Privacy-preserving nl2sql method, electronic device, storage medium, and program product

Abstract

This application provides a privacy-preserving NL2SQL method, electronic device, storage medium, and program product, relating to the field of security technology. By constructing a collaborative architecture of a local execution agent and a review agent, SQL statements are generated using the efficient reasoning capabilities of a large cloud-based model, ensuring that sensitive data does not leave the domain. Through security review by the review agent, the risk of sensitive information being leaked to the cloud is effectively blocked, enhancing the integrity of privacy protection. This significantly improves the accuracy of SQL generation and the robustness of the system in complex query scenarios while ensuring privacy and security.

Description

Technical Field

[0001] This application relates to the field of security technology, and more specifically, to a privacy-preserving NL2SQL method, electronic device, storage medium, and program product. Background Technology

[0002] The development of Natural Language to Structured Query Language (NL2SQL) technology has evolved from early rule matching and deep neural network generation to the current general reasoning based on Large Language Models (LLMs). In particular, the introduction of LLMs, with their powerful contextual understanding and code generation capabilities, has significantly improved the accuracy of SQL conversion in complex query scenarios, enabling NL2SQL technology to be widely applied in many fields such as government big data analysis, financial risk control, and healthcare management. Currently, most mainstream and highly accurate NL2SQL solutions heavily rely on cloud-based large models and their intelligent agent architectures. They construct prompts from natural language queries and database schema information, and then utilize the powerful computing capabilities of the cloud to generate executable SQL statements.

[0003] However, in highly sensitive sectors such as government affairs and finance, directly uploading information containing sensitive natural language queries and database table structures to the cloud could potentially lead to privacy breaches and data sovereignty risks. To mitigate cloud risks, small-scale parametric models deployed entirely on a local private platform have become an alternative. However, limited by parameter size and training data, local small models often perform poorly in generating SQL when handling complex reasoning involving multiple table joins, nested conditions, or rare values, making it difficult to directly meet the needs of practical applications. Summary of the Invention

[0004] The purpose of this application is to provide a privacy-preserving NL2SQL method, electronic device, storage medium, and program product to improve upon existing methods that cannot simultaneously meet the requirements of privacy blocking integrity and query transformation accuracy.

[0005] In a first aspect, embodiments of this application provide a privacy-preserving NL2SQL method, the method comprising: Receive query information, which includes natural language queries and database schema information; The sensitive information in the query information is symbolized by an intelligent agent to generate symbolic query information; The symbolic query information is subject to security review by an intelligent review agent. If the security review fails, the execution agent corrects the leaked information in the symbolic query information and performs a new security review until it passes. If the security audit is passed, the symbolic query information is sent to the cloud through the execution agent, and the cloud is used to generate symbolic SQL statements using the deployed large model; The system receives symbolic SQL statements sent from the cloud and uses the recorded privacy-de-identification mapping relationship to restore the symbolic SQL statements to real SQL statements through the execution agent. The execution agent executes the real SQL statement to obtain the query results.

[0006] In the above implementation process, by constructing a collaborative architecture of local execution agents and review agents, SQL statements are generated using the efficient reasoning capabilities of large cloud models, ensuring that sensitive data does not leave the domain. Through security review by the review agent, the risk of sensitive information being leaked to the cloud is effectively blocked, enhancing the integrity of privacy protection. This significantly improves the accuracy of SQL generation and the robustness of the system in complex query scenarios while ensuring privacy and security.

[0007] Optionally, the security review includes: a first review dimension for detecting whether the symbolic query information contains unreplaced sensitive information; and a second review dimension for assessing whether there is a risk of inference attacks based on contextual semantics to deduce the original sensitive information.

[0008] In the aforementioned implementation process, the first review dimension directly identifies residual plaintext sensitive entities, effectively compensating for potential omissions in single static desensitization and ensuring that the symbolic results sent to the cloud do not contain any directly identifiable privacy content. The second review dimension further simulates the attacker's perspective, inferring the original information based on contextual semantic clues and comparing similarities, thereby defending against more covert inference attack risks. The two dimensions work together to both block explicit disclosure channels and implicit inference vulnerabilities, significantly improving the comprehensiveness and depth of privacy protection.

[0009] Optionally, the security review of the symbolic query information by the review agent includes: By reviewing the intelligent agent's construction of review prompts; Identify data identifiers or data values ​​with real semantic references in the symbolic query information based on the review prompts; If identified, the review result for the first review dimension is determined to be unsuccessful; If not identified, the review result for the first review dimension is determined to be passed.

[0010] In the above implementation process, by constructing specialized review prompt words, the review agent actively scans the symbolic query information to see if there are any database identifiers or data values ​​with real semantic references, thereby achieving targeted detection of explicit privacy leaks.

[0011] Optionally, the security review of the symbolic query information by the review agent includes: By reviewing the intelligent agent, adversarial prompts are constructed; Based on the adversarial prompts and the residual semantics of the symbolic query information, the original input content of the symbolic query information is inferred. Perform a semantic similarity comparison between the original input content and the query information; If the similarity exceeds the set safety threshold, the review result for the second review dimension is determined to be unsuccessful. If the similarity does not exceed the set security threshold, the review result of the second review dimension is determined to be passed.

[0012] In the above implementation process, by constructing adversarial prompts, the review agent actively plays the role of the attacker, reverse-engineers the original input based on the residual semantic clues in the symbolic query information, and performs a semantic similarity metric comparison with the real query, thereby realizing the active detection of implicit reasoning attack risks.

[0013] Optionally, the executing agent and the reviewing agent adopt the same base model and share a global state, which includes: natural language query, database pattern information, current privacy-de-identified mapping relationship set, and intermediate execution results.

[0014] In the above implementation process, by sharing the same model weights, the problem of doubling the video memory and computing resources caused by loading two independent large models at the same time is avoided, which significantly reduces the hardware threshold and operating cost of local deployment. Through a unified global state (including the original query, database mode, de-identified mapping relationship and intermediate results), information sharing and consistency guarantee between the two types of intelligent agents with zero latency are achieved, avoiding decision deviations caused by message transmission or state asynchrony.

[0015] Optionally, the global state is managed through an implicit state transition mechanism, which includes: defining a tool library as a set of mapping functions from state space to state space; the executing agent selects the tool identifier of the tool to be invoked at any time step; injects the current global state into the selected tool through the underlying environment; and updates the state components after the tool is executed to obtain a new global state.

[0016] In the above implementation, each tool in the tool library is formalized as a mapping function from state space to state space. The executing agent only needs to output the tool identifier, and the underlying runtime environment automatically completes the injection of the current global state, tool execution, and atomic updates of state components. This significantly reduces the burden on the agent to construct complex parameter lists for each decision and reduces various risks caused by parameter generation errors.

[0017] Optionally, the method further includes: When the executing agent makes a decision, it extracts the observation context from the historical interaction trajectory and transmits the observation context to the executing agent for decision-making; the observation context includes the most recent w rounds of interaction records and keyframes, and the keyframes include key state nodes in the global task.

[0018] In the above implementation process, sliding window memory enables the agent to accurately capture the real-time feedback signals of the most recent rounds, ensuring rapid response to abnormal situations such as review rejection in multiple rounds of repair iterations and avoiding repetitive errors; while keyframe memory locks the logical anchor point of the global task, effectively preventing catastrophic forgetting in long-term interactions and ensuring that the agent always reasones around the user's original intent.

[0019] Optionally, the step of symbolizing sensitive information in the query information by executing an intelligent agent includes: By executing atomic operations through an intelligent agent, a privacy protection tool is invoked to symbolize sensitive information in the query information. The privacy protection tool is a composite tool that encapsulates pattern filtering, entity recognition, entity linking, and symbolization processing into a single atomic call.

[0020] In the above implementation process, by encapsulating pattern filtering, entity recognition, entity linking, and symbolization into a composite privacy protection tool, and having the executing agent complete all desensitization operations in a single atomic call, the decision complexity of the executing agent is reduced. The agent does not need to schedule four independent tools sequentially, but only needs to issue a single call instruction, thereby reducing the inference overhead caused by multiple rounds of interaction. Secondly, atomic encapsulation avoids the risk of state interruption and data inconsistency between steps, ensuring that entity linking and symbolization replacement are completed sequentially in the same context, eliminating the possibility of missing entity chains or symbol mismatches due to step separation.

[0021] Optionally, the pattern filtering includes: Based on the local cross encoder, the tables and columns in the database schema information are relevance scored to filter out candidate subsets; The candidate subset is fine-grained by using a local model to remove redundant tables and columns through prompts.

[0022] In the above implementation process, the first stage uses a local cross-encoder to score the relevance of tables and columns in the database schema, which can quickly narrow down the candidate range with low computational cost and significantly reduce semantic noise and token overhead in subsequent processing. The second stage uses a local small-parameter model to perform fine-grained pruning through prompt words, and leverages the semantic understanding capabilities of a large language model to identify complex information such as field abbreviations and implicit associations, further eliminating redundant elements. Thus, while ensuring recall relevance, the accuracy and execution efficiency of entity recognition and symbolization processing are significantly improved.

[0023] Optionally, the entity recognition and the entity linking include: Identify the lexical units in the natural language query that correspond to specific data values ​​in the database, and link them to specific columns or tables in the database schema information; Identify entity tokens in the natural language query that reference the database schema, and link them to the corresponding table name or column name in the database schema information.

[0024] In the above implementation process, by identifying and linking specific data values ​​(such as personal names and drug names), sensitive information in the query can be accurately located, providing a complete basis for subsequent symbolic replacement and effectively avoiding privacy leaks due to missed detections; by identifying and linking entity tokens that reference database patterns (such as table names and column names), the accurate mapping between natural language descriptions and database structures is ensured, preserving a complete logical skeleton for generating symbolic SQL in the cloud.

[0025] Optionally, the symbolization process includes: The table names and column names in the database schema information, as well as the sensitive data in the natural language query, are mapped to different types of distinguishable symbolic identifiers to obtain symbolic query information. Add an association between the symbol and the corresponding database schema element to the symbolized query information. The association is a privacy-de-identified mapping relationship.

