Privacy information protection method, apparatus, device, storage medium, and program product

Abstract

The application relates to a privacy information protection method, device, equipment, storage medium and program product. The method comprises the following steps: obtaining first desensitization data corresponding to original data, the original data corresponding to a privacy demand parameter, the privacy demand parameter being used for determining a first perturbation function, the first perturbation function being used for perturbing data in each dimension of the original data to obtain first perturbation data, and the first desensitization data being obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to a value range of the corresponding dimension; perturbing the data in each dimension of the first perturbation data by using a second perturbation function to obtain second perturbation data; and constraining the data in each dimension of the second perturbation data to the value range of the corresponding dimension by using the constraint function to obtain second desensitization data, wherein the first desensitization data and the second desensitization data are used for determining a target loss function and a training model. The method can widen the applicable application scenarios.

Description

Technical Field

[0001] This application relates to the field of privacy protection technology, and in particular to a method, apparatus, device, storage medium, and program product for protecting privacy information. Background Technology

[0002] In the fields of differential privacy machine learning and privacy-preserving data analysis, related technologies can limit the impact of individual samples on the analysis results by introducing random noise during model training or data analysis.

[0003] For differential privacy learning methods based on stochastic gradient descent, such as Noisy-SGD (Noisy Stochastic Gradient Descent), the privacy protection mechanism usually involves pruning the gradient and adding noise during model training.

[0004] Because the Noisy-SGD method consumes a privacy budget during each model training or parameter update, the specific analysis task and loss function form need to be determined in advance before practical application. Once the model training is complete, if the analyst wants to perform a new analysis task or use a different loss function on the same dataset, the training process usually needs to be rerun, consuming additional privacy budget. However, due to privacy protection, the number of times the privacy budget is consumed on the same dataset needs to be limited. Therefore, the Noisy-SGD method is difficult to meet the need for multiple, flexible analyses of the same dataset, resulting in significant limitations in application scenarios with diverse analysis requirements or dynamically changing tasks. Furthermore, since some data can easily deviate from the range of real data after adding noise, analysts may doubt the data and refuse to use it, further limiting its application scenarios. Summary of the Invention

[0005] Therefore, it is necessary to provide a privacy information protection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can broaden the applicable application scenarios to address the above-mentioned technical problems.

[0006] On one hand, this application provides a privacy information protection method, comprising: obtaining first de-identified data corresponding to original data, wherein the original data corresponds to privacy requirement parameters, the privacy requirement parameters are used to determine a first perturbation function, the first perturbation function is used to perturb the data in each dimension of the original data to obtain first perturbation data, the first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension, and the original data contains privacy information; perturbing the data in each dimension of the first perturbation data using a second perturbation function to obtain second perturbation data, the second perturbation function being determined according to the privacy requirement parameters; constraining the data in each dimension of the second perturbation data to the value range of the corresponding dimension using the constraint function to obtain second de-identified data, the first de-identified data and the second de-identified data being used to determine a target loss function and a training model.

[0007] On the other hand, this application also provides a privacy information protection device, comprising: a data acquisition module, used to acquire first de-identified data corresponding to original data, wherein the original data corresponds to privacy requirement parameters, the privacy requirement parameters are used to determine a first perturbation function, the first perturbation function is used to perturb the data in each dimension of the original data to obtain first perturbation data, the first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension, and the original data contains privacy information; a data perturbation module, used to perturb the data in each dimension of the first perturbation data using a second perturbation function to obtain second perturbation data, the second perturbation function being determined according to the privacy requirement parameters; and a data constraint module, used to use the constraint function to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain second de-identified data, wherein the first de-identified data and the second de-identified data are used to determine a target loss function and a training model.

[0008] On the other hand, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described privacy information protection method.

[0009] On the other hand, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described privacy information protection method.

[0010] On the other hand, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described privacy information protection method.

[0011] The aforementioned privacy information protection method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire first de-identified data corresponding to the original data. The original data corresponds to privacy requirement parameters, which are used to determine a first perturbation function. The first perturbation function is used to perturb the data in each dimension of the original data to obtain first perturbation data. The first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension. The original data contains privacy information. A second perturbation function is used to perturb the data in each dimension of the first perturbation data to obtain second perturbation data. The second perturbation function is determined according to the privacy requirement parameters. The constraint function is used to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain second de-identified data. The first and second de-identified data are used to determine the target loss function and train the model. Since the training process does not require access to the original data or additional privacy budget, both the first and second anonymized data sets can be reused. This makes them suitable for training different models for different analytical tasks and applicable to scenarios with diverse analytical needs or dynamically changing tasks, thus broadening the application scenarios applicable to privacy protection methods. Furthermore, because the first anonymized data set is obtained by constraining the data in each dimension of the first perturbation data to the corresponding value range using constraint functions, and the second anonymized data set is obtained by constraining the data in each dimension of the second perturbation data to the corresponding value range using constraint functions, the data in each dimension of both the first and second anonymized data sets satisfy the value range requirements for each dimension. Therefore, while protecting the privacy information in the original data as much as possible, the reliability of both the first and second anonymized data sets can be guaranteed. This solves the problem of data deviating from the true data range after adding noise, thereby broadening the application scenarios. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a diagram illustrating the application environment of a privacy information protection method in one embodiment;

[0014] Figure 2 This is a flowchart illustrating a privacy information protection method in one embodiment;

[0015] Figure 3This is a schematic diagram illustrating the principle of generating the second desensitized data in one embodiment;

[0016] Figure 4 This is a structural block diagram of a privacy information protection device in one embodiment;

[0017] Figure 5 This is an internal structural diagram of a computer device in one embodiment;

[0018] Figure 6 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0021] In the field of differential privacy machine learning, Noisy-SGD (also known as Differential Privacy Stochastic Gradient Descent, DP-SGD) is a privacy-preserving model training method. The basic idea of ​​this type of method is to introduce random noise into each stochastic gradient update during model training, thereby limiting the impact of individual samples on model parameter updates and achieving differential privacy.

[0022] The Noisy-SGD method typically involves randomly sampling a mini-batch of samples from the training data and calculating the gradient of each sample during each round of model parameter updates. To prevent excessively large gradients from leading to privacy risks, the Noisy-SGD method first prunes the gradient of each sample to limit its norm. Then, it aggregates the pruned gradients and adds random noise to the aggregated gradients. Finally, it uses the noisy gradients to update the model parameters. By continuously introducing noise throughout multiple iterations, the given differential privacy constraints are ensured throughout the training process.

[0023] For example, the dataset used for training is... The model parameters are The goal is to minimize the empirical risk function:

[0024]

[0025] Where N is the dataset The number of samples in the middle For the dataset The i-th sample, For the i-th sample, the true label or target value is... For single-sample loss function, Let be a D-dimensional real vector space. In the ... In the next iteration of training, the Noisy-SGD algorithm uses the dataset... A small batch of samples is randomly selected from the data. And calculate the gradient for each sample in the batch:

[0026]

[0027] To limit the impact of a single sample on gradient updates, a gradient pruning operation is performed:

[0028]

[0029] in The preset clipping threshold is then used. Subsequently, the clipped gradients are averaged, and random noise is introduced at the gradient level:

[0030]

[0031] Among them, noise item It is usually taken as zero-mean Gaussian noise: , This is a noise scale parameter used to control the strength of privacy protection. Let be a d×d identity matrix. Finally, the model parameters are updated according to the stochastic gradient descent rule:

[0032]

[0033] in, This is the learning rate.

[0034] By introducing pruning and noise in each gradient update process and combining it with cumulative analysis of privacy loss over multiple iterations, the Noisy-SGD algorithm can satisfy the overall requirements. - Differential privacy requirements.

[0035] Furthermore, in statistical learning and parameter estimation problems involving measurement errors or data perturbations, deconvolution methods are a classic error correction technique. These methods typically assume that the observed data consists of a superposition of real data and random noise. By modeling the noise distribution and inverting the noise's impact during the estimation process, they recover the statistics relevant to the real data.

[0036] Within the framework of machine learning and empirical risk minimization, deconvolution methods typically eliminate systematic biases introduced by noise by correcting the loss function. However, these methods often require the loss function or its related functions to possess a certain degree of smoothness. Furthermore, the deconvolution process usually involves integration, Fourier transforms, or numerical inversion, which can be computationally expensive and challenging to implement in high-dimensional or complex models.

