Privacy Information Leakage Prevention Method Based on Large Language Model

Abstract

This invention relates to the fields of data security and enterprise knowledge service technology. More specifically, it relates to a privacy information leakage prevention and control method based on a large language model. This method extracts privacy clue atoms and semantic support atoms from user requests, session context, historical memory fragments, and candidate knowledge fragments, constructs a trusted clue subgraph and an identity recovery path graph, and combines minimum identifiable slot templates, counterfactual exposure simulation, and minimum blocking set solving to perform path blocking-type order reduction expression, source evidence fragment retraction, and restricted regeneration on high-risk recovery paths. At the same time, it maintains the activity recovery path state table during the streaming output process, realizing dynamic blocking and security response reorganization of privacy leakage risks, improving privacy prevention and control effectiveness, response usability, and audit traceability.

Description

Technical Field

[0001] This invention relates to the fields of data security and enterprise knowledge service technology, and more specifically, to a method for preventing privacy information leakage based on a large language model. Background Technology

[0002] As large language models are increasingly used in scenarios such as enterprise knowledge assistants, customer service Q&A, internal knowledge retrieval, and work order assistance, the system typically needs to combine internal enterprise knowledge bases, historical conversation memories, and real-time user requests to generate response content. In such scenarios, the model not only processes the current input but may also invoke historical memory fragments from multiple rounds of conversations and candidate knowledge fragments from the retrieval enhancement generation chain. Therefore, the output content often features cross-source splicing, cross-round referencing, and dynamic streaming generation.

[0003] Current technologies for preventing privacy leaks typically rely on keyword matching, regular expression filtering, entity recognition, or document-based access control. While these solutions can identify and restrict explicitly sensitive fields to some extent, they often lack effective identification capabilities for implicit identity information, transaction relationship information, or sensitive attribute information formed by combining multiple source fragments. Especially in large language model scenarios, multiple seemingly insensitive clues on their own may collectively constitute an object-identifiable recovery path during model reconstruction, summarization, continuation, and interpretation, thus leading to privacy leakage risks.

[0004] Therefore, we propose a privacy information leakage prevention method based on a large language model to address the above problems. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a privacy information leakage prevention and control method based on a large language model to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a privacy information leakage prevention method based on a large language model, comprising the following steps: Step S1: Receive the user request submitted by the caller, and obtain the session context, historical memory fragments, caller role identifier, data tag range accessible to the caller, and candidate knowledge fragments recalled from the enterprise internal knowledge base corresponding to the user request. User requests, session contexts, historical memory fragments, and candidate knowledge fragments are uniformly segmented into multiple content fragments, and a corresponding source evidence fragment record is generated for each content fragment. The source evidence fragment record includes at least the following: Source type identifier, fragment identifier, round to which it belongs, timestamp, text position range, upstream reference identifier, data tag, source object hint identifier, source trust level, and semantic role identifier; Step S2: Based on the privacy detection model and semantic parsing model, extract privacy clue atoms and semantic support atoms from each source evidence fragment record respectively; Based on the source object hint identifier, the alias reference relationship, the attribute pairing relationship, the inheritance relationship of the round to which it belongs, and the upstream reference relationship, multiple privacy clues are atomically merged into object candidate clue clusters; A conflict relation matrix is ​​constructed for privacy clue atoms in each candidate clue cluster. Based on the source trust level and the conflict relation matrix, conflict resolution is performed on conflicting privacy clue atoms to generate the corresponding trust clue subgraph. Step S3: For each trusted clue subgraph, call the preset minimum identifiable slot template to construct the corresponding identity recovery path graph. The nodes in the identity recovery path graph include at least: trusted clue nodes, released semantic nodes, candidate released semantic nodes, and target object recovery nodes. The edges in the identity recovery path graph include at least: slot complement edges, cross-round inheritance edges, cross-source reference edges, temporal co-occurrence edges, and semantic reference edges; Each identity recovery path is used to characterize a potential recovery path that allows the target object's identity, contact information, transaction relationships, or sensitive attributes to be recovered after the combination of released content and content to be released. Step S4: Based on the user request, the task intent code is parsed and constructed according to the task intent code, the caller role identifier and the data tag range. The task semantic skeleton includes at least the task target node, necessary fact node, optional explanation node and prohibited exposure node. Multiple candidate semantic response fragments are generated based on the task semantic skeleton, semantic supporting atoms, and trusted clue subgraphs. Each candidate semantic response fragment is bound to at least a corresponding set of semantic supporting atoms and an associated set of privacy clue atoms. Step S5: Perform counterfactual exposure simulation for each candidate semantic response fragment. The counterfactual exposure simulation is used to calculate the path activation increment, identifiable advancement of the target object recovery node, and task fidelity contribution of the candidate semantic response fragment to each identity recovery path, under the assumption that the current candidate semantic response fragment is included in the prompt context or sent as output. Based on the path activation increment, identifiable advancement, and task fidelity contribution, determine the path blocking cost and semantic preservation benefit of the corresponding candidate semantic response fragment. Step S6: Under the constraint of keeping the task target node and necessary fact node in the task semantic skeleton from becoming invalid, solve the minimum blocking set for the identity recovery path graph. The minimum blocking set is used to represent the minimum set of candidate semantic response fragments, source evidence fragment records or clue connection edges that need to be downgraded, prohibited from release, withdrawn or replaced in order to prevent all high-risk identity recovery paths from being connected. The objective of finding the minimum blocking set is to minimize the loss of the task fidelity contribution value while cutting off all identity recovery paths that reach the preset recovery risk threshold. Step S7: Generate a safe response reorganization scheme based on the minimum blocking set, wherein candidate semantic response fragments that do not fall into the minimum blocking set are preserved according to their original semantics, and path blocking type reduction expression is performed on candidate semantic response fragments that fall into the minimum blocking set. The path blocking type reduction expression includes at least one or more of the following: categorical substitution, relation weakening substitution, interval substitution, statistical substitution, summary substitution, and feature stripping substitution. When the corresponding identity recovery path is not cut off after the path-blocking downgraded expression, the high-path activation incremental source evidence fragment record associated with the candidate semantic response fragment is rolled back and restricted regeneration is performed under the constraints of the task semantic skeleton. Step S8: During the streaming output of candidate response content, an active recovery path status table is generated for each output block. The active recovery path status table includes at least the activated path segment identifier, the remaining uncut path segment identifier, the path residual blocking cost, and the current task fidelity margin corresponding to the current output block. Based on the active recovery path status table, it is determined whether sending the current output block will cause any high-risk identity recovery path to be opened. If so, prevent the current output block from being sent as is, and continue to execute path-blocking downgraded expressions, source evidence fragment rollback, or restricted regeneration; if all processing still fails to prevent the high-risk identity recovery path from being established, output a rollback response; Step S9: Output the response content that passes the detection and generate an audit record. The audit record includes at least: the object candidate clue cluster identifier, the trusted clue subgraph identifier, the identity recovery path graph identifier, the minimum blocking set, the path activation increment corresponding to each candidate semantic response fragment, the path blocking type downgrade expression action executed, whether the source evidence fragment was withdrawn, whether the restricted regeneration was executed, and the reason code.

[0007] In a preferred embodiment, the source credibility level of the source evidence fragment record is determined based on at least the following factors: The source type of the content fragment; The historical effectiveness of content fragments corresponding to the source system; The degree of authorization compatibility between content fragments and the caller's role identifier and data tag scope; The time freshness and time validity of content fragments; This results in content fragments with higher source credibility and time validity having a higher retention priority in conflict resolution and higher path edge weights in the identity restoration path graph.

[0008] In a preferred embodiment, the conflict relation matrix represents at least one or more of the following conflicts: Source conflicts arise when different source types provide inconsistent content for the same clue slot. Time conflicts caused by changes in the same object's properties at different timestamps; Authorization conflicts arising from inconsistent visibility of clues under different data tags; Semantic mutual exclusion conflict formed when two or more privacy clue atoms cannot be valid at the same time; The conflict resolution process includes at least the following steps: reducing the weight of low-trust conflicting threads, removing time-expired threads, masking threads with incompatible authorizations, and retaining high-trust consistent threads, thereby obtaining a trusted thread subgraph.

[0009] In a preferred embodiment, the identity recovery path graph is a directed graph constructed based on a trusted clue subgraph and a minimum identifiable slot template; The minimum identifiable slot templates are set separately for different privacy categories, and each minimum identifiable slot template includes at least two clue slot types; When the clue slot type that has been satisfied and the released semantic node together satisfy the corresponding minimum identifiable slot template on an identity recovery path, the identity recovery path is determined to be connected. The path activation increment is used to characterize the improvement in the connectivity of the corresponding identity recovery path after a candidate semantic response fragment is released.

[0010] In a preferred embodiment, counterfactual exposure simulation includes: Combine the current candidate semantic response fragment with the released semantic node, historical memory fragment, and candidate knowledge fragment respectively; Under combined conditions, the success rate or success rate of each identity recovery path is recalculated. Calculate the identifiable propulsion amount corresponding to the current candidate semantic response fragment; Based on the degree to which the current candidate semantic response fragment satisfies the task target node, necessary fact node, and optional explanation node, the corresponding task fidelity contribution value is calculated. The path blocking cost is determined by the combined effect of cutting off the identity recovery path graph and the degree of damage to the task semantic skeleton when preventing the release of the current candidate semantic response fragment.

[0011] In a preferred embodiment, solving for the minimum blocking set includes: All identity recovery paths that reach the preset recovery risk threshold are designated as the set of paths to be cut off; Candidate semantic response fragments, source evidence fragment records, and clue connection edges are used as blocking candidates; The constraint is to cut off all paths to be cut off; The optimization objective is to minimize the loss of task fidelity contribution value, the cost of blocking, or the weighted sum of the two. Find the corresponding minimal blocking set.

[0012] In a preferred embodiment, the path-blocking reduction expression is not a general desensitization replacement for text content, but a targeted expression reduction performed on the high-risk identity recovery path where the candidate semantic response fragments falling into the minimum blocking set are located; Pathway-blocking reduction expression includes at least: Replace object-level representations with category-level representations using categorical substitution; Replace explicit relational expressions with weak relational expressions to weaken the relational substitution; Replace precise numerical values ​​with interval values, rank values, or interval or statistical substitutions of statistical values; Replace the feature stripping by removing time location features, source object cue features, or combined recognition features; And replace detailed descriptions with a summary of the information required for the task; Each of the path-blocking downgraded expressions corresponds to at least one type of high-risk identity recovery path cutoff strategy.

