cross-domain graph data undergoes multi-dimensional automated evaluation of node attribute completeness, edge relationship accuracy, and topological structure rationality, generating a quality evaluation report. This includes: statistically analyzing the node attribute missing rate, attribute value range compliance rate, and the proportion of nodes generated by the language model in the cleaned cross-domain graph data to obtain node attribute completeness evaluation results; calculating the divergence between the graph density distribution and the reference distribution, and the triangle closure rate, to obtain edge relationship accuracy evaluation results; performing a goodness-of-fit test on the degree distribution of the cross-domain graph data, and calculating the average complementary dispersion of the number of connected components and the attribute distributions of multiple participants to obtain topological structure rationality and data diversity evaluation results; summarizing the accumulated privacy budget consumption, and combining the node attribute completeness evaluation results, the edge relationship accuracy evaluation results, and the topological structure rationality and data diversity evaluation results to generate the quality evaluation report.

[0018] Compared with the prior art, the present invention has the following technical effects:

[0019] First, this invention uses the Monte Carlo approximation Shapley-CMI mechanism to estimate the true marginal contribution of participant data in the homomorphic encryption domain using conditional mutual information, providing a rigorous information theory basis for participant admission scoring and solving the problem of lack of theoretical support in traditional quality scoring. At the same time, it superimposes the Wasserstein distribution complementary greedy matching to ensure the diversity of attribute distributions in the synthetic dataset and avoid the insufficient generalization ability of downstream graph neural network models due to a single distribution.

[0020] Second, this invention decouples missing attribute semantic completion and edge structure repair into independent subtasks, eliminating error contagion between the two subtasks. For edge predictor training, a label back-correction strategy based on randomized response flip probability is adopted to mathematically eliminate the systematic bias introduced by differential privacy noise, cut off the noise cycle, and enable graph structure repair to achieve near-noise-free accuracy under strict privacy constraints.

[0021] Third, this invention adds privacy budget cumulative tracking and Wasserstein diversity indicators to the traditional graph quality indicators, forming a complete five-dimensional quality evaluation standard system for graph datasets oriented towards privacy computing scenarios, filling the gap in the coverage of existing data quality standards for graph data topology evaluation and privacy constraint scenarios. Attached Figure Description

[0022] Figure 1 A schematic diagram illustrating the overall process of the cross-domain collaborative construction method for graph datasets based on federated learning provided in this embodiment of the invention;

[0023] Figure 2 This is a schematic diagram of the multi-dimensional quality pre-inspection and privacy-preserving metadata generation process provided in an embodiment of the present invention;

[0024] Figure 3 A flowchart illustrating the two-dimensional matching and admission mechanism provided in this embodiment of the invention;

[0025] Figure 4 This is a schematic diagram of the privacy set intersection node alignment and edge privacy protection process provided in an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of the decoupled collaborative cleaning process provided in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of the multi-dimensional quality assessment and report generation process provided in an embodiment of the present invention. Detailed Implementation

[0028] Example 1

[0029] like Figure 1 As shown, a method for cross-domain collaborative construction of graph datasets based on federated learning includes:

[0030] S1: Multiple participants perform multidimensional quality pre-checks on the graph dataset they hold locally to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics. The multidimensional information is then processed locally using differential privacy to generate quality metadata, which is not shared with external parties.

[0031] In this embodiment of the invention, the participants are institutions holding graph datasets, such as hospitals, banks, and government departments. Each participant performs a multi-dimensional quality pre-check on the graph dataset locally, covering four dimensions: node attribute integrity, data consistency, timeliness, and attribute distribution statistics, extracting statistics reflecting the data quality status. To prevent the statistics themselves from revealing data distribution details, each participant applies differential privacy processing to the extracted statistics locally, generates quality metadata, and uploads it to the central node. Throughout the process, no original graph data (including node attribute values, edge relationship lists, etc.) is shared externally.

[0032] S2: Based on the quality metadata, use the information theory contribution scoring mechanism to screen the multiple participants, and combine the attribute distribution complementarity measure to perform greedy sequence selection to determine the set of participants with quality scores higher than the first threshold and complementary distributions and their corresponding data weights.

[0033] In this embodiment of the invention, the admission screening stage employs a two-dimensional mechanism: the first dimension is an information theory contribution score, used to eliminate participants that do not meet the quality standards; the second dimension is an attribute distribution complementarity measure, used to prioritize participants in the candidate set that can expand the distribution coverage of the dataset. The two dimensions work together to ensure that the final participant set simultaneously meets the quality threshold and distribution diversity requirements. The data weight of each participant is obtained by normalizing its information theory contribution score and is used for subsequent weighted fusion of the datasets.

[0034] Unlike traditional federated learning methods that select participants based on mean error or precision metrics, this invention employs information theory contribution scoring to evaluate participant value from the perspective of the overall information gain of the dataset construction. Its core principle is that the value of a participant's dataset depends not only on its own quality metrics but also on the amount of additional information it provides relative to the existing data of other participants. For example, the marginal information contribution of a dataset from two organizations operating in the same industry, with similar data sizes and attribute distributions may be far lower than that of a dataset from a smaller, cross-industry organization with unique attribute distributions. This characteristic allows information theory contribution scoring to effectively guide the system to prioritize the inclusion of participants who can truly expand the information coverage of the dataset, rather than simply relying on data volume or quality score rankings.

[0035] S3: The nodes of the participating party set are aligned using a privacy set intersection protocol, and differential privacy protection is applied to the existence of cross-party edges to obtain the aligned node set and the privacy-preserving prior edge set.

[0036] Specifically, cross-party node alignment employs a privacy-preserving intersection protocol. This protocol ensures that participating parties can only know the nodes that exist in common across parties and cannot infer the unique node information of other parties. After node alignment is completed, differential privacy protection is further applied to the existence of edges between aligned nodes, generating a privacy-preserving prior edge set as a priori reference for subsequent graph structure repair, rather than directly using the real edge set.

[0037] S4: Using the aligned node set and the privacy-preserving prior edge set, decouple the missing attribute semantic completion and graph structure edge repair into two independent subtasks, and complete the two independent subtasks collaboratively through federated aggregation, outputting the cleaned cross-domain graph data.

[0038] In this embodiment of the invention, collaborative cleaning is divided into two independent subtasks: attribute semantic completion and graph structure edge repair. These two subtasks are executed sequentially and do not interfere with each other, eliminating the problem of error contagion in traditional strongly coupled schemes. Both subtasks are completed through federated aggregation, with each participant only uploading encrypted gradients or scalar quality scores, without sharing local graph data.

[0039] The technical necessity of the decoupling strategy lies in the fact that traditional strongly coupled schemes for attribute completion and edge structure repair of graph data suffer from bidirectional error propagation. If edge structure repair relies on node embedding with missing values, the embedding quality is affected by the missing attributes, leading to insufficient edge prediction accuracy. Conversely, if attribute completion relies on the graph structure containing noisy edge sets for context extraction, inaccurate neighborhood semantic information will affect the completion quality of the language model. This invention fundamentally cuts off the error propagation link between the two subtasks by first completing attribute semantic completion and then using the completed node attributes to drive the edge relationship prediction model. This allows each subtask to execute independently with complete required information, thereby improving the overall cleaning quality.

[0040] S5: Perform multi-dimensional automated evaluation on the cleaned cross-domain graph data from the perspectives of node attribute integrity, edge relationship accuracy, and topological structure rationality, and generate a quality evaluation report.

[0041] It is worth noting that the multi-dimensional evaluation system established in this step includes topological structure rationality indicators specific to graph data (degree distribution goodness of fit, number of connected components, etc.), as well as privacy budget cumulative tracking and data diversity indicators newly added for privacy computing scenarios, filling the gaps in the coverage of graph data structure evaluation in existing general data quality standards. The evaluation report can directly support the compliance certification of the dataset.

[0042] To further illustrate the practical application effects of the method of the present invention, the following provides exemplary descriptions of two typical scenarios:

[0043] Scenario 1: Cross-platform construction of social network user behavior graph datasets:

[0044] In the realm of social networks, different platforms each hold user behavior graph datasets with users as nodes and follow or interaction relationships as edges. Taking a short video platform A, a news community platform B, and an e-commerce platform C as examples, all three platforms hope to build a high-quality graph dataset covering user behavior characteristics across multiple platforms for training downstream user interest and preference prediction models. However, due to user privacy protection regulations, none of them may directly share raw user data with other parties.

[0045] In Phase S1, each of the three platforms performed multidimensional quality pre-checks locally. Platform A found that its user attributes (age group, interest tags, and active time periods) had a missing rate of approximately 8%, and the timestamps of user interaction edges were all within the last three months, indicating good timeliness. Platform B had high data completeness, but there were approximately 3% duplicate user records. Platform C had a large amount of product interaction edge data, but some user attribute values ​​had enumeration violations (gender attributes were filled in as numerical values ​​instead of predefined enumeration values), with an attribute value domain violation rate of approximately 5%. The three platforms processed the above statistics locally using Laplace noise to generate their respective quality metadata, which was then uploaded to the central matching node. No user identifiers or behavior records were shared throughout the process.

[0046] In stage S2, the central matching node estimates the information theory contribution scores of each party based on the three parties' quality metadata. Because the distribution of user interest tag attributes on platform A differs significantly from that on platforms B and C (the attribute spaces of short video interest tags, news reading preference tags, and shopping target tags complement each other), platform A has the highest marginal information contribution score. While user attributes on platforms B and C overlap in some dimensions (such as city level and spending power range), platform C's product interaction edge structure information provides shopping graph topological features that platform B lacks, resulting in a high complementarity score. Ultimately, all three parties passed the admission threshold, and their data weights, normalized by information theory contribution, were 0.42, 0.31, and 0.27, respectively. Platform A had the highest weight, reflecting the high information value of its interest tag attributes.

[0047] In the S3 phase, the three platforms use their respective user hash identifiers (de-identified user ID digests) as input to perform a privacy set intersection protocol, identifying a set of active user nodes across all three platforms, which serves as the alignment node set. For social interaction edges between aligned users (such as shared interest topics among cross-platform users), the three platforms report the existence of the edges through a randomized response mechanism. The central node then generates a privacy-preserving prior edge set after bias correction.

[0048] In the S4 stage, for nodes with missing attributes in the aligned user nodes, each platform locally uses the user's existing attributes (such as active time period and content preference) and the attributes of its neighboring users as context to complete the missing interest tag attributes through a language model; then, the federated edge relationship prediction model is trained with the debiased labels to infer the association edge relationships that should exist between aligned users in the synthetic graph, and outputs the cleaned cross-platform user behavior graph dataset.