[0026] In the above implementation process, different types of symbol identifiers enable the cloud-based large model to clearly distinguish between structural references and data values, avoiding semantic confusion and thus accurately generating logically consistent SQL skeletons. At the same time, the additional relationships provide the cloud with mapping guidance between value symbols and column symbols, making up for the lack of semantics after desensitization, and improving the success rate and accuracy of symbolic SQL generation without exposing the original sensitive information.

[0027] Optionally, the review agent maintains a set of sensitive information for storing potential leaks identified during the security review process. The step of correcting the leaks in the symbolic query information through the execution agent includes: The leaked information in the set of leaked sensitive information is corrected by the executing intelligent agent; Specifically, if the review agent determines that the set of leaked sensitive information is empty, then the security review is deemed to have passed.

[0028] In the above implementation process, scattered explicit leakage and implicit reasoning risks are uniformly collected into a single set, providing a structured basis for correction for the executing agent, which facilitates the accurate location of leakage terms and their respective stages, and avoids the processing chaos caused by multi-source heterogeneous information.

[0029] Optionally, the step of correcting the leaked information in the symbolic query information through the executing intelligent agent includes: The execution agent invokes a privacy repair tool to correct the leaked information in the symbolic query information; The privacy repair tool performs the following operations: Based on the leakage information from the security review feedback, locate the symbolic processing stage that caused the leakage; The privacy replacement operation involved in the symbolization process is corrected, and all downstream processing steps are re-executed sequentially from this step to achieve cascading state updates.

[0030] In the above implementation process, the leaked information is directly traced to the specific step in the symbolization process where the omission occurred (such as entity recognition, entity linking, or symbolization replacement), rather than resetting the entire desensitization process, which reduces the computational overhead and time cost required for repair; only the step is locally modified, and all downstream processing steps after the step are automatically re-executed, ensuring the consistency of the symbolization result from beginning to end, and avoiding secondary leakage or symbol mismatch caused by incomplete modification or downstream non-synchronization.

[0031] Optionally, the step of executing the real SQL statement through the execution agent to obtain the query result includes: The execution agent invokes the SQL execution tool in the SQL processing class tool to execute the actual SQL statement and obtain the query result; The SQL execution tool is deployed in a sandbox environment and is subject to the following security constraints: connecting to the database in read-only mode; setting an execution timeout threshold and an upper limit on the number of rows in the result set; and intercepting and returning error messages for data modification or structural change operations in SQL statements.

[0032] In the above implementation process, connecting to the database in read-only mode fundamentally eliminates any data tampering or structural changes. Combined with a proactive interception mechanism for modification statements, this forms a double layer of protection, ensuring the integrity and security of the local database. Setting execution timeout thresholds and result set row limits effectively defends against resource exhaustion attacks caused by complex queries or maliciously crafted SQL, preventing database services from becoming paralyzed due to prolonged occupation or massive returns. These constraints collectively constitute a security isolation layer for the local execution phase. This ensures that even if the restored real SQL encounters anomalies during cloud inference or attackers attempt to inject malicious code, it remains harmlessly confined within the sandbox boundary. Thus, without sacrificing the convenience of large-scale cloud model inference, a reliable and controllable execution environment is provided for data queries in highly sensitive scenarios.

[0033] Secondly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the method provided in the first aspect above are performed.

[0034] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method provided in the first aspect above.

[0035] Fourthly, embodiments of this application provide a computer program product, including computer program instructions, which, when read and executed by a processor, perform the steps of the method provided in the first aspect above.

[0036] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A schematic diagram of a privacy-preserving NL2SQL intelligent agent collaborative architecture provided for embodiments of this application; Figure 2A flowchart illustrating a privacy-preserving NL2SQL method provided in this application embodiment; Figure 3 A schematic diagram of an agent cooperative model provided in this application embodiment; Figure 4 A flowchart illustrating the implementation of an implicit state transition mechanism provided in this application embodiment; Figure 5 A flowchart illustrating the implementation of a hybrid memory mechanism provided in this application embodiment; Figure 6 A schematic diagram illustrating the relationship between various tools provided in this application embodiment; Figure 7 A flowchart illustrating the implementation of a privacy protection tool provided in this application embodiment; Figure 8 A flowchart illustrating the implementation of a privacy-repairing tool provided in this application embodiment; Figure 9 A structural block diagram of a privacy-preserving NL2SQL device provided in this application embodiment; Figure 10 This is a schematic diagram of the structure of an electronic device for executing a privacy-preserving NL2SQL method, provided as an embodiment of this application. Detailed Implementation

[0039] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0040] It should be noted that the terms "system" and "network" in the embodiments of this invention can be used interchangeably. "Multiple" refers to two or more; therefore, in the embodiments of this invention, "multiple" can also be understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0041] It should also be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0042] Before introducing the specific implementation method of this solution, for ease of understanding, we will first give a brief introduction to the overall architecture involved in this solution.

[0043] like Figure 1 As shown, Figure 1This is a schematic diagram of a privacy-preserving NL2SQL intelligent agent collaborative architecture (Generate a User And Repair Driven SQL, GUARD-SQL). This system uses a privacy boundary as a hard isolation limit, strictly dividing the execution space into a local trusted environment and a cloud-based untrusted environment. All operations involving sensitive entities, the original database schema, and business data are completed in the local trusted environment; the cloud only receives the anonymized pure logical semantic skeleton, utilizes the powerful reasoning capabilities of its large language model to generate symbolic SQL statements, and does not retain any state information.

[0044] In this architecture, the local environment serves as the storage center for all data, undertaking core processing logic such as interaction management, process control, and tool invocation, ensuring that sensitive data is strictly confined within the local security boundary; while the cloud environment, as the computing power provider, is only allowed to perform inference tasks based on de-identified non-sensitive data, in order to eliminate the risk of privacy data retention.

[0045] GUARD-SQL has three core modules: a control module, a tools module, and a resource support module. These modules work closely together to build a privacy-preserving NL2SQL agent collaborative architecture with a closed-loop mechanism for generation, review, and remediation. The definitions and main responsibilities of each module are described below.

[0046] 1. Control module.

[0047] The control module is the decision-making core of the entire system, deployed in a local trusted environment, and carries the agent collaboration logic. This module contains two agents based on the same foundation model but with different roles: The executing agent is responsible for parsing the user's natural language query, autonomously planning tool call paths based on the current task status, and advancing the task process by calling various tools. Through a series of tool calls, it generates the SQL statement required by the end user. Internally, it maintains a global state object, which uses a key-value pair structure to store the original query, database schema, symbol mapping table, and intermediate results at each stage.

[0048] The review agent focuses on security oversight. After the executing agent completes symbol de-identification, the review agent is triggered to perform explicit leak detection and implicit inference attack detection on the de-identification results. The two agents collaborate using a global state shared in a memory region. If the review fails, the review agent returns a feedback signal to the executing agent containing the specific location of the leaked term; if the review passes, the next stage of the process is executed.

[0049] 2. Tools module.

[0050] The tools module encapsulates all atomic functions that interact with external resources, exposing them to the control module as a RESTful API. This module is divided into three types of tools based on their functional characteristics: privacy protection, privacy remediation, and SQL processing. Privacy Protection Tools: This toolkit ensures the privacy and security of content transmitted to the cloud model by masking and symbolizing the input query and database schema. It primarily filters database schema information highly relevant to the user's intent, and uses entity recognition technology to synchronously abstract the original natural language query and database structure, eliminating sensitive features while preserving semantic logic.

[0051] Privacy Repair Tool: This tool responds to rejection signals from the reviewing agent. Upon receiving feedback from the reviewing agent, the toolset first performs phased repairs on the privacy protection aspects involved in the leak, based on the leaked information and the original context. Then, it sequentially re-executes subsequent privacy protection steps starting from the current step, ensuring the repaired state is fully updated. This method avoids resetting the entire inference task, improving the execution efficiency and stability of complex tasks in multi-turn interactions.

[0052] This SQL processing toolset covers the entire lifecycle of SQL statements, streamlining the execution chain from logical reasoning to data retrieval. It not only generates anonymized SQL statements but also undertakes the crucial task of reconstructing the anonymized results into executable standard SQL statements through reverse mapping. Finally, it handles the final SQL execution and the repair of any exceptions.

[0053] 3. Resource support module.

[0054] This module forms the infrastructure layer of GUARD-SQL, responsible for providing the necessary data and computing power support for upper-layer computations. Based on differences in data sensitivity and environmental reliability, this module is physically divided into local and cloud components. The local component includes the business database and small parameters (…). The model consists of a database storing core database schema metadata and business records, accessible only to local tools; a local small-parameter model provides basic named entity recognition and semantic analysis support offline. The cloud-based portion connects to a high-performance large language model, used as a logic inference engine. This module establishes a data-localized, cloud-based inference operating model through a physical isolation strategy, cutting off the physical path to privacy leaks at the infrastructure level.

[0055] The following section, in conjunction with the implementation process, elucidates the internal operating mechanism of the aforementioned agent collaborative architecture. Its core lies in the dynamic interaction and functional complementarity between the executing agent and the reviewing agent. This solution ensures high-quality privacy protection through multiple rounds of review and remediation iterations by clearly defining the agent's state space, perceptual behavior, and decision-making logic, thereby guaranteeing accurate understanding of NL2SQL semantics.

[0056] Please refer to Figure 2 , Figure 2 A flowchart of a privacy-preserving NL2SQL method provided in this application embodiment is included, the method comprising the following steps: Step S110: Receive query information.

[0057] In the local privacy-preserving NL2SQL system, the executing agent first receives query information from the user. This query information includes two parts: first, the query statement entered by the user in natural language, such as "Query the hospitalization records of the child diagnosed with progressive muscular dystrophy yesterday and prescribed nusinersen sodium injection by Li Ming"; second, the database schema information related to the query, including structural descriptions such as table names, column names, primary and foreign key constraints, etc. The system can store this information in a globally shared state for use in subsequent steps.

