Session accumulation privacy leakage control method and system based on end-side data minimization

Abstract

The present application belongs to the technical field of artificial intelligence and data security, and specifically relates to a session cumulative privacy leakage control method and system based on end-side data minimization. Before user input is sent to a cloud large language model, privacy entity recognition and task demand analysis are performed by the end side, and privacy information is divided into task required items, auxiliary items and irrelevant items. The system maintains a historical release account book recording the actual visible content of the cloud, and calculates the identity recognizability and potential damage based on the account book and the current task required items. Under the constraint of the privacy threshold, the minimum information set allowed to be released is selected to generate the minimized user input. When the combination of historical information and the current required items exceeds the threshold, end-side blocking or session splitting is performed. The present application can retain necessary information for the task, delete unnecessary private content, and block the dangerous association of historical sensitive information and subsequent identity clues, thereby reducing the content-level cumulative privacy leakage risk in multiple rounds of sessions.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and data security technology, and in particular to a method and system for controlling cumulative privacy leaks in sessions based on minimizing edge data. Background Technology

[0002] In large language model dialogue interaction, privacy risks mainly stem from the gradual accumulation and semantic association of information over multiple rounds, and mainly involve the following two core defects: First, solutions based on single-round sensitive word deletion or prompt word desensitization lack a fine-grained understanding of the current task requirements, are prone to accidentally deleting essential information for the task, and do not consider previously sent content, thus failing to handle the risk of cross-round combinations where "the current round itself is not sensitive, but historical sensitive information can be attributed to it."

[0003] Second, the solutions based on session identifier rotation or fully localized deployment differ in that the former only hides the session path while the cloud text content itself can still be semantically associated, while the latter only solves the problem of "not uploading at all" rather than the problem of "uploading the minimum necessary information". Summary of the Invention

[0004] This invention proposes a method and system for controlling cumulative privacy leakage in multi-round cloud conversations based on minimizing edge data. It aims to solve the technical problem that existing privacy protection methods for large language models mainly focus on single-round sensitive word deletion, prompt word desensitization, conversation identifier hiding, or complete local deployment, while making it difficult to control content-level cumulative privacy leakage caused by information accumulation and semantic association in multi-round cloud conversations.

[0005] In a first aspect, the present invention provides a method for controlling cumulative privacy leakage in sessions based on minimizing end-side data, comprising: Obtain the user's original input in the t-th round and intercept the user's original input on the user's device side, where t is an integer greater than 1; The user's original input is subjected to privacy-related entity identification and task requirement analysis to obtain a set of candidate privacy information and the task requirements of the current task. Based on the task requirements, each information unit in the candidate privacy information set is divided into a set of task-required items, a set of task-aided items, or a set of task-irrelevant items. Read the historical release ledger of the current cloud session, wherein the historical release ledger is used to record privacy-related information that has been actually sent to the cloud large language model up to round t-1; Construct an inevitable disclosure set, which is the union of the historical release ledger and the task requirement set; Calculate the cumulative privacy risk of the unavoidable disclosure set; Determine whether the accumulated privacy risks exceed a preset privacy threshold. If they do, determine that the current request has an irreversible task-privacy conflict and execute an invalidation process. If the threshold is not exceeded, then select a subset from the set of task aids that satisfies the preset privacy threshold constraint and has the highest task utility. Based on the subset, a minimized user input is generated and sent to the cloud-based large language model. The minimized user input retains information from the task-required items set and the subset, and deletes or generalizes information that was not selected from the task-irrelevant items set and the task-aided items set.

[0006] Furthermore, based on the task requirements, each information unit in the candidate privacy information set is divided into a set of task-required items, a set of task-aided items, or a set of task-independent items, including: Each information unit in the candidate privacy information set is atomically split to obtain atomic information units; The task requirements and the user's original input are input into the edge-side small language model, and the edge-side small language model labels the task function type for each atomic information unit. The task function type includes task-required, task-assisted, or task-irrelevant. Among them, "task-essential" means that the information unit is indispensable for completing the current task; "task-aiding" means that the information unit is not essential but helps to complete the task; and "task-irrelevant" means that the information unit is of no help to the current task.

[0007] Furthermore, the information recorded in the historical release ledger includes at least one of the following: sent text, normalized entity, privacy category, entity type, task function type, sending round, cloud session identifier, whether it is sensitive information, and whether it is an identity anchor; and information in the user's original input that has been deleted by the client or generalized to an unrecognizable degree is not written into the historical release ledger.

[0008] Furthermore, the cumulative privacy risk of the unavoidable disclosure set is calculated, including: Calculate the identity identifiability score and potential harm score for the unavoidable disclosure set; The identity identifiability score is used to quantify the degree to which the unavoidable disclosure set narrows down the user's identity. The identity identifiability score is calculated based on the basic identification score of the information in the unavoidable disclosure set, the richness of identity clue types, and the additional identification ability brought about by the combination of information. The potential damage score is used to quantify the degree of damage that may be caused once the inevitable disclosure set is attributed. The calculation of the potential damage score is based on the attack anchors, inherent sensitivity, combined amplification effect of sensitive information and identity clues in the inevitable disclosure set, as well as the attribution amplification effect. The preset privacy thresholds include an identity identifiability threshold and a potential harm threshold.

