Data desensitization security enhancement and watermark tracing method and system

Abstract

The application provides a data desensitization security enhancement and watermark tracing method and system. The application performs synonym watermark replacement and punctuation format replacement on the desensitized Prompt, and residual risk comprehensive scoring and routing selection; performs security detection and blocking processing on the response text returned by the large model; encrypts, multi-round overwrites, memory unlocks and deletes persistent encrypted files on the mapping table of placeholders and original entities, and generates destruction audit credentials; and performs leakage tracing when the desensitized Prompt is leaked. The application embeds double-layer watermarks in the non-sensitive text part of the desensitized Prompt, so that each desensitized Prompt carries a unique session-level identifier. When tracing, the watermark vector is extracted from the leaked text, and the Hamming distance K-NN search is matched. When a data leakage event occurs, the specific session, user identity and API endpoint where the leakage occurs are accurately located through watermark tracing.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data desensitization security enhancement and watermark tracing method, system, electronic device, and computer storage medium. Background Technology

[0002] With the rapid development of large language model APIs (Application Programming Interfaces), users commonly upload business-sensitive prompts (prompt words, request texts) to third-party cloud-based large models for inference, which poses a risk of leakage of sensitive personal / organizational data such as user names, ID cards, bank cards, medical records, and corporate business information.

[0003] Existing technologies primarily employ placeholder-based anonymization schemes to address the aforementioned issues. This involves identifying sensitive entities in the text using Named Entity Recognition (NER) and regular expressions, replacing the original private content with type-identified placeholders, and then restoring the original entities using a local mapping table after the cloud-based large language model returns the response text. While this basic anonymization solution prevents the original plaintext from directly leaking out of the enterprise intranet, it suffers from a lack of multi-layered security protection in scenarios involving end-to-end transmission, cloud inference, session retention, and leak tracing for third-party LLM (Large Language Model) APIs. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a data desensitization security enhancement and watermark tracing method, system, electronic device, and computer storage medium, effectively reducing the risk of sensitive data leakage.

[0005] In a first aspect, the present invention provides a method for enhancing data desensitization security and watermarking for tracing origins, comprising:

[0006] Sensitive entities are identified in the original Prompt issued by the agent, and the sensitive entities are replaced with placeholders carrying entity type identifiers to obtain the first desensitized Prompt;

[0007] The non-sensitive areas of the first desensitized Prompt are replaced with synonym watermarks and punctuation formatting to generate a second desensitized Prompt carrying an implicit watermark of the session identity.

[0008] Calculate a residual risk comprehensive score for the residual privacy risk of the second de-identified Prompt, and route the second de-identified Prompt to the large model for inference based on the residual risk comprehensive score;

[0009] Placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection are performed on the natural language response text returned by the large model to obtain a comprehensive response risk score, and risk level classification and blocking processing are performed based on the comprehensive response risk score;

[0010] A session encryption key is derived based on the current session ID and user ID. The session encryption key is used to encrypt the mapping table between storage placeholders and sensitive entities. The desensitization and restoration operations are retained in the hashed audit log. After the session ends, multiple rounds of overwriting, memory unlocking and deletion of persistent encrypted files are performed on the memory mapping table, and destruction audit credentials are generated.

[0011] When the second de-identified Prompt is leaked, the synonym index vector and punctuation format feature vector of the leaked text are extracted, concatenated to generate a query binary vector, and a candidate leaked session set is obtained based on the binary vector similarity retrieval; a watermark secondary matching verification is performed on the candidate leaked sessions, the target leaked session is selected, the session ID and user identifier of the target leaked session are parsed, and a complete leak tracing report is output in combination with the audit log.

[0012] Secondly, the present invention provides a data desensitization security enhancement and watermark tracing system, comprising:

[0013] The desensitization processing module is used to identify sensitive entities in the original Prompt issued by the intelligent agent and replace the sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt.

[0014] The watermark embedding module is used to replace the non-sensitive areas of the first desensitized Prompt with synonym watermarks and punctuation format replacements to generate a second desensitized Prompt carrying an implicit watermark of the session identity.

[0015] The privacy risk routing module is used to calculate a residual risk comprehensive score for the residual privacy risk of the second de-identified Prompt, and to route the second de-identified Prompt to the large model for inference based on the residual risk comprehensive score;

[0016] The response security detection and blocking module is used to perform placeholder semantic association leakage detection, abnormal entity aggregation detection and cross-document enhancement detection on the natural language response text returned by the large model, obtain a comprehensive response risk score, and perform risk level classification and blocking processing based on the comprehensive response risk score;

[0017] The mapping table management module derives a session encryption key based on the current session ID and user ID, uses the session encryption key to encrypt the mapping table storing placeholders and sensitive entities, retains hashed audit logs for desensitization and restoration operations, and performs multiple rounds of overwriting, memory unlocking and deletion of persistent encrypted files on the memory mapping table after the session ends, and generates destruction audit credentials.

[0018] The source tracing module is used to extract the synonym index vector and punctuation format feature vector of the leaked text when the second de-identified Prompt is leaked, concatenate them to generate a query binary vector, retrieve a set of candidate leaked sessions based on the similarity of the binary vectors, perform secondary watermark matching verification on the candidate leaked sessions, filter out the target leaked sessions, parse the session ID and user identifier of the target leaked sessions, and output a complete leak source tracing report in combination with the audit logs.

[0019] Thirdly, the present invention provides an electronic device, comprising:

[0020] At least one processor;

[0021] and a memory communicatively connected to the at least one processor;

[0022] The memory stores a computer program that can be executed by the at least one processor, and when the computer program is executed by the at least one processor, it implements the data desensitization security enhancement and watermark tracing method.

[0023] Fourthly, the present invention provides a computer storage medium storing a computer program, which, when executed by a processor, implements the data desensitization security enhancement and watermark tracing method.