[0058] Step S120: The sensitive information in the query information is symbolized by the execution agent to generate symbolized query information.

[0059] Symbolization refers to replacing sensitive entities (such as personal names, disease names, drug names, etc.) in natural language queries and database schema information with meaningless placeholder symbols such as [PERSON], [DRUG], [T1], [C1], while recording the mapping relationship between the original entities and the symbols. This mapping relationship is called the privacy desensitization mapping relationship.

[0060] The executing agent can invoke locally deployed privacy protection tools to perform symbolic desensitization processing on the received natural language queries and database schema information. The specific processing flow is as follows: First, the executing agent uses a local small-parameter model to perform entity recognition on the natural language query, identifying words belonging to sensitive categories, such as the name "Li Ming," the disease name "progressive muscular dystrophy," and the drug name "Nusinersen sodium injection." Simultaneously, it filters the table names and column names in the database schema information, retaining only the parts relevant to the query semantics. Then, the executing agent assigns a unique symbolic identifier to each identified sensitive entity: for database table names, it maps to [T1], [T2], etc.; for column names, it maps to [C1], [C2], etc.; and for specific data values ​​in the query, it maps to [V1], [V2], etc.

[0061] The executing agent records the correspondence between the original sensitive entities and symbols as a privacy-de-identified mapping relationship and stores it in local memory. Finally, the executing agent replaces all sensitive words in the original query and database schema information with corresponding symbols to generate symbolic query information, which includes symbolic natural language queries and symbolic database schema information. This symbolic query information no longer contains any sensitive content with real semantic references, but only retains the logical structure of the query (e.g., "query the hospitalization records of the child diagnosed with [DISEASE] and issued [DRUG] yesterday by [PERSON]" and the symbolic table structure [T1]([C1],[C2],...)).

[0062] Step S130: The symbolic query information is subject to security review by the review agent.

[0063] After the executing agent completes the symbolization process, it submits the generated symbolized query information to the reviewing agent. The reviewing agent performs a security review from two dimensions: Leakage detection is displayed: The review agent scans symbolic query information to determine whether there are still any unreplaced sensitive terms (such as directly exposed "Li Ming" or unmasked column names). If any are found, these terms are recorded as leaked information.

[0064] Implicit Reasoning Attack Detection: The review agent acts as a malicious attacker, attempting to deduce possible original sensitive information based on contextual clues in symbolic query information. For example, if a symbolic query contains "[DISEASE] diagnosed yesterday," and although [DISEASE] is symbolized, words in the context such as "hospitalization record" and "child" may still point to a specific disease category. The review agent generates a reasoning result and compares its semantic similarity with the actual original query. If the similarity exceeds a preset security threshold (e.g., 0.7), an implicit disclosure risk is identified, and relevant clues are included in the leaked information.

[0065] The specific review process for reviewing intelligent agents can be found in the detailed description in the subsequent embodiments, and will not be elaborated on here.

[0066] If no leakage is found in either of the above two dimensions (i.e., the leakage information is empty), the review is passed and proceeds to step S150; otherwise, the review is not passed and proceeds to step S140.

[0067] Step S140: If the security review fails, the leaked information in the symbolic query information is corrected by executing the intelligent agent, and the security review is carried out again until the review passes.

[0068] When the review agent returns a signal indicating that the review has failed, this signal carries the specific content of the leaked information (e.g., the leaked term "nusinersen" and its position in the original query). Upon receiving the leaked information, the executing agent can invoke a locally deployed privacy remediation tool to correct the issue. The specific remediation process of the privacy remediation tool can be described in detail in subsequent embodiments, and will not be elaborated upon here.

[0069] After the correction is completed, the executing agent re-executes all subsequent processing steps (including entity linking, symbolic replacement, etc.) starting from the correction stage, generating updated symbolic query information and overwriting the original symbolic query information. Then, the executing agent submits the updated symbolic query information to the reviewing agent again, repeating the review process of step S130. If it fails again, the above-mentioned repair iteration continues until the review is passed. This closed-loop mechanism ensures that the symbolic query information finally sent to the cloud does not contain any sensitive information.

[0070] Step S150: If the security review is passed, the symbolic query information is sent to the cloud by executing the intelligent agent.

[0071] Once the reviewing agent confirms that the current symbolic query information meets privacy and security requirements, the review is approved. The executing agent then sends the symbolic query information (including the symbolic natural language query and the symbolic database schema information) to an untrusted environment in the cloud via an encrypted network connection. A general-purpose large language model (e.g., GPT-4) is deployed in the cloud, and the cloud is used to generate symbolic SQL statements using this large model.

[0072] After receiving the symbolic query information, the cloud model generates the corresponding structured query language based solely on the logical relationships between the symbols. The cloud model does not need to know the original entities represented by the symbols; it only needs to output SQL statements containing the same symbols according to the query requirements, such as `SELECT [T1].[C3] FROM [T1] WHERE [T1].[C1] = '[V1]' AND [T2].[C2] = '[V2]'`. This SQL statement generated by the cloud is called a symbolic SQL statement. After generation by the cloud, the symbolic SQL statement is returned to the local execution agent, and the cloud does not save any logs or state locally.

[0073] Step S160: Receive the symbolic SQL statement sent from the cloud, and restore the symbolic SQL statement to the real SQL statement by executing the intelligent agent using the recorded privacy-de-identification mapping relationship.

[0074] After receiving the symbolic SQL statement returned from the cloud, the execution agent reads the privacy-de-identifying mapping relationship recorded in step S120 from local memory. This mapping relationship contains a one-to-one correspondence between each symbol and the original sensitive entity (table name, column name, data value). The execution agent iterates through all symbols in the symbolic SQL statement, replacing each symbol with its corresponding original entity. For example, [T1] is replaced with the actual table name "patients", [C1] is replaced with "name", and [V1] is replaced with the specific value 'Li Ming'. For non-sensitive condition values ​​(such as dates), since no symbolic processing is performed, the original values ​​are directly retained. After the complete string replacement, an executable standard SQL statement targeting the real database is generated. This restoration process is completed entirely locally, and the original sensitive values ​​do not leave the local environment.

[0075] Step S170: Execute the real SQL statement by the execution agent to obtain the query results.

[0076] The execution agent submits the restored real SQL statement to the local database execution engine. After the database executes the SQL statement, it returns the query results (e.g., hospitalization records of children meeting the criteria). The execution agent can then return the query results to the user in a user-friendly format (such as JSON or a table).

[0077] In the above implementation process, by constructing a collaborative architecture of local execution agents and review agents, SQL statements are generated using the efficient reasoning capabilities of large cloud models, ensuring that sensitive data does not leave the domain. Through security review by the review agent, the risk of sensitive information being leaked to the cloud is effectively blocked, enhancing the integrity of privacy protection. This significantly improves the accuracy of SQL generation and the robustness of the system in complex query scenarios while ensuring privacy and security.

[0078] like Figure 3 As shown, in the agent collaboration model, although the executing agent and the reviewing agent have different roles, they adopt the same base model, such as being built on the same pre-trained large language model, and share a global state. At any time step, the global state includes natural language queries, database pattern information, the current set of privacy-de-identified mapping relationships, and intermediate execution results.

[0079] At the start of each NL2SQL task, the system creates a new global state object and stores it in local shared memory. The components of the initial global state are as follows: Natural language query: Directly stores the original query string entered by the user, such as "Query the hospitalization records of the child diagnosed with progressive muscular dystrophy yesterday and prescribed nusinersen sodium injection by Li Ming".

[0080] Database schema information: The full or filtered table structure, column names, and primary and foreign key relationships read from the local database, stored in a list or tree structure, for example, [{"table": "patients", "columns":["id","name","age"]},...].

[0081] The current set of privacy-de-identified mapping relationships: initially an empty dictionary. As the de-identification process progresses, key-value pairs are gradually filled in, for example, {"Li Ming":"[PERSON_1]", "Nusinersen Sodium Injection": "[DRUG_1]",...}.

[0082] Intermediate execution results: Initially an empty list. As the task executes, the output of each stage is recorded progressively, including: symbolic natural language queries, symbolic database schemas, review conclusions, symbolic SQL statements, restored real SQL statements, and SQL execution results.

[0083] The global state object is encapsulated in a thread-safe context manager, ensuring atomicity of reads and writes at any point in multi-round interactions.

[0084] The executing agent, as the primary actor, is responsible for driving the evolution of the state. It analyzes the current state, autonomously plans and executes the various tools that need to be invoked, thereby generating new intermediate states. The reviewing agent, acting as the reviewer of the intermediate states, does not directly modify the data but instead performs security assessments on the privacy-related intermediate results produced by the executing agent.

[0085] The review agent rigorously examines intermediate results by simulating potential privacy attacks. Upon detecting a privacy breach risk, the review agent refuses to transition to the current state and generates a feedback signal containing specific error locations and corrective suggestions. The executing agent, upon receiving the feedback, must adjust its strategy accordingly and invoke privacy-remediating tools for targeted corrections. This dynamic feedback loop constitutes the core operating mechanism of the architecture, ensuring a high degree of privacy protection for the output results.

[0086] In the above implementation process, by sharing the same model weights, the problem of doubling the video memory and computing resources caused by loading two independent large models at the same time is avoided, which significantly reduces the hardware threshold and operating cost of local deployment. Through a unified global state (including the original query, database mode, de-identified mapping relationship and intermediate results), information sharing and consistency guarantee between the two types of intelligent agents with zero latency are achieved, avoiding decision deviations caused by message transmission or state asynchrony.

[0087] To achieve collaboration between the executing agent and the tool, the aforementioned global state can be managed through an implicit state transition mechanism. The implicit state transition mechanism includes: defining the tool library as a set of mapping functions from the state space to the state space; the executing agent selects the tool identifier of the tool to be invoked at any time step; injecting the current global state into the selected tool through the underlying environment; and updating the state components after the tool executes to obtain a new global state.

[0088] GUARD-SQL uses a global state centrally to maintain core context parameters in the interactive task flow. This method separates decision logic from parameter filling, reducing the inference burden on the agent.

