Trusted rag retrieval method and system based on document-level differential privacy budget

Abstract

The application provides a kind of based on document level difference privacy budget trusted RAG retrieval method and system, it is related to retrieval enhancement generation technical field, method includes following steps: S1, construct the double-layer privacy budget account book of record multidimensional budget state;S2, calculate original similarity score;S3, read source document current remaining budget, combine global budget with single upper limit to calculate the effective total budget of this query;S4, filter out Top-N candidate set and obtain fine arrangement disturbance score;S5, select Top-K document block return;S6, update double-layer account book in atomic transaction mode, and according to remaining budget, execute multi-level privacy degradation strategy.The application greatly reduces the loss of noise on retrieval quality through two-stage budget splitting and smoothing sensitivity, and effectively prevents budget dissipation and side channel inference attack by combining double-layer account book and multi-level degradation strategy, to achieve high security and high availability trusted RAG retrieval.

Description

Technical Field

[0001] This invention relates to the field of retrieval enhancement generation technology, and more particularly to a trusted RAG retrieval method and system based on document-level differential privacy budget. Background Technology

[0002] Retrieval-Augmented Generation (RAG) technology, by combining external knowledge base retrieval with large language model generation, significantly improves the knowledge coverage and answer accuracy of large models in specialized fields. It is currently widely used in high-value and data-sensitive scenarios such as enterprise knowledge management, medical consultation, and legal inquiries. Differential Privacy (DP) technology provides rigorously quantifiable privacy guarantees by injecting controlled random noise into data or query results. The core parameter of differential privacy, privacy budget, is typically denoted as... Used to control the strength of privacy protection. A smaller value indicates a higher level of privacy protection, but it also leads to a greater loss of data utility. With the widespread application of search-enhanced generation systems, how to protect the privacy of documents in knowledge bases has become an urgent problem to be solved.

[0003] Currently, existing technologies related to privacy-preserving RAG (Reference-Based Access) mainly include the following schemes: The first scheme is a document-level differential privacy framework based on individual privacy filters, represented by MURAG or Private-RAG. This scheme allows privacy loss to accumulate with the retrieval frequency of individual documents rather than with the total number of queries in the system. The second scheme is a document-level differential privacy scheme at the generation stage. This scheme provides differential privacy guarantees only at the document level during the generation stage; the retrieval stage itself is not protected by differential privacy. The third scheme is a token-row-level differential privacy scheme. This scheme adds noise protection to the key-value matrix of the attention mechanism, using individual token rows as privacy units. The fourth scheme is a secure Top-k retrieval selection scheme based on differential privacy. This scheme adds noise to the selection process of Top-k documents through an exponential mechanism to prevent the selection results from leaking information about documents not selected. The fifth scheme is a query vector differential privacy scheme, represented by CAPRISE. This scheme applies perturbations to the user's query embedding vector to protect the user's query intent. The sixth approach is RAG permission management based on Access Control Lists (ACLs), which restricts document visibility through traditional permission checks.

[0004] Each of the aforementioned existing technologies has significant limitations. The first approach uses a one-size-fits-all strategy to allocate a uniform initial privacy budget to all documents, failing to differentiate the sensitivity of different documents. It also lacks a dynamic degradation protection mechanism after the budget is exhausted. Its model architecture is only suitable for single-user scenarios and does not support fair budget allocation and isolation in multi-tenant or multi-user concurrent scenarios. Furthermore, it only covers the retrieval stage and lacks differential privacy combination and tracking mechanisms across the retrieval and generation stages. The second approach's retrieval stage itself is not protected by differential privacy; attackers can still obtain sensitive information through the exposure of retrieval results, leading to significant privacy leakage risks in the retrieval process. The third approach's protection granularity is at the sub-document level, making it impossible to achieve independent tracking and management of document-level privacy budgets at the system level. The fourth approach only targets the sorting and selection step and does not establish an independent privacy budget ledger mechanism at the document level, thus failing to control the cumulative privacy loss of documents during multiple retrievals. The fifth approach is query-side (user-end) privacy protection, which is fundamentally different from protecting the privacy of document-side (knowledge base content) privacy in terms of technical logic and application scenarios, and cannot solve the problem of malicious extraction of knowledge base documents. The sixth approach falls under deterministic access control, allowing unrestricted access once a user has permission. It fails to defend against malicious, high-frequency probes from compliant users and cannot provide statistically significant differential privacy quantification guarantees. In summary, existing retrieval-enhanced generation privacy protection solutions have significant gaps in areas such as differentiated allocation of document-level privacy budgets, dynamic degradation mechanisms, multi-user budget scheduling, and end-to-end privacy tracking, making it difficult to meet the security needs of highly sensitive knowledge bases in complex business scenarios. Summary of the Invention

[0005] In view of this, the purpose of this invention is to propose a trusted RAG retrieval method and system based on document-level differential privacy budget, so as to solve the technical problem in the prior art that it is impossible to allocate privacy budgets differently for documents with different levels of sensitivity.

[0006] The technical means employed in this invention are as follows: A trusted RAG retrieval method based on document-level differential privacy budgeting includes the following steps: S1. For new documents received by the knowledge base, an initial privacy budget and an upper bound for the privacy failure probability are allocated to the document according to the confidentiality level of the document; the confidentiality level is evaluated based on static metadata annotation and deep learning sensitivity quantification based on variational information bottleneck; a two-layer privacy budget ledger is constructed, which records the remaining privacy budget, consumed privacy budget, cumulative consumption across cycles, lifecycle limit, upper bound for privacy failure probability, and the timestamp of the last budget reset for each user-document pair; S2. Receive natural language queries initiated by users, convert natural language queries into query embedding vectors, and calculate the original similarity score between the query embedding vectors and the document block vectors of each document block in the knowledge base. S3. Read the current remaining privacy budget of the source document to which each document block belongs, and calculate the effective total budget for this query based on the current remaining privacy budget in the two-layer privacy budget ledger, the global document budget, and the preset single query budget limit. S4. The effective total budget mentioned in S3 is divided into coarse-ranking sub-budgets and fine-ranking sub-budgets: In the coarse-ranking stage, the coarse-ranking Laplace noise scale is calculated based on the coarse-ranking sub-budgets and local smoothing sensitivity. The coarse-ranking Laplace noise scale is injected into the original similarity score mentioned in S2 to obtain the coarse-ranking perturbation score, and a preliminary Top-N candidate set is selected; In the fine-ranking stage, the fine-ranking Laplace noise scale is calculated based on the fine-ranking sub-budgets and local smoothing sensitivity. The fine-ranking Laplace noise scale is injected into the original similarity score of the Top-N candidate set to obtain the fine-ranking perturbation score; S5. Sort the Top-N candidate sets in descending order according to the fine-sorting perturbation scores described in S4, and select the K document blocks with the highest scores as the candidate document set to return; S6. Synchronously update the user sub-ledger and global ledger using atomic transactions, and execute a multi-level privacy degradation strategy based on the updated remaining budget.