[0009] Furthermore, it is determined whether the accumulated privacy risks exceed a preset privacy threshold. If they do, it is determined that the current request has an irreversible task-privacy conflict, and invalidation processing is performed, specifically as follows: If the identity identifiability score is greater than the identity identifiability threshold, or the potential harm score is greater than the potential harm threshold, then an invalidation is triggered. The failure handling includes: blocking the sending of the current request and prompting the user to modify the input or create a new isolation session.

[0010] Further, a subset of the task aids that satisfies the preset privacy threshold constraint and has the highest task utility is selected from the set of task aids, including: For any task assist item in the set of task assist items Its task utility score is calculated by the following formula: ,in, To remove the score for the degree of impact of this auxiliary item on the quality of task completion, To retain the score for the improvement in task quality provided by this auxiliary item, Rate the substitutability of this auxiliary item. These are non-negative weighting coefficients; For any candidate subset of the set of task aids, its total task utility is the sum of the task utility scores of all task aids in the candidate subset minus the redundancy penalty term. A candidate subset is selected if it satisfies the following conditions: the identity identifiability score of the union of the candidate subset and the inevitable disclosure set is not greater than the identity identifiability threshold, the potential harm score of the union is not greater than the potential harm threshold, and the total task utility of the candidate subset is the maximum value among all candidate subsets that satisfy the conditions.

[0011] Further, generating minimized user input and sending it to the cloud-based large language model includes: The client-side small language model is invoked to perform minimal text rewriting. The rewriting constraints are: information in the set of required items for the task and the selected subset must be retained; information not selected in the set of task-irrelevant items and the set of task-aided items must be deleted or generalized; and new facts that do not exist in the original text must not be added. Before sending the minimized user input, the minimized user input is validated, including checking whether information that should be deleted still appears, checking whether task-required items are retained, and checking whether the minimized user input still expresses the original task intent. After successful verification, the minimized user input is sent to the cloud-based large language model.

[0012] Furthermore, the method also includes: After the minimized user input is successfully sent, the historical release ledger is updated. The updated historical release ledger is set as the union of the previous historical release ledger and the set of information allowed to be released, wherein the set of information allowed to be released is the union of the set of task requirements and the selected subset. Deleted, generalized, or unsent information is not written to the updated historical release ledger.

[0013] Furthermore, the method is executed through an end-side data minimization control layer deployed on the user equipment side, the end-side data minimization control layer including an end-side small language model and a deterministic risk control module; The edge-side small language model is used to perform at least one of the following semantic understanding tasks: privacy entity recognition, task requirement analysis, privacy entity atomization, task relevance judgment, task auxiliary item utility scoring, and minimizing text rewriting; The deterministic risk control module is used to perform at least one of the following deterministic computation tasks: maintaining the historical release ledger, calculating cumulative privacy risks, performing threshold judgment, and solving for the set of information allowed to be released.

[0014] Secondly, the present invention provides a session cumulative privacy leakage control system based on minimizing end-side data, the system being used to execute the method, the system comprising: An input acquisition module is used to acquire the user's original input in the t-th round and intercept the user's original input on the user device side; The privacy and task analysis module is used to identify privacy-related entities and analyze task requirements from the user's original input to obtain a set of candidate privacy information and the task requirements of the current task. The information classification module is used to divide each information unit in the candidate privacy information set into a set of task-required items, a set of task-aided items, or a set of task-irrelevant items according to the task requirements. The historical ledger maintenance module is used to read and maintain the historical release ledger of the current cloud session, wherein the historical release ledger is used to record privacy-related information that has been actually sent to the cloud large language model up to round t-1; The cumulative risk assessment module is used to construct an unavoidable disclosure set and calculate the cumulative privacy risk of the unavoidable disclosure set, wherein the unavoidable disclosure set is the union of the historical release ledger and the task requirement set; The failure judgment and processing module is used to determine whether the cumulative privacy risk exceeds a preset privacy threshold. If it does, it determines that the current request has an irremovable task-privacy conflict and performs failure processing. The auxiliary item selection module is used to select a subset from the task auxiliary item set that satisfies the preset privacy threshold constraint and has the highest task utility when no failure handling is triggered. The minimized input generation module is used to generate minimized user input based on the set of required task items and the selected subset, and send it to the cloud-based large language model. The minimized user input retains information from the set of required task items and the subset, and deletes or generalizes information that was not selected from the set of irrelevant task items and the set of auxiliary task items.