[0089] The privacy-preserving NL2SQL task is modeled as a discrete-time series process. Let any time step in the NL2SQL task... The global state is This state serves as a unified information hub for the collaborative work between the executing agent and the reviewing agent. It is defined as a multi-dimensional tuple containing environmental constraints, task context, and the current execution snapshot, and its formal representation is as follows:

[0090] in, This represents the original natural language query, which serves as the initial input and constant constraint for the task, remaining unchanged throughout the task's lifecycle. This represents database schema information, including table structure definitions. With primary and foreign key constraints ,Right now ; : Represents the current set of privacy-de-identification mapping relationships. It records the bijective relationship between the original sensitive entities and the desensitized symbols; : Indicates intermediate results during the execution process, including but not limited to symbolic results, audit results, or SQL execution results.

[0091] Based on the definition of the global state space described above, GUARD-SQL uses an implicit state transition mechanism. The tool library is defined as a collection of functions. Any tool It is defined as a mapping function from state space to state space:

[0092] Each tool receives the current global state as input, executes specific business logic, and then returns a new global state. This means that the executing agent operates at any given time... action Simply select the target tool identifier This eliminates the need to explicitly construct complex parameter lists.

[0093] like Figure 4 As shown, the underlying runtime environment automatically takes exclusive control of the current global state from shared storage. And based on the tool identifier selected by the executing agent, find and call the corresponding tool function. As a parameter injection tool The tool reads data internally based on logic. After performing operations such as desensitization, review, repair, or SQL processing on each component, a new state is generated. The Q and D components in the new state typically remain unchanged (unless the pattern filtering results need to be updated during the repair phase), while M and... The components will be incrementally updated or replaced based on the execution results, and then... Write back to shared memory to atomically overwrite the old state. This design guarantees the atomicity of state transitions and minimizes the illusionary risk of agents generating unstructured parameters.

[0094] In the above implementation, each tool in the tool library is formalized as a mapping function from state space to state space. The executing agent only needs to output the tool identifier, and the underlying runtime environment automatically completes the injection of the current global state, tool execution, and atomic updates of state components. This significantly reduces the burden on the agent to construct complex parameter lists for each decision and reduces various risks caused by parameter generation errors.

[0095] In tool-enhanced agent collaborative architectures, the executing agent needs to continuously invoke privacy protection, privacy repair, and SQL processing tools during multi-turn interactions. As the depth of interaction increases, the complete historical trajectory expands rapidly, leading not only to high context token overhead but also potentially causing the agent to forget earlier task plans due to information overload, thus disrupting the logical coherence of multi-turn reasoning. To address the catastrophic forgetting problem in long-range interactions while controlling the context overhead of large language models, this solution provides a hybrid memory construction function. This function is responsible for analyzing historical trajectories. Extracting useful information to construct the agent's observation context Specifically, such as Figure 5 As shown, when the executing agent makes a decision, the observation context can be extracted from the historical interaction trajectory and transmitted to the executing agent for decision-making. The observation context includes the most recent w rounds of interaction records and keyframes. The keyframes include key state nodes in the global task, and w can be an integer greater than or equal to 1.

[0096] Among them, historical interaction trajectory It consists of a series of state-action pairs: The construction of the observation context follows the formula:

[0097] in This indicates that the sliding window remembers only the most recent one. Wheel interaction records This ensures that the agent can capture immediate feedback signals and achieve local error correction; This represents keyframe memory, filtering out state nodes that are crucial to the overall task, such as key state information during the initial planning of tool calls and the approval of privacy protection reviews by the agent. Once these keyframes are generated, they are locked within the context.

[0098] In the above implementation process, sliding window memory enables the agent to accurately capture the real-time feedback signals of the most recent rounds, ensuring rapid response to abnormal situations such as review rejection in multiple rounds of repair iterations and avoiding repetitive errors; while keyframe memory locks the logical anchor point of the global task, effectively preventing catastrophic forgetting in long-term interactions and ensuring that the agent always reasones around the user's original intent.

[0099] The execution agent is responsible for the core function of translating user natural language queries into executable SQL statements while protecting privacy and security. To avoid unauthorized or erroneous operations caused by the free divergence of the large model, this method constrains the macroscopic execution trajectory of the execution agent within the logical boundaries of privacy-preserving NL2SQL, endowing it with the ability to autonomously correct strategies and plan execution paths based on dynamic feedback.

[0100] To avoid unauthorized operations caused by the free divergence of large models, the executing agent does not rely on a fixed process sequence, but dynamically plans actions based on the current context. However, all actions belong to the following four key steps: 1. Symbolic Replacement: The primary task of the executing agent is not to directly generate SQL, but to invoke privacy protection tools to perform pattern filtering, entity recognition, and linking on natural language queries and database schemas, followed by symbolic replacement to construct a privacy-de-identified mapping table. The symbolic query information output in this step is stored in the global state and triggers a review agent to conduct a security review. If the review fails, the executing agent invokes privacy remediation tools based on the leaked information to perform targeted corrections and cascading updates until the review passes.

[0101] 2. Symbolic SQL Generation: After the symbolic replacement passes review, the agent calls the cloud-based large model, taking the symbolic query information from the current global state as input, to generate an intermediate SQL statement containing masked symbols (called symbolic SQL). At this stage, the cloud only encounters meaningless symbols and is unaware of any original sensitive information.

[0102] 3. Entity Restoration: After the execution agent receives the symbolic SQL returned from the cloud, it uses the privacy-de-identifying mapping relationship stored locally to reverse-replace all symbols in the SQL statement (such as [T1], [C1], [V1]) with the real table names, column names and data values, and generate a standard SQL statement for the local database.

[0103] 4. SQL Execution and Verification: The execution agent executes the restored real SQL statement locally, verifying the non-nullability and logical correctness of the returned results. If SQL execution fails (e.g., syntax error, division by zero exception, or timeout), the execution agent calls the SQL repair tool, automatically corrects the error using a local small-parameter model based on the database error log, and re-executes, retrying a maximum of three times. If execution succeeds, the query results are returned to the user.

[0104] The agent executes in each iteration according to the following process: First, it starts from the global state S. t Extract the current context snapshot, including the original natural language query, database schema information, current privacy-de-identification mapping relationships, and recent intermediate results (such as previous review conclusions or repair records). Then, based on this snapshot, use the base model to infer and generate the next decision, which is in the form of outputting a target tool identifier (such as privacy_protect, audit, privacy_repair, generate_symbolic_sql, restore_sql, execute_sql, or repair_sql). The underlying runtime environment automatically injects the current global state into the selected tool. After the tool executes, it updates the state components and generates a new global state S. t+1 Finally, the executing agent observes the new state and decides whether to continue or terminate.

[0105] When the review agent returns a rejection signal, the execution agent does not directly re-execute the complete symbol replacement. Instead, based on the missed tokens indicated in the leaked information and their corresponding stages, it invokes privacy-repairing tools to perform targeted fault repair and cascading updates. This strategy avoids resetting the entire task and improves the execution efficiency of multi-round interactions.

[0106] In the agent-based collaborative architecture, the completeness of the toolset directly determines the execution capability of GUARD-SQL. The execution agent advances the task status by calling tools, while the review agent performs security assessments based on the intermediate results output by the tools. Therefore, the design of the toolset not only needs to meet the functional requirements of the privacy-preserving NL2SQL task itself, but also needs to organically cooperate with the agent-based collaborative mechanism to provide underlying support for the closed-loop operation of generation, review, and remediation.

[0107] The following section describes the design of a dedicated toolset for privacy-preserving NL2SQL tasks within the architecture. Based on the lifecycle stages of NL2SQL tasks under privacy constraints, the toolset is divided into three core categories: privacy-preserving tools responsible for pre-data anonymization, privacy-remediation tools responsible for correcting privacy leaks, and SQL processing tools responsible for query generation, execution, and remediation.

[0108] A complete privacy-preserving NL2SQL request needs to go through four core stages in sequence: sensitive information desensitization, symbolic SQL generation, symbol-to-entity reconstruction, and final execution. The relationships between the tools are as follows: Figure 6 As shown. Privacy protection tools correspond to the first stage, their function being to transform raw input containing sensitive information into a symbolic representation that can be securely exposed to the cloud. Privacy repair tools, on the other hand, do not correspond to a specific linear stage. Instead, they function as a separate execution unit, invoked by the execution agent when the review agent detects a privacy breach. They perform targeted corrections on the breached areas within the privacy protection tools and conduct cascading updates. The repaired results are then resubmitted to the review agent for secondary verification. If the review is still unsuccessful, the repair tools are triggered again for correction until privacy compliance requirements are fully met. SQL processing tools cover the subsequent three stages, handling the entire chain from logical reasoning to data acquisition. The SQL repair tools continuously repair the SQL based on feedback from the execution tools.

[0109] The toolset is designed following the principle of parallel atomization and compounding. For the privacy protection stage, which has a fixed process and strong state dependency, this solution encapsulates pattern filtering, entity recognition, entity linking, and symbolization processing into a composite tool to reduce the scheduling complexity of the agent and minimize the risk of illusions introduced by intermediate steps. For privacy repair and SQL processing, which require high-frequency interaction and may involve multiple iterations, this solution maintains a high degree of atomicity in the tools to support fine-grained process control by the executing agent.

[0110] Specifically, when the execution agent performs symbolic processing on sensitive information in the query information, the execution agent performs atomic operations to call the privacy protection tool to perform symbolic processing on sensitive information in the query information. The privacy protection tool is a composite tool that encapsulates pattern filtering, entity recognition, entity linking and symbolic processing into a single atomic call.

[0111] The privacy-preserving NL2SQL task comprises four logical steps: pattern filtering, entity recognition, entity linking, and symbolization. Decomposing these four steps into independent atomic tools for the executing agent to call one by one would significantly increase the agent's inference steps and easily lead to context breakage due to illusions in intermediate steps. This solution encapsulates the above process into an indivisible composite tool. The executing agent only needs to call this tool once to transform the original query into a symbolic query. The implementation flow of the privacy-preserving tool is as follows: Figure 7 As shown.

