Multi-party cooperative method and system for data security hierarchical classification based on privacy calculation

Abstract

The application discloses a data security hierarchical classification multi-party cooperation method and system based on privacy calculation. The method analyzes enterprise data sources and identifies sensitive information, forms desensitization features through a shared key pseudo-random function; establishes a consensus sensitive mode library by using a threshold multi-party privacy intersection, safely aggregates a double-head hierarchical classification model parameter and a calibration score histogram, and obtains a global model and a conformal threshold value; forms a local hierarchical result according to a candidate level set, an experience re-identification risk and data blood relationship; and then performs a secret state difference screening, weighted aggregation and high and degraded evidence arbitration on cross-party common objects. Thus, cross-subject confidence grading and verifiable arbitration are realized under the condition that the original data does not leave the domain, and the missing grading and the level continuously rising without basis are inhibited.

Description

Technical Field

[0001] This invention relates to the fields of data security governance, privacy computing, and computer data processing technology, and in particular to a multi-party collaborative method and system for data security hierarchical classification based on privacy computing. Background Technology

[0002] Enterprise data assets are typically distributed across heterogeneous data sources such as relational databases, document databases, object storage, data warehouses, and application interfaces. To configure encryption, data masking, and access control measures based on data sensitivity, it is necessary to first identify the sensitive information contained in the data objects, and then classify and categorize the data objects. Furthermore, upstream and downstream entities in the industry chain, group members, or collaborative service providers may each store different views of the same business object, thus creating a need for consistent alignment of classification and categorization results across different entities.

[0003] Existing data security classification and grading systems typically employ either rule-matching or model-based identification. Rule-matching systems use regular expressions, dictionaries, and checksum rules to scan field values, while model-based identification systems train semantic classification or named entity recognition models using locally labeled samples, then convert sensitive types into grading labels using a manually maintained mapping table. However, differences in sample distribution, field naming, and rule definitions across different entities mean that local models may miss unfamiliar variations of sensitive fields. Conversely, directly aggregating original samples expands the scope of transmission and exposure of original sensitive information. Furthermore, local closed-loop sensitive data identification and grading systems read data source metadata and extract field samples within a single entity's boundary, generate sensitive type labels through a local sensitive identification model, output single-point grading labels according to a rule table, and configure control measures by looking up the table at each level. This approach relies on labeled samples accumulated by a single entity for model iteration, and grading rules and control strength depend on manual maintenance. When the model shifts across data domains, single-point labels do not carry coverage confidence information, and the system lacks a technical channel to utilize complementary patterns from multiple entities without exchanging original data.

[0004] Therefore, existing technologies have at least the following technical problems: the coverage of samples and sensitive patterns of a single subject is limited, and expanding the coverage across subjects may lead to the original data going out of the domain; at the same time, single-point classification labels are difficult to provide statistical constraints on the risk of missed classification when the data distribution is heterogeneous, and manual rule mapping is also inconvenient to adjust the classification and control intensity with comparable risk quantities across subjects. Summary of the Invention

[0005] The technical problem to be solved by this invention is: under the condition that the enterprise's original data and local calibration details do not leave the domain, to form a sensitive pattern and risk measure that can be compared across entities, to train a hierarchical classification model by utilizing the complementarity of multi-party data and to establish candidate level coverage constraints.

[0006] To address the aforementioned technical problems, this invention provides a multi-party collaborative method for data security hierarchical classification based on privacy computing, comprising:

[0007] Metadata parsing, sampling, and sensitive information identification are performed on various data sources of the enterprise to obtain a sensitive label set;

[0008] Perform shared-key pseudo-random function hash bucketing on the sensitive label set and output the de-identified feature set;

[0009] Extract pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus sensitive pattern library with support not lower than the disclosure threshold;

[0010] An initial hierarchical classification model is trained using the consensus-sensitive pattern library. Multi-party secure aggregation is then performed on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set.

[0011] The desensitized feature set is input into the global hierarchical classification model, and a candidate level set is constructed according to the conformal threshold set. The highest level is taken from the candidate level set that is not a single level to obtain the local hierarchical result set.

[0012] The local hierarchical result set is fingerprinted and multi-party privacy intersection is performed with each of the participating parties. The subset of divergent objects screened out by the secret state test is aggregated by secret state weighting and then arbitrated according to the principle of higher or lower level evidence, and the final hierarchical result set is output.

[0013] By employing the above technical solution, since the desensitization features are formed by a shared-key pseudo-random function and are comparable across parties, and the scope of sensitive pattern disclosure is controlled by a support threshold, multiple participants can utilize complementary information without exchanging original values ​​and low-support private patterns, thereby alleviating the contradiction between insufficient coverage of single-subject samples and data not leaving the domain. By reusing the secure aggregation channel of the histogram for model parameters and class conditions calibration, and constructing a candidate level set by selecting a conservative threshold between the local threshold and the global threshold, the uncertainty of the model output can be explicitly transmitted to the hierarchical decision-making, reducing the possibility that highly sensitive objects are uninformedly classified as low-level.

[0014] By first performing a secret equality check on all shared objects, and then only performing secret weighted aggregation on a subset of disagreeing objects, with voting weights based on the size of the candidate level set and data completeness, the number of objects processed by secret weighting is reduced from all shared objects to disagreeing objects. Simultaneously, the weighted threshold and the constrained downgrade evidence jointly limit the direction and scope of arbitration, prohibiting downgrades for objects awaiting review. This maintains prudence on the high-risk side while avoiding unfounded escalation caused by multiple rounds of collaboration. After binding the rating criteria to hash audit vouchers and control enforcement evidence, consistency verification of cross-entity rating conclusions and implementation measures can also be performed. Attached Figure Description

[0015] Figure 1 A schematic diagram of the overall process of the data security classification and hierarchical multi-party collaboration method based on privacy computing provided in the embodiments of the present invention;

[0016] Figure 2 A flowchart illustrating the consensus-sensitive pattern library determination process provided in this embodiment of the invention;

[0017] Figure 3 A flowchart illustrating the training and conformal threshold aggregation process of the federated hierarchical classification model provided in this embodiment of the invention;

[0018] Figure 4 This is a flowchart illustrating the conformal confidence rating and combined amplification risk analysis process provided in an embodiment of the present invention.

[0019] Figure 5 This is a flowchart illustrating the cross-party rating consistency alignment and dense-state weighted arbitration process provided in an embodiment of the present invention.

[0020] Figure 6 A schematic diagram of the module structure of a data security hierarchical classification and multi-party collaborative device based on privacy computing provided in an embodiment of the present invention. Detailed Implementation

[0021] The present invention will be further described below with reference to the accompanying drawings and embodiments. The participating parties may be enterprise nodes, institutional nodes, or business system nodes that maintain data domains respectively; the aggregator may be implemented by an independent computing node or by a computing service jointly maintained by multiple participating parties. Unless otherwise stated, the thresholds, number of buckets, number of training rounds, and risk intervals in the embodiments are exemplary settings and do not constitute a limitation on the scope of protection.

[0022] Example 1

[0023] like Figure 1 As shown, this embodiment provides a multi-party collaborative method for data security classification and grading based on privacy computing, including the following steps:

[0024] S1. Perform metadata parsing, sampling, and sensitive information identification on each data source of the enterprise to obtain a sensitive label set;

[0025] Each enterprise data source must include at least one of the following: relational database, document database, file storage, data warehouse, and application interface. The unified parser reads the data source connection configuration, extracts metadata such as databases, tables, columns, field types, constraints, comments, and lineage references within the authorized scope, maps character, numeric, date, binary, and nested object fields from different data sources to a unified type system, and generates a sampled content set according to a preset sampling ratio, sampling upper limit, and stratification conditions. The sampled content set resides only in the local trusted execution environment or controlled computing domain of the corresponding participant.

[0026] Sensitive information identification can be performed in parallel using checksum rule matching, column semantic classification, and named entity recognition. Checksum rule matching generates rule hit labels and format validity markers; column semantic classification outputs column-level sensitivity type probabilities based on standardized column names, column comments, and statistical summaries; named entity recognition outputs fragment-level sensitivity types and locations for text samples. The privacy-preserving computation-based data security hierarchical classification multi-party collaborative system (hereinafter referred to as the system) aligns the three results with data object identifiers and version timestamps to form a sensitive label set containing candidate sensitive types, source channels, confidence information, and sampling batches. The three identification methods complement each other, ensuring that sensitive information with explicit formats, context-dependent semantics, or that appears only in free text receives appropriate representation.

[0027] Specifically, stratified sampling distinguishes at least between high-cardinality numeric segments, low-cardinality numeric segments, long text fields, and time-varying fields. For high-cardinality numeric segments, the system can combine random sampling with start and end interval sampling to cover the main value patterns. For low-cardinality numeric segments, local summaries of all distinct values ​​can be retained without exceeding the sampling limit. For long text fields, local segments are extracted using a fixed character window, and only the identified type, location range, and morphological statistics are written into the sensitive annotation set. Each sampling is bound to the data object version, sampling strategy version, and local random seed commitment, enabling the same data snapshot to be repeatedly verified without requiring cross-party public disclosure of specific samples.

[0028] When the data source connection times out, field type parsing fails, or the number of valid samples falls below a preset minimum, the data parsing module does not indicate "no sensitive information" with an empty result. Instead, it writes a parsing status and an evidence sufficiency flag. Data objects with insufficient evidence sufficiency are placed in a review queue, and their level is prohibited from being lowered solely based on missing features in subsequent grading stages. This anomaly handling method distinguishes between "insufficient evidence not yet obtained" and "no sensitive information detected," preventing sampling failures from being misinterpreted as low-risk results.

[0029] S2. Perform shared-key pseudo-random function hash bucketing on the sensitive label set, and output the desensitized feature set;

[0030] Each participating party generates a session-level shared key through an authentication key negotiation protocol. This shared key is only accessed by controlled protocol components and is not used for business data output. Irreversible encoding is performed on the standardized value format, column name semantic encoding, and statistical digest corresponding to sensitive annotations. Taking a normalized fragment as an example, the hash bucket identifier can be represented as:

[0031] (Equation 1)

[0032] in, 'Indicates the participant index, Represents the index of a data object. 'Indicates a normalized fragment index, This represents the hash bucket identifier of the corresponding normalized fragment. This refers to the shared key obtained through multi-party negotiation. Indicates the first The participating party is targeting the first The first data object obtained A standardized fragment, Indicates using a shared key For the pseudo-random function of the key, This means converting the output of the pseudo-random function to a non-negative integer. Indicates the preset total number of buckets. This indicates a modulo operation.

[0033] The desensitized feature set may also include value length distribution, character category ratio, missing rate, cardinality estimation, frequency quantile, and dimensionality-reduced truncated column name semantic embedding. The column name semantic embedding retains only a preset dimension and performs fixed-point quantization, ensuring that exchanged features are insufficient to recover the complete column name. A shared key maps the same normalized fragment to comparable bucket identifiers across different participants, while pseudo-random functions, bucket collisions, and truncation collectively reduce the feasibility of reverting a single bucket identifier to its original value. The shared key can be rotated according to collaborative tasks or time periods; the total number of buckets can be set based on pattern size and collision tolerance. Too few buckets increase irrelevant pattern collisions, while too many buckets increase sparse features and communication overhead.

