Cross-agency fraud detection modeling method, apparatus, device, and medium

Abstract

The application relates to the technical field of artificial intelligence, and discloses a cross-institution anti-fraud modeling method, device, equipment and medium, the method comprises the following steps: generating a dynamic random permutation matrix and a paired matrix thereof, and distributing the dynamic random permutation matrix and the paired matrix to each participant, so that the intermediate layer weights of a local neural network are topologically confused; receiving the confused model update parameters uploaded by each participant and the gradient fingerprints extracted by the participants locally based on original gradients; performing clustering analysis according to all the gradient fingerprints, identifying outlier nodes whose deviation degree exceeds a preset threshold, and excluding the outlier nodes from aggregation; summing the confused parameters of the remaining participants and inversely permuting the paired matrix to obtain global aggregated model weights; and issuing the global model after adaptively injecting differential privacy noise during the training phase. The application can be applied to the financial technology field, and is based on confused domain security aggregation and gradient fingerprint clustering auditing. Abnormal nodes can be actively identified and removed without decrypting original parameters, and the privacy protection level and model robustness of cross-institution joint modeling are improved.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence technology and financial technology, and in particular to a cross-institutional anti-fraud modeling method, apparatus, equipment and medium. Background Technology

[0002] In the fintech sector, cross-institutional collaborative anti-fraud modeling is of significant value in enhancing risk identification capabilities. Customer transaction data, asset data, and claims data held by different financial institutions (such as banks, insurance companies, and securities firms) form highly complementary feature dimensions. However, due to strict constraints on data security and personal information protection, both bank and insurance data fall under stringent regulatory purview, making the traditional approach of physically aggregating raw data from various parties into a single data center for centralized modeling no longer feasible.

[0003] Federated learning, as a privacy-preserving computation paradigm where data remains stationary while the model moves, allows participating parties to train models locally and only upload gradients or model parameter updates to a central server for aggregation, thus avoiding the direct transmission of raw data. However, in scenarios involving multiple institutions, especially different business entities, existing federated learning solutions still face multiple security and trust challenges. First, establishing trust itself incurs high compliance costs; all parties need to go through cumbersome auditing processes to confirm the security of the collaborative environment, lacking inherent technical security guarantees. Second, federated learning has been proven vulnerable to member inference attacks. Malicious collaborators can analyze subtle changes in gradients over multiple training rounds to infer sensitive customer characteristics within specific participating parties, such as the specific asset range of high-net-worth individuals. This makes encrypted transmission alone insufficient to eliminate privacy concerns.

[0004] Furthermore, existing federated learning architectures generally lack the ability to proactively audit gradient anomalies. During joint modeling, if a participant's local data is mislabeled due to system failure or poisoned by malicious attacks, the abnormal model parameters uploaded will directly participate in the global aggregation, leading to overall model bias or even collapse. Existing central aggregation servers struggle to accurately locate and remove the abnormal contributing node without decrypting the original data, and can only passively accept the contaminated aggregation results. Summary of the Invention

[0005] The technical problem to be solved by the embodiments of the present invention is: in the process of federated learning aggregation, how to actively identify and exclude data poisoning or abnormal contributions from participants without decrypting the original model parameters of each participant, so as to ensure the purity of the global model.

[0006] In a first aspect, embodiments of the present invention provide a cross-institutional anti-fraud modeling method, applied to a central aggregation server, comprising: Generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. Receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprints are obtained by the participant through statistical feature extraction based on the original model update gradients generated by its local training. Cluster analysis is performed on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and the model update parameters corresponding to the outlier nodes are excluded from subsequent aggregation. The obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes are summed, and the summation result is subjected to inverse permutation using the pairing matrix to obtain a global aggregated model weight that does not expose the original model parameters of any participant. Depending on the training stage of the global model, differential privacy noise is adaptively injected into the weights of the global aggregate model, and the global model with injected noise is then distributed to each participant.

[0007] Secondly, embodiments of the present invention also provide a cross-agency anti-fraud modeling apparatus, comprising: The permutation matrix management module is used to generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. The fingerprint receiving module is used to receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant. The gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training. The fingerprint audit module is used to perform cluster analysis based on all received gradient fingerprints, identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation. The aggregation recovery module is used to sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and to perform inverse permutation processing on the summation result using the pairing matrix to obtain a global aggregated model weight that does not expose the original model parameters of any participant. The noise control module is used to adaptively inject differential privacy noise into the weights of the global aggregate model according to the training stage of the global model, and distribute the noise-injected global model to each participant.

[0008] Thirdly, embodiments of the present invention also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-mentioned cross-agency anti-fraud modeling method.