[0024] The beneficial technical effects of this invention are as follows:

[0025] This application embeds a double-layer watermark in the non-sensitive text portion of the de-identified Prompt, ensuring each de-identified Prompt carries a unique session-level identifier, providing an essential feature data source for tracing subsequent leakage events. It differentiates scheduling based on the actual residual leakage risk of the de-identified Prompt, reducing the probability of privacy leakage from the source of the call. Simultaneously, it performs placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection on the natural language response text returned by the large model, calculating the comprehensive risk score of the response, and carrying out risk level classification and blocking processing, overcoming the technical shortcomings of only de-identifying the input and ignoring the possibility of reverse-engineering sensitive entities in the large model's inference. It uses session-derived keys to achieve key isolation between sessions, preventing a single session leak from affecting the entire system. It records every de-identification and restoration operation through hashed audit logs, and securely destroys persistent encrypted files in memory and on disk after the session ends, retaining destruction credentials to prevent the mapping table from being stolen and leading to reverse engineering of the entire de-identified data. When the de-identified Prompt... When a leak occurs, the system extracts the synonym index vector and punctuation format feature vector from the leaked text to construct a query binary vector. Target leaked sessions are then filtered through similarity retrieval and secondary watermark matching verification. Combined with hash audit logs, a source tracing report is output. In security scenarios where anonymized Prompt data is leaked, the system can accurately locate the corresponding session, user, and API call chain, enabling security incident location and accountability. The entire technical solution achieves a complete security enhancement closed loop, including pre-emptive anonymization watermark implantation, in-process residual risk tiered routing, output-side leakage protection, full lifecycle security management of high-risk mapped assets, and post-incident leakage watermark tracing. This provides end-to-end privacy protection for sensitive Prompt data while meeting compliance requirements for security auditing and leak incident location and accountability. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the method of an embodiment of the present invention;

[0027] Figure 2 This is a structural framework diagram of the system according to an embodiment of the present invention;

[0028] In the diagram, 10 is the desensitization module; 20 is the watermark embedding module; 30 is the privacy risk routing module; 40 is the response security detection and blocking module; 50 is the mapping table management module; and 60 is the source tracing module. Detailed Implementation

[0029] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings:

[0030] Reference Figure 1 As shown, one embodiment of this application provides a data desensitization security enhancement and watermark tracing method, including:

[0031] S1: The original Prompt issued by the agent is processed to identify sensitive entities, and these sensitive entities are replaced with placeholders carrying entity type identifiers, resulting in the first de-identified Prompt. This step achieves sensitive entity de-identification: The original Prompt is received, and NER (Named Entity Recognition) and regular expression matching are used to identify sensitive entities; necessary entities for querying and ordinary sensitive entities are distinguished; ordinary sensitive entities are replaced with placeholders carrying entity type identifiers, and the first de-identified Prompt is output. Required entities for querying are subsequently forced to be routed to the local model.

[0032] S2: Perform synonym watermark replacement and punctuation format replacement on the non-sensitive areas of the first desensitized Prompt to generate a second desensitized Prompt carrying an implicit watermark of the session identity. This step achieves session-level two-layer implicit watermark embedding: construct a synonym candidate library and a punctuation format candidate library; generate a session key from the session ID, user ID, and master key using HKDF-SHA256; only in the non-sensitive text areas of the first desensitized Prompt, use the session key to generate a random sequence, perform synonym replacement watermarking and punctuation format watermarking, and generate a second desensitized Prompt carrying an implicit watermark of the session identity. The watermark does not destroy the semantics and is invisible to the naked eye.

[0033] S3: Calculate a residual risk comprehensive score for the residual privacy risk of the second de-identified Prompt, and route the second de-identified Prompt to the large model for inference based on the residual risk comprehensive score. This step implements the residual privacy risk comprehensive score and model routing: if there is a necessary entity tag for the query, directly force routing to the local large model; calculate the residual risk comprehensive score based on the weighted average of information masking degree, entity type sensitivity, and entity relevance; and route according to the score into three levels: low risk to the public cloud LLM-API; medium risk to the trusted API with signed DPA; and high risk to the local large model for inference.

[0034] S4: Perform placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection on the natural language response text returned by the large model to obtain a comprehensive response risk score. Based on the comprehensive response risk score, risk level classification and blocking processing are performed. This step implements LLM response security detection and graded blocking: Perform triple detection on the response text returned by the large model: ① placeholder semantic association leakage detection; ② abnormal entity aggregation detection; ③ cross-document enhancement detection; calculate the comprehensive response risk score and classify it into three risk levels: low risk: restore all placeholders; medium risk: restore only low-sensitivity fields, keep high-sensitivity fields de-identified and issue an alert; high risk: directly block restoration and return the un-de-identified text.

[0035] S5: Derive a session encryption key based on the current session ID and user ID. Use the session encryption key to encrypt the mapping table between storage placeholders and sensitive entities. Desensitization and restoration operations are recorded in hashed audit logs. After the session ends, perform multiple rounds of overwriting, memory unlocking, and deletion of persistent encrypted files on the memory mapping table, and generate destruction audit credentials. This step achieves mapping table encryption, auditing, and secure destruction: A session encryption key is derived using HKDF-SHA256; the "original entity-placeholder-entity type" mapping table is encrypted using AES-256-GCM; desensitization and restoration operations are recorded in hashed audit logs; after the session ends, memory is overwritten and unlocked multiple times to release memory; disk files are securely deleted according to NIST standards (multiple rounds of overwriting for HDDs, ATASecure Erase for SSDs), and destruction audit credentials are generated.

[0036] S6: When the second de-identified Prompt is leaked, extract the synonym index vector and punctuation format feature vector of the leaked text, concatenate them to generate a query binary vector, and retrieve a set of candidate leaked sessions based on the similarity of the binary vectors; perform secondary watermark matching verification on the candidate leaked sessions, filter out the target leaked sessions, parse the session ID and user identifier of the target leaked sessions, and output a complete leak tracing report based on the audit logs. This step achieves watermark tracing of the leak event: obtain the leaked text, clean and extract the synonym index vector and punctuation format feature vector, and encode them into a binary query vector; use Hamming distance K-NN to retrieve candidate sessions in the vector library; perform weighted matching calculation to calculate the comprehensive matching degree, and filter the target leaked sessions; decode to obtain the session ID and user hash, and output a complete tracing report based on the audit logs; support brute-force traversal degradation when the vector library fails.

[0037] This embodiment of the data anonymization security enhancement and watermark tracing method features interconnected steps, with the output of each preceding step serving as the input for subsequent steps. It constructs a complete security closed loop for large language model API call scenarios, encompassing pre-emptive anonymization and watermark implantation, residual risk tiered routing, response-side leakage blocking, full lifecycle security management of the mapping table, and post-leakage tracing and accountability. This addresses the problems of existing simple placeholder anonymization schemes, such as lack of post-anonymization risk management, susceptibility to large model inference responses, lack of secure mapping table destruction, and inability to trace and hold individuals accountable after a leak. It ensures that businesses can normally call large model APIs to complete inference tasks while achieving end-to-end privacy protection for sensitive data, and simultaneously meets the compliance requirements for security auditing and leakage incident tracing.

[0038] In this embodiment, step S1 includes:

[0039] S11: Receives the original Prompt from the agent and identifies sensitive entities within the original Prompt through named entity recognition and regular expression matching.

[0040] In this embodiment, a local NER deep learning model and a regular expression rule base are used in parallel to identify sensitive entities within the original Prompt, wherein: sensitive entities are identified by the local NER deep learning model; and sensitive fields with fixed formats are matched by the regular expression rule base.