[0049] In the S5 phase, the evaluation report showed that the node attribute missing rate of the synthetic dataset decreased from the mean of 8% before cleaning to 1.2%, the degree distribution KS test P value was 0.09, the global privacy budget cumulative ε value was 4.6 through the goodness-of-fit test, which is within the compliance range of the system configuration, and the diversity Wasserstein dispersion was 0.34, indicating that the attribute distribution of the three platforms has a good complementary effect.

[0050] Scenario 2: Cross-institutional construction of drug development molecule-target interaction graph dataset:

[0051] In the field of drug development, different pharmaceutical research institutions and hospitals each possess knowledge graph datasets with molecular compounds or genes as nodes and biological interactions (such as molecule-target binding and gene co-expression) as edges. Taking a pharmaceutical research institute X, a genomics research institution Y, and a top-tier hospital Z as examples, all three institutions hope to construct a multi-level, high-quality interaction graph dataset covering molecules, targets, and clinical phenotypes for new drug target discovery tasks. However, the original experimental data and patient clinical data of each institution are considered core secrets or are subject to medical ethics constraints and cannot be shared externally.

[0052] In Phase S1, Institution X possessed a large amount of in vitro validated molecular-target binding relationship data with high attribute completeness but low data update frequency; timeliness statistics showed that approximately 18% of molecular target records had timestamps exceeding one quarter. Institution Y possessed gene co-expression network data obtained based on high-throughput sequencing technology; the node attribute (gene expression level, functional annotation) completeness rate was approximately 91%, and the number of edge relationships was large, but some suffered from consistency bias due to experimental batch effects. Institution Z possessed genotype-phenotype association graph data from clinical patients, with data derived from real clinical records and high timeliness; however, due to patient privacy protection regulations, some attribute fields were obfuscated, resulting in an attribute missing rate of approximately 15%. Each of the three institutions completed local quality pre-checks and generated privacy-preserving quality metadata.

[0053] In the S2 phase, the information theory contribution score calculation results showed that: the gene co-expression network attribute space of institution Y and the molecular target attribute space of institution X were most complementary at the information theory level, and institution Y obtained the highest marginal information contribution score; the clinical phenotype attributes of institution Z provided the clinical association dimension missing in the laboratory data of the other two parties, and ranked second in score; the in vitro experimental target data of institution X and the genomics data of institution Y had a certain overlap in attribute distribution (both included target function annotation attributes), the complementarity score was relatively low but the quality score was high. Finally, all three parties passed the admission threshold and were included in the participant set with normalized weights of 0.29 (institution X), 0.44 (institution Y), and 0.27 (institution Z), respectively.

[0054] In phase S3, the three institutions use hash digests of compound CAS numbers or gene Entrez IDs as node identifiers and execute a privacy-preserving set intersection protocol to identify common molecular and gene entities recorded in all three institutions' datasets, forming an aligned node set. For the interaction edges between nodes, the three institutions report edge existence through a randomized response mechanism, and the central node generates a privacy-preserving prior edge set after correction.

[0055] In stage S4, for missing patient attribute nodes of institution Z (missing rate of about 15%, exceeding the preset threshold of 0.1), each institution uses the existing genotype attributes and neighboring molecular attributes of the node as context to drive the local language model to complete the missing functional annotation attributes. After the federated edge relationship prediction model is trained based on the debiased labels, it infers the molecular interaction edge relationships between aligned nodes and outputs a cleaned cross-institution interaction graph dataset covering the three-layer structure of molecule-target-phenotype.

[0056] In the S5 phase, the evaluation report showed that the node attribute completeness rate of the synthetic dataset improved to 93.7%, the KL divergence between the graph density distribution and the publicly referenced drug graph dataset was 0.08, the edge relationship accuracy evaluation passed, the degree distribution KS test p-value was 0.12, and the topological structure was reasonable; the cumulative global privacy budget ε value was 3.8, which is lower than the compliance limit of 5.0 for medical data scenarios; the data diversity Wasserstein dispersion was 0.51, showing that the attribute distribution of the three institutions complemented each other well, and the synthetic dataset has good cross-institutional representativeness.

[0057] Example 2

[0058] like Figure 2 As shown, based on Example 1, multiple participants perform multidimensional quality pre-checks on their held graph datasets locally to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics. This multidimensional information is then processed locally using differential privacy techniques to generate quality metadata, which is not shared externally with the original graph data. This metadata includes:

[0059] S1.1: Multiple participants locally calculate the missing node attribute rate, edge hole rate, attribute value range violation rate, and duplicate node rate, and output integrity and consistency statistics.

[0060] Specifically, the node attribute missing rate refers to the proportion of nodes in the node set whose attribute values ​​are empty; the edge hole rate refers to the proportion of node pairs that are expected to have edge relationships but are actually missing; the attribute value range violation rate refers to the proportion of attribute values ​​that exceed the preset legal value range constraints; and the duplicate node rate refers to the proportion of redundant nodes with the same node identifier or completely identical attributes. The above four statistics characterize the basic quality of this graph dataset from the two dimensions of completeness and consistency.

[0061] S1.2: Perform a timeliness check on the integrity and consistency statistics, and calculate the percentage of nodes whose timestamps exceed the preset update cycle to obtain the timeliness statistics.

[0062] In this embodiment of the invention, the preset update cycle is determined by the system configuration, for example, a quarterly update standard corresponds to 90 days. Each participating party compares the timestamp of its local node with the current time difference, and calculates the proportion of expired nodes to the total number of nodes as a timeliness statistic. The timeliness statistic reflects the real-time level of the dataset; an excessively high proportion of expired data will affect the representativeness of the synthesized dataset to the current business status.

[0063] It should be understood that timeliness has a particularly significant impact on graph data. Unlike structured tabular data, the node attributes and edge relationships in graph data often exhibit dynamic evolutionary characteristics, such as the frequent changes in transaction relationships in financial transaction graphs and the continuous updates of entity states in knowledge graphs. If the graph dataset provided by a participant contains a large number of nodes with expired timestamps, the attribute values ​​and edge relationships of these nodes may no longer reflect the true state. Including them in a cross-domain synthetic dataset not only fails to improve the representativeness of the dataset but may also introduce historical noise, affecting the training effect of downstream graph neural network models. Therefore, timeliness statistics are included in the calculation input of information theory contribution score during the admission screening stage. Participants with an excessively high proportion of expired nodes will be penalized in the scoring process and will find it difficult to pass the first threshold admission screening.

[0064] S1.3: For the graph dataset corresponding to the timeliness statistics, extract the marginal distribution histogram of each node attribute in the corresponding graph dataset, and add Laplace noise locally using the L1 sensitivity of the marginal distribution histogram as the scale parameter to obtain a privacy attribute distribution histogram that satisfies differential privacy constraints.

[0065] In practice, each participant independently extracts a marginal distribution histogram for each node attribute, with a fixed number of intervals (e.g., 64 intervals) to ensure the structural comparability of cross-partisan histograms. The L1 sensitivity of the histogram is the maximum influence of a single node on the histogram, equal to 1 / |V| (where |V| is the number of local nodes). This sensitivity is divided by the privacy budget parameter as the scaling parameter for Laplace noise. Independent Laplace noise is added to the local histogram interval counts to ensure that the uploaded privacy-preserving attribute distribution histogram satisfies differential privacy constraints, preventing the central node or other participants from inferring the distribution details of local data from the histogram.

[0066] The selection of L1 sensitivity as the Laplace noise scaling parameter is based on the fact that the L1 sensitivity of the histogram counting function to a single node (i.e., the maximum change in the L1 norm of the histogram vector caused by adding or removing a node) is exactly equal to 1 / |V|. This is the most compact upper bound of sensitivity that can be used under the premise of satisfying differential privacy constraints, which helps to minimize the amount of noise under the same privacy budget, thereby preserving more useful distribution shape information without changing the strength of privacy protection. The fixed number of histogram intervals of 64 is based on two considerations: firstly, 64 intervals can approximate the distribution shape of most continuous attributes with reasonable accuracy, covering key statistical features such as mode and quantiles; secondly, the fixed number of intervals ensures that the privacy-preserving histograms of all participants have the same vector dimension, making the calculation of Wasserstein-1 distance comparable between cross-party histograms, which is a prerequisite for the distribution complementarity measurement in the subsequent two-dimensional matching stage.

[0067] S1.4: Encapsulate the integrity and consistency statistics, the timeliness statistics, and the privacy attribute distribution histogram to generate quality metadata.

[0068] It should be understood that the quality metadata is a privacy-protected summary of the local quality status of each participant, which does not contain any original node identifiers, attribute values ​​or edge relationship information, and can be securely uploaded to the central node for subsequent matching and admission analysis.

[0069] Example 3

[0070] like Figure 3 As shown, based on Example 1, using the aforementioned quality metadata, an information-theoretic contribution scoring mechanism is employed to screen the multiple participants, and a greedy sequence selection is performed in conjunction with an attribute distribution complementarity measure to determine the set of participants with quality scores higher than a first threshold and complementary distributions, along with their corresponding data weights. This includes:

[0071] S2.1: The quality statistics vector in the quality metadata is homomorphically encrypted and uploaded to the central node. The central node performs joint statistics decryption on a randomly sampled permutation subset in the ciphertext domain, estimates the marginal information contribution of the multiple participants to the global dataset based on conditional mutual information, and outputs the information theory contribution score of the multiple participants.

[0072] In this embodiment of the invention, the Paillier homomorphic encryption scheme is used to encrypt the quality statistics vector. This scheme supports ciphertext field addition, allowing the central node to accumulate multi-party statistics without decrypting unilateral data. The information-theoretic contribution score is approximated using Shapley values ​​based on conditional mutual information: Monte Carlo random sampling (e.g., sampling 100 permutations) is performed on the full permutation space of the participant set. For each sampled permutation, the marginal conditional mutual information increment is calculated and averaged to serve as the approximate Shapley contribution score for each participant. This scheme reduces the exponential complexity of calculating the exact Shapley value to linear complexity, ensuring both theoretical rationality and practical usability.

[0073] In this embodiment of the invention, the selection of the random sampling number K (e.g., 100 times) is based on the theoretical error bound analysis of the Shapley value approximation: the approximation error is... The rate converges with increasing sampling quantity. When K=100, the approximate error has decreased to the order of 0.1, which meets the engineering requirements for the stability of the scoring ranking in the participant admission screening. However, if an accurate Shapley value is desired, it is necessary to enumerate 2... |P| The computational complexity of calculating subsets (where the p-value represents the probability of a significance test) exceeds millions when the number of participants reaches 20, making it completely infeasible in the ciphertext domain. The Paillier homomorphic encryption scheme supports ciphertext addition, meaning the central node can perform linear combination operations (such as summation or weighted summation) on the encrypted quality statistics vectors of multiple parties without decrypting any individual's data. This allows for the cumulative calculation of the joint statistics of each permutation subset within the ciphertext domain, followed by a batch decryption to obtain the conditional mutual information estimates of each subset. This ensures that the entire calculation of the information-theoretic contribution score is performed under encryption protection, preventing the central node from obtaining any individual's plaintext quality data.