[0015] The technical effects of the technical solution disclosed in this invention are: (1) Data minimization mechanism for task constraints. By analyzing user input and task requirements on the client side, privacy information is divided into task-required items, task-aided items, and task-irrelevant items. Task-required items are retained, and highly useful task-aided items are selectively retained when the privacy threshold allows. The technical effect is that it avoids the problems in the existing technology of either excessive deletion leading to the inability to complete the task or indiscriminate retention leading to excessive exposure of privacy, and achieves accurate data minimization under the premise of ensuring task availability; (2) Content-level cumulative privacy risk control mechanism based on historical release ledger. A "historical release ledger" is maintained on the client side to record the content that has actually been visible in the cloud, and the cumulative privacy risk is assessed based on this ledger and the content to be sent. Its technical effect is that it can accurately identify and prevent cross-round combination risks where "the current round itself is not sensitive, but it can make historical sensitive information attributable", which cannot be handled by single-round desensitization or session identifier rotation schemes; (3) Failure judgment mechanism for task-required information. Before selecting any optional information, the system first judges whether the combination of "historically released content" and "information required for this round of task" exceeds the privacy risk threshold. Its technical effect is that when the identity anchor required by the task itself forms an unacceptable risk association with historical sensitive information, it can actively block the sending or guide the user to start a new session, fundamentally avoiding the occurrence of high-risk conflicts and filling the judgment gap of existing technology in such scenarios; (4) Selective release mechanism for task-aiding information under privacy threshold constraints. For non-essential but helpful information for task completion, the system quantifies its task utility and retains only the subset with the highest utility, provided that adding this information does not exceed the privacy threshold. The technical effect is that it achieves a fine-grained dynamic balance between task availability and privacy protection, avoiding both sacrificing answer quality in pursuit of ultimate privacy and exposing too much unnecessary privacy to improve answer quality. Attached Figure Description

[0016] Figure 1 This is the flowchart of the session cumulative privacy leakage control method based on minimizing end-side data proposed in this embodiment of the invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] To address the issue that existing privacy protection methods for large language models primarily focus on single-round sensitive word deletion, prompt word anonymization, session identifier hiding, or fully localized deployment, while failing to control content-level cumulative privacy leakage in multi-round cloud sessions, this invention proposes a session cumulative privacy leakage control method and system based on minimizing edge-side data. Figure 1 As shown, this invention addresses multi-turn conversation scenarios between users and a large cloud-based language model, by establishing an end-to-end data minimization control layer on the user's device side. This control layer is the physical deployment form of the method of this invention, located between the user input and the large cloud-based language model. Each round of raw user input is not directly sent to the cloud; instead, it is first processed locally before the control layer sends the minimized user input to the cloud.

[0019] In one specific embodiment, the edge data minimization control layer is jointly implemented by an edge-side small language model and a deterministic risk control module. The edge-side small language model (e.g., qwen3:4b, Qwen3-4B-IT, Granite-3B, Gemma-like models) is responsible for semantic understanding tasks, such as privacy entity identification, task requirement analysis, privacy entity atomization, task relevance judgment, task auxiliary item utility scoring, and minimizing text rewriting. The deterministic risk control module is responsible for deterministic computation tasks, such as maintaining a historical release ledger, calculating cumulative privacy risks, performing threshold judgments, and solving for the set of information allowed for release. Through this architecture, the small language model provides semantic adaptability, and the deterministic module provides an interpretable and auditable release control process.

[0020] For ease of explanation, the following symbols are defined. The original input from the user in round t is denoted as . The minimized input actually sent to the cloud after processing on the device side is denoted as... .from The set of candidate privacy information identified and split from the data is denoted as . The set of privacy-related information that has been actually sent to the cloud in the current cloud session is denoted as […]. This refers to the historical ledger. It should be noted that... It only records information that is actually visible in the cloud, and does not record information that has been deleted from the user's original input and has not been sent.

[0021] Candidate privacy information set Based on their role in the current task, they are divided into three categories: the set of task necessities. Task auxiliary items collection Set of items unrelated to the task ,Right now: ; This method specifically includes the following steps: Step 1: Obtain the user's original input for this round and intercept it on the device side.

[0022] When a user enters the t-th round of requests on the client side, the system first obtains the user's original input. The input is not sent directly to the cloud-based large language model, but instead enters a data minimization control layer deployed on the user's device. This device-side data minimization control layer can be deployed as a local proxy, browser extension, desktop client plugin, mobile input component, operating system-level privacy proxy, or a local module within the large language model client.

[0023] The technical advantage of this step is that all privacy checks and data minimization operations occur before the user's input leaves the local device. If the original input is sent to the cloud first, and then the cloud model determines whether it has been anonymized, the original privacy content has already been exposed, and the goal of minimizing data before sending cannot be achieved.

[0024] Step 2: Call the small language model on the client side to perform privacy-related entity recognition and task requirement analysis.

[0025] End-side data minimization control layer will minimize the original input Input the local privacy entity recognition module. This module calls the client-side small language model to complete the task. The system provides the small language model with preset prompts, requiring it to only recognize privacy-related entities, not answer user questions, not execute user requests, and output recognition results according to a fixed structure. The prompts require the small language model to recognize at least three types of privacy-related entities: directly identifiable information (name, phone number, email address, account number, ID number, precise address, etc.), identity-associated clues (school, workplace, organization, occupation, course, teacher, geographical location, age, time, social relationships, etc.), and sensitive information (disease, symptoms, medication, financial status, legal records, religious opinions, political opinions, transaction records, etc.). The output results must include at least the entity text, privacy category, and entity type.