[0041] S12: Divide the sensitive entities into query-required entities and ordinary sensitive entities.

[0042] In this embodiment, a predefined list of query key entity types is defined as {ID card number, social security number, order number, mobile phone number, bank card number}. If the identified entity is in the query key entity type list, contextual semantic analysis is performed to determine the entity's role, i.e.:

[0043] Extract the semantic pattern of the sentence containing the entity, match it with the query intent pattern library. If the semantic role of the entity is a query key, then edit the corresponding entity as a query required entity; if the semantic role of the entity is a descriptive attribute, then treat the corresponding entity as a normal sensitive entity.

[0044] S13: Perform format-preserving encryption or reversible desensitization on entities required for the query, retaining the necessary format information. While ensuring the normal execution of the intelligent agent's query business, ensure that the complete plaintext does not appear in the desensitized Prompt. The desensitization results and associated identifiers corresponding to the entities required for the query are included in the mapping table management and audit log. Replace ordinary sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt. High-sensitivity entities such as ID cards and bank cards are required for the query. Perform format-preserving encryption (FPE) / reversible desensitization (such as retaining the first 3 and last 4 middle masks) on these entities. Local LLM can still perform partial inference, but the plaintext does not appear in the Prompt and is included in the mapping table management and audit log.

[0045] In this embodiment, step S2 includes:

[0046] S21: Pre-build a candidate library of synonyms and a candidate library of punctuation formats. The candidate library of synonyms contains multiple sets of semantically equivalent synonyms, and replacement does not change the original semantics of the Prompt. The candidate library of punctuation formats contains multiple types of semantically equivalent punctuation formats.

[0047] In this embodiment, the synonym candidate library includes multiple sets of synonyms, and each set of synonyms has at least 3 semantically equivalent synonyms.

[0048] For example: "Please review" Please review "Please verify";

[0049] "Supplier's legal representative" "Supplier's legal representative" "Supply legal entity".

[0050] Each set of synonyms Represented as: ;in, For the first Synonyms.

[0051] S22: Based on the session ID and user ID, and combined with the system master watermark key, the session watermark key and session encryption key are derived respectively using the HKDF-SHA256 algorithm with different info context strings. The system master watermark key is stored in HSM or KMS, supports key versioning, and the key_version field is stored in the session record. Two types of keys are derived respectively using the HKDF-SHA256 algorithm with different info strings; the system master watermark key is stored in HSM or KMS and supports versioning (key_version) for easy rotation and traceability.

[0052] Right now:

[0053] ;

[0054] In the formula, For session key; The algorithm is HKDF-SHA256. This is the system's master watermark key; , These are the session ID and the user ID, respectively.

[0055] S23: Perform word segmentation on the first desensitized Prompt, filter out non-sensitive text regions, and extract all watermarkable embedding candidate points within the non-sensitive text regions.

[0056] In this embodiment, all sensitive areas containing placeholders are filtered out, and only plain natural text without placeholders is retained as the watermark embedding area.

[0057] Extract all candidate synonyms of the first de-identified Prompt from its plain natural text. and all punctuation candidate positions .

[0058] S24: Generate a one-time random nonce. Concatenate the session watermark key with the nonce as the seed for the HMAC-DRBG cryptographic pseudo-random number generator to generate a pseudo-random number sequence. The nonce is stored in the backup Prompt for traceability verification. Each embedding generates a one-time random nonce, using the "watermark key || nonce" as the HMAC-DRBG seed. The nonce is stored in the backup Prompt. If the master key is leaked, the historical watermark cannot be forged because the nonce is unknown.

[0059] S25: Based on the pseudo-random number sequence, synonym watermark replacement and punctuation format watermark replacement are sequentially performed in the non-sensitive text area of ​​the first desensitized Prompt to generate a second desensitized Prompt carrying an implicit watermark of the session identity.

[0060] In this embodiment, HKDF-SHA256 and HMAC-DRBG are exemplary cryptographic algorithms; the system master watermark key is exemplaryly stored in an HSM or KMS key management facility. Here, `info` is a context string used to distinguish different key uses during the key derivation process; `key_version` is the system master watermark key version identifier recorded in the session log, used for key tracing in key rotation scenarios. `nonce` represents a one-time random number, a cryptographically secure random number, which is only stored in conjunction with a locally archived copy of the backup Prompt and is not embedded in a second desensitized Prompt output to the large model API; the backup Prompt is a copy of the Prompt archived internally within the session, used for auditing and leakage tracing verification. The session watermark key and the one-time random number are concatenated to obtain a composite seed input to the pseudo-random number generator. The output pseudo-random number sequence is used to control the watermark replacement selection logic for synonyms and punctuation formats in non-sensitive areas; watermark replacement is only performed in non-sensitive text areas, and the desensitized areas corresponding to placeholders are not modified to avoid destroying the desensitization semantics.

[0061] In this embodiment, each candidate synonym of the first de-identification Prompt is traversed sequentially. And obtain synonym candidate points from the synonym candidate library. The set of synonyms is used, and a random number is obtained from a pseudo-random number sequence. The corresponding synonym is selected from the set of synonyms to replace the original word in the first desensitized Prompt.

[0062] In this embodiment, each candidate punctuation position of the desensitization Prompt is traversed sequentially. Then, select the corresponding punctuation or text format from the punctuation format candidate library, and replace the original punctuation or original format in the first desensitization Prompt with the corresponding punctuation or text format selected according to the random number.

[0063] Further, in one embodiment, step S3 includes:

[0064] S31: If the second de-identified Prompt carries the entity tag required for the query, then skip the residual privacy risk score and force the second de-identified Prompt to be routed to the local large model for inference.

[0065] S32: If the entity tag required for the query is not carried, the residual risk comprehensive score is obtained by weighted summation of the information masking score, entity type sensitivity score and entity relevance score based on the second de-identification Prompt.

[0066] In this embodiment, the information masking score is... Represented as:

[0067] ;

[0068] In the formula, For information masking, The total number of sensitive entity words replaced by placeholders; This represents the total number of words in the original Prompt before desensitization. This is the information masking weight coefficient.

[0069] In this embodiment, the entity type sensitivity score Represented as:

[0070] ;

[0071] In the formula, The average sensitivity of the entity; For the first The type sensitivity score of each sensitive entity This represents the total number of sensitive entities identified through de-identification. This is the weighting coefficient for the average sensitivity of the entity.

[0072] In this embodiment, the entity relevance score Represented as:

[0073] ;

[0074] In the formula, For entity relevance; For the first The association weight of each semantic role; For the first The type sensitivity score of each sensitive entity.

[0075] In this embodiment, the type sensitivity score of the sensitive entity and the association weight of the semantic role can be queried according to Table 1.