[0009] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described cross-agency anti-fraud modeling method.

[0010] This invention achieves a synergistic improvement in privacy protection and model purity in federated anti-fraud modeling by constructing a closed-loop mechanism. It uses a dynamic random permutation matrix to topologically obfuscate the intermediate layer weights of participating parties' neural networks, rendering model parameters outside their local environment semantically meaningless, fundamentally cutting off the data basis for member inference attacks. By introducing gradient fingerprints extracted locally by participating parties based on the original gradients and uploaded along with the obfuscated parameters, the central server can complete clustering audits before aggregation without decrypting the original data. Based on objective deviation metrics, it automatically identifies and accurately removes outliers that have caused data poisoning or anomalies, ensuring that only normal contributions enter the aggregation process. During aggregation, a pairing matrix is ​​used to directly perform additive aggregation and inverse permutation within the obfuscation domain, achieving secure global weight synthesis without exposing the original parameters and eliminating cross-agency compliance and trust barriers. Simultaneously, differential privacy noise is adaptively injected and dynamically decayed during the training phase, strengthening privacy protection in the early stages and ensuring model recognition accuracy in the later stages, achieving a dynamic optimal balance between privacy and usability. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic diagram of an application environment for the cross-organizational anti-fraud modeling method provided in an embodiment of the present invention; Figure 2 A flowchart illustrating the cross-organizational anti-fraud modeling method provided in an embodiment of the present invention; Figure 3 A flowchart for permutation matrix management provided in an embodiment of the present invention; Figure 4A flowchart of gradient fingerprint generation provided in an embodiment of the present invention; Figure 5 A flowchart of fingerprint auditing provided for embodiments of the present invention; Figure 6 This is a flowchart of the aggregation recovery process provided in an embodiment of the present invention; Figure 7 A noise control flowchart provided for an embodiment of the present invention; Figure 8 A schematic diagram of a cross-agency anti-fraud modeling device provided in an embodiment of the present invention; Figure 9 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0015] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0016] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0017] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0018] The cross-agency anti-fraud modeling method provided in this invention can be applied to, for example... Figure 1 In this application environment, the client communicates with the server via a network. The server can generate a dynamic random permutation matrix and a pairing matrix with an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological obfuscation on the intermediate layer weights of the locally trained neural network; receive obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant through the client, wherein the gradient fingerprints are obtained by the participant from statistical feature extraction based on the original model update gradients generated by its local training; perform cluster analysis based on all received gradient fingerprints to identify outliers in the multidimensional feature space whose distribution deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outliers from subsequent aggregation; sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outliers, and use the pairing matrix to perform inverse permutation processing on the summation result to obtain global aggregated model weights that do not expose the original model parameters of any participant; adaptively inject differential privacy noise into the global aggregated model weights according to the training stage of the global model, and distribute the noise-injected global model to each participant. In this invention, a closed-loop mechanism is constructed to achieve a synergistic improvement in privacy protection and model purity in federated anti-fraud modeling. A dynamic random permutation matrix is ​​used to topologically obfuscate the intermediate layer weights of the participating parties' neural networks, rendering model parameters outside the local network semantically meaningless, fundamentally cutting off the data basis for member inference attacks. By introducing gradient fingerprints extracted locally by the participating parties based on the original gradients and uploaded along with the obfuscated parameters, the central server can complete clustering audits before aggregation without decrypting the original data. Based on objective deviation metrics, it automatically identifies and accurately removes outliers that have caused data poisoning or anomalies, ensuring that only normal contributions enter the aggregation process. During aggregation, a pairing matrix is ​​used to directly perform additive aggregation and inverse permutation within the obfuscation domain, achieving secure global weight synthesis without exposing the original parameters, eliminating cross-agency compliance and trust barriers. Simultaneously, differential privacy noise is adaptively injected and dynamically decayed during the training phase, strengthening privacy protection in the early stages and ensuring model recognition accuracy in the later stages, achieving a dynamic optimal balance between privacy and usability. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster composed of multiple servers. The present invention will now be described in detail through specific embodiments.