[0037] Deconvolution methods typically require differentiation or integration of the loss function, introducing high computational complexity when constructing the correction loss function. In high-dimensional parameter spaces or complex model structures, this significantly increases computational overhead, reduces optimization efficiency, and makes them inconvenient to deploy and use in engineering implementations. Furthermore, these methods often place strong demands on the smoothness of the loss function; their applicability is limited when the loss function has discontinuous or non-differentiable structures.

[0038] In summary, existing differential privacy learning methods and error correction methods still have shortcomings in terms of analytical task flexibility, computational efficiency, and adaptability to loss function forms. Therefore, there is an urgent need for a new technical solution that, while meeting the requirements of differential privacy protection, decouples data publication from subsequent analysis, supports multiple and flexible analyses of the same privacy-protected data (e.g., anonymized data), and minimizes complex differentiation or integration operations to reduce computational costs and improve the convenience of practical applications.

[0039] Based on this, this application provides a method for protecting privacy information. The privacy information protection method provided in this application can be applied to, for example... Figure 1 In the illustrated application environment, the environment includes a first device 102, a server 104, and a second device 106. The first device 102, server 104, and second device 106 communicate via a network. A data storage system can store the data that the server 104 needs to process. The data storage system can be integrated onto the server 104 or located on a cloud or other network server. The data storage system can be a database. The first device 102 can be a device owned by the holder of the original data, and the second device 106 can be a device owned by the analyzer performing the data analysis.

[0040] In an exemplary embodiment, the first device 102 displays a data collection page, which includes a privacy requirement setting area. Based on the privacy requirement information set within this area, the first device 102 determines privacy requirement parameters, perturbs the raw data collected by the data collection page using these parameters, and obtains first perturbation data. This first perturbation data is then sent to a server 104. The server 104 stores the first perturbation data and can constrain the data in each dimension of the first perturbation data to the corresponding dimension's value range to obtain first de-identified data. Alternatively, the first de-identified data can also be generated by the first device 102 and sent to the server 104.

[0041] The privacy requirement information may include privacy protection level information, which indicates the level of privacy protection. Different privacy protection levels require different levels of protection. The privacy requirement information may also include sub-levels corresponding to the privacy protection level. The same privacy protection level can correspond to multiple sub-levels, each requiring different levels of protection; for example, multiple sub-levels could be "strong," "medium," and "weak." Each sub-level under a privacy protection level can correspond to privacy requirement parameters. For example, if the privacy protection level is determined to be the first privacy protection level and the sub-level is "strong" based on the privacy requirement information, then the privacy requirement parameters corresponding to the "strong" sub-level under the first privacy protection level can be queried. The privacy requirement parameters corresponding to the same sub-level under different privacy protection levels can be the same or different. The first device 102 can query the privacy requirement parameters corresponding to the sub-level from the server 104, use the privacy requirement parameters corresponding to the sub-level to determine the first perturbation function, and use the first perturbation function to perturb the original data to obtain the first perturbed data. The data collection page may be, but is not limited to, a page for filling out a questionnaire, a page for publishing data, a page for uploading data, a page for providing feedback, etc. Of course, it is also possible to have a privacy protection level corresponding to a privacy requirement parameter, and obtain the corresponding privacy requirement parameter based on the privacy protection level.

[0042] The first terminal 102 can use a second perturbation function to perturb the first perturbation data to obtain second perturbation data. The second perturbation function is determined according to privacy requirement parameters. Furthermore, the first terminal 102 can use a constraint function to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain second de-identified data. The first terminal 102 can send the first de-identified data and the second de-identified data to the server 104, and the server 104 can store the first de-identified data and the second de-identified data.

[0043] In an exemplary embodiment, the first device 102 can send privacy requirement information and raw data to the server 104. The server 104 determines privacy requirement parameters based on the privacy requirement information, uses a first perturbation function determined by the privacy requirement parameters to perturb the raw data to obtain first perturbation data, stores the first perturbation data, and generates first desensitized data based on the first perturbation data.

[0044] In an exemplary embodiment, server 104 can perturb the first perturbation data to obtain second perturbation data. Server 104 can constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain second de-identified data, and store the second de-identified data. It can also establish a correlation between the first de-identified data and the second de-identified data. Second device 106 can obtain the first de-identified data and / or the second de-identified data from the server. Alternatively, second device 106 can obtain the first perturbation data from server 104, perturb the first perturbation data to obtain the second perturbation data, and further generate the second de-identified data. Second device 106 can perform model training based on the first de-identified data and the second de-identified data. The model can be, but is not limited to, classification, clustering, or regression models.

[0045] For example, the first perturbation data is generated by perturbing the original data using a first perturbation function. The feature function of the first perturbation function includes privacy requirement parameters corresponding to the original data. The privacy requirement parameters and the original data originate from the holder of the original data. The server 104 or the second device 106 can perturb the first perturbation data using a second perturbation function to obtain the second perturbation data. The feature function of the second perturbation function includes privacy requirement parameters. The second device 106 can train a model using the first de-identified data and the second de-identified data. During training, a target loss function is determined based on the first and second de-identified data, and the model parameters are adjusted using the target loss function. The target loss function satisfies the unbiased property.

[0046] The first device 102 and the second device 106 can be devices or servers. Devices can be, but are not limited to, various personal computers, laptops, smartphones, and tablets. Server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0047] In one exemplary embodiment, such as Figure 2 As shown, a privacy information protection method is provided. This method can be executed by server 104 or the second device 106 of the analyzer, or it can be jointly executed by server 104 and the second device 106 of the analyzer. This method can be applied to... Figure 1Taking server 104 as an example, the following steps are included:

[0048] Step 202: Obtain the first de-identified data corresponding to the original data. The original data has privacy requirement parameters, which are used to determine the first perturbation function. The first perturbation function is used to perturb the data in each dimension of the original data to obtain the first perturbation data. The first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension. The original data contains privacy information.

[0049] The first perturbation function can be random noise, such as zero-inflated symmetric multivariate Laplace (ZIL) noise, or other symmetric or mixed noise that meets differential privacy requirements. The characteristic function of the first perturbation function can be called the first characteristic function. Perturbation values ​​can be generated using the first characteristic function, and these values ​​can be used for perturbation. "Perturbation" can be understood as adding noise. The first perturbation function can be used to directly perturb the data in the original data, or it can be used to indirectly perturb the data in the original data. For example, the data can be compressed first, and then the first perturbation function can be used to perturb the compressed data.

[0050] The raw data may contain sensitive information, such as data from the financial, medical, or other sectors. Raw data may also contain personal privacy or trade secrets. For example, raw data may include spending records, loan records, medical diagnostic records, or unpublished source code, etc.

[0051] The original data corresponds to privacy requirement parameters from the holder of the original data. Privacy requirement parameters may include a first parameter. Second parameter First parameter The second parameter is used to constrain the strength of privacy protection. This is a relaxation term. For example, the privacy requirement parameter can include... -DP algorithm or Privacy Budget in CDP Algorithms and relaxation term relaxation term This is an additive relaxation term. DP is an abbreviation for differential privacy. CDP is an abbreviation for componentwise differential privacy.

[0052] A mechanism (Algorithm or function) satisfies The condition for DP is: For any set and any adjacent datasets and It is established if and only if and The only difference is that when it comes to data from a single user, the dataset... and This is called a neighboring dataset.

[0053] If an algorithm satisfies -DP, so if anyone tries to guess whether a certain person exists in the dataset based on the algorithm's output, the probability of them guessing incorrectly is at least 1 / 3. The higher the error probability, the better the privacy protection. If the error probability is 0, it means that if someone is in the dataset, the analyst can always confirm that person's presence in the dataset, which violates privacy. The larger, The larger the value, the lower the probability of error and the worse the level of privacy protection, and vice versa.

[0054] A mechanism (Algorithm or function) satisfies The conditions for CDP are: For any set Adjacent datasets at any element level It is established if and only if and The only difference is that when a user has only one attribute value, the dataset... and This is called an element-level adjacency dataset. It means belong The probability of. It means belong The probability. The dataset includes user privacy data for multiple different users, and each user privacy data includes data from multiple dimensions.

[0055] If an algorithm satisfies -CDP means that if anyone tries to guess the value of a certain attribute of a person in the dataset based on the algorithm's output, the probability of them guessing incorrectly is at least 1 / 3. The higher the error probability, the better the privacy protection. If the error probability is 0, it means that when a person is in the dataset, the analyst can always confirm the values ​​of all of that person's attributes, which violates element-level differential privacy.