[0007] Furthermore, in S1, the specific steps for allocating an initial privacy budget and an upper bound on the privacy failure probability for each document are as follows: The privacy risks of documents are assessed based on two dimensions: static metadata annotation and deep learning-based sensitivity quantification based on variational information bottlenecks. The assessment results of the two dimensions are uniformly normalized into a risk score of [0,1], and a comprehensive privacy risk score is calculated. The calculation formula is as follows:

[0008] in, Risk scores are statically labeled. Quantifying the expected value of privacy risks for deep learning and The weighting coefficients set for the system and satisfying + = 1; Based on the comprehensive privacy risk score The sensitivity levels are mapped directly to four levels L: low, medium, high, and very high. An initial privacy budget is then automatically allocated based on the sensitivity level. Upper bound of privacy failure probability Initial privacy budget Representative document The maximum amount of private information that can be disclosed within a given period.

[0009] Furthermore, in S1, the specific steps of the deep learning sensitivity quantification based on variational information bottleneck are as follows: Document Input a pre-trained language model to extract text representation vectors ; Text representation vectors are processed through an encoder network. Mapped to the probability distribution space, the output mean is calculated. and variance And low-dimensional latent variables are obtained by sampling using reparameterization techniques. ; During the model training phase, maximize the latent variables. With real privacy labels Mutual information between At the same time, minimize the input With latent variables Mutual information between By introducing KL divergence as a regularization term, we force the model to express forgetting as privacy-independent; The purified latent variables Input a classification decoder, output a continuous expected value of privacy risk. .

[0010] Furthermore, in S1, the two-layer privacy budget ledger includes a user-document sub-ledger. and global document ledger; User-Document Subledger The formula used to track the intra-period status and cross-period history of a single user and a single document is as follows:

[0011] Global Document Ledger The formula used to track the total exposure of a document to all users and defend against multi-user collaborative attacks is as follows:

[0012] in, For user u, regarding the document Current period remaining budget This represents the budget consumed by user u within the current period. For user u, regarding the document Total cumulative consumption across cycles; For user u to document The total lifecycle budget cap, This is the timestamp of the last budget reset. For document Remaining global budget for all users; When the user's remaining budget or overall budget When exhausted, a circuit breaker is applied to the user-document combination.

[0013] Furthermore, in S2, when the system receives a natural language query request q from user u, it performs differential privacy retrieval, calls the same pre-trained language model as in the knowledge base construction phase, and transforms the user query q into a high-dimensional continuous query embedding vector. :

[0014] Traverse the vector database, for each document block in the knowledge base. With document block vector Original similarity scores between : .

[0015] Furthermore, in S3, the calculation of the effective total budget for this query is specifically performed using the following formula:

[0016] in, This is the preset budget limit for a single query.

[0017] Furthermore, in S4, the specific calculation formulas for the coarse sorting stage and the fine sorting stage are as follows: In the coarse-ranking stage, the coarse-ranking Laplace noise scale is used.

[0018] in, For local smoothing sensitivity; The coarse perturbation score after adding noise is:

[0019] in, The original similarity score. For coarse-out Laplace noise scale, This indicates a mean of 0 and a scale of 0. The Laplace distribution sampling values ​​are used; the coarse similarity of global document blocks is quickly calculated with privacy overhead to filter out the initial Top-N candidate set; For the Top-N candidate set recalled by the coarse ranking, allocate the remaining budget for the fine ranking sub-budget:

[0020] The candidate documents are precisely ranked, and the Laplace noise scale is finely adjusted.

[0021]

[0022] in, The original similarity score. For finely sorted Laplace noise scale, This indicates a mean of 0 and a scale of 0. The Laplace distribution sampled values.

[0023] Furthermore, in S6, based on the effective privacy budget actually consumed in this query... Synchronously update user sub-ledgers and global document ledgers; The user sub-ledger update formula is as follows:

[0024]

[0025] in, For document The initial allocation of total privacy budget, For user u to the document Privacy budget already consumed, This represents the actual effective privacy budget consumed in this query. For the updated remaining privacy budget; The global document ledger update formula is as follows:

[0026] The formula for cumulative updates across cycles is as follows:

[0027] After each update, determine Has the lifecycle limit been reached?

[0028] Furthermore, in S6, the multi-level privacy degradation strategy adopts a dual-threshold mechanism, specifically including: Set a Level 1 warning threshold. and secondary circuit breaker threshold ,in, ; Level 1 warning stage, current remaining privacy budget When this occurs, the first-level warning is triggered, and the system increases the Laplace noise scale, which naturally reduces the document's search ranking probability. Level 2 circuit breaker stage: when When the circuit breaker is triggered at level two, the system does not physically delete the document, but instead sets the effective allocation budget for the document to a preset minimum positive value. ; When the cumulative consumption across cycles Greater than or equal to the preset total lifecycle budget limit When the circuit breaker condition is triggered, the corresponding user-document pair will be permanently locked in privacy mode. Periodically triggered privacy locks will be automatically released when the next cycle begins, while permanent privacy locks can only be released through specific permission commands.