[0019] This embodiment uses a deep neural network model applied to a credit card transaction anti-fraud scenario as an example to illustrate the technical solution of the present invention in detail. (Refer to...) Figure 1 This anti-fraud model is deployed between a central aggregation server and multiple participating parties (such as different banks and payment institutions). Each participating party has its own independent customer transaction dataset, containing user transaction behavior characteristics and fraud tags. All participating parties and the central server collaboratively train a global anti-fraud model, with the following specific configuration: Model Structure: A feedforward neural network is used, comprising an input layer, three fully connected hidden layers, and an output layer. The number of nodes in the input layer equals the number of selected features. In this embodiment, 50 features are selected, including transaction amount, transaction time, transaction location code, merchant category, device fingerprint, etc., all of which are numerical or categorical features processed by embedding. The first hidden layer has 512 neurons, the second hidden layer has 256, and the third hidden layer has 128. Each hidden layer is followed by a ReLU activation function, and L2 regularization (coefficient 0.0001) is applied to the weights. The output layer is a single neuron that outputs the fraud probability through a sigmoid function. This structure can be adjusted according to specific scenarios, and this invention does not impose any limitations on it.

[0020] Training setup: Each participant uses the Adam optimizer locally with an initial learning rate of 0.001, a first-order momentum coefficient of 0.9, and a second-order momentum coefficient of 0.999. The loss function is binary classification cross-entropy loss. In each global communication round, participants train locally for 5 epochs with a batch size of 32. Gradient clipping is applied to stabilize training, and the maximum norm is set to 1.0. Local data is divided into training, validation, and test sets in an 8:1:1 ratio, but the validation and test sets are only used for local tuning and are not shared.

[0021] Input and output: In the inference phase, given a transaction record to be detected, the above 50-dimensional features are first extracted and standardized, and then input into the global model. The model outputs a fraud probability between 0 and 1. If the probability exceeds 0.5, it is judged as a fraudulent transaction.

[0022] like Figure 2 As shown, this embodiment of the invention provides a cross-institutional anti-fraud modeling method, including steps S1-S5: S1. Generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network.

[0023] In this step, the dynamic random permutation matrix is ​​an invertible matrix generated by the central aggregation server. It is used to linearly transform the weight parameters of the intermediate layers of the neural network, making the transformed weight parameters mathematically equivalent to the original parameters in another basis, but losing the original semantic readability. In a financial anti-fraud scenario of this invention, financial company A, acting as the central aggregation server, collaborates with its bank subsidiaries, property insurance subsidiaries, and life insurance subsidiaries to jointly train a deep neural network anti-fraud model. The intermediate layer weights of this model contain feature extraction patterns learned by each subsidiary from their respective customer transaction data, asset data, and claims data. If plaintext weights are transmitted directly, malicious eavesdroppers may analyze the distribution and changes of the weights to deduce the asset range or transaction habits of a specific customer group, constituting a member inference attack. The dynamic random permutation matrix P generated in this step is equivalent to setting a dedicated, randomly generated coordinate system for the intermediate layer of each participating party's model. This ensures that intermediate layer weights outside the local system are mapped to coordinates within this coordinate system, presenting a meaningless random number sequence to any third party that does not possess the pairing matrix, thereby cutting off the risk of intermediate layer parameter leakage at the source.

[0024] In a specific embodiment, such as Figure 3 As shown, step S1 specifically includes steps S11-S12.

[0025] S11. Using a preset random seed, generate an invertible dynamic random permutation matrix and its pairing matrix.

[0026] In this step, the central aggregation server uses a high-entropy random seed to generate an invertible square matrix P as a dynamic random permutation matrix through a secure pseudo-random number generator, and calculates its inverse matrix P. -1 As a pairing matrix, invertibility ensures that the confused aggregation parameters can be uniquely restored. In the scenario of financial company A, the random seed can be generated by combining timestamps and hardware noise and securely stored in the hardware security module of the central server. The dimension of the dynamic random permutation matrix is ​​consistent with the number of intermediate layer neurons agreed upon by each participant. For example, if the first hidden layer of the joint model contains 512 neurons, then P is a 512×512 full-rank matrix.

[0027] S12. The dynamic random permutation matrix is ​​sent to the corresponding participants through an encrypted channel, and the update and redistribution of the dynamic random permutation matrix are triggered according to a preset time period or training round.

[0028] In this step, the central aggregation server securely pushes P to the local training nodes of the bank, property insurance, and life insurance subsidiaries via encrypted channels such as SSL / TLS. To prevent attackers from reverse-engineering the permutation matrix by collecting a large number of obfuscated parameters over a long period, the system is equipped with a dynamic update mechanism. For example, it is set that every 10 rounds of global iterative training is completed, or every 1 hour, the central server regenerates new P and P'. -1 The matrix is ​​then distributed to all participants via an encrypted channel for updates. During the update process, participants who have not completed the current training round continue to upload using the old matrix until the next round of unified switching, ensuring a smooth transition in the training process. This mechanism implements a forward security feature, ensuring that even if the permutation matrix of a certain period is accidentally leaked, it will not affect the communication security of previous or subsequent periods.