[0034] The irreversible encoding refers to the fact that the encoding results of cross-party exchanges only retain the information needed to complete pattern equality comparisons, statistical aggregations, and model training, without retaining the complete semantics and value-by-value correspondences that can be directly restored from column names or original values. Cross-party comparability refers to the fact that under the same task domain, the same encoding version, and the same shared key, the same normalized input yields the same bucket identifier. Both are jointly established through task domain isolation; if the task domain or key is different, even if the original input is the same, bucket identifiers that cannot be directly associated will be generated, thus limiting the horizontal association between different collaborative tasks.

[0035] The lifecycle of a shared key can include negotiation, activation, rotation, revocation, and destruction. When a participant withdraws from the task or an abnormal key status is detected, the system stops receiving new features generated using the old key and re-encodes the data objects that still need to participate in the collaboration with the new key. Old-version de-identified features are only used to verify existing audit credentials and are not mixed with new-version features for training. For hash collisions, disambiguation can be achieved by adding a second independent signature bucket, field type code, or statistical distance verification. Only when multiple verification dimensions meet the consistency condition is it considered to be the same pattern. This avoids disclosing the original value and reduces the probability of erroneous consensus caused by a single bucket collision.

[0036] In one example, two participants store fields with different naming conventions but whose values ​​both consist of a fixed prefix, a fixed-length numeric body, and a checksum. The standardization process removes irrelevant differences, compresses column names into the same semantic neighborhood, and maps value formats to the same signature bucket. The two parties can identify the same sensitive pattern in subsequent intersection checks without exchanging field names and specific numbers. If another field has the same length but lacks a checksum, its second-form signature will differ, preventing it from entering the same consensus record solely due to length bucket collisions.

[0037] S3. Extract the pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus sensitive pattern library with a support level not lower than the disclosure threshold;

[0038] This step uses a desensitized feature set instead of the original samples as the cross-party interaction medium. The pattern fingerprint is obtained by concatenating at least two of the following in a standardized order: column name identifier hash bucket, value form signature bucket, field type code, and sensitive type candidate code, and then blinding it again. The protocol outputs the blinded fingerprint and the holder's traceability label only when the same blinded fingerprint is held by at least a number of participants that meet the disclosure threshold; patterns below the disclosure threshold are neither included in the consensus sensitive pattern library nor are their corresponding holding relationships output to other participants. Because the support threshold separates industry-common patterns from unilaterally specific patterns, cross-party complementary information can be used for subsequent training, while avoiding the inference of a participant's proprietary field structure from low-frequency patterns.

[0039] The threshold-over-threshold multi-party privacy intersection essentially adds support gating before traditional intersection determination: the protocol first confirms the number of different holders of the same blinded fingerprint in a secret or secret-sharing state, and only releases the controlled result corresponding to that fingerprint after reaching the disclosure threshold. Therefore, the intersection output is no longer equivalent to the union of the intersections of any two parties, and the existence of a certain pattern at the hands of one or a few participants will not be known to other participants due to protocol execution. The disclosure threshold is at least two, and can be determined based on the number of participants, the allowed scale of collusion, and the coverage ratio required for the consensus pattern; when the number of participants changes, the protocol regenerates a task configuration version to avoid using old thresholds that are incompatible with the current scale of participation.

[0040] The support of the pattern fingerprint is separated from the model training frequency. Support only indicates how many different participants hold the pattern, and does not count duplicate votes based on the number of records within a single participant. The frequency of local samples during model training is still reflected in each party's local batch and is entered into the global update through secure aggregation. This separation mechanism prevents a single participant with a large amount of data from having their private pattern misjudged as a cross-party consensus due to duplicate records, and also prevents the support threshold from directly revealing the record size of each party.

[0041] S4. Train an initial hierarchical classification model using the consensus-sensitive pattern library, and perform multi-party secure aggregation on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set;

[0042] Each participant locally recalculates the pattern hit feature bits using the consensus-sensitive pattern library and concatenates these feature bits with the desensitized feature set to form an enhanced desensitized feature set. The initial hierarchical classification model includes a shared representation network, a sensitive type multi-label output head, and a three-level ordinal hierarchical output head. The shared representation network can employ a multilayer perceptron, an aggregateable parameter representation of a tree model, or other model structures capable of parameter aggregation. The sensitive type multi-label output head represents, with multiple independent probabilities, that an object can simultaneously belong to multiple sensitive types. The three-level ordinal hierarchical output head outputs the order relationship between the general, important, and core levels through two ordered boundaries.

[0043] A joint objective function for local training is:

[0044] (Equation 2)

[0045] in, Indicates the first Joint training losses for each participating party This represents the multi-label classification loss of the sensitive type multi-label output header. This represents the ordinal classification loss of the three-level ordinal hierarchical output head. The weights represent the multi-label classification loss. The weights represent the ordinal classification loss. This indicates the weight of the regularization term. Indicates the first The local model parameter set of each participant This represents the squared L2 norm of the local model parameters. All three weights are non-negative and can be selected based on type recognition recall, ordinal classification error, and model stability on the local validation set.

[0046] Training samples and per-sample inconsistency scores remain locally hosted; only model parameters processed with norm pruning, pairwise random masking, and secret sharing are uploaded, along with histogram counts of inconsistency scores stratified by sensitivity type and target level. The aggregator obtains the global bucket counts for each stratum and then accumulates them bucket by bucket. Let a certain sensitivity type be considered. With target level If the corresponding histogram bucket boundaries are arranged in ascending order, then the stratification threshold can be expressed as:

[0047] (Equation 3)

[0048] in, Indicates sensitive type With target level The corresponding global hierarchical threshold, Indicates the first level of the corresponding layer The upper boundary of the histogram bucket, This indicates the bucket number at which the target coverage count was first reached. Indicates the first level of the corresponding layer Global count of buckets, This indicates the allowable level of coverage loss for the corresponding layer. This represents the total number of global calibration samples for the corresponding stratum. This indicates rounding up. The number of histogram buckets can be chosen between traffic and threshold resolution, for example, using equal-width buckets, quantile buckets formed according to a public reference distribution, or adaptive buckets; increasing the number of buckets can improve threshold resolution, but it will also increase the traffic of dense state counting.

[0049] Because model parameters and calibration counts reuse a secure aggregation channel, the aggregator can only obtain cross-party summation results and cannot obtain parameter updates and calibration score details for individual participants; cross-party complementary representations of model learning and class-conditional conformal calibration are driven by the same round of data versions, reducing the risk of model version and calibration version mismatch.

[0050] The shared underlying representation between the sensitive type multi-label output head and the three-level ordinal hierarchical output head means that both output tasks use the implicit representation generated by the enhanced desensitized feature set before entering their respective output layers. The multi-label output head preserves the possibility that an object simultaneously hits multiple sensitive types, while the ordinal output head incorporates the order of magnitude among the levels into the boundary learning process. Sharing the underlying representation allows both "why sensitive" and "to what extent sensitive" to utilize the same pattern evidence, while avoiding the forced compression of multi-label types into a single category. The errors of the two output heads jointly update the shared representation, enabling scarce level samples to leverage the relevant structure provided by the sensitive type task.

[0051] Before training, each participant performs column order alignment, zero-padding, and numerical range scaling on the enhanced and desensitized feature set according to the publicly available feature pattern list. Participants who do not hold a certain consensus pattern will set the corresponding pattern's hit feature position to zero, but will not delete that dimension to ensure the consistency of the shape of the local model parameters. Label quality checks can identify conflicting local-level labels, labels lacking source evidence, and expired labels; samples with conflicts but not yet completed verification can only be used for training of sensitive type multi-label heads and will not participate in the supervised update of ordinal hierarchical output heads.

[0052] During multi-round federated training, the aggregator performs consistency checks on the number of effective participants, the magnitude of changes in aggregated model parameters, and the summary of local validation metrics for each round. When the number of effective participants is below the threshold required for safe aggregation, no global update is generated for that round. When parameter changes diverge or ordinal boundaries reverse in multiple consecutive rounds, the model reverts to the most recently validated model version and reduces the local learning step size or rebalances the batch. Model convergence is not determined solely by the number of rounds, but rather by a combination of stable update magnitude, valid ordinal boundaries, and at least one retained validation metric not continuously deteriorating, thereby reducing oscillations caused by heterogeneous data.

[0053] S5. Input the desensitized feature set into the global hierarchical classification model, construct a candidate level set according to the conformal threshold set, and take the highest level from the candidate level set that is not a single level to obtain the local hierarchical result set;

[0054] In one implementation, the actual input is an enhanced desensitized feature set obtained by concatenating the pattern hit feature bits generated using the consensus sensitive pattern library with the desensitized feature set; at the interface layer of the global hierarchical classification model, the enhanced desensitized feature set can be regarded as the desensitized feature set with consensus pattern bits. For each data object, the sensitivity type probability, the inconsistency score for each candidate level, and the empirical re-identification risk are obtained. The candidate level set includes levels whose inconsistency scores do not exceed the corresponding conservative threshold; the local stratification quantile and the global stratification threshold represent the calibration constraints of the local domain and the multi-party population, respectively. The system selects the one that prevents the candidate set from shrinking, thereby reducing the probability that the true level will be excluded from the candidate set under heterogeneous distributions.

[0055] The risk of empirical re-identification can be synthesized from equivalence class size, record uniqueness, k-map estimation, and attribute inference discrimination rate. An exemplary calculation method is as follows:

[0056] (Equation 4)

[0057] in, Indicates the first Risk of re-identification of individual data objects based on experience This represents the value of the inverse of the equivalence class size of the data object after interval normalization. This indicates the uniqueness of the data object record. This represents the k-map risk estimate of the data object. This represents the attribute inference discrimination rate of the data object. , , and These represent the non-negative calibration coefficients of the four risk components mentioned above. This represents the natural exponential function. Each calibration coefficient can be fitted using historical attack simulation samples or validation data to ensure the output falls within the risk range of zero to one.

[0058] When the candidate level set contains a single element, that element is directly used as the initial level. When the candidate level set contains two or three levels, the highest level is selected and marked as pending review. This asymmetric attrition method does not force the model to output a single low-level label when confidence is insufficient; instead, it transforms uncertainty into cautious levels and explicit review tasks. If the local calibration set and the local pending level data are commutative, and the stratification of calibration scores is consistent with that during inference, the probability that the true level falls into the candidate level set is not less than the corresponding one-loss coverage level.

[0059] Subsequently, object combinations are enumerated within the connected subgraph of the data lineage graph. The empirical re-identification risk after combination is recalculated, and the high-level risk triggering is propagated downstream along the derivation relationship edges. Since the information available for distinguishing records does not decrease after the addition of attributes, and the risk satisfies the corresponding monotonicity, the system can stop expanding the superset of a combination after it reaches a threshold, thereby controlling the scale of combination enumeration. The upper limit of the combination cardinality can be set to two to five; too small an upper limit may miss risks jointly identified by multiple attributes, while too large an upper limit will increase the computational load of combinations. It can be selected based on the size of the connected subgraph and the preset computational budget.