[0029] This invention also provides a trusted RAG retrieval system based on document-level differential privacy budgeting, for implementing the trusted RAG retrieval method based on document-level differential privacy budgeting described in any one of the above claims, comprising: The document privacy budget initialization module assesses the confidentiality level of each document in the knowledge base based on two dimensions: static metadata annotation and deep learning sensitivity quantification based on variational information bottlenecks. It allocates an initial privacy budget, a total lifetime budget cap, a single query budget cap associated with the sensitivity level, and a budget reset timestamp for each document. It also constructs a two-layer privacy budget ledger, which includes a user sub-ledger and a global document ledger. The user sub-ledger records the remaining budget, consumed budget, cumulative consumption across periods, lifetime cap, and last budget reset timestamp for each user-document pair. The global document ledger records the global remaining budget for each document. The differential privacy retrieval execution module receives user queries and transforms them into query embedding vectors. It calculates the original similarity score between the query embedding vector and the document block vector of each document block in the knowledge base. It reads the current remaining privacy budget of the source document to which each document block belongs from the two-layer privacy budget ledger and calculates and determines the effective allocation budget for this query. A multi-stage adaptive noise calibration module is used to perform document screening based on the effective allocation budget and the original similarity scores. Specifically, it includes: a coarse ranking unit: allocating a first share from the effective allocation budget as a coarse ranking sub-budget, calculating a first Laplace noise scale based on the coarse ranking sub-budget, injecting noise sampled from the Laplace distribution into the original similarity scores of each document block to obtain a coarse ranking perturbation score, and selecting a preliminary candidate set containing N document blocks based on the coarse ranking perturbation scores; a fine ranking unit: for the preliminary candidate set, using the difference between the effective allocation budget and the coarse ranking sub-budget as a fine ranking sub-budget, calculating a second Laplace noise scale based on the fine ranking sub-budget, injecting noise sampled from the Laplace distribution into the original similarity scores of each document block in the preliminary candidate set to obtain a fine ranking perturbation score, sorting according to the fine ranking perturbation scores, and selecting the K document blocks with the highest scores as the final candidate document set to be returned. The budget dynamic management module updates the two-layer privacy budget ledger in an atomic transaction manner after each retrieval, based on the effective budget actually consumed by each source document in this query: It accumulates the consumed budget and updates the remaining budget and cross-period cumulative consumption in the user sub-ledger, and deducts the global remaining budget in the global document ledger. Based on the updated remaining budget, it executes a multi-level privacy degradation strategy, including: during the warning phase, the effective budget is reduced due to the constraint of the remaining budget, and the Laplace noise scale increases accordingly; during the circuit breaker phase, the corresponding user-document pair or the document globally is marked as privacy locked, and during the locking period, a preset minimum positive value is used as the corresponding available budget for subsequent noise scale calculations; the user sub-ledger is maintained independently for each user-document pair to achieve budget isolation in multi-user concurrent scenarios. The output of the document privacy budget initialization module connects to the input of the budget dynamic management module, providing the budget dynamic management module with an initialized two-layer privacy budget ledger. The output of the budget dynamic management module connects to the input of the differential privacy retrieval execution module, providing the differential privacy retrieval execution module with the current user's remaining budget for each source document and the global remaining budget for each document. The output of the differential privacy retrieval execution module connects to the input of the multi-stage adaptive noise calibration module, providing it with the original similarity score and the effective allocated budget. The output of the multi-stage adaptive noise calibration module connects to the input of the budget dynamic management module, providing the budget dynamic management module with the effective budget actually consumed by each source document in this retrieval, which is used to trigger ledger updates.

[0030] Compared with the prior art, the present invention has the following advantages: Compared to existing coarse-grained system-level or query-level differential privacy schemes, this invention innovatively refines privacy accounting to the document level. By dynamically allocating and consuming budgets for documents with different sensitivities, it implements stricter noise protection for highly sensitive documents and maintains retrieval quality to the greatest extent possible for low-sensitivity documents. This mechanism effectively overcomes the utility loss caused by traditional uniform strategies, achieving a balance between the strength of privacy protection and the utility of RAG retrieval overall.

[0031] This invention establishes a document-level privacy budget ledger, ensuring a complete historical record of each document's budget initialization, dynamic deductions, and remaining status. This mechanism not only achieves end-to-end traceability of privacy consumption but also perfectly aligns with the compliance requirements of data protection regulations such as GDPR regarding explainability and data access logs, providing robust technical support for enterprise-level privacy compliance governance.

[0032] To address the member inference attack and document recovery attack faced by large-scale RAG systems, this invention introduces an adaptive degradation and circuit breaker mechanism based on remaining budget. When a document is frequently retrieved, causing a budget alert, the system automatically increases the noise injection amount or blocks access, fundamentally preventing attackers from reconstructing the original document data through unlimited, low-cost queries, thus greatly improving the overall security of the knowledge base system.

[0033] The document-level budget initialization strategy of this invention supports highly customizable configuration and can be flexibly adjusted according to the data classification standards of different vertical fields. Whether it is medical and health records with extremely high privacy requirements, financial and legal files, or regular government information disclosure data, it can adaptively match the corresponding privacy protection strategies, giving this system extremely high commercial application value and cross-domain promotion potential.

[0034] By combining a fine-grained user-level budget sharing mechanism, this invention effectively isolates the consumption of privacy resources by different users. This mechanism completely solves the problem in traditional shared knowledge bases where a few malicious or high-frequency users exhaust the privacy budget of a shared document, effectively ensuring the quality and fairness of retrieval services for all users under a multi-tenant RAG architecture. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a system architecture diagram of the present invention.

[0037] Figure 2 This is a schematic diagram of the two-layer privacy budget ledger structure of the present invention.

[0038] Figure 3 This is a diagram illustrating the multi-level privacy degradation strategy of this invention.

