An audit model training and abnormality identification method based on rule feedback

Abstract

This invention discloses a method for training and identifying anomalies in an audit model based on rule feedback, comprising the following steps: generating a structured description of rules based on activated audit rules, a document type system, and rule relationship data; generating an audit sample constraint template based on the structured description of rules; inputting the audit sample constraint template into a large-scale cloud model to generate audit training samples and anomaly interpretation chains; performing replay detection on the audit training samples through a rule engine to obtain replay verification results; constructing a GRPO reward signal based on the replay verification results; optimizing the sample generation strategy of the large-scale cloud model based on the GRPO reward signal and generating a standardized training set; training a local small-scale audit identification model using distillation based on the standardized training set; and performing incremental sample generation and incremental distillation when adding new audit rules. This invention achieves self-generation of audit samples, rule feedback optimization, local anomaly identification, and rapid adaptation to new rules.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a method for training and identifying anomalies in an audit model based on rule feedback. Background Technology

[0002] As the data volume of corporate financial reimbursement, travel approval, invoice verification, expense control and internal audit business continues to increase, traditional auditing methods that rely on manual sampling and fixed rule screening are no longer able to meet the auditing needs of high-frequency, multi-source and complex scenarios.

[0003] Existing auditing systems typically use rule engines to judge reimbursement amounts, invoice dates, consumption locations, approval processes, personnel permissions, and invoice entities, which can detect some obvious violations. However, such systems mainly rely on manually configured conditions and thresholds, and the rules can only be used as detection conditions, making it difficult to further transform them into data generation constraints and feedback signals during model training.

[0004] Existing AI auditing models typically require a large amount of real expense reports, invoice data, and anomaly-labeled samples for training. However, corporate financial data is highly sensitive, data sharing between different customers is difficult, the number of real anomaly samples is small, and the labeling cost is high, resulting in insufficient training data for the model, incomplete coverage of anomaly types, and weak adaptability of the model to new rules.

[0005] In actual business operations, clients' audit rules constantly change with management systems, reimbursement policies, invoice requirements, and risk control strategies. For example, a client might initially configure only ten audit rules, but the business department may later add an eleventh rule. Traditional models typically require collecting real anomaly samples, relabeling, and retraining the model, resulting in long training cycles and potential issues with the leakage of sensitive data, which is detrimental to the continuous updating of the model in the client's local environment.

[0006] Furthermore, existing data generation solutions based on large models mostly remain at the level of generating samples based on prompt words. They lack a mechanism for rule engines to replay and verify the quality of generated samples, and they also lack technical solutions to transform rule hit results, risk levels, explanation completeness, and rule conflict situations into reinforcement learning reward signals. This can lead to problems such as inconsistent rules, incorrect abnormal labels, missing explanation chains, and insufficient coverage of boundary samples in generated samples.

[0007] Therefore, how to provide a rule-based feedback-based audit model training and anomaly identification method is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0008] One objective of this invention is to propose a rule-based audit model training and anomaly identification method. This invention transforms activated audit rules, document type systems, and rule relationship data into structured rule descriptions, and generates audit sample constraint templates based on these descriptions. Audit training samples and anomaly interpretation chains are generated using a large-scale cloud model according to these constraint templates. The audit training samples are then replayed and tested using a rule engine, converting rule hit results, risk scores, anomaly levels, interpretation completeness, and rule conflict results into GRPO reward signals to optimize the audit sample generation strategy of the large-scale cloud model. The optimized standardized training set is then used to distill and train a local small-scale audit identification model, enabling the local model to perform anomaly identification in the customer's local environment. When a new audit rule is added, the system automatically triggers incremental sample generation, rule replay testing, reward updates, and incremental distillation based on the new rule, allowing the local small-scale audit identification model to acquire the ability to identify the new rule.

[0009] A method for training and identifying anomalies in an audit model based on rule feedback according to an embodiment of the present invention includes the following steps:

[0010] S1. Generate a structured description of the rules based on the activated audit rules, the invoice type system, and the rule relationship data, and generate an audit sample constraint template based on the structured description of the rules;

[0011] S2. Input the audit sample constraint template into the large-size model in the cloud to generate audit training samples and anomaly interpretation chains;

[0012] S3. The audit training samples are replayed and tested using the rule engine to obtain the replay verification results;

[0013] S4. Construct the GRPO reward signal based on the playback verification results;

[0014] S5. Optimize the audit sample generation strategy for large-size cloud models based on GRPO reward signals, and generate a standardized training set;

[0015] S6. Distill the local small-size audit identification model based on the standardized training set to obtain the trained local small-size audit identification model.

[0016] S7. Deploy the trained local small-size audit identification model on the customer's local machine to identify anomalies in the audit data;

[0017] S8. When a new audit rule is added, incremental sample generation, rule replay detection, reward update and incremental distillation are triggered based on the new audit rule, so that the local small-size audit recognition model can obtain the ability to recognize the new rule.

[0018] Optionally, step S2 includes the following steps:

[0019] S21. Input the audit sample constraint template, rule structure description, and invoice type system into the large-size cloud model;

[0020] S22. Generate normal audit samples, abnormal audit samples, boundary audit samples, and combined abnormal audit samples from large-size models in the cloud.

[0021] S23. An anomaly explanation chain is generated by a large-scale model in the cloud based on the triggering field, target rule, risk level, and anomaly cause.

[0022] S24. Combine normal audit samples, abnormal audit samples, boundary audit samples, combined abnormal audit samples, target rule numbers, and abnormal interpretation chains into audit training samples.

[0023] Optionally, step S3 includes the following steps:

[0024] S31. Input the audit training sample into the rule engine and execute rule detection according to the trigger field, judgment condition and threshold condition of the target rule;

[0025] S32. Determine whether the audit training sample hits the target rule and whether it mishit a non-target rule to obtain the rule hit result;

[0026] S33. Generate risk scores and anomaly levels based on rule hit results, target rule risk levels, and rule escalation relationships;

[0027] S34. Generate explanation completeness based on the abnormal fields, rule numbers, triggering conditions, and explanation text in the audit training sample;

[0028] S35. Generate rule conflict results based on complementary relationships, escalation relationships, co-occurrence relationships, and conflict relationships, and use the rule hit results, risk scores, anomaly levels, explanation completeness, and rule conflict results as replay verification results.

[0029] Optionally, step S4 includes the following steps:

[0030] S41. Generate rule hit rewards based on rule hit results;

[0031] S42. Generate risk level consistency rewards based on risk scores and anomaly levels;

[0032] S43. Generate explanation chain rewards based on explanation completeness;

[0033] S44. Generate sample coverage rewards based on the coverage of boundary audit samples and combined anomaly audit samples;

[0034] S45. Generate conflict penalties based on rule conflict results;

[0035] S46. Determine the weight of each reward item based on the rule risk level, rule stability, and rule hit frequency, and perform a weighted mapping on the rule hit reward, risk level consistency reward, interpretation chain reward, sample coverage reward, and conflict penalty to obtain the GRPO reward signal.

[0036] Optionally, step S5 includes the following steps:

[0037] S51. Multiple audit training samples corresponding to the same rule structure description are taken as a group of candidate samples.

[0038] S52. Calculate the intra-group relative reward for each candidate sample based on the GRPO reward signal;

[0039] S53. Increase the sampling probability of the generation path corresponding to the candidate sample with relatively high reward within the group, and decrease the sampling probability of the generation path corresponding to the candidate sample with relatively low reward within the group.

[0040] S54. Repeat the audit sample generation and rule replay detection until the average reward of the candidate sample group reaches the preset reward threshold.

[0041] S55. Generate a standardized training set based on audit training samples whose average reward reaches a preset reward threshold.

[0042] Optionally, step S6 includes the following steps:

[0043] S61. Use the invoice field, amount field, time field, location field, personnel field, approval process field, and rule number from the standardized training set as student input;

[0044] S62. Use the rule hit results, risk level, anomaly explanation chain and sample weight output by the large-size cloud model as teacher supervision information;

[0045] S63. Train a local small-sized audit identification model based on rule label distillation, risk score distillation, interpretation chain distillation, and sample weight distillation;

[0046] S64. When the rule hit accuracy, risk level consistency rate, and explanation chain integrity rate in the validation set reach the preset conditions, the trained local small-size audit identification model is obtained.

[0047] Optionally, S63 includes the following steps:

[0048] S631. Encode student input as coordinates of monetary relationship, time relationship, location relationship, invoice relationship, personnel relationship, approval process relationship, and rule path relationship.

[0049] S632. Encode the rule number, rule category, trigger field, threshold condition, risk level, complementary relationship, upgrade relationship, co-occurrence relationship and rule hit count corresponding to the target rule into a rule condition vector;

[0050] S633. Input the coordinates of monetary relationship, time relationship, location relationship, invoice relationship, personnel relationship, approval process relationship, and rule path relationship into the coordinate relationship encoding layer to obtain seven types of relationship branch embeddings, and inject the rule condition vector into the seven types of relationship branch embeddings to obtain the rule fusion relationship embedding;

[0051] S634. Calculate distillation loss based on rule fusion relationship embedding and teacher supervision information, and construct rule path constraint loss based on complementary relationship, upgrading relationship and co-occurrence relationship;

[0052] S635. Update the local small-size audit identification model based on distillation loss and rule path constraint loss;

[0053] S636. Based on historical normal audit data, calculate the mean, standard deviation, maximum value and quantile threshold of the deviation scores corresponding to the seven types of audit relationship coordinates to obtain the normal deviation benchmark.

[0054] Optionally, step S7 includes the following steps:

[0055] S71. Read the expense reimbursement data, invoice data, travel data, accommodation data, transportation data, approval process data, and basic employee data to be audited in the customer's local environment;

[0056] S72. Input the data to be audited into the trained local small-size audit recognition model to obtain anomaly labels, risk scores, hit rules and anomaly interpretation chains;

[0057] S73. Perform consistency verification between the abnormal labels and the real-time detection results of the customer's local rule engine;

[0058] S74. Output the anomaly identification result when the anomaly label matches the real-time detection result;

[0059] S75. When the anomaly label is inconsistent with the real-time detection result, output the verification identifier and conflict rule number.