[0013] In a preferred embodiment, a rollback response is output when any of the following conditions exist: Even after the current output block is processed by the path-blocking reduced-order expression, it will still result in the opening of any high-risk identity recovery path; After the high-path activation incremental source evidence fragment record associated with the current output block is rolled back, the candidate response content obtained by the restricted regeneration still cannot keep all high-risk identity recovery paths in an unconnected state. Candidate knowledge fragments are missing data labels; The historical memory fragment is missing its corresponding round or upstream reference identifier; The activity recovery path status table could not be updated or the update timed out; The rollback response includes one or more of the following: security summary response, insufficient permissions prompt response, narrowed query scope prompt response, or manual review prompt response.

[0014] In a preferred embodiment, a privacy information leakage prevention system based on a large language model includes: The request receiving module is used to receive user requests and obtain session context, historical memory fragments, caller role identifier, data tag range, and candidate knowledge fragments. The evidence record building module is used to segment user requests, session contexts, historical memory fragments, and candidate knowledge fragments into multiple content fragments and generate source evidence fragment records; The atom extraction module is used to extract privacy clue atoms and semantic support atoms from various source evidence fragment records; The clue merging module is used to atomically merge multiple privacy clues into a candidate clue cluster of objects; The conflict resolution module is used to construct a conflict relationship matrix and generate a trusted thread subgraph. The recovery path construction module is used to construct an identity recovery path graph based on a trusted clue subgraph and a minimum identifiable slot template. The simulation evaluation module is used to perform counterfactual exposure simulations on candidate semantic response fragments and calculate path activation increment, identifiable propulsion, and task fidelity contribution. The blocking solution module is used to solve for the minimum blocking set in the identity recovery path graph; The recombination control module is used to generate a secure response recombination scheme based on the minimum blocking set. The order reduction expression module is used to perform path-blocking order reduction expression on candidate semantic response fragments that fall into the minimum blocking set; The rollback and regeneration module is used to perform source evidence fragment rollback and restricted regeneration when the cutoff condition is still not met after path-blocking downgraded expression. The streaming state maintenance module is used to generate and update the active recovery path state table for each output block; The rollback control module is used to output a rollback response when it is still impossible to prevent the high-risk identity recovery path from being opened. The audit log module is used to generate audit logs that include trusted clue subgraphs, identity recovery path graphs, minimum blocking sets, path activation increments, and reason codes.

[0015] The technical effects and advantages of this invention are as follows: 1. This invention extracts privacy clue atoms and semantic support atoms from multi-source content and performs conflict resolution on conflicting clues to form a trusted clue subgraph, thereby reducing the interference of low-trust, expired or unauthorized clues on risk judgment and improving the accuracy of privacy risk identification.

[0016] 2. This invention constructs an identity recovery path graph based on a trusted clue subgraph and a minimum identifiable slot template, which can identify potential recovery paths formed by combining multiple pieces of ordinary information, thereby solving the problem that existing technologies are unable to detect hidden privacy leaks.

[0017] 3. This invention performs counterfactual exposure simulation on candidate semantic response fragments to calculate path activation increment, identifiable advance amount and task fidelity contribution value, and further solves the minimum blocking set, thereby minimizing task semantic loss and improving response retention capability while cutting off high-risk recovery paths.

[0018] 4. This invention performs path-blocking reduction expression, source evidence fragment withdrawal, and restricted regeneration on candidate semantic response fragments that fall into the minimum blocking set. Instead of simple overall interception, it completes response reorganization under security constraints, taking into account both privacy protection and business response usability.

[0019] 5. This invention maintains an activity recovery path status table during the streaming output process, performs dynamic path determination and real-time blocking for each output block, thereby enabling interception before high-risk paths are established, reducing the probability of leakage in streaming output scenarios.

[0020] 6. This invention improves the traceability and interpretability of the entire prevention and control process by generating audit records corresponding to candidate clue clusters, trusted clue subgraphs, identity recovery path graphs, minimum blocking sets, and downgrade actions, which facilitates enterprise internal control audits and subsequent rule optimization. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the overall process of the privacy information leakage prevention and control method based on a large language model provided in the embodiments of the present invention.

[0022] Figure 2 This is a schematic diagram illustrating the source evidence fragment record construction, privacy clue atom and semantic support atom extraction, object candidate clue cluster merging, conflict relationship matrix construction, conflict resolution, and trusted clue subgraph generation provided in the embodiments of the present invention.

[0023] Figure 3 This is a schematic diagram illustrating the configuration of the minimum identifiable slot template, the construction of the identity recovery path graph, the determination of path connectivity, and the determination of path activation increment provided in the embodiments of the present invention.

[0024] Figure 4 This is a schematic diagram illustrating the tasks of task intent parsing, task semantic skeleton construction, candidate semantic response fragment generation, counterfactual exposure simulation, minimum blocking set solution, security response reorganization, streaming output dynamic blocking, and audit log generation provided in the embodiments of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Reference Figure 1-4 The privacy information leakage prevention method based on large language models includes the following steps: Step S1, receiving user requests submitted by the caller, is not a simple reception of a single text string. Instead, it involves request access, identity binding, and session location through a unified access link. The system first receives the request message sent by the caller through the call access interface within the enterprise intranet. The request message carries at least the request text, caller identifier, session identifier, request timestamp, and terminal source identifier. Subsequently, the system performs role mapping based on the caller identifier to obtain the caller role identifier, and locates the current session instance in the session management storage based on the session identifier. To ensure consistency in subsequent processing objects, the system prioritizes standardization processing on the request message after receiving it. This includes unified character encoding, removal of invalid control characters, preservation of original punctuation boundaries, extraction of explicit citation instructions, and identification of explicit citation markers for historical rounds or knowledge fragments in the user request, thereby forming a standardized user request object that can proceed to subsequent steps. For cases where the request does not carry a complete session identifier, the caller identifier is abnormal, or the request timestamp is missing, the system does not directly discard the request. Instead, it first generates a pending verification status record and enters a conservative processing branch, reducing the priority of this type of source in subsequent trust calculations and conflict resolution.

[0027] When acquiring the session context, historical memory fragments, data tag range accessible to the caller, and candidate knowledge fragments corresponding to a user request, the system adopts a sequence of "current session priority, historical memory supplementation, and knowledge retrieval follow-up" for association and assembly. First, the system extracts several rounds of question-and-answer content adjacent to the current request within the current session based on the session identifier, forming a session context set. Then, using the user request and the current session context as conditions, it retrieves historical memory fragments from the historical memory storage that are semantically similar to the current request and have a continuity relationship with the current session topic. Subsequently, it queries the authorization control table based on the caller's role identifier to obtain the data tag range accessible to the caller. Finally, it combines the standardized user request, session context, and historical memory fragments to form search conditions, initiates a recall request to the enterprise's internal knowledge base, and returns candidate knowledge fragments. To ensure that the association "corresponding to the user request" is not arbitrarily pieced together, the system calculates the topic consistency, temporal proximity, and reference relevance of the candidate session context, historical memory fragments, and candidate knowledge fragments with the current request, respectively, and only retains content that meets the preset thresholds for subsequent steps; for content that is semantically related but has incompatible permissions or expired, it is not directly deleted, but is retained in the internal record with a restricted participation mark for reference in subsequent conflict resolution and path blocking.

[0028] When uniformly segmenting user requests, session contexts, historical memory fragments, and candidate knowledge fragments into multiple content fragments, the system does not employ independent segmentation strategies for different sources. Instead, it first performs source normalization and then performs unified fragmentation. The system first maps content from different sources into "locatable text units," ensuring that each piece of content has the original text, source identifier, round identifier, timestamp, and original location index. Subsequently, the system divides the fragments according to unified segmentation rules. These rules prioritize semantic and citation integrity: for user requests, segmentation is based on complete semantic sentences, parallel constraint phrases, and explicit citation segments; for session contexts, segmentation is based on round boundaries, question-and-answer boundaries, and abbreviation reference windows; for historical memory fragments, segmentation is based on historical event units, user intent units, and existing summary boundaries; and for candidate knowledge fragments, segmentation is based on document paragraphs, title hierarchies, field boundaries, and structured record units. When a text segment is too long and contains multiple independently referential information units, the system performs a secondary segmentation based on a preset length threshold and semantic connection strength. However, during this secondary segmentation, the system retains the correlation index between preceding and following segments to avoid losing contextual relationships. Through this unified segmentation method, content from different sources is ultimately processed into a sequence of comparable, traceable, and associative content segments, thus providing consistent input for subsequent clue extraction, conflict resolution, and recovery path construction.

[0029] When generating corresponding source evidence fragment records for each content fragment, the system uses a "source metadata inheritance + fragment-level supplementary calculation" approach to construct the records. For each segmented content fragment, the system first inherits the basic metadata of its source object, including source type, round, timestamp, data tag, upstream reference relationship, and source object hint information; then, it generates a text position range by combining the fragment's start and end offset positions in the original text; finally, it assigns a unique fragment identifier to the fragment and marks it with a semantic role identifier based on the fragment's actual role in the current task chain. The system does not mechanically assign values ​​based on source type, but rather determines the semantic role identifier based on the matching relationship between the fragment content and the current user request: if the fragment mainly serves to constrain queries, limit questions, or supplement conditions, it is marked as a query constraint role; if the fragment mainly provides factual content, it is marked as a fact support role; if the fragment directly involves identifying information such as object identity, contact information, or transaction relationships, it is marked as an object description role or transaction corroboration role; if the fragment is mainly used to explain background or generate supplementary explanations, it is marked as an explanation / supplementary role. After the above processing, each content fragment forms a source evidence fragment record that can independently participate in subsequent analysis. This record retains both the source attribute and fragment-level location and semantic function information.

[0030] When determining the source trust level, the system does not simply assign a fixed level based on the source type. Instead, it performs a multi-factor joint calculation on the source evidence fragment records corresponding to each content fragment. First, the system assigns a basic trust value based on the source type. For example, a higher basic value is given to content directly from the currently controlled business system and generated synchronously with the current session, while a lower basic value is given to content with unknown sources, earlier times, or content generated only from indirect summaries. Then, the basic trust value is corrected based on the historical effectiveness rate of the source system to which the content fragment belongs. The historical effectiveness rate can be obtained by combining historical verification pass rate, historical error correction rate, and historical failure rate. Next, a second correction is made based on the degree of authorization compatibility between the data tag corresponding to the content fragment and the range of data tags accessible to the caller. Fragments with full authorization compatibility have their trust correction value increased, while fragments with only partial compatibility or questionable permissions have their trust correction value decreased. Finally, a time correction is performed based on time freshness and time validity. That is, the trust level is increased for content fragments that are closer to the current request and still within the business validity period, while the trust level is decreased for content fragments that have exceeded the validity period, are discontinuous in time, or whose current validity cannot be confirmed. After the above multi-factor correction is completed, the system obtains the fragment-level source credibility level and writes it into the corresponding source evidence fragment record.