[0029] S2. Receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training.

[0030] In this step, after receiving the dynamic random permutation matrix P, each participant uses P to obfuscate the local model update gradient, obtaining obfuscated model update parameters. Simultaneously, each participant locally extracts statistical features from the original gradient before obfuscation to generate a gradient fingerprint, and uploads both to the central aggregation server. In the scenario of financial company A, after a bank subsidiary completes a round of local training using its customer transaction records and labeled fraud case data, it obtains the original gradient tensor. It obfuscates the gradient using P and extracts the statistical features of the gradient to generate a fingerprint, then packages and uploads both. The gradient fingerprint generation process does not involve specific sample information; it only reflects the overall statistical distribution of the gradient, ensuring that customer-level privacy is not leaked due to fingerprint upload.

[0031] In a specific embodiment, such as Figure 4 As shown, the gradient fingerprint is generated by the participants through the following steps A11-A13.

[0032] A11. Obtain the original model update gradient generated by the participant's local training.

[0033] In this step, the participants use their locally retained customer dataset to calculate the gradient of the global model's loss function with respect to the weights of each layer on the current local data using the backpropagation algorithm. Taking a bank subsidiary as an example, its local training data contains millions of anonymized transaction records of customers and corresponding fraud labels. After one round of training, the original gradient ΔW_raw is obtained.

[0034] A12. Calculate the mean, variance, and skewness of the gradient update for the original model.

[0035] In this step, the participants statistically analyze all scalar gradient values ​​in ΔW_raw, calculating their mean μ and variance σ. 2 And skewness γ. The mean reflects the overall direction and magnitude of the gradient update in this round, the variance reflects the consistency of the update amounts of each parameter, and the skewness reveals the asymmetry of the gradient distribution. In financial anti-fraud scenarios, if the data distribution is normal, the skewness of the gradient is usually close to 0; if there are a large number of incorrect labels in the local data (for example, a system bug incorrectly marks a large number of normal transactions as fraud), the gradient distribution will deviate significantly from the symmetric shape, resulting in abnormal skewness, which provides a basis for subsequent anomaly detection.

[0036] A13. The calculated mean, variance, and skewness are concatenated into a feature vector, which serves as the gradient fingerprint of the participant's model update for this time. The gradient fingerprint only reflects the global statistical distribution of the local gradient update and does not contain specific sample-level information.

[0037] In this step, μ and σ 2 The three statistics γ are concatenated into a three-dimensional vector [μ, σ]. 2 [γ] serves as the gradient fingerprint. This fingerprint can be regarded as a behavioral profile of the participant's contribution in this round of training. It only abstractly summarizes the macroscopic statistical characteristics of the gradient and cannot restore the gradient value or features of any single sample. Therefore, it has natural privacy protection properties.

[0038] S3. Perform cluster analysis based on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation.

[0039] In this step, after receiving the gradient fingerprints from each participant, the central aggregation server does not rush to aggregate model parameters. Instead, it first maps all fingerprints to a multi-dimensional feature space for auditing. The core of this auditing mechanism is that although the data of normal participants comes from different subsidiaries, it represents genuine customer behavior, and its gradient update distribution has inherent statistical consistency, forming dense clusters in the feature space. However, the gradient statistical characteristics of participants whose data has been poisoned or that have anomalies will deviate significantly from normal clusters, becoming isolated points. For example, if a property insurance subsidiary experiences a system upgrade that causes a reversal error in the status labels of some claims records, the skewness component in its locally uploaded gradient fingerprint will change drastically, appearing as an outlier node far from the main cluster in cluster analysis. The system automatically marks the model update parameters corresponding to this node as abnormal and excludes it, ensuring that it does not enter the subsequent aggregation process, thereby preventing data quality problems in one subsidiary from spreading to the entire group's anti-fraud model.

[0040] In a specific embodiment, such as Figure 5 As shown, step S3 specifically includes steps S31-S33.

[0041] S31. Map the gradient fingerprint feature vector corresponding to each participant to a coordinate point in a multi-dimensional feature space.

[0042] In this step, the three-dimensional gradient fingerprint of each participant is directly used as its coordinates in three-dimensional space, or mapped to a higher-dimensional space by introducing higher-order statistics. In one embodiment of the invention, a three-dimensional feature vector [μ, σ] is used. 2 , γ] directly correspond to the x, y, z coordinates in three-dimensional space.

[0043] S32. Use an unsupervised clustering algorithm to divide all coordinate points in the multidimensional feature space into clusters, and determine the cluster with the most coordinate points as the main cluster.