[0060] Optionally, step S8 includes the following steps:

[0061] S81. Receive new audit rules and parse them into a structured description of the new rules;

[0062] S82. Generate a sample constraint template for auditing new rules based on the structured description of the new rules;

[0063] S83. Generate new rule training samples through a large-size model in the cloud, and replay and detect the new rule training samples through the rule engine;

[0064] S84. Update the GRPO reward signal based on the replay detection results of the newly added rule training samples, and select high-reward newly added rule training samples;

[0065] S85. Extract existing rule-preserving samples from existing rule training samples;

[0066] S86. Input the training samples of the newly added high-reward rules and the existing rule-maintained samples into the local small-size audit recognition model for incremental distillation training, so that the local small-size audit recognition model can obtain the anomaly recognition capability corresponding to the newly added audit rules.

[0067] Optionally, S85 includes the following steps:

[0068] S851. Read related rule samples from existing rule training samples that have complementary, upgrading, or co-occurrence relationships with the newly added audit rules;

[0069] S852. Read high-risk rule samples with a risk level higher than the preset risk level from the existing rule training samples;

[0070] S853. Read easily confused rule samples with a historical false alarm count higher than the preset false alarm count from the existing rule training samples;

[0071] S854. Combine the association rule samples, high-risk rule samples, and easily confused rule samples into existing rule preservation samples;

[0072] S855. Use existing rule-preserving samples for incremental distillation training to maintain the local small-size audit recognition model's ability to recognize existing audit rules.

[0073] The beneficial effects of this invention are: by using structured description of rules and audit sample constraint templates, this invention transforms audit rules from traditional detection conditions into training data generation constraints, so that large-scale cloud models no longer rely on manual generation of audit samples, but instead generate normal samples, abnormal samples, boundary samples, and combined abnormal samples around invoice type, trigger field, threshold condition, risk level, complementary relationship, escalation relationship, and interpretation field, thereby improving the consistency between training samples and real audit rules.

[0074] This invention uses a rule engine to replay and test audit training samples generated by large-scale models in the cloud. It can determine whether the generated samples hit the target rule, whether they mishit non-target rules, whether the risk levels are consistent, whether the interpretation chain is complete, and whether there are rule conflicts. This ensures that the generated samples are verified by the rule system before entering model training, reducing the impact of invalid samples, mislabeled samples, and samples with missing interpretations on model training.

[0075] This invention maps the replay detection results of the rule engine into GRPO reward signals. It optimizes the sample generation strategy of large-scale cloud models by using rule hit rewards, risk level consistency rewards, explanation chain rewards, sample coverage rewards, and conflict penalties. This enables large-scale cloud models to gradually become sensitive to audit rules and generate training samples that are more in line with audit rules and cover boundary scenarios and combined anomaly scenarios.

[0076] This invention distills the rule-hitting results, risk levels, anomaly explanation chains, and sample weights output from a large-scale cloud model into a local small-scale audit identification model. This enables customers to complete anomaly identification of expense reimbursement data, invoice data, and approval data in a local environment, avoiding the uploading of real and sensitive financial data to the cloud, reducing data security risks, and improving the availability of the model in customer private deployment scenarios.

[0077] In a preferred embodiment, this invention employs an improved GEOM audit anomaly identification model with rule-based condition injection. This model encodes monetary relationships, time relationships, location relationships, document relationships, personnel relationships, approval process relationships, and rule path relationships into seven types of audit relationship coordinates. It also encodes rule numbers, trigger fields, threshold conditions, risk levels, complementary relationships, escalation relationships, and co-occurrence relationships into rule condition vectors. This enables the local model to simultaneously learn audit business field relationships and rule path relationships, thereby improving its ability to identify latent anomalies, combined anomalies, and rule escalation anomalies.

[0078] This invention constructs a normal deviation benchmark for seven types of audit relationship coordinates based on historical normal audit data. When identifying audit data, it can compare the deviation score output by the model with the normal deviation benchmark to obtain anomaly labels, risk scores, hit rules, and anomaly explanation chains. This makes the anomaly identification results not only include classification conclusions, but also provide rule basis and anomaly reasons for auditors to review.

[0079] When adding new audit rules, this invention does not require the collection of a large number of real abnormal samples or the full retraining of the local model. Instead, it generates incremental sample constraint templates based on the new rules, generates training samples for the new rules from a large-scale model in the cloud, and selects high-reward samples after rule engine replay detection and GRPO reward update. These samples are then used together with existing rule samples for incremental distillation training, enabling the local model to acquire the ability to recognize new rules while maintaining its ability to recognize existing rules.

[0080] This invention enables the formation of a rule lifecycle-driven self-evolution mechanism for audit models, achieving linkage between rule configuration, sample generation, rule replay, reward optimization, model distillation, local identification, and incremental updates of new rules. This improves the training efficiency of audit models, reduces reliance on real data, enhances rule expansion capabilities and local deployment capabilities, and is applicable to scenarios such as travel expense reimbursement, financial invoices, expense approval, corporate compliance audits, and internal risk control audits. Attached Figure Description

[0081] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0082] Figure 1 This is an overall flowchart of an audit model training and anomaly identification method based on rule feedback proposed in this invention;

[0083] Figure 2 This is a flowchart of the rule engine replay verification and GRPO reward signal construction process in this invention;

[0084] Figure 3 This is a flowchart of the local model distillation, dual-path verification and identification, and incremental update of new rules in this invention. Detailed Implementation

[0085] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0086] refer to Figures 1-3 A method for training and identifying anomalies in an audit model based on rule feedback includes the following steps:

[0087] S1. Generate a structured description of the rules based on the activated audit rules, the invoice type system, and the rule relationship data, and generate an audit sample constraint template based on the structured description of the rules;

[0088] S2. Input the audit sample constraint template into the large-size model in the cloud to generate audit training samples and anomaly interpretation chains;

[0089] S3. The audit training samples are replayed and tested using the rule engine to obtain the replay verification results;

[0090] S4. Construct the GRPO reward signal based on the playback verification results;

[0091] S5. Optimize the audit sample generation strategy for large-size cloud models based on GRPO reward signals, and generate a standardized training set;

[0092] S6. Distill the local small-size audit identification model based on the standardized training set to obtain the trained local small-size audit identification model.

[0093] S7. Deploy the trained local small-size audit identification model on the customer's local machine to identify anomalies in the audit data;

[0094] S8. When a new audit rule is added, incremental sample generation, rule replay detection, reward update and incremental distillation are triggered based on the new audit rule, so that the local small-size audit recognition model can obtain the ability to recognize the new rule.

[0095] In this embodiment, rule feedback refers to replaying and detecting the audit training samples generated by the large-scale model in the cloud through the rule engine, and converting the rule hit results, risk level results, explanation chain integrity results and rule conflict results obtained from the replay detection into GRPO reward signals, which are used to reverse optimize the audit sample generation strategy of the large-scale model in the cloud.

[0096] In this embodiment, self-supervised learning refers to the system not relying on a large number of real abnormal audit samples labeled by humans, but automatically generating audit training samples based on activated audit rules, invoice type system and rule relationship data, and automatically forming rule hit labels, risk level labels, abnormal interpretation chain labels and sample weights through the rule engine replaying the detection results, which serve as training supervision signals for the local small-scale audit identification model.

[0097] In this implementation, the rule hit label, risk level label, anomaly explanation chain label, and sample weight are all automatically generated by the rule engine replay detection and GRPO reward mapping, eliminating the need for manual anomaly labeling of each audit training sample.

[0098] In this implementation, the large-scale cloud model is used for rule understanding, audit sample generation, anomaly explanation chain generation, and sample generation strategy optimization.

[0099] In this embodiment, the local small-size audit identification model is used for local anomaly identification, risk scoring, and anomaly explanation chain output.

[0100] In this implementation, the large-size cloud model does not receive the customer's real sensitive audit data, while the small-size local audit identification model receives the customer's real audit data and runs it locally on the customer's machine.

[0101] In this embodiment, S1 generates a structured description of rules based on activated audit rules, the invoice type system, and rule relationship data, and generates an audit sample constraint template based on the structured description of rules, specifically including:

[0102] Retrieve active audit rule data from the rule management module and generate a set of active audit rules;

[0103] The activated audit rule set includes at least the following: travel time conflict rules, excessive expense rules, holiday travel rules, cross-city abnormality rules, duplicate reimbursement rules, invoice header abnormality rules, invoice amount inconsistency rules, accommodation location abnormality rules, transportation location abnormality rules, approval process abnormality rules, and supplier abnormality rules.

[0104] Obtain data on the bill type system and generate a set of bill types;

[0105] The set of invoice types includes at least VAT special invoices, VAT general invoices, electronic invoices, air tickets, train tickets, taxi receipts, ride-hailing tickets, accommodation receipts, catering receipts, office supplies receipts, service fee receipts, and other expense receipts;

[0106] Perform field structure parsing on the set of invoice types to generate a set of invoice field structures;

[0107] The invoice field structure set includes at least the following: invoice type identifier, invoice number field, amount field, time field, location field, personnel field, supplier field, invoice subject field, and invoice status field;

[0108] Obtain rule relationship data and generate a rule relationship set;

[0109] The set of rule relationships includes at least complementary relationships, escalation relationships, co-occurrence relationships, and conflict relationships;

[0110] Complementary relationships are used to indicate that when two or more rules are both hit, they can explain the same abnormal fact from different field dimensions;

[0111] An escalation relationship indicates that when one rule and another rule both hit, the risk level increases.

[0112] Co-occurrence relationships are used to indicate that multiple rules frequently co-occur in historical detection logs or business scenarios;

[0113] Conflict relationships are used to indicate that when multiple rules are hit simultaneously in the same sample, they may lead to label conflicts, field conflicts, or interpretation conflicts.

[0114] Perform rule field extraction processing on each audit rule in the set of activated audit rules to generate a set of basic rule fields;

[0115] The basic set of rule fields should include at least the rule number, rule name, rule category, applicable bill type, trigger field, judgment condition, threshold condition, risk level, rule description, and rule status.