[0112] In the above implementation process, by encapsulating pattern filtering, entity recognition, entity linking, and symbolization into a composite privacy protection tool, and having the executing agent complete all desensitization operations in a single atomic call, the decision complexity of the executing agent is reduced. The agent does not need to schedule four independent tools sequentially, but only needs to issue a single call instruction, thereby reducing the inference overhead caused by multiple rounds of interaction. Secondly, atomic encapsulation avoids the risk of state interruption and data inconsistency between steps, ensuring that entity linking and symbolization replacement are completed sequentially in the same context, eliminating the possibility of missing entity chains or symbol mismatches due to step separation.

[0113] In real-world database applications, database schemas often contain hundreds or even thousands of tables, each with numerous column attributes. A specific natural language query involves only a tiny subset of the entire database schema. Directly injecting the full schema information into the model's context window incurs enormous token overhead, leading to an exponential increase in computational costs. Furthermore, a large number of irrelevant table and column names constitute high-intensity semantic noise, which severely interferes with the model's attention mechanism, causing the model to misinterpret and incorrectly reference irrelevant entities, thus significantly reducing the accuracy of SQL generation. As the first step in privacy protection, schema filtering aims to extract the subset of tables and columns most relevant to the current query's semantics from the complete database schema information, reducing noise in candidate entity recognition and symbolization. For example, schema filtering includes: scoring the relevance of tables and columns in the database schema information based on a local cross-encoder to select candidate subsets; and then using a local model to perform fine-grained pruning of the candidate subsets using prompts to remove redundant tables and columns.

[0114] The privacy protection tool first calls a locally deployed small-parameter model or a dedicated cross-encoder (such as RoBERTa) to perform a two-stage screening of database schema information. The first stage uses a discriminative method: transforming the schema screening task into a binary classification and ranking problem. Unlike traditional dual encoders that encode queries and database tables separately into vectors, this method concatenates the natural language query with each database table to form an input sequence in the form of "[CLS] Question [SEP]Table_Schema[SEP]", which is then fed into the cross-encoder for relevance scoring. A multilayer perceptron module scores the data to estimate the relevance of each table and column, retaining the top k tables with the highest scores and their associated top j columns (e.g., k=5).

[0115] The initial screening based on the cross-encoder effectively reduces the search space, but the retained candidate set may still contain redundant table and column information, which can interfere with subsequent privacy desensitization. To further improve the signal-to-noise ratio of the database schema, the second stage uses a small-parameter model for fine-grained pruning with few-sample prompts: prompt words and the candidate subset selected in the first stage are provided to the local model, and its semantic reasoning ability is used to identify field abbreviations and implicit associations, requiring the model to remove redundant elements that are irrelevant to the query intent. The final output is a concise subset D of the database schema. filtered It only includes tables and columns that are directly related to the query.

[0116] In the preprocessing stage, the candidate subset obtained in the first stage is transformed into a linear text sequence. Specifically, each database schema element is iterated and serialized into a string token with hierarchical identifiers, such as... Figure 7 The table “circuits” is serialized as “TABLE:[circuits]” and the column “circuits.name” is serialized as “COLUMN:[circuits].[name]”. This serialization method preserves the database structure information while compressing the input length to the greatest extent, allowing the model to process more candidate lists in a single inference window.

[0117] In the inference phase, i.e., the second phase, this scheme constructs prompt words containing few-sample hints. The instruction section explicitly requires the model to filter the given list based on the natural language question; the example section guides the model to learn the relevance judgment logic by embedding standard question-and-answer examples and specifies the list output format.

[0118] In the above implementation process, the first stage uses a local cross-encoder to score the relevance of tables and columns in the database schema, which can quickly narrow down the candidate range with low computational cost and significantly reduce semantic noise and token overhead in subsequent processing. The second stage uses a local small-parameter model to perform fine-grained pruning through prompt words, and leverages the semantic understanding capabilities of a large language model to identify complex information such as field abbreviations and implicit associations, further eliminating redundant elements. Thus, while ensuring recall relevance, the accuracy and execution efficiency of entity recognition and symbolization processing are significantly improved.

[0119] After pattern filtering is completed, natural language query is implemented based on the local small-parameter model capability. With filtered database schema information Semantic alignment between them. Given the high coupling between value linking and entity linking in the semantic parsing path and their inherent logical consistency in privacy de-identification tasks, these two steps are discussed in a unified manner. This mechanism will... and As input, the aim is to construct an accurate mapping between natural language lexical units and database patterns.

[0120] Specifically, entity recognition and entity linking include: recognizing lexical units in a natural language query that correspond to specific data values ​​in the database and linking them to specific columns or tables in the database schema information; recognizing entity lexical units in a natural language query that reference the database schema and linking them to the corresponding table names or column names in the database schema information.

[0121] Privacy protection tools are based on filtered database schema information The system scans the tokens in the natural language query Q to identify the token sequences that may correspond to specific data values ​​in the database. Specifically, a local small-parameter model is used to construct a prompt word, requiring the model to identify two types of entities: one is a word that may correspond to a specific data value in the database (e.g., "Li Ming" or "Nusinersen sodium"), and the other is a word that references a table name or column name in the database schema (e.g., "hospitalization record" or "drug name").

[0122] After processing the data values, the local small-parameter model is used to continue analyzing the remaining terms in the query, identifying terms that reference entities in the database schema. .

[0123] The model outputs a list of entities, each containing lexical text, entity type (value or structure reference), and its position in the query. For example, in the query "Query Li Ming's hospitalization records", the model outputs {"Li Ming": value entity, "hospitalization records": table reference}. Figure 7In the query instance, the model successfully identified the term "Silverstone Circuit" as a specific data value, and in the query instance, the model successfully identified the terms "location coordinates", "lat", "lng", and "circuit.name" as entity references of the database schema.

[0124] For value linking, after identifying potential data values, a local small-parameter model is used to map these values ​​to specific columns or tables in the database schema. For example... Figure 7 As shown, the term "Silverstone Circuit" identified by the model is mapped to the column "circuits.name". This process relies on the model's understanding of the context to determine the dependency relationship between values ​​and attributes.

[0125] For entity links, a local small-parameter model is used to accurately map the identified entity terms to the corresponding table names or column names in the filtered database schema. For example... Figure 7 As shown, the terms “location coordinates”, “lat”, “lng” and “circuit.name” are mapped to the table “circuits”, the columns “circuits.lat”, “circuits.lng” and “circuit.name”, respectively.

[0126] This step requires generating accurate and complete links to ensure that all sensitive terms can be identified and abstracted. Any unidentified values ​​or references may cause sensitive information to remain unmasked in subsequent steps, thus posing a risk of privacy leakage. However, this risk can be mitigated to some extent in subsequent privacy protection and remediation tools.

[0127] In the above implementation process, by identifying and linking specific data values ​​(such as personal names and drug names), sensitive information in the query can be accurately located, providing a complete basis for subsequent symbolic replacement and effectively avoiding privacy leaks due to missed detections; by identifying and linking entity tokens that reference database patterns (such as table names and column names), the accurate mapping between natural language descriptions and database structures is ensured, preserving a complete logical skeleton for generating symbolic SQL in the cloud.

[0128] After establishing precise link mappings, specific symbolic processing will be performed to generate symbolic query information, including symbolic queries. With symbolic database schema This process can be achieved simply by looking up the mapping table and replacing the string, ensuring the reversibility and consistency of the desensitization.

[0129] Specifically, the symbolization process includes: mapping table names, column names in the database schema information, and sensitive data in the natural language query to different types of distinguishable symbol identifiers to obtain symbolized query information; adding associations between symbols and corresponding database schema elements in the symbolized query information, where the associations are privacy-desensitized mapping relationships.

[0130] The above Each table and column retained in the code will be assigned a unique abstract symbol. For example, table names will be mapped... Column names are mapped to And from arrive The mapping will be stored as a privacy-de-identified mapping table, which will be used later to materialize symbolic SQL. Subsequently, the link mapping obtained in the previous step will be used to... Replace all corresponding lexical units with their corresponding symbols. For example... Figure 7 As shown, the tokens "location coordinates", "lat", "lng", and "circuit.name" are mapped to " "", "", "as well as" ".

[0131] After processing the entity values ​​related to the table and columns Each term detected that is related to a specific value in the database will be mapped to... And will Finally, the association between each value and the symbolic table or column name is appended. This makes it easier for the cloud-based large language model to understand the mapping relationship between values ​​and database schema elements when generating symbolic SQL, without exposing any sensitive information. For example... Figure 7 As shown, the term "Silverstone Circuit" is mapped to " , and it is associated with the "circuits.name" column (symbolized as "" in the diagram). The relationship between them was also placed in The end of.

[0132] In the above implementation process, different types of symbol identifiers enable the cloud-based large model to clearly distinguish between structural references and data values, avoiding semantic confusion and thus accurately generating logically consistent SQL skeletons. At the same time, the additional relationships provide the cloud with mapping guidance between value symbols and column symbols, making up for the lack of semantics after desensitization, and improving the success rate and accuracy of symbolic SQL generation without exposing the original sensitive information.

[0133] Privacy-protection remediation tools are core components in building a closed-loop mechanism for generation, review, and remediation. These tools focus on targeted remediation and cascading updates for specific vulnerabilities. Specifically designed to respond to leaked information reported by the review agent, they implement targeted corrections to specific steps in the symbolization and desensitization process, triggering cascading updates to ensure the security and compliance of the final symbolization result while minimizing remediation costs. When the review agent determines that the current intermediate state is non-compliant and reports an error diagnosis, the executing agent invokes this tool. Leveraging the semantic understanding capabilities of a local small-parameter model, it performs fine-grained local corrections to privacy leak points while meeting the state consistency requirements of each stage of the process.

[0134] For example, by executing an intelligent agent to invoke a privacy-remediation tool to correct leaked information in symbolized query information, the privacy-remediation tool performs the following operations: based on the leaked information from the security audit feedback, it locates the symbolization processing step that caused the leak, then corrects the privacy replacement operations involved in the symbolization processing step, and sequentially re-executes all downstream processing steps from that step to achieve cascading state updates. The main process of privacy-remediation tools is as follows: Figure 8 As shown.