[0076] Table 1. Sensitivity scores of sensitive entities and association weights of semantic roles.

[0077]

[0078] The residual risk comprehensive score Represented as:

[0079] .

[0080] S33: Based on the residual risk comprehensive score's score range, route to the corresponding security level of the large model for inference. The large model includes the cloud-based large model LLM API, the trusted large model LLM API that has signed the DPA protocol, and the local large model. Specifically, based on the residual risk comprehensive score... Select the appropriate route, including:

[0081] If the residual risk comprehensive score is greater than or equal to 0 and less than the first threshold, the de-identified Prompt carrying the implicit watermark of the session identity will be routed to the cloud-based large model LLM API.

[0082] In this embodiment, the first threshold is set to 30, that is... .

[0083] If the residual risk comprehensive score is greater than or equal to the first threshold and less than the second threshold, the de-identified Prompt carrying the session identity implicit watermark will be routed to the trusted large model LLM API endpoint that has signed the DPA protocol.

[0084] In this embodiment, the second threshold is set to 65, that is: .

[0085] If the residual risk comprehensive score is greater than or equal to the second threshold and less than or equal to 100, then the de-identified Prompt carrying the implicit watermark of the session identity will be routed to the local large model.

[0086] Further, in one embodiment, in step S4, placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection are performed on the natural language response text returned by the large model to obtain a comprehensive response risk score. Based on the comprehensive response risk score, risk level classification and blocking processing are performed, including:

[0087] S41: Perform placeholder semantic association leakage detection on the natural language response text, identify the mapping leakage patterns between placeholders and plaintext entities through preset regular expression pattern matching, and calculate the mapping leakage score. .

[0088] In this embodiment, the preset regular expression patterns include direct keyword disclosure templates, indirect inducement sentence templates, boundary detection sentence templates, placeholder natural language mapping templates, cross-document reasoning disclosure templates, and table key-value mapping templates.

[0089] The mapping leakage score Represented as:

[0090] ;

[0091] In the formula, To count the total number of templates that were hit; For the first Template matching confidence.

[0092] If no template is hit, the aforementioned mapping leakage score The mapping leakage score is 0. The higher the value, the greater the risk of placeholder leakage.

[0093] S42: Perform abnormal entity aggregation detection on the natural language response text to identify the set of sensitive entities that appear in plaintext in the natural language response text. And based on each sensitive entity The association preset sensitivity score is used to calculate the basic aggregation score, and the sensitive entity aggregation score is calculated based on the basic aggregation score, that is:

[0094] ;

[0095] ;

[0096] ;

[0097] In the formula, Aggregate scores for sensitive entities; Based on aggregated scores; The average sensitivity score for the entity; For quantity penalty items; Number of sensitive entities; For the first Sensitive entities The associated preset sensitivity score.

[0098] S43: Based on the number of input documents, the number of sensitive entities, and the semantic matching relationship between plaintext and placeholders, determine whether to activate cross-document augmentation detection, and reassign the sensitive entity aggregation score according to the activation status to obtain the final sensitive entity aggregation score. Specifically, this includes:

[0099] If the total number of input documents in the session is greater than or equal to 2, and there is 1 sensitive entity, and there is a semantic association match between plaintext entities and placeholders in the natural language response text, then cross-document augmented detection is activated.

[0100] If cross-document augmented detection is activated, the final sensitive entity aggregation score is assigned as follows: .

[0101] If cross-document augmentation detection is not activated, and there are 2 or more sensitive entities, the final aggregated score for sensitive entities will be assigned as follows: .

[0102] If cross-document augmentation detection is not activated and the number of sensitive entities is less than 2, the final aggregated score for sensitive entities will be assigned as follows: .

[0103] S44: Score based on mapping leakage Assigning scores to the final sensitive entities Calculate the overall risk score for the response. That is:

[0104] ;

[0105] In the formula, In response to the comprehensive risk score; , Scores for mapping leakage Assigning scores to the final sensitive entities The weighting coefficients.

[0106] Specifically, S45: Based on the comprehensive risk score of the response, the risk level is determined. For different risk levels, processing operations are performed respectively, including full placeholder restoration, partial desensitization and retention, or complete blocking and restoration. Furthermore, corresponding blocking processing is applied to the natural language response text according to different risk levels, including:

[0107] In this embodiment, if the overall risk score of the response is less than the first risk threshold, the wind direction level is determined to be LOW. Then, all placeholders in the natural language response text are restored, the detection result is recorded in the audit log, and there are no user alarms.

[0108] If the overall risk score of the response is greater than or equal to the first risk threshold and less than the second risk threshold, the risk level is determined to be MEDIUM. In this case, low-sensitivity placeholders such as amount and date in the natural language response text are restored, while high-sensitivity entity placeholders such as ID card, name, and bank card remain desensitized. A security risk alarm is pushed to the business user who initiated the request, and the alarm event is recorded simultaneously.

[0109] If the overall risk score of the response is greater than or equal to the second risk threshold, the risk level is determined to be HIGH, the placeholder restoration is completely blocked, and the unrestored desensitized response text is returned.

[0110] In some embodiments, the first risk threshold is set to 30, and the second risk threshold is set to 90.

[0111] Furthermore, in one embodiment, step S5 specifically includes:

[0112] S51: Derive the session encryption key based on the current session ID, user ID, and system global root key. That is:

[0113] ;

[0114] In the formula, Encrypt the session key; This is a key derivation function based on the SHA-256 hash function; This is the system's global root key; These are the current session ID and the user ID, respectively.

[0115] S52: Construct a plaintext mapping table in a protected memory buffer using the key-value pairs "original sensitive entity plaintext-placeholder-entity type". After performing AES-256-GCM encryption in memory, only the ciphertext is written to disk, and the plaintext is not written to disk. A 96-bit IV vector is generated using a cryptographic random number generator. The 96-bit IV vector, ciphertext, and authentication tag are persisted together. After performing AES-256-GCM encryption in memory, only the ciphertext is written to disk; the 96-bit IV, generated by the cryptographic random number generator, is persisted together with the ciphertext and authentication tag.

[0116] S53: Randomly generate GCM standard IV vectors and based on the session encryption key. The plaintext mapping table is encrypted to obtain the encrypted ciphertext mapping table. That is:

[0117] ;

[0118] In the formula, This is a mapping table for the encrypted ciphertext. For plaintext mapping table;

[0119] S54: An audit log is generated for each de-identification write to the mapping and response restoration read from the mapping.

[0120] After performing an irreversible hash on the user ID, the hash value of the user ID is stored in the audit log, along with the entity type, risk level, and operation type.