[0116] Perform rule classification mapping processing on the set of basic rule fields to generate rule classification identifiers;

[0117] The rule classification identifiers should include at least the identifiers for abnormal amounts, abnormal times, abnormal locations, abnormal invoices, abnormal personnel behavior, abnormal approval processes, and abnormal rule paths.

[0118] Perform field association processing on the applicable bill types, associating the applicable bill types with the bill field structure set to generate rule field association results;

[0119] Perform field source annotation processing on the trigger field to generate a trigger field source identifier;

[0120] The trigger field source identifier should include at least the internal expense reimbursement field, the invoice upload field, the approval process field, the historical statistics field, and the external verification field;

[0121] Based on the rule relationship set, the complementary rule number, upgrade rule number, co-occurrence rule number and conflict rule number are written into the rule index of the corresponding audit rule;

[0122] A structured description of a rule is generated based on the rule number, rule category, applicable bill type, trigger field, judgment condition, threshold condition, risk level, rule field association results, and rule relationship set.

[0123] The structured description of a rule should include at least the rule number, rule name, rule category, applicable bill type, trigger field, judgment condition, threshold condition, risk level, complementary rule number, escalation rule number, co-occurrence rule number, conflicting rule number, and rule description.

[0124] For example, for the rule about excessively high accommodation costs, the structured description of the rule includes rule number R001, rule classification as abnormal amount, applicable invoice type as accommodation invoice, trigger fields as accommodation amount and city standard amount, judgment condition as accommodation amount is greater than city standard amount, risk level as medium risk, upgrade rule as cross-city abnormal rule, and complementary rule as accommodation location abnormal rule.

[0125] For example, for the rule on abnormal invoice time, the structured description of the rule includes rule number R002, rule classification as abnormal time, applicable invoice types as accommodation invoices and transportation invoices, triggering fields as invoice issuance time, business trip start time, reimbursement submission time and approval time, judgment condition as invoice issuance time being later than reimbursement submission time or earlier than business trip start time, risk level as medium risk, and complementary rule as approval process abnormal rule.

[0126] For example, for cross-city anomaly rules, the structured description of the rule includes rule number R003, rule classification as location anomaly, applicable ticket types as transportation tickets, accommodation tickets and catering tickets, trigger fields as departure location, arrival location, accommodation location, consumption location and invoice issuance location, judgment condition as inconsistent location links within the same business trip period, risk level as medium risk, and upgrade rule as high cost rule.

[0127] After generating the rule structure description, the system further generates an audit sample constraint template based on the rule structure description.

[0128] The specific components of generating the audit sample constraint template include:

[0129] Read the rule number, rule category, applicable bill type, trigger field, judgment condition, threshold condition, risk level, complementary relationship, escalation relationship, co-occurrence relationship and conflict relationship from the rule structure description, and generate a sample constraint input set;

[0130] Generate normal sample constraints based on threshold conditions in the sample constraint input set;

[0131] Normal sample constraints are used to limit the generation of audit samples from large-size cloud models to avoid triggering target rules;

[0132] Generate abnormal sample constraints based on threshold conditions in the sample constraint input set;

[0133] Anomaly sample constraints are used to limit the generation of audit samples with clearly defined triggering target rules in large-size cloud models;

[0134] Boundary sample constraints are generated based on the value range of 1% to 10% above and below the threshold condition.

[0135] Boundary sample constraints are used to limit the generation of audit samples that are close to the rule judgment boundaries of large-size models in the cloud;

[0136] Constraints for combined anomaly samples are generated based on complementary rule numbers, upgrade rule numbers, and co-occurrence rule numbers;

[0137] Combined anomaly sample constraints are used to limit the generation of composite anomaly samples that trigger multiple related rules simultaneously in large-scale cloud models;

[0138] Generate non-conflict constraints based on conflict rule numbers;

[0139] The conflict prohibition constraint is used to restrict large-size cloud models from generating audit samples where the labels, fields, rule hit results, or exception interpretation chains are contradictory.

[0140] Generate an explanation chain constraint based on the trigger field, target rule number, risk level, and anomaly cause;

[0141] The explanation chain constraint is used to require that the explanation chain of anomalies generated by large-scale models in the cloud must include at least the anomaly field, triggering condition, hit rule, risk level, anomaly cause, and review suggestion;

[0142] Normal sample constraints, abnormal sample constraints, boundary sample constraints, combined abnormal sample constraints, prohibited conflict constraints, and interpretation chain constraints are combined in a templated manner according to rule numbers to generate audit sample constraint templates.

[0143] For example, when the accommodation fee threshold is 500 yuan, the normal sample constraint includes accommodation fees less than or equal to 500 yuan, the abnormal sample constraint includes accommodation fees greater than 500 yuan, and the boundary sample constraint includes accommodation fees in the range of 450 yuan to 550 yuan.

[0144] For example, when the invoice time exception rule requires that the invoice issuance time must not be later than the reimbursement submission time, the normal sample constraint includes the invoice issuance time being earlier than or equal to the reimbursement submission time, the exception sample constraint includes the invoice issuance time being later than the reimbursement submission time, and the boundary sample constraint includes the invoice issuance time being within 1 hour to 24 hours before or after the reimbursement submission time.

[0145] For example, when there is an escalation relationship between the high accommodation cost rule and the cross-city anomaly rule, the combined anomaly sample constraints include accommodation costs exceeding the city's accommodation standard, and the accommodation location being inconsistent with the travel destination. The risk level corresponding to this combined anomaly sample is set to high risk.

[0146] For example, when the duplicate reimbursement rule and the inconsistency in invoice amount rule co-occur, the combined abnormal sample constraints include the same invoice number appearing in multiple reimbursement records, and the difference between the invoice amount and the reimbursement amount exceeding the preset error.

[0147] In this implementation, the audit sample constraint template is not a simple prompt word, but a structured constraint data that includes rule number, invoice type, field constraints, numerical range, time range, location relationship, rule relationship, risk level, and interpretation chain requirements.

[0148] In this embodiment, the audit sample constraint template is the direct input for generating audit training samples by the large-scale cloud model. Without this audit sample constraint template, the large-scale cloud model cannot generate audit training samples that can be replayed and detected according to the requirements of target rules, boundary conditions, combined anomaly relationships and interpretation chains.

[0149] In this implementation, the structured description of rules and the constraint template of audit samples together define the field range, rule triggering conditions, boundary value range, combined anomaly relationship and interpretation chain structure of audit training samples, so that the sample generation process of large-size models in the cloud is subject to the closed-loop constraint of rule feedback.

[0150] Through S1, the system transforms activated audit rules, invoice type system, and rule relationship data into structured rule descriptions, and further into audit sample constraint templates that can be executed by large-scale cloud models, providing a constraint basis for the generation of subsequent audit training samples.

[0151] In this embodiment, S2 inputs the audit sample constraint template into the large-size model in the cloud to generate audit training samples and anomaly interpretation chains, specifically including:

[0152] Obtain the audit sample constraint template, and read the normal sample constraints, abnormal sample constraints, boundary sample constraints, combined abnormal sample constraints, prohibited conflict constraints, and interpretation chain constraints from the audit sample constraint template to generate a large model sample generation input set;

[0153] Large-scale model prompt information is constructed in the cloud based on the input set generated from large model samples.

[0154] The prompts for building a large-scale cloud model include: writing the rule number into the rule identifier area, writing the applicable invoice type into the invoice type area, writing the trigger field into the field constraint area, writing the threshold condition into the rule judgment area, writing the combined abnormal sample constraint into the rule relationship area, and writing the explanation chain constraint into the explanation output area.

[0155] Input the prompt information of the large-size cloud model into the large-size cloud model, and obtain the output text of the model;

[0156] The model output text should include at least normal audit samples, abnormal audit samples, boundary audit samples, combined abnormal audit samples, and an abnormal interpretation chain;

[0157] The model output text is processed using structured parsing to extract sample number, invoice type, invoice field, amount field, time field, location field, personnel field, approval process field, target rule number, sample type, expected risk level, and anomaly explanation chain, generating a candidate audit training sample set.

[0158] Perform field integrity verification on the candidate audit training sample set. The field integrity verification process includes verifying whether each candidate audit training sample contains the trigger field, invoice type field, rule number field, and interpretation chain field required by the target rule.

[0159] Perform conflict prevention validation on the candidate audit training sample set. Conflict prevention validation includes checking whether normal samples contain abnormal trigger fields, whether abnormal samples are missing target rule trigger fields, and whether combined abnormal samples are missing relevant rule trigger fields.

[0160] When the field integrity check and conflict prevention check pass, the candidate audit training sample is determined as the audit training sample;

[0161] The abnormal fields, triggering conditions, target rule numbers, risk levels, abnormal causes, and review suggestions corresponding to each audit training sample are combined to generate an abnormal explanation chain;

[0162] The audit training samples and the anomaly interpretation chain are associated and stored to generate an audit training sample set.

[0163] In this embodiment, the large-scale cloud model can be a large language model with the capabilities of rule understanding, structured data generation, tabular data generation, and interpreted text generation.

[0164] In this implementation, the large-scale cloud model does not receive real sensitive audit data from customers, but instead generates simulated audit training samples based on the structured description of rules and the audit sample constraint template.

[0165] In this implementation, the identity definition of the large-scale cloud model can be set as a professional billing and auditing expert.

[0166] In this implementation, the fixed instructions include: generating samples strictly in accordance with the audit rules, not generating fields that conflict with the rule labels, the exception explanation must include the rule number and the trigger field, the boundary samples must be located near the threshold, and the combined exception samples must reflect the complementary or escalation relationship between the rules.

[0167] In one specific implementation, the system generates 100 training samples and 20 verification samples based on the activated audit rules.

[0168] The training samples are used to distill and train a local small-size audit recognition model.

[0169] The validation samples are used to verify the rule hit accuracy, risk level consistency, and explanation chain completeness of the local small-size audit identification model.