[0056] Exemplarily, the privacy requirement parameter may be set by the holder, or may be determined according to the information set by the holder. For example, the privacy requirement parameter may be determined according to the privacy requirement information provided by the holder. The privacy requirement information may include privacy protection level information, where the privacy protection level information is used to indicate a privacy protection level, different privacy protection levels require different degrees of protection, and different privacy protection levels may correspond to different privacy requirement parameters. For example, for different privacy protection levels, at least one of the first parameter and the second parameter is different.

[0057] Alternatively, different privacy protection levels may correspond to different differential privacy algorithms, the same privacy protection level may correspond to multiple sub-levels, and different sub-levels require different protection strengths. For example, the multiple sub-levels are three levels of "strong", "medium" and "weak" respectively. The sub-levels may correspond to privacy requirement parameters. For example, "strong" corresponds to , "medium" corresponds to and "weak" corresponds to , ≤ ≤ , s value is much smaller than 1, for example may be less than 1 / n, for example, may be 0.01. The privacy requirement information may further include identification information of a target sub-level selected from the multiple sub-levels. The privacy requirement parameter corresponding to the original data may be the privacy requirement parameter corresponding to the sub-level.

[0058] In an exemplary embodiment, the original data includes , and at least one of; is dimensional discrete data, is a positive integer and represents the dimensionality of the discrete data , the j-th component in , represents an integer set from 0 to , is a positive integer; is dimensional bounded data, is a positive integer, the j-th component in , is the lower limit of the interval , is the upper limit of the interval ; is dimensional unbounded data, The integer is positive; the method also includes at least one of the following:

[0059] The constraint function includes a rounding function, and the first desensitized data includes first rounded data. The first rounded data is obtained by rounding the first initial perturbation data using the rounding function. The first initial perturbation data is obtained by rounding the first perturbation data using the first perturbation function. The perturbation generation function is used to round the j-th component in the first initial perturbation data to the nearest integer. ;or,

[0060] The constraint function includes a projection function, and the first desensitized data includes first projected data. The first projected data is obtained by projecting the second initial perturbation data using the projection function. The second initial perturbation data is obtained by projecting the second initial perturbation data using the first perturbation function. The perturbation is generated, and the projection function is used to project the j-th component in the second initial perturbation data onto... ;or,

[0061] The constraint functions include a first compression function, a second compression function, and a decompression function; the first compression function is used to... Compression is performed to obtain first compressed data. A second compression function is used to compress third initial perturbation data to obtain second compressed data. The third initial perturbation data is obtained by perturbing the first compressed data using the first perturbation function. A decompression function is used to decompress the second compressed data to obtain first decompressed data. The first desensitized data includes the first decompressed data.

[0062] in, Determine based on the actual situation, for example This indicates the patient's gender; there are two genders, therefore... , The value can be 0 or 1, with 0 and 1 representing different genders.

[0063] For example, raw data yes Dimensional data. It is user data, data whose privacy needs to be protected. It is the total dimension of the original data. This represents the transpose. The j-th component is the data in the j-th dimension. The first perturbation function is used to... To perform a perturbation is to use the first perturbation function as... For each dimension of the data, a corresponding perturbation value is generated, and this perturbation value is used to perturb the data in that dimension. For example, for data in j dimensions... Generate perturbation value Using perturbation values Data Perturbation to obtain .

[0064] Similarly, using the first perturbation function to... To perform a perturbation is to use the first perturbation function as... For each dimension of the data, a corresponding perturbation value is generated, and this perturbation value is used to perturb the data in that dimension. For example, for data in j dimensions... Generate perturbation value Using perturbation values Data Perturbation to obtain .

[0065] For example, the rounding function is: , The domain is Independent variable , represent 3D real space, Used to determine the independent variable Data in the j-th dimension Rounding to the set of integers An integer in the set of integers, that is, an integer from the set of integers. Select one from The nearest integer, if there exist two integers that are both far from the nearest integer. Recently, Rounding to the larger of the two values. Rounding the initial perturbation data using a rounding function means rounding the data in each dimension of the initial perturbation data separately. For example, rounding the data in the j-th dimension of the initial perturbation data... Rounding to the nearest integer The first rounded data can be represented as... , Include .

[0066] For example, the projection function is , The domain is Independent variable , represent 3D real space, Used to Data in the j-th dimension Projection (i.e., mapping) to interval For example, if Greater than The projection is ,if Less than The projection is ,if ,but Projection as (i.e., maintain) (Unchanged). Projecting the second initial disturbance data using a projection function means projecting the data in each dimension of the second initial disturbance data separately using the projection function. For example, projecting the data in the j-th dimension of the second initial disturbance data... Projection The first projection data can be represented as... , Include .

[0067] For example, the first compression function compresses unbounded data into bounded data. The first compression function is: , Independent variables , For all real numbers. Using the first compression function on... Compression refers to using the first compression function to compress... The data in each dimension is compressed separately. For example, the first compression function is used to compress the data in each dimension. Data in the j-th dimension Compression is performed separately. Therefore, the first compressed data includes data compressed using the first compression function. The results are obtained by compressing each dimension separately. The first compressed data can be represented as... The first perturbation function is used to generate perturbation values ​​for each dimension of the data in the first compressed data. These perturbation values ​​are then used to perturb the data in the corresponding dimension, resulting in perturbed data for each dimension of the first compressed data. The third initial perturbation data contains the perturbed data for each dimension of the first compressed data. For example, The corresponding disturbance value is Then the perturbated data in the j-th dimension is .

[0068] For example, the second compression function is used to compress components that may exceed [a certain value] due to perturbation. Bounded data in intervals compressed back The interval. The second compression function is... That is, when Independent variables hour, = ;when hour, ;when When, equal to Compressing the third initial perturbation data using the second compression function means compressing the data in each dimension of the third initial perturbation data separately using the second compression function. For example, compressing the data in the j-th dimension of the third initial perturbation data using the second compression function. Compress to obtain .

[0069] For example, the decompression function is . This is the independent variable of the decompression function. Decompressing the second compressed data using the decompression function means decompressing the data in each dimension of the second compressed data separately using the decompression function. For example, using the decompression function... right Decompress to obtain The first decompressed data can be represented as... , Include Therefore, the first de-identified data .

[0070] In this embodiment, it can be ensured that the discrete and bounded data contained in the first de-identified data are within the original value range, which can reduce the concerns of privacy mechanism users about the data used.

[0071] Step 204: Perturb the data in each dimension of the first perturbation data using the second perturbation function to obtain the second perturbation data. The second perturbation function is determined according to the privacy requirement parameters.

[0072] The second perturbation function is random noise. The characteristic function of the second perturbation function can be called the second characteristic function. Perturbation can be performed using the perturbation values ​​generated by the second characteristic function. The second perturbation function can also be random noise with zero mean or symmetry.

[0073] In an exemplary embodiment, the privacy requirement parameters include a first parameter and a second parameter. The first parameter constrains the strength of privacy protection, and the second parameter is a relaxation term. The characteristic functions of the first and second perturbation functions include a first perturbation parameter and a second perturbation parameter, where the second perturbation parameter is the second parameter, and the first perturbation parameter is determined based on the first and second parameters. The first perturbation parameter can be used... This indicates that the larger the first perturbation parameter, the greater the perturbation to the data caused by the first perturbation function and the second perturbation function. In this embodiment, the first perturbation parameter and the second perturbation parameter are determined by the privacy requirement parameter, thereby enabling control over the degree of privacy protection.

[0074] In an exemplary embodiment, the characteristic functions of the first perturbation function and the second perturbation function satisfy characteristic function constraint conditions, which include:

[0075]

[0076] in, , , For the second parameter, This is the characteristic function of the first perturbation function. This is the characteristic function of the second perturbation function. . Let m be a real vector. Let be an m-dimensional real vector space.

[0077] For example, one can search for characteristics that satisfy the characteristic function constraints. and The characteristic function constraint conditions will be satisfied. and , which serve as the characteristic functions of the first perturbation function and the second perturbation function, respectively.

[0078] For example, the characteristic function of the first perturbation function can be:

[0079]

[0080] For example, the characteristic function of the second perturbation function can be:

[0081]

[0082] In this embodiment, the characteristic function constraint condition provides a basis for determining the characteristic functions of the first noise and the second noise.