[0031] To ensure that content fragments with higher source credibility and valid timeliness have a higher retention priority in conflict resolution, the system does not simply compare text similarity during conflict resolution. Instead, it prioritizes conflict fragments based on credibility, timeliness, and authorization compatibility. When multiple content fragments provide inconsistent content for the same clue slot, the system first compares the source credibility of the corresponding source evidence fragments. If there is a significant difference in source credibility, the fragment with the higher source credibility is retained as the primary retention clue, while the fragment with lower credibility is downgraded. If the source credibility is similar, the system continues to compare timeliness, prioritizing fragments that are more recent and still valid. If both timeliness and timeliness are valid, the system further compares the degree of authorization compatibility with the current caller's role identifier and data tag range, assigning higher retention priority to fragments with higher authorization compatibility. For low-credibility conflict fragments that cannot be directly eliminated, the system does not delete them immediately but retains them as weak candidate clues for subsequent counterfactual simulation and recovery path interference analysis. However, these fragments will not participate in high-priority recovery path construction by default. Through this processing method, content fragments with higher source credibility and longer validity naturally receive a higher retention priority in conflict resolution.

[0032] To ensure that content fragments with high source credibility and valid time have higher edge weights in the identity recovery path graph, the system directly converts the source credibility and time validity of the fragments into path edge weight calculation factors when constructing the identity recovery path graph. When establishing connections between trusted clue nodes and target object recovery nodes, the system does not uniformly assign fixed edge weights. Instead, it performs weighted calculations based on the source credibility, time validity, authorization compatibility, and semantic complementarity with other clue nodes of the corresponding source evidence fragment. For content fragments with high source credibility, valid time, and stable complementary relationships with other clues, their corresponding path edges are assigned higher weights, indicating that once released, these fragments have a stronger ability to advance the recovery of the target object's identity, contact information, transaction relationships, or sensitive attributes. Conversely, for content fragments with low source credibility, expired time, poor authorization compatibility, or only weak complementary relationships, their corresponding path edges are assigned lower weights, indicating that these fragments contribute less to the completion of the recovery path. Furthermore, in constructing cross-cycle inheritance edges, cross-source reference edges, and semantic reference edges, the system can also apply attenuation coefficients to clues with excessively large time spans, thereby preventing outdated but superficially relevant content from being assigned unreasonably high weights in the path graph. Through the above edge weight assignment logic, the identity recovery path graph can more accurately reflect "which content fragments truly contribute highly to the identifiable recovery of the object," thus supporting subsequent path blocking, minimum blocking set solving, and secure response reorganization.

[0033] Step S2: The system first sends the source evidence fragment records output in Step S1 into the privacy detection processing chain and the semantic parsing processing chain, respectively. The privacy detection processing chain is used to locate privacy-related clues from the source evidence fragment records that have significance for identity recognition, contact information, transaction relationships, or sensitive attributes. The semantic parsing processing chain is used to identify the semantic support role of each fragment in the current task response. To avoid using different processing standards for fragments from different sources, the system uses the source evidence fragment records as a unified input unit for subsequent analysis of user requests, session contexts, historical memory fragments, and candidate knowledge fragments, maintaining a one-to-one correspondence with fragment identifiers, source path identifiers, rounds, and data tags. This ensures that the privacy clues and semantic support information extracted subsequently can be traced back to the original content fragments.

[0034] During the extraction of privacy clue atoms, the system does not directly classify the entire text as "sensitive" or "non-sensitive." Instead, it extracts the smallest privacy clue unit that can participate in subsequent object recovery analysis from each source evidence fragment record. Specifically, the system first performs an initial screening of the source evidence fragment records according to a preset privacy category system to identify whether there are names, contact information, transaction serial numbers, work order numbers, address descriptions, customer levels, service times, product binding relationships, after-sales status, account characteristics, or other information that can be used to identify specific customer objects. Subsequently, the system refines the above information in combination with contextual trigger relationships to determine the slot type, content boundaries, combination relationship with adjacent terms, and source path of the information in the current fragment. For directly appearing identifying fields, the system extracts them as explicit privacy clue atoms; for information that does not directly appear as a name or number but can indirectly point to a specific object through pseudonyms, role descriptions, attribute combinations, time points, business status, or historical rounds, the system extracts it as implicit privacy clue atoms. Each privacy clue atom is bound to a corresponding source evidence fragment record, and at least its privacy category, clue slot type, clue content, confidence level, time validity identifier, and source path identifier are recorded. Through this fragment-minimization extraction method, the system does not need to rely on the entire text for coarse-grained judgment, but can build a more refined recovery path based on the combination relationship between multiple atoms.

[0035] During the extraction of semantic support atoms, the system's goal is not to identify "which content is sensitive," but rather to identify "which content must be retained to answer the current user request." Specifically, the system semantically aligns each source evidence fragment with the standardized user request, analyzing the fragment's role in the current question-answering task: if the fragment is used to limit the question scope, define query conditions, or supplement the question context, it is extracted as a constraint-type semantic support atom; if the fragment is used to provide factual evidence, business status, processing results, or policy explanations, it is extracted as a factual-type semantic support atom; if the fragment is used to explain causality, explain rules, supplement processing reasons, or provide operational suggestions, it is extracted as an explanatory-type semantic support atom. To avoid the separation between semantic support extraction and privacy clue extraction, the system allows the same source evidence fragment to generate both privacy clue atoms and semantic support atoms simultaneously, but their roles in subsequent processing differ: privacy clue atoms are used to build object recovery capabilities, while semantic support atoms are used to maintain answer usability. Each semantic support atom is bound to its source path identifier, task support type, and necessity identifier. The necessity identifier is used to characterize whether the semantic support content is necessary, replaceable, or can be omitted in order to complete the current question-answering goal, thus providing a basis for subsequent minimum blocking set solution and security response reorganization.

[0036] When merging multiple privacy clue atoms into candidate object clue clusters, the system adopts a merging strategy of "explicit hint priority, implicit relationship supplementation, and multi-round inheritance correction," rather than simply clustering based on text similarity. Specifically, the system first checks the source object hint identifier corresponding to the privacy clue atom. If multiple privacy clue atoms have the same source object hint identifier, or although the source object hint identifiers are different, they clearly point to the same customer object, the same work order object, or the same transaction object in the upstream reference chain, they are preferentially merged into the same candidate object clue cluster. For privacy clue atoms that do not explicitly provide a source object hint identifier, the system further supplements the merging based on the alias reference relationship, attribute pairing relationship, inheritance relationship of the round to which they belong, and upstream reference relationship. Specifically, if a privacy clue atom contains pronouns such as "the customer," "the user," or "the previous consultant," which can refer back to a specific object in a previous round, it is grouped into the same object candidate clue cluster. If two privacy clue atoms, although different in wording, provide different attributes of the same object (e.g., one provides the customer level and the other provides the customer's most recent transaction time), and both satisfy the matching condition of the same business object under the current session topic, they are also merged. If a privacy clue atom is inherited from a historical memory fragment in the upstream reference chain, and this inheritance relationship is not negated by new highly reliable content, its inheritance association with the original object candidate clue cluster is preserved. Through the combined effect of the above explicit and implicit relationships, the system can group privacy clue atoms scattered in different sources, rounds, and expressions into a finite number of object candidate clue clusters, providing an object-level foundation for subsequent conflict identification and recovery path modeling.

[0037] When constructing the conflict relationship matrix, the system does not simply mark inconsistent content as conflicting. Instead, it establishes conflict relationships item by item for privacy clue atoms within the same candidate clue cluster, according to the clue slot dimension, time dimension, authorization dimension, and semantic consistency dimension. Specifically, the system first groups privacy clue atoms within the same candidate clue cluster according to clue slot type. For example, clues representing contact information are grouped together, clues representing transaction time are grouped together, and clues representing customer level or customer identity are grouped together. Then, within each group, the system compares the source type, timestamp, data tag, and clue content pairwise. If different source types provide inconsistent content for the same clue slot, it is marked as a source conflict in the matrix; if the same object attribute changes under different timestamps, and the old clue has exceeded its preset validity period or has been overwritten by a new clue, it is marked as a time conflict; if a clue itself is visible under a certain data tag but should not participate in the output within the current caller's authorized scope, it is marked as an authorization conflict; if two or more privacy clue atoms cannot be semantically true simultaneously, for example, if the same object is described as mutually exclusive identity states, mutually exclusive transaction states, or mutually exclusive geographical locations within the same time window, it is marked as a semantic mutual exclusion conflict. In this way, the conflict relationship matrix can not only represent "whether there is a conflict", but also clearly define "which slot the conflict occurs in, what causes it to occur, which source paths and which time conditions are involved", providing direct input for subsequent fine-grained conflict resolution.

[0038] When resolving conflicts, the system does not delete all conflicting clues at once, but proceeds in the following order: "preserving the main clue, suppressing weak conflicts, clearing invalid items, and isolating unauthorized items." Specifically, for multiple conflicting privacy clue atoms within the same clue slot, the system first compares the source credibility level of their corresponding source evidence fragment records, prioritizing the retention of privacy clue atoms with higher source credibility levels as the main clue; if the source credibility levels of multiple clues are similar, their time validity is further compared, prioritizing the retention of clues that are more up-to-date and still valid; if they still cannot be distinguished, their authorization compatibility with the current caller's role identifier and data tag range is further compared, prioritizing the retention of clues with higher authorization compatibility. For conflicting clues with low source trust levels but not obviously erroneous, the system does not immediately delete them, but instead downgrades their weight, making them only weak candidate clues in subsequent recovery path calculations. For clues with outdated timestamps, already covered by subsequent high-trust clues, or exceeding the preset validity period, the system removes them, preventing them from participating in subsequent object recovery analysis. For clues incompatible with the current caller's authorized scope, the system masks them; these clues can be retained in the system's internal audit logs but do not participate in the current call chain's trusted recovery analysis. For high-trust clues from multiple sources that are consistent or complementary, the system retains them and writes them as trusted master clues into subsequent subgraphs. Through this multi-level conflict resolution method, the system will not lose all object information due to a single conflict, nor will it directly include unverified or expired clues in the recovery chain.