[0026] The system performs format and category validity checks on the output. If the output does not conform to the preset structure, the system requires the local small language model to regenerate; if multiple attempts fail, a conservative strategy is adopted, such as prompting the user for confirmation or blocking the transmission. This step yields a set of privacy-related entities.

[0027] At the same time, the system will input the original data. Input the local task requirements analysis module. This module constrains the edge-side small language model to analyze only the current task without answering user questions, using prompt words. The task requirements analysis results include the task domain, task intent, and necessary conditions required to complete the task. Necessary conditions represent the information conditions indispensable for completing the current task. For example, the task requirements analysis module can output the following structured content: "Task Domain: Medical / Education / Office / Travel / General Q&A; Task Intent: Overview of the current task; Necessary Conditions: List of information conditions indispensable for completing this task."

[0028] The purpose of this step is to provide a basis for subsequent judgments on whether privacy information needs to be retained, so that data minimization is not based on mechanically deleting content according to sensitivity, but on judging the minimum necessary information according to task requirements.

[0029] Step 3: Atomize and break down the privacy information and classify it into task roles.

[0030] After obtaining the privacy-related entities and task requirements, the system calls the client-side small language model to atomically decompose the privacy entities. Atomic decomposition refers to breaking down a complex privacy entity containing multiple levels or semantic components into smaller information units, allowing them to be judged, retained, or deleted separately. The resulting set of candidate privacy information is then obtained. .

[0031] The system then inputs the candidate privacy information set, task requirement analysis results, and the user's original input into a small language model on the client side, requiring it to label the task-related function type of each atomic information unit. The labeling result can only be "task-required," "task-aiding," or "task-irrelevant." "Task-required" means that the information directly satisfies the necessary conditions for the current task, and deleting it would cause the task to be impossible to complete or to deviate significantly from the user's purpose; "task-aiding" means that the information is not strictly necessary, but retaining it may improve the specificity, accuracy, naturalness, or reduce ambiguity of the answer; "task-irrelevant" means that the information does not significantly help the current task, and retaining it mainly increases privacy exposure.

[0032] Based on the annotation results, the system obtains: ; ; ; This step forms the basis for the data minimization of this invention: necessary items are used to ensure that the task can be completed, irrelevant items are directly deleted, and auxiliary items are included in the subsequent utility scoring and privacy constraint selection.

[0033] Step 4: Rate the utility of the task aids.

[0034] For task auxiliary items set For each information unit, the system calls the client-side small language model to perform a marginal utility score. This score only evaluates the degree to which the information is helpful to the current task, and does not evaluate privacy risks. The system provides prompt words to the small language model, requiring it to output three scores for each task aid, assuming all necessary items for the task have been retained: impact of deletion, benefit of retention, and substitutability.

[0035] The "Impact of Deletion" rating indicates the degree of impact on task completion quality after deleting the task aid, scored from 0 to 6. 0 indicates virtually no impact, 1-2 indicates a slight impact, 3-4 indicates a moderate impact, and 5-6 indicates a significant impact or near-damage to task quality. The "Benefit of Retention" rating indicates the degree of improvement in the specificity, accuracy, personalization, or disambiguation capabilities of the cloud-based large language model output after retaining the task aid, scored from 0 to 5. 0 indicates virtually no benefit, 1-2 indicates a slight benefit, 3-4 indicates a significant benefit, and 5 indicates a substantial benefit. The "Substitutability" rating indicates whether the task aid has been covered by necessary or other task aids, or whether it can be replaced by lower-risk, coarser-grained information, scored from 0 to 5. 0 indicates no substitutability, 1-2 indicates difficult substitution, 3-4 indicates partial substitutability or duplication, and 5 indicates near-complete substitutability.

[0036] For a certain task auxiliary item Let the impact of its deletion be... Retained earnings are Substitutability is Then its task utility score is: ; in, , , These are non-negative weighting coefficients. Higher values ​​for deletion impact and retention benefit indicate that the information is more worthwhile to retain; higher values ​​for substitutability indicate that the information is less worthwhile to retain. In a default implementation, one could choose... , , In scenarios where task integrity is more important, performance can be improved. In scenarios where privacy and simplicity are of greater importance, it can improve... .

[0037] For any subset of task helper items Its total task utility is expressed as: ; in, This represents a redundancy penalty term, used to deduct duplicate contributions among multiple task aids. A redundancy penalty can be added if two task aids are similar in expression, or if one aid has already been covered by another lower-risk piece of information.

[0038] Step 5: Calculate cumulative privacy risks based on historical release ledgers and determine if the policy has expired. The system reads the historical release ledger of the current cloud session. This ledger records privacy-related information that has been actually sent to the cloud and is therefore visible to the cloud in historical rounds. Each record may include fields such as sent text, normalized entity, privacy category, entity type, task function type, sending round, cloud session to which it belongs, whether it is sensitive information, and whether it is an identity anchor.

[0039] The system first constructs the unavoidable disclosure set. . This represents the set consisting of historical information already sent to the cloud and the necessary items for the current task. Because... It is essential information for completing the current task, therefore if The privacy threshold has been exceeded, indicating that even if all task-related and task-assistant items are removed, the request cannot be securely completed in the current cloud session.