[0060] S6. Perform fingerprinting on the local hierarchical result set and perform multi-party privacy intersection with each of the participating parties. Perform dense-state weighted aggregation on the subset of divergent objects screened out by the dense-state test, and arbitrate the evidence according to the principle of higher or lower level, and output the final hierarchical result set.

[0061] Arbitration based on the principle of prioritizing higher security level over lower security level means that in the event of a conflict between different security levels, the higher security level is generally preferred. A lower level is only permitted if the participating parties can prove that the risk of re-identifying the data object is below a preset downgrade threshold and obtain support from a specified number of holders. Downgrades are typically limited to one level per round, and data objects marked "pending review" are prohibited from being downgraded.

[0062] Each participating party first standardizes the data object name, business path, field hierarchy, and version identifier, and then uses a shared-key pseudo-random function to generate object fingerprints. Multi-party privacy intersection only outputs the fingerprints of shared objects that meet the disclosure threshold, along with the holder's traceability label. For shared objects, each party encodes the level label as a secret sharing share, and distinguishes between consistent and divergent objects through a cryptographic equality check; consistent objects do not need to enter the costly weighted aggregation protocol, only divergent objects participate in the level-based summation carrying encrypted weights.

[0063] Voting weights reflect both the certainty of the conformal candidate level set and the completeness of the data, and can be expressed as:

[0064] (Equation 5)

[0065] in, Indicates the first The participating party on the first The voting weight of each data object Indicates the first The participating party is targeting the first Data integrity of a data object Indicates the first p participants regarding the first The number of candidate levels in the set of *o* data objects. Data completeness can be synthesized by normalizing at least two of the following: required field effectiveness, lineage coverage, inverse vector of sample missing rate, and version freshness. A smaller candidate level set indicates a more certain conformal decision; higher data completeness indicates more sufficient observational evidence for the object. Both parameters are derived from local results formed before arbitration, thus avoiding circular dependencies due to arbitration result write-back.

[0066] In a closed-state process, the aggregator obtains the weighted sum of each level, selects the level with the highest weighted score, and compares it with the highest level among the level labels of all participants, using the higher one as the initial judgment level. Downgrading is not a simple reverse voting process, but is constrained by proof conditions, support thresholds, single-round magnitude, and the object's state: the proposer must prove that the risk of empirical re-identification is lower than the downgrading risk threshold; the number of supporters must reach the downgrading consensus threshold; the downgrading consensus threshold is greater than the disclosure threshold and not less than half plus one of the number of holders; each round can be downgraded by at most one level, and objects awaiting review are prohibited from being downgraded. This two-way arbitration structure ensures caution with high-risk information when evidence is insufficient, while allowing objects with sufficient risk evidence to undergo limited reversal with majority support, thereby suppressing the continuous escalation of levels caused by multi-round collaboration.

[0067] The system normalizes and sorts the object fingerprints, model versions, threshold versions, summary of confidentiality equivalence test results, weighted score commitments, downgrade proof verification results, supporter commitments, and arbitration timestamps, then calculates a hash to form a rating basis hash audit credential. The audit credential does not contain original data, plaintext weights, or unilateral rating details, but it can prove during subsequent verification that the corresponding rating conclusion is bound to a specific protocol input version.

[0068] Example 2

[0069] like Figure 2 As shown, this embodiment details the process of determining the consensus-sensitive pattern library, including the following steps:

[0070] S3.1. Extract column name identifier hash buckets and value form signature buckets from the desensitized feature set, and concatenate them to obtain the pattern fingerprint of each data object;

[0071] The column name identifier hash bucket can be obtained from the result of a shared-key pseudo-random function of standardized column names, and the value form signature bucket can be obtained by encoding character category sequences, length ranges, separator positions, check bit presence, and cardinality ranges. Before concatenation, normalization is performed according to the field order and fixed-length encoding specified by the protocol version, and task domain identifiers and protocol version identifiers are added to prevent the same byte sequence in different collaborative tasks or different encoding versions from being misjudged as the same pattern. In other implementations, field type codes or sensitive identification candidate type codes can also be added to form a pattern fingerprint.

[0072] S3.2. Perform an unintentional pseudo-random function evaluation on the pattern fingerprint to obtain a blinded fingerprint;

[0073] Unintentional pseudorandom functions (ORFs) are cryptographic protocols that protect input and key privacy. The input party can obtain the result of the PORF computation corresponding to its input, but the key holder is unaware of the input content, and the input party cannot obtain the function key or compute the results of other inputs. The unintentional PORF protocol allows the evaluator to obtain the PORF output corresponding to the pattern fingerprint, but does not disclose the evaluator's pattern fingerprint to the key service provider, nor does it disclose the PORF key to the evaluator. The blinded fingerprint is represented using a fixed-length byte string and is deduplicated and randomly sorted before entering the intersection protocol to reduce the number of repetitions and auxiliary information leaked by the original traversal order.

[0074] The output of an unintentional pseudo-random function can be expressed as:

[0075] (Equation 6)

[0076] in, Indicates the first The output of an unintentional pseudo-random function corresponding to each input; This indicates that a serial number has been entered. Indicates the first A pattern fingerprint to be evaluated; This represents an input mapping function that maps pattern fingerprints to elements of a preset cryptographic group. This represents the secret evaluation parameter held by the key holder; This represents the output mapping function that maps the result of a cryptographic group operation to a fixed-length byte string.

[0077] In actual execution, the input party first... The process involves randomizing and blinding the data, and then the key holder uses the secret evaluation parameters. After evaluation, the input side is unblinded and the result is obtained. Therefore, the input party can obtain the corresponding pseudo-random function result, but cannot obtain... The key holder can perform the evaluation, but cannot obtain the key information. The symbols mentioned above are not duplicates of the parameter symbols in the formulas described above.

[0078] S3.3. Using the blinded fingerprint as input, perform over-threshold multi-party privacy intersection among the participating parties, count the number of participating parties holding each blinded fingerprint, and determine the fingerprint support.

[0079] The aggregator only processes blind fingerprints, secret sharing shares of holding relationships, and protocol commitments. To avoid support inflation caused by repeated reporting by the same participant, each holding relationship is bound to the participant's anonymous credential commitment. During deduplication, only one valid commitment from the same participant to the same blind fingerprint is retained. The disclosure threshold can be set according to the total number of participants, the minimum anonymity set requirement, and the coverage required by the industry consensus model; the higher the disclosure threshold, the stronger the concealment of unilateral private models, but the fewer models can be included in the consensus sensitive model library.

[0080] S3.4. Collect the blinded fingerprints with support levels not lower than the disclosure threshold and their corresponding holder identifiers to determine the consensus sensitive pattern library and holder traceability tags.

[0081] Each record in the consensus-sensitive pattern library contains at least a blinded fingerprint, encoded version, fingerprint support, validity period, and a holder traceability tag. The holder traceability tag can be an anonymous identifier within the task or an authorized, auditable encrypted identifier, and does not directly disclose the list of participating parties' business data. The holder traceability tag is used to subsequently determine the set of entities eligible to participate in arbitration, and can also be used to identify the source coverage of a particular consensus pattern.

[0082] The consensus-sensitive pattern library is appended and updated only according to the task domain and version. When a new consensus pattern is discovered in a new round of intersection, a stable sequence number is assigned to the new record. When the support of an existing pattern drops below the disclosure threshold, the record is marked as frozen instead of outputting the specific exiting party to other participants, thus avoiding inferring the unilateral holding status through version differences. Frozen patterns are no longer used in the new round of feature enhancement, but their version summaries are still retained to ensure that models trained using older versions can be traced back.

[0083] In one example, the collaborative task has five participants, and the disclosure threshold is set to three. When a blinded fingerprint is held by three participants, the protocol outputs the blinded fingerprint, a support score of three, and three in-task source tags. When another blinded fingerprint is held by only two participants, the protocol only internally generates candidate support scores and terminates the reconstruction; other participants cannot obtain the specific fingerprint content or the identity of the holder. If the third participant also exhibits the latter pattern in a subsequent round, this pattern enters the consensus-sensitive pattern library from the current round onwards, without rewriting the audit results of previous rounds.

[0084] Example 3

[0085] This embodiment further defines the support statistics and controlled disclosure process of the holder identifier in the over-threshold multi-party privacy intersection, including the following steps:

[0086] S3.3.1. Each of the participating parties generates a set of secret sharing shares for each of the local blinded fingerprints, wherein the secret value carried by each secret sharing share is the holder identifier of the corresponding participating party, and the threshold of each secret sharing share is equal to the disclosure threshold;

[0087] Each participant generates a holder identifier commitment for the blinded fingerprint, encodes the holder identifier as a secret value within the protocol domain, and then distributes secret-sharing shares to multiple protocol execution nodes. Each share carries a blinded fingerprint group label, a holder identifier commitment, and a round random number. The group label is only used to group shares corresponding to the same blinded fingerprint. To enable different secrets from different participants to be reconstructed separately, the protocol execution nodes maintain a set of sub-shares based on the holder identifier commitment. Threshold reconstruction of each sub-share set is only opened after the candidate support of the corresponding blinded fingerprint reaches the disclosure threshold. Thus, the disclosure threshold controls both whether a group enters the reconstruction phase and the recovery conditions of the secret corresponding to the holder identifier.

[0088] S3.3.2. The secret sharing shares are grouped and aggregated to the aggregator according to the blinded fingerprint to obtain the share set grouped by fingerprint;

[0089] The aggregator collects shares according to blinded fingerprint grouping labels and verifies the agreement round, share signature, task domain identifier, and holder identifier commitment. Shares that fail verification or have expired are not included in the share collection. The aggregator only sees the grouping labels and commitments, and does not see the plaintext holder identifier carried by the shares.

[0090] S3.3.3. Perform deduplication on the share set grouped by fingerprint, and output a set of distinct shares;

[0091] Deduplication is based on the combination key of the blinded fingerprint group label and the holder's identifier commitment. When the same participant submits multiple share packages due to retrying, only the share package that meets the latest round and has a valid signature is retained; shares from different protocol execution nodes but corresponding to the same holder's identifier commitment belong to the same holding relationship and are not added to the candidate support repeatedly.

[0092] S3.3.4. Count the number of shares in the distinct share sets and output the candidate support.

[0093] Candidate support is counted based on the number of commitments made by distinct holder identifiers, rather than by the number of network packets or the total number of secret-shared fragments. The aggregator can simultaneously output count commitments for each participant to verify that the candidate support comes from verified and deduplicated holder relationships.

[0094] S3.3.5. Compare the candidate support with the disclosure threshold. For the share set of fingerprint grouping with candidate support not lower than the disclosure threshold, perform secret reconstruction and output the corresponding all holder identifiers. For the share set of fingerprint grouping with candidate support lower than the disclosure threshold, stop reconstruction and use the candidate support as the fingerprint support of the corresponding blinded fingerprint.

[0095] When the disclosure threshold is reached, the protocol execution node performs reconstruction on the sub-share set corresponding to each holder's identifier commitment under the blinded fingerprint, and outputs the recovered holder identifiers to the authorized intersection result receiver. If the disclosure threshold is not reached, the protocol state machine is destroyed or expires and temporary shares are cleared, without triggering the reconstruction interface. Therefore, the aggregator can know the candidate support but cannot recover the holder details based on low support groups, and low-frequency patterns remain hidden.