[0039] When generating the trusted clue subgraph, the system, based on the aforementioned conflict resolution results, no longer retains all privacy-preserving clue atoms in the candidate clue cluster as is. Instead, it retains only those clues that possess credibility, timeliness, and authorization compatibility after conflict resolution, and constructs a graph structure based on the complementary relationships between these clues. Specifically, the system maps the retained high-credibility consistent clues and the downweighted but not completely eliminated weak candidate clues to clue nodes with different weights. It establishes complementary connection edges between clue pairs that can jointly support object recovery, inheritance edges between clues inherited from the same source path, and cross-source association edges between clues from different sources that can jointly point to the same identity or the same transaction object in the current candidate clue cluster. For blocked or eliminated clues, the system does not include them as trusted nodes in the subgraph backbone, but only retains the reason for their exclusion internally for subsequent auditing and backtracking analysis. The trusted clue subgraph generated in this way is not a simple set of original clues, but a structured trusted relationship network that has undergone conflict filtering, time verification, and authorization screening. When constructing the identity recovery path graph, the system uses only the valid nodes and valid connecting edges in the trusted clue subgraph as the basis for path construction, thereby avoiding misjudgment of the recovery path due to the incorporation of erroneous clues, expired clues, or unauthorized clues.

[0040] The conflict resolution process includes at least four steps: downgrading low-trust conflicting threads, removing time-expired threads, masking authorization-incompatible threads, and retaining high-trust consistent threads. This process is not composed of four isolated actions but rather a sequential filtering process. More specifically, the system first uses source trust level and time validity as the first-level filtering criteria to initially compress obviously low-trust or obviously expired conflicting threads. Then, it uses the compatibility between data tags and the caller's authorization scope as the second-level filtering criteria to mask threads that, although their content may be authentic, should not participate in the current request processing chain. Finally, the remaining threads are retained based on their consistency and complementarity, ensuring that the threads that ultimately enter the trusted thread subgraph backbone simultaneously meet the four conditions of "relatively trustworthy source, time validity, authorization compatibility, and semantic non-exclusivity." By adopting this continuous screening mechanism, the credible clue subgraph obtained by the system can not only improve the accuracy of the subsequent identity recovery path graph, but also effectively reduce the false recovery paths introduced by expired information, cross-authority information or low-credibility noise information, thereby improving the stability and interpretability of the subsequent minimum blocking set solution and path blocking type reduced-order expression.

[0041] Step S3: The system first reads the trusted clue subgraphs output in step S2 and initiates the recovery path construction process for each candidate clue cluster of an object. For the same candidate clue cluster of an object, the system first selects the corresponding minimum identifiable slot template based on the privacy category it involves, and then uses this template as a path construction constraint to map the clue nodes in the trusted clue subgraph that can participate in the recovery of object identity, contact information, transaction relationships, or sensitive attributes, together with the semantic content already released in the current session and the candidate semantic content to be released, onto a unified directed graph, thereby forming the corresponding identity recovery path graph. In this way, the identity recovery path graph does not reflect "how many sensitive clues are currently available" in isolation, but rather reflects "how, once the currently released content and the content that may be released later are combined, they will gradually approach the recovery state of a certain target object."

[0042] When constructing the identity recovery path graph, the system uses valid clue nodes in the trusted clue subgraph as basic nodes and introduces two types of nodes directly related to the output behavior: released semantic nodes and candidate released semantic nodes. Released semantic nodes represent semantic fragments that have been actually output to the caller in the current session. While these semantic fragments may not necessarily be explicit privacy information, they may have provided recovery conditions such as time windows, business states, object scope, transaction background, or role limitations. Candidate released semantic nodes represent semantic fragments that have not yet been formally output in the current round but may be released during subsequent generation processes. The system then sets at least one target object recovery node for each object candidate clue cluster to indicate whether a specific recovery result has been achieved, such as recovery to "identifiable specific customer identity," "identifiable specific contact information," "identifiable specific transaction relationship," or "identifiable sensitive attribute status." After the above nodes are established, the system establishes directed connections according to the complementary relationships of clues in the trusted clue subgraph, the current session output state, and the support relationships between candidate semantic fragments and clues. This gives each edge a clear directional meaning of "progressing from a certain content to the next recovery state", rather than just representing general relevance.

[0043] When establishing edges in the identity recovery path graph, the system does not connect all nodes indiscriminately. Instead, it only establishes edges when preset recovery conditions are met, and the type of edge is differentiated based on the different recovery functions. Specifically, when two trusted clue nodes correspond to different but complementary clue slot types, and their combination can jointly narrow the target object identification range, a slot complementarity edge is established between them; when a clue that has appeared in a historical round is triggered again in the current round through a pseudonym, summary reference, or continuation question, a cross-round inheritance edge is established between the relevant nodes; when a candidate release semantic node contains a reference to a knowledge fragment, work order record, or previous question and answer content, and this reference can fill the semantic gap of the trusted clue node, a cross-source reference edge is established between them; when different clues or semantic fragments appear together in the same time window, and this temporal proximity relationship can enhance the object location capability, a temporal co-occurrence edge is established; when a pseudonym, role description, or abbreviated expression in a semantic fragment can be parsed as pointing to the object corresponding to an existing trusted clue node, a semantic reference edge is established between them. By constructing the above-mentioned multi-type edges, the identity recovery path graph can uniformly represent the three dimensions of "how clues complement each other", "how historical content continues to be effective in the current round", and "how candidate outputs further advance the recovery process".

[0044] Each identity recovery path is not an arbitrary graph traversal path from start to finish. Instead, it refers to a directed path that starts from one or more trusted clue nodes, released semantic nodes, and candidate released semantic nodes, and gradually connects along slot complementary edges, cross-round inheritance edges, cross-source reference edges, time co-occurrence edges, and semantic reference edges, ultimately reaching the target object recovery node. Furthermore, during this connection process, the corresponding minimum identifiable slot template requirement has been met or is about to be met. In other words, the system only recognizes a path as a potential recovery path when the set of nodes and edges on that path collectively indicate that "if the currently known information and the information to be released are simultaneously true, it is sufficient to advance the object from an ambiguous state to a recoverable state." For example, in a customer identity recovery scenario, a path can be composed of "customer level clues," "recent transaction time clues," "work order product clues," and "the region-specific semantics to be output in the current response." Although any single piece of information is insufficient to identify a specific customer, if combining these elements according to the path can restore the object to a unique customer or a very small candidate set, then the path is considered a valid potential recovery path. With this path construction method, the system no longer only looks at the sensitivity of a single fragment, but explicitly simulates whether "a combination of multiple ordinary information will form a recovery capability".

[0045] In this embodiment, the minimum identifiable slot template is not a fixed and unique template, but is set separately for different privacy categories, and configured according to the principle that "a combination of at least two or more clue slot types can constitute actual recovery capability". Specifically, for customer identity privacy, the system can set at least two or more combinations of name slot, contact information slot, customer level slot, region slot, recent transaction time slot, product binding slot, or work order status slot as template candidates; for contact information privacy, the system can set at least two or more combinations of contact phone number slot, email address slot, region restriction slot, contact person role slot, and business association slot as template candidates; for transaction relationship privacy, the system can set at least two or more combinations of transaction flow identifier slot, order time slot, transaction amount range slot, product name slot, after-sales event slot, and customer level slot as template candidates; for sensitive attribute privacy, template candidates consisting of identity attribute slot, service status slot, time point slot, behavior result slot, and associated object slot can be set according to specific business scenarios. In actual operation, the system does not require that there be only one template for each privacy category. Instead, it allows multiple parallel templates to be configured for the same category. Then, it selects one or more templates that best match the currently extracted clues and best reflect the real recovery risk from the candidate clue cluster of specific objects to participate in the subsequent connection judgment.

[0046] When setting minimum identifiable slot templates for different privacy categories, the system follows the principle of "minimum sufficient conditions required for recovery" rather than "all fields that may theoretically be involved." Specifically, the system first analyzes which clue slot combinations are most likely to lead to the re-identification of specific objects in historical business data, historical leakage cases, or internal simulation samples; then it filters out slot combinations that, while theoretically relevant, are unstable, infrequent, or cannot be reproduced stably in real-world scenarios; finally, it retains the minimum set of slots that can stably form recovery capabilities in the current business scenario as the template. This setup ensures that the template is neither so broad as to misclassify any ordinary information combination as high-risk, nor so narrow as to miss actual recoverable paths. Furthermore, the system allows for dynamic tightening or loosening of the template's applicability based on source trust level, time validity, and session context strength. For example, in high-trust, strong contextual continuity scenarios, certain weak clue combinations can be considered sufficient to approach a recovery state; while in low-trust, weak contextual continuity scenarios, a more complete set of slots is required before the path is considered nearly complete.

[0047] The system determines that an identity recovery path is complete when the satisfied lead slot type and the released semantic node on an identity recovery path jointly satisfy the corresponding minimum identifiable slot template. "Jointly satisfying" here does not mean that every field in the template must appear explicitly in the path, but rather that lead nodes and released semantic nodes are allowed to complementarily fill the slots required by the template. For example, if the template requires three slots: "Customer Level + Recent Transaction Time + Product Association," where Customer Level comes from a trusted lead node, Recent Transaction Time comes from a released semantic node, and Product Association comes from an explanatory response released in the current round, the system still considers the template satisfied. To ensure the feasibility of this judgment, the system maintains a slot satisfaction status table for each path during path traversal, recording which template slots have been satisfied, which slots are still empty, and which type of node filled the satisfied slots. Only when a slot meets the preset conditions of the corresponding template in the status table will the system upgrade the path from "potential recovery path" to "completed recovery path"; if it is not fully met, it will remain in the state of "not completed but can continue to be activated" so that it can be evaluated when subsequent candidate semantic response fragments are released.

[0048] The path activation increment characterizes the improvement in the connectivity of the corresponding identity recovery path after a candidate semantic response fragment is released. Therefore, after constructing the identity recovery path graph, the system performs a fragment-level path advancement evaluation for each candidate semantic response fragment. Specifically, the system first assumes that the candidate semantic response fragment is added to the set of released semantic nodes, and then recalculates the slot filling situation of the fragment for each potential recovery path: if the fragment can directly fill a key slot that has not yet been satisfied, its activation increment for the path is high; if the fragment itself does not provide a new slot, but can strengthen the edge connection strength on the original path through proxy resolution, reference inheritance, or time positioning, its activation increment for the path is medium; if the fragment neither fills a key slot nor enhances the connectivity of the existing path, its activation increment is low or zero. The system can express this improvement as a reduction in the number of remaining unsatisfied slots, an increase in the path connectivity probability, or an increase in the overall edge weight of the path. By calculating the path activation increment, the system can predict in advance whether the release of a candidate semantic response fragment will only add general explanatory information or significantly promote a high-risk recovery path to be connected. This provides a direct basis for the counterfactual exposure simulation in step S5 and the solution of the minimum blocking set in step S6.