[0040] To ensure that the calculation of cumulative privacy risks has a clear and executable standard, this invention employs the following scoring method in one feasible implementation: The system calculates an identity identifiability score for any set of cloud-visible information X. and potential damage score .

[0041] Identity identifiability is used to measure a set The degree of narrowing down based on user identity, session identity, or a small group of people. The calculation formula is as follows: ; in, Contribute to single-item recognition, Contribute to the emergence of types, Contribution to the combination association, This is for redundancy deduction.

[0042] Before computation, the system first processes the set. The information is standardized and deduplicated. When the same entity appears repeatedly in multiple rounds, only one standardized record is retained; if one piece of information is a superordinate concept of another piece of information, such as "Beijing" being included in "a certain community in Haidian District, Beijing", the superordinate concept will be subsequently processed by redundancy reduction.

[0043] Single item recognition contribution The basic identification scores are calculated as follows: Strong direct identification information (ID card number, passport number, etc.) 8 points; Common direct identification information (real name, mobile phone number, email address, precise address) 6 points; Strong quasi-identification information (school, unit, hospital, institution name, teacher name, etc.) 3 points; Ordinary quasi-identification information (course name, department, major, occupation, district / county level location, etc.) 2 points; Weak quasi-identification information (city, broad age range, etc.) 1 point. .in, Representation of information unit The basic identification score.

[0044] For the type of contribution, statistics The number of identity clue types appearing (personal name, contact information, account, precise location, organization, educational or work role, time and place, social relationship) will each add 1 point, up to a maximum of 6 points. .in, Represents a set The number of identity clue types appearing in the process.

[0045] To determine the contribution of a combination association, points are calculated based on the combination rule table: 4 points are awarded for a real name appearing alongside a school / work unit / hospital; 5 points are awarded for a real name appearing alongside a mobile phone number / email address / precise address; 4 points are awarded for a school, course, and teacher appearing together; 3 points are awarded for a work unit, position, specific location, or specific time appearing together; 3 points are awarded for a district / county or road, specific time, and specific activity appearing together; 3 points are awarded for the appearance of three different types of quasi-identifier information; and 5 points are awarded for the appearance of five or more different types of quasi-identifier information. The system sums the combinations that meet the conditions. And set .

[0046] For redundancy deductions: When the same standardized entity appears repeatedly, 2 points will be deducted for each additional appearance, but the deduction will not exceed the basic identification score of the entity; when one piece of information is contained by another more specific piece of information, 1 to 2 points will be deducted; when two pieces of information are synonyms or aliases, the higher score will be retained and the lower score will be included in the redundancy deduction.

[0047] One possible implementation is as follows: when the same standardized entity appears repeatedly, deduct 2 points for each additional appearance, but the deduction shall not exceed the entity's basic identification score; when one piece of information is contained within another more specific piece of information, deduct 1 to 2 points; when two pieces of information are synonyms or aliases, retain the higher score, and the lower score is included in the redundancy deduction. The final identity identifiability score shall not be less than 0, that is: ; Potential damage is used to measure the set The extent of harm that information may cause once attributed to a specific individual, session identity, or small group of people. The calculation formula is as follows: ; in, Contribute to attack anchor points Contributing to inherent sensitivity, Contributes to the amplification of contextual damage. This contributes to attribution amplification.

[0048] Attack Anchor Contribution This refers to information capable of supporting real-world contact, location tracking, harassment, phishing, pressure tactics, or follow-up attacks. An executable scoring table is shown in Table 1 below: Contributions to inherent sensitivity: 1 point for general preferences, general interests, and general travel arrangements; 2 points for occupational information, general consumption records, general transaction records, and general study or work arrangements; 3 points for income range, loans, general financial situation, and minor health symptoms; 5 points for disease names, medication information, mental health status, debt difficulties, legal disputes, and judicial records; and 6 points for highly sensitive diseases, infectious diseases, sexual health, serious mental health problems, political views, religious beliefs, sexual orientation, and sensitive information related to minors. If the same sensitive item appears repeatedly, it will only be counted once; if multiple sensitive items belong to different categories, they will be scored separately. .in, Representation of information unit The inherent sensitivity score.

[0049] Contribution to amplifying contextual damage: 5 points for any sensitive information appearing together with a real name; 5 points for any sensitive information appearing together with a mobile phone number, email address, account number, or precise address; 4 points for any sensitive information appearing together with a school, workplace, hospital, or institution; 5 points for any sensitive information appearing together with a combination of school, course, and teacher; 4 points for any sensitive information appearing together with a workplace, position, contact person, or superior; 4 points for financial or legal sensitive information appearing together with contact information or account number; 3 points for health sensitive information appearing together with a specific location or time. ≤12.

[0050] For attribution amplification contribution: If X does not contain sensitive information, then =0; if it contains sensitive information, then it is based on the identity identifiability score. Bonus points for each segment: <5 points, add 0 points; 5 ≤ <8:00 adds 2 points; 8≤ Add 4 points for each hour less than 11:00; ≥11 points, add 6 points.

