A data security fence method and system based on source contribution and combination recovery

Abstract

The application discloses a data security fence method and system based on source contribution and combination recovery, comprising collecting processing events in an artificial intelligence processing link, establishing data version nodes, processing event nodes and time sequence blood relationship, and allocating root source identification for source data units; generating event condition propagation operators based on sensitive data knowledge graphs, taking root source identification, sensitive fact identification and propagation path identification as propagation states, and recursively calculating candidate source contributions; through source contribution account books, idempotent merging is performed on repeated execution records, and homologous path deduplication is performed based on the observable feature coincidence degree of evidence union; for multiple inputs actually entering the same aggregation context, newly added sensitive relationships formed jointly are identified and combination recovery hyperedges are generated; risks are calculated according to direct sensitivity, inherited sensitivity, combination contribution and exposure factors, and fence actions are selected based on evidence subgraphs and residual risks.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence data security and computer security technology, and in particular to a data security fence method and system based on source contribution and combined recovery. Background Technology

[0002] With the development of large language models, retrieval enhancement generation, and intelligent agent technologies, data needs to go through multiple stages, including import, parsing, slicing, vectorization, retrieval, prompt word assembly, model inference, tool invocation, cache reading and writing, and network transmission. The same data may change in content, representation, storage location, and access scope during processing. Although the derived data no longer retains the complete expression of the original data, it may still inherit or re-express sensitive facts.

[0003] Existing sensitive data detection schemes typically perform keyword, format, entity, or semantic recognition on the current input or output, making it difficult to continuously identify and attribute the source of sensitive data after rewriting, summarizing, vectorizing, or model generation. Existing data lineage schemes usually only record the data flow direction, lacking information such as specific processing events, local input-output mappings, model versions, and permission boundaries, making it difficult to calculate the propagation contribution of sensitive facts in different processing stages.

[0004] Furthermore, model retries, cache reuse, overlapping slicing, and duplicate recall may cause the same sensitive fact to reach the same output along multiple similar paths, resulting in duplicate risk calculations. Multiple individual low-risk data fragments may also combine in the same prompt word or aggregation context to form new sensitive relationships, causing combined risks to be missed. Existing fences usually adopt overall allowance or overall blockage, making it difficult to locate the specific source of risk and select precise handling measures such as local desensitization, fragment removal, vector isolation, or cache cleanup. Summary of the Invention

[0005] To address these issues, this invention provides a data security fence method and system based on source contribution and combined recovery, which solves the above problems.

[0006] In a first aspect, the present invention provides a data security fence method based on source contribution and combined recovery, the method comprising the following steps:

[0007] S1. Collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes, and the temporal lineage relationship between the data version nodes and the processing event nodes, and assign root source identifiers to source data units;

[0008] S2. Establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event condition propagation operators for processing events and sensitive categories based on the mapping relationship between the sensitive data knowledge graph and the data version node and processing event node.

[0009] S3. Using the root source identifier, sensitive fact identifier, and propagation path identifier as the propagation state, starting from the fact-level direct sensitivity, the candidate source contribution is recursively calculated event by event along the temporal lineage using the event conditional propagation operator.

[0010] S4. Write the candidate source contributions into the source contribution ledger. For repeated execution records with the same logical event idempotency key, perform idempotency merging. For multiple propagation paths with different logical event idempotency keys but the same root source identifier and sensitive fact identifier, perform homologous path deduplication based on the observable feature overlap between the evidence union formed by the current propagation path and the previously processed propagation paths, and fuse the deduplicated contributions to obtain the ordinary propagation contribution.

[0011] S5. For an aggregation processing event with multiple input data versions, determine the set of inputs that actually enter the same aggregation context, and determine whether the input set jointly forms a new sensitive relationship that is not completely contained by any single input data version; if the preset combination judgment condition is met, generate a valid combination recovery hyperedge and determine the combination contribution; if the preset combination judgment condition is not met, do not generate a valid combination recovery hyperedge and retain the ordinary propagation contribution.

[0012] S6. Calculate the risk of the target data version based on the direct sensitivity, inherited sensitivity, combined contribution, and exposure factors; collect direct identification evidence, general propagation contribution, and effective combination recovery hyperedge from the target data version in reverse; select the evidence subgraph based on the marginal contribution of candidate evidence items; simulate the remaining risk after the candidate fence action is implemented, and execute the candidate fence action that meets the safety conditions and has the lowest overall disposal cost.

[0013] Specifically, the processing event record includes multiple items from the following: event identifier, event type, input data version identifier set, output data version identifier set, execution component, actual parameter summary, model or algorithm version, execution subject, execution time, input / output local mapping, and call chain identifier; the logical event idempotency key is generated based on the tenant identifier, session identifier, parent call identifier, event type, sorted input data version identifier set, model or algorithm version, and parameter summary. The retry sequence number, physical execution instance identifier, and execution time are not involved in the generation of the logical event idempotency key.

[0014] Specifically, one or more of the following processes are performed on the data version node: format rule matching, sensitive entity identification, sensitive relationship identification, and semantic context identification, to obtain the direct sensitivity. Sensitive fact identifiers and direct identification evidence are generated for the identified entities, attributes, or relationships. The event conditional propagation operator is instantiated based on two or more of the following: event type, actual parameters, model or algorithm version, input / output local mapping, execution subject, permission status, and network boundary. The candidate source contribution is recursively calculated based on the source contribution of the previous propagation layer, the event conditional propagation operator, and the event evidence confidence score. The event evidence confidence score is determined based on one or more of the following: source identifier completeness, input / output local mapping completeness, call chain completeness, and third-party component association evidence.

[0015] Specifically, for multiple propagation paths corresponding to the same target data version, the same sensitive category, the same root source identifier, and the same sensitive fact identifier, they are sorted according to a preset order of candidate source contribution from high to low, event evidence confidence from high to low, propagation path length from short to long, and propagation path identifier, to form a deterministic and stable order. For the i-th propagation path after sorting, its overlap and independent increment relative to the evidence union formed by previously processed propagation paths are calculated. The calculation formula is as follows:

[0016] ;

[0017] Where x represents the evidentiary feature, O i α is the set of evidence features that can be actually computed or mapped between the current propagation path and the union of evidence formed by previously processed propagation paths. x For the weight of the evidence features, r x,i The overlap of the current propagation path with the corresponding evidence features is defined as follows: the evidence features include one or more of event edge features, root source location features, and cached source features; evidence features that are missing or cannot be mapped to the same coordinate system are not included in the overlap calculation; when the evidence feature set is empty or the evidence coverage is insufficient, the candidate source contribution is not deducted based on the overlap, and the corresponding propagation path is marked as pending review.

[0018] Specifically, the aggregation processing events include prompt word assembly events, tool result summary events, cross-round memory splicing events, or data aggregation events. Based on the event logs and input-output local mappings of the aggregation processing events, it is determined whether the input data versions actually enter the same aggregation context, and only input data versions with event log evidence and input-output local mapping evidence are added to the input set. The preset combination judgment conditions include: the single input risk of each input data version in the input set without including combination contribution is lower than a preset single input threshold; the input set matches the sensitive relation template; the candidate object set before combination is not empty, and the number of candidates in the candidate object set after combination is reduced or the candidate constraints are enhanced compared to the candidate object set before combination; and the sensitive relation jointly supported by the input set is not completely contained by any single input data version. When the candidate object set before combination is empty, or the candidate object set after combination undergoes invalid expansion relative to the candidate object set before combination, no valid combination recovery hyperedge is generated, and the corresponding combination contribution is determined to be zero.

[0019] Specifically, the inherited sensitivity is the sensitivity obtained after sequentially performing logical event idempotent merging, deduplication of propagation paths corresponding to the same root source identifier and sensitive fact identifier, and contribution group fusion for candidate source contribution records of the same target data version and the same sensitive category, excluding direct sensitivity and the combined contribution; the exposure factors include two or more of the following: processing stage, destination, receiving subject, operation type, model capability, and permission status, obtained according to one or more of the following: processing event record, network boundary record, identity authentication record, model capability configuration, and permission verification record; the candidate evidence items include one or more of the following: direct identification evidence that can be independently removed and used to recalculate sensitivity or risk, ordinary propagation contribution groups, and effective combined recovery hyperedges; the interpretation coverage of the evidence subgraph is determined using the same sensitive category weight normalization method and bounded fusion method as the risk calculation.

[0020] Specifically, the candidate fence actions include one or more of the following: local field desensitization, removal and regeneration of prompt word input fragments, isolation of vector entries, clearing cached copies, revoking sharing permissions, denying tool calls, and blocking outbound transmission. When simulating candidate fence actions, the affected ordinary propagation contributions or effective combination recovery hyperedges are marked as invalid, and the affected downstream derived data versions are determined along the temporal lineage. The comprehensive processing cost is determined based on the information loss, additional latency, and scope of impact caused by the candidate fence actions. When the sensitive identification rules, event conditional propagation operators, authorization status, or the input set of aggregated processing events change, the affected data versions and their downstream derived data versions are incrementally recalculated based on the reverse index established by the source contribution ledger and the effective combination recovery hyperedge.

[0021] Secondly, the present invention provides a data security fence system based on source contribution and combined recovery, comprising:

[0022] The event and lineage processing module is used to collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes and their temporal lineage relationships, and generate logical event idempotent keys;

[0023] The Sensitive Data Identification and Propagation Module is used to build a knowledge graph of sensitive data, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event conditional propagation operators and candidate source contributions.

[0024] The source contribution ledger module is used to perform idempotent merging of repeated execution records with the same idempotent key for logical events, and to perform deduplication of the same source path based on the degree of overlap of observable features between the propagation path and the evidence union formed by the previously processed propagation path;

[0025] The combined recovery module is used to determine the input set that actually enters the same aggregation context, identify the newly added sensitive relationship formed by the input set that is not fully contained by any single input data version, and generate effective combined recovery superedges and combined contributions.

[0026] The risk and evidence processing module is used to calculate risk based on direct sensitivity, inherited sensitivity, combined contribution, and exposure factors, and to generate evidence subgraphs based on the marginal contribution of candidate evidence items.

[0027] The fence decision module is used to simulate the remaining risks after the implementation of candidate fence actions, and to execute the candidate fence action that satisfies the safety conditions for the remaining risks and has the lowest overall disposal cost.

[0028] Thirdly, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the data security fence method based on source contribution and combined recovery according to any embodiment of the present invention.

[0029] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the steps of the data security fence method based on source contribution and combined recovery according to any embodiment of the present invention.

[0030] The data security fence method and system based on source contribution and combined recovery in this application have the following beneficial effects:

[0031] 1. Based on the knowledge graph of sensitive data and the temporal lineage, an event conditional propagation operator is generated, and the root source, sensitive facts and propagation path are used as the source contribution for recursive state calculation. This enables continuous tracking of the sensitivity inheritance and changes of data in the artificial intelligence processing chain.

[0032] 2. By using the source contribution ledger to perform idempotent merging of repeated executions of the same logical events, and comparing the evidence union formed by the same source propagation path with the previous path, no unfounded deductions are made when there are no observable features, thereby reducing the risk of duplicate calculations caused by retries, cache reuse, and overlapping slices.