[0049] Step S4: When obtaining the task intent code based on the user request parsing, the system does not simply perform keyword matching on the request text, but rather conducts a joint analysis of the user request's purpose, questioning method, constraints, and expected output format. Specifically, the system first identifies whether the user request contains intent triggering features such as querying, explaining, comparing, summarizing, locating, asking follow-up questions, providing processing suggestions, confirming status, confirming permissions, or explaining reasons. Subsequently, the system, combined with the current session context, determines whether the request is for starting a new task, continuing an existing task, supplementing a previous answer with a follow-up question, or verifying an existing result. Based on this, the system further analyzes whether the user request contains restrictive conditions, such as limiting the scope of the query object, limiting the time range, limiting the data granularity, limiting the output format, or requiring the reference of historical rounds. The system maps the above analysis results to preset task intent coding rules to obtain the corresponding task intent code. For a user request containing multiple sub-tasks, the system allows the generation of a main task intent code and one or more auxiliary task intent codes. The main task intent code is used to determine the core objective of the current answer, and the auxiliary task intent codes are used to determine whether supplementary explanations, explanations of reasons, result comparisons, or operational suggestions are needed. Through this layered parsing method, the task intent code can reliably reflect the key factors of the current user request, such as "what to do", "what granularity to achieve", "whether explanatory content is needed" and "whether historical content is allowed to be called", thus providing a clear control basis for the subsequent semantic skeleton construction.

[0050] When constructing the task semantic skeleton, the system prioritizes the task intent code and constrains the response structure by combining the caller's role identifier and data tag range. Specifically, the system first determines the core task objective that must be completed in this round of response based on the main task intent code, and abstracts this core task objective into one or more task objective nodes. Then, it filters out the factual support content essential for completing the task objective from the semantic support atoms extracted in step S2, and organizes its corresponding atom set into necessary fact nodes. For explanatory content, background content, or rule description content that can improve the comprehensibility of the response but does not affect the completion of the task objective after deletion, the system organizes them into optional explanatory nodes. For content that, although related to the current request topic, would increase the risk of object recovery, exceed the caller's authorization boundary, break through the current data tag range, or be inconsistent with the output granularity required by the task intent code, the system organizes it into prohibited exposure nodes. During the construction process, the system does not directly copy the original text, but performs structured abstraction of various nodes, so that each node at least contains a node type, a reference identifier of the corresponding support atom or clue atom, a matching relationship with the task intent code, and a compatibility state with the caller's authorization boundary. In this way, the task semantic skeleton essentially forms a response framework that is driven by the task objective, constrained by the permission boundary, and can distinguish between "must be retained", "can be supplemented", and "must not be exposed", thus providing clear content boundaries for the generation of subsequent candidate semantic response fragments.

[0051] When incorporating caller role identification and data tag range into the construction of the task semantic skeleton, the system does not filter after generation, but pre-limits the scope of participation for different nodes during the skeleton formation stage. Specifically, for multiple semantic support atoms under the same task intent code, the system first checks whether their corresponding source paths and data tags fall within the data tag range accessible to the current caller. If some semantic support atoms can enhance the completeness of the answer, but their corresponding data tags are above the caller's accessible range, the system will not include them in the necessary fact nodes, but will downgrade them to optional explanation nodes or directly include them in prohibited exposure nodes, depending on the situation. For content that is inconsistent with the requirements of the current task intent code, such as a user request only requiring statistical results, but some atoms pushing the answer to object-level description, the system will not include them in the core node set that can be directly used to generate the answer, even if it confirms their semantic truth. Through this pre-constraint method, the task semantic skeleton itself already has task completion boundaries and exposure boundaries, and the subsequently generated candidate semantic response fragments are naturally within a controllable range, without needing to rely entirely on end-point interception for correction.

[0052] When generating multiple candidate semantic response fragments based on the task semantic skeleton, semantic supporting atoms, and trusted cue subgraphs, the system adopts a "skeleton-driven, atom assembly, and version-based generation" approach, rather than allowing the large language model to freely generate multiple natural language answers. Specifically, the system first selects corresponding semantic supporting atoms as core assembly materials around the task target nodes and necessary fact nodes in the task semantic skeleton; then, depending on whether supplementary explanations, rule interpretations, background descriptions, or operational suggestions are needed, several semantic supporting atoms are selected from optional explanation nodes as extended assembly materials; for atoms referenced by nodes that are prohibited from being exposed, the system does not directly use them for candidate fragment assembly, but only records their restricted reasons internally. Afterwards, the system constructs multiple candidate semantic response fragments according to different answering strategies. For example, one candidate fragment leans towards directly answering the task result, another leans towards "result + brief reason," another leans towards "result + explanatory background," and yet another leans towards higher abstract granularity or stronger security conservatism. During generation, the system allows for differences in the granularity, interpretability, and detail retention of these candidate semantic response fragments, but they must all meet two prerequisites: first, they must not disrupt the task target nodes and necessary fact nodes in the task semantic skeleton; second, they must not bypass the credible clues and recovery path constraints identified in steps S2 and S3. Through this multi-version candidate generation method, the system can subsequently compare the recovery risk, path activation increment, and task fidelity contribution among multiple candidate fragments, rather than being limited by a single generated result.

[0053] In generating candidate semantic response fragments, the system does not simply concatenate semantic supporting atoms into continuous text. Instead, it first groups, sorts, and compresses the atoms to form fragment-level expressions. Specifically, the system first divides the semantic supporting atoms into core answer groups, necessary fact groups, explanation and supplement groups, and alternative explanation groups according to the hierarchical relationships between nodes in the task's semantic skeleton. Then, based on the principles of prioritizing the main task, prioritizing necessary facts over explanations, and prioritizing low-risk content over high-risk content, the system sorts these atoms. After sorting, the system performs aggregation compression on multiple semantic supporting atoms that can be merged, based on the target granularity of the current answer. For example, it merges multiple similar facts into a statistical description and merges multiple similar cause descriptions into a summary expression. The candidate semantic response fragments formed after this assembly process not only have a clear task orientation but also retain the supporting atom relationships that each fragment depends on internally, facilitating subsequent judgments on "what necessary semantics will be lost if a fragment is deleted" and "what recovery risks will be introduced if a fragment is retained."

[0054] When binding each candidate semantic response fragment to its corresponding set of semantic support atoms, the system employs a reverse traceable binding method. Specifically, for each candidate semantic response fragment, the system records which semantic support atoms it is assembled from, and the node affiliation of these semantic support atoms in the task semantic skeleton. If a candidate fragment is mainly composed of atoms corresponding to task target nodes and necessary fact nodes, it is marked as a high-task-fidelity fragment; if a candidate fragment also incorporates atoms corresponding to optional explanation nodes, it is marked as an extended explanation fragment. During the binding process, the system not only records "which atoms are used," but also "whether these atoms play the role of core conclusion, fact support, rule explanation, or background supplement in the current fragment," so that subsequent steps, when performing minimum blocking set solving and safe response reassembly, can accurately determine which type of task semantic function will be lost if a candidate fragment is downgraded, replaced, or deleted.

[0055] When binding a set of privacy clue atoms to each candidate semantic response fragment, the system does not simply bind based on whether the fragment's text surface contains sensitive fields. Instead, it comprehensively considers the source path of the semantic support atoms referenced by the fragment, its connection relationship with the trusted clue subgraph, and its potential role in advancing the identity recovery path graph. Specifically, the system first checks which source evidence fragment records the semantic support atoms on which the candidate semantic response fragment depends come from, and then tracks whether these source evidence fragment records simultaneously generated privacy clue atoms in step S2. If so, the relevant privacy clue atoms are bound to the candidate fragment as a first-level association set. Subsequently, the system determines whether the content expressed in the candidate fragment forms a complementary relationship with other clue nodes in the trusted clue subgraph through time constraints, object constraints, role pronouns, business attribute combinations, or reference inheritance. If a complementary relationship is formed, the privacy clue atoms corresponding to the relevant clue nodes are bound to the candidate fragment as a second-level association set. Through this two-layer binding method, even if a candidate fragment text does not directly contain a phone number, name, or order number, as long as it can make the existing clues closer to the target object's restored state by supplementing the path, the system can still establish an association between the relevant privacy clue atoms and the fragment, thereby providing accurate input for the counterfactual exposure simulation in the subsequent step S5.

[0056] In step S5, specifically, for each candidate semantic response fragment generated in step S4, the system constructs two contrasting states: "release the fragment" and "do not release the fragment," and compares the recovery path graph state and the task semantic skeleton satisfaction state under these two states. Through this counterfactual exposure simulation method, the system no longer relies solely on whether the candidate semantic response fragment itself contains explicit sensitive fields for static judgment. Instead, it explicitly evaluates how the fragment, once added to the prompt context or sent as output, will change the activation level of the existing recovery path, how it will push the target object's recovery node closer to a recognizable state, and to what extent it will preserve or destroy the semantic integrity of the current answer task.

[0057] During the counterfactual exposure simulation, the system first constructs multiple combined scenarios centered on the current candidate semantic response fragment. Specifically, the system combines the candidate semantic response fragment with the currently released set of semantic nodes to evaluate its incremental effect on existing exposed information links; it combines it with historical memory fragments to evaluate whether the fragment will activate historical recovery paths formed by cross-round inheritance; and it combines it with candidate knowledge fragments to evaluate whether it will supplement recovery conditions that were originally only within knowledge fragments and not yet exposed to the session output layer. For each combined scenario, the system reprojects the set of associated privacy clue atoms bound to the candidate semantic response fragment onto the identity recovery path graph and checks whether these atoms will add path nodes, enhance path edge weights, fill missing slots, or bring previously disconnected paths closer to a connected state. The system records the path state change results in each combined scenario and merges the results of each scenario to form a comprehensive exposure impact assessment of the candidate semantic response fragment under the current context.