[0051] Threshold setting and calibration: In a default implementation, an identity identifiability threshold is set. Potential damage threshold When the application scenario is a highly sensitive one, such as in healthcare, finance, or law, a more stringent threshold can be used, for example... ; When the application scenario is a low-sensitivity scenario such as ordinary office work or general Q&A, a more lenient threshold can be used, for example... , The scoring table and default thresholds described above do not imply that this invention can only use a single set of scores, but rather provide an implementable, reproducible, and auditable method for quantifying privacy risks. Specific scores can be adjusted by system developers, deployers, or domain security personnel based on the actual scenario. During implementation, the scoring rules can be calibrated through offline threshold scanning and end-to-end verification.

[0052] System computation inevitably discloses sets Risks: , If satisfied or If the system determines that the current request has an unavoidable task-privacy conflict within the current cloud session, this determination is the failure judgment in this invention. It means that even if all task-assistant and task-irrelevant items are deleted, the combination of the necessary information for the current task and previously released content still results in an unacceptable cumulative privacy risk. In this case, the system does not send the current input to the current cloud session, but instead blocks the transmission on the client side, prompting the user to modify the request, delete or generalize some of the necessary task information, or choose to create a new isolated session.

[0053] like and If the combination of previously released content and the necessary items for this round of tasks is still within the privacy threshold, the system will continue to select task auxiliary items.

[0054] Step 6: Select the minimum release set and generate the minimum input under privacy constraints.

[0055] If step five does not trigger the failure check, the system will retrieve the task auxiliary items from the set. Select the subset to keep. The system selects a subset of auxiliary items that have the highest task utility and meet privacy threshold constraints. and satisfy and When the number of task aids is small, the system can enumerate all subsets and select the subset that satisfies the constraints and has the highest utility. When the number of task aids is large, the system can use a greedy algorithm, dynamic programming, or heuristic search. For example, it can try to add aids in turn according to the ratio of "utility increment / risk increment", and skip if the threshold is exceeded.

[0056] Ultimately, the set of information allowed to be released in this round is: The set of information that should be deleted or generalized is: .

[0057] The system then invokes the client-side small language model to perform minimal text rewriting. The rewriting prompts require the small language model to only perform rewriting, not to answer user questions or perform user tasks; these prompts must be retained. The information in the document must be deleted, generalized, or replaced. The information in the original text must be complete; new facts not existing in the original text must not be added; deleted content must not be reintroduced through synonyms. The rewritten text is the minimum input for this round. .

[0058] Sending Beforehand, the system performs three types of checks: First, checks... Does the information still appear in Second, check the necessary items for the task. Whether it is retained or retained in an equivalent, low-risk manner; third, check. Does it still convey the original task intent without adding new facts? If the verification fails, the message will be rewritten or transmission will be blocked. If the verification passes, the system will... Send to the cloud-based large language model.

[0059] when After successful transmission, the system updates the historical release ledger: Deleted, generalized to the point of being unrecognizable, or unsent information is not written to the ledger. When the next round of user input arrives, the system... Continue executing the above process, thereby forming a multi-round closed-loop data minimization control. Among these, Indicates the first The historical ledger is released after each round of input. Deleted, generalized to an unrecognizable level, or unsent information is not written to the ledger. When the next round of user input arrives, the system... Continue executing the above process to form a multi-round closed-loop data minimization control.

[0060] By employing the above method, this invention combines the semantic understanding capabilities of a small-scale language model on the edge with deterministic risk constraints, achieving data minimization before transmission under task constraints. This method can identify and segment privacy information in user input, determine the role of each information unit in the current task, calculate the marginal value of task-aiding information, and, in conjunction with historically released content, determine whether the current round will cause cumulative privacy risks. Ultimately, the system only sends essential task information and highly efficient task-aiding information permissible by privacy thresholds to the cloud, thereby reducing the risk of content-level cumulative privacy leakage in multi-round cloud-based large-scale language model conversations.

[0061] The following describes the processing procedure of the present invention using a multi-turn Chinese dialogue scenario.

[0062] In the first round, the user entered: "Please write a WeChat message for me to Wang Lei, saying that I just came back from near Zhichun Road in Haidian District, Beijing, and asking if he is free to have dinner this Friday night. Sign it Li Ming." The edge-side small language model identifies privacy-related entities: "Wang Lei", "near Zhichun Road, Haidian District, Beijing", and "Li Ming". Task requirements analysis: Draft a message to Wang Lei, including recipient, message purpose, and signature. "Near Zhichun Road, Haidian District, Beijing" is marked as task-irrelevant. Minimum input is generated: "Write a WeChat message to Wang Lei asking if he's free for dinner this Friday night, signed 'Li Ming'." After sending, the historical ledger records "Wang Lei" and "Li Ming" are released.

[0063] In the second round, the user entered: "I'm very worried about the risk of HIV infection recently. I had a test done near the city's infectious disease hospital a few days ago. If I am infected with HIV, is it treatable now, and what precautions should I take in my daily life?" Identify privacy-related entities: "HIV infection risk", "HIV", "near the municipal infectious disease hospital", "a few days ago". Task requirement analysis: Consulting on HIV treatment and precautions; the essential information is the disease topic. "Near the municipal infectious disease hospital" and "a few days ago" are task-irrelevant items. Generate minimal input: "I want to know about the treatment possibilities after HIV infection, and general precautions in daily life." After sending, the historical release ledger is updated with "HIV-related health consultations".