[0033] 3. Only multiple inputs that actually enter the same aggregation context are combined for judgment. By identifying newly added sensitive relations that are not fully contained by any single input, combined recovery superedges are generated. This can discover the combined recovery risk formed by multiple low-risk inputs, while retaining the ordinary propagation contribution of each input.

[0034] 4. By collecting direct identification evidence, general propagation contribution, and effective combination to recover the hyperedge based on the target data version, and by recalculating the risk after removing candidate evidence items to select the evidence subgraph, the interpretability and verifiability of the risk conclusions can be improved.

[0035] 5. By simulating the remaining risks after the implementation of candidate fence actions, select fence actions that meet the safety conditions and have a lower overall handling cost, and support incremental recalculation of affected downstream derived data, thereby achieving precise handling of sensitive data and reducing the business impact caused by overall blockage. Attached Figure Description

[0036] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A flowchart illustrating a data security fence method based on source contribution and combined recovery, provided in an embodiment of the present invention;

[0038] Figure 2 This is a structural block diagram of a data security fence system based on source contribution and combined recovery, provided in an embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Example 1: A data security fence method based on source contribution and combined recovery.

[0042] Please see Figure 1 The diagram shows a flowchart of a data security fence method based on source contribution and combined recovery according to this application.

[0043] In one embodiment, step S1 is performed to collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes, and the temporal lineage relationship between the data version nodes and the processing event nodes, and assign root source identifiers to source data units.

[0044] Specifically, the event and lineage processing module collects and processes event records through software development kit (SDK) tracking points, application programming interface (API) gateways, service meshes, message buses, database audit interfaces, vector database interfaces, caching system interfaces, or proxy layers.

[0045] The processing event record includes multiple items from the following: event identifier, event type, set of input data version identifiers, set of output data version identifiers, execution component, actual parameter summary, model or algorithm version, execution subject, execution time, input / output local mapping, call chain identifier, session identifier, parent call identifier, tenant identifier, network boundary, permission status, and aggregation context identifier.

[0046] The event type is used to represent an actual processing action, rather than just an abstract processing category. For example, an OCR process performed on a PDF file constitutes a specific OCR processing event; similarly, a prompt word assembly performed on a batch of search segments constitutes a specific prompt word assembly event.

[0047] For logs generated by different components, the event and lineage processing module converts them into a unified format according to a preset field mapping table, forming standardized event records.

[0048] The processing of event e includes at least the event identifier, event type, set of input nodes, set of output nodes, execution component, model or algorithm version, parameter summary, execution subject, start and end times, execution status, input-output local mapping, rule version, and attribution evidence.

[0049] The system establishes data version nodes for original files, database records, fields, image regions, audio and video time segments, text segments, vector entries, prompt word segments, model output fact units, and cached copies.

[0050] A data version node includes at least the following: data unit identifier, data version identifier, parent data unit identifier, root source identifier, data content or semantic fingerprint, data location, data representation type, processing stage, generation time, permission scope, network boundary, direct sensitivity, inherited sensitivity, and risk level.

[0051] When data content, representation, storage location, access permissions, storage boundaries, or network boundaries change, the original data version node is not overwritten. Instead, a new data version node is generated, and a parent-child relationship is established between the old and new versions. For example, the original file node of a PDF file might be v0, the table area on page 12 of the PDF might be v1, the OCR text might be v2, and the text slice might be v... 3a and v 3b The vector entries are v 4a and v 4b The prompt word fragment is v5, and the model output fact unit is v6. The above nodes represent different versions of data, rather than simple labels for the same data object.

[0052] For data units imported or acquired for the first time, the system assigns a root source identifier. The root source identifier is used to indicate the original source of the data.

[0053] In one implementation, the root source identifier can be obtained by hashing the tenant identifier, source data object identifier, source data fingerprint, and source location after normalization and concatenation.

[0054] The source location can be a file path, page number, character range, field identifier, image coordinates, audio / video time range, or database record identifier.

[0055] Derived data versions obtained from the same source data unit through OCR, slicing, vectorization, retrieval, prompt word assembly, or model generation inherit the root source identifier of that source data unit.

[0056] Execute step S2 to establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event conditional propagation operators for processing events and sensitive categories based on the mapping relationship between the sensitive data knowledge graph and the data version node and processing event node.

[0057] Specifically, one or more of the following processes are performed on the data version node: format rule matching, sensitive entity identification, sensitive relationship identification, and semantic context identification, to obtain the direct sensitivity, and to generate the sensitive fact identifier and direct identification evidence for the identified entities, attributes, or relationships.

[0058] The event conditional propagation operator is instantiated based on two or more of the following: event type, actual parameters, model or algorithm version, input-output local mapping, execution subject, permission status, and network boundary.

[0059] The sensitive data identification and propagation module establishes a sensitive data knowledge graph G. K The sensitive data knowledge graph includes at least: sensitive category nodes, sensitive feature nodes, sensitive fact nodes, entity nodes, attribute nodes, sensitive relationship template nodes, processing behavior nodes, business scenario nodes, execution subject and permission nodes, network boundary nodes, propagation parameter nodes, and fence action nodes.

[0060] Sensitive categories can include personal information, trade secrets, important data, project budgets, undisclosed plans, identity verification information, model asset data, and other organization-defined sensitive categories.

[0061] Sensitive relationship templates are used to describe the relationships between multiple entities, attributes, or facts. For example: project is associated with the person in charge; project is associated with the budget; project, person in charge, and budget are all associated together.

[0062] The system performs one or more of the following processes on the data version node: format rule matching, sensitive entity identification, sensitive relationship identification, and semantic context identification, to obtain the direct sensitivity of the data version node.

[0063] In one implementation, the system calculates format feature scores for each sensitive category k. Entity feature score Relationship Feature Scoring and semantic context score :

[0064] ;

[0065] ;

[0066] ;

[0067] ;

[0068] In the formula, M f (v,k) represents the set of format rules that were matched. For the reliability of format rules, For format matching completeness; M e (v,k) represents the set of sensitive entities that were hit. Confidence level for entity identification The strength of the association between the entity and the sensitive category; T k Let m be the set of relation templates for sensitive category k. t p represents the relation template matching degree. t,i p represents the confidence level for identifying the entity corresponding to the relation slot. topic p inten t and p scope These are topic relevance, processing intent sensitivity, and content scope sensitivity.

[0069] Direct sensitivity can be calculated as follows:

[0070] ;

[0071] In the formula, This indicates the direct sensitivity of data version v to the sensitive category k.

[0072] Sensitive fact identifiers are used to represent specific entities, attributes, or relational facts that have been identified. For example, in the text "The Galaxy Project is managed by Zhang, with a budget of 32 million yuan," the following can be generated: project fact, person in charge fact, budget fact, project-person in charge relationship fact, project-budget relationship fact, and project-person in charge joint relationship fact.

[0073] In one implementation, the sensitive fact identifier is generated after normalizing the fact type, entity normalization result, attribute normalization result, relation type, root source identifier, and source location. For scenarios where it is not suitable to directly store the original sensitive content, the sensitive fact identifier can be generated after encrypting, de-identifying, or irreversibly summarizing the entity value or attribute value.

[0074] Directly identified evidence is used to prove the existence of corresponding sensitive facts in a data version. Directly identified evidence can include at least: a matched rule identifier, a matched character range, a matched field identifier, an identified entity, and local context. Directly identified evidence is associated with and stored in the data version node and is collected in reverse during the subsequent evidence subgraph generation process.

[0075] Execute step S3, using the root source identifier, sensitive fact identifier, and propagation path identifier as the propagation state, starting from the fact-level direct sensitivity, and recursively calculate the candidate source contribution event by event along the temporal lineage using the event conditional propagation operator.

[0076] The candidate source contribution is recursively calculated based on the source contribution of the previous propagation layer, the event conditional propagation operator, and the event evidence confidence. The event evidence confidence is determined based on one or more of the following: source identifier completeness, input-output local mapping completeness, call chain completeness, and third-party component association evidence.

[0077] Specifically, propagation path identifiers are used to distinguish propagation paths formed by different sequences of events from the same source and the same sensitive fact.

[0078] In one implementation, the propagation path identifier is generated based on the root source identifier, the sensitive fact identifier, the sequence of processing event identifiers arranged in chronological order, and the data version identifier sequence.

[0079] Physical retries of the same logical processing event do not form new logical propagation paths independently. A new propagation path identifier is only formed when there is an actual change in the input data version, the sequence of processing events, or the local mapping relationship.

[0080] Establishing an artificial intelligence time-series data lineage graph G L The artificial intelligence time-series data lineage graph includes at least: data version nodes, processing event nodes, input edges from data version nodes to processing event nodes, output edges from processing event nodes to data version nodes, input-output local mappings, call chain relationships, and event evidence confidence levels.

[0081] A one-way temporal relationship is established between the processing event node and the data version node, with the output data version being generated later than the input data version. Cache reads, cache write-backs, model retries, and recurrent agent calls all generate new processing event nodes and new data version nodes, without directly linking the new processing results back to the old data version node.

[0082] Establish a mapping relationship between a knowledge graph of sensitive data and a lineage graph of time-series data for artificial intelligence.

[0083] One type of mapping is used to map data version nodes to: sensitive categories, sensitive features, sensitive facts, and relationship templates.

[0084] Another type of mapping is used to map event processing nodes to: processing behavior, business scenario, execution entity, permission status, network boundary, model or algorithm version.

[0085] Through the above mapping, event condition propagation operators can be generated for specific processing events and sensitive categories, instead of propagating based solely on static sensitive labels on data version nodes.

[0086] The event conditional propagation operator T(e,k) represents the degree to which sensitive facts of the processed event e are preserved, attenuated, transferred, or amplified for sensitive category k. The event conditional propagation operator is instantiated based on two or more of the following parameters: the type of the processed event, the actual parameters of the processed event, the model or algorithm version, the local mapping of input and output, the executing entity, the business scenario, the permission status, the network boundary, and the model capabilities.

[0087] In one implementation, different operator templates are used for different processing events.

[0088] For replication events, propagation parameters can be determined using content retention rate and local mapping integrity rate: ;

[0089] For event identification, propagation parameters can be determined using identification confidence level and sensitive area coverage: ;

[0090] For slice events, the propagation parameters can be determined based on the overlap ratio between the sensitive fact source interval and the output slice interval: ;

[0091] For desensitized events, propagation parameters can be determined based on mask coverage and mask effectiveness. ;

[0092] For model-generated events, propagation parameters can be determined based on the degree to which the input supports the output facts, the degree of semantic implication, the degree of retention of categorical elements, and attribution consistency. ;

[0093] For vectorized events, propagation parameters can be determined based on the completeness of the binding between vector entries and source slices, as well as the risk of vector inversion or re-identification. ;

[0094] Where, r content and r map These are content retention rate and input / output mapping integrity rate, respectively; q recongnize and r region These are identification confidence level and sensitive area coverage, respectively; I fact and I out These are the sensitive fact source interval and the output interval, respectively; c mask and e mask These represent mask coverage and mask effectiveness, respectively; p support To output the proportion of facts supported by the input facts, p entail p represents the semantic entailment of the input to the output fact. coverage p represents the retention rate of key elements of category k in the output. attr To output the attribution consistency between the facts and the actual input set; r sourceThe binding integrity rate between vector entries and source slices is denoted by , and the preverse is the risk of vector inversion or re-identification.