[0044] In this step, clustering algorithms such as DBSCAN or density-based clustering are used to group all coordinate points. There's no need to pre-specify the number of clusters; the algorithm automatically groups density-connected points into the same cluster based on the Euclidean distance between them. The cluster with the most coordinate points is the master cluster, representing the normal consensus reached by the majority of participants. Taking financial company A as an example, assuming there are 5 participants, if the fingerprints of bank A, bank B, property insurance company A, and life insurance company C are closely adjacent, forming a cluster of 4 points, then this cluster is determined as the master cluster.

[0045] S33. Calculate the distance from each coordinate point to the cluster center of the main cluster, mark the participants corresponding to the coordinate points whose distance exceeds a preset distance threshold as outliers, and exclude the model update parameters of the outliers.

[0046] In this step, the centroid of the main cluster is calculated, and then the Euclidean distance from each participant's coordinate point to that centroid is calculated. The preset distance threshold can be dynamically set based on the distance distribution of normal nodes in historical training rounds, for example, three times the historical average distance. For participants whose distance exceeds the threshold, such as the aforementioned property insurance subsidiary with an abnormal label, their distance is far beyond the threshold, and they are marked as outliers. All model update parameters uploaded by them in this round are directly discarded and do not participate in aggregation, thus achieving accurate blocking without decrypting the original parameters.

[0047] S4. Sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and use the pairing matrix to perform inverse permutation on the summation result to obtain a global aggregated model weight that does not expose the original model parameters of any participant.

[0048] In this step, only the obfuscation model update parameters of the audited clean participants are used for aggregation. Since the dynamic random permutation matrix P is a linear transformation, the obfuscation parameters of each participant can be considered as the original parameters represented in the P coordinate system; therefore, vector addition can be performed directly within the obfuscation domain. After the summation is complete, the central server calls the pairing matrix P corresponding to P. -1 Performing an inverse permutation on the aggregation result is equivalent to transforming the aggregated coordinates back to the standard coordinate system, restoring the global model weight update in the real space. The entire process is equivalent to completing secure multi-party computation in an encrypted state. At any time, the central server cannot know the original model parameters of any single participant, but can only obtain the overall update after aggregation.

[0049] In a specific embodiment, such as Figure 6 As shown, step S4 specifically includes steps S41-S42.

[0050] S41. Under the representation of the obfuscated model update parameters without inverse permutation, directly perform addition operation on the obfuscated parameters uploaded by each participant after excluding the outlier node to obtain the aggregated obfuscated parameters.

[0051] In this step, assuming that after auditing, the remaining participants are Bank A, Bank B, and Life Insurance Company C, the central server directly adds their respective uploaded obfuscation model update parameter vectors W_A', W_B', and W_C' to obtain the aggregate obfuscation parameter W_sum' = W_A' + W_B' + W_C'. This addition operation is performed in the obfuscation domain, so even if an attacker obtains W_sum', they cannot interpret its meaning.

[0052] S42. Call the pairing matrix stored only in the central aggregation server, perform inverse permutation on the aggregation obfuscation parameters, and restore the global model update aggregation result in the real space, so that no plaintext decryption operation is performed on the original model parameters of a single participant during the entire aggregation and inverse permutation process.

[0053] In this step, the central server retrieves the pairing matrix P from the hardware security module. -1 Calculate W_global = P -1 • W_sum'. Based on the linear property of matrix operations, W_global = P -1 (P · W_A + P · W_B + P · W_C) = W_A + W_B + W_C, which is exactly equal to the true sum of the original model update. Throughout the process, the original parameter W_i of one party never appears in plaintext on the central server, achieving the security goal of ensuring that the original parameter does not leave the domain and the aggregation result is recoverable.

[0054] S5. Based on the training stage of the global model, adaptively inject differential privacy noise into the weights of the global aggregate model, and distribute the noise-injected global model to each participant.

[0055] In this step, to further defend against potential differential attacks, the central server injects random noise conforming to a Laplace or Gaussian distribution into the aggregated global model weights. The amplitude of the noise is not fixed but adaptively correlated with the training process. In the early stages of training the anti-fraud model, when the model weights are not yet stable, injecting larger noise can strongly protect the privacy of sensitive features (such as annual income and asset size) in the data of each participant. As the model gradually converges, smaller noise is injected in the later stages to avoid affecting the fraud detection accuracy of the model, thus achieving a dynamic balance between privacy and accuracy.

[0056] In a specific embodiment, such as Figure 7 As shown, step S5 specifically includes steps S51-S52.

[0057] S51. For feature dimensions in the global model with sensitivity higher than the preset level, determine the corresponding basic noise level.