[0064] In the third round, the user entered: "Please help me check the leave application process of the School of Computer Science at Jiangcheng University, and write a leave application letter to Professor Zhang, my teacher of the 'Computer Networks' course, saying that I am not feeling well and may need to go for a check-up." Identify privacy-sensitive entities: "Jiangcheng University", "School of Computer Science", "Computer Networks Course", "Professor Zhang", "Feeling unwell", "Follow-up examination". Task requirement analysis: Inquire about the leave application process and write a leave application explanation. Necessary information includes the school name and the recipient's teacher information. Construct an unavoidable disclosure set G_3 = S_3 ∪ B_3 = {Wang Lei, Li Ming, HIV consultation, Jiangcheng University, Professor Zhang}. The system calculates identity identifiability and potential harm, and finds that H(G_3) exceeds the threshold. The system determines that there is an unavoidable task-privacy conflict, blocks the transmission on the client side, and prompts the user: "The current session already contains sensitive health consultation content. This round of requests requires sending identity clues such as school, course, or teacher. The combination of the two may lead to health information being associated with a specific individual or a small group of people. It is recommended to delete some identity information, rewrite the request, or create a new isolated session and continue."

[0065] After creating a new isolation session, it is still necessary to re-enter the data minimization process.

[0066] This embodiment illustrates that the core function of the present invention is not to mechanically delete all sensitive information, but to maintain the historical state of the actual visible content in the cloud between different rounds, and to determine before sending whether the information required for the current round of tasks will form an unacceptable cumulative privacy risk with the historical sensitive information.

[0067] In an experimental implementation of this invention, the edge-side small language model uses qwen3:4b. In task utility evaluations on the MedQA and PUPA datasets, the system retains approximately 99.0% and 99.2% of the information necessary for the task, respectively, while the retention rates of information irrelevant to the task decrease to approximately 2.0% and 6.4%, respectively. In multi-round semantic association attack evaluations, after adopting a historical release ledger and dual-axis risk constraints, the cumulative link risk decreased from 0.717 to 0.484, and the cumulative sensitive attribution risk decreased from 0.580 to 0.238; the earliest occurrence round of identity attribution was delayed from 1.000 to 3.699, and the earliest occurrence round of sensitive attribution was delayed from 4.418 to 6.446. This demonstrates that this invention can reduce unnecessary privacy content visible in the cloud while maintaining basic task usability, and weaken the content-level cumulative association risk in multi-round sessions.

[0068] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A session cumulative privacy leakage control method based on minimizing end-side data, characterized in that, include: Obtain the user's original input in the t-th round and intercept the user's original input on the user's device side, where t is a positive integer; The user's original input is subjected to privacy-related entity identification and task requirement analysis to obtain a set of candidate privacy information and the task requirements of the current task. Based on the task requirements, each information unit in the candidate privacy information set is divided into a set of task-required items, a set of task-aided items, or a set of task-irrelevant items. Read the historical release ledger of the current cloud session, wherein the historical release ledger is used to record privacy-related information that has been actually sent to the cloud large language model up to round t-1; Construct an inevitable disclosure set, which is the union of the historical release ledger and the task requirement set; Calculate the cumulative privacy risk of the unavoidable disclosure set; Determine whether the accumulated privacy risks exceed a preset privacy threshold. If they do, determine that the current request has an irreversible task-privacy conflict and execute an invalidation process. If the threshold is not exceeded, then select a subset from the set of task aids that satisfies the preset privacy threshold constraint and has the highest task utility. Based on the subset, a minimized user input is generated and sent to the cloud-based large language model. The minimized user input retains information from the task-required items set and the subset, and removes unselected information from the task-irrelevant items set and the task-auxiliary items set.

2. The method according to claim 1, characterized in that, Based on the task requirements, each information unit in the candidate privacy information set is divided into a set of task-required items, a set of task-auxiliary items, or a set of task-irrelevant items, including: Each information unit in the candidate privacy information set is atomically split to obtain atomic information units; The task requirements and the user's original input are input into the edge-side small language model, and the edge-side small language model labels the task function type for each atomic information unit. The task function type includes task-required, task-assisted, or task-irrelevant. Among them, "task-essential" means that the information unit is indispensable for completing the current task; "task-aiding" means that the information unit is not essential but helps to complete the task; and "task-irrelevant" means that the information unit is of no help to the current task.

3. The method according to claim 1, characterized in that, The information recorded in the historical release ledger includes at least one of the following: sent text, normalized entity, privacy category, entity type, task function type, sending round, cloud session identifier, whether it is sensitive information, and whether it is an identity anchor. Furthermore, information in the user's original input that has been deleted or generalized to an unrecognizable degree by the client side is not written into the historical release ledger.