[0039] Figure 4 This is a flowchart of the two-stage budget allocation and noise injection process for coarse / fine sorting in this invention. Detailed Implementation

[0040] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0042] like Figure 1 As shown, this invention provides a trusted RAG retrieval method based on document-level differential privacy budgeting, comprising the following steps: S1. For new documents received by the knowledge base, allocate an initial privacy budget and an upper bound on the privacy failure probability to the document based on its confidentiality level; the confidentiality level is evaluated based on static metadata annotation and deep learning sensitivity quantification based on variational information bottlenecks; construct a two-layer privacy budget ledger, which records the remaining privacy budget, consumed privacy budget, cumulative consumption across periods, lifecycle limit, upper bound on privacy failure probability, and the timestamp of the last budget reset for each user-document pair; specifically: When the knowledge base receives a new document, the system first needs to assess the document's confidentiality level and allocate an appropriate privacy protection allowance. Assume the document being processed is the [number]th document in the knowledge base. A document, denoted as The system uses a multi-dimensional hybrid sensitivity classification strategy to classify each document. Assign two core differential privacy control parameters: Initial privacy budget : Represents document The maximum amount of private information that can be disclosed within a given period. The smaller the value, the greater the interference noise injected by the system, and the stronger the privacy protection.

[0043] Upper bound of privacy failure probability It represents the extremely small probability that, in extreme cases, the system allows the privacy protection mechanism to fail. It is usually a very small value, such as .

[0044] The allocation of the above parameters is based on a weighted fusion of the following two dimensions: (a) Static annotation based on metadata: directly reading the tags or attributes that are already present in the document. Tags or attributes include public, internal, and confidential. (b) Sensitive quantification of deep learning based on variational information bottleneck: Introducing a lightweight pre-trained language model such as RoBERTa and utilizing the variational information bottleneck algorithm to deeply understand the contextual semantics, ultimately outputting a continuous expected value of privacy risk. .in ∈ [0,1], the closer the value is to 1, the higher the risk of the document containing deep privacy; the specific quantification process is as follows: Semantic feature extraction: extracting semantic features from documents Input the pre-trained language model and extract text representation vectors containing rich contextual information. ; Latent variable space mapping: text representation through an encoder network. Mapped to a probability distribution space, output mean and variance And low-dimensional latent variables are obtained by sampling using reparameterization techniques. ; Mutual information optimization: During the model training phase, the core optimization objective is to maximize the latent variables. With real privacy labels Mutual information between At the same time, minimize the input With latent variables Mutual information between By introducing KL divergence as a regularization term, the model is forced to forget privacy-irrelevant representations and retain only the most essential privacy features. Expected risk output: the purified latent variables The input is a classification decoder, and the final output is a continuous expected value of privacy risk. ,in ∈ [0,1].

[0045] To calculate the final sensitivity of the document, the evaluation results of the two dimensions mentioned above are uniformly normalized to a risk score of [0,1], and a comprehensive privacy risk score is calculated. The specific fusion formula is as follows:

[0046] in: and These correspond to risk scores for static annotation and deep learning quantization, respectively. and The weighting coefficients set for the system satisfy the following conditions: To leverage the semantic understanding advantages of large models, it is common practice to set... ,like .

[0047] Calculation Then, the system directly maps the values ​​to four sensitivity levels—low, medium, high, and extremely high—based on preset numerical threshold ranges. Based on this, an initial privacy budget is automatically allocated to each document. Upper bound of privacy failure probability .

[0048] After initialization, the system builds and maintains a two-layer privacy budget ledger at the bottom layer to track the intra-cycle consumption and cross-cycle accumulation of each user-document pair.

[0049] User-Document Subledger (Tracking the intra-cycle status and cross-cycle history of a single user and a single document):

[0050] Global Document Ledger (Tracking the total exposure of documents to all users to defend against multi-user coordinated attacks):

[0051] The specific meanings of each symbol are as follows: User u regarding the document The current period's remaining budget. Initially, it equals... Each time the document is retrieved, the balance will decrease accordingly, and it will be restored to full value upon periodic reset. : The budget consumed by user u in the current period; User u regarding the document The total cumulative consumption across cycles. This field does not return to zero when the cycle is reset, but continues to increment, and is used to detect the overall privacy loss accumulated over a long period; User u on document The total lifecycle budget cap.

[0052] : The timestamp of the last budget reset.

[0053] : document The remaining global budget for all users.

[0054] When the user's remaining budget or overall budget When the limit is reached, the system will apply a circuit breaker to the user-document combination.

[0055] S2. Receive natural language queries initiated by users, convert the natural language queries into query embedding vectors, and calculate the original similarity score between the query embedding vectors and the document block vectors of each document block in the knowledge base; specifically: When the system receives a user's natural language query request At this time, the Differential Privacy Retrieval Execution (DPRE) module will be launched, and the specific retrieval and noise addition process includes the following steps: Query vectorized representation; It calls the same pre-trained language model used in the knowledge base construction phase to process user queries. Transform into a high-dimensional continuous query embedding vector :

[0056] Precise similarity calculation; Traverse the vector database, for each document in the knowledge base belonging to the source document document blocks The query vector is calculated using cosine similarity or inner product. With document block vector Original similarity scores between :

[0057] S3. Read the current remaining privacy budget of the source document to which each document block belongs. Calculate the effective allocation budget for this query based on the current remaining privacy budget in the two-layer privacy budget ledger and the preset single query budget cap. Then, based on the effective allocation budget and the global sensitivity of the similarity scoring function, calculate the Laplacian noise scale to be injected into each document block, and temporarily store the value of the effective allocation budget during this query. Specifically: To achieve document-level differential privacy protection, the system needs to base its decisions on the source document. Current remaining privacy budget Dynamically calculate the Laplace noise scale that needs to be injected into this document block. .first, To prevent excessive resource consumption in a single query, the system also considers the remaining budget of the current user's sub-ledger for that document. The remaining budget in the global document ledger of this document. And the system's preset budget limit for a single query. The minimum of the three values ​​is taken as the effective total budget for this query.