[0074] Furthermore, the information-theoretic contribution scoring mechanism refers to a scoring system that uses Conditional Mutual Information (CMI) as the data value metric and Shapley values ​​as the fair allocation framework. It approximates the marginal contribution of each participant's dataset to the global information gain through Monte Carlo random sampling in a federated encryption environment. Unlike traditional scoring methods based on superficial quality indicators such as missing rate and accuracy, this mechanism, from an information-theoretic perspective, strictly defines "the data value of a participant" as the incremental global conditional mutual information brought about by adding data from a new participant to the existing participant's dataset. This definition directly links the scoring results to the information gain of downstream tasks, rather than relying on superficial statistics irrelevant to the task.

[0075] The technical principle behind the access scoring mechanism lies in the following three levels. First, conditional mutual information. (in, This represents the data set of participant i. This represents the data set of all participants except participant i. Represents the global target variable. The conditional mutual information function (CMIF) naturally captures the additional information of participant i's data given the data of other participants: if participant i's attribute distribution highly overlaps with that of other participants, its conditional mutual information approaches zero, resulting in a lower score; if it provides unique attribute features not possessed by other participants, its conditional mutual information is larger, resulting in a higher score. Secondly, the Shapley value framework guarantees fairness in allocation—satisfying efficiency (the sum of all participants' scores equals the total global information gain), symmetry (participants with equal contributions receive the same score), and zero contribution (participants with no contribution to global information receive a score of zero). These three axioms guarantee the fairness of the scoring results in a game-theoretic sense, making the scores a theoretical basis for data weight allocation. Thirdly, Monte Carlo sampling reduces computational complexity from exponential to linear levels while ensuring controllable approximation errors, making the mechanism still engineering-ready when the number of participants reaches tens.

[0076] Through the aforementioned information theory contribution scoring mechanism, this invention achieves the following technical effects: First, the scoring standard is upgraded from "data surface quality" to "data information gain," directly aligning the admission decision with the actual information value of the synthesized dataset. This avoids redundant participants with qualified quality indicators but highly overlapping data with existing participants passing the admission threshold, thus wasting federated computing resources. Second, the fair allocation of Shapley values ​​ensures that the data weight allocation for each participant is rational in a game theory sense. Participants with high contributions receive greater weight in subsequent dataset synthesis stages, while those with low contributions have limited weight. This protects the participation enthusiasm of all participants while ensuring that the quality of the synthesized dataset leans towards higher value. Third, scoring calculation is performed under Paillier homomorphic encryption protection, ensuring that no participant's plaintext data is visible to the central node throughout the entire admission screening process. This eliminates the security risk of data exposure to third-party evaluation agencies in traditional data evaluation processes.

[0077] Let's illustrate this with a real-world application scenario. Assume a knowledge graph construction project involves four participants: a financial institution A (holding a business transaction relationship graph), a business data service provider B (holding a business registration information graph), an industry association C (holding a business industry classification graph), and a media organization D (holding a business news association graph). The federated learning-based cross-domain collaborative graph dataset construction system (hereinafter referred to as the system) first calculates the information theory contribution scores of each party: Institutions A and B have highly correlated attribute distributions (both centered on basic enterprise attributes), with relatively low conditional mutual information. Institution A's Shapley-CMI score is 0.72, and Institution B's score is 0.68, both exceeding the admission threshold of 0.60. Institution C's industry classification attributes differ significantly from those of A and B, resulting in high marginal information gain and a score of 0.91, thus it is prioritized for inclusion. Institution D's news association attributes have low overlap between the enterprise nodes covered and the aligned node set, resulting in limited marginal information gain and a score of only 0.41, failing to meet the admission threshold and thus excluded from this collaborative construction. Through the aforementioned scoring mechanism, the system completed the participant admission screening based on information theory without accessing any raw data.

[0078] S2.2: Filter the information theory contribution scores using an admission threshold, and include participants with scores not lower than the admission threshold into the candidate set to obtain a set of candidate participants.

[0079] The admission threshold is pre-configured by the system administrator based on the quality requirements of the target dataset. Participants whose scores are below the admission threshold are excluded from this collaborative construction to prevent low-quality data from contaminating the final synthesized dataset.

[0080] In this embodiment of the invention, the admission threshold is not set as a fixed value, but is dynamically configured based on the quality requirements of the target dataset and the scale of the participants. When the target dataset is for financial risk control or medical auxiliary decision-making scenarios with high accuracy requirements, the admission threshold can be configured to a higher level (e.g., above 0.80) to ensure that all participants entering the subsequent process have a high information theory contribution. When the target dataset is for scenarios with relatively high tolerance for accuracy, such as data exploration or model pre-training, the admission threshold can be appropriately reduced (e.g., between 0.50 and 0.65) to expand the scale of participants and increase the coverage of the synthetic dataset.

[0081] It is worth noting that the setting of the admission threshold directly affects the size of the candidate set in the subsequent greedy sequence selection stage. If the threshold is too high, resulting in a small candidate set (e.g., only 2 to 3 participants), the optimization space for the distribution complementarity in the greedy sequence selection stage is limited, and the diversity of the synthetic dataset is difficult to guarantee. If the threshold is too low, resulting in a large candidate set (e.g., exceeding 80% of the total number of participants), a large number of low-quality participants will enter the candidate set, increasing the computational overhead of the subsequent greedy selection and potentially introducing noisy data. Therefore, in actual deployment, it is recommended that system administrators use a small number of participants' quality metadata as a sample during the initial configuration phase to evaluate the distribution range of information theory contribution scores, using a quantile near the median (e.g., the 60th to 70th percentile) as a reference starting point for the admission threshold, and fine-tuning it based on the target participant size requirements.

[0082] Furthermore, the timing design of the admission screening process is also of great significance. This invention arranges admission screening before node alignment, rather than after alignment. The technical basis for this is that if node alignment is performed first (step S3), all participants (including low-quality participants) have already participated in the calculation of the privacy set intersection protocol, consuming the privacy budget, and the noisy nodes of low-quality participants have already been mixed into the aligned node set. By placing admission screening beforehand, it ensures that only high-quality participants participate in the subsequent privacy protocol calculation, saving privacy budget consumption while preventing low-quality data from polluting the aligned node set from the source. This is particularly important for federated scenarios with limited privacy budgets (such as medical data scenarios where the differential privacy total budget ε is strictly limited).

[0083] S2.3: For the set of candidate participants, perform greedy sequence selection by combining attribute distribution complementarity measure to determine the set of participants whose quality score is higher than the first threshold and whose distribution is complementary.

[0084] Optionally, the attribute distribution complementarity measure is calculated based on a privacy-preserving attribute distribution histogram, which does not require access to the original data and maintains consistency with the overall privacy protection framework.

[0085] In this embodiment of the invention, the execution details of the greedy sequence selection need further explanation. After each round of greedy selection, the system calculates a weighted average of the histogram of the privacy attribute distribution of the newly included participants and the histograms of all participants in the already selected set, according to the current data weights, and updates the overall average distribution of the already selected set. This update operation ensures that the average distribution referenced in the next round of complementarity calculation can accurately reflect the overall attribute distribution state of the currently selected set, enabling the greedy selection to make the optimal single-step decision based on the latest set state in each round, avoiding the repeated selection of participants with similar attribute distributions due to outdated average distributions.

[0086] It's important to note that the greedy sequence selection process has a special case that needs to be handled: when the complementarity scores of all remaining participants in the candidate set are below a preset minimum complementarity threshold (indicating that the attribute distributions of all remaining candidates highly overlap with the already selected set, and the marginal diversity gain from introducing any one of them is extremely limited), the system will terminate the greedy sequence selection early, using the currently selected set as the final participant set, even if the size of the selected set has not yet reached the original target size. This early termination mechanism prevents the system from forcibly including low-complementarity participants to reach the target size, ensuring the diversity baseline of the synthetic dataset.

[0087] Furthermore, for candidates with the same overall score in the same batch, the system uses their information theory contribution score as the deciding factor, prioritizing those with higher information theory contributions. If the information theory contribution scores are also the same (a very low probability event, usually occurring only when the number of participants is extremely small), the tie is broken by the order in which the participants joined the system, ensuring that the greedy sequence selection produces a deterministic and unique result under any circumstances, thus avoiding the reproducibility problem caused by nondeterminism.

[0088] S2.4: Normalize the information theory contribution score to obtain the data weights corresponding to the set of participants.

[0089] It should be noted that the data weights are used in the subsequent weighted synthesis stage of the dataset. Participants with higher contribution scores have greater weight in the final synthesized dataset, reflecting the impact of data quality on the synthesis result.

[0090] In this embodiment of the invention, the normalization operation of data weights involves dividing the information theory contribution score of all parties in the participant set by the sum of all party scores, so that the sum of all weights is exactly equal to 1, forming a weight vector on the probability simplex. This normalization design is consistent with the efficiency axiom of Shapley values ​​(the sum of all party scores equals the total global information gain), making the weight allocation inherently consistent in an information theory sense.

[0091] Data weights play three specific roles in subsequent processes. First, in the node attribute weighting and fusion stage, for shared nodes held by all parties in the aligned node set, the synthesized attribute value is weighted and averaged using the data weights of each party as coefficients. The higher the weight of a participant, the greater their contribution to the final attribute value, ensuring that the data of high-quality participants dominates the synthesized result. Second, in the graph structure edge weight normalization stage, each participant's contribution to a particular edge in the privacy-preserving prior edge set (measured by the edge existence correction value) is weighted and summarized according to its data weight, ensuring that the final edge existence probability estimate reflects the impact of differences in data quality among different participants on the confidence level of edge relationship judgments. Third, in the data sourcing section of the quality assessment report, data weights, as a quantitative summary of each participant's contribution to the synthesized dataset, are recorded in the sourcing hash chain. This allows dataset users to refer to the dataset composition, clarifying which participants' data has the greatest impact on the synthesized result, thus supporting the dataset's interpretability.

[0092] It should be understood that once the data weights are determined in step S2.4, they will remain fixed in all subsequent steps (S3 to S5) and will not be dynamically adjusted due to intermediate results of subsequent operations such as node alignment and collaborative cleaning. The rationale for this design is that the information theory contribution score reflects the global information value of each participant's dataset and is a comprehensive assessment of the overall data quality of the participants, rather than a local measurement of the intermediate results of a specific step; keeping the weights fixed ensures that the contribution status of each participant is consistent throughout the entire collaborative construction process, avoids frequent weight changes due to random fluctuations in local steps, and increases the stability and predictability of the system.