[0135] When the reviewing agent detects a privacy breach in the current symbolization result (i.e., the current symbolization query information) (whether due to explicit residuals or implicit inference attack risks), it returns a rejection signal and the breached information to the executing agent. The executing agent then invokes this privacy protection and remediation tool, passing the breached information and the current global state as parameters. The tool executes the following two consecutive phases.

[0136] (1) The fault-targeted repair phase refers to tracing the leaked information back to the specific missed detection stage in the symbolic desensitization process, and only making partial corrections to the output of that stage, rather than resetting the entire desensitization process. The privacy protection repair tool first parses the leaked information, extracts the text of the leaked terms, their position in the original query, and the desensitization stage to which they may belong. In order to accurately locate the missed detection link, the tool also reads the intermediate products of each stage from the global state, including: the original natural language query Q, the filtered database schema D. filtered The outputs of the entity recognition stage (a list of identified entities), the entity linking stage (a mapping between entities and database elements), and the previously generated symbolic natural language query Q. sym and symbolic database schema information D sym The tool compares the leaked lexical terms with the output of each of the above stages: If the leaked term does not appear in the output list of the entity recognition stage, the fault is determined to be due to a missed recognition in the entity recognition stage. If the leaked term appears in the entity recognition list but not in the entity link mapping, the fault is located in the entity linking stage. If the leaked terminology has been correctly linked but not replaced by symbolization, the fault is located in the symbolization process.

[0137] Once the fault is located, the tool constructs a dedicated repair prompt template. This template integrates three aspects of information: the original natural language query and database pattern information, the current stage output results, and the specific content of the leaked terms. For example, when the fault is located in the entity recognition stage, the repair prompt could be designed as follows: Original query: {original query} Database schema (filtered): {schema description} Current entity recognition result: {Existing entity list} The review found that the following sensitive terms were not identified: {leaked terms} Please re-run the entity recognition to ensure the above terms are correctly recognized and return the updated entity list. The prompt word is sent to the local small-parameter model. Based on the diagnostic information in the prompt word, the model only supplements the identified entities and outputs a corrected list of entities. The entire process does not re-identify all entities, thus saving computational resources and avoiding interference with correctly processed entities.

[0138] (2) Cascading update stage: After correcting the output of a certain stage, all downstream stages after that stage (such as entity linking, symbolization processing) are automatically re-executed to ensure the consistency and integrity of the intermediate states of each stage.

[0139] After completing the fault-oriented repair, the tool obtains the corrected stage output. To maintain the consistency of the entire desensitization pipeline, the tool triggers the re-execution of all downstream stages following this stage. Specifically: If the correction is applied to the output of the entity recognition stage, the tool uses the corrected entity list to re-execute the two downstream stages of entity linking and symbolization.

[0140] If the correction is made to the output of the entity linking stage, the tool only re-executes the symbolization stage.

[0141] If the correction is made to the symbolization stage, then there is no need to trigger the downstream stage (because symbolization is the last step).

[0142] During the cascading update process, the tool sequentially calls the corresponding sub-functional modules, and the new output results gradually overwrite the original intermediate products in the global state. For example, after correcting entity recognition, a new entity list is written to the global state, and the tool then calls the entity linking module to rebuild the mapping between entities and database elements based on the new list, obtaining the updated linking results; next, it calls the symbolization processing module to generate a new symbolic natural language query Q. sym ′ and symbolic database schema D sym The tool then updates the privacy-de-identification mapping set M. Finally, the tool returns the updated global state to the executing agent, which can then invoke the reviewing agent again to perform a secondary review of the new symbolization results.

[0143] For example, when the reviewing agent detects the leakage risk point "circuits.name" and adds it to the set of leaked sensitive information. Subsequently, the privacy remediation tool analyzed the intermediate outputs in the globally shared state and discovered that "circuits.name" was missing from the output of the entity recognition and linking stage. The tool then determined that the entity recognition and linking stage had failed to correctly identify the entity object, thus pinpointing the root cause of the failure to be a missed detection in this stage. The privacy remediation tool then invoked the remediation prompt template for entity recognition and linking to correct this stage. After the correction was completed, the intermediate states of subsequent entity recognition and linking stages were updated according to the workflow of those stages, ensuring that subsequent stages were not affected.

[0144] By employing the above methods, privacy protection tools can correct only the specific steps where the leak occurred, avoiding an indiscriminate reset of the entire desensitization process and significantly improving remediation efficiency. Furthermore, they automatically recalculate downstream stages to ensure that the symbolization results are synchronized with the corrected content, eliminating inconsistencies in state.

[0145] In this scheme, the execution agent invokes SQL processing tools during both the reconstruction and execution of real SQL statements. Unlike the end-to-end paradigm that leaves all logic to a large, black-box model, the SQL processing tools are broken down into four atomic tools based on the SQL lifecycle: a symbolic SQL generation tool, an entity SQL reconstruction tool, an SQL execution tool, and an SQL repair tool. Each tool runs independently and is invoked by the execution agent as needed, thereby achieving fine-grained control over SQL generation, transformation, execution, and anomaly recovery.

[0146] (1) Symbolic SQL generation tool: A service component deployed in an untrusted cloud environment, whose input is a locally sent symbolic natural language query Q. sym and symbolic database schema D symThe output is an SQL statement generated based on symbolic logic (called symbolic SQL), in which all table names, column names and filter values ​​are in symbolic form.

[0147] After the executing agent confirms the security and compliance of the symbolic query information, it invokes the symbolic SQL generation tool. This tool is implemented as an HTTP client, sending a request to the cloud-based large model server endpoint. The request body contains two parts: first, a system prompt, such as "You are a strict SQL generator. You can only generate SQL statements using table symbols, column symbols, and value symbols from the given symbolic database schema. Guessing or introducing any real names is not allowed. The output contains only SQL statements."; second, a user prompt, displaying the current symbolic query information Q. sym and D sym Embedded in structured text format. The cloud-based large model generates symbolic SQL statements based on prompts, for example: SELECT [T1].[C3]FROM [T1]WHERE [T1].[C1] = '[V1]' AND [T2].[C2]= '[V2]'. After generation, the cloud returns this string, which the local tool receives and stores in the intermediate results of the global state. Throughout the entire process, the cloud never touches any real entity information, and each request is independent with no state retention.

[0148] (2) Entity SQL restoration tool: A local conversion component that uses privacy-de-identifying mapping relationship M to reverse the symbols in symbolized SQL to real database table names, column names and data values, generating standard SQL statements that can be executed on the local database.

[0149] After receiving the symbolized SQL, the execution agent invokes the entity SQL restoration tool. This tool first reads the set M of privacy desensitization mapping relationships from the global state. This set records the correspondence between each symbol and the original entity, such as {"[T1]": "patients", "[C1]": "name", "[V1]": "Li Ming",...}. The tool uses regular expressions or string traversal and replacement methods to replace all symbols in the symbolized SQL with real values one by one. When replacing, pay attention to distinguishing the context: the table symbol [Ti] is replaced with the table name, the column symbol [Cj] is replaced with the column name, and the value symbol [Vk] is replaced with the specific data value (if the value itself is a string, the quotes are retained). For literals such as dates and numbers that are not symbolized, they are directly retained as they are. After restoration, a real SQL statement is generated, such as: SELECT patients.id FROM patients WHERE patients.name = 'Li Ming' AND diagnoses.disease_name = 'Progressive Muscular Dystrophy'. The tool also stores the restored SQL statement in the global state for subsequent execution use.

[0150] (3) SQL Execution Tool: A secure execution component deployed locally, responsible for running the restored SQL statement in a sandbox environment and obtaining the query result. This tool imposes security constraints such as read-only transactions, timeout thresholds, and upper limits on the number of result set rows.

[0151] Specifically, when executing the real SQL statement, the execution agent invokes this SQL execution tool to execute the real SQL statement and obtain the query result. The SQL execution tool is deployed in a sandbox environment and has the following security constraints: connecting to the database in read-only mode; setting the execution timeout threshold and the upper limit on the number of result set rows; intercepting and returning error messages for data modification or structure change operations in the SQL statement.

[0152] Among them, the read-only mode is to execute SET TRANSACTION READ ONLY when establishing the connection or use the read-only mode option provided by the database driver to ensure that any modification operations such as INSERT, UPDATE, DELETE, ALTER, etc. are directly rejected by the database engine.

[0153] Timeout control means setting the maximum execution time of the query (such as 30 seconds) through the statement.setQueryTimeout(seconds) method. If it times out, it will automatically interrupt and throw an exception.

[0154] Result set limit means using SET maxrows or an equivalent mechanism to limit the number of returned rows (such as 1000 rows) to prevent memory overflow caused by unlimited queries.

[0155] Error interception refers to the tool capturing all exceptions returned by the database, including data modifications or structural changes, and encapsulating the error codes and messages into a standard structure to return to the caller.

[0156] If the SQL execution succeeds, the tool converts the result set into JSON format, stores it in the global state, and eventually returns it to the user. If the execution fails (e.g., table name not existing, division by zero error, syntax error, etc.), the tool does not terminate the process directly, but instead passes the error information to the SQL repair tool.

[0157] In the above implementation process, connecting to the database in read-only mode fundamentally eliminates any data tampering or structural changes. Combined with a proactive interception mechanism for modification statements, this forms a double layer of protection, ensuring the integrity and security of the local database. Setting execution timeout thresholds and result set row limits effectively defends against resource exhaustion attacks caused by complex queries or maliciously crafted SQL, preventing database services from becoming paralyzed due to prolonged occupation or massive returns. These constraints collectively constitute a security isolation layer for the local execution phase. This ensures that even if the restored real SQL encounters anomalies during cloud inference or attackers attempt to inject malicious code, it remains harmlessly confined within the sandbox boundary. Thus, without sacrificing the convenience of large-scale cloud model inference, a reliable and controllable execution environment is provided for data queries in highly sensitive scenarios.