[0170] For example, the cloud-based large-scale model generates an abnormal sample for the rule of excessively high accommodation costs. This sample includes the employee number, department, city of business trip, accommodation location, accommodation amount, ticket type, invoice amount, approval time, and reimbursement submission time.

[0171] When the accommodation amount exceeds the standard for the corresponding city and the invoice date matches the business trip date, the anomaly explanation chain can be generated as follows: the accommodation amount exceeds the city's accommodation standard, which hits the rule of high accommodation cost, and the risk level is medium risk. It is recommended to check the accommodation invoice and business trip approval form.

[0172] For example, the cloud-based large-scale model generates a combined anomaly sample for the rules of excessively high accommodation costs and cross-city anomalies. This sample includes accommodation costs exceeding the city standard, while the accommodation location is inconsistent with the travel destination.

[0173] The anomaly interpretation chain for this combination of abnormal samples can be generated as follows: the accommodation cost exceeds the city's accommodation standard and the accommodation location is inconsistent with the travel destination, hitting the rules of excessively high accommodation costs and cross-city anomalies, triggering the rule escalation relationship, and the risk level is high risk.

[0174] Through S2, the system obtains audit training samples and anomaly explanation chains generated from large-scale models in the cloud.

[0175] In this embodiment, S3 performs replay testing on the audit training samples using a rule engine, and the replay verification results specifically include:

[0176] Obtain the audit training sample set, and read the invoice type, trigger field, target rule number, sample type, expected risk level and anomaly interpretation chain from the audit training sample set to generate the replay detection input set;

[0177] Based on the target rule number, the corresponding audit rule in the rule engine is invoked to generate a rule replay task;

[0178] Perform rule hit detection processing on the rule replay task;

[0179] The rule hit detection process includes detecting whether the audit training sample hits the target rule according to the trigger field, judgment condition and threshold condition of the target rule, and generating rule hit results;

[0180] Perform non-target rule detection processing on the audit training samples, determine whether the audit training samples have falsely hit non-target rules, and generate false hit results;

[0181] Perform multi-rule common hit detection processing on the audit training sample to determine whether the audit training sample simultaneously hits complementary rules, upgrade rules or co-occurrence rules, and generate multi-rule common hit results;

[0182] Generate the target rule replay result based on the rule hit result, false hit result, and multiple rule joint hit result;

[0183] Risk scores and anomaly levels are generated based on the replay results of the target rules and the expected risk levels.

[0184] The risk score ranges from 0 to 100, with 0 to 30 being normal, 31 to 50 being low risk, 51 to 75 being medium risk, and 76 to 100 being high risk.

[0185] When a sample hits the upgrade rule path, 10 to 20 points are added to the original risk score;

[0186] The completeness of the explanation is generated based on the exception fields, rule numbers, triggering conditions, risk levels, and exception causes in the exception explanation chain;

[0187] When the exception explanation chain contains exception fields, rule number, triggering condition, risk level and exception cause, the explanation completeness is determined to be complete;

[0188] When the exception interpretation chain is missing a rule number, trigger condition, or exception field, the interpretation completeness is determined to be incomplete.

[0189] Generate rule conflict results based on the rule relationship set;

[0190] Rule conflict results include at least label conflicts, interpretation conflicts, field conflicts, and no conflicts;

[0191] When the sample label is inconsistent with the rule replay detection result, the rule conflict result is a label conflict;

[0192] When the rules described by the sample interpretation chain are inconsistent with the actual hit rules, the rule conflict result is an interpretation conflict.

[0193] When a sample field simultaneously satisfies two conflicting rule conditions, the result of the rule conflict is a field conflict.

[0194] When a sample conforms to the target rule and there is no conflicting relationship, the rule conflict result is no conflict;

[0195] The rule hit results, risk scores, anomaly levels, explanation completeness, and rule conflict results are summarized to generate replay verification results.

[0196] In one optional implementation, when the audit training sample or the data to be audited involves ticket types that require third-party verification, such as air tickets, train tickets, taxi receipts, accommodation receipts, or electronic invoices, the rule engine calls the corresponding external data source through the MCP service interface to obtain the actual flight departure time, actual flight arrival time, train arrival time, train departure time, taxi pick-up time, taxi drop-off time, hotel check-in time, hotel check-out time, invoice authenticity status, and location accessibility results, and uses the external verification results as auxiliary input for rule replay detection.

[0197] For example, when an employee submits reimbursements for both airfare and train tickets, the rules engine obtains the actual flight time and train arrival / departure times through the MCP service interface. If the flight time and train travel time overlap, a time-space conflict verification result for the transportation tickets is generated.

[0198] For example, when an employee submits a claim for a taxi fare to their destination after a flight delay, the rules engine obtains the actual arrival time of the flight and the pick-up time of the taxi through the MCP service interface. If the pick-up time of the taxi is earlier than the actual arrival time of the flight, an abnormal verification result for the destination consumption time is generated.

[0199] The aforementioned MCP service interface is only used to provide third-party authenticity verification data. The rule structure description, audit sample constraint template, rule replay detection, GRPO reward signal construction, standardized training set generation, and local small-size audit recognition model distillation training are still executed according to the main process of this invention.

[0200] In this implementation, the external verification field is only used as a source identifier for the field in the rule structured description. The external verification of the actual data to be audited is performed in the customer's local deployment environment or in the rule replay environment after anonymization.

[0201] Through S3, the system can use the rule engine to replay and detect audit training samples generated by large-scale models in the cloud, avoiding the direct use of samples with inconsistent rules, incorrect labels, incorrect risk levels, or incomplete interpretation chains for local model training.

[0202] In this embodiment, S4 constructs the GRPO reward signal based on the playback verification result, specifically including:

[0203] Obtain the replay verification results, and read the rule hit results, risk scores, anomaly levels, explanation completeness, and rule conflict results from the replay verification results to generate the reward construction input set;

[0204] Multiple audit training samples corresponding to the same rule structure description are divided into the same candidate sample group;

[0205] For each audit training sample in the candidate sample group, perform rule hit reward calculation and generate rule hit reward;

[0206] When the audit training sample hits the target rule and does not mistakenly hit a non-target rule, the rule hit reward is the first reward value.

[0207] When the audit training sample does not match the target rule, the rule match reward will be the second reward value.

[0208] When an audit training sample mis-hit a non-target rule, the reward for hitting the rule is reduced to a penalty value.

[0209] For each audit training sample in the candidate sample group, perform risk level consistency reward calculation and generate risk level consistency reward;

[0210] When the anomaly level is consistent with the expected risk level in the audit sample constraint template, the risk level consistency reward is the first reward value.

[0211] When the anomaly level is adjacent to the expected risk level, the risk level consistency reward takes the second reward value;

[0212] When the anomaly level conflicts with the expected risk level, the risk level consistency reward takes the penalty value.

[0213] For each audit training sample in the candidate sample group, perform the interpretation chain reward calculation process to generate the interpretation chain reward;

[0214] When the completeness of the explanation is greater than or equal to 0.85, the higher reward value is used for the explanation chain reward.

[0215] When the completeness of explanation is greater than or equal to 0.60 and less than 0.85, the explanation chain reward is a medium reward value;

[0216] When the completeness of the explanation is less than 0.60, the explanation chain reward takes the lower reward value;

[0217] Perform sample coverage reward calculation on the candidate sample group;

[0218] The sample coverage reward calculation process includes determining whether a candidate sample group simultaneously contains normal audit samples, abnormal audit samples, boundary audit samples, and combined abnormal audit samples.

[0219] When a candidate sample group covers all of the above sample types, a high sample coverage reward is generated.

[0220] Reduce the sample coverage bonus when a candidate sample group lacks boundary audit samples or combines abnormal audit samples.

[0221] Perform conflict penalty calculation processing on each audit training sample in the candidate sample group to generate a conflict penalty;

[0222] No conflict penalty is incurred when the result of a rule conflict is no conflict.

[0223] When the rule conflict result is a label conflict, interpretation conflict, or field conflict, a conflict penalty is generated.

[0224] The reward weight set is determined based on the rule risk level, rule stability, and rule hit frequency;

[0225] When the target rule is a high-risk rule, the rule hit reward weight is set to 0.35, the risk level consistency reward weight is set to 0.25, the interpretation chain reward weight is set to 0.15, the sample coverage reward weight is set to 0.15, and the conflict penalty weight is set to 0.10.

[0226] When the target rule is a normal low-risk rule, the rule hit reward weight is set to 0.25, the risk level consistency reward weight is set to 0.20, the interpretation chain reward weight is set to 0.20, the sample coverage reward weight is set to 0.20, and the conflict penalty weight is set to 0.15.

[0227] Based on the reward weight set, a weighted mapping is performed on the rule hit reward, risk level consistency reward, interpretation chain reward, sample coverage reward and conflict penalty to generate a comprehensive reward value for each audit training sample;

[0228] The relative reward within the candidate sample group is calculated based on the comprehensive reward value of each audit training sample within the group, and a GRPO reward signal is generated.

[0229] In this implementation, multiple candidate samples corresponding to the same rule structure description are treated as the same reward group. The system does not evaluate a single sample individually, but compares the relative merits of samples in the same group, so that the large-scale cloud model gradually tends to generate audit training samples that are accurate in their hits, complete in their explanations, have sufficient boundary coverage, and have fewer rule conflicts.

[0230] In this implementation, the intra-group relative reward is used to compare the quality differences of different candidate samples under the same rule constraint, rather than directly updating the sample generation strategy with the absolute score of a single sample.

[0231] When the replay verification result includes external verification results returned by the MCP service interface, the system will use the external verification results as an auxiliary verification item for authenticity in the construction of the GRPO reward signal.

[0232] When the external verification results are consistent with the expected anomaly type of the sample, the overall reward value of the sample is increased.

[0233] When the external verification results are inconsistent with the expected anomaly type of the sample, the overall reward value of the sample is reduced.

[0234] Through S4, the system transforms the rule engine replay detection results into GRPO reward signals that can be used to optimize large-scale cloud models, enabling large-scale cloud models to gradually develop sensitivity to audit rules, risk levels, and anomaly interpretation chains during multiple rounds of generation.