[0058] When calculating the path activation increment of the candidate semantic response fragment for each identity recovery path, the system does not give a single total score for the entire path graph, but performs differential calculations for each recovery path. Specifically, for each potential recovery path in the identity recovery path graph, the system first records the current connectivity, the number of satisfied slots, the set of activated edges, and the distance to the target object recovery node in the baseline state of "not releasing the current candidate semantic response fragment"; then, in the counterfactual state of "releasing the current candidate semantic response fragment", the system recalculates the above indicators. If the current candidate semantic response fragment directly provides new clue slots, it will increase the number of satisfied slots in the path; if the fragment does not directly provide new clue slots, but enhances the feasibility of some edges through time constraints, role backreferences, reference inheritance, or semantic supplementation, it will increase the set of activated edges or increase the weight of some edges; if the fragment satisfies multiple conditions simultaneously, it will cause a compound increase in the connectivity of the path. The system normalizes the difference in path connectivity before and after release, the change in the number of satisfied slots, the change in the number of activated path edges, and the increase in edge weights, and synthesizes these into the path activation increment of the candidate semantic response fragment for the identity recovery path. Through this path-by-path differencing method, the system can accurately distinguish that some candidate semantic response fragments only slightly enhance path connectivity, while others significantly advance a high-risk path towards completion.

[0059] When calculating the identifiable advancement of a candidate semantic response fragment to the target object's recovery node, the system uses "the change in the proximity of the target object's recovery node to an identifiable state before and after releasing the fragment" as the core evaluation criterion. Specifically, the system first determines, based on the minimum identifiable slot template, which key conditions are still missing from the target object's recovery node in the current candidate clue cluster. Then, it judges whether the current candidate semantic response fragment directly fills these conditions after release, or whether it enhances the complementary relationship between existing clues, enabling some combinations that were originally insufficient to form recovery capabilities to begin to meet the recovery conditions. If the candidate semantic response fragment directly fills key slots, such as filling specific time windows, object ranges, business attributes, or transaction restrictions, its contribution to the identifiable advancement is high; if it only enhances the matching strength between existing clues, narrows the object candidate range, or improves path connectivity, its contribution to the identifiable advancement is moderate; if it only provides general background information without changing the identifiable state of the target object, its advancement is low or zero. The system can represent this advancement as "the reduction in the number of remaining unmet slots," "the reduction in the size of the target object candidate set," "the approximation ratio to reaching the identifiable threshold," or "the improvement in the risk score of the target object recovery node." Through this calculation method, the system can transform the abstract judgment of "whether this candidate content will make a certain object easier to recover" into a comparable, sortable, and quantifiable result that can be used for subsequent blocking solutions.

[0060] When calculating the task fidelity contribution of the current candidate semantic response fragment to the task semantic skeleton, the system adopts a comprehensive evaluation method of "node satisfaction + node importance + expression completeness," rather than scoring solely based on fragment length or semantic similarity. Specifically, the system first examines which semantic supporting atoms constitute the current candidate semantic response fragment, and then maps these semantic supporting atoms back to the task target node, necessary fact node, and optional explanation node in the task semantic skeleton. If the candidate semantic response fragment directly carries the core answer conclusion required by the task target node, the system assigns it a high base task fidelity value; if the fragment mainly provides the factual basis necessary to complete the core answer, its task fidelity contribution value is further increased based on the number and completeness of the necessary fact nodes it covers; if the fragment mainly serves as an optional explanation, it is assigned a medium or low contribution value based on its enhancement of the answer's comprehensibility. For candidate semantic response fragments that simultaneously cover multiple node types, the system does not simply add them up, but rather performs weighted fusion based on node priority, that is, the satisfaction level of the task target node has a higher weight than that of necessary fact nodes, and necessary fact nodes have a higher weight than optional explanation nodes. In addition, the system checks whether the candidate semantic response fragment contains extended content unrelated to the current task objective. If it contains a large number of irrelevant components, its task fidelity contribution value is penalized to prevent the system from misjudging "redundant but unnecessary" content as high-value content. In this way, the task fidelity contribution value can truly reflect: how much the completion of the current answer task would be improved if the candidate semantic response fragment were retained; and what key support would be lost from the task semantic skeleton if the fragment were prevented from being released.

[0061] When determining the path blocking cost of a candidate semantic response fragment based on path activation increment, identifiable advance, and task fidelity contribution, the system employs a "joint evaluation of cutoff benefits and semantic losses" approach, rather than simply prioritizing fragments with higher risk values. Specifically, the system first synthesizes the path activation increment and identifiable advance brought about by the release of the candidate semantic response fragment into a recovery risk push value, representing the fragment's ability to advance high-risk identity recovery paths. Subsequently, the task fidelity contribution value of the fragment is used as a semantic loss reference value, indicating the extent of disruption to the current task response if the fragment's release is blocked. Based on this, the system comprehensively calculates both the "path cutting benefits gained from blocking the fragment's release" and the "semantic loss cost incurred in blocking the fragment's release." If a candidate semantic response fragment has a high recovery risk but a low task fidelity contribution, its path blocking cost is low, indicating that the fragment is suitable as a priority blocking target. Conversely, if a fragment has some recovery risk but also supports the core answer conclusion or key facts, its path blocking cost is high, indicating that it should not be simply deleted but is more suitable for processing in subsequent steps using reduced-order expression, local replacement, or recombination. Through this two-factor trade-off, the system can avoid simply including all high-risk fragments in the direct blocking set, thereby improving the rationality of solving the minimum blocking set in the subsequent steps.

[0062] When determining the semantic retention benefit of candidate semantic response fragments, the system comprehensively evaluates the fragment based on the following criteria: how much does retaining the fragment increase task completion, explanation sufficiency, and response stability? Specifically, the system first calculates the basic retention benefit based on the task objective nodes, necessary fact nodes, and optional explanation nodes covered by the fragment. Then, it determines whether the fragment reduces dependence on other high-risk fragments, i.e., whether there exists a scenario where retaining the current candidate semantic response fragment allows other high-risk candidate fragments to remain active while still achieving the same task objective. If such a substitution effect exists, the system increases the semantic retention benefit of the fragment because it is not only valuable in itself but may also help the overall response complete the task more safely. Conversely, if the fragment is semantically relevant but its content can be completely replaced by other low-risk candidate fragments, its semantic retention benefit is low. The system also checks whether the fragment enhances the coherence and comprehensibility of the overall response, such as whether it connects discrete facts into a complete conclusion or provides necessary explanations for rule-based responses. If so, its semantic retention benefit is further increased. Through this process, the benefits of semantic preservation are not merely a rough judgment of whether the text is "useful or not," but a comprehensive quantification of the actual substitution value and structural value that the fragment plays in the overall safe response scheme.

[0063] Step S6: The system first reads the identity recovery path graph, the path activation increment, identifiable advancement amount, task fidelity contribution value, path blocking cost, and the current task semantic skeleton state corresponding to each candidate semantic response fragment. Then, it filters out identity recovery paths whose connection risk reaches a preset recovery risk threshold, forming a set of paths to be cut off. High-risk identity recovery paths here are not limited to already connected paths, but also include paths that will significantly approach a connected state after releasing certain candidate semantic response fragments, thus ensuring that the blocking solution not only handles existing risks but also foreseeable risks that are about to emerge.

[0064] When forming blocking candidate objects, the system does not only consider candidate semantic response fragments as the sole blocking object, but also includes source evidence fragment records and clue connection edges in the candidate scope. Specifically, if the release of a candidate semantic response fragment will directly fill a critical slot or significantly improve the path connectivity, then the candidate semantic response fragment is listed as a fragment-level blocking candidate object; if a source evidence fragment record is an upstream evidence source that multiple high-risk paths jointly depend on, then the source evidence fragment record is listed as a source-level blocking candidate object; if a clue connection edge itself plays a role in cross-round inheritance, cross-source reference, or semantic reference, and cutting off the connection can prevent several high-risk paths from continuing to exist, then the clue connection edge is listed as an edge-level blocking candidate object. The system then establishes a blocking impact record for each blocking candidate object, which paths to be cut off can be cut off after the object is blocked, how much identifiable progress will be reduced, and how much task fidelity contribution value will be lost.

[0065] When establishing solution constraints, the system uses "task target nodes and necessary fact nodes not becoming invalid" as a hard constraint and "cutting off all paths to be cut off" as a safety constraint. More specifically, the system first checks which candidate semantic response fragments in the task semantic skeleton directly support the task target nodes and necessary fact nodes; for fragments that are completely irreplaceable and whose removal would prevent the core task from being completed, they are not allowed to be directly included in the set of blocking objects that are completely prohibited from being released, but are only allowed to enter the set of reduced-order expressions or replacement candidates. Subsequently, the system checks whether each path to be cut off has at least one blockable fragment, source evidence, or connecting edge; only when the set of blocking candidate objects can cover all paths to be cut off will the subsequent optimization solution be entered. Through this dual constraint, the system avoids the unreasonable result of "cutting off high-risk paths, but also cutting off the main conclusion of the answer at the same time".

[0066] When solving for the minimum blocking set, the system employs a combination of stepwise search and comprehensive cost evaluation. Specifically, the system first selects the object that covers the largest number of paths while minimizing the loss of task fidelity contribution value from the blocking candidate objects, using this as the initial blocking candidate. Based on this, new blocking candidate objects are iteratively added until all paths to be blocked are covered. For each new blocking candidate object added, the system recalculates the remaining unblocked path set, the cumulative task fidelity contribution value loss, and the cumulative path blocking cost. If multiple options exist, the option with the smaller task fidelity contribution value loss is prioritized; if the task fidelity contribution value losses are similar, the option with the smaller blocking cost is further selected. When both factors need to be considered, the system can also weight the task fidelity contribution value loss and blocking cost according to preset weights, selecting the blocking scheme with the smallest weighted result. The result obtained is not a coarse solution that prioritizes "more blocking objects equals greater safety," but rather a simplified blocking solution that minimizes the impact on response quality while satisfying the safety blocking objective.

[0067] After obtaining the minimum blocking set, the system performs a validity check on the result. Specifically, the system temporarily removes each blocking object in the minimum blocking set from the identity recovery path graph, or replaces it with an equivalent object after a reduced-order expression, and recalculates whether each high-risk path is still possible to connect. At the same time, the remaining candidate semantic response fragments after blocking are remapped into the task semantic skeleton, and the task target node and necessary fact node are checked to see if they are still valid. If the check result shows that there are still high-risk paths that have not been cut off, the system continues to add blocking objects and solves again; if the check result shows that although all paths have been cut off, the task target node or necessary fact node is invalid, the system reverts to the current scheme and selects alternative blocking objects with less semantic loss. Only when both conditions are met—"all paths to be cut off are blocked" and "the task target node and necessary fact node in the task semantic skeleton are still valid"—will the system confirm the result as the final minimum blocking set.