[0121] S55: After the session ends, the compiler-safe zeroing function (memset_s) is used to clear the plaintext and ciphertext mapping table buffers in memory, destroy the session encryption key to make persistent ciphertext unrecoverable (crypto-shredding), free memory pages, and generate destruction audit credentials. crypto-shredding: Destroying the session encryption key makes the ciphertext cryptographically unrecoverable; the compiler-safe memset_s function zeroes known buffers in memory and frees memory pages.

[0122] In some embodiments, the multi-round overwrite includes:

[0123] First round of overwriting: Use all zero bytes (0x00) to completely overwrite the plaintext and ciphertext mapping table buffer in memory;

[0124] Second round of overwriting: Use a full 1-byte 0xFF to completely overwrite the same memory buffer.

[0125] In this embodiment, the memory unlocking is: calling the release memory page function to unlock the memory page and release the memory resources.

[0126] In some embodiments, securely deleting persistent encrypted files based on NIST standards includes:

[0127] Perform NIST multi-round overwrite deletion on HDD hard drives.

[0128] For SSDs or flash memory media, additional ATA Secure Erase commands are executed.

[0129] In some embodiments, the destruction of audit credentials includes: session SID, destruction trigger timestamp, memory overwrite execution record, disk erase execution method, erase verification result, and operation process ID; the destruction of audit credentials is written to the audit log.

[0130] Furthermore, in one embodiment, step S6 specifically includes:

[0131] S61: Perform standardized cleaning on suspected leaked text. Based on the time of the leak, retrieve the thesaurus and punctuation format candidate library for the corresponding time period, and filter all placeholder areas in the leaked text through word segmentation.

[0132] S62: Traverse the cleaned text, match the current thesaurus candidate words, identify all thesaurus candidate points, and for each successfully matched candidate point, query the thesaurus index of the candidate point's words in the thesaurus set. Concatenate all thesaurus indexes in the order of the cleaned text to generate a thesaurus index vector. Each synonym index is encoded as a fixed 2-bit binary bit string, and then concatenated to obtain the L1 binary watermark vector.

[0133] S63: Traverse all candidate punctuation formats within the text, match them against the punctuation format candidate library, record the format index used for each punctuation position, concatenate all format indices in text order, and generate a punctuation feature vector. Each format index is encoded into a 2-bit binary bit string to generate an L2 binary feature vector.

[0134] S64: Concatenate the L1 binary watermark vector and the L2 binary feature vector to form a query binary vector. The data is padded or truncated to a fixed dimension (256-bit, with 0s used to pad any missing bits). The Faiss or Milvus binary vector index library is called, and Hamming distance is used as the similarity metric. When performing K-nearest neighbor retrieval, the contribution of padding bits is excluded. The result is a Top-K candidate set of historical session watermark vectors with the smallest Hamming distance. Different numbers of candidate points in different prompts result in varying vector lengths. Faiss / Milvus requires vectors in the library to be of equal length, and after concatenation, they are padded / truncated to a fixed 256 bits (padded with 0s if necessary). The contribution of padding bits is excluded during retrieval.

[0135] in, Indicates the first The complete binary watermark vector corresponding to each historical session; Indicates the first Each historical session is a unique session identifier; Indicates the first User hash digest for each historical session.

[0136] In this embodiment, the Hamming distance is represented as:

[0137] ;

[0138] In the formula, This represents the total bit length of the binary watermark vector.

[0139] S65: If the vector index service crashes or is damaged, it will automatically switch to the full session watermark brute-force comparison mode. After the index is restored, it will automatically switch back to K-NN fast retrieval.

[0140] S66: For each candidate session returned by the retrieval, obtain the complete watermark details of the candidate session, and compare the extracted synonym index of the leaked text with the original synonym index of the session point by point, and calculate the L1 matching degree. The L2 matching degree is calculated by comparing the format index with each punctuation mark. Weighted fusion L1 matching degree L2 matching degree Get the overall matching degree .Right now:

[0141] ;

[0142] ;

[0143] ;

[0144] In the formula, , These represent the number of current synonym candidate points that match consistently and the size of the intersection between leaked text candidate points and session candidate points, respectively. , These represent the number of matching punctuation candidate positions in the current candidate session and the total number of punctuation candidate positions, respectively. To match the number of consistent punctuation candidate positions and the size of the intersection between leaked text punctuation positions and session punctuation positions.

[0145] S67: Filter all overall match scores Candidate sessions with a match value greater than or equal to a preset matching threshold are selected, and the session with the highest overall match value is selected as the target leaked session. The target leaked session is then decoded to obtain the session ID and user hash identifier, and the real user who performed the operation is restored by matching the audit logs.

[0146] S68: Generate a complete leak tracing report based on the audit logs, leaked text samples, session information, operating users, API call chains, and risk levels extracted from the target leaked session.

[0147] like Figure 2 As shown, this embodiment provides a data desensitization security enhancement and watermark tracing system, including a desensitization processing module 10, a watermark embedding module 20, a privacy risk routing module 30, a response security detection and blocking module 40, a mapping table management module 50, and a tracing module 60.

[0148] In this embodiment, the desensitization processing module 10 is used to identify sensitive entities in the original Prompt issued by the intelligent agent, and replace the sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt. Specifically:

[0149] Receive the original Prompt from the agent and identify sensitive entities within the original Prompt through named entity recognition and regular expression matching.

[0150] In some embodiments, a local NER deep learning model and a regular expression rule base are used in parallel to identify sensitive entities within the original Prompt, wherein: sensitive entities are identified by the local NER deep learning model; and sensitive fields with fixed formats are matched by the regular expression rule base.

[0151] The sensitive entities are divided into entities required for querying and ordinary sensitive entities.

[0152] In some embodiments, a predefined list of query key entity types is provided: {ID card number, social security number, order number, mobile phone number, bank card number}. If the identified entity is in the query key entity type list, contextual semantic analysis is performed to determine the entity's role, i.e.:

[0153] Extract the semantic pattern of the sentence containing the entity, match it with the query intent pattern library. If the semantic role of the entity is a query key, then edit the corresponding entity as a query required entity; if the semantic role of the entity is a descriptive attribute, then treat the corresponding entity as a normal sensitive entity.

[0154] Perform format-preserving encryption or reversible desensitization processing on entities required for the query, retaining the format information required for the query so that the complete plaintext does not appear in the desensitized Prompt, and include the entities required for the query in the mapping table management and audit log; replace ordinary sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt.

[0155] In this embodiment, the watermark embedding module 20 is used to perform synonym watermark replacement and punctuation format replacement on the non-sensitive areas of the first desensitized Prompt to generate a second desensitized Prompt carrying an implicit watermark of session identity, specifically including:

[0156] Construct a candidate library of thesaurus containing multiple sets of synonyms and a candidate library of punctuation formats with multiple semantically equivalent punctuation formats.