[0235] In this embodiment, S5 optimizes the audit sample generation strategy for large-scale cloud models based on GRPO reward signals and generates a standardized training set, specifically including:

[0236] Obtain the GRPO reward signal, and read the candidate sample group, comprehensive reward value and relative reward within the group from the GRPO reward signal to generate the policy optimization input set;

[0237] Based on the relative reward within the group, the candidate sample groups are sorted according to their sample quality, and the sample quality ranking results are generated.

[0238] Determine the high-reward sample set and the low-reward sample set based on the sample quality ranking results;

[0239] Increase the sampling probability of the generated path corresponding to the high-reward sample set;

[0240] Reduce the sampling probability of the generated path corresponding to the low-reward sample set;

[0241] Generate an updated cloud-based large-size model sample generation strategy;

[0242] Based on the updated cloud-based large-size model sample generation strategy, the audit sample generation process is re-executed to generate a new set of candidate audit training samples.

[0243] Perform rule replay testing on the new round of candidate audit training sample set to generate a new round of replay verification results;

[0244] The GRPO reward signal is reconstructed based on the new round of replay verification results, and a new round of GRPO reward signal is generated.

[0245] Repeat the sample generation, rule replay detection, reward construction and strategy optimization process until the average reward of the candidate sample group reaches the preset reward threshold.

[0246] The preset reward threshold is set to 0.80;

[0247] When the average reward of the candidate sample group is greater than or equal to the preset reward threshold, the high reward sample in the candidate sample group is determined as a sample that can be included in the database.

[0248] Standardization processing is performed on samples that can be included in the database;

[0249] Standardization processes include uniformity of fields, bill types, risk levels, rule hit results, anomaly explanation chains, and sample weights.

[0250] Write the standardized samples into the standardized training set;

[0251] Each sample in the standardized training set includes at least the sample number, invoice field, amount field, time field, location field, personnel field, approval process field, target rule number, rule hit result, risk level, anomaly explanation chain, and sample weight.

[0252] Sample weights are determined based on the overall reward value;

[0253] High-reward samples correspond to higher sample weights;

[0254] Low-reward samples correspond to lower sample weights;

[0255] Generate training set files and validation set files based on the standardized training set;

[0256] The training set file is used to train a local small-size audit identification model;

[0257] The validation set file is used to validate the rule hit accuracy, risk level consistency, and explanation chain completeness of the local small-size audit identification model.

[0258] In this embodiment, the strategy for generating audit samples for large-scale cloud models includes at least one of updating prompt templates, adjusting candidate sample sampling probabilities, adjusting sample type ratios, and updating rule constraint weights.

[0259] In this embodiment, the optimization of the audit sample generation strategy for large cloud models is not limited to fine-tuning the parameters of large cloud models. It can also be achieved by updating the generation prompts, reordering candidate paths, adjusting the sample type ratio, and updating the rule constraint weights.

[0260] Through S5, the system obtains a standardized training set formed by rule structure description, cloud-based large-size model generation, rule engine replay detection, and GRPO reward screening.

[0261] This standardized training set can reflect the triggering conditions, boundary conditions, combined anomaly relationships, and risk level differences of different audit rules, providing a data foundation for the subsequent distillation training of local small-scale audit identification models.

[0262] In this embodiment, S6 performs distillation training on the local small-size audit identification model based on the standardized training set, and the trained local small-size audit identification model specifically includes:

[0263] Obtain a standardized training set, and read the invoice field, amount field, time field, location field, personnel field, approval process field, rule number, rule hit result, risk level, anomaly explanation chain and sample weight from the standardized training set to generate a distillation training input set;

[0264] The fields for invoice, amount, time, location, personnel, approval process, and rule number are designated as student input.

[0265] The rule hit results, risk level, anomaly explanation chain, and sample weights output by the large-scale cloud model are used as teacher supervision information.

[0266] A distillation training sample set is constructed based on student input and teacher supervision information;

[0267] Perform rule-labeled distillation on the distillation training sample set to generate a rule-labeled distillation loss.

[0268] Rule label distillation is used to enable the local small-scale audit identification model to learn the anomaly labels corresponding to the audit rules;

[0269] Perform risk fractional distillation on the distillation training sample set to generate risk fractional distillation loss;

[0270] Risk score distillation is used to enable local small-scale audit identification models to learn the risk level and risk score corresponding to various abnormal samples;

[0271] Perform interpretation chain distillation on the distillation training sample set to generate interpretation chain distillation loss;

[0272] Explanation chain distillation is used to enable local small-scale audit identification models to learn the correspondence between anomaly fields, hit rules, and anomaly causes;

[0273] Perform sample weight distillation on the distillation training sample set to generate sample weight distillation loss;

[0274] Sample weight distillation is used to enable the local small-size audit identification model to assign higher training weights to high-reward samples, boundary samples, and combined anomaly samples.

[0275] The rule label distillation loss, risk score distillation loss, interpretation chain distillation loss, and sample weight distillation loss are weighted and fused to generate a comprehensive distillation loss.

[0276] The model parameters of the local small-size audit identification model are updated based on the comprehensive distillation loss, resulting in the trained local small-size audit identification model.

[0277] In a preferred embodiment, the local small-size audit identification model adopts an improved GEOM audit anomaly identification model with rule-based condition injection.

[0278] The local small-size audit identification model is preferably an improved GEOM model with rule-condition injection, or it can be a lightweight neural network model with multi-field encoding, rule-condition fusion and risk classification output capabilities.

[0279] The improved GEOM audit anomaly identification model with rule condition injection maps audit business fields and rule conditions to audit relationship coordinates simultaneously, and identifies anomalies based on rule path constraints and normal deviation benchmarks.

[0280] Specifically, student input is encoded as coordinates for monetary relationships, time relationships, location relationships, invoice relationships, personnel relationships, approval process relationships, and rule path relationships.

[0281] The amount relationship coordinates are generated from the reimbursement amount, invoice amount, budget amount, historical average amount of the same department, historical average amount of the same position, and the amount range of expense type;

[0282] The time relationship coordinates are generated from the start time of the business trip, the end time of the business trip, the time of invoice issuance, the time of expense reimbursement submission, the time of approval, and the time of payment;

[0283] Location relationship coordinates are generated from the departure point, arrival point, accommodation location, consumption location, invoice issuance location, and approval location;

[0284] The bill relationship coordinates are generated from the bill type, bill header, tax number, bill amount, consumption item, supplier name, and bill status;

[0285] Personnel relationship coordinates are generated from employee position, department, historical expense reimbursement frequency, historical number of abnormalities, average expense reimbursement for the same position, and average expense reimbursement for the same department;

[0286] The approval process relationship coordinates are generated by approval nodes, approvers, approval time, approval status, number of process jumps, and number of rejections and modifications;

[0287] The rule path relationship coordinates are generated by rule number, rule category, trigger field, threshold condition, risk level, complementary relationship, upgrade relationship, co-occurrence relationship, and rule hit count;

[0288] Encode the rule number, rule category, trigger field, threshold condition, risk level, complementary relationship, escalation relationship, co-occurrence relationship, and rule hit count corresponding to the target rule into a rule condition vector;

[0289] Inputting the coordinates of the seven types of audit relationships into the coordinate relationship encoding layer yields the embedding of the seven types of relationship branches.

[0290] Injecting the rule condition vector into the seven types of relation branch embeddings yields the rule-fused relation embedding;

[0291] The injection methods for rule condition vectors include concatenation injection, weight modulation injection, and attention injection;

[0292] Concatenation injection is used to directly concatenate the rule condition vector with the seven types of relation branch embeddings;

[0293] Weight modulation injection is used to adjust the weights of the seven types of relationship branches embedded according to the rule risk level, trigger field, and rule relationship;

[0294] Attention injection is used to weight the rule condition vectors with attention for the seven types of relation branch embeddings;

[0295] For example, when the target rule is that accommodation costs are too high, the model increases the weights of the monetary relationship coordinates and the location relationship coordinates;

[0296] For example, when the target rule is a ticket time anomaly rule, the model increases the weight of the time relationship coordinate and the rule path relationship coordinate;

[0297] For example, when the target rule is a cross-city anomaly rule, the model increases the weight of location relationship coordinates and approval process relationship coordinates;

[0298] The improved GEOM model with rule-condition injection does not simply encode the invoice fields uniformly, but injects the rule number, trigger field, threshold condition, risk level, and rule relationship as condition vectors into seven types of audit relationship coordinates, so that the same invoice field can form different risk representations under different rule conditions;

[0299] Distillation loss is calculated based on rule-based fusion relationship embedding and teacher supervision information;

[0300] Construct rule-based path constraint loss based on complementary, upgrading, and co-occurrence relationships;

[0301] Complementary relationships correspond to embedded convergence constraints;

[0302] When two rules are complementary, the system makes the rule paths corresponding to the two rules embed in the same abnormal scenario to be similar.

[0303] The upgrade relationship corresponds to the risk level separation constraint;

[0304] When a low-risk rule and another rule both hit and can be upgraded to high-risk, the system embeds the rule paths before and after the upgrade into the risk level to form a separable distance.

[0305] Co-occurrence relationships correspond to common hit strength constraints;

[0306] When two rules frequently overlap in historical detection logs, the system adjusts the constraint strength between the path embeddings of the two rules based on the number of overlaps.

[0307] An improved GEOM audit anomaly identification model based on distillation loss and rule path constraint loss for updating rule condition injection;

[0308] Based on historical normal audit data, the mean, standard deviation, maximum value and quantile threshold of the deviation scores corresponding to the seven types of audit relationship coordinates are calculated to obtain the normal deviation benchmark;

[0309] Normal deviation benchmarks include normal deviation benchmarks for amount, time, location, invoice, personnel, approval process, and rule path.

[0310] Model validation processing is performed on the local small-size audit identification model in training based on the validation set;

[0311] Model validation processes include rule hit accuracy validation, risk level consistency validation, and explanation chain integrity validation.

[0312] When the rule hit accuracy reaches 90% or higher, the risk level consistency rate reaches 85% or higher, and the explanation chain completeness rate reaches 85% or higher, the local small-size audit identification model in training is determined as the local small-size audit identification model after training.