[0096] Secretly shared shares can be bound to a one-time round random number and an expiration time during generation. The aggregator refuses to accept shares from other task domains, other protocol rounds, or expired shares. Each protocol execution node records its share acceptance commitment separately, but does not record the complete, reversible holder identifier. If the aggregator initiates a reconstruction request when candidate support is insufficient, the execution nodes refuse to release the recovery shares based on state machine conditions. If some execution nodes go offline after reaching a threshold, the protocol can continue to complete controlled reconstruction as long as the number of online nodes still reaches the recovery threshold.

[0097] It should be noted that the disclosure threshold and the secret recovery threshold are numerically equal, but they respectively constrain whether the mode allows disclosure and whether the execution node has recovery capabilities. In implementation, an independent sub-share set can be set for each holder's identifier secret, and the support result of the blinded fingerprint grouping can be used as the activation condition for each sub-share set. This structure avoids mistakenly treating shares from different participants carrying different secret values ​​as directly interpolated values ​​of the same secret, while maintaining the protocol semantics of "no holder identifier reconstruction is initiated if the participant support threshold is not reached."

[0098] The protocol generates verifiable summaries from the deduplication, counting, and reconstruction results. Each participating party verifies that its effective share has entered the corresponding group by submitting a committed Merkel path or equivalent integrity proof; the aggregator provides proof of the correspondence between candidate support and deduplication commitments. The proof is only used to confirm that the protocol is executed according to preset rules and does not disclose blinded fingerprint plaintext or its holder identifier below the disclosure threshold.

[0099] Example 4

[0100] like Figure 3 As shown, this embodiment details the training process and conformal threshold formation process of the federated hierarchical classification model, including the following steps:

[0101] S4.1. Match each data object in the sensitive label set according to the consensus sensitive pattern library, generate pattern hit feature bits, and concatenate them with the desensitized feature set to obtain the enhanced desensitized feature set;

[0102] Participants recalculate local data objects item by item using blinded fingerprints or authorized pattern matching tokens, without needing to restore consensus-sensitive patterns to the original fields of other participants. Each pattern hit feature bit can be zero or one, or a normalized hit frequency; the feature bits are arranged according to stable indices in the consensus-sensitive pattern library and concatenated with the statistical features, semantic truncation features, and rule-based hit features of the original desensitized feature set. The model input simultaneously retains local individual features and cross-party consensus features.

[0103] Enhanced desensitization feature sets can be represented using fixed-length sparse vectors or key-value sparse tensors. The feature header stores the task domain identifier, feature pattern library version, and dimension; the body stores the non-zero feature positions and quantization values; and the tail stores a local mapping reference to the data object identifier. Cross-platform uploads only update the model and do not upload the aforementioned local mapping references. When loading the model version, the feature pattern library version is first verified; if the versions are inconsistent, the system aligns the old dimensions using stable indices and sets the new dimensions to zero, prohibiting the direct input of features with the same position but different semantic versions into the model.

[0104] S4.2. Train the initial hierarchical classification model containing a sensitive type multi-label output head and a three-level ordinal hierarchical output head using the enhanced desensitization feature set, and output the local model parameters after training;

[0105] The shared representation network extracts low-dimensional representations from an enhanced desensitized feature set. The two output heads share this representation but separately compute multi-label probabilities and ordered level boundaries. Training batches can be jointly hierarchically sampled by sensitivity type and level to reduce the possibility of a few sensitivity types being overwhelmed in local batches. The multi-label output head allows a data object to carry multiple sensitivity types simultaneously, while the ordinal output head utilizes level ordering to constrain adjacent boundaries, avoiding treating three-level hierarchies as mutually unordered categories. In other implementations, the shared representation network can be implemented using aggregateable gradient boosting tree parameters, linear model parameters, or lightweight neural network parameters.

[0106] Instead of directly writing prediction labels to each other, the two output heads indirectly exchange statistical evidence through a shared representation network. This allows the value patterns, semantic neighborhoods, and consensus patterns identified by the multi-label output head to improve the ordinal hierarchical output head's ability to discern level boundaries; conversely, the risk order constraints generated by the ordinal hierarchical output head can also in turn prompt the shared representation to be organized according to level-related directions. To prevent a particular task's loss from dominating training in the long term, the loss weights can be adjusted based on the gradient magnitudes of the two output heads on the local validation set, and upper and lower limits can be set to prevent rare task types from losing training signals due to excessively low weights.

[0107] Let's illustrate with an example training batch: A data object in the batch simultaneously hits both the "Identity Class" and "Contact Information Class" sensitive categories. The multi-label output head retains two independent positive labels. Locally, based on the corresponding importance level, the ordinal classification output head learns the positive boundary for "above-normal level" and the negative boundary for "above-importance level," respectively. Compared to direct classification using three mutually exclusive categories, ordinal boundaries can clearly distinguish between adjacent level errors and errors spanning two levels, making subsequent inconsistency scores more reflective of the cost of missed classifications.

[0108] S4.3. Calculate the inconsistency score of the initial hierarchical classification model on the local calibration subset, and perform hierarchical statistics according to sensitivity type and target level to obtain the local calibration score distribution;

[0109] The local calibration subset does not participate in model parameter fitting. For each calibration object, an inconsistency score is calculated based on the model probability or cumulative ordinal probability corresponding to its true target level. The weaker the model's support for the true level, the higher the inconsistency score. Subsequently, a two-dimensional stratification is formed according to sensitivity type and target level. The scores of each stratum are bucketed and counted, and the local precise quantile is saved as the local stratification quantile. If the local calibration subset is too small, adjacent sensitivity type strata can be merged or a preset minimum sample threshold can be used; the merging rule must be fixed and the version recorded before inference.

[0110] The local calibration score distribution is a count-based replacement for the value-by-value detailing of inconsistent scores. All parties share the same hierarchical rules and bucket boundaries, but each bucket only uploads masked integer counts. Therefore, the aggregated global bucket counts can be used to approximate the overall quantiles, while the aggregator cannot read the scores of specific objects from individual party messages. Bucket boundaries can be set with equal width within the zero-to-one score range, or they can be predetermined as non-equal-width intervals by a public reference distribution. To avoid additional leakage caused by adaptive bucket setting based on current individual party data, bucket boundaries are fixed before collecting the current round of counts.

[0111] The interchangeability of the calibration subset and the data to be determined can be monitored by the drift indices of the input feature range, the proportion of sensitive types, and the model score distribution. If the drift of a certain stratum exceeds a preset limit, the system does not claim that the stratum continues to meet the original coverage conditions, but instead increases the candidate level set, marks it as pending verification, or initiates local recalibration. This process makes the applicability of statistical coverage guarantees verifiable, avoiding the mechanical application of old thresholds even with significant distribution drift.

[0112] S4.4. After performing masking and fragmentation on the local model parameters and the local calibration score distribution, the data is uploaded to the aggregator. The aggregator then performs masking and cancellation-based secure summation and offline fragmentation recovery to obtain the global hierarchical classification model and the conformal threshold set.

[0113] The definition of mask cancellation-based secure summation and offline fragment recovery is as follows: Each participant superimposes a pair of random masks onto its local data or model parameters. During aggregation and summation, the positive and negative masks cancel each other out, ensuring that the aggregator can only obtain the sum and cannot read individual data. If a participant goes offline midway, the system uses a pre-distributed secret sharing share to recover the mask information related to the offline participant, eliminating any residual masks that could not be properly canceled, thereby continuing to complete the aggregation.

[0114] Before masking, norm pruning is performed on local model updates to limit the update magnitude of individual participants. Any two participants generate paired random masks with opposite signs based on ephemeral key negotiation. During normal online operation, the paired random masks cancel each other out during aggregation and summation. When a participant goes offline, the aggregator only obtains the recovery share used to cancel out the offline mask after the recovery threshold is reached, and does not obtain individual model updates from online participants. The calibration histogram and model parameters carry version identifiers in the same secure aggregation round, ensuring that the global model and conformal threshold set correspond to the same data snapshot.

[0115] The secure aggregation round comprises a submission phase, an upload phase, a disconnection confirmation phase, and a results publication phase. Participants lock the model update summary and calibration histogram summary during the submission phase and send masked fragments during the upload phase. The disconnection list is only determined after the upload deadline to prevent aggregators from selectively announcing disconnections based on known unilateral updates. Before results publication, online participants can verify the valid participant set summary and the aggregation round summary. If they are inconsistent with the submission phase summary, the global model and conformal threshold set for that round will be rejected.

[0116] The local conformal threshold remains within its domain, while the global conformal threshold is obtained from the aggregated histogram. During inference, a threshold that does not shrink the candidate level set is selected layer by layer. Instead of mixing the calibration samples corresponding to the two thresholds into the same population, a conservative decision is made after retaining both local domain protection and cross-domain population protection. For cases where local samples are sufficient but a certain global layer is sparse, the local threshold provides intra-domain protection; for cases where local layer samples are insufficient but other participants have similar samples, the global threshold provides supplementation. The combination of these two approaches can reduce the risk of missed classifications due to single threshold mismatch when the participants are heterogeneously distributed.

[0117] Example 5

[0118] This embodiment further illustrates mask cancellation-based secure summation, disconnection recovery, and conformal threshold calculation, including the following steps:

[0119] S4.4.1. Perform norm pruning on the local model parameters, and negotiate with each of the participating parties to generate a pair of random masks. Superimpose the pair of random masks onto the pruned local model parameters to obtain mask model parameters.

[0120] Norm pruning is bounded by a preset pruning upper limit. When the model update norm exceeds the upper limit, it is scaled proportionally; when it is below the upper limit, it remains unchanged. The pruning upper limit can be determined by the high quantiles of historical update norms. Too small a limit will weaken effective updates, while too large a limit will amplify the impact of unilateral aberration updates on the aggregation results. Pairwise random masks are derived from the temporary session key and round identifier. For the same participant, the opposite sign is added to the ends of the ordering pairs before and after the ordering pairs to ensure that the mask sum of all online participants is zero.

[0121] S4.4.2. Expand the local calibration score distribution into hierarchical bucket counts, and superimpose the paired random mask on each bucket count to obtain the mask bucket count;

[0122] Bucket boundaries are publicly configured by the protocol and fixed before the start of this round. All parties use the same sensitivity type layer, target level layer, and bucket order. Bucket counts can be added to the independent mask stream after being encoded by fixed-point integers. The independent mask stream and the model parameter mask are derived using different context labels to avoid mask reuse between different payloads.

[0123] Each stratum's histogram also records the total number of valid calibration objects and the overflow bucket count. Strata with a sample size below the minimum do not publish thresholds separately; instead, they are merged into a wider sensitivity type stratum according to the pre-registered parent stratum mapping. Outliers above the upper bound of the score or below the lower bound of the score are placed into overflow buckets at either end and are not silently discarded due to truncation. The bucket width can be selected based on the allowable threshold approximation error; the denser the bucket boundaries, the more precise the quantile localization, but the number of encrypted counts and the transmission load increase simultaneously.

[0124] S4.4.3. The mask model parameters and the mask bucket count are uploaded to the aggregator after being secretly shared and fragmented. The aggregator sums the fragments to make the paired random masks cancel each other out, and performs threshold recovery on the fragments of the offline participants to obtain the aggregation model parameters and the global bucket count.