[0095] The above-described operator is only a preferred embodiment. The event conditional propagation operator can also be implemented using piecewise functions, lookup table functions, matrix operations, rule models, or constrained training models.

[0096] In one implementation, the specific mathematical form of the event conditional propagation operator T(e,k) is:

[0097] T(e,k)=clip [0,1] (w1·T type (e)+w2·T param (e)+w3·T model (e)+w4·T map (e)+w5·T subj (e)+w6·T auth (e)+w7·T net (e))

[0098] Among them, clip [0,1] (x)=min(1,max(0,x)) indicates that the value is truncated to the interval [0,1]; the weights w1 to w7 are non-negative and satisfy w1+w2+w3+w4+w5+w6+w7=1. In one implementation, w1=0.25, w2=0.20, w3=0.10, w4=0.10, w5=0.10, w6=0.15, and w7=0.10. Each component is instantiated according to the following rules based on the processed event record: when only two or more components can be observed in the event record, only the observable components are given the corresponding weights and renormalized; when key components are missing or cannot be mapped, the confidence of the event evidence is reduced and the event is marked as pending review.

[0099] In the formula:

[0100] T type (e) represents the event type component T. type (e): Determine the baseline coefficient based on the event type of the processed event by querying the preset baseline coefficient table. For example, the coefficient for copying or importing events is 0.9, recognition events are 0.8, model generation events are 0.8, slicing events are 0.7, vectorization events are 0.7, prompt word assembly events are 0.6, retrieval events are 0.4, and desensitization events are 0.2.

[0101] T param(e) is the actual parameter component: determined based on the actual parameter summary of the processed event, taking the proportion of the sensitive content actually involved in the processing to the source data content; for example, for the copy event, it is the ratio of the actual number of copied fields to the total number of source fields, for the slice event, it is the overlap ratio of the sensitive fact source interval and the output slice interval, and for the identification event, it is the identification confidence level;

[0102] T model (e) Model or algorithm version component: take 1 for processing events that do not involve the model or algorithm; for processing events that involve the model or algorithm, take the pre-calibrated retention coefficient corresponding to the current model or algorithm version. The pre-calibrated retention coefficient is pre-calibrated by performing standard sensitive sample tests on each version of the model or algorithm and stored in the propagation parameter node of the sensitive data knowledge graph.

[0103] T map (e) is the input-output local mapping component: the ratio of the number of content units that successfully establish input-output local mapping to the total number of content units involved in processing;

[0104] T subj (e) Execution subject component: determined based on the execution subject type in the event processing log, for example, 1.0 for a registered service account within the system, 0.9 for a regular user account, and 0.6 for an external or anonymous subject;

[0105] T auth (e) Permission status component: Take the permission coverage rate of the executing subject for the data fields involved in this processing, that is, the ratio of the number of authorized data fields to the total number of data fields involved;

[0106] T net (e) is the network boundary component: determined based on the relationship between the input and output of the processed event and the network boundary. For example, it is 1.0 within the same trust domain, 0.6 across trust domains, and 0.3 when sent out across network boundaries.

[0107] The following is the calculation process of the propagation operator for the replication event:

[0108] 80% of the fields in the source data unit are copied to a new data unit within the same trust domain. The execution entity is a registered service account within the system, with a permission coverage of 1. Input and output partial mapping is complete, without involving the model or algorithm. The value of each component is: T type (e)=0.9, T param (e)=0.8, T model (e)=1、T map (e)=1.0、T subj (e)=1.0, T auth (e)=1.0、T net (e) = 1.0, substituting into the above equation, we get:

[0109] T(e,k) = 0.25×0.9 + 0.20×0.8 + 0.10×1 + 0.10×1.0 + 0.10×1.0 + 0.15×1.0 + 0.10×1.0 = 0.225 + 0.160 + 0.100 + 0.100 + 0.100 + 0.150 + 0.100 = 0.935, that is, the propagation operator of the replication event T(e,k) = 0.935.

[0110] The following is the calculation process of the propagation operator for the model-generated events:

[0111] A regular user account calls a model version with a pre-calibrated retention coefficient of 0.9 to generate text. The source data sensitive fields referenced in the prompt words account for 70% of the total number of source data sensitive fields. The input / output local mapping coverage is 60%, the execution entity permission coverage is 80%, and the processing occurs within the same trust domain. The values ​​of each component are: T type (e)=0.8, T param (e)=0.7, T model (e)=0.9, T map (e)=0.6, T subj (e)=0.9, T auth (e)=0.8, T net (e) = 1.0, substituting into the above equation, we get:

[0112] T(e,k)=0.25×0.8+0.20×0.7+0.10×0.9+0.10×0.6+0.10×0.9+0.15×0.8+0.10×1.0=0.200+0.140+0.090+0.060+0.090+0.120+0.100=0.800, that is, the propagation operator T(e,k) of the event generated by this model is 0.80.

[0113] Confidence of evidence in an event Used to represent the first in the propagation path The completeness of the evidence regarding the source and mapping of each incident.

[0114] In one implementation, the confidence level of event evidence is obtained by fusing the following evidence components: source identifier completeness, input-output partial mapping completeness, call chain completeness, and third-party component association evidence.

[0115] The integrity of the source identifier is determined based on whether the root source identifier is unique and whether it can locate the source file or source region.

[0116] The completeness of input-output local mapping is determined based on whether there is a positional mapping, character mapping, token mapping, field mapping, or semantic fact mapping between the input and output regions.

[0117] The completeness of the call chain is determined based on the parent call identifier, child call identifier, call chain identifier, and event time sequence.

[0118] Third-party component association evidence is used to establish candidate associations when third-party components cannot be tracked. It can include: session tokens, interface request identifiers, input and output semantic fingerprints, request and response time windows, network endpoints, request and response directions, and input and output data volume relationships.

[0119] In one implementation, a complete source identifier, a complete local mapping, and a complete call chain correspond to a higher level of evidence confidence; the lack of some key logs reduces the level of evidence confidence; and when only semantic fingerprint support is available, the propagation path is marked as a path to be confirmed. When the event evidence confidence is lower than a preset review condition, only the candidate source contribution and review status are saved, and irreversible deletion or blocking operations are not automatically performed.

[0120] The propagation state is determined by the root source identifier r, the sensitive fact identifier f, the propagation path identifier p, and the sensitive category identifier k.

[0121] For sensitive facts in the root source, initialize fact-level direct sensitivity:

[0122] ;

[0123] The contribution of candidate sources is calculated layer by layer along the processing events of the propagation path:

[0124] ;

[0125] in, For the first in the propagation path Layer data version nodes, For the first One event to handle, This is for processing the next layer of data version nodes formed after the event is executed.

[0126] During the recursive computation process, the contribution of each candidate source is always preserved: the root source identifier,

[0127] Sensitive fact identifier, propagation path identifier, precursor contribution identifier, event processing identifier, event evidence confidence level, operator version.

[0128] Furthermore, it does not use node aggregation sensitivity that has already mixed multiple root sources or multiple sensitive facts as the recursive input for the next layer, in order to avoid source identity loss and mutual contamination between different sensitive facts.

[0129] In step S4, the candidate source contribution is written into the source contribution ledger. For repeated execution records with the same logical event idempotency key, idempotency merging is performed. For multiple propagation paths with different logical event idempotency keys but the same root source identifier and sensitive fact identifier, the same source path is deduplicated based on the observable feature overlap between the evidence union formed by the current propagation path and the previously processed propagation paths. The deduplicated contributions are then merged to obtain the ordinary propagation contribution.

[0130] The source contribution ledger is used to persistently store candidate source contributions and perform duplicate processing identification, same-source grouping, path deduplication, and reverse indexing.

[0131] In one implementation, source contribution ledger record L i At least including:

[0132] L i =<Target data identifier, sensitive category identifier, root source identifier, sensitive fact identifier, logical event idempotent key, propagation path identifier, predecessor contribution identifier, candidate source contribution, event evidence confidence, operator version, record status>;

[0133] The source contribution ledger can be implemented using relational database tables, graph databases, key-value stores, or event sourcing logs.

[0134] The logical event idempotency key is used to identify retries, duplicate deliveries, or duplicate consumption of the same logical event. This idempotency key is generated based on the tenant identifier, session identifier, parent call identifier, event type, a set of sorted input data version identifiers, model or algorithm version, and parameter digest. The retry sequence number, physical execution instance identifier, and execution time are not involved in the generation of the logical event idempotency key. Therefore, when a logical inference is retried due to a timeout, the retry record has the same logical event idempotency key as the initial record.

[0135] When the ledger detects the same target data identifier, the same sensitive category identifier, the same root source identifier, the same sensitive fact identifier, and the same logical event idempotent key, it identifies them as duplicate execution records of the same logical processing event, and only updates the execution status, execution count, completion time, or evidence integrity, without adding new propagation contributions.

[0136] For propagation paths with different logical event idempotent keys but the same root source identifier and sensitive fact identifier, the system establishes a common-source contribution group. Since deduplication of common-source paths requires comparing the evidence union formed by the current path with the previously processed paths, the path processing order must be determined first.

[0137] In one implementation, a deterministic stable sequence is established in the following order:

[0138] 1. Candidate sources are ranked from highest to lowest contribution.

[0139] 2. The confidence level of the evidence in the event is ranked from high to low;

[0140] 3. The propagation path length increases from shortest to longest;

[0141] 4. The first processed event in the propagation path occurs from morning to night;

[0142] 5. The propagation path identifiers are arranged in lexicographical or numerical order.

[0143] If the previous sorting item is the same, the next sorting item is used to continue determining the order.

[0144] By adopting the stable order described above, we can avoid different deduplication results for the same set of paths due to different log arrival orders, different asynchronous message sequences, or different ledger batches, thereby improving the reproducibility of risk calculation and audit results.

[0145] The observable evidence features of the same source path include at least: event edge features, root source location features, and cache source features.

[0146] Event edge features are used to indicate whether the processing event edges traversed by the path are the same or partially the same.

[0147] The root source location feature is used to indicate whether the source file page number, character range, image region, field position, or audio / video time range corresponding to the path overlaps.

[0148] The cache origin feature is used to indicate whether different propagation paths read the same cache copy, the same cache key, the same vector entry, or the same copy of the search result.

[0149] For multiple propagation paths corresponding to the same target data version, the same sensitive category, the same root source identifier, and the same sensitive fact identifier, they are sorted according to the preset order of candidate source contribution from high to low, event evidence confidence from high to low, propagation path length from short to long, and propagation path identifier, in order to form a deterministic and stable order.

