Multi-tenant privacy feedback processing method and system

Abstract

The application discloses a privacy feedback method of a multi-tenant intelligent system. A client locally maps skill behavior containing free-text business context into versioned closed intent code, and does not generate normal uplink events when it cannot be mapped. Security events only contain predetermined identifiers, integers, enumerations, Booleans and coarse-grained time buckets, and free text, unknown fields and original text reversible coding are rejected. The client separates the context with tenant-side secrets and skill-specific domains to generate an aggregated token that is stable within a skill and cannot be associated across skills. The aggregated token is received persistently through a one-way white list interface from an identity measurement plane to a quality feedback plane, and is de-duplicated by skill.

Description

Technical Field

[0001] This invention relates to the fields of multi-tenant artificial intelligence systems, privacy-preserving event handling, client data minimization, and asynchronous aggregation, and particularly to a method for mapping free text behavior to closed intent codes on the client side and performing deduplication aggregation using skill domain separation tokens. Background Technology

[0002] Shared skills services need to understand the usage outcomes of different skill versions and common rewrite types. Directly uploading sessions, paths, business facts, text summaries, or embedding vectors causes the tenant's business context to leave the tenant boundary; simply committing to delete the original text at the center does not exclude the possibility that the original text has entered the center from the event structure.

[0003] Managed services also require authentication and measurement using real identities, while quality statistics aim to avoid cross-skill profiles. Using the same global pseudonym would allow the center to associate across skills; however, statistics based solely on the number of events are susceptible to replay effects. Summary of the Invention

[0004] Technical problems to be solved The present invention aims to solve the problem of how to generate structured signals that can be used to judge the quality of skill versions without uploading free text and its reversible representation, and to allow deduplication within a single skill while limiting cross-skill identity association. Technical solution

[0005] The client retains the processing boundaries of the free text business context and uses a versioned, closed intent codebook to perform local semantic mapping of skill usage or rewriting behaviors. Successful mapping outputs only a limited enumeration; failed mapping does not generate ordinary events, nor does it truncate, encode, summarize, or vectorize the original text and insert it into a catch-all field.

[0006] The security event constructor only reads allowed identifiers, integers, enumerations, booleans, and coarse-grained event buckets, and checks them in closed mode both before and after serialization. The entire event is rejected if the server finds an unknown field or free text value.

[0007] The client computes T_i=PRF(S,K_i,epoch) using the tenant-side secret S and the skill-specific domain separation context K_i. T_i remains stable within the same skill and period to facilitate deduplication, while outputs differ across skills; the quality plane does not hold S. Organizational deduplication employs the same skill domain separation principle.

[0008] The identity measurement plane and the quality feedback plane are isolated through a one-way field whitelist interface. The identity plane completes authentication and measurement; the quality plane only receives closed events and skill domain separation aggregation keys, and cannot perform reverse identity queries.

[0009] This invention also provides technical solutions for both the tenant client side and the server side. The tenant client-side method completes closed intent mapping, whitelist security event construction, and skill domain separation token generation within the client boundary, and sends the uplink security event and tenant aggregation token to the server receiving interface. The server-side method completes closed mode verification, complete rejection of unknown fields, one-way field whitelist writing, and skill-based deduplication aggregation without obtaining the tenant's secret and tenant identity identifier. Both methods can be implemented independently, together forming an end-to-end privacy feedback channel.

[0010] Client-side event model and closed mapping LOCAL_CONTEXT can contain session text, path, client name, and precise time, and is only present at tenant boundaries. INTENT_CODEBOOK records code_id, version, applicable_action, allowed_inputs, and forbidden_outputs, such as ADD_VERIFICATION_STEP, TIGHTEN_SCOPE, and REMOVE_STEP. It returns NO_ENUM_MATCH if a code cannot be explicitly entered.

[0011] UPLINK_SAFE_EVENT may include schema_version, event_id, event_type, skill_ref, skill_version, outcome, intent_code, tenant_token, org_token, and time_bucket. The event constructor must not read free text fields from LOCAL_CONTEXT to generate a summary or embedding.