[0125] Each participant distributes the mask seed recovery information required for disconnection recovery to other participants or multiple recovery nodes. When a participant fails to complete the upload after submitting a commitment, the aggregator collects the recovery share that has reached the threshold. Reconstruction is only used to remove the masks that the disconnected participant failed to offset in pairs. A recovery threshold below the minimum number of safe participants increases the risk of collusion, while a threshold that is too high reduces the tolerance for disconnections. Therefore, it can be set based on the total number of participants and the maximum expected number of disconnections.

[0126] For the same participant, the model parameter load and calibration count load adopt the same valid participation status. If the model parameter upload is successful but the calibration count upload fails, the participant is marked as incomplete in this round, and the aggregator removes the residual masks corresponding to both types of loads to prevent the global model and threshold from being based on different participant sets. After the disconnection is recovered, the aggregation result includes the number of valid participants and the set commitment, which each participant uses to verify whether the preset minimum aggregation size has been reached in this round.

[0127] S4.4.4. Update and distribute the initial hierarchical classification model with the aggregated model parameters, and obtain the global hierarchical classification model through multiple iterations;

[0128] The aggregated model parameters can be normalized according to the effective sample size or preset participant weights before updating the shared model. Each round of distribution includes the model version, participant set summary, feature encoding version, and calibration bucket configuration version. Iteration ends when a preset number of rounds is reached, the validation metric converges, or the change in parameters falls below a stopping threshold for several consecutive rounds.

[0129] The model deployment employs a validation-before-activation mechanism. Participants first load candidate global models into isolated version slots, checking input dimensionality, ordinal boundary order, numerical range, and local retention set metrics. Only after all activation conditions are met does the inference version switch. If some participants fail validation, the aggregator retains the previous stable version and categorizes the reasons for failure as model structure incompatibility, feature version incompatibility, or performance degradation for future adjustments, rather than directly overwriting the currently used stable model.

[0130] S4.4.5. The global bucket count is accumulated bucket by bucket according to the sensitivity type and target level. The bucket boundary corresponding to the first time the accumulated value reaches the target coverage level is taken as the layer threshold of the corresponding layer. The conformal threshold set is obtained by taking the layer threshold and the local layer quantile that makes the candidate level set contain the most levels.

[0131] Given that a smaller inconsistency score indicates greater model support for the corresponding level definition, increasing the threshold will not shrink the candidate level set. Therefore, choosing the threshold that maximizes the number of levels in the candidate level set between the global stratification threshold and the local stratification quantile is equivalent to selecting a more conservative acceptance threshold. This choice incorporates both the coverage information provided by the global samples and the protection information provided by the local offset, ensuring that true levels are not excluded when a distribution deviates from the overall distribution due to directly applying a more aggressive threshold.

[0132] The stratification threshold obtained by accumulating bucket by bucket is the upper boundary of the bucket. This choice ensures that scores falling within the same bucket as the target quantile but not yet precisely sorted are all accepted, thus preventing the narrowing of the candidate level set due to histogram discretization. For levels whose scores are exactly equal to the stratification threshold, the system includes them in the candidate level set according to the "not exceeding" rule; for strata without any valid calibration counts, the system reverts to the pre-registered parent stratification threshold and forces the setting of a check mark, without generating a numerical threshold from an empty stratum.

[0133] In one example, the local stratification quantile for a certain sensitivity type and importance level is 0.24, and the global stratification threshold is 0.31. Since inconsistency scores below the threshold are accepted, the system uses 0.31 as the decision threshold for this stratification. Objects awaiting stratification with an importance level inconsistency score of 0.28 are included in the candidate level set; otherwise, they are excluded if only the local threshold is used. This conservative selection does not directly determine the final level, but rather preserves possible levels, and the final result is determined by the highest-level abstention rule, empirical re-identification risk, and lineage propagation.

[0134] Example 6

[0135] like Figure 4 As shown, this embodiment refines the local conformal confidence rating process, including the following steps:

[0136] S5.1. Input the desensitized feature set into the global hierarchical classification model to obtain the sensitivity type probability and inconsistency score of each data object;

[0137] The desensitized feature set may include an enhanced form concatenated with the consensus sensitive pattern hit feature bits. For each data object, the model outputs multiple sensitivity type probabilities, two ordinal boundary probabilities, and a non-consistency score obtained by transforming the probabilities corresponding to each target level. The inference process is executed locally on the participating party; model inputs and object-by-object outputs are not uploaded to the aggregator.

[0138] S5.2. Combining the aforementioned sensitivity type probabilities with the statistically obtained equivalence class sizes of each data object, calculate the empirical re-identification risk for each data object;

[0139] Equivalence classes are partitioned based on the same value pattern of data objects in combinations of quasi-identifying attributes. For objects with only statistical summaries and not allowing record-by-record scanning, cardinality sketches and frequency sketches can be used to estimate the size of equivalence classes. Empirical re-identification risk can also be calculated by integrating record uniqueness, k-map estimation under the external mapping population, and the discriminant rate of controlled attribute inference tests. During calculation, each component is normalized in the same direction, so that larger component values ​​indicate higher re-identification risk.

[0140] The aforementioned experience-based re-identification risk is a unified quantitative result oriented towards the probability that a data object can be associated with a single record or a specific subject, rather than a level obtained by directly looking up a table based on the sensitive type name. The inverse of the equivalence class size reflects the distinguishing power of an object's value on a record; record uniqueness reflects the proportion of values ​​that appear only once within a sample; k-map risk estimation reflects the sparsity of the correspondence between the sample and the mapped population; and attribute inference discrimination rate reflects the inference power of other known attributes on the target attribute. All components are obtained locally through controlled statistics or attack simulation. Cross-party arbitration only uses risk comparison proofs or permitted risk intervals, without transmitting record-by-record analysis results.

[0141] The calibration coefficients for risk components can be fitted using historical desensitization assessment tasks or configured by security personnel within a preset range. To avoid treating a missing component as zero risk, the missing component should be included in the risk calculation along with the sufficiency of evidence: if the reason for the missing component is that the test is not applicable, then the remaining valid components are used for renormalization; if the reason for the missing component is insufficient data or calculation failure, then the conservative upper bound of the corresponding component is used and marked as pending review. The risk results simultaneously save the component versions and estimation error ranges, allowing different stakeholders to compare under the same physical meaning without needing to use a consistent field naming convention.

[0142] Using an exemplary data object, it can be seen that while a column may have a large minimum equivalence class size and low record uniqueness, when combined with a time slice field in the same kinship subgraph, the equivalence class size of the joint values ​​significantly decreases, and the discriminant rate of the attribute inference test increases accordingly. Individual column risks may fall within the general risk range, while combined risks enter the important risk range. This result demonstrates that empirical re-identification risk can express changes where "individual observations are difficult to correlate, but combined observations can correlate," whereas manually generated sensitivity type mapping tables typically only provide fixed levels based on field names, making it difficult to reflect such changes in combined conditions.

[0143] S5.3. For each data object, the levels whose inconsistency scores do not exceed the corresponding hierarchical threshold in the conformal threshold set are included in the candidate level set. For the candidate level set that is not a single level, the highest level is taken and marked as pending review. Combined with the experience-based re-identification risk, an initial hierarchical label set is obtained.

[0144] When a data object corresponds to multiple sensitivity types, candidate level sets can be constructed separately and their union taken, or the sensitivity type layer with the highest risk can be used as the primary layer; the merging rules used are fixed before calibration. When the candidate level set is empty, the highest level can be included in the set and marked as pending review to avoid no output due to missing samples in the calibration layer. The initial classification label set should at least record the data object identifier, selected level, empirical re-identification risk, candidate level set size, pending review label, and model and threshold version.

[0145] The technical definition of cost-asymmetric waiver is: when model evidence cannot stably shrink the true level to a single element, instead of forcibly selecting the single-point level with the highest probability, all possible levels that meet the calibration threshold are retained, and the highest level among them is temporarily selected on the business execution label. The pending review label enables subsequent arbitration, manual verification, and control enforcement to identify that the level comes from uncertainty protection rather than from a uniquely certain prediction. Missing a level may lead to insufficient protection measures for high-risk data, the cost of which is usually higher than the control overhead increased by temporary mis-escalation. Therefore, the highest-level waiver directly incorporates this cost difference into the decision rules.

[0146] The generation process of the candidate level set also includes boundary consistency checks. If the ordinal output header generates boundary probabilities that do not satisfy the ordered relationship, the system first calculates the inconsistency score using the monotonic correction result and records the model state as an anomaly. If all levels of an object exceed the threshold, the system uses the highest level as a placeholder and marks it as pending review. If all three levels enter the set, it indicates that the current features are insufficient to distinguish the levels, and the weight of this object in cross-party voting will automatically decrease as the set size increases. The above processing ensures that no abnormal path will silently output low-level and high-weight results.

[0147] In one example, an object's inconsistency scores for the general, important, and core levels are 0.18, 0.23, and 0.41, respectively, corresponding to stratification thresholds of 0.20, 0.27, and 0.35. Therefore, the candidate level set includes both general and important levels. Instead of directly outputting the general level simply because it has the lowest score, the system outputs the important level and marks it as pending review. The candidate level set has a size of two, and subsequent voting weights are correspondingly lower than those for a deterministic result where the candidate set has only one level.

[0148] S5.4. Perform combined amplification risk recalculation and level propagation on the initial hierarchical label set on the data lineage graph to obtain the local hierarchical result set.

[0149] The combined amplification risk analysis uses connected subgraphs as boundaries, avoiding arbitrary splicing of unrelated data objects. The system prioritizes enumerating object combinations with high uniqueness or high attribute inference discriminative rates, and utilizes the risk monotonicity pruning caused by attribute additions. The risk level is then propagated upwards along the direction of the derivation edges; if an object receives levels from multiple paths, the highest level is retained, and the source object combination and propagation path leading to the upward adjustment are recorded for subsequent auditing.

[0150] Example 7

[0151] This embodiment further illustrates the combined amplification risk recalculation and level-to-level propagation, including the following steps:

[0152] S5.4.1. Construct the data lineage graph with each data object as a node and the table reference relationship and derivation relationship as edges, and divide the data lineage graph into connected subgraphs;

[0153] Data object nodes can correspond to fields, columns, tables, file attributes, or interface parameters. Table references include primary and foreign key references and mapping references. Derivation relationships include projection, join, aggregation, replication, and format conversion. Directed edges are retained for directional derivation relationships, while reference relationships that only indicate a common affiliation can be treated as undirected edges during connectivity partitioning.

[0154] S5.4.2. Enumerate data object combinations whose cardinality does not exceed the preset upper limit of the combination cardinality within each of the connected subgraphs to obtain a candidate combination set;

[0155] Enumeration starts with a single set of objects and connects objects with common record keys or traceable derivation relationships in a fixed order. A preset upper limit on the cardinality of combinations and a budget for the number of candidates in a single connected subgraph jointly limit the search size; when the budget is exceeded, candidate combinations can be sorted by single-object risk, mutual information estimation, or common record coverage, retaining higher-priority candidate combinations.