[0150] For the sorted i-th propagation path, calculate its overlap and independence increment relative to the evidence union formed by the previously processed propagation paths. The calculation formula is as follows:

[0151] ;

[0152] Where x represents the evidentiary feature, O i α is the set of evidence features that can be actually computed or mapped between the current propagation path and the union of evidence formed by previously processed propagation paths. x For the weight of the evidence features, r x,iThe degree of overlap between the current transmission path and the corresponding evidentiary features;

[0153] The evidence features include one or more of event edge features, root source location features, and cached source features; evidence features that are missing or cannot be mapped to the same coordinate system do not participate in the overlap calculation; when the evidence feature set is empty or the evidence coverage is insufficient, the candidate source contribution is not deducted based on the overlap, and the corresponding propagation path is marked as pending review.

[0154] In one implementation, the evidence feature weight α x The basis and calibration method for the value are as follows: α x The initial value is determined based on the reliability, stability, and discriminative power of the corresponding evidence features, and is given by expert rules, such as the event edge feature α. event =0.5, Root source location feature α source =0.3, Cache source characteristic α cache =0.2; Subsequently, a validation set was constructed using audit samples labeled with common origin relationships. The initial weights were adjusted with the goal of minimizing the identification error of repeated contributions from common origin paths. After adjustment, normalization was performed to make Σα x =1.

[0155] Overlap r x,i Calculated separately according to the type of evidence characteristics:

[0156] Event edge characteristics: Take the set E of processing event edges of the current propagation path. i Combined with previous evidence and centralized processing of event edge set E union Jaccard overlap, r event,i =|E i ∩E union | / |E i ∪E union |;

[0157] Root source location characteristics: When the source location is a one-dimensional interval such as a page number interval, character interval, or audio / video time interval, the ratio of the interval intersection length to the interval union length is taken; when the source location is a two-dimensional region such as an image coordinate region, the ratio of the intersection area to the union area (IoU) is taken.

[0158] Cache source characteristics: 1 is taken when the current propagation path and the evidence union read the same cache key, the same vector entry, or the same copy of the retrieval result; otherwise, 0 is taken. When multiple cache identifiers are involved, the Jaccard overlap of the cache identifier set is taken, r. cache,i =|C i ∩C union | / |C i ∪C union |

[0159] For example, the overlap of the second propagation path after sorting with the event edge Jaccard of the previous evidence union set is 0.9, the intersection-union length ratio of the root source character interval is 0.9, and the overlap of reading the same cache key (i.e., the cache source overlap is 1), then its overlap ρ2 = 0.5 × 0.9 + 0.3 × 0.9 + 0.2 × 1 = 0.45 + 0.27 + 0.20 = 0.92.

[0160] When a certain evidentiary feature is missing, cannot be mapped to the same coordinate system, or does not have a corresponding identifier, the overlap of that evidentiary feature is not directly set to zero. Instead, the evidentiary feature is moved from O... i Exclude from both the numerator and denominator.

[0161] Simultaneously record evidence coverage. :

[0162] ;

[0163] When O i When empty, the overlap is not defined; when the evidence coverage is lower than the preset coverage condition, automatic deduction is not performed based on the current overlap, and the current propagation path is marked as the source to be confirmed or manually reviewed.

[0164] The specific calculation method for the independent increment is only one implementation method described in the specification.

[0165] For the first propagation path in a homogeneous contribution group, its candidate source contribution is determined as an independent increment: ;

[0166] For subsequent propagation paths, when the overlap is valid and the evidence coverage meets the preset conditions, independent increments are determined as follows: ;

[0167] Where, q i ρ contributes to the candidate sources of the current propagation path. i This represents the degree of overlap between the current propagation path and the previous set of evidence.

[0168] When ρ i When =1, it means that the observable evidence of the current propagation path is completely contained in the union of previous evidence, therefore: ;

[0169] When ρ i When the value is close to 0, it indicates that the current propagation path is basically independent of the previous evidence set, and most of the candidate source contributions of the current path are retained.

[0170] When the evidence feature set is empty or the evidence coverage is insufficient, automatic deduction is not performed, and a conservative retention method is adopted: ;

[0171] And mark the path as pending review.

[0172] After multiple propagation paths corresponding to the same source identifier and the same sensitive fact identifier have completed independent incremental calculations, they are then fused in a bounded manner: ;

[0173] Where, q g This is a deduplication contribution for homologous contributing groups.

[0174] Contribution groups corresponding to different root source identifiers or different sensitive fact identifiers are not deduplicated within the same source path, but rather boundedly merged between contribution groups:

[0175] ;

[0176] Among them, I k (v) represents the inherited sensitivity of the target data version v for the sensitive category k, G k (v) is the set of valid contributing groups.

[0177] In one implementation, the complete expression for the above-mentioned bounded fusion is: q within the same source contribution group g =1-∏ i∈Pg (1-δ i ), where P g δ is the set of propagation path indices that have undergone deduplication in the same contributing group g. i For the independent increment of the i-th propagation path; I among contributing groups k (v)=1-∏ g∈Gk(v) (1-q g ), where G k (v) represents the set of valid contribution groups for target data version v under the sensitive category k.

[0178] The determination of the bounds and range of values ​​for the above fusion function is based on the following: due to the independent increments δ i ∈[0,1], therefore ∏ i∈Pg (1-δ i )∈[0,1], therefore q g ∈[0,1], similarly I k (v)∈[0,1]. This range represents the normalized sensitivity metric range: the lower bound 0 indicates no sensitivity contribution, and the upper bound 1 indicates a fully sensitive state; the sensitivity metric of any single path or single contribution group does not exceed 1, and the cumulative sensitivity metric after bounded fusion of multiple sources asymptotically approximates but does not exceed 1 in the fully sensitive state, thus avoiding artificially inflated sensitivity caused by simple linear addition. Wherein, the candidate source contribution q i Event conditional propagation operator T(e,k), event evidence confidence level γ i and overlap ρ iAll values ​​are confined to [0,1], therefore the independent increment δ i= q i ×(1-ρ i ) also belongs to [0,1], and the above boundary is thus obtained.

[0179] Execute step S5: For an aggregation processing event with multiple input data versions, determine the set of inputs that actually enter the same aggregation context, and determine whether the input set jointly forms a new sensitive relationship that is not completely contained by any single input data version; if the preset combination judgment condition is met, generate a valid combination recovery hyperedge and determine the combination contribution; if the preset combination judgment condition is not met, do not generate a valid combination recovery hyperedge and retain the ordinary propagation contribution.

[0180] Specifically, the aggregation processing events include: prompt word assembly events, tool result summary events, cross-round memory splicing events, data aggregation events, multi-document summary events, multi-field joint analysis events, and multi-source search result merging events.

[0181] Based on the event logs and input / output local mappings of the aggregated processing events, determine whether the input data versions actually enter the same aggregation context, and only add input data versions with event log evidence and input / output local mapping evidence to the input set; for each candidate input data version, at least the following judgments are made:

[0182] 1. Does the event log record the event that this version of input data enters the target aggregation processing?

[0183] 2. Does a local mapping exist between the input data version and the aggregation context?

[0184] 3. Whether the input is in a context area that is actually read by the model, tool, or aggregation program;

[0185] 4. Whether the input exists validly during the event processing execution.

[0186] An input data version is added to the actual input set H only if it has both event log evidence and local input-output mapping evidence.

[0187] For example, if the retrieval system returns 5 candidate segments, but the prompt word assembly event only uses 2 of them, then only the 2 segments that are actually written into the prompt word context are added to the input set, and the candidate segments that are not included in the prompt word do not participate in the combination and recovery calculation.

[0188] The preset combination determination conditions include:

[0189] The single-input risk of each input data version in the input set is lower than the preset single-input threshold when excluding combined contributions.

[0190] Specifically, the setting basis, value range, and adjustment method of the preset single-input threshold are as follows: The preset single-input threshold is configured according to the sensitive category, business scenario, and risk tolerance level, and the value range is [0,1]. The initial value is determined by taking the preset high quantile of the single-input risk distribution of normal business samples in the historical risk samples. During operation, it is dynamically adjusted according to the false positive rate and false negative rate on the validation set. In one implementation, the 95th percentile of the single-input risk of normal business samples is taken as the initial threshold, for example, θ is obtained. single =0.50; When the false negative rate of the validation set exceeds the preset upper limit, the threshold is increased by a step size of 0.02 to allow more single inputs to enter the combination judgment until the false negative rate meets the preset constraint; When the false positive rate exceeds the preset upper limit, the threshold is decreased by a step size of 0.02 to tighten the input set until the false positive rate meets the preset constraint; After each adjustment, the threshold is truncated within the range of [0,1].

[0191] The input set is matched with the sensitive relation template; a candidate object set A is established before combination. b The combined candidate object set A a The pre-combination candidate object set represents the set of candidate objects that can be matched when using a single input or a portion of the input set individually. The post-combination candidate object set represents the set of candidate objects obtained after placing the input sets together in the same aggregation context and processing them through entity alignment, relation template matching, attribute constraints, and time constraints.

[0192] The candidate object set before combination is not empty, and the number of candidates in the candidate object set after combination is reduced or the candidate constraints are strengthened compared to the candidate object set before combination;

[0193] When |A b When |>0, the degree of candidate contraction can be calculated as follows:

[0194] ;

[0195] The sensitive relationships jointly supported by the input set are not fully contained in any single version of the input data;

[0196] When the set of candidate objects before combination is empty, or when the set of candidate objects after combination undergoes an invalid expansion relative to the set of candidate objects before combination, no valid combination recovery superedge is generated, and the corresponding combination contribution is determined to be zero.

[0197] When |A a |>|A b When | indicates that the combination process has led to an expansion of the candidate set, the candidate shrinkage degree is set to zero, and candidate set conflicts are recorded to avoid misjudging candidate expansion as accurate restoration of the combination relationship.

[0198] Determine whether the input sets jointly form a new sensitive relationship that is not fully contained by any single version of the input data.

[0199] Let rel be a candidate sensitive relation. If the following conditions are met:

[0200] 1. The joint support of the input set to rel reaches the preset joint support threshold;

[0201] 2. For any single input data version u in the input set i None of them completely contain rel;

[0202] Then rel will be identified as a newly added sensitive relationship.

[0203] For example:

[0204] Input fragment A contains the project name and the person in charge;

[0205] Input fragment B contains the project name and budget;

[0206] Input fragment A is incomplete and does not contain the budget;

[0207] Input fragment B is incomplete and does not include the person in charge;

[0208] However, after input fragment A and input fragment B enter the model context together, the relationship between "project, person in charge, and budget" can be restored.

[0209] At this point, the "project, person in charge, and budget" constitute a new sensitive relationship formed by combination, while the project name, person in charge, and budget facts themselves are still calculated separately according to the normal communication process.

[0210] Confidence level of combined evidence c comb (h) is obtained by fusing the following evidence components: input attribution confidence, sensitive relation template matching confidence, candidate set construction confidence before and after combination, and new relation determination confidence.

[0211] In one implementation, the confidence level of combined evidence is calculated as follows:

[0212] ;

[0213] In the formula, h is the combined recovered hyperedge, and c input For the input attribution confidence score, c template For template matching confidence, c candidat e constructs the confidence score for the candidate set, and c novelty Determine the confidence level for the newly added relationship.