[0083] Step 206: Use constraint functions to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain the second desensitized data. The first desensitized data and the second desensitized data are used to determine the target loss function and train the model.

[0084] In an exemplary embodiment, the second perturbation data includes at least one of a first re-perturbation data, a second re-perturbation data, and a third re-perturbation data. The first re-perturbation data is obtained by perturbing the first initial perturbation data using a second perturbation function. The second re-perturbation data is obtained by perturbing the second initial perturbation data using a second perturbation function. The third re-perturbation data is obtained by perturbing the third initial perturbation data using a second perturbation function. The second desensitized data includes at least one of a second rounded data, a second projected data, and a second decompressed data. The second desensitized data is obtained by constraining the data in each dimension of the second perturbation data to the value range of the corresponding dimension using a constraint function, including at least one of the following: rounding the first re-perturbation data using a rounding function to obtain the second rounded data; or projecting the second re-perturbation data using a projection function to obtain the second projected data; or compressing the third re-perturbation data using a second compression function to obtain the third compressed data, and decompressing the third compressed data using a decompression function to obtain the second decompressed data.

[0085] For example, perturbing the first initial perturbed data using the second perturbed function means generating corresponding perturbed values ​​for each dimension of the first initial perturbed data using the second perturbed function, and then using these perturbed values ​​to perturb the data in the corresponding dimension. For instance, perturbing the data in the j-th dimension of the first initial perturbed data... Generate perturbation value Using perturbation values Data Perturbation to obtain .

[0086] Rounding the first re-perturbed data using a rounding function means rounding the data in each dimension of the first re-perturbed data separately using a rounding function. For example, rounding the data in the j-th dimension of the first re-perturbed data... Rounding to the nearest integer The second rounded data can be represented as... , Include .

[0087] For example, perturbing the second initial perturbed data using the second perturbed function means generating corresponding perturbed values ​​for each dimension of the data in the second initial perturbed data using the second perturbed function, and then using these perturbed values ​​to perturb the data in the corresponding dimension. For example, perturbing the data in the j-th dimension of the second initial perturbed data... Generate perturbation value Using perturbation values Data Perturbation to obtain .

[0088] Projecting the second, re-perturbed data using a projection function means projecting the data in each dimension of the second, re-perturbed data separately using the projection function. For example, projecting the data in the j-th dimension of the second, re-perturbed data... Projection The second projection data can be represented as... , Include .

[0089] For example, perturbing the third initial perturbed data using the second perturbed function means generating corresponding perturbed values ​​for each dimension of the third initial perturbed data using the second perturbed function, and then using these perturbed values ​​to perturb the data in the corresponding dimension. For instance, perturbing the data in the j-th dimension of the third initial perturbed data... Generate perturbation value Using perturbation values Data Perturbation to obtain .

[0090] Compressing the third re-perturbed data using the second compression function means compressing the data in each dimension of the third re-perturbed data separately using the second compression function. For example, compressing the data in the j-th dimension of the third re-perturbed data. Compress to obtain .

[0091] Decompressing the third-dimensional compressed data using a decompression function means decompressing the data in each dimension of the third-dimensional compressed data separately using the decompression function. For example, using a decompression function... For the data in the j-th dimension of the third compressed data Decompress to obtain The second decompressed data can be represented as... , Include Therefore, the second de-identified data .

[0092] In this embodiment, the generated second desensitized data can be used to construct a target loss function that satisfies the unbiased property, thereby ensuring the accuracy of model training.

[0093] In an exemplary embodiment, a target loss function can be generated based on the loss functions of the first and second de-identified data. The target loss function satisfies the unbiased property. The loss function of the first de-identified data refers to the loss function constructed using the first de-identified data as input data. The loss function of the second de-identified data refers to the loss function constructed using the second de-identified data as input data. The loss is calculated using the loss functions. Since the target loss function satisfies the unbiased property, by introducing noise (perturbation values) and constructing the target loss function, the bias caused by privacy protection is eliminated.

[0094] When training the model, multiple sets of original data, corresponding to first and second de-identified data, can be used. These multiple sets of original data could be, for example, first de-identified data and second de-identified data. The original data are respectively , . Representing the The original data. For example... Figure 3 As shown, a perturbation value is added to the original data to obtain the first perturbation data, and constraints are applied to the first perturbation data to obtain the first de-identified data. , yes In , yes In , yes In . , , It is an independent and identically distributed noise vector. The corresponding variables form a sub-vector, and the first de-identified data is stored in the first de-identified dataset. A perturbation value is added to the first perturbation data to obtain the second perturbation data. Constraints are applied to the second perturbation data to obtain the second de-identified data. Second de-identified data. , , , It is an independent and identically distributed noise vector. The corresponding variables form a subvector, and the second desensitized data is stored in the second desensitized dataset.

[0095] For example, the privacy requirement parameters include a first parameter and a second parameter. The first parameter constrains the strength of privacy protection, and the second parameter is a relaxation term. The first weight corresponding to the loss function of the first de-identified data and the second weight corresponding to the loss function of the second de-identified data can be determined based on the second parameter. Using the first and second weights, the loss functions of the first and second de-identified data are weighted and calculated to obtain the target loss function.

[0096] For example, the second weight is The first weight is ,in, This is the second parameter. The target loss function is:

[0097]

[0098] in, , For the parameter space of the model, These are the parameters of the model. The loss function for the first de-identified data is... The loss function generated during model training The loss function for the second de-identified data is... The loss function generated during model training. The target loss function is defined as follows: the loss function for the first de-identified data and the loss function for the second de-identified data. This can be, but is not limited to, the cross-entropy loss function, the mean squared error function, or the mean absolute error, etc. The specific form of the loss function is determined according to the task performed by the model, which can be, but is not limited to, linear regression or logistic regression.

[0099] For example, the target loss function can be obtained by performing at least one basic algebraic operation, such as addition, subtraction, and multiplication, on the loss function of the first de-identified data and the loss function of the second de-identified data. The specific form of calculating the target loss function can be adjusted according to the actual application scenario.

[0100] For example, the target loss functions corresponding to multiple raw data points are used to generate a comprehensive loss function. During training, the model parameters are adjusted by minimizing this comprehensive loss function. The comprehensive loss function can be the sum of the target loss functions corresponding to the multiple raw data points, or it can be the mean of the target loss functions corresponding to the multiple raw data points. For example... This represents the data variable corresponding to a single sample, for samples containing... A dataset of samples ,in, Indicates the first The observed values ​​of each sample. The corresponding objective loss functions are used to generate the comprehensive loss function. During training, the model parameters are adjusted by minimizing the comprehensive loss function, which is:

[0101]

[0102] in, For raw data The corresponding target loss function, for . The comprehensive loss function is the sum of the target loss functions corresponding to the multiple original data. for The corresponding second parameter, It is based on The first disturbance parameter is determined by the corresponding first and second parameters.

[0103] Under certain conditions, the true value of the parameter exhibits an asymptotic normality, with the rate... convergence.

[0104] In an exemplary embodiment, the target loss function can also be referred to as the correction loss function. The target loss function satisfies the unbiased property, which includes:

[0105]

[0106] In an exemplary embodiment, the target loss function is denoted as .in,

[0107]

[0108] , , These represent discrete variables, bounded continuous variables, and unbounded continuous variables, respectively. Specifically, the first discrete variable Each component satisfies The first bounded continuous variable Each component satisfies The first unbounded continuous variable Each component satisfies .in, With the previous Equivalent, With the previous Equivalent.

[0109] make This represents a mapping that rounds each component of a discrete variable to its corresponding set of values, let... This represents the component-wise projection of a bounded continuous variable onto the corresponding interval. The mapping. Derived by the first compression function. and decompression functions From its form, we can see that

[0110]

[0111] By the second compression function From its form, we can see that

[0112]

[0113] As can be seen from the above definition, for the original data ,have:

[0114]

[0115] In the absence of external data, construct the first set of anonymized data:

[0116]

[0117] in,

[0118]

[0119] in, Let be a random vector, and let its characteristic function be... Its specific form is as follows:

[0120]

[0121] , .

[0122] Simultaneously, construct a second set of desensitized data:

[0123]

[0124] in,

[0125]

[0126]

[0127] in, Let be a random vector, and let its characteristic function be... Its specific form is as follows:

[0128]

[0129] and and They are independent of each other.