[0156] The candidate combination set can be generated using a layer-by-layer expansion approach. The system first retains single-object items that meet the common record coverage condition, and then connects valid combinations with the same prefix into higher-cardinality combinations; if a combination lacks a common record key, crosses the permission boundary of prohibited combinations, or its data version time intervals do not overlap, it will not proceed to the next level. This enumeration method ensures that each candidate combination can actually form a joint value on the local data, avoiding the forced combination of objects that are only logically adjacent but do not have a common observation basis.

[0157] S5.4.3. Calculate the equivalence class size after combination for each candidate combination in the candidate combination set, and recalculate the empirical re-identification risk of the candidate combination accordingly to obtain the combination amplification risk;

[0158] The system performs grouped counting of the joint values ​​of candidate combinations locally, or approximates the size of the combined equivalence classes using a joint cardinality sketch. The size of the combined equivalence classes is usually no larger than the size of the equivalence classes formed by any single component object alone, therefore the corresponding risk components do not decrease. The recalculation results also record the estimation error bound; when the estimation interval near the risk threshold crosses the threshold, the corresponding combination is set to await review rather than being directly downgraded.

[0159] Combinatorial risk monotonicity is only used for risk components where "adding attributes does not reduce distinguishable information." For derived objects with random noise, strong aggregation, or irreversible generalization proofs, the system marks the corresponding edges as risk-reduced edges and excludes them from the ordinary monotonic expansion rules to avoid incorrectly upscaling statistical results that have lost individual granularity. Risk-reduced edges need to carry the operation type, parameter version, and verification summary; if the verification summary is missing, they are treated as ordinary derived edges to maintain conservatism.

[0160] S5.4.4. When the combined amplification risk of the candidate combination is not lower than the preset risk threshold, the level of each data object in the candidate combination is raised to the level corresponding to the preset risk threshold, and the expansion of the superset of the candidate combination is stopped;

[0161] The superset expansion mechanism leverages the property that risk does not decrease with increasing attributes: For combinations that have reached a preset risk threshold, their supersets do not need to be recalculated to determine if the same threshold has been reached. The system can still save this combination as the minimum triggering combination to indicate which objects jointly caused the level increase. Different risk ranges can correspond to different level thresholds, but the same pruning is performed on a fixed threshold.

[0162] The cessation of expansion does not involve discarding risk evidence, but rather recording the combination that first reaches the threshold as the minimum trigger combination. Since no proper subset of this combination reaches the same threshold, the reason for the level increase can be explained with fewer objects; its superset, based on monotonicity, does not require repeated verification of whether the threshold has been reached. For cases where a higher risk threshold needs to be determined, limited expansion can continue from the minimum trigger combination, but a separate search for higher threshold states should be used to avoid mixing pruning conditions for different thresholds.

[0163] In one example, a connected subgraph contains objects A, B, C, and D, with a preset maximum combination cardinality of three. If no single object reaches the importance risk threshold, but the combination of objects A and B does, the system records this as the minimum trigger combination and does not calculate a three-object superset containing A and B for the same threshold. If the combination of objects A and C does not reach the threshold, it can still be connected to object D for further evaluation. Thus, computational resources are concentrated on branches where the risk cannot yet be determined by smaller combinations.

[0164] S5.4.5. Propagate the upgraded level to downstream data objects along the derivation relationship edges of the data lineage graph, and take the highest level on the propagation path for each data object to obtain the local hierarchical result set.

[0165] During propagation, blocking conditions can be set based on the type of derived operation. For example, derived edges that have been proven to satisfy irreversible aggregation and whose outputs do not retain individual granularity can be marked as risk-reduction edges and will not undergo normal propagation to the highest level; derived edges that have not obtained risk-reduction proofs are processed according to the highest level rule. Each downstream object stores the highest-level source path, propagation version, and timestamp, thus making the propagation results traceable.

[0166] When the data lineage graph contains write-back, synchronization, or circular dependencies, the system folds strongly connected node groups into propagation units. Within each propagation unit, the highest level is taken first, and then propagation proceeds downstream along the folded directed acyclic relationships. During incremental updates, only nodes whose levels or lineage edges have changed are recalculated for downstream reachability; it is not necessary to recalculate the entire connected subgraph. The propagation result includes the minimum trigger combination of the source, a summary of the derived edges traversed, and the final received level, enabling cross-party arbitration to distinguish between the level directly given by the model and the level adjusted by lineage propagation.

[0167] Example 8

[0168] like Figure 5 As shown, this embodiment details the cross-party rating consistency alignment and dense-state weighted arbitration process, including the following steps:

[0169] S6.1. Perform name normalization and shared key pseudo-random function fingerprinting on each data object in the local hierarchical result set to obtain the object fingerprint set;

[0170] Name standardization can be performed sequentially, including case unification, whitespace and separator normalization, path hierarchy normalization, controlled synonym mapping, and version field concatenation. The input to the shared-key pseudo-random function must include at least the standardized object name, business domain identifier, and object hierarchy to reduce the probability of misalignment of objects with the same name across different business domains. Object fingerprints and the pattern bucket in step S2 can use different key-derived context labels to prevent association between the two types of fingerprints.

[0171] S6.2. Perform a multi-party privacy intersection on the object fingerprint set and each of the participating parties to obtain a cross-party shared object fingerprint set and a holder traceability tag;

[0172] The multi-party privacy request can reuse the threshold-crossing protocol of Embodiments 2 and 3, revealing only the fingerprints of objects that have reached the disclosure threshold. The holder traceability label limits which participants can provide level labels, voting weights, or downgrade support for the corresponding object, and participants who do not hold the object are not included in the arbitration subject set for that object.

[0173] S6.3. For each object fingerprint in the cross-party shared object fingerprint set, convert the level label of each participating party into a secret sharing share and perform a secret state equality check, and classify the object fingerprints with inconsistent level labels into the divergent object subset.

[0174] Level labels can be encoded as ordered integers or one-hot vectors. The closed-state equality check only outputs the equality or inequality decision bits, without outputting the level labels for each participant; objects with all equal labels directly enter the consensus label set. Only objects with inequal decision bits establish subsequent closed-state weight aggregation sessions, making computational and communication overhead related to the number of divergent objects, rather than the total number of cross-party shared objects.

[0175] The essence of two-phase cross-party alignment lies in separating the determination of "whether a disagreement exists" and "how to weight the disagreement" into different cryptographic calculation stages. The first stage only performs a low-load equality check and does not calculate weights; the second stage only prepares encrypted weights and performs level-based summation for objects with unequal bits. If the number of shared objects is large and the actual disagreement ratio is low, this structure can significantly reduce the number of sessions that inadvertently transmit encrypted weights, the number of ciphertext multiplications and additions, and the amount of temporary storage, while not changing the output of consistent objects.

[0176] Each stage is bound to the same set of object fingerprints and the same set of participant summaries. If a participant withdraws after the equality check, the system does not directly continue weighted aggregation with the remaining participants. Instead, it regenerates the set of valid holders for the corresponding object and checks whether the disclosure threshold is still met; if not, arbitration for that object is stopped. This avoids unverifiable weighted results arising from different subject sets in the first and second stages.

[0177] S6.4. Perform dense-state weighted aggregation on the subset of the divergent objects to obtain a weighted divergent decision set, and perform arbitration of the highest and lowest level of evidence on the object fingerprints that are consistent with the level labels in the cross-party shared object fingerprint set, and output the final classification result set.

[0178] The encrypted weighted aggregation adds encrypted weights to each level separately. The aggregator only obtains the authorized decrypted level weights and their comparison results. Unintentional encrypted weight transmission prevents the aggregator from directly mapping plaintext weights to specific participants. The arbitration state machine first forms an initial judgment level, then checks for valid downgrade evidence; the state transition simultaneously checks the risk proof, the number of supports, the single-round amplitude, and the pending review flag. If any condition is not met, the initial judgment level is maintained.

[0179] Unintentional encrypted weight transfer allows participants to deliver encrypted weights valid only in the corresponding level slot to the aggregator without revealing the selected level location. The aggregator receives ciphertext that can be aggregated by slot, rather than a ternary relationship of "participant-plaintext weight-plaintext level". To prevent participants from submitting negative weights, weights exceeding the upper limit, or weighting multiple levels in the same slot, participants submit both weight range proofs and single-choice constraint proofs. Payloads that fail to be verified are not included in the weighted divergence decision set.

[0180] Example 9

[0181] This embodiment further illustrates the voting weights, initial judgment level, and constrained downgrade evidence submission, including the following steps:

[0182] S6.4.1. Each participating party generates a voting weight by multiplying the reciprocal of the number of levels contained in the candidate level set with the participating party's data integrity of the data object;

[0183] The candidate level set contains one, two, or three levels; a smaller set indicates a more certain local conformal inference. Data completeness, after normalization, falls between zero and one and can be weighted by the proportion of valid records, the coverage ratio of key attributes, data version freshness, and lineage completeness. To avoid excessive weighting for any single participant, the data can be truncated to the public upper limit and a range proof generated before encrypted transmission.

[0184] The components of data completeness are fixed when the arbitration task is established, and only objective statistics generated before the grading are used. The effective record ratio reflects the coverage of records eligible for local analysis; the key attribute coverage ratio reflects whether the attributes required for risk assessment are complete; data version freshness reflects the interval between the object version and the arbitration benchmark time; and lineage completeness reflects the traceability of upstream sources and derivation paths. Each component is first mapped to the same numerical range and then synthesized using publicly available configurations. No component may reference the arbitration result of this round or the voting results of other participants, thus preventing a loop where the arbitration result reverses its own voting weight.

[0185] The reciprocal of the candidate level set size expresses model uncertainty, while data completeness expresses the completeness of evidence. Multiplying these two factors suppresses voting weight when either factor is low. For results with only one candidate level but severely missing data, data completeness limits the weight; for results with complete data but a candidate set containing three levels, set size limits the weight. Compared to allocating voting rights solely based on participant size or fixed identity weights, this structure correlates weights with the actual evidentiary state of the current object.

[0186] S6.4.2. The voting weights are encrypted and transmitted to the aggregator via unintentional encryption. The aggregator sums the voting weights by level in the encrypted state to obtain the weighted scores for each level. The weighted scores constitute the weighted divergence decision set.

[0187] Participants encode their voting weights and corresponding level selections into encrypted vectors. Only positions at the selected level carry valid weights, while other positions carry zero-valued ciphertext. Aggregators perform homomorphic addition or secure multi-party summation on positions at the same level to obtain weighted scores for three levels: general, important, and core. The protocol may disclose only the position of the highest score and necessary comparison proofs, without disclosing individual weights.

[0188] Unintentional encrypted weights refer to the process where participating parties encrypt their voting weights and submit them unintentionally or through a corresponding encrypted selection protocol. This allows the aggregator to summarize the weights according to levels without revealing the plaintext weights of individual participants, their selected levels, or the correspondence between the two. This technology reduces the leakage of voting information and supports encrypted weighted arbitration.

[0189] Each encrypted vector is bound to an object fingerprint, a participant's task identifier, and an arbitration round. The aggregator rejects vectors containing duplicate objects, duplicate participants, or expired rounds. Range proofs are used to verify that the weights are within the publicly allowed range, while single-choice constraint proofs are used to verify that only one level slot carries a valid weight without revealing the slot's position. Only after successful verification is a secret summation performed on slots of the same level, preventing malicious or faulty participants from manipulating the weighted score by submitting multiple non-zero slots, negative values, or abnormally large values.