[0093] Example 4

[0094] Based on Example 3, for the candidate participant set, a greedy sequence selection is performed in conjunction with an attribute distribution complementarity measure to determine the participant set whose quality score is higher than the first threshold and whose distribution is complementary, including:

[0095] The quality-diversity dual-objective greedy matching strategy refers to a matching mechanism that, after obtaining a set of candidate participants through information theory contribution screening, uses the Wasserstein-1 distance to measure the complementarity between the data distribution of the candidate participants and the average distribution of the currently selected set. The complementarity score and the information theory contribution score are weighted and combined into a comprehensive score. This mechanism then uses a greedy sequence selection to gradually construct a final set of participants that meets the quality requirements and exhibits diverse distributions. The Wasserstein-1 distance is a probability distribution difference measure based on optimal transport theory. Its physical meaning is the minimum total transport cost required to "transfer" one distribution to another. Compared to information theory distances such as KL divergence, the Wasserstein distance provides a meaningful distance metric even when the support sets of the distributions do not overlap, making it suitable for cross-domain scenarios where the attribute distributions of the participants differ significantly.

[0096] The technical principle behind the strategy's ability to enhance dataset diversity while maintaining quality lies in the following: When relying solely on information theory contribution scores for participant selection, high-scoring participants tend to concentrate in similar scenarios with generally high data quality, and their attribute distributions are often similar, resulting in a synthetic dataset that is "high-quality but with a single distribution" in terms of attribute dimensions. However, by superimposing the Wasserstein complementarity metric, each round of selection additionally rewards candidates whose attribute distributions differ significantly from the currently selected set, thus creating a broader coverage of the attribute distribution space in the final set. Mathematically, greedy sequence selection is an approximate solution to a submodular function maximization problem: the Wasserstein complementarity metric satisfies the diminishing marginal utility property, and the greedy algorithm can guarantee an approximately optimal ratio of (1-1 / e)3% for such problems, which has been proven to be close to the optimal solution in engineering practice.

[0097] S2.3.1: For the set of candidate participants, in each round of selection, based on the histogram of the privacy attribute distribution of each candidate participant and the average distribution of the currently selected participant set, calculate the complementarity metric of the attribute distribution of each candidate participant to obtain the complementarity score of each candidate participant.

[0098] Specifically, the complementarity measure of attribute distribution uses the Wasserstein-1 distance (Earth Mover's Distance), which calculates the distribution difference between the histogram of the privacy attribute distribution of each candidate participant and the average distribution of the currently selected set. The larger the distance, the more significant the difference between the attribute distribution of the candidate participant and the selected set, the greater the improvement in the diversity of the dataset distribution after its introduction, and the higher the complementarity score.

[0099] S2.3.2: The information theory contribution score and the complementarity score are weighted and summed according to a preset trade-off coefficient to obtain the comprehensive score of each candidate participant.

[0100] In this embodiment of the invention, a preset weighting coefficient controls the balance between prioritizing quality and prioritizing diversity; for example, quality weight is 0.6 and diversity weight is 0.4, which can be adjusted according to specific application scenarios. The scores of both dimensions are normalized to the same dimension before weighted summation.

[0101] Furthermore, the information theory contribution score and complementarity score need to be normalized separately before weighted summation, mapping their respective value ranges to the [0,1] interval. The necessity of normalization lies in the fundamental differences in the dimensions and numerical ranges of the two types of scores. The information theory contribution score is based on the conditional mutual information estimate, and its absolute magnitude is affected by the number of node attribute dimensions; while the Wasserstein-1 distance is based on the difference in probability distribution, and its magnitude is related to the dispersion of attribute distributions. If weighting is performed directly without normalization, the difference in dimensions will render the preset weighting coefficient meaningless. The specific value of the preset weighting coefficient can be adjusted according to the application scenario: in financial risk control scenarios with extremely strict data quality requirements, the quality weight can be increased to above 0.8 to ensure data accuracy is prioritized; while in medical knowledge graph construction scenarios that need to cover diverse group characteristics, the diversity weight can be increased to 0.5 to 0.6 to ensure the cross-group representativeness of the synthetic dataset.

[0102] S2.3.3: The candidate participant with the highest comprehensive score is included in the selected set, the average distribution is updated, and the above process is repeated until the size of the selected set reaches the target size, so as to obtain a set of participants with quality scores higher than the first threshold and complementary distributions.

[0103] Furthermore, after adding a new participant in each round, the average distribution of the selected set is recalculated, and the complementarity scores of all candidates are updated to ensure that each round's selection is based on the latest state of the selected set. The time complexity of this greedy sequential strategy is O(n log n). ,in For the size of the candidate set, It has good computational scalability, which is based on the number of target participants.

[0104] Through the aforementioned dual-objective greedy matching strategy, this invention achieves the following technical effects. First, compared to the simple strategy of selecting the top K participants solely based on information theory contribution ranking, the participant set constructed by the dual-objective greedy selection significantly improves the average Wasserstein dispersion in attribute distribution, resulting in even greater performance improvement for the downstream graph neural network model in cross-domain generalization scenarios. Second, Wasserstein complementarity calculation is directly based on the uploaded privacy-preserving attribute distribution histogram, requiring no additional data access or privacy budget consumption, achieving the diversity guarantee goal with extremely low additional computational cost. Third, the adjustable design of the quality-diversity tradeoff coefficient enables the system to adapt to the differentiated needs of different application scenarios, outputting participant combinations that meet business objectives in both scenarios with strict quality constraints and scenarios with prominent diversity requirements.

[0105] Example 5

[0106] like Figure 4 As shown, based on Example 1, a privacy set intersection protocol is used to align the nodes of the participating party set, and differential privacy protection is applied to the existence of cross-party edges, resulting in an aligned node set and a privacy-preserving prior edge set, including:

[0107] S3.1: Each participant performs an elliptic curve blinded hash mapping on its local node identifier, exchanges the blinded hash value with other participants, takes the intersection of the blinded hash values ​​of multiple parties, restores the node identifier that exists across the parties, and obtains the aligned node set.

[0108] In this embodiment of the invention, elliptic curve blinded hash mapping is the core operation for protecting node identifier privacy. The basic operation is as follows: each participating party first selects an elliptic curve group (such as the P-256 curve) suitable for cryptographic security requirements, randomly generates a private key integer locally, and then maps each node identifier string to a point on the elliptic curve group using a deterministic hash function. This point is then multiplied by the party's private key using an elliptic curve scalar multiplication operation to obtain the blinded curve point, which serves as the blinded hash value of the node identifier. Due to the computational difficulty of the elliptic curve discrete logarithm problem, it is computationally infeasible to deduce the original node identifier from the blinded hash value, thus ensuring that the node identifier is not cracked by the other party or intermediate nodes during transmission.

[0109] In practice, the ECDH-PSI (Elliptic Curve Diffie-Hellman Private Set Intersection) protocol is used: each participant uses its own private key. Perform blind hash mapping on node identifier ID After exchanging blinded hash values, each party exponentiates the hash value again using its private key. The blinding factor is eliminated by taking the common exponent, and the intersection of the results from all parties is used to reconstruct the set of node identifiers that exist across the parties, forming an aligned node set. Throughout the entire process, no participating party can know the unique node information of other participating parties.

[0110] It should be noted that the core principle behind the ECDH-PSI protocol's ability to achieve intersection reconstruction lies in the commutativity of elliptic curve exponentiation: for the same node identifier ID, regardless of which party's private key is used first... Blind hashing is performed, and the final result is obtained by exponentiation of the private keys of all participants. The results are identical, regardless of the order in which the parties perform the exponentiation. Therefore, each party sequentially performs exponentiation again on the blinded hash values ​​uploaded by other parties using its own private key. Ultimately, the hash values ​​corresponding to the same ID obtained by all parties are completely identical after full quantization, and the nodes commonly found across parties can be determined using a set intersection algorithm. However, for node identifiers unique to a particular party, since other parties do not hold the corresponding blinded hash value, this node cannot appear in the hash set shared by all parties, thus completing the intersection calculation without exposing the unique node identifier. Throughout the entire process, the private keys of each party remain confidential, and the blinded hash values ​​exchanged in the middle are computationally irreversibly used to derive the original node identifier.

[0111] S3.2: Add differential privacy noise to the intersection potential of the aligned node set to prevent any participant from inferring the node member information of other participants from the intersection size.

[0112] It should be understood that even if the node identifiers themselves are protected by the PSI protocol, the size (potential) of the intersection may still reveal inferences about the total number of nodes and the overlapping distribution of each party. Therefore, when reporting the intersection potential to each participant, integer noise satisfying differential privacy constraints (such as the Geometric mechanism) is added to prevent weaker participants from inferring the node size distribution of other parties from the intersection size.

[0113] S3.3: Regarding the existence of edges between node pairs in the alignment node set, the multiple participants report the edge status according to a preset flip probability using a randomized response mechanism. The central node aggregates the reporting results of the multiple participants and performs deviation correction to obtain a privacy-preserving prior edge set.

[0114] In this embodiment of the invention, the randomized response mechanism is a classic local differential privacy technique: each participant reports the existence of the real edges of each node pair by randomly flipping them with a preset flipping probability. The central node aggregates the reports from multiple parties and eliminates the statistical bias introduced by the flipping through a linear correction formula to obtain a privacy-preserving prior edge set that satisfies the differential privacy constraints.

[0115] The complete execution process of S3.1 to S3.3 is further illustrated with a specific scenario example. Assume that the set of participants consists of three medical institutions, A, B, and C, and the alignment node of each institution is the patient entity. The node identifier is the patient identity digest processed by SHA-256 (the original identity information does not participate in any calculation).

[0116] In phase S3.1, Institution A holds a patient summary set containing 500 nodes with summary numbers P001 to P500; Institution B holds 500 nodes with summary numbers P200 to P700; and Institution C holds 450 nodes with summary numbers P350 to P800. Each of the three institutions generates its own private key, performs elliptic curve blinded hash mapping on its node identifiers, and uploads the blinded hash set to the central coordinating node (the central node does not hold the private key and cannot deblind). Subsequently, each institution receives the blinded hash sets from the other two institutions in turn, and then performs a scalar multiplication on each element in the received set using its own private key to obtain a double or triple blinded value resulting from the combined action of the private keys of two or three institutions. Finally, the intersection of the hash value sets from which all three institutions have completed triple blinding is taken to reconstruct the common patient summary set. In this example, the aligned node set contains 151 patient nodes from P350 to P500. Institution A cannot know the unique nodes (P200 to P349, P501 to P700, P501 to P800) of Institutions B and C respectively. The same applies to Institutions B and C. The unique patient information of each party is protected.

[0117] When the intersection potential of the aligned node set (151 patient nodes) is reported to the three parties, integer noise that satisfies differential privacy constraints is superimposed. The actual intersection potential reported by the three parties is a random integer between 148 and 154, which cannot accurately infer the true size of the intersection of 151, thus preventing any institution from using this to infer the total number of patients of other institutions.