[0068] Step S7: Specifically, the system first reads the minimum blocking set, task semantic skeleton, candidate semantic response fragment set, and the path activation increment, task fidelity contribution value, and high-risk identity recovery path identifier corresponding to each fragment output in step S6. Then, candidate semantic response fragments not falling into the minimum blocking set are directly included in the retained fragment set, while candidate semantic response fragments falling into the minimum blocking set are included in the set to be downgraded. The system does not immediately delete fragments in the set to be downgraded. Instead, it first generates a corresponding security response reorganization scheme based on the type of high-risk identity recovery path the fragment belongs to, the key slots the path depends on, and whether the fragment plays a role in object location, relationship completion, time constraint, or combination identification in path connection. The security response reorganization scheme at least clarifies: which fragments are retained as is, which fragments require what type of path-blocking downgrade expression, which fragments still need to be reviewed after downgrade, and which fragments, if downgraded ineffective, require triggering upstream source evidence fragment record retraction and restricted regeneration.

[0069] When performing path-blocking reduction expression on candidate semantic response fragments that fall into the minimum blocking set, the system does not replace sensitive words with placeholders according to a fixed template. Instead, it first identifies the key driving factors in the high-risk identity recovery path where the fragment is located, and then selects a reduction strategy that can cut off the driving factors. Specifically, if a segment is high-risk because it elevates a vague object to a specific one, then categorical substitution is preferred, replacing object-level descriptions with category-level descriptions. If a segment is high-risk because it explicitly establishes strong relationships between customers and orders, customers and work orders, or customers and contact information, then relation weakening substitution is preferred, rewriting definitive relationships such as "belongs to," "corresponds to," and "bound" with weaker relationship descriptions such as "related," "involved in," and "possibly associated." If a segment is high-risk because it provides precise time, precise amount, precise number of times, or precise range and together with other clues constitutes a unique identification condition, then interval or statistical substitution is preferred, rewriting precise values ​​with range values, grade values, statistical values, or generalized quantitative expressions. If a segment is high-risk because it carries time-location features, source object hint features, or combined identification features, then feature stripping substitution is preferred, deleting such limiting components that can trigger path completion. If a segment, while fulfilling a necessary explanatory function, has too many details that would complicate the recovery path, then summary substitution is preferred, retaining only the conclusive information necessary to complete the task. By using this method of "first identifying the factors that drive the path and then selecting the cutting-off action", a one-to-one correspondence is formed between the downgraded expression and the high-risk identity restoration path, thereby ensuring that the rewriting action is not a general fuzzy processing, but a targeted processing with a clear blocking purpose.

[0070] When performing path-blocking reduction of expression, the system rewrites the fragments in the set to be reduced according to the principle of "preserving the task first, then reducing recognition." More specifically, the system first checks whether the candidate semantic response fragment supports the task target node, necessary fact node, or optional explanation node in the task semantic skeleton. For fragments supporting the task target node and necessary fact node, they are not directly deleted as a whole. Instead, while keeping the core conclusion unchanged, the part of the expression that will supplement the identity recovery path is weakened first. For fragments supporting only optional explanation nodes, higher-intensity summarization replacement or feature stripping replacement is allowed. After rewriting, the system rebinds the reduced fragment to its remaining semantic support atom set and remaining associated privacy clue atom set, and remaps it back to the identity recovery path graph to determine whether the fragment still retains the necessary semantics after rewriting and no longer promotes the continuation of high-risk paths. The result of this processing is that the system outputs not the "masked original text", but a safe candidate expression that has been rewritten according to the path-blocking requirements and can still complete the current task.

[0071] When reviewing the downgraded candidate semantic response fragments, the system uses "whether the corresponding identity recovery path has been severed" as the primary criterion, rather than simply checking whether the text has become shorter or whether explicit fields have been removed. Specifically, the system recombines the downgraded fragments with the retained fragment set, historical memory fragments, and candidate knowledge fragments, and recalculates the connectivity of the high-risk identity recovery path corresponding to the fragment, the key slot satisfaction status, and the path activation increment. If the review results indicate that the original high-risk path no longer meets the connectivity conditions, or although a path still exists, it has been reduced to below the preset recovery risk threshold, the system confirms that the downgraded expression is valid and includes the fragment in the retained output set of the security response reorganization scheme. If the review results indicate that the fragment, after downgrading, still fills in key slots, still maintains high-weighted connections, or still makes a high-risk path nearly connected, the downgraded expression is deemed invalid, and the process enters the source evidence fragment record withdrawal stage. Thus, the system is not truly concerned with "how much the text has been changed," but rather with "whether the recovery path has been substantially severed."

[0072] If the identity recovery path is not severed after the path-blocking downgraded expression, the system further retracts the high-path activation increment source evidence fragment records associated with the candidate semantic response fragment. Specifically, the system tracks the source path of the candidate semantic response fragment, identifies the source evidence fragment records it depends on in steps S1 and S2, and sorts the path activation increment of high-risk paths according to these source evidence fragment records. For those upstream source evidence fragment records that, once retained, will continue to provide key support for high-risk paths, the system removes them from the current prompt context or downgrades them to be usable only for internal reference and not directly involved in the current round of generation. After the retraction is completed, the system does not end directly, but performs restricted regeneration under the constraints of the task semantic skeleton. That is, the model is only allowed to reorganize the answer around the task target node and necessary fact nodes, and the identifiable content corresponding to the retracted source evidence fragment records is not allowed to be reintroduced, nor is it allowed to bypass the aforementioned path-blocking downgraded expression to generate equivalent high-risk statements again. By using this progressive processing method of "first reducing the order, then reverting, and then regenerating", the system avoids the distortion of answers caused by simple deletion, and also prevents high-risk source content from repeatedly appearing in the model regeneration. Step S8: Specifically, the system first divides the security response reorganization scheme obtained in step S7 into multiple output blocks according to preset block length, semantic boundaries, or pause boundaries. Before sending each output block, it generates a corresponding active recovery path status table by combining the currently sent preceding content, the semantic support atom set bound to the output block, the associated privacy clue atom set, and the identity recovery path graph. The active recovery path status table records at least: the identifier of the activated path segment that has been triggered by the current output block, the identifier of the remaining uncut path segment that has not been cut off in the current sending state, the path residual blocking cost required to continue to allow the output block, and the task fidelity margin that can still be reduced under the current task semantic skeleton without causing the task target node and necessary fact node to fail. Through this block-level status table, the system no longer only checks "whether the current block itself is sensitive" during the streaming output stage, but continuously judges "whether adding sent content to the current block will advance a high-risk identity recovery path to the through state."

[0073] When making a pre-send determination based on the activity recovery path status table, the system first assumes that the current output block is added to the set of sent content, and then remaps it to the identity recovery path graph. It checks whether the output block adds a critical slot, enhances the connectivity of existing path segments, or completes any remaining uncut path segments, thereby determining whether any high-risk identity recovery path will be established. If the determination is negative, and the cost of blocking the remaining path is still higher than the actual path advancement effect of the current output block, then the output block is allowed to be sent as is, and the sending result is written back to the activity recovery path status table as the preceding state of the next output block. If the determination is positive, meaning that sending the current output block will lead to the establishment of any high-risk identity recovery path, or will reduce the remaining uncut path segments below a preset security threshold, then the system does not allow the output block to be sent as is, but immediately enters the block-level blocking process. Therefore, step S8 implements a continuous control process of "outputting, updating, and determining simultaneously," rather than a static review process.

[0074] When the current output block is determined to be unsuitable for transmission as is, the system prioritizes continuing to execute path-blocking reduction expressions within that output block. This involves categorical substitution, relation weakening substitution, interval or statistical substitution, feature stripping substitution, or summary substitution for local expressions within the output block that perform functions such as object location, relation completion, time constraint, or combination identification. If the activity recovery path status table is recalculated after reduction and indicates that the high-risk path has been severed, the reduced output block replaces the original output block for transmission. If reduction still fails to prevent the high-risk path from continuing, the system continues to trace the high-path activation incremental source evidence fragment records upon which the output block depends and performs a rollback, preventing the corresponding upstream evidence from participating in the current subsequent output link. After the rollback is completed, the system performs restricted regeneration of the current block and its subsequent necessary content only under the constraints of the task semantic skeleton, thereby preserving the task target node and necessary fact nodes as much as possible while avoiding the reintroduction of the rolled-back high-risk identification information. Through this block-level progressive processing, the system refines risk control to each output block, rather than terminating the entire response in a one-size-fits-all manner.

[0075] The system outputs a rollback response when any of the following conditions exist: The current output block, after path-blocking reduction processing, still results in the completion of any high-risk identity recovery path; after the high-path activation incremental source evidence fragment record associated with the current output block is rolled back, the candidate response content obtained through restricted regeneration still cannot keep all high-risk identity recovery paths in a non-completed state; the candidate knowledge fragment lacks a data tag, preventing it from participating in authorization compatibility and recovery path security determination; the historical memory fragment lacks its round or upstream reference identifier, preventing it from reliably participating in cross-round inheritance relationship determination; the activity recovery path status table cannot be updated or the update times out, resulting in the current block lacking credible sending basis. In any of the above situations, the system will no longer attempt to allow the current output block, but will directly output a rollback response. The rollback response can be selected from one or more of the following based on the current task intent code and task semantic skeleton: a security digest response, an insufficient permission prompt response, a narrowed query scope prompt response, or a manual review prompt response. This conservatively terminates high-risk outputs when path security cannot be guaranteed, while maintaining the availability and interpretability of the system response as much as possible.

[0076] Step S9: Specifically, the system only performs formal output on response content that meets the following conditions: First, all output blocks corresponding to the current output content have completed the activity recovery path status table update; second, there are no high-risk identity recovery paths still in a connected state; third, after necessary path-blocking reduction expressions, source evidence fragment retraction, or restricted regeneration, the current output content still satisfies the task target nodes and necessary fact nodes in the task semantic skeleton. After meeting the above conditions, the system sends the response content as the final response content that has passed the detection to the caller and marks this output behavior as an auditable secure output event.

[0077] When generating audit logs, the system does not only record the final output text, but also structurally solidifies the key judgment links experienced by this security output event. Specifically, the system first writes the candidate clue cluster identifier corresponding to this output, which is used to characterize which object-level clue aggregation results this output risk assessment revolves around; then it writes the trusted clue subgraph identifier and the identity recovery path graph identifier, which are used to characterize which set of trusted clue relationships after conflict resolution and which set of recovery path structures this output is based on; then it writes the minimum blocking set, which is used to characterize the set of blocking objects ultimately selected by the system to prevent the high-risk identity recovery path from being completed. Then, the system continues to record the path activation increment corresponding to each candidate semantic response fragment, to illustrate the contribution of each candidate fragment to the progress of the recovery path before release; at the same time, it records the path blocking type reduction expression actions actually executed, to illustrate which fragments have undergone categorization substitution, relation weakening substitution, interval or statistical substitution, feature stripping substitution, or summary substitution. For cases where upstream processing has occurred, the system also records whether source evidence fragment retraction was executed, whether restricted regeneration was executed, and the corresponding triggering reasons.