[0313] Through S6, the system distills the rule sensitivity, risk level judgment ability and anomaly interpretation ability generated by the large-size model in the cloud into the local small-size audit identification model, and forms a multi-dimensional anomaly identification capability based on amount, time, location, invoice, personnel, approval process and rule path by improving the GEOM audit anomaly identification model.

[0314] In this embodiment, the trained local small-size audit identification model is deployed to the customer's local server, private deployment environment, or enterprise intranet environment;

[0315] Configure the model inference service, auditable data access service, field parsing service, and abnormal result output service in the customer's local environment;

[0316] The above-mentioned local deployment method enables customers to complete the identification and processing of their real financial data, invoice data, and approval data locally.

[0317] In this implementation, auditable data uploaded by the customer is received;

[0318] The data to be audited can be in JSON format or structured data exported from the company's expense reimbursement system, financial system, invoice system, or approval system.

[0319] Perform field parsing processing on the audit data to generate invoice fields, amount fields, time fields, location fields, personnel fields, and approval process fields;

[0320] Identify the type of invoice corresponding to the data to be audited based on the invoice field;

[0321] Based on the personnel field, identify the expense claimant, department, employee position, and approval authority corresponding to the data to be audited;

[0322] Identify reimbursement amount, invoice amount, approved amount, and payment amount based on the amount field;

[0323] Based on the time field, identify the start time of the business trip, the end time of the business trip, the time of invoice issuance, the time of expense reimbursement submission, the time of approval, and the time of payment;

[0324] Based on the location field, the system identifies the departure point, arrival point, accommodation location, consumption location, invoice issuance location, and approval location.

[0325] Based on the approval process fields, identify approval nodes, approvers, approval time, approval status, number of process jumps, and number of rejections and modifications;

[0326] The parsed audit data is input into the trained local small-size audit recognition model;

[0327] The local small-size audit identification model maps the data to be audited into coordinates of monetary relationships, time relationships, location relationships, invoice relationships, personnel relationships, approval process relationships, and rule path relationships.

[0328] The seven types of audit relationship coordinates are compared with the normal deviation benchmark to obtain the deviation scores of the seven types of relationships;

[0329] The dimension of the largest deviation relationship is determined based on the deviation scores of seven types of relationships;

[0330] A comprehensive risk score is calculated based on the hit rule number, rule risk level, rule path deviation value, and maximum deviation relationship dimension.

[0331] When the overall risk score is below 0.30, output a normal label;

[0332] When the comprehensive risk score is greater than or equal to 0.30 and less than 0.55, a low-risk anomaly label is output;

[0333] When the comprehensive risk score is greater than or equal to 0.55 and less than 0.75, output a medium-risk abnormal label;

[0334] When the comprehensive risk score is greater than or equal to 0.75, a high-risk anomaly label is output;

[0335] Generate an anomaly explanation chain based on the maximum deviation relation dimension, hit rule number, risk level, and anomaly field;

[0336] Output the anomaly detection results;

[0337] The anomaly identification results should include at least the anomaly label, comprehensive risk score, hit rule number, anomaly field, risk level, and anomaly explanation chain.

[0338] For example, when the accommodation amount in the audit data is significantly higher than the accommodation standard in the same city, and the accommodation location is inconsistent with the travel destination, the local small-size audit identification model obtains a high deviation score on the amount relationship coordinate and the location relationship coordinate, and outputs an anomaly result that is hit by both the accommodation cost high rule and the cross-city anomaly rule.

[0339] For example, when the invoice issuance time in the audit data is later than the reimbursement submission time, the local small-size audit identification model obtains a high deviation score on the time relationship coordinate and outputs an invoice time anomaly result.

[0340] In this embodiment, after the local small-size audit identification model outputs the anomaly identification result, the customer's local rule engine is called to perform real-time rule detection on the same audit data.

[0341] The real-time detection results from the local rule engine include at least the real-time hit rule number, real-time anomaly label, real-time risk level, and real-time trigger field;

[0342] The real-time hit rule number is used to indicate the audit rule that was actually hit by the local rule engine.

[0343] Real-time anomaly labels are used to indicate the anomaly types detected by the local rule engine based on rule conditions;

[0344] Real-time risk level is used to represent the risk level obtained by the local rule engine based on the rule risk level and escalation relationship;

[0345] The real-time trigger field is used to represent the field content that caused the rule to be triggered.

[0346] In this embodiment, the anomaly labels, hit rule numbers, and risk levels output by the local small-size audit identification model are checked for consistency with the real-time anomaly labels, real-time hit rule numbers, and real-time risk levels in the real-time detection results of the local rule engine.

[0347] When the anomaly label output by the local small-size audit identification model is consistent with the real-time detection result of the local rule engine, and the hit rule number belongs to the same target rule or complementary rule set, the system generates a consistency verification pass flag.

[0348] When a consistency check passes the flag, the anomaly identification result output by the local small-size audit identification model is used as the target output result.

[0349] When the anomaly label output by the local small-size audit identification model is inconsistent with the real-time detection result of the local rule engine, or when the hit rule number output by the local small-size audit identification model conflicts with the real-time hit rule number in the real-time detection result of the local rule engine, the system generates a consistency check failure result.

[0350] In this embodiment, when the anomaly identification result is inconsistent with the real-time detection result of the local rule engine, a review identifier is generated;

[0351] The review indicator is used to indicate that the data to be audited needs to enter the manual review process or the high-priority audit review process;

[0352] Read the hit rule number output by the local small-size audit recognition model and the real-time hit rule number in the real-time detection result of the local rule engine, and generate the conflict rule number;

[0353] The conflict rule number should include at least the model-hit rule number, the rule engine-hit rule number in real time, and the conflict type of the two.

[0354] Conflict types include at least the following: the model hits the rule engine but the rule engine misses the rule engine, the rule engine hits the rule engine but the model misses the rule engine, the model's risk level is higher than the rule engine's risk level, the model's risk level is lower than the rule engine's risk level, and the hit rule categories are inconsistent.

[0355] When generating a review identifier, the anomaly identification result should include at least the anomaly label, comprehensive risk score, model hit rule number, rule engine real-time hit rule number, conflict rule number, review identifier, risk level, anomaly field, and anomaly explanation chain.

[0356] For example, if the accommodation cost in the data to be audited is 520 yuan and the city accommodation standard is 500 yuan, the local small-size audit identification model outputs an abnormal label for excessively high accommodation costs and rule number R001. If the local rule engine detects in real time that the same rule number R001 is hit, the system will generate a consistency verification pass flag and output an abnormal result for excessively high accommodation costs.

[0357] For example, if the accommodation cost in the data to be audited is 498 yuan and the city accommodation standard is 500 yuan, the local small-size audit identification model outputs an abnormal label of "accommodation cost is too high" due to historical similar behavior and location deviation. However, the local rule engine does not hit the rule of "accommodation cost is too high" in real time. In this case, the system generates a review identifier and writes the rule number R001 that the model hit and the result that the rule engine did not hit into the conflict rule number field to prompt the auditor to review.

[0358] For example, if the data to be audited is identified as a low-risk anomaly by the local small-size audit identification model, but the local rule engine detects in real time that it hits both the "high accommodation cost" rule and the "cross-city anomaly" rule and forms an escalation relationship, then the system generates a review identifier, writes the rule number output by the model and the rule number hit in real time by the rule engine into the conflict rule number field, and marks the conflict type as inconsistent risk level.

[0359] In one alternative implementation, when the data to be audited involves ticket types that require third-party verification, such as airline tickets, train tickets, taxi receipts, accommodation receipts, or electronic invoices, the customer's local system can call the corresponding external data source through the MCP service interface for auxiliary verification, and use the auxiliary verification results as reference information for rule detection or anomaly interpretation chain generation.

[0360] This MCP service interface is only used as an auxiliary verification method for the authenticity of the data to be audited, and does not change the main anomaly identification process of the local small-size audit identification model.

[0361] Anomaly identification results can be written back to the customer's local audit system as a basis for manual review, rule hit statistics, false alarm statistics, and subsequent rule additions to maintain sample extraction.

[0362] With S7, the trained local small-size audit identification model can complete the anomaly identification of the audited data in the customer's local environment, and reduce the risk of false alarms or missed alarms caused by single-path detection through dual-path consistency verification between the model identification results and the real-time detection results of the local rule engine.

[0363] In this embodiment, when a new audit rule is added in step S8, incremental sample generation, rule replay detection, reward update, and incremental distillation are triggered based on the new audit rule, enabling the local small-size audit recognition model to acquire the ability to recognize the new rule. Specifically, this includes:

[0364] Receive new audit rules;

[0365] Extract the new rule number, rule name, rule category, applicable document type, trigger field, judgment condition, threshold condition, risk level, complementary relationship, escalation relationship and co-occurrence relationship from the new audit rules;

[0366] A structured description of the new rule is generated based on the new rule number, rule category, applicable bill type, trigger field, threshold condition, risk level, and rule relationship data.

[0367] Generate a sample constraint template for auditing new rules based on the structured description of the new rules;

[0368] Input the newly added rule audit sample constraint template into the large-size model in the cloud to generate new rule training samples and new rule anomaly explanation chains;

[0369] Input the newly added rule training samples into the rule engine and perform new rule replay detection;

[0370] Construct a new rule GRPO reward signal based on the detection results of new rule replay;

[0371] High-reward training samples for newly added rules are selected based on the GRPO reward signal of the newly added rules.

[0372] Extract existing rule-preserving samples from existing rule-training samples;

[0373] The existing rule retention samples include association rule samples, high-risk rule samples, and easily confused rule samples;

[0374] The association rule sample consists of existing rule samples that have a complementary, upgrading, or co-occurrence relationship with the new audit rule;

[0375] High-risk rule samples are existing rule samples with a risk level higher than the preset risk level;

[0376] The preset risk level can be set to medium risk;

[0377] The easily confused rule samples are existing rule samples whose historical false alarm count exceeds the preset false alarm count;

[0378] The preset number of false alarms can be 3.