[0118] In phase S3.3, for approximately 11,325 node pairs comprised of 151 aligned patient nodes, the three institutions, based on their respective records of real-world medical visit associations, performed a randomized response to the edge existence of each node pair according to a preset flip probability (e.g., a flip probability of approximately 0.047 corresponding to a privacy budget parameter ε=3) before reporting. Taking a specific patient node pair (P401, P423) as an example: Institution A's real records show that the two have shared medical records in the same department, with a real edge existence of 1. After performing a randomized response with a flip probability of 0.047, the reported value is 1 (no flip occurred); Institution B's records show no direct association between the two, with a real edge existence of 0, and the reported value after the randomized response is 0 (no flip occurred); Institution C's records show shared medication records between the two, with a real edge existence of 1, and the reported value after the randomized response is 0 (a flip occurred, with a probability of approximately 4.7%). The central node aggregates the reported values ​​(1, 0, 0) from all three parties, with a mean of 0.333. After linear unbiased correction, the corrected value is approximately 0.298, which is below the binarization threshold of 0.5. Therefore, this node pair is marked as non-existent in the privacy-preserving prior edge set. If all three parties report 1, the mean is 1.0, and the corrected value is also approximately 1.0. This node pair will then be marked as existing. Throughout the process, no institution can know the other two parties' assessments of the actual existence of any node pair, thus protecting the privacy of patient-patient relationships.

[0119] Example 6

[0120] Based on Example 5, the multiple participants report edge states according to a preset flip probability using a randomized response mechanism. The central node aggregates the reported results from the multiple participants and performs deviation correction to obtain a privacy-preserving prior edge set, including:

[0121] S3.3.1: The multiple participants determine the edge state flipping probability using a preset privacy budget parameter, and report the edge existence of multiple node pairs in a randomized response manner according to the flipping probability to obtain a noisy edge state report.

[0122] In this embodiment of the invention, the flip probability is a core parameter in the randomized response mechanism used to control the trade-off between the strength of privacy protection and the accuracy of data statistics. Its technical meaning is as follows: for the existence of a true edge between a pair of nodes (a value indicating existence or non-existence), the participating party reports the true value with the probability of the flip probability (i.e., reporting "existence" as "non-existence," or "non-existence" as "existence"), and reports the true value with the remaining probability. The higher the flip probability, the stronger the randomness of a single report, the weaker the ability of the central node to infer the existence of the true edge from the reported value, and the higher the strength of privacy protection; the lower the flip probability, the closer the reported result is to the true value, the higher the statistical accuracy, but the lower the strength of privacy protection. The flip probability is uniquely determined by the privacy budget parameter through a monotonically decreasing relationship: the larger the privacy budget parameter, the smaller the flip probability; the smaller the privacy budget parameter, the larger the flip probability. This correspondence is a mathematical guarantee that the randomized response mechanism under the differential privacy theoretical framework satisfies the local differential privacy definition, ensuring that when any attacker observes a single reported value, they cannot infer the existence of the real edge of the participant with a confidence level exceeding that allowed by the privacy budget parameter.

[0123] The flip probability has clearly defined upper and lower bounds. When the flip probability is 0.5, the reported value is completely random and has no statistical correlation with the true value. This provides the strongest level of privacy protection, but the reported information is completely useless. When the flip probability is 0, the reported value is the true value. This provides the highest statistical accuracy but offers no privacy protection whatsoever. In practical applications, the flip probability is usually set within a range of 0 to 0.5, with the specific value determined by the privacy compliance requirements of the application scenario (such as GDPR regulations, industry data security standards, or the organization's internal privacy policy).

[0124] Specifically, the probability of flipping Privacy Budget Parameters The relationship is Privacy Budget The larger the value, the lower the probability of flipping, the weaker the privacy protection, but the higher the statistical accuracy. The smaller the value, the higher the probability of flipping, resulting in stronger privacy protection but also introducing more noise. Each participant independently executes a randomized response to the existence of edges for each node pair, generating a noisy edge state report.

[0125] S3.3.2: The central node summarizes the noisy edge state reports of the multiple participants, performs linear unbiased correction on the aggregation result according to the flip probability, eliminates the systematic bias introduced by the randomized response, and obtains the privacy-preserving prior edge set.

[0126] The linear unbiased correction formula is: ,in This represents the average of the noisy edge states after aggregation. Let be the flip probability. This correction formula eliminates the systematic bias introduced by the randomized response in an expected sense, making the corrected privacy-preserving prior edge set statistically unbiased in reflecting the true edge distribution.

[0127] Specifically, the central node averages and aggregates the edge states of the same node reported by multiple participants. The average of the aggregated values ​​reflects the combined tendency of the participants to judge the existence of that edge. Since each participant uses a flip probability... Perform randomized responses independently and aggregate the mean. Expectations to be met ,in This represents the probability that a true edge exists between the nodes. Linear correction formula. This is the inverse algebraic transformation of the above relationship, and its expected value is exactly equal to... This eliminates the systematic bias introduced by the randomized response in a desirable sense. The corrected... Numerically, this represents an unbiased estimate of the probability of a node pair having a true edge. After converting it into a deterministic edge state using a preset binarization threshold (e.g., 0.5), the edge labels for each node pair in the privacy-preserving prior edge set are obtained. It is worth noting that linear unbiased correction eliminates bias in the statistical expectation sense, but it cannot completely eliminate random noise variance. Therefore, the privacy-preserving prior edge set still contains a certain amount of random error, which is the fundamental reason why a de-labeling strategy needs to be further implemented during the training phase of the subsequent edge relationship prediction model.

[0128] S3.3.3: Record the privacy budget parameters to the privacy budget tracking log for use in the cumulative privacy budget statistics in the quality assessment report.

[0129] Furthermore, the privacy budget tracking log runs throughout the entire collaborative construction process, recording the privacy budget parameters consumed in each stage of local differential privacy metadata processing, intersection potential protection, and edge state randomization response. Based on the differential privacy combinatorial theorem, cumulative statistics are performed during the quality evaluation stage, and finally, a global privacy budget report is presented in the quality evaluation report for dataset users to evaluate the strength of privacy protection.

[0130] Taking the construction of a cross-bank transaction graph dataset for financial institutions as an example, this paper details the complete execution process of S3.3.1 to S3.3.3 and the engineering implementation of the privacy budget tracking mechanism.

[0131] Assuming the participating parties include a state-owned bank A, a joint-stock bank B, and a city commercial bank C, the three parties have completed the construction of the aligned node set in phase S3.1, identifying a total of 8,200 cross-bank common customer nodes (mainly corporate customers), forming approximately 33.62 million customer node pairs. In accordance with regulatory requirements, the three banks have set the global privacy budget cap for this collaborative construction to ε = 2. In the privacy budget allocation for each step, the sub-budget allocated in the edge existence randomization response phase is ε = 1.2, thus determining the flip probability to be approximately 0.23.

[0132] In phase S3.3.1, each of the three banks performs randomized response reporting for all node pairs. Taking a customer node pair (company M, company N) as an example: Bank A's records show frequent bank transfers between the two companies over the past year. After processing the existence of the real edge (1) with a flip probability of 0.23, the reported value is 1 (not flipped). Bank B's records show no direct transactions between the two companies, so the existence of the real edge is 0. After processing with a flip probability of 0.23, the reported value is 0 (not flipped). Bank C's records show a bill discounting relationship between the two companies, so the existence of the real edge is 1. After processing with a flip probability of 0.23, the reported value is 0 (flipped). Each of the three parties encrypts the noisy edge state reports of all node pairs and uploads them to the central node. The amount of data reported by each party is approximately 33.62 million binary scalars, and the communication volume can be compressed to approximately 4MB.

[0133] In phase S3.3.2, the central node aggregates the reported values ​​from all three parties. For node pairs (Company M, Company N), the average of the reported values ​​(1, 0, 0) is approximately 0.33. After performing linear unbiased correction based on a flip probability of 0.23, the corrected value is approximately 0.27, which is below the binarization threshold of 0.5. This node pair is marked as non-existent in the privacy-preserving prior edge set. For node pairs where all three parties report 1, the corrected value is approximately 0.96, and they are marked as existing edges with high confidence. For node pairs where two parties report 1 and one party reports 0, the average is approximately 0.67, and the corrected value is approximately 0.57, just exceeding the binarization threshold, and they are marked as existing edges. The entire correction process is executed in batches by the central node. Linear computation on 33.62 million node pairs takes approximately 12 seconds on a standard server, demonstrating its engineering practicality.

[0134] In phase S3.3.3, the privacy budget parameter ε, equal to 1.2, used in the edge state randomization response phase is recorded in the current entry of the privacy budget tracking log. The log entry format includes the operation type (edge ​​randomization response), privacy budget consumption (ε equals 1.2, δ equals 0), operation timestamp, and participant identifier hash digest. At this point, the operations recorded in the privacy budget tracking log include: local Laplace noise processing in phase S1.3 (ε equals 0.5), intersection potential differential privacy protection in phase S3.2 (ε equals 0.3), and the edge randomization response in this phase (ε equals 1.2). According to the differential privacy combination theorem, the cumulative privacy budget consumption of the three operations is ε equal to 2.0 (equal to 0.5 plus 0.3 plus 1.2), which perfectly matches the system's configured global upper limit ε equal to 2, thus verifying privacy budget compliance. This cumulative record will be presented as a global privacy budget report in the quality evaluation report of phase S5.4 for auditing and verification by regulatory agencies and dataset users.

[0135] Example 7

[0136] like Figure 5 As shown, based on Example 1, using the aligned node set and the privacy-preserving prior edge set, the semantic completion of missing attributes and the graph structure edge repair are decoupled into two independent subtasks. These two independent subtasks are then collaboratively completed through federated aggregation, outputting cleaned cross-domain graph data, including:

[0137] S4.1: Obtain the missing attributes of each node in the aligned node set. For nodes with a missing rate exceeding a preset missing threshold, the multiple participants generate candidate values ​​for missing attributes locally using existing node attributes and neighborhood attributes as context through a language model. The generated quality scores are encrypted and uploaded to the central node to be aggregated into a global reflection signal. The multiple participants adjust their local generation strategies based on the global reflection signal and iteratively execute until the early stopping condition is met to obtain the semantically completed node attributes. Node attribute completion is performed on the nodes with a missing rate exceeding the preset missing threshold.

[0138] In this embodiment of the invention, a preset missing threshold (e.g., 0.3) is set to distinguish between two types of missing scenarios: for nodes with a missing rate exceeding the threshold, their attribute missing degree is high and they lack sufficient local context, so semantic completion using a language model is employed; for nodes with a missing rate not exceeding the threshold, their missing degree is low and their local context information is sufficient, so completion is performed using a graph autoencoder, thus balancing completion quality and computational efficiency. The language model runs locally, and the generated quality score is transmitted in encrypted form to protect the local generation strategy from being leaked.