[0214] The combinatorial contribution of combinatorial recovery hyperedges can be calculated as follows:

[0215] ;

[0216] In the formula, η is the basic coefficient of combined contribution, M is the relation template matching degree, Q is the candidate shrinkage degree, N is the indicator of new relations, and β is the basic coefficient of combined contribution. M β Q and β N To configure weights.

[0217] The combined contribution is reduced by the confidence level of the combined evidence. When any key evidence in input attribution, template matching, candidate set construction, or determination of new relationships is missing, the confidence level of the combined evidence is reduced, and the combined contribution is reduced accordingly, rather than only reducing the confidence level of the risk conclusion at the final disposal stage.

[0218] Multiple combined recovery hyperedges corresponding to the same target data version, sensitive category, relation template, recovery relation identifier, and sorted actual input set can form the same hyperedge for decomposition. For the same hyperedge decomposition, the system retains the record with the largest combined contribution as the valid combined recovery hyperedge, and saves the remaining records as duplicate evidence.

[0219] Execute step S6 to calculate the risk of the target data version based on the direct sensitivity, inherited sensitivity, combined contribution, and exposure factors; collect direct identification evidence, general propagation contribution, and effective combination recovery hyperedge from the target data version in reverse; select the evidence subgraph based on the marginal contribution of candidate evidence items; simulate the remaining risk after the candidate fence action is implemented, and execute the candidate fence action that meets the safety conditions and has the lowest overall disposal cost.

[0220] The inherited sensitivity is the sensitivity obtained after sequentially performing logical event idempotent merging, deduplication of propagation paths corresponding to the same root source identifier and sensitive fact identifier, and contribution group fusion for candidate source contribution records of the same target data version and the same sensitive category, and does not include direct sensitivity and the combined contribution.

[0221] For the target data version v and the sensitive category k, the direct sensitivity is D. k (v), inheritance sensitivity is I k (v) The sensitivity after fusing ordinary propagation and direct recognition is:

[0222] ;

[0223] The combinatorial contribution generated by the effective combinatorial recovery superedge does not replace the ordinary propagation contribution, but is superimposed on the basis of ordinary fusion sensitivity:

[0224] ;

[0225] In the formula, H valid(v,k) is the set of superedges recovered by the effective combination of target data version v under sensitive category k.

[0226] The exposure factors include two or more of the following: processing stage, destination, receiving subject, operation type, model capability, and permission status, which are obtained based on one or more of the following: processing event records, network boundary records, identity authentication records, model capability configuration, and permission verification records.

[0227] The methods for obtaining information on each exposure factor are as follows:

[0228] 1. Processing Phase: Determined based on the type of event being processed, the execution components, and the stage of the data within the AI ​​pipeline;

[0229] 2. Destination: Determined based on the output endpoint, network area, network boundary, and trust domain;

[0230] 3. Receiving entity: Determined based on user identity, tool caller, model service provider, API caller, or external receiving entity;

[0231] 4. Operation type: Determined based on whether it is a read, write, generate, transfer, export, share, tool call, or cache operation;

[0232] 5. Model Capabilities: Determined according to the model capability configuration table, including whether the model supports external networking, whether it supports tool calls, whether it supports autonomous planning, or whether it can generate structured results;

[0233] 6. Permission status: Determined based on access control policies, authorization policies, session permissions, and permission verification results.

[0234] In one implementation, the exposure coefficient can be expressed as:

[0235] ;

[0236] Where, x s x d x r x o x m and x p ω represents the exposed components corresponding to the processing stage, destination, receiving subject, operation type, model capability, and permission status, respectively. s ω d ω r ω o ω m and ω p To configure weights.

[0237] The candidate evidence items include one or more of the following: direct identification evidence that can be independently removed and used to recalculate sensitivity or risk, general propagation contribution groups, and effective combination recovery hyperedges.

[0238] The interpretation coverage of the evidence subgraph is determined using the same sensitive category weight normalization method and bounded fusion method as the risk calculation.

[0239] Perform weight normalization on sensitive categories that currently have valid sensitive evidence.

[0240] Let K v Given the set of active sensitive categories for the target data version, the final risk can be calculated as follows:

[0241] ;

[0242] When K v When empty, the risk of the target data version is set to zero.

[0243] The candidate fence actions include one or more of the following: local field desensitization, removing prompt word input fragments and regenerating them, isolating vector entries, clearing cached copies, revoking sharing permissions, denying tool calls, and blocking outgoing data.

[0244] When simulating candidate fence actions, affected common propagation contributions or effective combination recovery superedges are marked as invalid, and the affected downstream derived data versions are determined along the temporal lineage.

[0245] The overall processing cost is determined based on the information loss, additional delay, and scope of impact caused by the candidate fence action;

[0246] When the input set of sensitive identification rules, event conditional propagation operators, authorization status, or aggregation processing events changes, the inverse index established by the superedge is restored based on the source contribution ledger and valid combinations, and incremental recalculation is performed on the affected data version and its downstream derived data version.

[0247] The risk and evidence processing module starts with the target data version or the target sensitive fact, and traverses the target data version and its predecessor data version nodes in reverse along the temporal lineage to collect: direct identification evidence, deduplicated common propagation contribution groups, effective combination to restore hyperedges, key input and output local mappings, event evidence confidence, root source location, and related processing events.

[0248] The above evidence together form the complete evidence set E. all .

[0249] Among them, direct identification evidence refers to evidence that proves the data version itself directly contains sensitive entities, attributes, or relationships; ordinary propagation contribution group refers to the propagation contribution after completing the idempotent merging of logical events, deduplication of the same source path, and fusion of contribution groups; effective combination recovery hyperedge refers to the hyperedge that meets the combination judgment conditions and generates a combination contribution.

[0250] Candidate evidence items are evidence units that can be independently removed and the sensitivity or risk of the target data version recalculated.

[0251] Candidate evidence items include: a directly identified evidence item, a deduplicated ordinary propagation contribution group, an effective combination to recover the superedge, a local mapping relationship that can be tested independently, and a propagation path that can be tested independently.

[0252] For any evidence set E, the system calculates the comprehensive sensitivity interpretation value using the same sensitivity category weight normalization method and nonlinear bounded fusion method as the final risk calculation:

[0253] ;

[0254] This indicates the sensitivity obtained by recalculating using only the evidence set E.

[0255] For a candidate evidence item ξ, the marginal contribution is obtained by removing the evidence item and recalculating the comprehensive sensitivity interpretation value:

[0256] ;

[0257] In the formula, "\" represents the set difference in mathematics, which is the deletion of an element from a set. E all \{ξ} represents the set of all evidence E. all Delete candidate evidence item ξ.

[0258] The greater the marginal contribution, the greater the supporting effect of the candidate evidence item on the conclusion of the risk or sensitivity of the target data version.

[0259] The system ranks candidate evidence items based on their marginal contribution and selects the evidence subgraph in one of the following ways:

[0260] 1. Prioritize evidence items with larger marginal contributions;

[0261] 2. When the interpretation coverage condition is met, prioritize the evidence items with fewer nodes;

[0262] 3. When marginal contributions are the same, priority should be given to evidence items with shorter path lengths, higher confidence levels, or lower uncertainties.

[0263] 4. Prioritize evidence items that can simultaneously cover both general propagation contribution and combined recovery superedge.

[0264] The interpretation coverage of the selected evidence subgraph can be calculated as follows:

[0265] ;

[0266] Among them, E s The selected evidence subgraph.

[0267] When Φ(E) all When Φ(E) > 0, select the evidence subgraph whose coverage reaches the preset coverage threshold. all When )=0 and the entire evidence set is empty, the coverage is set to one; when there is conflicting evidence but it cannot contribute positive risk, the coverage is set to zero and manual review is initiated.

[0268] Since the evidence subgraph adopts the same nonlinear bounded fusion method as the final risk, the recurring paths from the same source and the recovery superedges of repeated combinations will not be simply added together, thus avoiding an artificially high interpretation coverage.

[0269] Candidate fence actions are generated based on the evidence subgraph. These candidate fence actions include: local field desensitization, regenerating after removing prompt word input fragments, isolating vector entries, clearing cached copies, revoking sharing permissions, denying tool calls, blocking outgoing data, and transferring target data to manual review.

[0270] For each candidate fence action, the system simulates the action on a copy of the data version graph.

[0271] For example: when simulating the removal of a prompt word fragment, the corresponding prompt word input data version is removed from the aggregation context; when simulating the isolation of a vector entry, the vector entry is marked as unsearchable; when simulating the cleanup of cached copies, the corresponding cached data version is marked as invalid; when simulating field desensitization, the data version node is updated according to the local mapping before and after desensitization; when simulating the revocation of permissions, the permission status and exposure factors of the target data version are updated.

[0272] After the action simulation, the system recalculates the following data: affected general propagation contribution, affected effective combination recovery superedge, affected target output, affected downstream derived data version, and residual risk after candidate action implementation.

[0273] If a general propagation contribution depends on a removed or isolated data version, then that general propagation contribution is marked as invalid. If any necessary input to the input set of a combinatorial recovery hyperedge is removed, then that combinatorial recovery hyperedge is marked as invalid, and the combinatorial contribution is recalculated.

[0274] Let the action of creating a candidate fence be 'a', and the residual risk after the action is implemented be 'R'. residual (v,a), only when R residual (v,a)≤R safe Only when the action does not violate the mandatory blocking rule will the candidate action enter the set of possible actions. Wherein, R safe Preset security thresholds can be configured based on sensitive categories, business scenarios, receiving entities, and network boundaries.

[0275] The overall cost of handling candidate fence actions includes: information loss cost, additional delay cost, and impact range cost.

[0276] In one implementation, the overall processing cost is:

[0277] ;

[0278] Among them, L information (a) represents the proportion of information loss caused by the action, L latency (a) indicates the increased processing delay for the action, L scope (a) represents the scope of data objects, business objects, or downstream replicas affected by the action, where λ1, λ2, and λ3 are configuration weights.

[0279] From the set of possible actions, the system selects the candidate action with the lowest overall processing cost:

[0280] ;

[0281] For example, if deleting a budget fragment would reduce the remaining risk below the safety threshold, the system does not need to block all model outputs. Instead, it can simply remove the budget fragment, isolate the corresponding vector entries, clear the relevant cache, and regenerate the answer.

[0282] Selective recalculation is triggered when any of the following objects change: sensitive identification rules, sensitive categories, event conditional propagation operators, model or algorithm versions, authorization status, network boundaries, input sets for aggregated processing events, composite relation templates, and effective states of composite recovery hyperedges.

[0283] The source contribution ledger and the effective combination recovery superedge respectively store the target data version index, the upstream source index, and the downstream derived index.

[0284] The system queries the inverted index based on the changed object, and only adds the affected data version and its downstream derived data versions to the recalculation queue, without rebuilding the entire data lineage.

[0285] Example 2: Internal project data is retrieved and enhanced to generate sensitive output.