4. The method according to claim 1, characterized in that, Calculating the cumulative privacy risk of the unavoidable disclosure set includes: Calculate the identity identifiability score and potential harm score for the unavoidable disclosure set; The identity identifiability score is used to quantify the degree to which the unavoidable disclosure set narrows down the user's identity. The identity identifiability score is calculated based on the basic identification score of the information in the unavoidable disclosure set, the richness of identity clue types, and the additional identification ability brought about by the combination of information. The potential damage score is used to quantify the degree of damage that may be caused once the inevitable disclosure set is attributed. The calculation of the potential damage score is based on the attack anchors, inherent sensitivity, combined amplification effect of sensitive information and identity clues in the inevitable disclosure set, as well as the attribution amplification effect. The preset privacy thresholds include an identity identifiability threshold and a potential harm threshold.

5. The method according to claim 4, characterized in that, Determine whether the accumulated privacy risks exceed a preset privacy threshold. If they do, determine that the current request has an irreversible task-privacy conflict and execute invalidation processing, specifically: If the identity identifiability score is greater than the identity identifiability threshold, or the potential harm score is greater than the potential harm threshold, then an invalidation is triggered. The failure handling includes: blocking the sending of the current request and prompting the user to modify the input or create a new isolation session.

6. The method according to claim 4, characterized in that, Select a subset from the set of task aids that satisfies the preset privacy threshold constraint and has the highest task utility, including: For any task assist item in the set of task assist items Its task utility score is calculated by the following formula: ,in, To remove the score for the degree of impact of this auxiliary item on the quality of task completion, To retain the score for the improvement in task quality provided by this auxiliary item, Rate the substitutability of this auxiliary item. These are non-negative weighting coefficients; For any candidate subset of the set of task aids, its total task utility is the sum of the task utility scores of all task aids in the candidate subset minus the redundancy penalty term. A candidate subset is selected if it satisfies the following conditions: the identity identifiability score of the union of the candidate subset and the inevitable disclosure set is not greater than the identity identifiability threshold, the potential harm score of the union is not greater than the potential harm threshold, and the total task utility of the candidate subset is the maximum value among all candidate subsets that satisfy the conditions.

7. The method according to claim 1, characterized in that, Generating minimized user input and sending it to the cloud-based large language model includes: The client-side small language model is invoked to perform minimal text rewriting. The rewriting constraints are: information in the set of required items for the task and the selected subset must be retained; information not selected in the set of task-irrelevant items and the set of task-aided items must be deleted or generalized; and new facts that do not exist in the original text must not be added. Before sending the minimized user input, the minimized user input is validated, including checking whether information that should be deleted still appears, checking whether task-required items are retained, and checking whether the minimized user input still expresses the original task intent. After successful verification, the minimized user input is sent to the cloud-based large language model.

8. The method according to claim 1, characterized in that, The method further includes: After the minimized user input is successfully sent, the historical release ledger is updated. The updated historical release ledger is set as the union of the previous historical release ledger and the set of information allowed to be released, wherein the set of information allowed to be released is the union of the set of task requirements and the selected subset. Deleted, generalized, or unsent information is not written to the updated historical release ledger.

9. The method according to claim 1, characterized in that, The method is executed through an edge data minimization control layer deployed on the user equipment side, which includes an edge small language model and a deterministic risk control module; The edge-side small language model is used to perform at least one of the following semantic understanding tasks: privacy entity recognition, task requirement analysis, privacy entity atomization, task relevance judgment, task auxiliary item utility scoring, and minimizing text rewriting; The deterministic risk control module is used to perform at least one of the following deterministic computation tasks: maintaining the historical release ledger, calculating cumulative privacy risks, performing threshold judgment, and solving for the set of information allowed to be released.

10. A session cumulative privacy leakage control system based on minimizing end-side data, characterized in that, The system is used to perform the method according to any one of claims 1-9, the system comprising: An input acquisition module is used to acquire the user's original input in the t-th round and intercept the user's original input on the user device side; The privacy and task analysis module is used to identify privacy-related entities and analyze task requirements from the user's original input to obtain a set of candidate privacy information and the task requirements of the current task. The information classification module is used to divide each information unit in the candidate privacy information set into a set of task-required items, a set of task-aided items, or a set of task-irrelevant items according to the task requirements. The historical ledger maintenance module is used to read and maintain the historical release ledger of the current cloud session, wherein the historical release ledger is used to record privacy-related information that has been actually sent to the cloud large language model up to round t-1; The cumulative risk assessment module is used to construct an unavoidable disclosure set and calculate the cumulative privacy risk of the unavoidable disclosure set, wherein the unavoidable disclosure set is the union of the historical release ledger and the task requirement set; The failure judgment and processing module is used to determine whether the cumulative privacy risk exceeds a preset privacy threshold. If it does, it determines that the current request has an irremovable task-privacy conflict and performs failure processing. The auxiliary item selection module is used to select a subset from the task auxiliary item set that satisfies the preset privacy threshold constraint and has the highest task utility when no failure handling is triggered. The minimized input generation module is used to generate minimized user input based on the task required item set and the selected subset and send it to the cloud-based large language model. The minimized user input retains information from the task required item set and the subset, and deletes or generalizes information that was not selected from the task irrelevant item set and the task auxiliary item set.

Images