[0139] Optionally, the specific ways in which each participating party adjusts its local language model generation strategy based on the global reflection signal include, but are not limited to, the following: When the global semantic consistency score is low, each party can increase the sampling range of the neighboring node attributes in the context prompts (from 1-hop neighborhood to 2-hop neighborhood), enabling the language model to obtain richer graph semantic context; when the global value range compliance score is low, each party can add explicit descriptions of attribute value range constraints to the prompt words, guiding the language model to limit the generated values ​​to the compliance range; when both scores are low, each party can reduce the generation temperature parameter of the language model to reduce randomness and improve the stability of the generation results. The above adjustment strategies are implemented independently by each party locally, without uploading the specific adjustment parameters to the central node. The central node only indirectly observes the adjustment effect through the improvement magnitude of the next round of global reflection signals, thereby achieving federated collaborative optimization without exposing the local language model configurations of each party.

[0140] S4.2: Based on the semantically completed node attributes and the privacy-preserving prior edge set, reverse correction is performed on the edge state labels in the privacy-preserving prior edge set according to the flip probability to eliminate the training bias introduced by differential privacy noise. The multiple participants train the edge relationship prediction model locally with the corrected labels. After gradient encryption and aggregation, a global edge relationship prediction model is obtained. The global edge relationship prediction model is used to infer the edge relationship between aligned nodes to obtain the repaired graph structure.

[0141] It should be noted that if the edge relationship prediction model is trained directly using noisy edge state labels from the privacy-preserving prior edge set, the flipping noise introduced by the randomized response will cause the model to learn a biased edge distribution, leading to noise loops. This invention eliminates this systematic bias before training by performing a reverse linear correction on the training labels based on known flipping probabilities, enabling the edge relationship prediction model to accurately learn the true edge distribution under differential privacy constraints. Each participant only uploads encrypted gradients after local training; the global edge relationship prediction model is obtained through federated aggregation and does not share any local graph structure information.

[0142] In this embodiment of the invention, the edge relationship prediction model adopts a two-layer multilayer perceptron (MLP) structure, with node pairs as input features. splicing embedding vector , where node embedding , The edge relationship prediction model is obtained by mapping the semantically completed node attributes through an embedding layer. The model output layer uses the Sigmoid activation function to map the output to the [0,1] interval as the predicted edge existence probability. After each participant trains the above model locally with debiased labels, they encrypt their local gradients using a secure aggregation protocol (such as SecureAgg based on secret sharing) and upload them to the central node. The central node performs federated averaging aggregation without decrypting individual gradients and broadcasts the aggregated global model parameters to each participant. The global edge relationship prediction model performs batch inference on node pairs in the aligned node set whose edge relationships have not yet been determined. It converts the output probability into deterministic edge labels using a preset binarization threshold, completes the edge structure of the aligned graph, and obtains the repaired graph structure.

[0143] Furthermore, the debiased labeling strategy refers to addressing the systematic flipping bias introduced by the differential privacy randomized response mechanism on edge state labels. Before training the edge relationship prediction model, the strategy is based on the known flipping probabilities of the randomized response. A linear inverse correction operation is performed on the noisy training labels to make the corrected labels equivalent to the existence of true edges in the desired sense, thereby eliminating the problem of biased edge distribution in the edge prediction model caused by noisy training. The linear inverse correction is a closed-form algebraic operation that does not require additional model training or iterative solution. The computational cost of the correction process is negligible, but its effect can theoretically fundamentally cut off the transmission path of differential privacy noise to the edge predictor parameters.

[0144] The technical principle behind the debiased labeling strategy, which eliminates systematic training bias, is as follows: The randomized response mechanism uses a flip probability... Real edge labels Random flipping, therefore noisy labels Expectations to be met If directly using As training labels for the edge relationship prediction model, the expected value of the model's loss function will be... Instead To optimize the objective and converge the model parameters to the position offset from the decision boundary corresponding to the true edge distribution, a systematic approach is adopted to predict high-confidence true edges as low-confidence edges and high-confidence true non-edges as low-confidence edges. This introduces a large number of false edges and missed true edges during the edge repair stage. This is achieved through linear inverse correction. The expectation of the corrected label is restored to the expectation of the true edge label, so that the model optimization objective reverts to the true edge distribution. Theoretically, this ensures that the model parameters converge to the decision boundary position equivalent to noiseless training.

[0145] The specific implementation steps of the de-labeling strategy are as follows: After obtaining the noisy edge state labels of each node pair in the privacy-preserving prior edge set, each participant reads the flip probability q used in the edge state randomization response stage from the privacy budget tracking log, and performs linear inverse correction operation on the noisy label vector in an element-wise manner to obtain the corrected label vector in the continuous value range. After correction, the labels are no longer binary. Each participant truncates the corrected label vector to the [0,1] interval and uses it as soft labels for training the edge relationship prediction model. The loss is calculated on the soft labels using the binary cross-entropy loss function. The advantage of soft label training is that, compared with training with hard labels after re-binarization, soft labels retain the confidence information in the correction process (soft labels close to 0 or 1 correspond to high confidence edge existence judgments, and soft labels close to 0.5 correspond to judgments with higher uncertainty), which helps the model learn a more accurate edge probability distribution.

[0146] Through the aforementioned de-labeling strategy, this invention achieves the following technical effects. First, it theoretically eliminates the systematic transmission of differential privacy noise to the edge predictor parameters, making the training performance of the edge relationship prediction model under privacy constraints equivalent to the baseline performance trained with real edge labels, thus overcoming the inherent contradiction between differential privacy and edge prediction accuracy. Second, the de-labeling operation is a closed-form algebraic computation with a time complexity of O(log n). Compared to solutions that directly increase the privacy budget to improve edge prediction accuracy, this invention achieves an equivalent quality improvement without consuming additional privacy budget. Thirdly, the soft-label training strategy enables the model to utilize the uncertainty information brought about by differential privacy noise, assigning smaller gradient weights to highly uncertain edge labels. This objectively reduces the impact of noisy samples on model parameter updates, further improving edge prediction stability.

[0147] The effectiveness of the de-labeling strategy is illustrated with specific numerical examples. Assume the privacy budget parameter ε = 2, corresponding to a flip probability q of approximately 0.12. If the true edge exists for a certain node pair... (A real edge exists between the two nodes), noisy labels after randomization of the response. The expected value is 0.88. If the edge prediction model is trained directly with noisy labels having an expected value of 0.88, for The true non-edge, with a noisy label expectation of 0.12, might be incorrectly identified as an edge if the model's learned confidence threshold shifts upwards due to noisy training, thus introducing false edges. After bias correction, The corresponding correction value is restored to 1.0. The corresponding correction value is restored to 0, the model optimization objective reverts to the true edge distribution, and the above misjudgment problem is fundamentally eliminated.

[0148] S4.3: Merge the semantically completed node attributes with the repaired graph structure to output the cleaned cross-domain graph data.

[0149] Specifically, the merging operation performs weighted fusion of shared node attributes according to the data weights of each participant, while unique node attributes are directly retained; in the repaired graph structure, the edges contributed by each participant are normalized according to their data weights and then merged, finally outputting cleaned cross-domain graph data in a standardized format.

[0150] Example 8

[0151] Based on Example 7, the missing attributes of each node in the aligned node set are obtained. For nodes with a missing rate exceeding a preset missing threshold, the multiple participants locally generate candidate values ​​for missing attributes using a language model, with existing node attributes and neighborhood attributes as context. The generated quality scores are encrypted and uploaded to the central node to be aggregated into a global reflection signal. The multiple participants adjust their local generation strategies based on the global reflection signal, iteratively executing until the early stopping condition is met, to obtain the semantically completed node attributes, including:

[0152] The LLM federated reflective semantic attribute completion mechanism refers to an iterative reflective protocol within a federated learning framework. Each participant uses its local lightweight language model as the attribute generation engine, and uses existing attributes of nodes with missing values ​​and neighboring attributes as contextual cues to drive the language model to generate candidate values ​​for missing attributes. This is achieved through encrypted uploading of quality scores, aggregation by a central node into a global reflective signal, and broadcasting. This mechanism collaboratively improves the attribute completion quality of each party without sharing local graph data or language model parameters. The core idea of ​​this "reflection" mechanism is to guide the model iteratively to correct the generation strategy through external feedback signals. This invention extends the calculation of the reflective signal from within a single model to the federated aggregation level across participants, achieving distributed semantic completion quality improvement driven by multi-party collaboration.

[0153] The mechanism described above improves completion quality while protecting data privacy. This improvement is achieved through two levels of technical principles. First, the language model's semantic completion capability for text-based and enumerated node attributes stems from its deep modeling of natural language semantic relationships. Constructing contextual cues using existing and neighboring attributes effectively activates the language model's understanding of the node's semantic features, generating candidate values ​​for missing attributes consistent with the contextual semantics. Compared to traditional graph autoencoders that rely on similarity interpolation of node embedding vectors, language model completion captures non-linear and asymmetric semantic relationships between attributes (e.g., the strong semantic association between "occupation: doctor" and "professional field: cardiology"), resulting in significantly better semantic consistency in the generated results. Second, the federated reflection protocol transmits global feedback on completion quality to all participants through a global reflection signal (the aggregated mean of cross-party generation quality scores). If a certain cue construction method produces low semantic consistency scores on the data of most participants, this signal drives all parties to jointly adjust their cue strategies, causing the overall completion quality to converge towards the global optimum. This achieves implicit distributed collaborative learning without sharing any local data.

[0154] S4.1.1: For nodes with a missing rate exceeding a preset threshold, the multiple participants process the nodes in batches according to a preset batch size. Using the existing attributes and neighborhood attributes of each batch of nodes as contextual prompts, the local language model is driven to generate candidate values ​​for missing attributes to obtain initial completion results.

[0155] Specifically, the batch processing strategy divides nodes with high missing rates into multiple processing batches according to a preset batch size (e.g., 1000 nodes / batch). Each batch is processed in parallel, making full use of local computing resources in a pipeline manner and effectively reducing the end-to-end latency of language model inference. The existing attributes (textual attributes and numerical attributes) and neighborhood attributes (attributes of adjacent nodes in the graph structure) of each batch of nodes together constitute contextual cues, enabling the language model to generate candidate values ​​for missing attributes that are consistent with the contextual semantics based on local graph semantic understanding.

[0156] S4.1.2: The multiple participants calculate semantic consistency score and value range compliance score for the initial completion result, encrypt the score and upload it, and the central node aggregates the scores of the multiple participants to obtain a global reflection signal and broadcast it to the multiple participants.