[0379] The training samples of the newly added high-reward rules and the existing rule-maintained samples are combined into an incremental distillation training set;

[0380] Incremental distillation training is performed on the local small-size audit identification model based on the incremental distillation training set;

[0381] This enables the local small-size audit identification model to learn the anomaly identification capabilities corresponding to newly added audit rules.

[0382] At the same time, based on existing rules, the local small-size audit identification model maintains its ability to identify existing audit rules;

[0383] When the accuracy of newly added rules in the incremental verification set reaches over 90%, the accuracy of existing rules decreases by no more than 5%, and the completeness of the interpretation chain reaches over 85%, the incremental update of the local small-size audit identification model is completed.

[0384] For example, the client originally had ten audit rules, and the business department added an eleventh rule.

[0385] The system performs structured parsing on rule eleven, generating a structured description of the new rule and a sample constraint template for auditing the new rule.

[0386] The cloud-based large-size model generates normal samples, abnormal samples, boundary samples, and combined abnormal samples corresponding to rule eleven.

[0387] After replaying and testing the newly added rule training samples, the rule engine selects the new rule training samples with high rewards.

[0388] The system extracts existing rule-maintained samples from the training samples corresponding to the original ten rules, and performs incremental distillation training together with the training samples of the newly added high-reward rule corresponding to the eleventh rule.

[0389] After incremental distillation is completed, the local small-size audit identification model can identify the abnormal scenario corresponding to the eleventh rule and maintain the ability to identify the original ten rules.

[0390] With S8, the system can quickly acquire the ability to recognize new audit rules by adding new rules without relying on customers to re-collect a large number of real abnormal samples or retraining the local small-size audit recognition model. Instead, it can do so through structured description of new rules, generation of new samples, replay detection of new rules, reward updates, and incremental distillation.

[0391] Taking the rule of excessively high accommodation costs as an example, the system first generates a boundary anomaly sample with an accommodation cost of 520 yuan and a city standard of 500 yuan. After the rule engine replays the sample, it hits the target rule and has a medium risk level. The explanatory chain is complete. Based on this, the system generates a higher GRPO reward and includes the sample in the standardized training set. After the local small-size audit identification model is trained, when the customer identifies the same type of audit data locally, it outputs a medium-risk anomaly label and an explanatory chain of excessively high accommodation costs.

[0392] In this embodiment, the aforementioned preset reward threshold, accuracy threshold, risk score range, and false alarm frequency threshold can be adjusted according to the number of enterprise audit rules, historical false alarm rate, and risk management requirements.

[0393] Through the above implementation methods, the present invention forms a closed-loop process of "rule structuring - sample constraint template - cloud sample generation - rule playback feedback - GRPO reward optimization - local distillation training - local dual-path verification and recognition - incremental update of new rules".

[0394] This invention transforms audit rules from simple detection conditions into training sample generation constraints and GRPO reward sources, expands the rule engine from anomaly detection tools into sample quality replay verification tools, optimizes the large-scale cloud model from a regular sample generation model into a rule-sensitive sample generation model, and distills the rule sensitivity formed by the large-scale cloud model into the customer's local small-scale audit identification model.

[0395] This invention can generate high-quality audit training samples without disclosing real sensitive audit data, enabling local anomaly identification and rapid adaptation of new rules.

[0396] This invention can also reduce the risk of rule forgetting during incremental distillation by maintaining samples using existing rules, enabling the local small-size audit identification model to maintain stable identification capabilities in business environments where rules are constantly changing.

[0397] Example 1: To verify the feasibility of this invention in practice, it was applied to a scenario involving compliance auditing of financial documents and travel expense reimbursements. In this scenario, the system loads business data tables such as travel, invoices, transportation, and accommodation, and displays the total number of data tables, records, fields, and storage space used through the data table management function. It supports searching by table name or description, and clicking on a table name allows viewing the field structure and sample data. Data can also be exported to CSV or Excel files.

[0398] During the rule management phase, business personnel create audit rules for travel time conflicts, excessive expenses, business trips during holidays, and cross-city anomalies, and set conditions, thresholds, categories, and severity for each rule. Once a rule passes testing, it is activated. The system displays the complementary and escalation relationships between rules using a network diagram, and supports view operations such as zooming in, zooming out, locking, resetting, full-screen mode, and exporting images.

[0399] During the training data generation phase, the user sets the training set to 100 records and the validation set to 20 records, and configures their identity as "Professional Billing and Audit Expert." The system loads the activated rules, reads the fixed instructions and tool definition JSON, which contains the names, function descriptions, and parameter structures of the tools that the model can call. After clicking "Start Generation," the system automatically generates initial training samples containing questions, answers, tool call procedures, and result scores.

[0400] In this embodiment, the system does not directly use samples generated by large-scale models in the cloud as training data. Instead, it first parses the activated rules into structured rule descriptions. These structured descriptions include rule number, applicable document type, trigger field, threshold condition, risk level, complementary relationships, escalation relationships, co-occurrence relationships, and conflict relationships. Based on these structured rule descriptions, the system generates constraints for normal samples, abnormal samples, boundary samples, combined abnormal samples, and interpretation chains.

[0401] The cloud-based large-size model generates normal audit samples, abnormal audit samples, boundary audit samples, and combined abnormal audit samples based on the audit sample constraint template. Boundary audit samples are used to cover scenarios with changes in reimbursement amount, invoice time, consumption location, and approval node near the threshold; combined abnormal audit samples are used to cover complex scenarios triggered by complementary rules, escalation rules, and co-occurrence rules; and the abnormal interpretation chain is used to record the triggering field, hit rule, risk level, and abnormal reason.

[0402] The rule engine performs replay testing on the aforementioned audit training samples. For each generated sample, the system performs testing according to the trigger field, judgment condition, and threshold condition of the target rule to determine whether the sample hits the target rule or mishit a non-target rule, and further generates a risk score, anomaly level, completeness of explanation, and rule conflict result. This replay verification result serves as the source of the GRPO reward signal.

[0403] During the GRPO training phase, the system generates rule hit rewards based on rule hit results, risk level consistency rewards based on risk scores and anomaly levels, explanation chain rewards based on anomaly explanation chains, sample coverage rewards based on the coverage of boundary samples and combined anomaly samples, and conflict penalties based on rule conflict results. The system determines the weights of reward items according to rule risk level, rule stability, and rule hit frequency, thus optimizing the sample generation strategy for large-scale models in the cloud.

[0404] After optimizing the cloud-based generation strategy, the system forms a standardized training set based on audit training samples that have reached the preset reward threshold. The system uses the invoice field, amount field, time field, location field, personnel field, approval process field, and rule number as student input, and the rule hit result, risk level, anomaly explanation chain, and sample weight as teacher supervision information to distill and train the local small-sized audit identification model.

[0405] In a preferred embodiment, the local small-size audit identification model adopts an improved GEOM audit anomaly identification model with rule condition injection. This model encodes student input as coordinates of monetary relationships, time relationships, location relationships, invoice relationships, personnel relationships, approval process relationships, and rule path relationships, and encodes rule number, trigger field, threshold condition, risk level, complementary relationship, escalation relationship, co-occurrence relationship, and rule hit count as a rule condition vector.

[0406] The improved GEOM model inputs the coordinates of seven types of audit relationships into the coordinate relationship encoding layer to obtain the seven types of relationship branch embeddings. Rule condition vectors are then injected into these seven types of relationship branch embeddings to obtain the rule-fused relationship embeddings. During training, the system calculates the distillation loss based on the rule-fused relationship embeddings and teacher supervision information, and constructs rule path constraint losses based on complementary, escalation, and co-occurrence relationships. After training, the system calculates the mean, standard deviation, maximum value, and quantile threshold of the deviation scores for the seven types of audit relationship coordinates based on historical normal audit data to obtain the normal deviation benchmark.

[0407] During the local usage phase at the customer's location, business personnel upload the JSON file to be audited. The system automatically imports the data and executes the activated rule detection. Simultaneously, the data to be audited is input into the trained local small-size audit recognition model. The detection process displays the data import progress, anomaly detection progress, and detailed logs in real time. After the detection is completed, anomaly records are displayed, including employee information, invoice information, violation rules, and anomaly type.

[0408] When a customer adds a new audit rule, the system parses the new rule into a structured description and generates a constraint template for the new rule's audit sample. After the large-scale cloud model generates training samples for the new rule, the rule engine performs a replay test. Based on the replay test results, the system updates the GRPO reward signal, selects high-reward training samples for new rules, and extracts related rule samples, high-risk rule samples, and easily confused rule samples from the existing rule training samples as existing rule retention samples. Finally, the system inputs the high-reward training samples for new rules and the existing rule retention samples into the local small-scale audit recognition model for incremental distillation training, enabling the local model to acquire the ability to recognize new rules while maintaining its ability to recognize existing rules.

[0409] Table 1. Audit Sample Generation and Model Distillation Implementation Data Table

[0410] Rules and Data Foundation Travel, invoice, transportation, and accommodation data sheets; rules regarding travel time conflicts, high costs, business trips during holidays, and cross-city exceptions. Associate the invoice field, amount field, time field, location field, personnel field, and approval process field with the activated rules. This forms the basis for generating structured descriptions of rules and audit sample constraint templates. Training sample generation The training set contains 100 records, and the validation set contains 20 records; the identity is defined as "Professional Billing and Audit Expert"; the tool definition is JSON. The cloud-based large-size model generates audit training samples based on normal samples, abnormal samples, boundary samples, combined abnormal samples, and interpretation chain constraints. Expand the audit training sample while ensuring that real sensitive data is not leaked, and cover different rule-triggered scenarios. Rule replay verification The audit rules are activated after testing and support the configuration of complementary, escalation, co-occurrence, and conflict relationships. The rule engine replays and detects the generated samples, and outputs the rule hit results, risk scores, anomaly levels, explanation completeness, and rule conflict results. Samples with inconsistent screening rules, incorrect abnormal labels, incorrect risk levels, or missing explanations are excluded. GRPO Reward Optimization The training data generation module, rule engine module, and anomaly detection module work together. The replay detection results are mapped to rule hit rewards, risk level consistency rewards, explanation chain rewards, sample coverage rewards, and conflict penalties. Optimize the sample generation strategy for large-size models in the cloud to improve the consistency between generated samples and audit rules. Local model distillation The AI ​​training and validation sets are automatically generated by the system and include rule hit results, risk levels, anomaly explanation chains, and sample weights. The rule hit results, risk level, anomaly interpretation chain, and sample weights are distilled into a local small-size audit identification model; the improved GEOM model with rule condition injection is preferred. Enables local anomaly identification for clients, reduces the need to upload real audit data, and improves the ability to identify hidden and combined anomalies. New rule update Audit rules can be created, tested, activated, deactivated, and added. The new rule triggers incremental sample generation, rule replay detection, reward update and incremental distillation, and adds existing rules to maintain the sample. This enables the local model to recognize new rules while reducing the risk of forgetting existing rule recognition capabilities.