[0058] In this step, the sensitivity is pre-assessed based on the degree of impact of the feature dimension on the global model output. For example, in the anti-fraud model, a customer's annual income and the largest historical claim amount are assessed as highly sensitive features, and their corresponding weight dimensions are assigned a higher base noise level σ0; while low-sensitivity features such as transaction periods are assigned a smaller σ0, in order to reduce unnecessary accuracy loss on non-sensitive features while protecting core privacy.

[0059] S52. Based on the current training iteration number, dynamically calculate the noise attenuation coefficient so that the actual injected noise level decreases exponentially with the increase of the training iteration number. This allows for the injection of larger noise into the global model in the early stage of training to enhance privacy protection, and the injection of smaller noise into the global model in the later stage of training to ensure the accuracy of anti-fraud identification.

[0060] In this step, the actual injected noise standard deviation component is σ(t) = σ0 · e^{-αt}, where t is the current training iteration number and α is the decay rate control factor. For example, if the total training iterations are set to 100, the noise level is close to σ0 at t=1, providing strong privacy protection; by t=90, the noise has decayed to a minimum value, hardly affecting the model's final AUC index, thus ensuring the high accuracy of the group-level anti-fraud model.

[0061] S6. Based on the gradient fingerprint distribution characteristics of each participant in the continuous training process and the frequency of each participant not being identified as an outlier node and participating in aggregation, the contribution value of each participant to the final anti-fraud model is quantitatively calculated, and a data value audit report is generated accordingly.

[0062] In this step, contribution is evaluated using historical audit records after training. For a given participant, the more consistently its gradient fingerprint aligns with the main cluster across multiple training rounds, and the fewer times it is excluded, the higher the quality of the data it provides and the stronger its synergy with the global consensus, thus earning a higher contribution score. Financial company A can then use this contribution report to scientifically quantify the value and allocate costs of its subsidiaries' data assets within the group, providing a reliable technical basis for the cross-institutional circulation and settlement of data elements.

[0063] In summary, this application's embodiments achieve a synergistic improvement in privacy protection and model purity in federated anti-fraud modeling by constructing a closed-loop mechanism. By using a dynamic random permutation matrix to topologically obfuscate the intermediate layer weights of the participating parties' neural networks, model parameters outside the local network are rendered semantically meaningless, fundamentally cutting off the data basis for member inference attacks. By introducing gradient fingerprints extracted locally by the participating parties based on the original gradients and uploaded along with the obfuscated parameters, the central server can complete clustering audits before aggregation without decrypting the original data. Based on objective deviation metrics, it automatically identifies and accurately removes outliers that have caused data poisoning or anomalies, ensuring that only normal contributions enter the aggregation process. During aggregation, a pairing matrix is ​​used to directly perform additive aggregation and inverse permutation within the obfuscation domain, achieving secure global weight synthesis without exposing the original parameters and eliminating cross-agency compliance and trust barriers. Simultaneously, differential privacy noise is adaptively injected and dynamically decayed during the training phase, strengthening privacy protection in the early stages and ensuring model recognition accuracy in the later stages, achieving a dynamic optimal balance between privacy and usability.

[0064] like Figure 8 As shown, this embodiment of the invention also provides a cross-organizational anti-fraud modeling device, comprising: The permutation matrix management module 10 is used to generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. The fingerprint receiving module 20 is used to receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training. The fingerprint audit module 30 is used to perform cluster analysis based on all received gradient fingerprints, identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation. The aggregation recovery module 40 is used to sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and to perform inverse permutation processing on the summation result using the pairing matrix to obtain a global aggregated model weight that does not expose the original model parameters of any participant. The noise control module 50 is used to adaptively inject differential privacy noise into the weights of the global aggregate model according to the training stage of the global model, and distribute the noise-injected global model to each participant.

[0065] In a specific embodiment, the permutation matrix management module 10 is specifically used for: Using a preset random seed, generate an invertible dynamic random permutation matrix and its pairing matrix; The dynamic random permutation matrix is ​​sent to the corresponding participants through an encrypted channel, and the update and redistribution of the dynamic random permutation matrix are triggered according to a preset time period or training round.

[0066] In a specific embodiment, the aggregation recovery module 40 is specifically used for: Under the representation of the obfuscated model update parameters without inverse permutation, the obfuscated parameters uploaded by each participant remaining after excluding the outlier node are directly added together to obtain the aggregated obfuscated parameters. The pairing matrix, which is stored only in the central aggregation server, is invoked to perform an inverse permutation on the aggregation obfuscation parameters, restoring the global model update aggregation result in the real space. This ensures that no plaintext decryption operation is performed on the original model parameters of any individual participant during the entire aggregation and inverse permutation process.