[0012] Domain Separation Token and Key Management The PRF can be an HMAC or a pseudo-random function with equivalent unpredictability. K_i is generated from the skill identifier, codebook field label, and public salt; epoch is used for controlled rotation. Tenant secrets are stored in the client key store and are not uploaded with events.

[0013] Organizational aggregation tokens can be generated by tenant clients based on organizational secrets according to the same skill domain separation principle. In deployments where organizational secrets are unavailable or organizational affiliation is centrally managed by the hosting provider, organizational aggregation keys with skill domain separation can also be generated by a trusted tenant directory isolated from the quality feedback plane permissions, based on organizational affiliation mapping. This trusted tenant directory does not expose organizational identity identifiers to the quality feedback plane. Both generation methods maintain the properties of being deduplicated by organization within a single skill and not being associated across skills.

[0014] The rotation window allows for brief overlap between new and old periods, but a TOKEN_ROTATION_ABUSE flag is generated when an unusually large number of tokens appear for the same tenant in the same skill and time bucket. Tokens are only used for aggregation and deduplication and are not used as access credentials.

[0015] Dual-plane isolation, persistent reception and idempotency The identity measurement plane stores tenant_id, key_id, authorization, and usage; the quality feedback plane stores event_id, skill_ref, skill_version, outcome, intent_code, domain separation token, and time bucket. Both use independent service accounts and database permissions.

[0016] The synchronous receiving path first verifies the size, content type, mode version, and all fields. Upon successful verification, it writes to an append log or persistent queue. The asynchronous consumer deduplicates data by idempotent key, skill, version, token, and time bucket.

[0017] Codebook release, compatibility, and rejection semantics The server generates a signature or content hash for the INTENT_CODEBOOK, and the client verifies the version and integrity before use. Security events carry the codebook_version; the server only accepts the current version or versions explicitly compatible with the specified window. New code unknown to the client must not be sent in numeric pass-through or OTHER format.

[0018] Codebook upgrades require declaration of new, deprecated, and semantically incompatible items. If the semantic boundaries of a piece of code expand, the client must obtain the new version and remap it; the server cannot interpret events from the old code according to the new semantics. This avoids reintroducing the free semantic channel by silently changing the meaning of enumerations through a central mechanism.

[0019] The mapper can identify behavior using local rules or local models, but its output must be constrained by a finite set of code; it returns NO_ENUM_MATCH if the confidence of the local model is insufficient. Neither the mapping model nor the free text is uploaded; the center only accepts the final code and codebook version.

[0020] Security event fields and serialization constraints The pattern validator imposes usage and length restrictions on each string field. `skill_ref` and `event_id` must conform to the fixed identifier syntax and cannot contain path separators, whitespace sentences, or high-entropy payloads; enumeration fields must fall within the codebook; `time_bucket` only allows day, week, or other predefined granularities. `skill_ref` only allows shared skill identifiers; events carrying private skill identifiers are rejected entirely.

[0021] To prevent the use of hash fields to smuggle plaintext, regular events do not accept client-defined content hashes, arbitrary byte arrays, or open key-value mappings. When integrity protection is required, the signature only overrides the normalized security event, rather than using the local plaintext hash as the quality field.

[0022] Serialization uses a defined field order and canonical type. The server first checks the byte count and content type, then parses and compares the fields against a whitelist; parsing failures, duplicate fields, type casting, and unknown extensions are all rejected as a whole, and a pattern reason code is recorded.

[0023] Non-associative boundaries and rotation The non-associability applies to tokens seen in the quality feedback plane. The identity measurement plane can identify tenants for legitimate authentication, but the one-way interface does not write that identity into the quality record; network addresses and access logs must also not be included in the quality aggregation key.