[0286] An organization uploaded a PDF file containing unpublished project information to its internal knowledge base. A scanned table on page 12 of the PDF contains the following information:

[0287] Project Name: Galaxy Project;

[0288] Project Leader: Zhang;

[0289] Project budget: 32 million yuan.

[0290] The system performs OCR, text slicing, vectorization, vector retrieval, prompt word assembly, and model inference on the PDF. The model output is: "This project is managed by Zhang, and the next stage requires nearly eight figures in funding."

[0291] The model output did not fully replicate the original budget amount and complete project description; therefore, the direct sensitivity of the trade secret obtained solely through direct sensitivity identification was 0.31.

[0292] Perform event collection and version creation.

[0293] The system creates a data version node D0 for the original PDF, and a data version node D0-2 for the table area on page 12. OCR processing generates a text node D1, and slicing processing generates slice nodes D2-A, D2-A′, and D2-B, where:

[0294] D2-A includes the project name and the person in charge;

[0295] D2-A′ is a slice that overlaps with D2-A;

[0296] D2-B contains budgetary facts.

[0297] The vectorization event converts each slice into a vector entry, the retrieval and prompt word assembly events generate retrieval result nodes and prompt word fragment nodes respectively, and the model inference event generates output fact unit F-03.

[0298] The model inference timed out and was retried once. The original inference event and the retry event have the same tenant ID, session ID, parent call ID, event type, ordered set of input versions, model version, and parameter summary, therefore they produce the same logical event idempotent key.

[0299] The system identifies retry events as the same logical processing event, only updates the execution count and execution status, and does not add new source contributions.

[0300] Conduct sensitive fact identification.

[0301] The system identified the following from the table area on page 12:

[0302] Fact of the person in charge owner ;

[0303] Budget F budget ;

[0304] The relationship between the project and the person in charge;

[0305] The relationship between projects and budgets.

[0306] The system generates corresponding sensitive fact identifiers based on the source file, page number, character range, and fact type.

[0307] For the model output fact unit F-03, since the output content has been rewritten, the direct recognition result is:

[0308] D secret (F-03)=0.31

[0309] This value is insufficient to determine the final high-risk conclusion on its own, so the system continues to perform source propagation and combined recovery analysis.

[0310] Perform candidate source contribution calculation.

[0311] The facts concerning the person in charge and the budget facts are disseminated as different sensitive fact states.

[0312] The responsible fact propagates along D2-A to the output fact unit F-03, forming the candidate source contribution: q A =0.55;

[0313] The responsible party's fact propagates along the overlapping slice D2-A′ to F-03, forming another candidate source contribution: q A′ =0.42;

[0314] Budget facts propagate along D2-B to F-03, forming candidate source contributions: q B =0.20;

[0315] The above three contributions all carry: root source identifier, sensitive fact identifier, propagation path identifier, processing event identifier, predecessor contribution identifier, event evidence confidence level, and operator version.

[0316] Perform combination to restore the superedge.

[0317] Event logs and local mappings of the prompt assembly events indicate that both D2-A and D2-B actually entered the same prompt context.

[0318] Calculations show that: the single-input risk of D2-A is 0.44, and the single-input risk of D2-B is 0.48, both of which are lower than the preset single-input threshold; the template matching degree of the relationship between "project, person in charge, and budget" is 0.92, indicating that this ternary relationship is not fully contained by any single fragment in D2-A or D2-B; the candidate object set before combination contains 24 candidate projects; the candidate object set after combination shrinks to 1 project.

[0319] Therefore, the system determines that the input set forms a new sensitive relation and generates an effective combination to recover the superedge h-01.

[0320] The degree of candidate shrinkage before and after combination is as follows:

[0321] ;

[0322] The confidence scores for input attribution, template matching, candidate set construction, and new relationship determination are set to 0.95, 0.92, 0.90, and 0.90, respectively. The combined evidence confidence score is:

[0323] c comb (h-01)=0.30×0.95+0.30×0.92+0.25×0.90+0.15×0.90=0.921;

[0324] The combinatorial contribution of combinatorial recovery of superedges is:

[0325] Δ comb (h-01)≈0.219;

[0326] The sensitivity before combined recovery was:

[0327] S secret (F-03)=1-(1-0.31)(1-0.652)≈0.760;

[0328] After combining the contributions:

[0329] ;

[0330] If the candidate object set before combination is empty, or the candidate object set after combination undergoes an invalid expansion relative to the set before combination, the system will not generate h-01 and will set the combination contribution to zero, but will still retain the ordinary propagation contribution corresponding to the responsible person fact and the budget fact.

[0331] Perform risk calculations.

[0332] The model output is in the external output stage, the destination is the Internet cooperation portal, and the recipient is external cooperation personnel who have not obtained the corresponding authorization. The model has the ability to call external tools. Therefore, the system determines the exposure coefficient to be: X(F-03)=0.975;

[0333] The final risk is: R(F-03) = 0.813 × 0.975 ≈ 0.793;

[0334] If the risk exceeds the preset high-risk threshold, the system will enter the precise fencing process.

[0335] Evidence sub-graphs and processing.

[0336] The system traverses backward along the temporal lineage from the target fact unit F-03, collecting: the table area on page 12 of the original PDF, the responsible person's fact, the budget fact, the general propagation contribution corresponding to D2-A and D2-B, the cue word assembly event, the model inference event, and the combinatorial recovery hyperedge h-01.

[0337] Test the risk changes after removing the evidence item corresponding to D2-B.

[0338] After deleting D2-B, the budget fact general propagation contribution is revoked, the "project and person in charge and budget" relationship template is no longer complete, the combination recovery superedge h-01 fails, and the recalculated residual risk is lower than the safety threshold.

[0339] In contrast, while deleting D2-A could also reduce risk, it would result in a greater loss of project information.

[0340] Therefore, the fence decision-making process is as follows:

[0341] 1. Remove the budget fragment corresponding to D2-B from the current prompt;

[0342] 2. Regenerate the model's response;

[0343] 3. Isolate the vector entries corresponding to D2-B;

[0344] 4. Mark and clear the relevant cached copies;

[0345] 5. Send an authorization review notice to the person responsible for the data.

[0346] This action, while satisfying the residual risk constraint, has a relatively small information loss and scope of impact.

[0347] Example 3: Threshold calibration and anomaly handling.

[0348] 1. Third-party components cannot be used for event tracking.

[0349] When a third-party vector database or external tool service cannot provide complete logs, the proxy layer establishes candidate event associations based on session tokens, interface request identifiers, input / output semantic fingerprints, and time windows.

[0350] When there is insufficient evidence of candidate association, the system retains the candidate lineage edge, but marks it as an edge to be confirmed, reduces the confidence of the corresponding event evidence, and does not automatically perform irreversible processing based on the candidate edge.

[0351] Second, the evidentiary features are missing.

[0352] When the propagation path lacks root source location features but still has event edge features and cache source features, the system calculates the overlap only based on the observable evidence features.

[0353] When all three types of evidence features are missing, the degree of overlap is not defined, the system does not perform automatic deduction, retains the contribution of complete candidate sources, and transfers the path to manual review.

[0354] 3. Failed to write to the ledger.

[0355] When the source contribution ledger is temporarily unable to be written to, candidate source contributions are placed in an isolation queue. Once the ledger is restored, candidate source contributions are replayed according to the logical event idempotency key.

[0356] If the logical event idempotent key for the replay record already exists, then idempotent merging is performed; otherwise, a new ledger record is added, thus avoiding duplicate or missed calculations.

[0357] IV. Combined recovery calculation timed out.

[0358] When the combined recovery module times out, the system first calculates the conservative risk based on the ordinary propagation contribution and marks the target data version as "combined relationship pending calculation".

[0359] After the combined recovery calculation is completed, if a new sensitive relationship is found, the effective combined recovery superedge, combined contribution, and risk results are updated; if no new sensitive relationship is found, the ordinary propagation risk results are maintained.

[0360] V. Rule or model version update.

[0361] When the sensitive identification rules, propagation operator versions, or combination relationship templates change, the system locates the affected source contribution ledger records and combination recovery hyperedges based on the version reverse index, and only performs recalculation on the affected data versions and downstream derived data versions.

[0362] Historical calculation results retain the original rule version, operator version, and threshold version to ensure that audit results are reproducible.

[0363] Example 4: Full-link numerical manual calculation example and simulation verification example.

[0364] I. Data Version and Processing Event Chain.

[0365] This embodiment follows the scenario of Embodiment 2: the original PDF file is data version D0, and the table area on page 12 is D0-2; OCR event e1 processes D0-2 to generate text version D1; slicing event e2 generates slices D2-A (containing project name and person in charge), D2-A′ (slice overlapping with D2-A), and D2-B (containing budget facts); retrieval event e3 generates retrieval result version P1; prompt word assembly event e4 generates prompt word version P2; model inference event e5 generates output fact unit F-03. Sensitive category k is trade secret.

[0366] II. Instantiation of propagation operators and layer-by-layer calculation of candidate source contributions.

[0367] Taking slice event e2 as an example, it is instantiated in a seven-component weighted form: the event type is slice, i.e., T. type (e2)=0.7; the overlap ratio between the sensitive fact source interval and the output slice interval is 0.625, i.e., T param (e2) = 0.625; This does not involve a model or algorithm, i.e., T model (e2)=1; the input-output local mapping is complete, i.e., T map (e2)=1.0; The executing entity is the registered service account within the system, i.e., T subj (e2)=1.0; the permission coverage rate is 1, i.e., T auth (e2)=1.0; the processing occurs within the same trust domain, i.e., T net (e2) = 1.0; Substituting, we get:

[0368] T(e2,k)=0.25×0.7+0.20×0.625+0.10×1+0.10×1.0+0.10×1.0+0.15×1.0+0.10×1.0=0.85.

[0369] The remaining processing events are instantiated in the same way, and the propagation operators and event evidence confidence values ​​for each processing event are shown in Table 1:

[0370] Table 1:

[0371]

[0372] The fact-level direct sensitivity of the responsible party in the root source region D0-2 is initialized to q0=0.90, and recursively calculated layer by layer along the propagation path:

[0373] q1=q0×T(e1,k)×γ1=0.90×0.90×0.95=0.7695;

[0374] q2=q1×T(e2,k)×γ2=0.7695×0.85×1.00≈0.6541;

[0375] q3=q2×T(e3,k)×γ3=0.6541×0.90×0.98≈0.5769;

[0376] q4=q3×T(e4,k)×γ4=0.5769×0.98×1.00≈0.5654;

[0377] q5=q4×T(e5,k)×γ5=0.5654×0.97×1.00≈0.5484≈0.55;

[0378] That is, the candidate source contribution q of the responsible person's fact reaching the output fact unit F-03 along the path D0→e1→D1→e2→D2-A→e3→P1→e4→P2→e5→F-03. A =0.55.