[0158] (4) SQL Repair Tool: A local intelligent repair component that automatically corrects the SQL statement based on the error log returned by the database when the SQL execution fails, and resubmits the execution until it succeeds or the retry limit is reached.

[0159] Throughout the process, the executing agent does not need to concern itself with the internal implementation details of each tool; it only needs to trigger them in a predetermined order. This atomic decomposition makes each tool have a single responsibility, facilitating independent testing, replacement, or upgrades.

[0160] Regarding the review agent, it is responsible for performing an intermediate-state security review of the symbolic query information produced by the executing agent, after the symbolization and de-identification stage and before the symbolic SQL generation stage. Deployed in a local trusted environment, this automated security assessment unit shares the same base model as the executing agent but is assigned the role of "privacy and security reviewer" through a separate system prompt. Its input is the symbolic natural language query Q output by the executing agent. sym and symbolic database schema D sym The output includes the review conclusion (PASS or REJECT) and the set of leaked sensitive information L. leak .

[0161] To centrally manage various privacy risks discovered during the review process, the review agent maintains a set of leaked sensitive information. This is used to store potentially leaked information identified during the security review process. When the executing agent invokes the privacy remediation tool to correct the leaked information, the executing agent corrects the leaked information in the set of sensitive leaked information. If the reviewing agent determines that the set of sensitive leaked information is empty, the security review is considered passed.

[0162] Specifically, the output of the executing agent during the desensitization phase is defined as an intermediate state binary. .in This indicates a symbolic query. This represents the symbolic database schema. The task of the review agent is to construct the mapping function. .when Output Only when the execution agent is in a certain condition is it allowed to proceed to the subsequent SQL generation stage; otherwise, the review agent needs to return. The signal guides the agent to trigger a repair mechanism. This pre-screening design effectively prevents privacy breaches from spreading in subsequent stages.

[0163] To centrally manage various privacy risks discovered during the review process, the review agent needs to maintain a set of leaked sensitive information. This is used to aggregate potential leak-prone entities identified in all detection stages. Whether it's explicit sensitive word residue or implicit inference attack risks, once the detection module determines it to be a privacy hazard, the relevant entity is included in this set. Ultimately, the review agent is based on... Output the review conclusion based on whether it is an empty set: If Then it is determined to be Otherwise, it is judged as and will The specific content is fed back to the executing agent as a repair guide.

[0164] Specifically, the security review of the review agent includes two dimensions: the first review dimension is used to detect whether the symbolic query information contains unreplaced sensitive information; the second review dimension is used to assess whether there is a risk of reasoning attacks that infer the original sensitive information based on contextual semantics.

[0165] Regarding the first review dimension, it is essentially the detection of explicit privacy leaks where sensitive entities are directly exposed in the symbolic results without being replaced. The review agent performs this detection by constructing review prompts. Specifically, the review agent constructs review prompts and then identifies data identifiers or data values ​​with real semantic references in the symbolic query information based on these prompts. If identified, the review result for the first review dimension is determined to be "fail"; otherwise, it is determined to be "pass".

[0166] In the first review stage, the review agent receives symbolic natural language queries. With symbolic database schema Construct a display detection prompt. This prompt explicitly requires the model to act as a "strict privacy censor," scanning the input content word by word to identify whether the following types of un-anonymized information remain: The actual database table name or column name (e.g., the original name that was not replaced with [T1], [C1]); Specific sensitive entities such as personal names, place names, organization names, disease names, and drug names; Any data value that can be directly linked to a specific individual or business.

[0167] The review agent records each identified leaking term and its position in the text as an explicit leaking entry, and summarizes them into an explicit leaking set. And incorporate it into the collection of leaked sensitive information. ,Right now:

[0168] For example, if Q sym If the word "Li Ming" is still present and has not been replaced with "[PERSON]", then "Li Ming" is added. .

[0169] In the above implementation process, by constructing specialized review prompt words, the review agent actively scans the symbolic query information to see if there are any database identifiers or data values ​​with real semantic references, thereby achieving targeted detection of explicit privacy leaks.

[0170] Regarding the second review dimension, it could refer to implicit reasoning attack detection. In this stage, the review agent acts as a malicious attacker, attempting to infer the original sensitive information based on contextual clues from the symbolic query information. The inferred result is then compared semantically with the actual original input. If the similarity exceeds a preset threshold, a risk of reasoning leakage is identified. Specifically, the review agent constructs adversarial prompts; based on the adversarial prompts and the residual semantics of the symbolic query information, it infers the original input content of the symbolic query information; the original input content is compared semantically with the query information; if the similarity exceeds a set security threshold, the review result for the second review dimension is deemed "failed"; if the similarity does not exceed the set security threshold, the review result for the second review dimension is deemed "passed".

[0171] To defend against attackers inferring original privacy through context, the review agent performs a second layer of detection: it acts as a malicious data thief, attempting to reverse-engineer sensitive information based on the anonymized content. Specifically, the review agent receives the same... and As input, adversarial prompts are constructed to simulate an attacker's perspective, such as: "You are an attacker attempting to steal privacy. Given the following anonymized queries and database patterns, please infer the original sensitive information (such as specific names of people, diseases, drugs, etc.) as much as possible. Output your reasoning results." The review agent generates inference results based on residual semantic clues in the symbolized results (e.g., although DISEASE is symbolized in "diagnosed with DISEASE", the disease type can be inferred by combining it with words such as "hospitalization record" and "child"). Subsequently, the system calls a locally deployed semantic similarity calculation model (such as a BERT-based cross-encoder) to compare the inference results with the actual original query Q. If the similarity exceeds a set safety threshold... If the value is 0.7, then the current desensitization scheme is deemed to have an implicit reasoning leakage risk, and the relevant risk clues (such as the inferred entity type) are summarized as follows: and included in the collection of leaked sensitive information. ,Right now If the similarity is below the threshold, the implicit detection is considered to have passed.

[0172] After completing the dual detection, the review agent checks the set of leaked sensitive information. : like The review agent outputs a PASS signal, allowing the executing agent to proceed to the subsequent symbolic SQL generation step.

[0173] like Review the REJECT signal output by the intelligent agent and... The specific content (including leaked terms, leak locations, and detection dimensions) is formatted into structured feedback information and returned to the executing agent.

[0174] This feedback information is also stored in the intermediate results field of the global state, for the privacy fixation tool to read and locate the problem.

[0175] By constructing adversarial prompts, the review agent actively plays the role of the attacker, inferring the original input based on residual semantic clues in the symbolic query information, and performing a semantic similarity metric comparison with the real query, thus achieving proactive detection of implicit reasoning attack risks.

[0176] Through the aforementioned dual checks, the first review dimension directly identifies residual plaintext sensitive entities, effectively compensating for potential omissions in single static desensitization and ensuring that the symbolic results sent to the cloud do not contain any directly identifiable privacy content. The second review dimension further simulates an attacker's perspective, inferring the original information based on contextual semantic clues and comparing similarities, thereby defending against more covert inference attack risks. Working together, both dimensions block explicit leakage channels and implicit inference vulnerabilities, significantly improving the comprehensiveness and depth of privacy protection.

[0177] Please refer to the above method embodiments. Figure 9 , Figure 9 This is a structural block diagram of a privacy-preserving NL2SQL device 200 provided in an embodiment of this application. The privacy-preserving NL2SQL device 200 may be a module, program segment, or code on an electronic device. It should be understood that the privacy-preserving NL2SQL device 200 corresponds to the above method embodiment and is capable of executing the various steps involved in the method embodiment. The specific functions of the privacy-preserving NL2SQL device 200 can be found in the description above; to avoid repetition, detailed descriptions are appropriately omitted here.

[0178] Optionally, the privacy-preserving NL2SQL device 200 includes: Information receiving module 210 is used to receive query information, which includes natural language query and database pattern information; The symbolization module 220 is used to perform symbolization processing on sensitive information in the query information by executing an intelligent agent, thereby generating symbolic query information; Security review module 230 is used to perform security review on the symbolic query information through a review agent; The correction module 240 is used to correct the leaked information in the symbolic query information through the execution agent if the security review fails, and to re-perform the security review until the review is passed. The information sending module 250 is used to send the symbolic query information to the cloud through the execution agent if the security review is passed. The cloud is used to generate symbolic SQL statements using the deployed large model. SQL receiving module 260 is used to receive symbolic SQL statements sent from the cloud, and restore the symbolic SQL statements to real SQL statements through the execution agent using the recorded privacy desensitization mapping relationship; SQL execution module 270 is used to execute the real SQL statement through the execution agent to obtain query results.

[0179] Optionally, the security review includes: a first review dimension for detecting whether the symbolic query information contains unreplaced sensitive information; and a second review dimension for assessing whether there is a risk of inference attacks based on contextual semantics to deduce the original sensitive information.

[0180] Optionally, the security review module 230 is used to construct review prompt words through the review agent; identify data identifiers or data values ​​with real semantic references in the symbolic query information according to the review prompt words; if identified, determine that the review result of the first review dimension is not passed; if not identified, determine that the review result of the first review dimension is passed.

[0181] Optionally, the security review module 230 is configured to construct adversarial prompts through the review agent; infer the original input content of the symbolic query information based on the adversarial prompts and the residual semantics of the symbolic query information; compare the semantic similarity between the original input content and the query information; if the similarity exceeds a set security threshold, the review result of the second review dimension is determined to be unsuccessful; if the similarity does not exceed the set security threshold, the review result of the second review dimension is determined to be successful.

[0182] Optionally, the executing agent and the reviewing agent adopt the same base model and share a global state, which includes: natural language query, database pattern information, current privacy-de-identified mapping relationship set, and intermediate execution results.

[0183] Optionally, the global state is managed through an implicit state transition mechanism, which includes: defining a tool library as a set of mapping functions from state space to state space; the executing agent selects the tool identifier of the tool to be invoked at any time step; injects the current global state into the selected tool through the underlying environment; and updates the state components after the tool is executed to obtain a new global state.