[0130] The following proves that the corrected loss function constructed above satisfies the unbiased property. Note that for any function that satisfies the expectation, ... All of them have:

[0131]

[0132] The above relationship can be verified by the characteristic function. Let To be independent and A two-point distributed random variable, and , Then the random vector The characteristic function is:

[0133]

[0134] therefore and With the same distribution, we can obtain:

[0135]

[0136] For any given ,definition:

[0137]

[0138] in, .because , and ,therefore:

[0139]

[0140] The above Substituting into the previous equation, we get:

[0141]

[0142] according to and The above equation is equivalent to the following construction:

[0143]

[0144] Therefore, for Taking the expected value again, we get:

[0145]

[0146] Therefore, in the absence of external data, the corrected loss function can be determined as follows:

[0147]

[0148] It satisfies the unbiased property. Since this objective loss function can offset the bias caused by data perturbations to the model's learning results, it can improve the accuracy of the model's learning results.

[0149] Furthermore, in practical application scenarios, we set... for A set of independent and identically distributed random vectors, representing the actual... Individual feature vectors. For each Construct the corresponding according to the above method and Therefore, based on the above unbiased properties,

[0150]

[0151] In other words, the correction loss resulting from each person's anonymized data is, on average, equal to the target loss corresponding to the original data. Therefore, according to the law of large numbers, when the sample size... As the value gradually increases, the average correction loss per sample is:

[0152]

[0153] It will get closer and closer Therefore, although the loss value on a single desensitized sample may fluctuate due to random perturbations, when the sample size is large enough, such fluctuations can be offset by averaging, so that the average corrected loss calculated based on the desensitized data can approximately reflect the expected target loss on the original data.

[0154] In the aforementioned privacy protection method, first de-identified data corresponding to the original data is obtained. The original data corresponds to privacy requirement parameters, which are used to determine a first perturbation function. This first perturbation function perturbs the data in each dimension of the original data to obtain first perturbation data. The first de-identified data is obtained by constraining the data in each dimension of the first perturbation data to the corresponding value range using a constraint function. The original data contains privacy information. Second perturbation data is obtained by perturbing the data in each dimension of the first perturbation data using a second perturbation function, determined according to the privacy requirement parameters. The second perturbation data is then constrained to the corresponding value range using a constraint function to obtain second de-identified data. The first and second de-identified data are used to determine the target loss function and train the model. Since the original data is not accessed during training, and no additional privacy budget is consumed, the first and second de-identified data can be reused. This makes it suitable for training different models for different analysis tasks and applicable to scenarios with diverse analysis needs or dynamically changing tasks, thus broadening the application scenarios applicable to the privacy protection method. Furthermore, since the first de-identified data is obtained by constraining the data in each dimension of the first perturbation data to the corresponding value range using constraint functions, and the second de-identified data is obtained by constraining the data in each dimension of the second perturbation data to the corresponding value range using constraint functions, the data in each dimension of the first de-identified data and the data in each dimension of the second de-identified data satisfy the value range requirements of each dimension. Therefore, the reliability of the first and second de-identified data can be guaranteed while protecting the privacy information in the original data as much as possible. This solves the problem of data deviating from the real data range after adding noise, thereby broadening the application scenarios.

[0155] This application can be applied to model training or parameter estimation processes based on empirical risk minimization, and can also be used for other types of machine learning model training, parameter estimation, or statistical inference tasks, including but not limited to classification, regression, or other learning processes based on loss function optimization.

[0156] In one exemplary embodiment, the raw data corresponds to privacy protection level information, and the raw data includes... and , for 3D discrete data, The j-th component , for Bounded data The j-th component ;

[0157] When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for:

[0158]

[0159] When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for:

[0160]

[0161] Among them, the first level of privacy protection is higher than the second level of privacy protection. The third parameter is calculated based on the first and second parameters. for The maximum value of the data in the j-th dimension. for The minimum value of the data in the j-th dimension.

[0162] For example, the first privacy protection level and the second privacy protection level are two different privacy protection levels. The first privacy protection level and the second privacy protection level correspond to different differential privacy algorithms. For instance, the first privacy protection level corresponds to... -DP algorithm, corresponding to the second privacy protection level -CDP algorithm. For example, if using -DP algorithm, then If adopted -CDP algorithm, then .

[0163] For example, "a higher level of privacy protection than a higher level of privacy protection" means that the level of protection required by the first level of privacy protection is higher than that required by the second level of privacy protection. For instance, if the original data is a user's private data, the first level of privacy protection requires that the analyst (i.e., the analyst) cannot know whether a single user's data is included in the dataset { }middle, The second level of privacy protection requires that analysts cannot know the values ​​of individual attributes or dimensions of individual users in the dataset.

[0164] For example, because Usually greater than Therefore, the first perturbation parameter obtained under the first privacy protection level is greater than the first perturbation parameter obtained under the second privacy protection level. Since the larger the first perturbation parameter is, the greater the perturbation of the data by the first perturbation function, the better the privacy protection effect is. Thus, compared with the second privacy protection level, a better privacy protection effect can be obtained under the first privacy protection level.

[0165] In this embodiment, the first perturbation parameter is determined in different ways under different privacy protection levels, thereby supporting different levels of privacy protection requirements.

[0166] In one exemplary embodiment, the third parameter It is based on the first parameter Second parameter And the target constraints are determined, including:

[0167]

[0168]

[0169]

[0170] in, , Let be the cumulative distribution function of the standard normal distribution. In Replace with Then you can get . and Let be the base of the natural logarithm. The third parameter is what makes the equation... Established .

[0171] For example, the first perturbation data can be generated by the first terminal; therefore, the first perturbation parameter can also be generated by the first terminal. Specifically, when the first terminal obtains the original data, the first parameter, and the second parameter, it can generate the first parameter... Second parameter Substitute these parameters into the objective constraints and solve for the third parameter. This allows us to determine the characteristic function of the first perturbation function, and to use the perturbation value generated by the characteristic function of the first perturbation function to perturb the original data, thereby obtaining the first perturbation data.

[0172] For example, the first perturbation data can also be generated by the server. For instance, the first terminal can send the raw data and privacy requirement information to the server. The server determines a first parameter and a second parameter based on the privacy requirement information, and then sends the first parameter... Second parameter Substitute these parameters into the objective constraints and solve for the third parameter. Therefore, the characteristic function of the first perturbation function can be determined, and the perturbation value generated by the characteristic function of the first perturbation function can be used to perturb the original data to obtain the first perturbation data.

[0173] In this embodiment, due to the third parameter It is based on the first parameter Second parameter The target constraints are determined, and the first disturbance parameter is based on the third parameter. It is determined that the first disturbance parameter is subject to the first parameter. Second parameter The influence of the first disturbance parameter is that the first disturbance parameter changes with the first parameter. Second parameter The characteristic function changes with the first parameter, thus causing the characteristic function to change accordingly. Second parameter The degree of disturbance can be controlled by the change in the third parameter, thus controlling the degree of privacy protection. This allows the privacy protection method of this application to achieve -DP and -CDP.

[0174] In one exemplary embodiment, the privacy requirement parameters include a first parameter. Second parameter Among them, the first parameter The second parameter is used to constrain the strength of privacy protection. This is the relaxation term. The third parameter... Used to incorporate privacy requirement parameters Convert to first perturbation parameter .

[0175] In this embodiment, This can be understood as the upper bound of the maximum change between adjacent inputs relative to the noise scale. Specifically, if two adjacent inputs are... and ,but:

[0176]

[0177] This represents the relative magnitude of the adjacent changes at the noise scale. The smaller this value, the greater the change in noise scale relative to adjacent inputs, making it more difficult to distinguish the output distributions of two adjacent inputs after adding noise, thus providing stronger privacy protection. Therefore, by controlling this ratio to not exceed the third parameter... This allows you to control the level of privacy protection.

[0178] In order to meet the target privacy budget Determine the third parameter This embodiment uses the following privacy conversion function. It should be noted that the conversion uses... As the probability of zeroing in zero-inflated symmetric multivariate Laplace noise, the relaxation term in the target differential privacy budget remains... .use This is to ensure that the relaxation amount corresponding to the noise itself is less than the target relaxation term. This allows for slack space to accommodate differences between adjacent inputs.

[0179] make:

[0180]

[0181] in, Let be the cumulative distribution function of the standard normal distribution. For ease of writing, let:

[0182]

[0183] definition:

[0184]

[0185] Further definition:

[0186]

[0187] in, and All are based on the natural logarithm.