[0024] The token epoch is controlled by a policy. During normal rotation, old tokens are only accepted within a limited overlap window. The aggregator can merge new and old tokens from the overlap period into a single logical contribution through an independent conversion service, but the conversion result is still bound to a single skill. Exceeding the rotation frequency will generate an anomaly rather than increase the number of users.

[0025] If a tenant's secret is leaked, the client can replace S and invalidate the old period; the server-side quality plane does not have the ability to deduce S from T_i. Key rotation, revocation, and device migration events only expose closed status codes to the quality plane.

[0026] Distributed and regional implementation In a distributed deployment, events can first be written to a persistent queue in the tenant's home region, and then aggregated by skill shard. Only skill identifiers, versions, time buckets, and restricted aggregation keys or counts are exchanged across regions; local contexts are not exchanged.

[0027] Pattern versioning, codebook versioning, and domain separation rules are validated using content hashes in each region; regions with inconsistent versions reject events without providing lenient compatibility. This mechanism prevents multi-region configuration drift from compromising privacy boundaries.

[0028] Explicit content contribution isolation Users contribute specific skill text using different endpoints. The client first de-identifies the content and displays it to the author, then performs payload and side effect checks, followed by verification of the de-identified or synthesized evaluation samples; only after all checks pass does the content enter the quarantine zone. Regular telemetry permissions cannot access the content contribution interface.

[0029] Feasibility verification method In the local context, insert a unique identifier, path, and client name, capture normal uplink events, and confirm that the above identifier, its digest, encoding, and vector do not exist; add an unknown field and confirm that the server rejects it; generate tokens for two skills using the same secret and confirm that they are different; for duplicate events, confirm that they are counted only once; attempt to reverse look up the identity from the quality plane and confirm that access control is denied. Beneficial effects

[0030] This invention achieves data minimization by using a closed event structure instead of a centralized commitment; local semantic mapping preserves skill rewriting type signals; skill domain separation tokens support single-skill deduplication and restrict cross-skill profiles; dual-plane isolation balances managed authentication and quality analysis; asynchronous idempotent processing improves reliability under burst traffic.

[0031] The aforementioned features are functionally mutually supportive and interactive: the finite enumeration of the closed intent codebook determines the set of closed fields for security event pattern verification; the skill-specific domain separation context binds the pseudo-random function output to a single skill dimension; and the one-way field whitelist interface enables the quality feedback plane to complete deduplication aggregation using only the domain separation token. Overall, this solution addresses the technical challenge of preventing free text leakage and cross-skill re-identification during multi-tenant telemetry aggregation by skill, achieving both data isolation integrity and aggregation reliability under burst traffic. Attached Figure Description

[0032] Figure 1 Here is a diagram of the overall architecture for privacy feedback. Figure 2 Generate a graph for local semantic mapping and security events; Figure 3 Separate the token graph for the skill domain; Figure 4 A diagram showing the separation between the identity measurement plane and the quality feedback plane; Figure 5 For pattern verification, persistent reception, and idempotent deduplication graphs.

[0033] In the accompanying drawings of this specification, diamond-shaped nodes on connecting lines represent operations or data transfers, with text inside the diamond indicating the specific operation or transfer content; triangle-shaped nodes on connecting lines represent return statuses or determination results, with text inside the triangle indicating the specific status or result; arrows indicate the direction of the corresponding control flow or data flow. Diamonds and triangles are semantic symbols for connecting lines and do not replace system components marked with figures.

[0034] Explanation of reference numerals in the attached figures 110—Client-side free text business context; 120—Closed intent mapper and codebook; 130—Whitelist security event builder; 140—Skill domain separation token generator; 150—Quality feedback plane and persistent queue; 160—Intra-skill deduplication aggregation; 210—Detect skill usage or rewriting behavior; 220—Match versioned closed intent code.

[0035] 230 — Read only allowed structured fields; 240 — No match: normal upper row is empty; 250 — Construct a security event without free text; 260 — Secondary pattern check after serialization; 310 — Tenant-side secret S; 320 — Skill identifier and domain separation tag K_i; 330 — PRF(S,K_i,epoch); 340 — Stability within the same skill to remove duplicates.