[0157] In some embodiments of this invention, the thesaurus candidate library includes multiple sets of thesaurus, each set of thesaurus having at least three semantically equivalent thesaurus.

[0158] For example: "Please review" Please review "Please verify";

[0159] "Supplier's legal representative" "Supplier's legal representative" "Supply legal entity".

[0160] Each set of synonyms Represented as: ;in, For the first Synonyms.

[0161] Based on the session ID and user ID, and combined with the system master watermark key, the session watermark key and session encryption key are derived using the HKDF-SHA256 algorithm with different info context strings. The system master watermark key is stored in HSM or KMS, supports key versioning, and the key_version field is stored in the session record. That is:

[0162] ;

[0163] In the formula, For session key; It uses the HMAC-SHA256 algorithm; This is the system's master watermark key; , These are the session ID and the user ID, respectively.

[0164] The desensitized Prompt is segmented to filter out non-sensitive text regions and extract all candidate points for watermark embedding.

[0165] In some embodiments, all sensitive areas containing placeholders are filtered out, and only plain natural text without placeholders is retained as the watermark embedding area; all candidate synonyms of the desensitized Prompt are extracted from the plain natural text of the desensitized Prompt. and all punctuation candidate positions .

[0166] The session key is used as a seed for a pseudo-random number generator to generate a pseudo-random number sequence.

[0167] In the non-sensitive text area of ​​the desensitized Prompt, L1 synonym watermark replacement and L2 punctuation format style selection are performed sequentially to generate a desensitized Prompt carrying an implicit watermark of the session identity.

[0168] In some embodiments, each candidate synonym of the desensitization Prompt is traversed sequentially. And obtain synonym candidate points from the synonym candidate library. The set of synonyms is used, and a random number is obtained from a pseudo-random number sequence. The corresponding synonym is selected from the set of synonyms to replace the original word in the desensitized Prompt.

[0169] Iterate through each punctuation candidate position in the desensitization Prompt. Then, select the corresponding punctuation or text format from the punctuation format candidate library, and replace the original punctuation or original format in the desensitized Prompt with the corresponding punctuation or text format selected according to the random number.

[0170] In this embodiment, the privacy risk routing module 30 is used to calculate a comprehensive residual risk score for the residual privacy risk of the second de-identified Prompt, and based on the comprehensive residual risk score, routes the second de-identified Prompt to the large model for inference. Specifically:

[0171] If the de-identified Prompt carrying the implicit watermark of session identity carries the entity tag required for querying, then the residual privacy risk score is skipped, and the de-identified Prompt carrying the implicit watermark of session identity is forcibly routed to the local large model.

[0172] The residual risk comprehensive score is obtained by weighted summing of the information masking score, entity type sensitivity score, and entity relevance score of the de-identified Prompt carrying the implicit watermark of the session identity.

[0173] In this embodiment, the information masking score is... Represented as:

[0174] ;

[0175] In the formula, For information masking, The total number of sensitive entity words replaced by placeholders; This represents the total number of words in the original Prompt before desensitization. This is the information masking weight coefficient.

[0176] In this embodiment, the entity type sensitivity score Represented as:

[0177] ;

[0178] In the formula, The average sensitivity of the entity; For the first The type sensitivity score of each sensitive entity This represents the total number of sensitive entities identified through de-identification. This is the weighting coefficient for the average sensitivity of the entity.

[0179] In this embodiment, the entity relevance score Represented as:

[0180] ;

[0181] In the formula, For entity relevance; For the first The association weight of each semantic role; For the first The type sensitivity score of each sensitive entity.

[0182] In this embodiment, the type sensitivity score of the sensitive entity and the association weight of the semantic role can be queried according to Table 1.

[0183] The residual risk comprehensive score Represented as:

[0184] .

[0185] Based on the residual risk comprehensive score Select the appropriate route; including:

[0186] If the residual risk comprehensive score is greater than or equal to 0 and less than the first threshold, the de-identified Prompt carrying the implicit watermark of the session identity will be routed to the cloud-based large model LLM API.

[0187] In some embodiments, the first threshold is set to 30, i.e. .

[0188] If the residual risk comprehensive score is greater than or equal to the first threshold and less than the second threshold, the de-identified Prompt carrying the session identity implicit watermark will be routed to the trusted large model LLM API endpoint that has signed the DPA protocol.

[0189] In some implementations, the second threshold is set to 65, that is: .

[0190] If the residual risk comprehensive score is greater than or equal to the second threshold and less than or equal to 100, then the de-identified Prompt carrying the implicit watermark of the session identity will be routed to the local large model.

[0191] In this embodiment, the response security detection and blocking module performs placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection on the natural language response text returned by the large model to obtain a comprehensive response risk score. Based on this comprehensive response risk score, risk level classification and blocking processing are then performed. The specific functions implemented by the response security detection and blocking module correspond to sub-steps S41-S45 of the detection and blocking process in the above embodiment.

[0192] In this embodiment, the mapping table management module 50 is used to derive an AES-256-GCM encrypted storage placeholder mapping table with the original entity using the session key. The desensitization and restoration operations are stored in hashed audit logs. After the session ends, the memory mapping table undergoes multiple rounds of overwriting, memory unlocking, and deletion of persistent encrypted files, and a destruction audit credential is generated. Specifically:

[0193] The session encryption key is derived from the current session ID, user ID, and system global root key, i.e.:

[0194] ;

[0195] In the formula, Encrypt the session key; This is a key derivation function based on the SHA-256 hash function; This is the system's global root key; These are the current session ID and the user ID, respectively.

[0196] A plaintext mapping table is built in a protected memory buffer using the key-value pairs "original sensitive entity plaintext-placeholder-entity type". After AES-256-GCM encryption is performed in memory, only the ciphertext is written to disk, and the plaintext is not written to disk. A 96-bit IV vector is generated using a cryptographic random number generator. The IV is persistently stored together with the ciphertext and authentication tag.

[0197] Randomly generate GCM standard IV vectors and based on the session encryption key. Encrypt the plaintext mapping table to obtain the encrypted ciphertext mapping table; that is:

[0198] ;

[0199] In the formula, This is a mapping table for the encrypted ciphertext. This is a plaintext mapping table.

[0200] Each de-identification write to the mapping and response restoration read from the mapping operation generates an audit log. After performing an irreversible hash on the user ID, the user ID hash value is stored in the audit log, and the entity type, risk level, and operation type are recorded.

[0201] In some embodiments, the multi-round overwrite includes:

[0202] First round of overwriting: Use all zero bytes (0x00) to completely overwrite the plaintext and ciphertext mapping table buffer in memory;

[0203] Second round of overwriting: Use a full 1-byte 0xFF to completely overwrite the same memory buffer.