[0188] Take the third parameter To satisfy:

[0189]

[0190] A positive number; equivalently, it can also be:

[0191]

[0192] because The above equation has a positive solution. In actual calculations, the third parameter can be obtained through the bisection method, Newton's method, or other one-dimensional numerical solution methods. . Represents the upper boundary.

[0193] The third parameter mentioned above is explained below. Why can the target be guaranteed? Privacy budget. Let the noise-adding mechanism corresponding to the first perturbation function be:

[0194]

[0195] From the privacy conversion property of the zero-inflated symmetric multivariate Laplace noise mechanism, it can be seen that for any two adjacent inputs and ,like:

[0196]

[0197] Then for any output set ,have:

[0198]

[0199] and, Follow It increases without decreasing. Therefore, as long as:

[0200]

[0201] Then we have:

[0202]

[0203] This is exactly - The requirement of differential privacy. That is, the third parameter... This enables the ZIL noise-adding mechanism to achieve its target. The maximum permissible normalization sensitivity for privacy budgets.

[0204] At the first level of privacy protection, the protected object is the overall data of a single user, corresponding to -DP. In this case, adjacent inputs can differ across all protected dimensions for that user. If the original data includes... , and Discrete data The The range of values ​​for each component is: Bounded data The The range of values ​​for each component is: Unbounded data The length of the value range after compression by the first compression function shall not exceed Then the overall change can be taken as:

[0205]

[0206] Therefore, under the first level of privacy protection, the first perturbation parameter It can be taken as:

[0207]

[0208] At this point, for any two adjacent inputs that differ only by one piece of overall user data, we have:

[0209]

[0210] Thus, the noise-adding mechanism satisfies -DP.

[0211] Under the second level of privacy protection, the protected object is a single attribute value of a single user, corresponding to -CDP. At this point, adjacent inputs differ only in one attribute. Due to the discrete data's... The maximum change of each component does not exceed Bounded data The maximum change of each component does not exceed The variation of a single component of unbounded data after compression does not exceed Therefore, the attribute-level change can be taken as:

[0212]

[0213] Therefore, under the second level of privacy protection, the first perturbation parameter It can be taken as:

[0214]

[0215] At this point, for any two adjacent inputs that differ by only one attribute value, we have:

[0216]

[0217] Thus, the noise-adding mechanism satisfies -CDP.

[0218] Furthermore, the first desensitized data is obtained by performing constraint processing such as rounding, projection, compression, or decompression on the first perturbation data; the second desensitized data is obtained by further superimposing a second perturbation value independent of the original data on the first perturbation data, and then performing constraint processing such as rounding, projection, compression, or decompression again. All of the above processing belongs to post-processing of the already noisy result, or to random post-processing performed on the already noisy result. Post-processing does not reduce the already obtained differential privacy protection level. Therefore, the first and second desensitized data still satisfy the above requirements. -DP or -CDP Privacy Guarantee.

[0219] If the original data does not include Then in the above formula, with and the length of the value range The corresponding items can be omitted; if the original data does not include or If the summation term or the maximum value term is not specified, then the corresponding summation term or maximum value term can be omitted.

[0220] In one exemplary embodiment, the raw data corresponds to privacy protection level information, and the raw data includes... , and , for 3D discrete data, The j-th component , for Bounded data The j-th component , for Unbounded data;

[0221] When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for:

[0222]

[0223] When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for:

[0224]

[0225] in, The range of values ​​for the data in each dimension is .

[0226] In this embodiment, even when the original data includes unbounded data, bounded data, and discrete data, a reliable first perturbation parameter can still be obtained.

[0227] because The loss function is calculated by weighting the loss function of the first de-identified data and the loss function of the second de-identified data. Therefore, the target loss function only involves basic operations of addition, subtraction and multiplication, and there is no need to differentiate or integrate the loss function, so the computational complexity is low.

[0228] The holders of these multiple raw data sets may be the same or different. The privacy requirements parameters corresponding to each raw data set may be the same or different.

[0229] In one exemplary embodiment, the privacy requirement parameter includes a first parameter. Second parameter The first parameter constrains the strength of privacy protection, the second parameter is a relaxation term, and the original data is a part of the mixed data, which also includes external data. The external data and the original data source are different; the second de-identified data includes... External disturbance data obtained by perturbation , , Represents from 0 to The set of integers, It is a positive integer; when given hour, satisfy And for any and , ; middle is the base of the natural logarithm. These are integer variables; the mixed data is used to determine the target loss function and train the model. middle It is an abbreviation for external, meaning external. Indicates in Under the conditions, and Equal probability. Indicates in Under the conditions, and Equal probability.

[0230] In this application, the external data is one-dimensional data, meaning it is a scalar. In the same mixed dataset, both the original data and the external data belong to the same user (holder). For example, a patient may have multiple medical tests performed at one hospital; the data from these tests corresponds to the original data. If the patient receives a diagnosis at another hospital, either "healthy" or "confirmed," the external data corresponds to that diagnosis, and is represented by 0 or 1, where 0 represents "healthy" and 1 represents "confirmed." The original data and external data in the same mixed dataset share a pair. . In This is the base of the natural logarithm. Because the noise used to protect privacy in the release of external data (e.g., the first and second perturbation functions) cannot be correlated with the noise used by the original data storage provider, meaning the noise used by the external data storage provider is independently generated and differs from the first and second perturbation functions used in the original data. The original data comes from the same institution (which can be understood as an internal structure), while the external data comes from external institutions. The result of perturbing the data has a certain probability of remaining unchanged (i.e., the data before and after the perturbation is consistent), and a certain probability of changing to other values ​​(i.e., the data before and after the perturbation is inconsistent).

[0231] For example, the raw data and external data can be the user's medical data. Raw data includes discrete data, bounded data (bounded continuous data), and unbounded data (unbounded continuous data). Discrete variables include count data such as gender, whether the user has a disease (0 represents no, 1 represents yes), disease classification codes, or number of hospitalizations. Bounded continuous data includes blood oxygen saturation (0–100%), cardiac ejection fraction (0–1), body temperature, or BMI (Body Mass Index). Unbounded continuous data can be indicators such as blood glucose, cholesterol, or creatinine. The raw data and external data can be data collected from the same user at different hospitals. For example, the privacy protection method provided in this application is performed by equipment at Hospital A, while the external data is data collected by Hospital B.

[0232] In this embodiment, it is possible to train models using data from different sources while protecting data privacy and security as much as possible.

[0233] In one exemplary embodiment, the privacy requirement parameter includes a first parameter. Second parameter The objective loss function is:

[0234]

[0235] in,

[0236]

[0237]

[0238]

[0239] It is and The loss function calculated by inputting it into the model to train the model is also input into the model. It is and The loss function calculated by inputting it into the model to train the model is also input into the model. It is and The loss function calculated by inputting it into the model to train the model is also input into the model. It is and The loss function calculated by inputting these values ​​into the model for training is another input. Each loss function can be, but is not limited to, the cross-entropy loss function, the mean squared error function, or the mean absolute error, etc. The specific form of the loss function is determined by the task the model performs, which can be, but is not limited to, linear regression or logistic regression. Taking logistic regression as an example, the general formula for calculating the loss function can be:

[0240]

[0241] in, It can be , , , etc., with For example, then:

[0242]

[0243] in, , For the parameter space of the model, These are the parameters of the model; This is the original data; This is the first de-identified data; This is the second set of anonymized data. The target loss function has the property of being unbiased. for The corresponding target loss function. For example, For raw data The corresponding target loss function. for Corresponding external disturbance data, for External data within the mixed data set.

[0244] Similarly, in the presence of external data, the target loss function also satisfies the unbiased property. Specifically, in another exemplary embodiment, in addition to the original feature vector (i.e., the original data), In addition, there is also... Corresponding external data This embodiment handles the case where the external data has only a finite number of possible values. Specifically, The value depends on the number of possible values ​​of the external data in the actual application; if the original set of values ​​of the external data is not based on... Starting from this point, its range of values ​​can be equivalently represented by renumbering or translation transformation as follows:

[0245]

[0246] The aforementioned renumbering or translation transformation only changes the way the external data values ​​are represented, and does not change the relationship between the external data and the original feature vector. The correspondence between them does not change the learning task expressed by the target loss function. At this point, the original target loss function can be written as... .