[0379] To ensure that the other two paths can also be recalculated,

[0380] The D2-A′ path takes q0′=0.78; T(e1,k)=0.90, γ1=0.95; T(e2,k)=0.75, γ2=1.00; T( e3,k)=0.90, γ3=0.98; T(e4,k)=0.98, γ4=1.00; T(e5,k)=0.97, γ5=1.00;

[0381] Therefore q A =0.78×0.90×0.95×0.75×0.90×0.98×0.98×0.97≈0.419≈0.42;

[0382] For the D2-B path, q0B = 0.62; T(e1,k) = 0.90, γ1 = 0.95; T(e2,k) = 0.45, γ2 = 1.00. For subsequent events, T(e3,k) = 0.90, γ3 = 0.98; T(e4,k) = 0.98, γ4 = 1.00; T(e5,k) = 0.97, γ5 = 1.00.

[0383] Therefore q B =0.62×0.90×0.95×0.45×0.90×0.98×0.98×0.97≈0.200.

[0384] III. Idempotent merging.

[0385] Model inference event e5 experienced a physical retry due to a timeout, generating a duplicate execution record e5′. e5 and e5′ share the same tenant identifier, session identifier, parent call identifier, event type, sorted set of input data version identifiers, model version, and parameter summary. Therefore, the logical event idempotency key idem(e5) = idem(e5′). The source contribution ledger identifies the two records as duplicate executions of the same logical processing event, updating only the execution status and execution count, without adding new propagation contributions: before the idempotency merge, there were two candidate source contribution records; after the merge, only one record is retained.

[0386] IV. Deduplication and contribution fusion of the same source path.

[0387] The responsible party's fact forms a second propagation path along the overlapping slice D2-A′, and its candidate source contribution q A ' = 0.42. According to the deterministic stable order, q A =0.55, ranked first, is the first path in the same source contribution group, and its independent increment δ1=q A =0.55; The overlap of the second path with respect to the previous evidence union is calculated by evidence type:

[0388] The event edge Jaccard overlap is 0.9, the intersection-union length ratio of the root source character range is 0.9, and the overlap of reading the same cache key (i.e., cache source overlap) is 1. Weighted, we get:

[0389] ρ2=0.5×0.9+0.3×0.9+0.2×1=0.92;

[0390] Independent increment δ2=q A ′×(1-ρ2)=0.42×(1-0.92)=0.0336.

[0391] Deduplication contribution q from the same source contribution group (the person in charge) g =1-(1-δ1)(1-δ2)=1-(1-0.55)×(1-0.0336)=1-0.45×0.9664≈0.565. The propagation of budget facts along D2-B constitutes another contribution group, with only one propagation path within the group, and its deduplication contribution q g2 =q B =0.20. Inheritance sensitivity I k (F-03)=1-(1-0.565)×(1-0.20)=1-0.435×0.80=0.652.

[0392] V. Combinatorial recovery of superedge generation.

[0393] The event log and input / output local mapping of cue word assembly event e4 indicate that both D2-A and D2-B actually entered the same cue word context; their single-input risks of 0.44 and 0.48 are both lower than the preset single-input threshold of 0.50; the candidate object set A before combination... b The set of 24 candidate items is combined and then shrunk to a single item, with the shrinkage degree Q = (|A b |-|A a |) / |A b |=(24-1) / 24≈0.958; relation template matching degree M=0.92;

[0394] The relationship between “Projects, Responsible Persons, and Budgets” is not fully contained in any single version of the input data, so the new relationship indicator N=1;

[0395] Confidence level of combined evidence c comb (h-01)=0.30×0.95+0.30×0.92+0.25×0.90+0.15×0.90=0.921;

[0396] Let the base coefficient of combined contribution be η = 0.25, and the weight be β. M =0.4、β Q =0.4、β N =0.2, then the combined contribution is:

[0397] Δ comb (h-01)=η×c comb (h-01)×(β M ×M+β Q ×Q+β N ×N)=0.25×0.921×(0.4×0.92+0.4×0.958+0.2×1)=0.25×0.921×0.9513≈0.219.

[0398] VI. Risk Calculation.

[0399] F-03's direct sensitivity D k (F-03)=0.31;

[0400] Sensitivity S after fusion of ordinary propagation and direct recognition k (F-03)=1-(1-0.31)×(1-0.652)≈0.760;

[0401] After superposition and combination contribution C k (F-03)=1-(1-0.760)×(1-0.219)≈0.813;

[0402] Exposure coefficient X(F-03) = 0.975; final risk R(F-03) = 0.813 × 0.975 ≈ 0.793, exceeding the preset high-risk threshold of 0.75, the system enters the precise fencing process.

[0403] The exposure coefficient in this embodiment is calculated as ω s =0.10、ω d =0.20、ω r =0.20、ω o =0.20、ω m =0.15、ω p =0.15 configuration; external output stage takes exposed component x s =0.75, x d =x r =x o =x m =x p =1.00, substituting into the exposure coefficient formula, we get X(F-03)=0.10×0.75+0.20×1+0.20×1+0.20×1+0.15×1+0.15×1=0.975.

[0404] VII. Fence movement simulation and residual risk recalculation.

[0405] Simulation of removing the budget fragment corresponding to D2-B from the current prompt: the ordinary propagation contribution group corresponding to the budget fact becomes invalid, the combinatorial recovery superedge h-01 becomes invalid due to the removal of the necessary input, and its combinatorial contribution is set to zero; recalculate I k ′(F-03)=0.565, S k R′(F-03) = 1 - (1 - 0.31) × (1 - 0.565) ≈ 0.700, with no combined contribution, the remaining risk R′(F-03) = 0.700 × 0.975 ≈ 0.682, which is lower than the preset safety threshold R. safe =0.70.

[0406] In comparison, the residual risk R″ ≈ 0.437 when simulating the removal of the segment corresponding to D2-A is also lower than R. safe However, removing D2-A would result in a greater loss of project information and a higher overall cost; therefore, the system chose to remove the budget fragment corresponding to D2-B from the current prompt, isolate its corresponding vector entry, clean up the relevant cached copies, and regenerate the answer.

[0407] VIII. Simulation Verification Example.

[0408] A simulation test set containing 300 sets of AI processing chain samples was constructed, including 120 sets of repeated recall scenarios (covering model retry, cache reuse, and overlapping slicing), 100 sets of combined input scenarios (covering multiple low-risk segments forming sensitive relationships), and 80 sets of local processing scenarios. The baseline scheme was a solution that performs keyword and entity detection based solely on the current input and output, and adopts either overall allowance or overall blocking. The repeated contribution calculation rate was defined as the proportion of source contribution records repeatedly counted as risk out of the total number of source contribution records; the combined relationship false negative rate was defined as the proportion of the number of unidentified preset combined sensitive relationships out of the total number of preset combined sensitive relationships; and the local fence processing accuracy rate was defined as the proportion of samples that, after processing, eliminated both excessive risk and did not mistakenly harm normal content out of the total number of processed samples. The simulation results are shown in Table 2.

[0409] Table 2: Simulation Results

[0410]

[0411] To ensure the recalculation of the proportions in Table 2, a fixed random seed of 20260918 was used to generate scenarios; 300 sets were used for the number of scenario sets. Since each set could generate multiple records, the three indicators used independent denominators: total number of duplicate contribution records: 1000, with 318 duplicates counted in the baseline and 87 duplicates counted in the present invention; total number of preset combination relationships: 1000, with 274 missed by the baseline and 92 missed by the present invention; total number of local treatment samples: 1000, with 685 accurately treated by the baseline and 897 accurately treated by the present invention.

[0412] As shown in the table above, compared with the baseline scheme, the repetitive contribution calculation rate of the present invention decreased from 31.8% to 8.7%, a relative reduction of approximately 72.6%; the misjudgment rate of combination relationships decreased from 27.4% to 9.2%, a relative reduction of approximately 66.4%; and the accuracy rate of local fence handling increased from 68.5% to 89.7%, an increase of approximately 21.2 percentage points. This quantitatively demonstrates the technical effectiveness of the present invention in suppressing repetitive calculations, detecting combination recovery risks, and supporting precise handling.

[0413] like Figure 2 As shown, a data security fence system based on source contribution and combined recovery includes: an event and lineage processing module 200, a sensitivity identification and propagation module 210, a source contribution ledger module 220, a combined recovery module 230, a risk and evidence processing module 240, and a fence decision module 250.

[0414] Among them, the event and lineage processing module 200 is used to collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes and their temporal lineage relationships, and generate logical event idempotent keys;

[0415] Sensitive identification and propagation module 210 is used to establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event condition propagation operators and candidate source contributions;

[0416] The source contribution ledger module 220 is used to perform idempotent merging of repeated execution records with the same idempotent key for logical events, and to perform deduplication of the same source path based on the degree of overlap of observable features between the propagation path and the evidence union formed by the previously processed propagation path;

[0417] The combined recovery module 230 is used to determine the input set that actually enters the same aggregation context, identify the newly added sensitive relationship formed by the input set that is not fully contained by any single input data version, and generate effective combined recovery superedges and combined contributions.

[0418] The risk and evidence processing module 240 is used to calculate risk based on direct sensitivity, inherited sensitivity, combined contribution and exposure factors, and to generate evidence subgraphs based on the marginal contribution of candidate evidence items.

[0419] The fence decision module 250 is used to simulate the remaining risks after the implementation of candidate fence actions, and to execute the candidate fence action that satisfies the safety conditions and minimizes the overall disposal cost.

[0420] It should be understood that Figure 2 The modules and references described in the document Figure 1 The steps described in the text correspond to those in the method described above. Therefore, the operations, features, and corresponding technical effects described above also apply to the method described in the text. Figure 2 The various modules in the document will not be described in detail here.

[0421] In other embodiments, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the data security fence method based on source contribution and combined recovery in any of the above method embodiments.

[0422] S1. Collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes, and the temporal lineage relationship between the data version nodes and the processing event nodes, and assign root source identifiers to source data units;

[0423] S2. Establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event condition propagation operators for processing events and sensitive categories based on the mapping relationship between the sensitive data knowledge graph and the data version node and processing event node.

[0424] S3. Using the root source identifier, sensitive fact identifier, and propagation path identifier as the propagation state, starting from the fact-level direct sensitivity, the candidate source contribution is recursively calculated event by event along the temporal lineage using the event conditional propagation operator.

[0425] S4. Write the candidate source contributions into the source contribution ledger. For repeated execution records with the same logical event idempotency key, perform idempotency merging. For multiple propagation paths with different logical event idempotency keys but the same root source identifier and sensitive fact identifier, perform homologous path deduplication based on the observable feature overlap between the evidence union formed by the current propagation path and the previously processed propagation paths, and fuse the deduplicated contributions to obtain the ordinary propagation contribution.

[0426] S5. For an aggregation processing event with multiple input data versions, determine the set of inputs that actually enter the same aggregation context, and determine whether the input set jointly forms a new sensitive relationship that is not completely contained by any single input data version; if the preset combination judgment condition is met, generate a valid combination recovery hyperedge and determine the combination contribution; if the preset combination judgment condition is not met, do not generate a valid combination recovery hyperedge and retain the ordinary propagation contribution.

[0427] S6. Calculate the risk of the target data version based on the direct sensitivity, inherited sensitivity, combined contribution, and exposure factors; collect direct identification evidence, general propagation contribution, and effective combination recovery hyperedge from the target data version in reverse; select the evidence subgraph based on the marginal contribution of candidate evidence items; simulate the remaining risk after the candidate fence action is implemented, and execute the candidate fence action that meets the safety conditions and has the lowest overall disposal cost.