[0190] S6.4.3. Compare the level with the highest weighted score in the weighted disagreement decision set with the highest level in each of the participating party's level labels, and take the highest level of the two as the initial judgment level;

[0191] If weighted scores are tied, the higher level is selected from the tied levels. The highest level among the level labels for each participant can be obtained through a closed-state maximum protocol; the aggregator does not need to obtain the plaintext label for each participant. The weighted majority result is compared with the highest level so that a few high-risk observations are not simply ignored due to the small number of participants.

[0192] The weighted threshold includes two layers of conservative constraints: first, the highest score is selected from the weighted scores at each level, and then compared with the highest value of the dense state of all participants' level labels. The first layer reflects the concentration direction of the majority of high-quality evidence, while the second layer retains the upper bound of protection when a minority of participants observe high-level risks. Only when subsequent downgrading evidence simultaneously meets the risk threshold, the number of supports, the magnitude of a single round, and the object's state conditions is the initial judgment level allowed to be adjusted downward. Therefore, the weighted result itself cannot directly cover high-level risk signals.

[0193] S6.4.4. Receive downgrade evidence. When the participant proposing downgrade evidence proves in the secret state that the risk of re-identification of the corresponding data object is lower than the downgrade risk threshold, and the number of holders supporting the corresponding downgrade evidence is not less than the downgrade consensus threshold, the initial judgment level is downgraded by one level. The downgrade consensus threshold is greater than the disclosure threshold and not less than half plus one of the number of holders of the corresponding data object. Each round of downgrading shall not exceed one level, and data objects marked as pending review shall not be downgraded.

[0194] Downgrade evidence can employ interval proofs or secure comparison protocols, proving the relationship between the empirically re-identified risk and the downgrade risk threshold, without disclosing the raw statistical values ​​of the risk components. The supporting party signs the downgrade evidence digest or submits a secret share of the support bits; the aggregator counts the number of supports in a secret state. If the number of object holders is... The consensus threshold for downgrading is at least... And it is strictly greater than the disclosure threshold. This indicates the number of holders of the corresponding data object. Indicates to The majority threshold is rounded up. This constraint, along with the maximum reduction of one level per round, limits the rate of degradation, allowing the risk status to be re-evaluated in the next round.

[0195] Constrained downgrade evidence submission provides a limited corrective channel for continued adherence to the highest standard, rather than a regular vote symmetrical to the highest standard rule. The submitter must prove the risk is below the downgrade risk threshold, the supporting party must confirm the same proof summary and object version, and any pending review flag set by any participating party will block downgrade. A maximum of one level per round prevents a direct jump between the general and core levels; the next round must be initiated again using updated risk evidence, thus avoiding rapid downgrade to the lowest level through continuous reuse of the same proof.

[0196] Using a five-holder example, the disclosure threshold is set to two, and the downgrade consensus threshold is set to four. The dense-state weighted result points to the importance level, but one holder submits a core-level label, so the initial level is set to core. If the downgrade evidence risk is lower than the core-level downgrade risk threshold, and four holders submit valid support for the same proof digest, and the object is not marked as pending review, then it can be downgraded to the importance level in this round; even if all support it, it cannot be downgraded to the general level in the same round. If only three supporters or any one of them has a candidate level set that is not a single element and is marked as pending review, then the core level is maintained.

[0197] S6.4.5. Merge the level labels of the object fingerprints that are consistent with the level labels in the cross-party shared object fingerprint set after arbitration, calculate the hash certificate for the classification basis, and output the final classification result set and the classification basis hash audit certificate.

[0198] During merging, the object fingerprint and data version are used as the joint key to prevent different versions of the same object from overwriting each other. The grading criteria are serialized in a fixed order, and the calculated hash credentials are written to an immutable audit log or a log storage with append-write protection. Subsequent verifiers can recalculate the digest and compare it with the credentials to determine whether the model version, threshold version, proof result, and final grade have been changed.

[0199] The normalized sequence used for rating must at least fix the field order, character encoding, time representation, and missing value representation to prevent the same semantics from generating different hashes due to serialization differences. For weighted scores and support bits that are not suitable for plaintext entry into the audit log, the corresponding commitment or encrypted digest is written into the voucher; during verification, the authorized party provides the activation information or verification proof of the same commitment. If any of the model, threshold, object version, or arbitration proof changes, a new audit voucher is generated, which does not overwrite the old voucher.

[0200] Audit vouchers can also form parent-child relationships: local hierarchical result vouchers serve as input references for cross-party arbitration vouchers, which in turn serve as input references for control enforcement evidence. The verifying party can determine which model, threshold, object version, and arbitration session a particular enforcement strategy originates from by following the parent-child relationship, without needing to read the original data or plaintext voting details of the participating parties.

[0201] Example 10

[0202] like Figure 6 As shown, this embodiment provides a multi-party collaborative device for data security classification and grading based on privacy computing, used to execute the method described in the above embodiment, including:

[0203] The data parsing module is used to perform metadata parsing, sampling, and sensitive information identification on various data sources of the enterprise to obtain a sensitive label set;

[0204] The hash bucketing module is used to perform shared-key pseudo-random function hash bucketing on the sensitive label set and output a desensitized feature set;

[0205] The extraction module is used to extract the pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus sensitive pattern library with a support of not less than the disclosure threshold.

[0206] The training module is used to train an initial hierarchical classification model with the consensus-sensitive pattern library, and to perform multi-party secure aggregation on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set.

[0207] The construction module is used to input the desensitized feature set into the global hierarchical classification model, construct a candidate level set according to the conformal threshold set, and take the highest level from the candidate level set that is not a single level to obtain the local hierarchical result set.

[0208] The privacy intersection module is used to perform fingerprinting on the local hierarchical result set and perform multi-party privacy intersection with each of the participating parties, perform dense-state weighted aggregation on the subset of divergent objects screened by the dense-state test, and arbitrate the evidence according to the principle of higher or lower level, and output the final hierarchical result set.

[0209] Example 11

[0210] This embodiment illustrates the risk reverse labeling and differentiated control strategy implementation after the final classification result set is formed, so as to provide a feasible technical measure and evidence loop for the final classification conclusion.

[0211] S7.1. Based on the final graded result set, set the acceptable attack success probability target according to the grade, and obtain the minimum control strength that meets the requirements of the acceptable attack success probability target and the experience re-identification risk inverse solution of the corresponding data object to obtain the control strategy configuration set.

[0212] Candidate control strategies can consist of at least two of the following: de-identification generalization granularity, noise addition strength, encryption algorithm strength, key rotation cycle, query frequency limit, and access approval level. The system estimates the residual attack success probability after execution for each candidate strategy and selects the strategy with the lowest control cost from those that meet the objectives of its respective level. One reverse calibration method is as follows:

[0213] (Equation 7)

[0214] in, Indicates the first The selected control strategy for each data object Indicates candidate control strategy, Indicates the relationship with the first The final level of a data object A set of suitable candidate control strategies, Indicates the implementation of candidate control strategy The required management and control costs This indicates that risks will be re-identified based on current experience. Execute candidate control strategy The probability of success of the remaining attacks. Indicates level The corresponding acceptable probability of attack success for the target. This represents the candidate control strategy that minimizes the objective function. The acceptable attack success probability target does not increase with increasing level, thus subjecting higher-level objects to risk constraints no less severe than those imposed on lower-level objects.

[0215] In one example, a data object is designated as importance, and the current empirical re-identification risk is 0.32. The system evaluates the remaining attack success probability after generalization, adding noise, and a combination of both, and selects the combination with the lowest control cost among the strategies that meet the importance target value. The target value, cost coefficient, and policy feasible domain are all configured using versioning to facilitate subsequent review of the original reverse engineering basis.

[0216] Risk reverse calibration refers to starting from "the remaining probability of attack success allowed to be retained at a certain level" and searching backwards to enable current experience to re-identify the minimum control strategy that reduces risk to within the target range, rather than mechanically searching for fixed strategies according to level. The candidate strategy set is first screened based on the capabilities of the execution components and data usage constraints, and then evaluated according to control costs from low to high; once a strategy that meets the target is found, the search for similar strategies with higher costs but without increasing the necessary benefits can be stopped. For generalization, noise addition, and approval levels with discrete configuration levels, enumeration or branch and bound methods can be used to solve the problem; for continuous noise addition intensity, a successive approximation method can be used within the monotonic risk response interval to solve the problem.

[0217] Control costs include not only computation time but also data availability loss, interface latency, key maintenance load, and manual approval resources. Each cost component is normalized and assigned a non-negative weight within the same task domain. The estimation of the remaining attack success probability uses a data version and attack simulation environment consistent with empirical risk re-identification; if the risk response of a candidate strategy does not meet the expected monotonicity or the estimation error range crosses the target value, the strategy is not considered proven to meet the requirements, and the system continues to select a stronger strategy or marks it as pending review.

[0218] To illustrate with another example, if the current risk of a core-level object exceeds the target value, simply increasing the encryption algorithm strength can only reduce transmission and storage exposure, not the risk of re-identification in authorized query results. Therefore, the system will not misjudge this candidate as sufficient, but will continue to evaluate query result generalization and controlled noise addition. If "moderate generalization plus moderate noise addition" has already lowered the estimated upper bound of the remaining attack success probability below the core-level target, then the strong generalization scheme, which results in greater data availability loss, will not be selected. Thus, different objects at the same level can obtain different minimum control combinations that all satisfy the target, based on their current risk and risk sources.

[0219] S7.2. Based on the control policy configuration set, the effective control policy and execution evidence set are obtained by sending it to the database agent and application interface gateway for execution, collecting execution logs, and binding them with the hash audit certificate of the rating basis.

[0220] The database broker is responsible for implementing column-level masking, query rewriting, result generalization, or noise enhancement. The application programming interface gateway (API gateway) is responsible for implementing caller authentication, access frequency limits, and approval token verification. Execution logs record at least the object fingerprint, policy version, execution component identifier, execution time, result status, and configuration digest hash. The system combines the execution log digest with the rating-based hash audit credential to calculate a binding credential, thereby proving that the control policy corresponding to a given final rating result has been effective by the specified execution component under the corresponding version. When policy execution fails, the system maintains or increases the temporary control strength and generates pending tasks to prevent objects from falling below the target risk constraint due to execution failure.

[0221] The policy deployment process employs four states: preparation, verification, activation, and receipt. The database agent and application interface gateway first receive the configuration in the preparation state. In the verification state, they check the availability of object fingerprints, policy versions, algorithm capabilities, and dependent keys. Only after all checks pass does the system atomically switch to the activation state. If any execution component fails verification, partial success is not interpreted as overall effectiveness; the system maintains the previous policy or activates a preset conservative policy, and records the failed component and the reason for failure in the execution evidence set.

[0222] The binding credential links the rating basis hash audit credential, the control policy configuration summary, and the receipt summaries of multiple execution components into a single chain of evidence. Subsequent re-ratings, policy parameter adjustments, or component redeployments generate new sub-credentials that reference the previous version, without deleting old records. Verifiers can complete consistency checks using only the object fingerprint and the corresponding version summary, without needing to access the original data, unilateral model updates, or plaintext voting weights, thus maintaining consistency between audit verifiability and collaborative privacy boundaries.