[0036] 350—Cross-skill outputs are different and unrelated; 360—The quality plane does not hold tenant secrets; 410—Identity measurement plane: authentication, authorization, measurement; 420—One-way field whitelist conversion interface; 430—Quality feedback plane: closed event and domain decoupling key; 440—Identity, account, and API key storage; 450—Append logs, queues, and in-skill aggregation; 510—Receive security events.

[0037] 520—Field set, type, and enumeration validation; 530—Write to append log or persistent queue; 540—Unknown or free text field: reject the entire entry; 550—Deduplicate by event key, token, skill version, and time bucket; 560—Output in-skill statistics. Detailed Implementation

[0038] Example 1: The user adds a verification step locally, the mapper outputs ADD_VERIFICATION_STEP, and the ordinary event only contains code and structure fields; the original step text remains locally.

[0039] Example 2: The same tenant uses skill A and skill B, and the client generates different tokens based on different K_i; the quality plane can deduplicate within A, but cannot use tokens to associate the behaviors of A and B.

[0040] Example 3: If an event carries a string comment or an unknown field, the pattern validator will reject the entire event; if a duplicate event_id is delivered through the queue at least once, only one logical event will be formed.

[0041] Example 4: When a user explicitly contributes skill text, the system switches to an isolated contribution path, and the normal feedback interface still does not receive content. Other equivalent implementations that maintain local closed mapping, no free text normal uplink, skill domain separation aggregation key, and dual-plane isolation all fall under the concept of this invention.

Claims

1. A method for privacy feedback processing in a multi-tenant intelligent system, executed by at least one processor, the method comprising: include: Receive skill usage or skill rewriting behaviors containing free text business context within the tenant client boundary; The client-side local semantic mapper maps the behavior to closed intent codes based on the versioned closed intent codebook published by the server. When the closed intent code cannot be obtained, the generation of ordinary uplink feedback events is prohibited. The client-side security event constructor constructs uplink security events as ordinary uplink feedback events only from predefined identifiers, integers, enumerated values, booleans, and coarse-grained time buckets, and rejects free text fields, unknown fields, and reversible encoding of the original free text before and after serialization; For shared skill identifiers, a tenant aggregation token that is stable within a skill but not associated across skills is generated through a pseudo-random function by separating the context of the tenant-side secret and the skill-specific domain. By using a one-way field whitelist interface from the identity measurement plane to the quality feedback plane, the uplink security events and the tenant aggregation tokens are written to an append log or persistent queue, enabling the quality feedback plane to perform deduplication aggregation by skill without obtaining the tenant-side secret and tenant identity identifier.

2. A privacy feedback uplink method of a tenant client in a multi-tenant intelligent system, executed by at least one processor of the tenant client, the method comprising: include: Receive skill usage or skill rewriting behaviors containing free text business context within the tenant client boundary; Based on the versioned closed intent codebook published by the server, the behavior is mapped to closed intent code. When the closed intent code cannot be obtained, the generation of ordinary uplink feedback events is prohibited. Uplink security events are constructed only from predetermined identifiers, integers, enumeration values, boolean values ​​and coarse-grained time buckets as ordinary uplink feedback events. Reversible encoding of free text fields, unknown fields and original free text is rejected before and after serialization. For shared skill identifiers, a tenant aggregation token that is stable within a skill but not associated across skills is generated through a pseudo-random function by separating the context of the tenant-side secret and the skill-specific domain. The uplink security event and the tenant aggregation token are sent to the server receiving interface; wherein, the free text business context and its summary, reversible encoding and content embedding vector are not included in the uplink security event.