[0157] The semantic consistency score measures the semantic coherence between the generated candidate values ​​of missing attributes and the existing attributes and neighboring attributes of the node; the value range compliance score measures whether the generated value meets the preset value range constraints of the attribute (such as enumeration range, numerical interval). The two scores are transmitted to the central node in encrypted form and aggregated into a global reflection signal (e.g., the weighted average of the average scores of each party's batches), so that the central node can grasp the global completion quality status without accessing the local generated results of each party.

[0158] S4.1.3: The multiple participants adjust the generation strategy of the local language model according to the global reflection signal, iteratively optimize the initial completion result, terminate the iteration when the improvement of the global reflection signal in adjacent iteration rounds is lower than the preset early stopping threshold, and complete the missing attributes of nodes with a missing rate not exceeding the preset threshold using a graph autoencoder, and merge them to obtain the semantically completed node attributes.

[0159] Preferably, the maximum number of iteration rounds is set to 3 rounds, and the early stopping threshold is set to 0.01, that is, the iteration is terminated early when the improvement of the global reflection signal between two adjacent rounds is less than 0.01, so as to avoid the waste of computing resources caused by over-optimization.

[0160] In its implementation, the graph autoencoder uses the GraphSAGE encoder to sample and aggregate the existing attributes of nodes with low missing rates (nodes with missing rates not exceeding a preset threshold) and the attributes of their first-order neighboring nodes, generating node embedding vectors. The decoder takes these node embedding vectors as input and reconstructs the full attribute vector of the node through a multilayer perceptron structure, using the predicted value of the corresponding missing attribute dimension in the reconstructed output as the completion result. Compared to language models, the graph autoencoder has faster inference speed (no sequence generation process required) and generally better accuracy in completing numerical attributes; while language models have stronger semantic understanding capabilities for textual and enumerated attributes. This invention complements the two by attribute type and degree of missingness: for attributes with high missing rates and rich textual semantics, the language model is used for completion; for nodes with low missing rates and mainly numerical attributes, the graph autoencoder is used for completion. During merging, nodes are directly concatenated based on their partitioning, and the same node does not undergo both completion methods repeatedly, ensuring the completeness and non-redundant nature of the output node attribute set.

[0161] Through the aforementioned LLM federated reflexive semantic attribute completion mechanism, this invention achieves the following technical effects. First, for text-based and enumerated attributes (such as entity type and relation labels), the semantic consistency of language model completion is significantly improved compared to traditional graph autoencoder completion methods, making the attribute quality of the synthesized dataset closer to the level of real data. Second, the federated reflexive protocol achieves cross-party collaborative quality improvement without transmitting language model parameters across parties; each iteration only transmits a scalar quality score (communication overhead is...). floating-point numbers, of which For the number of participants, The communication cost is reduced by orders of magnitude compared to the traditional federated fine-tuning scheme (which requires transmitting the complete model gradient). Third, the batch pipeline strategy processes high-missing-rate nodes in batches in parallel, forming a dual-track parallel process with the graph autoencoder's concurrent completion of low-missing-rate nodes. This effectively reduces the end-to-end latency of attribute completion for large-scale graph datasets, making the mechanism practically usable on industrial-scale graph datasets with millions of nodes.

[0162] Example 9

[0163] Based on Example 7, before merging the semantically completed node attributes with the repaired graph structure and outputting the cleaned cross-domain graph data, the method further includes:

[0164] Step A: The multiple participants perform isolated forest anomaly detection on the nodes corresponding to the semantically completed node attributes to obtain local abnormal node labels.

[0165] In this embodiment of the invention, the Isolation Forest algorithm does not require predefined anomaly rules. It assesses the degree of anomaly by randomly constructing a decision tree and calculating the average number of splits required for a node to become isolated, making it suitable for unsupervised anomaly detection of graph node attributes. Each participant independently performs Isolation Forest anomaly detection locally on the semantically completed node attributes, marking nodes as normal or anomalous based on a preset anomaly score threshold, thus obtaining local anomalous node labels. Local detection results are not directly uploaded to protect the privacy of unilateral anomaly judgments.

[0166] In this embodiment of the invention, the setting of the isolated forest anomaly score threshold adopts an adaptive strategy: each participant uses the quantile (e.g., the 95th percentile) of the isolated forest anomaly score on its local data, based on the statistical distribution of the local graph dataset, as the anomaly judgment threshold. This ensures that approximately 5% of the nodes on each participant's local dataset are marked as suspected anomalies, avoiding the problem of excessively large differences in false positive rates across datasets of different sizes and distributions with a fixed threshold. After obtaining the local binary anomaly label vector, each participant uses it as input for secure multi-party computation. Through a secret sharing protocol, the label vector is split into multiple random shares and distributed to other participants. Each participant can only hold a meaningless random share, and neither the central node nor other participants can infer a participant's anomaly judgment on a specific node from a single share.

[0167] Step B: The local abnormal node labels are aggregated through secure multi-party computation, and nodes marked as abnormal by more than half of the participants are removed to obtain a filtered set of aligned nodes.

[0168] Specifically, the Secure Multi-Party Computation (SMPC) protocol allows multiple parties to calculate a summary statistic of tags (the number of participants whose nodes are marked as anomalous) without exposing their local tags. The SMPC protocol reconstructs the count of participants marked as anomalous for each node by performing an addition operation on the shares. A node is only removed if more than half of the participants mark it as anomalous, thus avoiding the erroneous removal of normal nodes due to unilateral detection errors and improving the robustness of anomalous removal decisions.

[0169] Step C: Merge the filtered aligned node set with the repaired graph structure to output the cleaned cross-domain graph data.

[0170] It should be understood that after the abnormal nodes are removed, the corresponding edge relationships in the edge relationship prediction model are also removed from the repaired graph structure, ensuring that the cleaned cross-domain graph data output maintains consistency at both the node set and edge set levels.

[0171] Example 10

[0172] like Figure 6 As shown, based on Example 1, the cleaned cross-domain graph data undergoes multi-dimensional automated evaluation in terms of node attribute integrity, edge relationship accuracy, and topological structure rationality, generating a quality evaluation report, including:

[0173] The graph data quality benchmark evaluation system refers to a five-dimensional automated evaluation standard system that extends the general data quality assessment framework to meet the specific quality requirements of cross-domain graph dataset construction in privacy-preserving computing environments. The five dimensions are: node attribute integrity, edge relationship accuracy, topological structure rationality, privacy budget compliance, and data diversity. The first three dimensions are a systematic integration of traditional graph data quality indicators, while the latter two are extensions of this invention for federated learning and differential privacy scenarios: the privacy budget compliance dimension quantifies the cumulative differential privacy budget consumed throughout the collaborative construction process, making the privacy protection strength of the synthesized dataset auditable and publicly declarable; the data diversity dimension uses Wasserstein discrete measurement to quantify the cross-domain coverage breadth of attribute distributions of each participant, filling the gap in existing graph dataset evaluation standards for assessing distribution representativeness.

[0174] The evaluation system expands upon existing general data quality standards in three specific areas related to graph data. First, the topological structure rationality dimension introduces degree distribution goodness-of-fit tests and connected component statistics. This is because the quality of graph data cannot be evaluated solely through node attributes and edge labels. The global topological characteristics of the graph (degree distribution shape, connectivity, clustering coefficients) directly impact the learning ability of graph neural network models. If the topological statistical characteristics of the synthesized graph differ significantly from those of the real graph, downstream models will face severe out-of-distribution generalization problems. Second, the privacy budget compliance dimension makes the theoretical guarantees of differential privacy transparent from the technical level into measurable quality indicators. This allows dataset users to independently assess the privacy risk exposure level of the dataset based on the global privacy budget report, without needing to trust the self-declarations of the data builder. Third, the data diversity dimension reuses existing computational results based on the Wasserstein complementarity metric in the two-dimensional matching admission phase. With minimal additional computational cost, it independently verifies the distribution diversity of the synthesized dataset during the evaluation phase, forming a closed loop from construction decision to quality evaluation.

[0175] S5.1: Statistically analyze the node attribute missing rate, attribute value range compliance rate, and the proportion of nodes generated by the language model for the cleaned cross-domain graph data to obtain the node attribute integrity evaluation results.

[0176] In this embodiment of the invention, the node attribute missing rate reflects the completeness of the cleaned dataset; the attribute value range compliance rate reflects whether the node attribute values ​​conform to the preset constraint specifications; and the proportion of nodes generated by the language model is a unique traceability transparency indicator for graph datasets, indicating which node attributes in the dataset are generated by the language model, allowing downstream users to assess the impact range of the model-generated content. These three indicators together constitute the node attribute completeness evaluation result.

[0177] S5.2: Calculate the divergence between the graph density distribution and the reference distribution of the cross-domain graph data and the triangle closure rate to obtain the edge relationship accuracy evaluation results.

[0178] The divergence between the graph density distribution and the reference distribution (e.g., KL divergence) reflects the degree of difference between the edge relation density distribution of the synthetic graph dataset and the reference dataset in the same domain; the smaller the divergence, the closer the edge relation distribution is to the reference. The clustering coefficient measures the proportion of triangular structures in the graph and is an important indicator of the rationality of the graph structure in scenarios such as social networks and knowledge graphs. These two indicators together constitute the edge relation accuracy evaluation result.

[0179] S5.3: Perform a goodness-of-fit test on the degree distribution of the cross-domain graph data, and calculate the average complementarity dispersion of the number of connected components and the attribute distribution of multiple participants to obtain the evaluation results of topological rationality and data diversity.

[0180] Specifically, the degree distribution goodness-of-fit test (such as the Kolmogorov-Smirnov test) verifies whether the node degree distribution of the synthetic graph conforms to the statistical regularity of the dataset in the same domain (such as the power law distribution). A test p-value greater than the significance level (such as 0.05) indicates that the topological structure is reasonable. The number of connected components reflects the overall connectivity of the graph. The average complementary dispersion of the attribute distribution of each participant (based on Wasserstein distance) quantifies the cross-domain coverage of the attribute distribution of the synthetic dataset.

[0181] In this embodiment of the invention, the reference distribution for the degree distribution goodness-of-fit test is derived from a publicly available graph dataset in the same domain, or a theoretical distribution (such as a power-law distribution or a Poisson distribution) pre-configured by the system administrator based on the target application domain. The Kolmogorov-Smirnov test evaluates the goodness of fit between the synthetic graph's degree distribution and the reference distribution by calculating the maximum absolute deviation (KS statistic) between the empirical cumulative distribution function of the synthetic graph's degree distribution and the reference distribution. If the p-value is greater than the significance level (default 0.05), the degree distribution of the synthetic graph is deemed to have passed the goodness-of-fit test. It is worth noting that the rationality of the degree distribution has a direct impact on the performance of downstream graph neural network models: if the degree distribution of the synthetic graph deviates significantly from the real-world graph data (e.g., the node degree values ​​are too uniform, or there is a lack of hub nodes), the graph neural network model trained on it will face distribution offset problems during actual deployment, leading to performance degradation. Therefore, the goodness-of-fit test is not only a formal indicator of data quality evaluation, but also an important signal for warning of downstream model deployment risks. If the test fails, the quality evaluation report will automatically generate targeted topology optimization suggestions in the improvement suggestion section.