[0184] Optionally, the privacy-preserving NL2SQL device 200 further includes: The decision-making module is used to extract the observation context from the historical interaction trajectory when the executing agent makes a decision, and transmit the observation context to the executing agent for decision-making; the observation context includes the most recent w rounds of interaction records and key frames, and the key frames include key state nodes in the global task.

[0185] Optionally, the symbolization module 220 is used to perform atomic operations by executing an intelligent agent to call a privacy protection tool to symbolize sensitive information in the query information. The privacy protection tool is a composite tool that encapsulates pattern filtering, entity recognition, entity linking and symbolization processing into a single atomic call.

[0186] Optionally, the pattern filtering includes: Based on the local cross encoder, the tables and columns in the database schema information are relevance scored to filter out candidate subsets; The candidate subset is fine-grained by using a local model to remove redundant tables and columns through prompts.

[0187] Optionally, the entity recognition and the entity linking include: Identify the lexical units in the natural language query that correspond to specific data values ​​in the database, and link them to specific columns or tables in the database schema information; Identify entity tokens in the natural language query that reference the database schema, and link them to the corresponding table name or column name in the database schema information.

[0188] Optionally, the symbolization process includes: The table names and column names in the database schema information, as well as the sensitive data in the natural language query, are mapped to different types of distinguishable symbolic identifiers to obtain symbolic query information. Add an association between the symbol and the corresponding database schema element to the symbolized query information. The association is a privacy-de-identified mapping relationship.

[0189] Optionally, the review agent maintains a set of sensitive information for storing potential leaks identified during the security review process. The correction module 240 is used to correct the leaks in the set of sensitive information by the execution agent. When the review agent determines that the set of sensitive information is empty, the security review is deemed to have passed.

[0190] Optionally, the correction module 240 is used to call a privacy repair tool through the execution agent to correct the leaked information in the symbolic query information; The privacy repair tool performs the following operations: Based on the leakage information from the security review feedback, locate the symbolic processing stage that caused the leakage; The privacy replacement operation involved in the symbolization process is corrected, and all downstream processing steps are re-executed sequentially from this step to achieve cascading state updates.

[0191] Optionally, the SQL execution module 270 is used to call the SQL execution tool in the SQL processing class tool through the execution agent to execute the real SQL statement and obtain the query result; The SQL execution tool is deployed in a sandbox environment and is subject to the following security constraints: connecting to the database in read-only mode; setting an execution timeout threshold and an upper limit on the number of rows in the result set; and intercepting and returning error messages for data modification or structural change operations in SQL statements.

[0192] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0193] Please refer to Figure 10 , Figure 10 This application provides a schematic diagram of an electronic device for executing a privacy-preserving NL2SQL method. The electronic device may include: at least one processor 310, such as a CPU; at least one communication interface 320; at least one memory 330; and at least one communication bus 340. The communication bus 340 is used to establish communication between these components. In this embodiment, the communication interface 320 is used for signaling or data communication with other node devices. The memory 330 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 330 may also be at least one storage device located remotely from the processor. The memory 330 stores computer-readable instructions, which, when executed by the processor 310, cause the electronic device to perform the aforementioned method process.

[0194] Understandable. Figure 10 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 10 The more or fewer components shown, or having the same Figure 10 The different configurations shown. Figure 10 The components shown can be implemented using hardware, software, or a combination thereof.

[0195] This application provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it performs the method process executed by the electronic device in the above method embodiments.

[0196] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as including: Receive query information, which includes natural language queries and database schema information; The sensitive information in the query information is symbolized by an intelligent agent to generate symbolic query information; The symbolic query information is subject to security review by an intelligent review agent. If the security review fails, the execution agent corrects the leaked information in the symbolic query information and performs a new security review until it passes. If the security audit is passed, the symbolic query information is sent to the cloud through the execution agent, and the cloud is used to generate symbolic SQL statements using the deployed large model; The system receives symbolic SQL statements sent from the cloud and uses the recorded privacy-de-identification mapping relationship to restore the symbolic SQL statements to real SQL statements through the execution agent. The execution agent executes the real SQL statement to obtain the query results.

[0197] In summary, this application provides a privacy-preserving NL2SQL method, electronic device, storage medium, and program product. By constructing a collaborative architecture of a local execution agent and a review agent, it generates SQL statements using the efficient reasoning capabilities of a large cloud-based model, ensuring that sensitive data does not leave the domain. Through security review by the review agent, the risk of sensitive information being leaked to the cloud is effectively blocked, enhancing the integrity of privacy protection. This significantly improves the accuracy of SQL generation and the robustness of the system in complex query scenarios while ensuring privacy security.

[0198] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0199] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0200] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0201] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0202] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A privacy-preserving NL2SQL method, characterized in that, The method includes: Receive query information, which includes natural language queries and database schema information; The sensitive information in the query information is symbolized by an intelligent agent to generate symbolic query information; The symbolic query information is subject to security review by an intelligent review agent. If the security review fails, the execution agent corrects the leaked information in the symbolic query information and performs a new security review until it passes. If the security audit is passed, the symbolic query information is sent to the cloud through the execution agent, and the cloud is used to generate symbolic SQL statements using the deployed large model; The system receives symbolic SQL statements sent from the cloud and uses the recorded privacy-de-identification mapping relationship to restore the symbolic SQL statements to real SQL statements through the execution agent. The execution agent executes the real SQL statement to obtain the query results.

2. The method according to claim 1, characterized in that, The security review includes: a first review dimension for detecting whether the symbolic query information contains unreplaced sensitive information; and a second review dimension for assessing whether there is a risk of inference attacks based on contextual semantics to deduce the original sensitive information.

3. The method according to claim 2, characterized in that, The security review of the symbolic query information by the review agent includes: By reviewing the intelligent agent's construction of review prompts; Identify data identifiers or data values ​​with real semantic references in the symbolic query information based on the review prompts; If identified, the review result for the first review dimension is determined to be unsuccessful; If not identified, the review result for the first review dimension is determined to be passed.

4. The method according to claim 2, characterized in that, The security review of the symbolic query information by the review agent includes: By reviewing the intelligent agent, adversarial prompts are constructed; Based on the adversarial prompts and the residual semantics of the symbolic query information, the original input content of the symbolic query information is inferred. Perform a semantic similarity comparison between the original input content and the query information; If the similarity exceeds the set safety threshold, the review result for the second review dimension is determined to be unsuccessful. If the similarity does not exceed the set security threshold, the review result of the second review dimension is determined to be passed.

5. The method according to claim 1, characterized in that, The executing agent and the reviewing agent adopt the same base model and share a global state, which includes: natural language query, database pattern information, current privacy-de-identified mapping relationship set, and intermediate execution results.

6. The method according to claim 5, characterized in that, The global state is managed through an implicit state transition mechanism, which includes: defining a tool library as a set of mapping functions from state space to state space; the executing agent selects the tool identifier of the tool to be invoked at any time step; injects the current global state into the selected tool through the underlying environment; and updates the state components after the tool is executed to obtain a new global state.

7. The method according to claim 1, characterized in that, The method further includes: When the executing agent makes a decision, it extracts the observation context from the historical interaction trajectory and transmits the observation context to the executing agent for decision-making; the observation context includes the most recent w rounds of interaction records and keyframes, and the keyframes include key state nodes in the global task.

8. The method according to claim 1, characterized in that, The step of symbolizing sensitive information in the query information by executing an intelligent agent includes: By executing atomic operations through an intelligent agent, a privacy protection tool is invoked to symbolize sensitive information in the query information. The privacy protection tool is a composite tool that encapsulates pattern filtering, entity recognition, entity linking, and symbolization processing into a single atomic call.

9. The method according to claim 8, characterized in that, The pattern filtering includes: Based on the local cross encoder, the tables and columns in the database schema information are relevance scored to filter out candidate subsets. The candidate subset is fine-grained by using a local model to remove redundant tables and columns based on prompts.

10. The method according to claim 8, characterized in that, The entity identification and the entity linking include: Identify the lexical units in the natural language query that correspond to specific data values ​​in the database, and link them to specific columns or tables in the database schema information; Identify entity words in the natural language query that reference the database schema and link them to the corresponding table name or column name in the database schema information.

11. The method according to claim 8, characterized in that, The symbolization process includes: The table names and column names in the database schema information, as well as the sensitive data in the natural language query, are mapped to different types of distinguishable symbolic identifiers to obtain symbolic query information. Add an association between the symbol and the corresponding database schema element to the symbolized query information. The association is a privacy-de-identified mapping relationship.

12. The method according to claim 1, characterized in that, The review agent maintains a set of sensitive information for storing potential leaks identified during the security review process. The step of correcting the leak information in the symbolic query information through the execution agent includes: The leaked information in the set of leaked sensitive information is corrected by the executing intelligent agent; Specifically, if the review agent determines that the set of leaked sensitive information is empty, then the security review is deemed to have passed.

13. The method according to claim 1, characterized in that, The step of correcting the leaked information in the symbolic query information through the executing intelligent agent includes: The execution agent invokes a privacy repair tool to correct the leaked information in the symbolic query information; The privacy repair tool performs the following operations: Based on the leakage information from the security review feedback, locate the symbolic processing stage that caused the leakage; The privacy replacement operation involved in the symbolization process is corrected, and all downstream processing steps are re-executed sequentially from this step to achieve cascading state updates.

14. The method according to claim 1, characterized in that, The process of executing the real SQL statement through the execution agent to obtain the query results includes: The execution agent invokes the SQL execution tool in the SQL processing class tool to execute the actual SQL statement and obtain the query result; The SQL execution tool is deployed in a sandbox environment and is subject to the following security constraints: connecting to the database in read-only mode; setting an execution timeout threshold and an upper limit on the number of rows in the result set; and intercepting and returning error messages for data modification or structural change operations in SQL statements.

15. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the method as described in any one of claims 1-14.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the method as described in any one of claims 1-14.

17. A computer program product, characterized in that, It includes computer program instructions, which, when read and executed by a processor, perform the method as described in any one of claims 1-14.

Images