[0058] Subsequently, the scale parameters of the Laplace noise were calculated. :

[0059] in, Similarity scoring function The global sensitivity. Since this embodiment uses cosine similarity, the maximum similarity difference between any two document block vectors in extreme cases is 2. Therefore, the system will... It is calibrated to a constant of 2.

[0060] S4. The effective total budget mentioned in S3 is divided into coarse-ranking sub-budgets and fine-ranking sub-budgets: In the coarse-ranking stage, the coarse-ranking Laplace noise scale is calculated based on the coarse-ranking sub-budgets and local smoothing sensitivity. The coarse-ranking Laplace noise scale is injected into the original similarity score mentioned in S2 to obtain the coarse-ranking perturbation score, and a preliminary Top-N candidate set is selected; In the fine-ranking stage, the fine-ranking Laplace noise scale is calculated based on the fine-ranking sub-budgets and local smoothing sensitivity. The fine-ranking Laplace noise scale is injected into the original similarity score of the Top-N candidate set to obtain the fine-ranking perturbation score; Specifically: Based on the calculated scale parameters From a mean of 0 and a scale of Noise is sampled from the Laplace distribution and injected into the original similarity score to obtain the noisy similarity score. :

[0061] S5. Sort the Top-N candidate sets in descending order according to the fine-sorting perturbation scores described in S4, and select the K document blocks with the highest scores as the candidate document set to return; specifically: Based on the set of fractions after injecting noise Sort in descending order and select the highest score. Each document block is returned as a candidate document set. Since the ranking is based on the perturbed score, attackers cannot infer from the minute changes in the recall results whether a specific document actually exists in the knowledge base, thus satisfying the requirement... Differential privacy guarantee.

[0062] S6. Synchronously update the user sub-ledger and global ledger using atomic transactions, and execute a multi-level privacy degradation strategy based on the updated remaining budget. Specifically: After each retrieval task is completed, the budget ledger management module will analyze the source documents accessed in this retrieval result. Strict budget deductions and status updates are implemented. The specific management mechanism is as follows: Step 1: Update the budget ledger; The system uses the actual effective privacy budget consumed in this query. It synchronously updates the user sub-ledger and the global document ledger using atomic transactions.

[0063] Among them, user sub-ledger updates:

[0064]

[0065] in, For document The initial allocation of total privacy budget, For user u to the document Privacy budget already consumed, This represents the actual effective privacy budget consumed in this query. For the updated remaining privacy budget.

[0066] Global document ledger update:

[0067] Cross-cycle cumulative update:

[0068] After each update, the system determines Has the lifecycle limit been reached?

[0069] Step 2: Multi-level privacy degradation strategy based on thresholds; The multi-level privacy degradation strategy employs a dual-threshold mechanism, specifically including: Set a Level 1 warning threshold. and secondary circuit breaker threshold ,in, ; Level 1 warning stage, current remaining privacy budget When this occurs, the first-level warning is triggered, and the system increases the Laplace noise scale, which naturally reduces the document's search ranking probability. Level 2 circuit breaker stage: when When the circuit breaker is triggered at level two, the system does not physically delete the document, but instead sets the effective allocation budget for the document to a preset minimum positive value. This allows the injected noise to mask the document's true similarity score, thus achieving periodic privacy locking.

[0070] When the cumulative consumption across cycles Greater than or equal to the preset total lifecycle budget limit When the circuit breaker condition is triggered, the corresponding user-document pair will be permanently locked in privacy mode. The privacy lock triggered periodically will be automatically released when the next period begins, while the permanent privacy lock can only be released by specific permission commands.

[0071] Step 3: Fine-grained budget isolation for multi-tenant / multi-user scenarios. In scenarios with concurrent access from multiple users, to prevent malicious single-user attacks or high-frequency probes from exhausting the common budget of a core document, the BLM module introduces a user-identifier-based joint budget isolation mechanism (Per-User Per-Document Budgeting). The system allocates budgets for each user-document pair... Maintaining independent sub-ledgers This ensures that when a single user's budget is exhausted, the document becomes invisible only to that specific user, without affecting the search experience of other normal users.

[0072] This invention also includes a multi-stage adaptive noise calibration and budget allocation step, specifically: To achieve the optimal balance between retrieval accuracy, computational efficiency, and privacy budget consumption, the system introduces an Adaptive Noise Calibration (ANC) module, which implements differentiated budget allocation and noise addition strategies during the coarse-ranking and fine-ranking stages of retrieval: Coarse ranking phase: A relatively lenient privacy budget allocation strategy is adopted. The system allocates a smaller budget share to global retrieval. According to the aforementioned scaling formula A smaller budget will result in larger-scale Laplace noise. This stage aims to quickly compute the coarse similarity of global document blocks with extremely low privacy overhead, and to filter out an initial Top-N candidate set; Fine-ranking phase: For the Top-N candidate set recalled by the coarse-ranking, the system allocates the remaining single-query budget. .because With a relatively large allocation ratio, the injected noise scale is reduced accordingly, enabling the system to perform high-precision semantic re-scoring and accurate ranking of candidate documents. Low-budget truncation and adaptive degradation: Before entering the fine-ranking stage, the system dynamically verifies the remaining budget of candidate documents. If a document's budget is low... Extremely low, for example, insufficient to support If a document is deducted, the system will trigger an early exit mechanism, meaning it will not undergo fine sorting and rescoring, but will instead use its initial perturbation score from the coarse sorting stage for the final ranking. This mechanism not only effectively prevents budget overruns but also significantly reduces the system's inefficient computing power. Privacy Guarantee Based on Advanced Combination Theorems: Since multi-stage retrieval involves multiple accesses and scoring of the same underlying data, the ANC module relies on advanced combination theorems of differential privacy for loss calculation. This ensures that a single complete retrieval task is effective for the document. Overall privacy loss caused Controlled, that is This ensures global privacy and security under the multi-stage cascaded noise-adding architecture.