[0067] In a specific embodiment, a gradient fingerprint generation module is also included, specifically used for: Obtain the original model update gradients generated during local training by the participants; Calculate the mean, variance, and skewness of the gradient update for the original model; The calculated mean, variance, and skewness are concatenated into a feature vector, which serves as the gradient fingerprint of the participant's model update for this time. The gradient fingerprint only reflects the global statistical distribution of the local gradient update and does not contain specific sample-level information.

[0068] In a specific embodiment, the fingerprint audit module 30 is specifically used for: Map the gradient fingerprint feature vector corresponding to each participant to a coordinate point in a multi-dimensional feature space; An unsupervised clustering algorithm is used to divide all coordinate points in the multidimensional feature space into clusters, and the cluster with the most coordinate points is determined as the main cluster. Calculate the distance from each coordinate point to the cluster center of the main cluster, mark the participants corresponding to coordinate points whose distance exceeds a preset distance threshold as outliers, and exclude the model update parameters of the outliers.

[0069] In a specific embodiment, the noise control module 50 is specifically used for: For feature dimensions in the global model with sensitivity higher than a preset level, determine the corresponding basic noise level; Based on the current training iteration number, the noise attenuation coefficient is dynamically calculated so that the actual amount of injected noise decreases exponentially with the increase of the training iteration number. This allows for the injection of larger noise into the global model in the early stage of training to enhance privacy protection, and the injection of smaller noise into the global model in the later stage of training to ensure the accuracy of anti-fraud identification.

[0070] In a specific embodiment, an audit report generation module is also included, used for: Based on the gradient fingerprint distribution characteristics of each participant during multiple rounds of training, and the frequency with which each participant is not identified as an outlier and participates in aggregation, the contribution value of each participant to the final anti-fraud model is quantitatively calculated, and a data value audit report is generated accordingly.

[0071] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned cross-organizational anti-fraud modeling device and its various units can be referred to the corresponding descriptions in the foregoing method embodiments. For the sake of convenience and brevity, these details will not be repeated here.

[0072] The aforementioned cross-agency anti-fraud modeling apparatus can be implemented as a computer program, which can, for example... Figure 9 It runs on the computer device shown.

[0073] Please see Figure 9 , Figure 9 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0074] See Figure 9The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0075] The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, it causes the processor 502 to execute a cross-agency anti-fraud modeling method.

[0076] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0077] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a cross-agency anti-fraud modeling method.

[0078] This network interface 505 is used for network communication with other devices. Those skilled in the art will understand that... Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0079] The processor 502 is used to run a computer program 5032 stored in the memory to perform the following steps: S1. Generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. S2. Receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training. S3. Perform cluster analysis based on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation. S4. Sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and use the pairing matrix to perform inverse permutation on the summation result to obtain a global aggregated model weight that does not expose the original model parameters of any participant. S5. Based on the training stage of the global model, adaptively inject differential privacy noise into the weights of the global aggregate model, and distribute the noise-injected global model to each participant.

[0080] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0081] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0082] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform the following steps: S1. Generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. S2. Receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training. S3. Perform cluster analysis based on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation. S4. Sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and use the pairing matrix to perform inverse permutation on the summation result to obtain a global aggregated model weight that does not expose the original model parameters of any participant. S5. Based on the training stage of the global model, adaptively inject differential privacy noise into the weights of the global aggregate model, and distribute the noise-injected global model to each participant.

[0083] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code.

[0084] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0085] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0086] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0087] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0088] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0089] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0090] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0091] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A cross-institutional anti-fraud modeling method, characterized in that, Applied to the central aggregation server, including: Generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. Receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant, wherein the gradient fingerprints are obtained by the participant through statistical feature extraction based on the original model update gradients generated by its local training. Cluster analysis is performed on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and the model update parameters corresponding to the outlier nodes are excluded from subsequent aggregation. The obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes are summed, and the summation result is inversely permuted using the pairing matrix to obtain a global aggregated model weight that does not expose the original model parameters of any participant. Depending on the training stage of the global model, differential privacy noise is adaptively injected into the weights of the global aggregate model, and the global model with injected noise is then distributed to each participant.

2. The cross-institutional anti-fraud modeling method according to claim 1, characterized in that, The process of generating a dynamic random permutation matrix and a pairing matrix with an inverse transformation relationship to the dynamic random permutation matrix, and distributing the dynamic random permutation matrix to each participant, includes: Using a preset random seed, generate an invertible dynamic random permutation matrix and its pairing matrix; The dynamic random permutation matrix is ​​sent to the corresponding participants through an encrypted channel, and the update and redistribution of the dynamic random permutation matrix are triggered according to a preset time period or training round.