[0204] In some embodiments, the memory unlocking is: calling the release memory page function to unlock the memory page and release the memory resources.

[0205] In some embodiments, securely deleting persistent encrypted files based on NIST standards includes:

[0206] Perform NIST multi-round overwrite deletion on HDD hard drives;

[0207] For SSDs or flash memory media, additional ATA Secure Erase commands are executed.

[0208] In some embodiments, the destruction of audit credentials includes: session SID, destruction trigger timestamp, memory overwrite execution record, disk erase execution method, erase verification result, and operation process ID; the destruction of audit credentials is written to the audit log.

[0209] In this embodiment, the source tracing module 60 is used to extract the synonym index vector and punctuation format feature vector of the leaked text when the second de-identified Prompt is leaked, use Hamming distance K-NN binary vector retrieval to filter the target leaked session, decode the session ID and user ID of the target leaked session, and output a complete leak source tracing report in conjunction with the audit log. The specific functions implemented by the source tracing module 60 correspond to sub-steps S61-S68 of the leak source tracing process in the above embodiment.

[0210] One embodiment of this application discloses an electronic device, including:

[0211] At least one processor;

[0212] and a memory communicatively connected to the at least one processor;

[0213] The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, it implements the data desensitization security enhancement and watermark tracing method described in any of the above embodiments.

[0214] Another embodiment of this application discloses a computer storage medium storing a computer program, which, when executed by a processor, implements the data desensitization security enhancement and watermark tracing method described in any of the above embodiments.

[0215] In this application, the memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. A processor, coupled to the memory, is used to execute computer programs stored in the memory.

[0216] Computer programs include computer program code, which can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable media can include at least: any entity or device capable of carrying computer program code to a photographic / electronic device, recording media, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, portable hard drives, magnetic disks, or optical discs.

[0217] The data desensitization security enhancement and watermark tracing method, system, electronic device, and computer storage medium described in the above embodiments have at least the following beneficial effects:

[0218] Double-layer watermarks are embedded in the non-sensitive text portion of the de-identified Prompt, so that each de-identified Prompt carries a unique session-level identifier. During source tracing, the watermark vector is extracted from the leaked text, encoded in binary, and then matched using Hamming distance K-NN search in the vector index library to decode the session ID and user ID. When a data breach occurs, the specific session, user identity, and API endpoint where the breach occurred can be accurately located through watermark tracing.

[0219] Security checks are inserted after the LLM response is returned and before the mapping relationship is restored. The checks cover mapping relationship leakage patterns and abnormal aggregation patterns. Based on the detection results, a comprehensive risk score is calculated, and normal restoration, selective restoration, or blocking restoration is performed to eliminate mapping leakage attack paths.

[0220] The entire process of creating encrypted data, auditing operations, and securely destroying data maps between memory and disk. Memory locking, multi-round overwriting, irreversible hash logs, and compliant destruction of credentials are implemented simultaneously to prevent de-identified core assets from becoming a vulnerability for attacks.

[0221] The embodiments and descriptions above are merely illustrative of the principles and preferred embodiments of the present invention. Various changes and modifications may be made to the present invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed.

Claims

1. A method for enhancing data security through desensitization and watermarking for tracing origins, characterized in that, include: Sensitive entities are identified in the original Prompt issued by the agent, and the sensitive entities are replaced with placeholders carrying entity type identifiers to obtain the first desensitized Prompt; The non-sensitive areas of the first desensitized Prompt are replaced with synonym watermarks and punctuation formatting to generate a second desensitized Prompt carrying an implicit watermark of the session identity. Calculate a residual risk comprehensive score for the residual privacy risk of the second de-identified Prompt, and route the second de-identified Prompt to the large model for inference based on the residual risk comprehensive score; Placeholder semantic association leakage detection, abnormal entity aggregation detection, and cross-document enhancement detection are performed on the natural language response text returned by the large model to obtain a comprehensive response risk score, and risk level classification and blocking processing are performed based on the comprehensive response risk score; A session encryption key is derived based on the current session ID and user ID. The session encryption key is used to encrypt the mapping table between storage placeholders and sensitive entities. The desensitization and restoration operations are retained in the hashed audit log. After the session ends, multiple rounds of overwriting, memory unlocking and deletion of persistent encrypted files are performed on the memory mapping table, and destruction audit credentials are generated. When the second de-identified Prompt is leaked, the synonym index vector and punctuation format feature vector of the leaked text are extracted, concatenated to generate a query binary vector, and a candidate leaked session set is obtained based on the binary vector similarity retrieval; a watermark secondary matching verification is performed on the candidate leaked sessions, the target leaked session is selected, the session ID and user identifier of the target leaked session are parsed, and a complete leak tracing report is output in combination with the audit log.

2. The method according to claim 1, characterized in that, The first desensitization prompt includes: Receive the original Prompt sent by the intelligent agent, and identify sensitive entities in the original Prompt through named entity recognition and regular expression matching; The sensitive entities are divided into entities required for querying and ordinary sensitive entities; For entities required for the query, perform format-preserving encryption or reversible desensitization processing, retaining the format information required for the query. While ensuring that the intelligent agent query business can be executed normally, ensure that the complete plaintext does not appear in the desensitized Prompt, and include the desensitization processing results and associated identifiers of the entities required for the query in the mapping table management and audit log; replace ordinary sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt.

3. The method according to claim 2, characterized in that, Generate a second desensitization Prompt, including: A pre-built thesaurus candidate library and a punctuation format candidate library are provided; the thesaurus candidate library contains multiple sets of semantically equivalent synonyms, and replacement does not change the original semantics of the Prompt; the punctuation format candidate library contains multiple types of semantically equivalent punctuation formats. Based on the session ID and user ID, and combined with the system master watermark key, the session watermark key and session encryption key are derived respectively using the HKDF-SHA256 algorithm with different info context strings. The system master watermark key is stored in HSM or KMS, supports key versioning, and the key_version field is stored in the session record. The first desensitized Prompt is segmented, non-sensitive text areas are filtered, and all watermarkable embedding candidate points within the non-sensitive text areas are extracted. A one-time random nonce is generated. The session watermark key is concatenated with the nonce as the seed for the cryptographic pseudo-random number generator HMAC-DRBG to generate a pseudo-random number sequence. The nonce is stored in the backup Prompt for traceability verification. Based on the pseudo-random number sequence, synonym watermark replacement and punctuation format watermark replacement are sequentially performed in the non-sensitive text area of ​​the first desensitized Prompt to generate a second desensitized Prompt carrying an implicit watermark of the session identity.