[0223] It should be noted that the specific model structure, cryptographic protocol instance, hash function, bucket configuration, risk components, and control strategies in the above embodiments can all be replaced while maintaining the data flow relationship and functional relationship defined in the claims. Those skilled in the art can also implement this invention as a computer device, a computer-readable storage medium, or a system composed of multiple computing nodes; when the processor of the computer device executes program instructions stored in the memory, it implements the steps of any of the above method embodiments.

Claims

1. A multi-party collaborative method for privacy computing-based data security hierarchical classification, characterized in that, include: Metadata parsing, sampling, and sensitive information identification are performed on various data sources of the enterprise to obtain a sensitive label set; Perform shared-key pseudo-random function hash bucketing on the sensitive label set and output the de-identified feature set; Extract pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus sensitive pattern library with support not lower than the disclosure threshold; An initial hierarchical classification model is trained using the consensus-sensitive pattern library. Multi-party secure aggregation is then performed on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set. The desensitized feature set is input into the global hierarchical classification model, and a candidate level set is constructed according to the conformal threshold set. The highest level is taken from the candidate level set that is not a single level to obtain the local hierarchical result set. The local hierarchical result set is fingerprinted and multi-party privacy intersection is performed with each of the participating parties. The subset of divergent objects screened out by the secret state test is aggregated by secret state weighting and then arbitrated according to the principle of higher or lower level evidence, and the final hierarchical result set is output.

2. The method of claim 1, wherein, Extract pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus-sensitive pattern library with support no less than the disclosure threshold, including: Extract column name identifier hash buckets and value form signature buckets from the desensitized feature set, and concatenate them to obtain the pattern fingerprint of each data object; An unintentional pseudo-random function is applied to the pattern fingerprint to obtain a blinded fingerprint; Using the blinded fingerprint as input, a threshold-based multi-party privacy intersection is performed among the participating parties to count the number of participating parties holding each blinded fingerprint and determine the fingerprint support. The blinded fingerprints with support levels not lower than the disclosure threshold are aggregated with their corresponding holder identifiers to determine the consensus sensitive pattern library and the holder traceability label.

3. The method of claim 2, wherein, Using the blinded fingerprint as input, a threshold-based multi-party privacy intersection is performed among the participating parties to count the number of participating parties holding each blinded fingerprint and determine the fingerprint support, including: Each of the aforementioned participants generates a set of secret sharing shares for each of the local blinded fingerprints. The secret value carried by each secret sharing share is the holder identifier of the corresponding participant, and the threshold of each secret sharing share is equal to the disclosure threshold. Each of the aforementioned secret sharing shares is grouped and aggregated to the aggregator according to the blinded fingerprint, resulting in a share set grouped by fingerprint; Perform deduplication on the share set grouped by fingerprint, and output a set of distinct shares; Count the number of shares in the distinct share sets and output the candidate support. The candidate support is compared with the disclosure threshold. For the share set of fingerprint grouping with candidate support not lower than the disclosure threshold, secret reconstruction is performed and the corresponding all holder identifiers are output. For the share set of fingerprint grouping with candidate support lower than the disclosure threshold, reconstruction is stopped and the candidate support is used as the fingerprint support of the corresponding blinded fingerprint.

4. The method of claim 1, wherein, An initial hierarchical classification model is trained using the aforementioned consensus-sensitive pattern library. Multi-party secure aggregation is then performed on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set, including: According to the consensus sensitive pattern library, each data object in the sensitive label set is matched item by item to generate pattern hit feature bits, which are then concatenated with the desensitized feature set to obtain the enhanced desensitized feature set; The initial hierarchical classification model, which includes a sensitive type multi-label output head and a three-level ordinal hierarchical output head, is trained using the enhanced desensitization feature set, and the local model parameters are output after training. The inconsistency score of the initial hierarchical classification model is calculated on the local calibration subset, and the local calibration score distribution is obtained by stratifying and statistically analyzing the sensitivity type and target level. After performing masking and fragmentation on the local model parameters and the local calibration score distribution, the data is uploaded to the aggregator. The aggregator then performs masking-off secure summation and offline fragmentation recovery to obtain the global hierarchical classification model and the conformal threshold set.

5. The method of claim 4, wherein, After performing masked fragmentation on the local model parameters and the local calibration score distribution, the data is uploaded to the aggregator. The aggregator then performs masked cancellation secure summation and offline fragment recovery to obtain the global hierarchical classification model and the conformal threshold set, including: Norm clipping is performed on the local model parameters, and pairs of random masks are generated through negotiation with each of the participating parties. The pairs of random masks are then superimposed on the clipped local model parameters to obtain the masked model parameters. The local calibration score distribution is expanded by hierarchical bucket counting, and the paired random mask is superimposed on each bucket count to obtain the mask bucket count; The mask model parameters and the mask bucket count are uploaded to the aggregator after being secretly shared and sharded. The aggregator sums the data of each shard to make the paired random masks cancel each other out, and performs threshold recovery on the shards of the offline participants to obtain the aggregation model parameters and the global bucket count. The initial hierarchical classification model is updated and distributed using the aggregated model parameters, and the global hierarchical classification model is obtained through multiple iterations. The global bucket count is accumulated bucket by bucket according to sensitivity type and target level. The bucket boundary corresponding to the first time the accumulated value reaches the target coverage level is taken as the layer threshold of the corresponding layer. The conformal threshold set is obtained by taking the layer threshold and the local layer quantile that makes the candidate level set contain the most levels.

6. The method of claim 1, wherein, The desensitized feature set is input into the global hierarchical classification model, and a candidate level set is constructed according to the conformal threshold set. For candidate level sets that are not single-level, the highest level is selected to obtain the local hierarchical result set, including: The desensitized feature set is input into the global hierarchical classification model to obtain the sensitivity type probability and inconsistency score of each data object; By combining the aforementioned sensitivity type probabilities with the statistically obtained equivalence class sizes of each data object, the empirical re-identification risk of each data object is calculated. For each data object, the levels whose inconsistency scores do not exceed the corresponding stratification threshold in the conformal threshold set are included in the candidate level set. For the candidate level set that is not a single level, the highest level is taken and marked as pending review. Combined with the experience-based re-identification risk, an initial grading label set is obtained. On the data lineage graph, the initial hierarchical label set is subjected to combined amplification risk recalculation and level propagation to higher levels to obtain the local hierarchical result set.

7. The method of claim 6, wherein, Perform combined amplification risk recalculation and level-to-high propagation on the initial hierarchical label set on the data lineage graph to obtain the local hierarchical result set, including: The data lineage graph is constructed using each data object as a node and the table references and derivation relationships as edges, and the connected subgraphs of the data lineage graph are divided. Within each connected subgraph, enumerate combinations of data objects whose cardinality does not exceed a preset upper limit of the combination cardinality to obtain a candidate combination set; For each candidate combination in the candidate combination set, calculate the combined equivalence class size, and recalculate the empirical re-identification risk of the candidate combination accordingly to obtain the combination amplification risk; When the combined amplification risk of the candidate combination is not lower than the preset risk threshold, the level of each data object in the candidate combination is raised to the level corresponding to the preset risk threshold, and the expansion of the superset of the candidate combination is stopped. The adjusted level is propagated downstream along the derivation edges of the data lineage graph, and the highest level on the propagation path is taken for each data object to obtain the local hierarchical result set.

8. The method of claim 1, wherein, The local hierarchical result set is fingerprinted and subjected to multi-party privacy intersection with each of the participating parties. The subset of divergent objects identified through secret-state verification is subjected to secret-state weighted aggregation. Arbitration is then performed based on the principle of prioritizing higher or lower-level evidence, and the final hierarchical result set is output, including: Name normalization and shared-key pseudo-random function fingerprinting are performed on each data object in the local hierarchical result set to obtain the object fingerprint set; Perform a multi-party privacy intersection with the object fingerprint set and each of the participating parties to obtain a cross-party shared object fingerprint set and a holder traceability tag; For each object fingerprint in the cross-party shared object fingerprint set, the level label of each participating party is converted into a secret sharing share and a secret state equality check is performed. Object fingerprints with inconsistent level labels are classified into the divergent object subset. Perform dense-state weighted aggregation on the subset of the divergent objects to obtain a weighted divergent decision set, and perform arbitration of the highest or lowest level of evidence on the object fingerprints that are consistent with the level labels in the cross-party shared object fingerprint set, and output the final classification result set.

9. The method of claim 8, wherein, Perform dense-state weighted aggregation on the subset of divergent objects to obtain a weighted divergence decision set, and perform arbitration of evidence presentation (either higher or lower level) on the object fingerprints in the weighted divergence decision set that match the level labels in the cross-party shared object fingerprint set, outputting the final classification result set, including: Each participating party generates a voting weight by multiplying the reciprocal of the number of levels contained in the candidate level set by the participating party's data integrity of the data object; The voting weights are encrypted and transmitted to the aggregator via unintentional encrypted weight transmission. The aggregator sums the voting weights by level in encrypted form to obtain the weighted score for each level. The weighted scores constitute the weighted divergence decision set. The level with the highest weighted score in the weighted disagreement decision set is compared with the highest level in the level labels of each participating party, and the highest level between the two is taken as the initial judgment level. When a participant proposing a downgraded evidence proves in a closed state that the risk of re-identification of the corresponding data object is lower than the downgrade risk threshold and the number of holders supporting the corresponding downgraded evidence is not lower than the downgrade consensus threshold, the initial judgment level is lowered by one level. The downgrade consensus threshold is greater than the disclosure threshold and not less than half plus one of the number of holders of the corresponding data object. Each round of downgrading shall not exceed one level, and data objects marked as pending review shall not be downgraded. Merge the level labels of the object fingerprints that are consistent with the level labels in the cross-party shared object fingerprint set after arbitration, calculate the hash certificate for the classification basis, and output the final classification result set and the classification basis hash audit certificate.

10. A multi-party cooperative device for privacy computing-based data security hierarchical classification, characterized in that, include: The data parsing module is used to perform metadata parsing, sampling, and sensitive information identification on various data sources of the enterprise to obtain a sensitive label set; The hash bucketing module is used to perform shared-key pseudo-random function hash bucketing on the sensitive label set and output a desensitized feature set; The extraction module is used to extract the pattern fingerprints from the desensitized feature set and perform over-threshold multi-party privacy intersection with each participant to determine a consensus sensitive pattern library with a support of not less than the disclosure threshold. The training module is used to train an initial hierarchical classification model with the consensus-sensitive pattern library, and to perform multi-party secure aggregation on the parameters of the initial hierarchical classification model and the local calibration score distribution to obtain a global hierarchical classification model and a conformal threshold set. The construction module is used to input the desensitized feature set into the global hierarchical classification model, construct a candidate level set according to the conformal threshold set, and take the highest level from the candidate level set that is not a single level to obtain the local hierarchical result set. The privacy intersection module is used to perform fingerprinting on the local hierarchical result set and perform multi-party privacy intersection with each of the participating parties, perform dense-state weighted aggregation on the subset of divergent objects screened by the dense-state test, and arbitrate the evidence according to the principle of higher or lower level, and output the final hierarchical result set.

Images