3. A privacy feedback processing method for the server side in a multi-tenant intelligent system, executed by at least one processor on the server side, characterized in that, include: Receive uplink security events and skill domain-separated tenant aggregation tokens from tenant clients; The uplink security event is validated in a versioned closed mode, including the mode version, field set, field type, enumeration value, identifier format, and time bucket. Any unknown field or free text value will cause the entire uplink security event to be rejected. Through a one-way field whitelist interface from the identity measurement plane to the quality feedback plane, the verified uplink security events and the tenant aggregation token are written to an append log or persistent queue. Without obtaining the tenant-side secret and tenant identity identifier, the quality feedback plane deduplicates the events and aggregates them by skill using the idempotent key, skill identifier, skill version, tenant aggregation token, and time bucket carried by the uplink security events.

4. The method according to claim 1 or 2, characterized in that, The versioned closed intent codebook is a finite enumeration set. Each code record includes a code identifier, applicable behavior category, allowed input fields, prohibited output fields, and codebook version. Clients are not allowed to generate free-comment code or catch-all code containing original rewritten fragments.

5. The method according to claim 1 or 2, characterized in that, The ordinary uplink feedback events do not include free text, text summaries, reversibly coded text, content embedding vectors, exact file paths, conversational text, prompt words, customer names, business facts, or exact timestamps; when specific content needs to be contributed, an explicit contribution path isolated from ordinary uplink feedback events must be entered.

6. The method according to claim 1 or 2, characterized in that, Tenant aggregation token T_i = PRF(S,K_i,epoch), where S is the tenant-side secret, K_i is generated based at least on the shared skill identifier and domain separation tag, and epoch is the token period that allows rotation; T_i is stable within the same skill and period, while K_i is different for different skills.

7. The method according to claim 1, 2 or 3, characterized in that, It also obtains a skill-specific organization aggregation token, which is generated by the tenant client based on the organization-side secret, or by the trusted tenant directory isolated from the quality feedback plane permissions based on the organization affiliation mapping, and adopts a domain separation context bound to the shared skill identifier, so that the quality feedback plane can deduplicate by organization within a single skill and cannot use the token to associate the same organization across skills.

8. The method according to claim 1 or 3, characterized in that, The identity and metering plane stores tenant identity, access credentials, authorization, and metering information, while the quality feedback plane only stores closed security events and domain separation aggregation tokens. The two planes use different database roles, storage permissions, or service accounts, and the quality feedback plane cannot query the identity and metering plane in reverse.

9. The method according to claim 1 or 3, characterized in that, The server-side schema validator verifies the schema version, field set, field type, enumeration value, identifier format, and time bucket; any unknown field, free text value, private skill identifier, or illegal enumeration will cause the entire event to be rejected.

10. The method according to claim 1 or 3, characterized in that, The persistent queue adopts at least-once delivery semantics, and events carry idempotent keys; the aggregator uses idempotent keys, skill identifiers, skill versions, tenant aggregation tokens, and time buckets to deduplicate, and does not count duplicate deliveries as independent feedback.

11. The method according to claim 1 or 2, characterized in that, Local events containing free text business contexts are either stored in the tenant's local diagnostic storage or deleted after mapping is complete; regardless of whether they are stored, the free text business contexts do not enter the normal uplink feedback events.

12. The method according to claim 5, characterized in that, The explicit contribution path responds to the user's explicit submission command by sequentially performing client-side local de-identification, author confirmation, security review, and evaluation sample verification. Only after all of these steps are passed is the candidate content sent to an isolated area that is separate from the normal feedback endpoint, permissions, and storage.

13. A privacy feedback processing system in a multi-tenant intelligent system, characterized in that, It includes a closed intent mapper, a security event builder, and a skill domain separation token generator within the client boundary, as well as a pattern validator, an identity measurement plane, a one-way field whitelist interface, a quality feedback plane, a persistent event receiver, and a skill-based deduplication aggregator on the server side. Each module is configured to perform the method of any one of claims 1 to 12.

14. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the method of any one of claims 1 to 12.

15. A computer program product comprising a computer program that, when executed by a processor, implements the method of any one of claims 1 to 12.

Images