[0073] This invention also provides a trusted RAG retrieval system based on document-level differential privacy budgeting, comprising: The Document Privacy Budget Initialization Module (DPBI Module) evaluates the confidentiality of each document in the knowledge base based on three dimensions: static annotation of the document's metadata, the results of deep learning sensitivity quantification based on variational information bottlenecks, and explicit manual configuration. It allocates an initial privacy budget, an upper bound on the probability of privacy failure, and a budget reset timestamp for each document and constructs a two-dimensional privacy budget ledger. The two-dimensional privacy budget ledger contains the remaining privacy budget, consumed privacy budget, upper bound on the probability of privacy failure, and the timestamp of the last budget reset for each document. The Differential Privacy Retrieval Execution Module (DPRE module) receives user queries and transforms them into query embedding vectors. It calculates the original similarity score between the query embedding vector and the document block vector of each document block in the knowledge base. It reads the current remaining privacy budget of the source document to which each document block belongs from the two-dimensional privacy budget ledger. Based on the current remaining privacy budget and the preset single query budget limit, it calculates the effective allocation budget and the Laplace noise scale. It samples noise from the Laplace distribution and injects it into the original similarity score to obtain a noisy similarity score. It sorts the documents according to the noisy similarity scores and selects the K document blocks with the highest scores as a candidate document set to return. The Budget Dynamic Management (BLM) module updates the consumed and remaining privacy budgets of the accessed source documents in the two-dimensional privacy budget ledger after each retrieval based on the effective privacy budget actually consumed in this query. It then executes a multi-level privacy degradation strategy based on the updated remaining privacy budget. This strategy includes increasing the noise scale and reducing the document exposure weight during the warning phase, and marking documents as privacy locked during the circuit breaker phase without physical deletion. Instead, a preset minimum positive value is used as the available budget for subsequent noise calculations. Simultaneously, an independent sub-ledger is maintained for each user-document pair to achieve budget isolation in multi-user concurrent scenarios. The user sub-ledger and global ledger are updated using atomic transactions.

[0074] The Adaptive Noise Calibration (ANC) module implements differentiated budget allocation in the coarse ranking and fine ranking stages of retrieval. In the coarse ranking stage, the first budget share is allocated for global noise addition and preliminary screening to obtain the Top-N candidate set. In the fine ranking stage, the second budget share is allocated to re-score and accurately rank the Top-N candidate set. Before the fine ranking stage, the remaining budget of the candidate documents is checked to determine whether to skip the fine ranking. At the same time, based on the differential privacy advanced combination theorem, the overall privacy loss after the cascaded noise addition in the coarse and fine ranking stages is controlled. The output of the document privacy budget initialization module is connected to the input of the budget dynamic management module, providing the budget dynamic management module with an initialized two-dimensional privacy budget ledger. The output of the budget dynamic management module is connected to the input of the differential privacy retrieval execution module, providing the differential privacy retrieval execution module with the current remaining privacy budget for each document. The adaptive noise calibration module is connected to both the differential privacy retrieval execution module and the budget dynamic management module, providing the differential privacy retrieval execution module with budget allocation strategies for each stage of coarse and fine ranking, and providing the budget dynamic management module with the total budget value actually consumed in the two stages of coarse and fine ranking for ledger updates.

[0075] Example Safety retrieval of ship collision avoidance files based on the maritime data sharing platform; Application Scenario Background: Suppose a maritime safety administration has deployed a smart maritime data sharing platform. The platform's knowledge base contains a vast amount of ship navigation logs, port dispatch instructions, and accident investigation files. Currently, a shipping company has dispatchers as users. I logged into the platform hoping to retrieve information on the navigation safety of a specific waterway recently.

[0076] Step 1: Maritime document import and privacy budget initialization, i.e., the DPBI module workflow; Document Input: A new core document has been added to the Maritime Knowledge Base. — Record of collision avoidance and high-value cargo dispatch in Yangshan Deep-Water Port Channel.

[0077] Sensitivity quantification: Static labeling: The system reads the metadata tags of this volume as internal scheduling references and maps them to a static risk score. .

[0078] AI-powered deep quantification: The system inputs the case file text into a finely tuned maritime pre-trained language model. The variational information bottleneck algorithm identifies deep-seated sensitive features in the text, such as the dynamic tracks of specific LNG dangerous goods vessels and commercial freight schedules, and outputs an expected value for privacy risks. .

[0079] Fusion computing: The system did not detect any manually forced configurations and adopted weighted fusion (assuming...). ), calculate the final sensitivity score:

[0080] Budget allocation and accounting: Based on a preset threshold, a score of 0.775 falls into the high sensitivity level. The system automatically assigns a document... Allocate initial privacy budget Maximum query limit per session Upper bound of privacy failure probability Simultaneously calculate its local smoothing sensitivity. The system establishes user sub-ledgers and a global ledger. The user sub-ledger shows the current remaining budget of d1 as u1, which is 2.0, with a lifecycle cap of 20.0. The global ledger shows the global remaining budget of d1 as 20.0. A first-level warning threshold of 1.0 and a second-level circuit breaker threshold of 0.001 are set.

[0081] Step 2: Maritime Natural Language Query and Multi-stage Noise Addition, i.e., the collaborative process of DPRE and ANC modules; Inquiry initiated by: Shipping company dispatcher Input natural language query What are the recent collision avoidance maneuver records for LNG vessels at Yangshan Port? The system will... Convert to query vector :

[0082] calculate With Documents Original cosine similarity of a data block .

[0083] When the query arrives, the system compares the status of the sub-ledger. The previous upper limit and the global ledger status =20.0, calculate the total effective budget for this transaction: 0.5 Coarse sorting stage (ANC adaptive allocation): System allocates coarse sub-budget Calculate the coarse-ranked noise scale. 0.6.

[0084] The system from Medium sampling noise is used to obtain coarse perturbation scores. .document With this score, they successfully entered the Top-50 candidate set.

[0085] Fine-tuning phase (ANC adaptive allocation): The system selects documents that enter the candidate set. Perform fine-tuning and allocate fine-tuning sub-budgets. .

[0086] Calculate the noise scale of the fine sorting The system from Medium sampling noise is used to obtain the fine-sorted perturbation score. .