[0078] During the audit record writing process, the system requires that each record can be traced back to the corresponding intermediate results in the preceding steps. Therefore, the fields are linked by reference rather than stored in isolation. Specifically, the object candidate clue cluster identifier corresponds to the object merging result in step S2, the trusted clue subgraph identifier corresponds to the conflict resolution result in step S2, the identity recovery path graph identifier corresponds to the path construction result in step S3, the minimum blocking set corresponds to the blocking solution result in step S6, the path activation increment corresponding to each candidate semantic response fragment corresponds to the counterfactual exposure simulation result in step S5, and the path blocking type order reduction expression action, source evidence fragment withdrawal, and restricted regeneration result correspond to the actual processing actions in steps S7 and S8, respectively. To facilitate subsequent verification, the system also attaches a reason code to each audit record. The reason code is used to characterize the direct cause that triggers the current processing action, such as a high-risk path about to be completed, authorization incompatibility, missing historical memory fragment identifier, missing data label for candidate knowledge fragment, or timeout in the activity recovery path status table update. By using this field-by-field correlation writing method, audit logs can fully reconstruct the entire process of "why this content was allowed to be output, what security measures the system took to allow the output, which high-risk paths were cut off, and which content was downgraded or rolled back".

[0079] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for preventing privacy information leakage based on a large language model, characterized in that; Includes the following steps: Step S1: Receive the user request submitted by the caller, and obtain the session context, historical memory fragments, caller role identifier, data tag range accessible to the caller, and candidate knowledge fragments recalled from the enterprise internal knowledge base corresponding to the user request. User requests, session contexts, historical memory fragments, and candidate knowledge fragments are uniformly segmented into multiple content fragments, and a corresponding source evidence fragment record is generated for each content fragment. The source evidence fragment record includes at least the following: Source type identifier, fragment identifier, round to which it belongs, timestamp, text position range, upstream reference identifier, data tag, source object hint identifier, source trust level, and semantic role identifier; Step S2: Based on the privacy detection model and semantic parsing model, extract privacy clue atoms and semantic support atoms from each source evidence fragment record respectively; Based on the source object hint identifier, the alias reference relationship, the attribute pairing relationship, the inheritance relationship of the round to which it belongs, and the upstream reference relationship, multiple privacy clues are atomically merged into object candidate clue clusters; A conflict relation matrix is ​​constructed for privacy clue atoms in each candidate clue cluster. Based on the source trust level and the conflict relation matrix, conflict resolution is performed on conflicting privacy clue atoms to generate the corresponding trust clue subgraph. Step S3: For each trusted clue subgraph, call the preset minimum identifiable slot template to construct the corresponding identity recovery path graph. The nodes in the identity recovery path graph include at least: trusted clue nodes, released semantic nodes, candidate released semantic nodes, and target object recovery nodes. The edges in the identity recovery path graph include at least: slot complement edges, cross-round inheritance edges, cross-source reference edges, temporal co-occurrence edges, and semantic reference edges; Each identity recovery path is used to characterize a potential recovery path that allows the target object's identity, contact information, transaction relationships, or sensitive attributes to be recovered after the combination of released content and content to be released. Step S4: Based on the user request, the task intent code is parsed and constructed according to the task intent code, the caller role identifier and the data tag range. The task semantic skeleton includes at least the task target node, necessary fact node, optional explanation node and prohibited exposure node. Multiple candidate semantic response fragments are generated based on the task semantic skeleton, semantic supporting atoms, and trusted clue subgraphs. Each candidate semantic response fragment is bound to at least a corresponding set of semantic supporting atoms and an associated set of privacy clue atoms. Step S5: Perform counterfactual exposure simulation for each candidate semantic response fragment. The counterfactual exposure simulation is used to calculate the path activation increment, identifiable advancement of the target object recovery node, and task fidelity contribution of the candidate semantic response fragment to each identity recovery path, under the assumption that the current candidate semantic response fragment is included in the prompt context or sent as output. Based on the path activation increment, identifiable advancement, and task fidelity contribution, determine the path blocking cost and semantic preservation benefit of the corresponding candidate semantic response fragment. Step S6: Under the constraint of keeping the task target node and necessary fact node in the task semantic skeleton from becoming invalid, solve the minimum blocking set for the identity recovery path graph. The minimum blocking set is used to represent the minimum set of candidate semantic response fragments, source evidence fragment records or clue connection edges that need to be downgraded, prohibited from release, withdrawn or replaced in order to prevent all high-risk identity recovery paths from being connected. The objective of finding the minimum blocking set is to minimize the loss of the task fidelity contribution value while cutting off all identity recovery paths that reach the preset recovery risk threshold. Step S7: Generate a safe response reorganization scheme based on the minimum blocking set, wherein candidate semantic response fragments that do not fall into the minimum blocking set are preserved according to their original semantics, and path blocking type reduction expression is performed on candidate semantic response fragments that fall into the minimum blocking set. The path blocking type reduction expression includes at least one or more of the following: categorical substitution, relation weakening substitution, interval substitution, statistical substitution, summary substitution, and feature stripping substitution. When the corresponding identity recovery path is not cut off after the path-blocking downgraded expression, the high-path activation incremental source evidence fragment record associated with the candidate semantic response fragment is rolled back and restricted regeneration is performed under the constraints of the task semantic skeleton. Step S8: During the streaming output of candidate response content, an active recovery path status table is generated for each output block. The active recovery path status table includes at least the activated path segment identifier, the remaining uncut path segment identifier, the path residual blocking cost, and the current task fidelity margin corresponding to the current output block. Based on the active recovery path status table, it is determined whether sending the current output block will cause any high-risk identity recovery path to be opened. If so, prevent the current output block from being sent as is, and continue to execute path-blocking downgraded expressions, source evidence fragment rollback, or restricted regeneration; if all processing still fails to prevent the high-risk identity recovery path from being established, output a rollback response; Step S9: Output the response content that passes the detection and generate an audit record. The audit record includes at least: the object candidate clue cluster identifier, the trusted clue subgraph identifier, the identity recovery path graph identifier, the minimum blocking set, the path activation increment corresponding to each candidate semantic response fragment, the path blocking type downgrade expression action executed, whether the source evidence fragment was withdrawn, whether the restricted regeneration was executed, and the reason code.

2. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: The credibility level of a source in a fragment of source evidence is determined based on at least the following factors: The source type of the content fragment; The historical effectiveness of content fragments corresponding to the source system; The degree of authorization compatibility between content fragments and the caller's role identifier and data tag scope; The time freshness and time validity of content fragments; This results in content fragments with higher source credibility and time validity having a higher retention priority in conflict resolution and higher path edge weights in the identity restoration path graph.

3. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: The conflict relation matrix should at least represent one or more of the following conflicts: Source conflicts arise when different source types provide inconsistent content for the same clue slot. Time conflicts caused by changes in the same object's properties at different timestamps; Authorization conflicts arising from inconsistent visibility of clues under different data tags; Semantic mutual exclusion conflict formed when two or more privacy clue atoms cannot be valid at the same time; The conflict resolution process includes at least the following steps: reducing the weight of low-trust conflicting threads, removing time-expired threads, masking threads with incompatible authorizations, and retaining high-trust consistent threads, thereby obtaining a trusted thread subgraph.

4. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: The identity recovery path graph is a directed graph constructed based on a trusted thread subgraph and a minimum identifiable slot template; The minimum identifiable slot templates are set separately for different privacy categories, and each minimum identifiable slot template includes at least two clue slot types; When the clue slot type that has been satisfied and the released semantic node together satisfy the corresponding minimum identifiable slot template on an identity recovery path, the identity recovery path is determined to be connected. The path activation increment is used to characterize the improvement in the connectivity of the corresponding identity recovery path after a candidate semantic response fragment is released.

5. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: Counterfactual exposure simulations include: Combine the current candidate semantic response fragment with the released semantic node, historical memory fragment, and candidate knowledge fragment respectively; Under combined conditions, the success rate or success rate of each identity recovery path is recalculated. Calculate the identifiable propulsion amount corresponding to the current candidate semantic response fragment; Based on the degree to which the current candidate semantic response fragment satisfies the task target node, necessary fact node, and optional explanation node, the corresponding task fidelity contribution value is calculated. The path blocking cost is determined by the combined effect of cutting off the identity recovery path graph and the degree of damage to the task semantic skeleton when preventing the release of the current candidate semantic response fragment.

6. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: Solving for the minimum blocking set includes: All identity recovery paths that reach the preset recovery risk threshold are designated as the set of paths to be cut off; Candidate semantic response fragments, source evidence fragment records, and clue connection edges are used as blocking candidates; The constraint is to cut off all paths to be cut off; The optimization objective is to minimize the loss of task fidelity contribution value, the cost of blocking, or the weighted sum of the two. Find the corresponding minimal blocking set.

7. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: The path-blocking reduction expression is not a general desensitization and replacement for text content, but a targeted expression reduction performed on the high-risk identity recovery path where the candidate semantic response fragments that fall into the minimum blocking set are located; Pathway-blocking reduction expression includes at least: Replace object-level representations with category-level representations using categorical substitution; Replace explicit relational expressions with weak relational expressions to weaken the relational substitution; Replace precise numerical values ​​with interval values, rank values, or interval or statistical substitutions of statistical values; Replace the feature stripping by removing time location features, source object cue features, or combined recognition features; And replace detailed descriptions with a summary of the information required for the task; Each of the path-blocking downgraded expressions corresponds to at least one type of high-risk identity recovery path cutoff strategy.

8. The privacy information leakage prevention method based on a large language model according to claim 1, characterized in that: Output a fallback response if any of the following conditions exist: Even after the current output block is processed by the path-blocking reduced-order expression, it will still result in the opening of any high-risk identity recovery path; After the high-path activation incremental source evidence fragment record associated with the current output block is rolled back, the candidate response content obtained by the restricted regeneration still cannot keep all high-risk identity recovery paths in an unconnected state. Candidate knowledge fragments are missing data labels; The historical memory fragment is missing its corresponding round or upstream reference identifier; The activity recovery path status table could not be updated or the update timed out; The rollback response includes one or more of the following: security summary response, insufficient permissions prompt response, narrowed query scope prompt response, or manual review prompt response.

Images