[0411] As shown in Table 1, this embodiment uses the system's basic configuration, including business data tables for travel, invoices, transportation, and accommodation; audit rules for travel time conflicts, high costs, business trips on holidays, and cross-city anomalies; and training data generation configurations such as 100 training set records, 20 validation set records, and JSON definitions for identity and tools. These configurations are no longer merely for platform functionality demonstration but are further transformed into structured rule descriptions, audit sample constraint templates, and model training supervision information.

[0412] Regarding training sample generation, this embodiment limits the generation range of large-scale models in the cloud by using audit sample constraint templates, ensuring that generated samples cover normal, abnormal, boundary, and combined abnormal scenarios. Compared to directly generating samples freely from large models, this method reduces samples inconsistent with audit rules and ensures more comprehensive coverage of scenarios such as boundary amounts, time conflicts, cross-city consumption, and rule upgrades in the training set.

[0413] In terms of sample quality control, the rule engine's replay detection plays a central role. Each generated sample undergoes rule hit, risk level, interpretation completeness, and rule conflict checks, and the replay results are then mapped to GRPO reward signals. This process transforms the rule engine from a simple detection tool into a feedback evaluator for large model generation strategies, enhancing the sensitivity of large-scale cloud models to audit rules.

[0414] For local deployment, the standardized training set is distilled and transferred to the local small-scale audit identification model. When the improved GEOM model with rule condition injection is preferred, amount, time, location, invoice, personnel, approval process, and rule path are encoded into seven types of audit relationship coordinates and fused with the rule condition vector, thereby enhancing the model's ability to identify latent anomalies and combined anomalies.

[0415] Regarding the adaptation of new rules, this embodiment does not require the re-collection of a large number of real abnormal samples. Instead, it generates incremental samples through new rules, and then filters high-quality samples through rule replay and GRPO reward updates. Existing rules are retained in the incremental distillation process, which can maintain the model's ability to recognize old rules and reduce the forgetting problem caused by training with new rules.

[0416] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for training and identifying anomalies in an audit model based on rule feedback, characterized in that, Includes the following steps: S1. Generate a structured description of the rules based on the activated audit rules, the invoice type system, and the rule relationship data, and generate an audit sample constraint template based on the structured description of the rules; S2. Input the audit sample constraint template into the large-size model in the cloud to generate audit training samples and anomaly interpretation chains; S3. The audit training samples are replayed and tested using the rule engine to obtain the replay verification results; S4. Construct the GRPO reward signal based on the playback verification results; S5. Optimize the audit sample generation strategy for large-size cloud models based on GRPO reward signals, and generate a standardized training set; S6. Distill the local small-size audit identification model based on the standardized training set to obtain the trained local small-size audit identification model. S7. Deploy the trained local small-size audit identification model on the customer's local machine to identify anomalies in the audit data; S8. When a new audit rule is added, incremental sample generation, rule replay detection, reward update and incremental distillation are triggered based on the new audit rule, so that the local small-size audit recognition model can obtain the ability to recognize the new rule.

2. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S2 includes the following steps: S21. Input the audit sample constraint template, rule structure description, and invoice type system into the large-size cloud model; S22. Generate normal audit samples, abnormal audit samples, boundary audit samples, and combined abnormal audit samples from large-size models in the cloud. S23. An anomaly explanation chain is generated by a large-scale model in the cloud based on the triggering field, target rule, risk level, and anomaly cause. S24. Combine normal audit samples, abnormal audit samples, boundary audit samples, combined abnormal audit samples, target rule numbers, and abnormal interpretation chains into audit training samples.

3. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S3 includes the following steps: S31. Input the audit training sample into the rule engine and execute rule detection according to the trigger field, judgment condition and threshold condition of the target rule; S32. Determine whether the audit training sample hits the target rule and whether it mishit a non-target rule to obtain the rule hit result; S33. Generate risk scores and anomaly levels based on rule hit results, target rule risk levels, and rule escalation relationships; S34. Generate explanation completeness based on the abnormal fields, rule numbers, triggering conditions, and explanation text in the audit training sample; S35. Generate rule conflict results based on complementary relationships, escalation relationships, co-occurrence relationships, and conflict relationships, and use the rule hit results, risk scores, anomaly levels, explanation completeness, and rule conflict results as replay verification results.

4. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S4 includes the following steps: S41. Generate rule hit rewards based on rule hit results; S42. Generate risk level consistency rewards based on risk scores and anomaly levels; S43. Generate explanation chain rewards based on explanation completeness; S44. Generate sample coverage rewards based on the coverage of boundary audit samples and combined anomaly audit samples; S45. Generate conflict penalties based on rule conflict results; S46. Determine the weight of each reward item based on the rule risk level, rule stability, and rule hit frequency, and perform a weighted mapping on the rule hit reward, risk level consistency reward, interpretation chain reward, sample coverage reward, and conflict penalty to obtain the GRPO reward signal.

5. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S5 includes the following steps: S51. Multiple audit training samples corresponding to the same rule structure description are taken as a group of candidate samples. S52. Calculate the intra-group relative reward for each candidate sample based on the GRPO reward signal; S53. Increase the sampling probability of the generation path corresponding to the candidate sample with relatively high reward within the group, and decrease the sampling probability of the generation path corresponding to the candidate sample with relatively low reward within the group. S54. Repeat the audit sample generation and rule replay detection until the average reward of the candidate sample group reaches the preset reward threshold. S55. Generate a standardized training set based on audit training samples whose average reward reaches a preset reward threshold.

6. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S6 includes the following steps: S61. Use the invoice field, amount field, time field, location field, personnel field, approval process field, and rule number from the standardized training set as student input; S62. Use the rule hit results, risk level, anomaly explanation chain and sample weight output by the large-size cloud model as teacher supervision information; S63. Train a local small-sized audit identification model based on rule label distillation, risk score distillation, interpretation chain distillation, and sample weight distillation; S64. When the rule hit accuracy, risk level consistency rate, and explanation chain integrity rate in the validation set reach the preset conditions, the trained local small-size audit identification model is obtained.

7. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 6, characterized in that, S63 includes the following steps: S631. Encode student input as coordinates of monetary relationship, time relationship, location relationship, invoice relationship, personnel relationship, approval process relationship, and rule path relationship. S632. Encode the rule number, rule category, trigger field, threshold condition, risk level, complementary relationship, upgrade relationship, co-occurrence relationship and rule hit count corresponding to the target rule into a rule condition vector; S633. Input the coordinates of monetary relationship, time relationship, location relationship, invoice relationship, personnel relationship, approval process relationship, and rule path relationship into the coordinate relationship encoding layer to obtain seven types of relationship branch embeddings, and inject the rule condition vector into the seven types of relationship branch embeddings to obtain the rule fusion relationship embedding; S634. Calculate distillation loss based on rule fusion relationship embedding and teacher supervision information, and construct rule path constraint loss based on complementary relationship, upgrading relationship and co-occurrence relationship; S635. Update the local small-size audit identification model based on distillation loss and rule path constraint loss; S636. Based on historical normal audit data, calculate the mean, standard deviation, maximum value and quantile threshold of the deviation scores corresponding to the seven types of audit relationship coordinates to obtain the normal deviation benchmark.

8. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S7 includes the following steps: S71. Read the expense reimbursement data, invoice data, travel data, accommodation data, transportation data, approval process data, and basic employee data to be audited in the customer's local environment; S72. Input the data to be audited into the trained local small-size audit recognition model to obtain anomaly labels, risk scores, hit rules and anomaly interpretation chains; S73. Perform consistency verification between the anomaly label and the real-time detection results of the customer's local rule engine; S74. Output the anomaly identification result when the anomaly label matches the real-time detection result; S75. When the anomaly label is inconsistent with the real-time detection result, output the verification identifier and conflict rule number.

9. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 1, characterized in that, S8 includes the following steps: S81. Receive new audit rules and parse them into a structured description of the new rules; S82. Generate a sample constraint template for auditing new rules based on the structured description of the new rules; S83. Generate new rule training samples through a large-size model in the cloud, and replay and detect the new rule training samples through the rule engine; S84. Update the GRPO reward signal based on the replay detection results of the newly added rule training samples, and select high-reward newly added rule training samples; S85. Extract existing rule-preserving samples from existing rule training samples; S86. Input the training samples of the newly added high-reward rules and the existing rule-maintained samples into the local small-size audit recognition model for incremental distillation training, so that the local small-size audit recognition model can obtain the anomaly recognition capability corresponding to the newly added audit rules.

10. The method for training and identifying anomalies in an audit model based on rule feedback according to claim 9, characterized in that, S85 includes the following steps: S851. Read related rule samples from existing rule training samples that have complementary, upgrading, or co-occurrence relationships with the newly added audit rules; S852. Read high-risk rule samples with a risk level higher than the preset risk level from the existing rule training samples; S853. Read easily confused rule samples with a historical false alarm count higher than the preset false alarm count from the existing rule training samples; S854. Combine the association rule samples, high-risk rule samples, and easily confused rule samples into existing rule preservation samples; S855. Use existing rule-preserving samples for incremental distillation training to maintain the local small-size audit recognition model's ability to recognize existing audit rules.

Images