[0247] For external data Let its corresponding external disturbance data be... Based on the external disturbance data generation method described above, when given... hour, satisfy:

[0248]

[0249] And for any , ,have:

[0250]

[0251] remember:

[0252]

[0253] The above probability can then be written as:

[0254]

[0255] Based on the correction loss in the absence of external data, an auxiliary summation term is defined:

[0256]

[0257] Furthermore, in the presence of external data, we define:

[0258]

[0259] The corrected loss function is then:

[0260]

[0261] The following proves that the above-mentioned corrected loss function satisfies the unbiased property. For any given... and As can be seen from the proven unbiased property in the absence of external data, for any fixed... ,have:

[0262]

[0263] therefore,

[0264]

[0265] To simplify the notation, let's call it:

[0266]

[0267] Due to external disturbance data In a given At that time, with probability Take the actual value and with probability Taking each non-true value, and combining it with the above formula, we get:

[0268]

[0269] Therefore, in the conditional expectation of the numerator of the correction loss function, the non-true values ​​are... The corresponding summation terms cancel each other out with the corresponding parts in the auxiliary summation terms, retaining only the true values. The corresponding part, namely:

[0270]

[0271] Divide by the denominator You can then obtain:

[0272]

[0273] Therefore, for Taking the expected value again, we get:

[0274]

[0275] Therefore, even with external data, the aforementioned correction loss function still satisfies the unbiased property. In other words, this correction loss function can not only offset the bias on the feature vector... The bias introduced by the perturbation can also offset the external data. The bias introduced by random perturbation makes the target loss calculated based on desensitized data and perturbed external data equal, on average, the target loss corresponding to the original data and the original external data.

[0276] In addition, the above-mentioned external disturbance data generation mechanism also satisfies - Differential privacy (DP). Let the perturbation mechanism of external data be denoted as... ,Right now For any two possible external data values and any set of outputs ,when The time-difference privacy (DP) inequality clearly holds. Now consider... The situation is as follows. Based on the above perturbation probabilities, it can be concluded that...

[0277]

[0278] At the same time, for any ,have:

[0279]

[0280] Therefore, for any output set ,have:

[0281]

[0282] Therefore, the external disturbance mechanism satisfy - Differential privacy (DP).

[0283] Furthermore, the aforementioned external disturbance mechanisms also possess local characteristics. This is because, for the actual... Individual, its external disturbance data External data of this person can be directly obtained. Locally via mechanism The generation process uses only the individual's external data and local randomness, without relying on external data from other individuals or requiring access to a centralized database containing external data from multiple individuals.

[0284] In this embodiment, the designed target loss function can support training models using data from different sources and after anonymization, while satisfying the unbiased property, further improving the applicability of the method.

[0285] This application can be divided into a data publishing phase and an analysis phase. The data publishing phase may include the process of processing the original data to generate first perturbation data and first de-identified data. The analysis phase may include the process of the analyst's second device processing the first perturbation data to obtain second de-identified data. By introducing randomization (i.e., perturbation) into the data publishing and analysis phases respectively, privacy protection and model analysis processes are decoupled, allowing the same de-identified dataset to be used by multiple analysts for different analysis tasks multiple times without re-accessing the original data or repeatedly consuming the privacy budget, thus realizing a novel differential privacy algorithm. Different analysis tasks can be training different types of models.

[0286] This application eliminates the need for pre-binding specific loss functions or analytical objectives during the data publishing phase, enabling it to adapt to various machine learning models and analytical needs, and achieving a data publishing method independent of specific analytical tasks. During the analysis phase, a target loss function is constructed to compensate for the biases caused by data perturbations on the model learning results in a desired sense, thereby achieving effective parameter estimation and model training under differential privacy constraints.

[0287] The target loss function of this application involves basic algebraic operations, eliminating the need for integration or numerical inversion of the loss function, thus reducing computational complexity and improving engineering feasibility. It is independent of the smoothness of the loss function, thereby expanding the range of applicable loss functions. Theoretical analysis proves that the target loss function of this application can be applied to non-smooth loss functions, including those containing discontinuous points or non-differentiable structures, overcoming the limitations imposed by differential privacy learning methods on the form of the loss function.

[0288] This application achieves significant improvements in terms of analytical task flexibility, computational complexity, and adaptability to loss function forms. Specifically, differential privacy learning methods typically require pre-determining the analytical task or loss function form before model training. Each execution of a new analytical task necessitates re-consuming the privacy budget, limiting the reuse of the same dataset. This application, by uniformly protecting the privacy of the original data during the data release phase, allows different analysts to perform their respective analytical tasks based on the same desensitized dataset (e.g., the first and second desensitized datasets) in subsequent analyses without re-accessing the original data or incurring additional privacy budget costs. This application decouples data release from subsequent analysis processes, improving the applicability of desensitized data in multi-task and multi-analysis scenarios. The target loss function proposed in this application relies only on basic algebraic operations such as addition, subtraction, and multiplication, without involving integration operations, effectively reducing the computational overhead during model training and parameter estimation, making the method easier to implement and deploy in practical engineering systems. Differential privacy learning methods and error correction methods typically impose strong requirements on the continuity or differentiability of the loss function, making them difficult to apply to loss functions containing discontinuities or non-differentiable structures. This application, by constructing a target loss function, theoretically demonstrates that it is independent of the smoothness assumption of the loss function. For scenarios with non-smooth loss functions, the method described in this application... It still achieves unbiased estimation results, thus broadening the applicability of differential privacy learning methods. In summary, this application, while meeting the requirements of differential privacy protection, achieves flexible expansion of analysis tasks, improved computational efficiency, and good adaptability to complex loss function forms, demonstrating significant technological advancement and practical application value.

[0289] This application can serve as a de-identified data publishing module, deployed on de-identified data publishing platforms, data sharing platforms, or data trading systems, providing a unified de-identified data source for various downstream analytical tasks. In fields such as financial risk control and healthcare, this application can be used for privacy protection processing of user or patient data, supporting various model applications such as risk assessment, predictive analysis, and statistical inference. The methods provided in this application can be integrated into machine learning frameworks, statistical analysis tools, or privacy-preserving computing software as a solution for differential privacy model training and parameter estimation. In online scenarios where data scale continuously grows and analytical tasks dynamically change, this application can support the reuse of de-identified data, making it suitable for practical products involving online learning and continuous model updates.

[0290] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0291] Based on the same inventive concept, this application also provides a privacy information protection device for implementing the privacy information protection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more privacy information protection device embodiments provided below can be found in the limitations of the privacy information protection method described above, and will not be repeated here.

[0292] In one exemplary embodiment, such as Figure 4 As shown, a privacy information protection device is provided, including: a data acquisition module 402, a data disturbance module 404, and a data constraint module 406, wherein:

[0293] The data acquisition module 402 is used to acquire the first de-identified data corresponding to the original data. The original data has privacy requirement parameters, which are used to determine the first perturbation function. The first perturbation function is used to perturb the data in each dimension of the original data to obtain the first perturbation data. The first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension. The original data contains privacy information.

[0294] The data perturbation module 404 is used to perturb the data in each dimension of the first perturbation data using a second perturbation function to obtain the second perturbation data. The second perturbation function is determined according to the privacy requirement parameters.

[0295] The data constraint module 406 is used to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension using a constraint function, thereby obtaining the second desensitized data. The first desensitized data and the second desensitized data are used to determine the target loss function and train the model.

[0296] In some embodiments, the raw data includes , and At least one of them; for 3D discrete data, The j-th component ; for Bounded data The j-th component ; for Unbounded data; constraint functions include a rounding function; the first desensitized data includes first rounded data, which is obtained by rounding the first initial perturbation data using the rounding function; the first initial perturbation data is obtained by rounding the first perturbation data using the first perturbation function. The perturbation generation function is used to round the j-th component in the first initial perturbation data to the nearest integer. Alternatively, the constraint function includes a projection function, the first desensitized data includes first projected data, the first projected data is obtained by projecting the second initial perturbation data using the projection function, and the second initial perturbation data is obtained by projecting the second initial perturbation data using the first perturbation function. The perturbation is generated, and the projection function is used to project the j-th component in the second initial perturbation data onto... Alternatively, the constraint functions include a first compression function, a second compression function, and a decompression function; the first compression function is used to... Compression is performed to obtain first compressed data. A second compression function is used to compress third initial perturbation data to obtain second compressed data. The third initial perturbation data is obtained by perturbing the first compressed data using the first perturbation function. A decompression function is used to decompress the second compressed data to obtain first decompressed data. The first desensitized data includes the first decompressed data.