[0182] S5.4: Summarize the cumulative privacy budget consumed, and combine the node attribute integrity evaluation results, edge relationship accuracy evaluation results, and topology rationality and data diversity evaluation results to generate the quality evaluation report.

[0183] Preferably, the cumulative statistics of the privacy budget for each step are performed according to the differential privacy combination theorem. The privacy budget parameters (ε, δ) consumed in each stage of local metadata differential privacy processing, intersection potential protection, and edge state randomization response are summed to obtain a global privacy budget report, which serves as the privacy transparency section of the quality evaluation report. The quality evaluation report is output in both structured data format (JSON) and document format (PDF). The JSON format facilitates programmatic parsing and automated compliance verification, while the PDF format facilitates manual review and external publication.

[0184] Through the aforementioned five-dimensional graph data quality benchmark evaluation system, this invention achieves the following technical effects. First, it provides standardized, multi-dimensional quality certification criteria for cross-domain constructed graph datasets, enabling the datasets to be released and circulated externally in the form of credible third-party evaluation reports, reducing the quality assessment costs for data users. Second, the introduction of the privacy budget compliance dimension incorporates the strength of differential privacy protection into the data quality evaluation system, promoting the extension of dataset quality standards to privacy computing scenarios and providing a reference model for the formulation of relevant industry standards. Third, the five-dimensional evaluation results each generate numerical scores, which can not only determine whether the dataset meets the standards but also accurately pinpoint quality shortcomings (e.g., insufficient topological rationality but compliant node attribute integrity), providing targeted improvement suggestions for iterative improvement of the dataset and supporting continuous quality optimization of synthetic datasets.

Claims

1. A method for cross-domain collaborative construction of graph datasets based on federated learning, characterized in that, include: Multiple participants perform multidimensional quality pre-checks on the graph datasets they hold locally to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics. The multidimensional information is then processed locally using differential privacy to generate quality metadata, which is not shared with external parties. Based on the quality metadata, the multiple participants are screened using an information theory contribution score mechanism, and a greedy sequence selection is performed in conjunction with the attribute distribution complementarity measure to determine the set of participants with quality scores higher than the first threshold and complementary distributions and their corresponding data weights. The data weights are used in the subsequent dataset weighting and synthesis stage, and participants with higher contribution scores have a greater weight in the final synthesized dataset. The nodes of the participating party set are aligned using a privacy set intersection protocol, and differential privacy protection is applied to the existence of cross-party edges to obtain an aligned node set and a privacy-preserving prior edge set. Using the aligned node set and the privacy-preserving prior edge set, semantic completion of missing attributes and graph structure edge repair are decoupled into two independent subtasks. These two subtasks are then collaboratively completed through federated aggregation, outputting cleaned cross-domain graph data. Specifically, this includes: obtaining the missing attributes of each node in the aligned node set; for nodes with a missing rate exceeding a preset missing threshold, multiple participants process the nodes in batches according to a preset batch size; using the existing attributes and neighborhood attributes of each batch of nodes as contextual hints, driving the local language model to generate candidate values ​​for missing attributes, thus obtaining initial completion results; and the multiple participants then refine the initial completion results. The semantic consistency score and value range compliance score are calculated for the entire result. The semantic consistency score and value range compliance score are encrypted and uploaded to the central node. The central node aggregates the scores of the multiple participants to obtain a global reflection signal and broadcasts it to the multiple participants. The multiple participants adjust the generation strategy of their local language models according to the global reflection signal and iteratively optimize the initial completion result. When the improvement of the global reflection signal in adjacent iterations is lower than a preset early stopping threshold, the iteration is terminated. The missing attributes of nodes with a missing rate not exceeding a preset threshold are completed using a graph autoencoder and merged to obtain the semantically completed node attributes. Based on the semantically completed node attributes and the privacy-preserving prior edge set, the edge state labels in the privacy-preserving prior edge set are reverse-corrected according to the flip probability to eliminate the training bias introduced by differential privacy noise. The multiple participants train the edge relationship prediction model locally with the corrected labels. After gradient encryption and aggregation, a global edge relationship prediction model is obtained. The global edge relationship prediction model is used to infer the edge relationships between aligned nodes to obtain the repaired graph structure. The semantically completed node attributes are merged with the repaired graph structure to output the cleaned cross-domain graph data. The cleaned cross-domain graph data is subjected to multi-dimensional automated evaluation of node attribute integrity, edge relationship accuracy, and topological structure rationality, and a quality evaluation report is generated.

2. The method according to claim 1, characterized in that, Multiple participants perform multidimensional quality pre-checks on their locally held graph datasets to determine multidimensional information including node attribute integrity, data consistency, timeliness, and attribute distribution statistics. This multidimensional information is then processed locally using differential privacy techniques to generate quality metadata, which is not shared externally with the original graph data. This metadata includes: Multiple participants locally calculate node attribute missing rate, edge hole rate, attribute value range violation rate, and duplicate node rate, and output integrity and consistency statistics. The timeliness of the integrity and consistency statistics is checked, and the percentage of nodes whose timestamps exceed the preset update cycle is counted to obtain the timeliness statistics. For the graph dataset corresponding to the timeliness statistics, the marginal distribution histogram of each node attribute in the corresponding graph dataset is extracted. Laplace noise is added locally using the L1 sensitivity of the marginal distribution histogram as the scale parameter to obtain a privacy attribute distribution histogram that satisfies differential privacy constraints. The integrity and consistency statistics, the timeliness statistics, and the privacy attribute distribution histogram are encapsulated to generate quality metadata.

3. The method according to claim 1, characterized in that, Based on the aforementioned quality metadata, an information-theoretic contribution scoring mechanism is used to screen the multiple participants, and a greedy sequence selection is performed in conjunction with an attribute distribution complementarity measure to determine the set of participants with quality scores higher than a first threshold and complementary distributions, along with their corresponding data weights, including: The quality statistics vector in the quality metadata is homomorphically encrypted and uploaded to the central node. The central node then performs joint statistics decryption on a randomly sampled subset in the ciphertext domain, estimates the marginal information contribution of the multiple participants to the global dataset based on conditional mutual information, and outputs the information theory contribution score of the multiple participants. The information theory contribution scores are filtered using an admission threshold, and participants with scores not lower than the admission threshold are included in the candidate set to obtain the candidate participant set. For the set of candidate participants, a greedy sequence selection is performed in combination with the attribute distribution complementarity measure to determine the set of participants whose quality scores are higher than the first threshold and whose distributions are complementary. The information theory contribution score is normalized to obtain the data weights corresponding to the set of participants.

4. The method according to claim 3, characterized in that, For the candidate participant set, a greedy sequence selection is performed based on the attribute distribution complementarity metric to determine the participant set whose quality score is higher than the first threshold and whose distribution is complementary, including: For the set of candidate participants, in each round of selection, based on the histogram of privacy attribute distribution of each candidate participant and the average distribution of the currently selected participant set, the complementarity metric of attribute distribution of each candidate participant is calculated to obtain the complementarity score of each candidate participant. The information theory contribution score and the complementarity score are weighted and summed according to a preset trade-off coefficient to obtain the comprehensive score of each candidate participant; The candidate participant with the highest overall score is included in the selected set, the average distribution is updated, and the above process is repeated until the size of the selected set reaches the target size, thus obtaining a set of participants with quality scores higher than the first threshold and complementary distributions.

5. The method according to claim 1, characterized in that, A privacy-preserving set intersection protocol is used to align the nodes of the participating party set, and differential privacy protection is applied to the existence of cross-party edges, resulting in an aligned node set and a privacy-preserving prior edge set, including: Each participant performs an elliptic curve blinded hash mapping on its local node identifier, exchanges the blinded hash value with other participants, takes the intersection of the blinded hash values ​​of multiple parties, and restores the node identifier that exists across the parties to obtain the aligned node set. Differential privacy noise is added to the intersection potential of the aligned node set to prevent any participant from inferring the node member information of other participants from the intersection size; Regarding the existence of edges between node pairs in the alignment node set, the multiple participants report edge states according to a preset flip probability using a randomized response mechanism. The central node aggregates the reporting results of the multiple participants and performs deviation correction to obtain a privacy-preserving prior edge set.

6. The method according to claim 5, characterized in that, The multiple participants report edge states according to a preset flip probability using a randomized response mechanism. The central node aggregates the reported results from the multiple participants and performs deviation correction to obtain a privacy-preserving prior edge set, including: The multiple participants determine the edge state flipping probability using a preset privacy budget parameter, and report the edge existence of multiple node pairs in a randomized response manner according to the flipping probability to obtain a noisy edge state report. The central node aggregates the noisy edge state reports from the multiple participants, performs linear unbiased correction on the aggregation result based on the flipping probability, eliminates the systematic bias introduced by the randomized response, and obtains the privacy-preserving prior edge set. The privacy budget parameters are recorded in the privacy budget tracking log for use in the cumulative privacy budget statistics in the quality assessment report.

7. The method according to claim 1, characterized in that, Before merging the semantically completed node attributes with the repaired graph structure to output the cleaned cross-domain graph data, the method further includes: The multiple participants perform isolated forest anomaly detection on the nodes corresponding to the semantically completed node attributes to obtain local anomaly node labels; The local abnormal node labels are aggregated through secure multi-party computation, and nodes marked as abnormal by more than half of the participants are removed to obtain a filtered set of aligned nodes. The filtered aligned node set is merged with the repaired graph structure to output the cleaned cross-domain graph data.

8. The method according to claim 1, characterized in that, The cleaned cross-domain graph data is subjected to multi-dimensional automated evaluation based on node attribute integrity, edge relationship accuracy, and topological structure rationality, generating a quality evaluation report, including: The node attribute completeness evaluation results are obtained by statistically analyzing the node attribute missing rate, attribute value range compliance rate, and the proportion of nodes generated by the language model on the cleaned cross-domain graph data. Calculate the divergence between the graph density distribution and the reference distribution of the cross-domain graph data, as well as the triangle closure rate, to obtain the edge relationship accuracy evaluation results; A goodness-of-fit test is performed on the degree distribution of the cross-domain graph data, and the average complementary dispersion of the number of connected components and the attribute distribution of multiple participants is calculated to obtain the evaluation results of topological rationality and data diversity. The accumulated privacy budget is summarized, and the quality evaluation report is generated by combining the node attribute integrity evaluation results, the edge relationship accuracy evaluation results, and the topology rationality and data diversity evaluation results.

Images