3. The cross-institutional anti-fraud modeling method according to claim 1, characterized in that, The process of summing the obfuscated model update parameters uploaded by the remaining participants after excluding the outliers, and then performing an inverse permutation on the summation result using the pairing matrix to obtain a globally aggregated model weight that does not expose the original model parameters of any participant, includes: In the unrepresented obfuscated model update parameters, the obfuscated parameters uploaded by each participant after excluding the outlier node are directly added together to obtain the aggregated obfuscated parameters. The pairing matrix, which is stored only in the central aggregation server, is invoked to perform an inverse permutation on the aggregation obfuscation parameters, restoring the global model update aggregation result in the real space. This ensures that no plaintext decryption operation is performed on the original model parameters of any individual participant during the entire aggregation and inverse permutation process.

4. The cross-institutional anti-fraud modeling method according to claim 1, characterized in that, The gradient fingerprint is generated by the participating parties through the following steps: Obtain the original model update gradients generated during local training by the participants; Calculate the mean, variance, and skewness of the gradient update for the original model; The calculated mean, variance, and skewness are concatenated into a feature vector, which serves as the gradient fingerprint of the participant's model update for this time. The gradient fingerprint only reflects the global statistical distribution of the local gradient update and does not contain specific sample-level information.

5. The cross-institutional anti-fraud modeling method according to claim 4, characterized in that, The step of performing cluster analysis based on all received gradient fingerprints to identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by a degree exceeding a preset threshold, and excluding the model update parameters corresponding to the outlier nodes from subsequent aggregation, includes: Map the gradient fingerprint feature vector corresponding to each participant to a coordinate point in a multi-dimensional feature space; An unsupervised clustering algorithm is used to divide all coordinate points in the multidimensional feature space into clusters, and the cluster with the most coordinate points is determined as the main cluster. Calculate the distance from each coordinate point to the cluster center of the main cluster, mark the participants corresponding to coordinate points whose distance exceeds a preset distance threshold as outliers, and exclude the model update parameters of the outliers.

6. The cross-institutional anti-fraud modeling method according to claim 1, characterized in that, The step of adaptively injecting differential privacy noise into the weights of the global aggregation model according to the training stage of the global model includes: For feature dimensions in the global model with sensitivity higher than a preset level, determine the corresponding basic noise level; Based on the current training iteration number, the noise attenuation coefficient is dynamically calculated so that the actual injected noise level decreases exponentially with the increase of the training iteration number. This allows for the injection of larger noise into the global model in the early stage of training to enhance privacy protection, and the injection of smaller noise into the global model in the later stage of training to ensure the accuracy of anti-fraud identification.

7. The cross-agency anti-fraud modeling method according to any one of claims 1 to 6, characterized in that, After distributing the noisy global model to all participants, the following steps are also included: Based on the gradient fingerprint distribution characteristics of each participant during multiple rounds of training, and the frequency with which each participant is not identified as an outlier and participates in aggregation, the contribution value of each participant to the final anti-fraud model is quantitatively calculated, and a data value audit report is generated accordingly.

8. A cross-institutional anti-fraud modeling device, characterized in that, include: The permutation matrix management module is used to generate a dynamic random permutation matrix and a pairing matrix that has an inverse transformation relationship with the dynamic random permutation matrix, and distribute the dynamic random permutation matrix to each participant so that each participant can perform topological confusion on the intermediate layer weights of the locally trained neural network. The fingerprint receiving module is used to receive the obfuscated model update parameters and corresponding gradient fingerprints uploaded by each participant. The gradient fingerprint is obtained by the participant through statistical feature extraction based on the original model update gradient generated by its local training. The fingerprint audit module is used to perform cluster analysis based on all received gradient fingerprints, identify outlier nodes whose distribution in the multidimensional feature space deviates from at least one cluster formed by other participants by more than a preset threshold, and exclude the model update parameters corresponding to the outlier nodes from subsequent aggregation. The aggregation recovery module is used to sum the obfuscated model update parameters uploaded by the remaining participants after excluding the outlier nodes, and to perform inverse permutation processing on the summation result using the pairing matrix to obtain a global aggregated model weight that does not expose the original model parameters of any participant. The noise control module is used to adaptively inject differential privacy noise into the weights of the global aggregate model according to the training stage of the global model, and distribute the noise-injected global model to each participant.

9. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the cross-agency anti-fraud modeling method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the cross-agency anti-fraud modeling method as described in any one of claims 1 to 7.

Images