[0428] Computer-readable storage media may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created based on the use of a data security fence system based on source contribution and combined recovery. Furthermore, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include memory remotely configured relative to a processor, which can be connected via a network to a data security fence system based on source contribution and combined recovery. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0429] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 3As shown, the device includes a processor 310 and a memory 320. The electronic device may also include an input device 330 and an output device 340. The processor 310, memory 320, input device 330, and output device 340 can be connected via a bus or other means. Figure 3 Taking a bus connection as an example, the memory 320 is the computer-readable storage medium described above. The processor 310 executes various server functions and data processing by running non-volatile software programs, instructions, and modules stored in the memory 320, thereby implementing the data security fence method based on source contribution and combined recovery as described in the above method embodiment. The input device 330 can receive input digital or character information and generate key signal inputs related to user settings and function control of the data security fence system based on source contribution and combined recovery. The output device 340 may include a display device such as a screen.

[0430] The aforementioned electronic device can execute the method provided in the embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the method provided in the embodiments of the present invention.

[0431] In one implementation, the above-described electronic device is applied to a data security fence system based on source contribution and combined recovery, for a client, and includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0432] S1. Collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes, and the temporal lineage relationship between the data version nodes and the processing event nodes, and assign root source identifiers to source data units;

[0433] S2. Establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event condition propagation operators for processing events and sensitive categories based on the mapping relationship between the sensitive data knowledge graph and the data version node and processing event node.

[0434] S3. Using the root source identifier, sensitive fact identifier, and propagation path identifier as the propagation state, starting from the fact-level direct sensitivity, the candidate source contribution is recursively calculated event by event along the temporal lineage using the event conditional propagation operator.

[0435] S4. Write the candidate source contributions into the source contribution ledger. For repeated execution records with the same logical event idempotency key, perform idempotency merging. For multiple propagation paths with different logical event idempotency keys but the same root source identifier and sensitive fact identifier, perform homologous path deduplication based on the observable feature overlap between the evidence union formed by the current propagation path and the previously processed propagation paths, and fuse the deduplicated contributions to obtain the ordinary propagation contribution.

[0436] S5. For an aggregation processing event with multiple input data versions, determine the set of inputs that actually enter the same aggregation context, and determine whether the input set jointly forms a new sensitive relationship that is not completely contained by any single input data version; if the preset combination judgment condition is met, generate a valid combination recovery hyperedge and determine the combination contribution; if the preset combination judgment condition is not met, do not generate a valid combination recovery hyperedge and retain the ordinary propagation contribution.

[0437] S6. Calculate the risk of the target data version based on the direct sensitivity, inherited sensitivity, combined contribution, and exposure factors; collect direct identification evidence, general propagation contribution, and effective combination recovery hyperedge from the target data version in reverse; select the evidence subgraph based on the marginal contribution of candidate evidence items; simulate the remaining risk after the candidate fence action is implemented, and execute the candidate fence action that meets the safety conditions and has the lowest overall disposal cost.

[0438] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0439] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data security fence method based on source contribution and combined recovery, characterized in that, Includes the following steps: S1. Collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes, and the temporal lineage relationship between the data version nodes and the processing event nodes, and assign root source identifiers to source data units; S2. Establish a sensitive data knowledge graph, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event condition propagation operators for processing events and sensitive categories based on the mapping relationship between the sensitive data knowledge graph and the data version node and processing event node. S3. Using the root source identifier, sensitive fact identifier, and propagation path identifier as the propagation state, starting from the fact-level direct sensitivity, the candidate source contribution is recursively calculated event by event along the temporal lineage using the event conditional propagation operator. S4. Write the candidate source contributions into the source contribution ledger. For repeated execution records with the same logical event idempotency key, perform idempotency merging. For multiple propagation paths with different logical event idempotency keys but the same root source identifier and sensitive fact identifier, perform homologous path deduplication based on the observable feature overlap between the evidence union formed by the current propagation path and the previously processed propagation paths, and fuse the deduplicated contributions to obtain the ordinary propagation contribution. S5. For an aggregation processing event with multiple input data versions, determine the set of inputs that actually enter the same aggregation context, and determine whether the input set jointly forms a new sensitive relationship that is not completely contained by any single input data version; if the preset combination judgment condition is met, generate a valid combination recovery hyperedge and determine the combination contribution; if the preset combination judgment condition is not met, do not generate a valid combination recovery hyperedge and retain the ordinary propagation contribution. S6. Calculate the risk of the target data version based on the direct sensitivity, inherited sensitivity, combined contribution, and exposure factors; collect direct identification evidence, general propagation contribution, and effective combination recovery hyperedge from the target data version in reverse; and select the evidence subgraph based on the marginal contribution of candidate evidence items. Simulate the remaining risks after the implementation of candidate fence actions, and execute the candidate fence action that meets safety conditions and minimizes the overall disposal cost.

2. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, The processing event record includes multiple items from the following: event identifier, event type, set of input data version identifiers, set of output data version identifiers, execution component, actual parameter summary, model or algorithm version, execution subject, execution time, input / output local mapping, and call chain identifier; The logical event idempotent key is generated based on the tenant identifier, session identifier, parent call identifier, event type, sorted set of input data version identifiers, model or algorithm version, and parameter summary. The retry sequence number, physical execution instance identifier, and execution time are not involved in the generation of the logical event idempotent key.

3. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, Perform one or more of the following processes on the data version node: format rule matching, sensitive entity identification, sensitive relationship identification, and semantic context identification, to obtain the direct sensitivity, and generate the sensitive fact identifier and direct identification evidence for the identified entities, attributes, or relationships; The event conditional propagation operator is instantiated based on two or more of the following: event type, actual parameters, model or algorithm version, input-output local mapping, execution subject, permission status, and network boundary. The candidate source contribution is recursively calculated based on the source contribution of the previous propagation layer, the event conditional propagation operator, and the event evidence confidence. The event evidence confidence is determined based on one or more of the following: source identifier completeness, input-output local mapping completeness, call chain completeness, and third-party component association evidence.

4. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, For multiple propagation paths corresponding to the same target data version, the same sensitive category, the same root source identifier, and the same sensitive fact identifier, they are sorted according to the preset order of candidate source contribution from high to low, event evidence confidence from high to low, propagation path length from short to long, and propagation path identifier, in order to form a deterministic and stable order. For the sorted i-th propagation path, calculate its overlap and independence increment relative to the evidence union formed by the previously processed propagation paths. The calculation formula is as follows: ； Where x represents the evidentiary feature, O i α is the set of evidence features that can be actually computed or mapped between the current propagation path and the union of evidence formed by previously processed propagation paths. x For the weight of the evidence features, r x,i The degree of overlap between the current transmission path and the corresponding evidentiary features; The evidence features include one or more of event edge features, root source location features, and cached source features; evidence features that are missing or cannot be mapped to the same coordinate system do not participate in the overlap calculation; when the evidence feature set is empty or the evidence coverage is insufficient, the candidate source contribution is not deducted based on the overlap, and the corresponding propagation path is marked as pending review.

5. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, The aggregation processing events include prompt word assembly events, tool result summary events, cross-round memory splicing events, or data aggregation events; Based on the event logs and input / output local mappings of the aggregated processing events, it is determined whether the input data versions actually enter the same aggregation context, and only the input data versions with event log evidence and input / output local mapping evidence are added to the input set; The preset combination judgment condition includes: the single input risk of each input data version in the input set is lower than the preset single input threshold when there is no combination contribution. The input set matches the sensitive relation template; the candidate object set before combination is not empty, and the number of candidates in the candidate object set after combination is reduced or the candidate constraints are enhanced compared to the candidate object set before combination; and the sensitive relations jointly supported by the input set are not completely contained by any single version of the input data. When the set of candidate objects before combination is empty, or when the set of candidate objects after combination undergoes an invalid expansion relative to the set of candidate objects before combination, no valid combination recovery superedge is generated, and the corresponding combination contribution is determined to be zero.

6. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, The inherited sensitivity is the sensitivity obtained after sequentially performing logical event idempotent merging, deduplication of propagation paths corresponding to the same root source identifier and sensitive fact identifier, and contribution group fusion for candidate source contribution records of the same target data version and the same sensitive category, and does not include direct sensitivity and the combined contribution. The exposure factors include two or more of the following: processing stage, destination, receiving subject, operation type, model capability, and permission status, which are obtained based on one or more of the following: processing event records, network boundary records, identity authentication records, model capability configuration, and permission verification records. The candidate evidence items include one or more of the following: direct identification evidence that can be independently removed and used to recalculate sensitivity or risk, general propagation contribution groups, and effective combination recovery hyperedges. The interpretation coverage of the evidence subgraph is determined using the same sensitive category weight normalization method and bounded fusion method as the risk calculation.

7. The data security fence method based on source contribution and combined recovery according to claim 1, characterized in that, The candidate fence actions include one or more of the following: local field desensitization, removing prompt word input fragments and regenerating them, isolating vector entries, clearing cached copies, revoking sharing permissions, denying tool calls, and blocking outgoing data. When simulating candidate fence actions, affected common propagation contributions or effective combination recovery superedges are marked as invalid, and the affected downstream derived data versions are determined along the temporal lineage. The overall processing cost is determined based on the information loss, additional delay, and scope of impact caused by the candidate fence action; When the input set of sensitive identification rules, event conditional propagation operators, authorization status, or aggregation processing events changes, the inverse index established by the superedge is restored based on the source contribution ledger and valid combinations, and incremental recalculation is performed on the affected data version and its downstream derived data version.

8. A data security fence system based on source contribution and combined recovery, used to implement the method according to any one of claims 1 to 7, characterized in that, include: The event and lineage processing module is used to collect processing event records in the artificial intelligence processing chain, establish data version nodes, processing event nodes and their temporal lineage relationships, and generate logical event idempotent keys; The Sensitive Data Identification and Propagation Module is used to build a knowledge graph of sensitive data, obtain the direct sensitivity, sensitive category identifier, sensitive fact identifier and direct identification evidence corresponding to the data version node, and generate event conditional propagation operators and candidate source contributions. The source contribution ledger module is used to perform idempotent merging of repeated execution records with the same idempotent key for logical events, and to perform deduplication of the same source path based on the degree of overlap of observable features between the propagation path and the evidence union formed by the previously processed propagation path; The combined recovery module is used to determine the input set that actually enters the same aggregation context, identify the newly added sensitive relationship formed by the input set that is not fully contained by any single input data version, and generate effective combined recovery superedges and combined contributions. The risk and evidence processing module is used to calculate risk based on direct sensitivity, inherited sensitivity, combined contribution, and exposure factors, and to generate evidence subgraphs based on the marginal contribution of candidate evidence items. The fence decision module is used to simulate the remaining risks after the implementation of candidate fence actions, and to execute the candidate fence action that satisfies the safety conditions for the remaining risks and has the lowest overall disposal cost.

9. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method according to any one of claims 1 to 7.

Images