4. The method according to claim 3, characterized in that, The second de-identified Prompt is routed to the large model for inference, including: If the second de-identified Prompt carries the entity tag required for the query, then the residual privacy risk score is skipped, and the second de-identified Prompt is forcibly routed to the local large model for inference; If the entity tags required for the query are not included, the residual risk comprehensive score is obtained by weighted summation of the information masking score, entity type sensitivity score, and entity relevance score based on the second de-identification Prompt. Based on the score range of the residual risk comprehensive score, the system routes the data to the large model corresponding to the safety level for inference.

5. The method according to claim 4, characterized in that, Risk level classification and blocking measures include: Perform placeholder semantic association leakage detection on natural language response text, identify the mapping leakage sentence pattern between placeholders and plaintext entities through preset regular expression pattern matching, and calculate the mapping leakage score; Anomaly entity aggregation detection is performed on the natural language response text to identify the set of sensitive entities that appear in plain text in the natural language response text. A basic aggregation score is calculated based on the pre-set sensitivity score associated with each sensitive entity, and a sensitive entity aggregation score is calculated based on the basic aggregation score. Based on the number of input documents, the number of sensitive entities, and the semantic matching relationship between plaintext and placeholders, it is determined whether to activate cross-document augmentation detection, and the sensitive entity aggregation score is reassigned according to the activation status to obtain the final sensitive entity aggregation score. The overall risk score of the response is calculated based on the mapping leakage score and the final sensitive entity aggregation score. The risk level is determined based on the comprehensive risk score of the response. For different risk levels, processing operations such as restoring all placeholders, partially desensitizing and retaining, or completely blocking and restoring are performed respectively.

6. The method according to claim 5, characterized in that, A session encryption key is derived based on the current session ID and user ID. This key is used to encrypt and store a mapping table of placeholders and sensitive entities. Desensitization and restoration operations are retained in hashed audit logs. After the session ends, multiple rounds of overwriting, memory unlocking, and deletion of persistent encrypted files are performed on the memory mapping table, and destruction audit credentials are generated, including: Derive the session encryption key based on the current session ID, user ID, and system global root key; The plaintext mapping table is constructed in the protected memory buffer by the key-value pair "original sensitive entity plaintext-placeholder-entity type". After AES-256-GCM encryption is performed in memory, only the ciphertext is written to the disk and the plaintext is not written to the disk. A 96-bit IV vector is generated using a cryptographic random number generator. The 96-bit IV vector, ciphertext and authentication tag are stored persistently together. Randomly generate GCM standard IV vectors and encrypt them based on the session key. The plaintext mapping table is encrypted to obtain the encrypted ciphertext mapping table. After the session ends, a secure zeroing function that is protected against compiler optimization is used to clear the plaintext and ciphertext mapping table buffer in memory, destroy the session encryption key to make persistent ciphertext unrecoverable, release memory pages, and generate destruction audit credentials.

7. The method according to claim 3, characterized in that, Output a complete leak attribution report, including: The suspected leaked text is cleaned using a standardized process. The cleaned text is traversed, and the current thesaurus is matched to identify all thesaurus candidate points. For each successfully matched candidate point, the thesaurus index of the candidate point's words in the thesaurus set is queried. All thesaurus indexes are concatenated in the order of the cleaned text to generate a thesaurus index vector. Each thesaurus index is fixedly encoded as a 2-bit binary bit string and concatenated to obtain the L1 binary watermark vector. Traverse all candidate punctuation formats in the text, match the punctuation format candidate library, record the format index used for each punctuation position, concatenate all format indices in text order, generate punctuation feature vectors, encode each format index into a 2-bit binary bit string, and generate L2 binary feature vectors. The L1 binary watermark vector and the L2 binary feature vector are concatenated into a query binary vector, which is then padded or truncated to a fixed dimension. The Faiss or Milvus binary vector index library is called, and Hamming distance is used as the similarity metric. When performing K-nearest neighbor retrieval, the contribution of padding bits is excluded, and the Top-K candidate historical session watermark vectors with the smallest Hamming distance are returned. For each candidate session returned by the retrieval, the complete watermark details of the candidate session are obtained, and the synonym index extracted from the leaked text is compared point-by-point with the original synonym index of the session. The L1 matching degree is calculated, and the format index is compared point-by-point for each punctuation mark to calculate the L2 matching degree. The L1 and L2 matching degrees are then weighted and fused to obtain the comprehensive matching degree. Filter all overall match scores Candidate sessions with a match value greater than or equal to a preset matching threshold are selected, and the session with the highest overall match value is selected as the target leaked session. The target leaked session is then decoded to obtain the session ID and user hash identifier. The real user who made the operation is then reconstructed by matching the audit logs. A complete leak tracing report is generated based on the audit logs, leaked text samples, session information, operating users, API call chains, and risk levels extracted from the target leaked session.

8. A data desensitization security enhancement and watermarking traceability system, characterized in that, include: The desensitization processing module is used to identify sensitive entities in the original Prompt issued by the intelligent agent and replace the sensitive entities with placeholders carrying entity type identifiers to obtain the first desensitized Prompt. The watermark embedding module is used to replace the non-sensitive areas of the first desensitized Prompt with synonym watermarks and punctuation format replacements to generate a second desensitized Prompt carrying an implicit watermark of the session identity. The privacy risk routing module is used to calculate a residual risk comprehensive score for the residual privacy risk of the second de-identified Prompt, and to route the second de-identified Prompt to the large model for inference based on the residual risk comprehensive score; The response security detection and blocking module is used to perform placeholder semantic association leakage detection, abnormal entity aggregation detection and cross-document enhancement detection on the natural language response text returned by the large model, obtain a comprehensive response risk score, and perform risk level classification and blocking processing based on the comprehensive response risk score; The mapping table management module derives a session encryption key based on the current session ID and user ID, uses the session encryption key to encrypt the mapping table storing placeholders and sensitive entities, retains hashed audit logs for desensitization and restoration operations, and performs multiple rounds of overwriting, memory unlocking and deletion of persistent encrypted files on the memory mapping table after the session ends, and generates destruction audit credentials. The source tracing module is used to extract the synonym index vector and punctuation format feature vector of the leaked text when the second de-identified Prompt is leaked, concatenate them to generate a query binary vector, retrieve a set of candidate leaked sessions based on the similarity of the binary vectors, perform secondary watermark matching verification on the candidate leaked sessions, filter out the target leaked sessions, parse the session ID and user identifier of the target leaked sessions, and output a complete leak source tracing report in combination with the audit logs.

9. An electronic device, comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, wherein the computer program, when executed by the at least one processor, implements the data desensitization security enhancement and watermark tracing method as described in any one of claims 1-7.

10. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the data desensitization security enhancement and watermark tracing method as described in any one of claims 1-7.

Images