[0087] The system ultimately sorts the documents based on a perturbation score of 0.85. Returned to the scheduler as one of the Top-K results Due to random fluctuations in the scores, competitors cannot deduce the existence of a specific voyage for the LNG vessel using the precise scores. Total loss in this query. .

[0088] Step 3: Ledger update and dynamic degradation, i.e., the BLM module workflow; To prevent budget overdrafts caused by concurrent queries, the system synchronously updates the ledger using atomic read-verify-write transactions. Once the retrieval is complete, the system immediately updates the document. In users Separate ledgers under one's name:

[0089]

[0090] Triggering a warning / yellow zone: Assuming the system's set warning threshold If u1 initiates a second query, the remaining budget drops to 1.0. The system triggers the first level of privacy degradation strategy. The system can increase the scale of Laplace noise and reduce its exposure.

[0091] Triggering circuit breaker / red zone: Assuming user Malicious high-frequency queries trigger a level 2 circuit breaker, employing an extremely low baseline budget and generating extremely high noise levels. Document d1 still appears in the candidate set, but its retrieval score is completely randomized, effectively blocking the vulnerability of side-channel inference based on document appearance / disappearance patterns.

[0092] Multi-tenant isolation guarantee: At this time, a dispatcher from another shipping company... Log in to the system to query. Because the BLM module uses a user-document dual-segregated ledger, documents... against The remaining budget remains at the initial 2.0. Therefore, Normal maritime search operations are completely unaffected Despite the impact of budget exhaustion, a perfect balance between security and availability was achieved for multi-tenant concurrent access in the maritime data sharing platform.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A trusted RAG retrieval method based on document-level differential privacy budgeting, characterized in that, Includes the following steps: S1. For new documents received by the knowledge base, an initial privacy budget and an upper bound for the privacy failure probability are allocated to the document according to the confidentiality level of the document; the confidentiality level is evaluated based on static metadata annotation and deep learning sensitivity quantification based on variational information bottleneck; a two-layer privacy budget ledger is constructed, which records the remaining privacy budget, consumed privacy budget, cumulative consumption across cycles, lifecycle limit, upper bound for privacy failure probability, and the timestamp of the last budget reset for each user-document pair; S2. Receive natural language queries initiated by users, convert natural language queries into query embedding vectors, and calculate the original similarity score between the query embedding vectors and the document block vectors of each document block in the knowledge base. S3. Read the current remaining privacy budget of the source document to which each document block belongs, and calculate the effective total budget for this query based on the current remaining privacy budget in the two-layer privacy budget ledger, the global document budget, and the preset single query budget limit. S4. The effective total budget mentioned in S3 is divided into coarse-ranking sub-budgets and fine-ranking sub-budgets: In the coarse-ranking stage, the coarse-ranking Laplace noise scale is calculated based on the coarse-ranking sub-budgets and local smoothing sensitivity. The coarse-ranking Laplace noise scale is injected into the original similarity score mentioned in S2 to obtain the coarse-ranking perturbation score, and a preliminary Top-N candidate set is selected; In the fine-ranking stage, the fine-ranking Laplace noise scale is calculated based on the fine-ranking sub-budgets and local smoothing sensitivity. The fine-ranking Laplace noise scale is injected into the original similarity score of the Top-N candidate set to obtain the fine-ranking perturbation score; S5. Sort the Top-N candidate sets in descending order according to the fine-sorting perturbation scores described in S4, and select the K document blocks with the highest scores as the candidate document set to return; S6. Synchronously update the user sub-ledger and global ledger using atomic transactions, and execute a multi-level privacy degradation strategy based on the updated remaining budget.

2. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S1, the specific steps for allocating an initial privacy budget and an upper bound on the privacy failure probability for each document are as follows: The privacy risks of documents are assessed based on two dimensions: static metadata annotation and deep learning-based sensitivity quantification based on variational information bottlenecks. The assessment results of the two dimensions are uniformly normalized into a risk score of [0,1], and a comprehensive privacy risk score is calculated. The calculation formula is as follows: in, Risk scores are statically labeled. Quantifying the expected value of privacy risks for deep learning and The weighting coefficients set for the system and satisfying + = 1; Based on the comprehensive privacy risk score The sensitivity levels are mapped to four levels: low, medium, high, and very high (L), and an initial privacy budget is automatically allocated based on the sensitivity level. Upper bound of privacy failure probability Initial privacy budget Representative document The maximum amount of private information that can be disclosed within a given period.

3. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S1, the specific steps of the deep learning sensitivity quantification based on the variational information bottleneck are as follows: Document Input a pre-trained language model to extract text representation vectors ; Text representation vectors are processed through an encoder network. Mapped to the probability distribution space, the output mean is calculated. and variance And low-dimensional latent variables are obtained by sampling using reparameterization techniques. ; During the model training phase, maximize the latent variables. With real privacy labels Mutual information between At the same time, minimize the input With latent variables Mutual information between By introducing KL divergence as a regularization term, we force the model to express forgetting as privacy-independent; The purified latent variables Input a classification decoder, output a continuous expected value of privacy risk. .

4. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S1, the two-layer privacy budget ledger includes a user-document sub-ledger. and global document ledger; User-Document Subledger The formula used to track the intra-period status and cross-period history of a single user and a single document is as follows: Global Document Ledger The formula used to track the total exposure of a document to all users and defend against multi-user collaborative attacks is as follows: in, For user u, regarding the document The remaining budget for the current period; This represents the budget consumed by user u within the current period. For user u, regarding the document Total cumulative consumption across cycles; For user u to document The total lifecycle budget cap, This is the timestamp of the last budget reset. For document Remaining global budget for all users; When the user's remaining budget or overall budget When exhausted, a circuit breaker is applied to the user-document combination.

5. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S2, when the system receives a natural language query request q from user u, it performs differential privacy retrieval, calls the same pre-trained language model as in the knowledge base construction phase, and transforms the user query q into a high-dimensional continuous query embedding vector. : Traverse the vector database, for each document block in the knowledge base. Calculate the query vector With document block vector Original similarity scores between : 。 6. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S3, the calculation of the effective total budget for this query is specifically performed using the following formula: in, This is the preset budget limit for a single query.

7. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S4, the specific calculation formulas for the coarse sorting stage and the fine sorting stage are as follows: In the coarse-ranking stage, the coarse-ranking Laplace noise scale is used. in, For local smoothing sensitivity; The coarse perturbation scores after adding noise are: in, The original similarity score. For coarse-ordered Laplace noise scale, This indicates a mean of 0 and a scale of 0. The Laplace distribution sampling values ​​are used; the coarse similarity of global document blocks is quickly calculated with privacy overhead to filter out the initial Top-N candidate set; For the Top-N candidate set recalled by the coarse ranking, allocate the remaining budget for the fine ranking sub-budget: The candidate documents are precisely ranked, and the Laplace noise scale is finely adjusted. in, The original similarity score. For finely sorted Laplace noise scale, This indicates a mean of 0 and a scale of 0. The Laplace distribution sampled values.

8. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S6, based on the effective privacy budget actually consumed in this query... Synchronously update user sub-ledgers and global document ledgers; The user sub-ledger update formula is as follows: in, For document The initial allocation of total privacy budget, For user u to the document Privacy budget already consumed, This represents the effective privacy budget actually consumed in this query. For the updated remaining privacy budget; The global document ledger update formula is as follows: The formula for cumulative updates across cycles is as follows: After each update, determine Has the lifecycle limit been reached? 9. The trusted RAG retrieval method based on document-level differential privacy budget according to claim 1, characterized in that, In S6, the multi-level privacy degradation strategy adopts a dual-threshold mechanism, specifically including: Set a Level 1 warning threshold. and secondary circuit breaker threshold ,in, ; Level 1 warning stage, current remaining privacy budget When this occurs, the first-level warning is triggered, and the system increases the Laplace noise scale, which naturally reduces the document's search ranking probability. Level 2 circuit breaker stage: when When the circuit breaker is triggered at level two, the system does not physically delete the document, but instead sets the effective allocation budget for the document to a preset minimum positive value. ; When the cumulative consumption across cycles Greater than or equal to the preset total lifecycle budget limit When the circuit breaker condition is triggered, the corresponding user-document pair will be permanently locked in privacy mode. Periodically triggered privacy locks will be automatically released when the next cycle begins, while permanent privacy locks can only be released through specific permission commands.

10. A trusted RAG retrieval system based on document-level differential privacy budgeting, used to implement the trusted RAG retrieval method based on document-level differential privacy budgeting as described in any one of claims 1-9, characterized in that, include: The document privacy budget initialization module assesses the confidentiality level of each document in the knowledge base based on two dimensions: static metadata annotation and deep learning sensitivity quantification based on variational information bottlenecks. It allocates an initial privacy budget, a total lifetime budget cap, a single query budget cap associated with the sensitivity level, and a budget reset timestamp for each document. It also constructs a two-layer privacy budget ledger, which includes a user sub-ledger and a global document ledger. The user sub-ledger records the remaining budget, consumed budget, cumulative consumption across periods, lifetime cap, and last budget reset timestamp for each user-document pair. The global document ledger records the global remaining budget for each document. The differential privacy retrieval execution module receives user queries and transforms them into query embedding vectors. It calculates the original similarity score between the query embedding vector and the document block vector of each document block in the knowledge base. It reads the current remaining privacy budget of the source document to which each document block belongs from the two-layer privacy budget ledger and calculates and determines the effective allocation budget for this query. A multi-stage adaptive noise calibration module is used to perform document screening based on the effective allocation budget and the original similarity scores. Specifically, it includes: a coarse ranking unit: allocating a first share from the effective allocation budget as a coarse ranking sub-budget, calculating a first Laplace noise scale based on the coarse ranking sub-budget, injecting noise sampled from the Laplace distribution into the original similarity scores of each document block to obtain a coarse ranking perturbation score, and selecting a preliminary candidate set containing N document blocks based on the coarse ranking perturbation scores; a fine ranking unit: for the preliminary candidate set, using the difference between the effective allocation budget and the coarse ranking sub-budget as a fine ranking sub-budget, calculating a second Laplace noise scale based on the fine ranking sub-budget, injecting noise sampled from the Laplace distribution into the original similarity scores of each document block in the preliminary candidate set to obtain a fine ranking perturbation score, sorting according to the fine ranking perturbation scores, and selecting the K document blocks with the highest scores as the final candidate document set to be returned. The budget dynamic management module updates the two-layer privacy budget ledger in an atomic transaction manner after each retrieval, based on the effective budget actually consumed by each source document in this query: It accumulates the consumed budget and updates the remaining budget and cross-period cumulative consumption in the user sub-ledger, and deducts the global remaining budget in the global document ledger. Based on the updated remaining budget, it executes a multi-level privacy degradation strategy, including: during the warning phase, the effective budget is reduced due to the constraint of the remaining budget, and the Laplace noise scale increases accordingly; during the circuit breaker phase, the corresponding user-document pair or the document globally is marked as privacy locked, and during the locking period, a preset minimum positive value is used as the corresponding available budget for subsequent noise scale calculations; the user sub-ledger is maintained independently for each user-document pair to achieve budget isolation in multi-user concurrent scenarios. The output of the document privacy budget initialization module connects to the input of the budget dynamic management module, providing the budget dynamic management module with an initialized two-layer privacy budget ledger. The output of the budget dynamic management module connects to the input of the differential privacy retrieval execution module, providing the differential privacy retrieval execution module with the current user's remaining budget for each source document and the global remaining budget for each document. The output of the differential privacy retrieval execution module connects to the input of the multi-stage adaptive noise calibration module, providing it with the original similarity score and the effective allocated budget. The output of the multi-stage adaptive noise calibration module connects to the input of the budget dynamic management module, providing the budget dynamic management module with the effective budget actually consumed by each source document in this retrieval, which is used to trigger ledger updates.

Images