[0297] In some embodiments, the second perturbation data includes at least one of a first re-perturbation data, a second re-perturbation data, and a third re-perturbation data. The first re-perturbation data is obtained by perturbing the first initial perturbation data using a second perturbation function. The second re-perturbation data is obtained by perturbing the second initial perturbation data using a second perturbation function. The third re-perturbation data is obtained by perturbing the third initial perturbation data using a second perturbation function. The second desensitized data includes at least one of a second rounded data, a second projected data, and a second decompressed data. The data constraint module 406 is further configured to: round the first re-perturbation data using a rounding function to obtain the second rounded data; or project the second re-perturbation data using a projection function to obtain the second projected data; or compress the third re-perturbation data using a second compression function to obtain the third compressed data, and decompress the third compressed data using a decompression function to obtain the second decompressed data.

[0298] In some embodiments, the privacy requirement parameters include a first parameter and a second parameter. The first parameter is used to constrain the strength of privacy protection, and the second parameter is a relaxation term. The characteristic functions of the first perturbation function and the second perturbation function include a first perturbation parameter and a second perturbation parameter. The second perturbation parameter is the second parameter, and the first perturbation parameter is determined based on the first parameter and the second parameter.

[0299] In some embodiments, the raw data corresponds to privacy protection level information, and the raw data includes... and , for 3D discrete data, The j-th component , for Bounded data The j-th component ;

[0300] When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for:

[0301]

[0302] When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for:

[0303]

[0304] Among them, the first level of privacy protection is higher than the second level of privacy protection. The third parameter is calculated based on the first and second parameters.

[0305] In some embodiments, the raw data corresponds to privacy protection level information, and the raw data includes... , and , for 3D discrete data, The j-th component , for Bounded data The j-th component , for Unbounded data;

[0306] When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for:

[0307]

[0308] When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for:

[0309]

[0310] Among them, the first level of privacy protection is higher than the second level of privacy protection. The third parameter is calculated based on the first and second parameters.

[0311] Each module in the aforementioned privacy protection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0312] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores at least a portion of the data involved in the privacy information protection method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a privacy information protection method.

[0313] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a privacy protection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0314] Those skilled in the art will understand that Figure 5 and Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0315] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0316] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0317] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0318] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0319] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0320] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0321] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for protecting privacy information, characterized in that, The method includes: Obtain the first de-identified data corresponding to the original data. The original data corresponds to privacy requirement parameters. The privacy requirement parameters are used to determine the first perturbation function. The first perturbation function is used to perturb the data in each dimension of the original data to obtain the first perturbation data. The first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension. The original data contains privacy information. The data in each dimension of the first perturbation data is perturbed using a second perturbation function to obtain the second perturbation data. The second perturbation function is determined according to the privacy requirement parameters. The constraint function is used to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain the second desensitized data. The first desensitized data and the second desensitized data are used to determine the target loss function and train the model.

2. The method according to claim 1, characterized in that, The raw data includes , and At least one of them; the said for 3D discrete data, It is a positive integer and represents discrete data. The dimension, the The j-th component , Represents from 0 to The set of integers, It is a positive integer; for Bounded data The value is a positive integer. The j-th component , For interval The lower limit, For interval The upper limit; The for Unbounded data The integer is positive; the method further includes at least one of the following: The constraint function includes a rounding function, and the first desensitized data includes first rounded data. The first rounded data is obtained by rounding the first initial disturbance data using the rounding function. The first initial disturbance data is obtained by rounding the first disturbance data using the first disturbance function. The perturbation is generated, and the rounding function is used to round the j-th component in the first initial perturbation data to the nearest integer. ; or, The constraint function includes a projection function, and the first desensitized data includes first projected data. The first projected data is obtained by projecting the second initial disturbance data using the projection function. The second initial disturbance data is obtained by projecting the second initial disturbance data using the first disturbance function. The perturbation is generated, and the projection function is used to project the j-th component in the second initial perturbation data onto... ;or, The constraint functions include a first compression function, a second compression function, and a decompression function; the first compression function is used to... The compression function is used to compress the first compressed data to obtain the second compressed data. The third initial perturbation data is obtained by perturbing the first compressed data using the first perturbation function. The decompression function is used to decompress the second compressed data to obtain the first decompressed data. The first desensitized data includes the first decompressed data.

3. The method according to claim 2, characterized in that, The second perturbation data includes at least one of a first re-perturbation data, a second re-perturbation data, and a third re-perturbation data. The first re-perturbation data is obtained by perturbing the first initial perturbation data using a second perturbation function. The second re-perturbation data is obtained by perturbing the second initial perturbation data using a second perturbation function. The third re-perturbation data is obtained by perturbing the third initial perturbation data using a second perturbation function. The second desensitized data includes at least one of a second rounded data, a second projected data, and a second decompressed data. The step of using the constraint function to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension to obtain the second desensitized data includes at least one of the following: The first re-perturbed data is rounded using the rounding function to obtain the second rounded data; or, The second re-perturbed data is projected using the projection function to obtain second projected data; or, The third re-perturbed data is compressed using the second compression function to obtain third compressed data, and the third compressed data is decompressed using the decompression function to obtain second decompressed data.

4. The method according to any one of claims 1 to 3, characterized in that, The privacy requirement parameters include a first parameter and a second parameter. The first parameter is used to constrain the strength of privacy protection, and the second parameter is a relaxation term. The characteristic functions of the first perturbation function and the second perturbation function include a first perturbation parameter and a second perturbation parameter. The second perturbation parameter is the second parameter, and the first perturbation parameter is determined based on the first parameter and the second parameter.

5. The method according to claim 4, characterized in that, The raw data corresponds to privacy protection level information, and the raw data includes... and The for 3D discrete data, It is a positive integer and represents discrete data. The dimension, the The j-th component , Represents from 0 to The set of integers, It is a positive integer; for Bounded data The value is a positive integer. The j-th component , For interval The lower limit, For interval The upper limit; When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for: When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for: The first privacy protection level is higher than the second privacy protection level. The third parameter is calculated based on the first parameter and the second parameter.

6. The method according to claim 4, characterized in that, The raw data corresponds to privacy protection level information, and the raw data includes... , and The for 3D discrete data, It is a positive integer and represents discrete data. The dimension, the The j-th component , Represents from 0 to The set of integers, It is a positive integer; for Bounded data The value is a positive integer. The j-th component , For interval The lower limit, For interval The upper limit, for Unbounded data It is a positive integer; When the privacy protection level information indicates a first privacy protection level, the first perturbation parameter for: When the privacy protection level information indicates a second privacy protection level, the first perturbation parameter for: The first privacy protection level is higher than the second privacy protection level. The third parameter is calculated based on the first parameter and the second parameter.

7. The method according to any one of claims 1 to 3, characterized in that, The privacy requirement parameters include a first parameter. Second parameter The first parameter is used to constrain the strength of privacy protection, the second parameter is a relaxation term, the original data is a part of the mixed data, and the mixed data also includes external data. The external data has a different source than the original data, and the second de-identified data includes... External disturbance data obtained by perturbation , , Represents from 0 to The set of integers, It is a positive integer; when given At that time, the satisfy And for any and ,have ; middle is the base of the natural logarithm. These are integer variables; the mixed data is used to determine the target loss function and train the model.

8. The method according to claim 7, characterized in that, The target loss function is: in, , For the parameter space of the model, These are the parameters of the model; This is the original data; This is the first de-identified data; This is the second set of anonymized data. yes and The common corresponding loss function, yes and The common corresponding loss function, yes and The common corresponding loss function, yes and The common corresponding loss function.

9. A privacy information protection device, characterized in that, The device includes: The data acquisition module is used to acquire the first de-identified data corresponding to the original data. The original data corresponds to privacy requirement parameters. The privacy requirement parameters are used to determine the first perturbation function. The first perturbation function is used to perturb the data in each dimension of the original data to obtain the first perturbation data. The first de-identified data is obtained by using a constraint function to constrain the data in each dimension of the first perturbation data to the value range of the corresponding dimension. The original data contains privacy information. The data perturbation module is used to perturb the data in each dimension of the first perturbation data using a second perturbation function to obtain the second perturbation data. The second perturbation function is determined according to the privacy requirement parameters. The data constraint module is used to constrain the data in each dimension of the second perturbation data to the value range of the corresponding dimension using the constraint function, thereby obtaining the second desensitized data. The first desensitized data and the second desensitized data are used to determine the target loss function and train the model.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images