A trusted large model intelligent due diligence method and system based on multiple constraint checking

Abstract

The application provides a trusted large model intelligent due diligence method and system based on multiple constraint verification, relates to the technical field of computer data processing and due diligence data verification; allowed data set is obtained by screening data, intersection point is selected by content anchor cross positioning, row and column attribution of numerical value area is confirmed and evidence record is generated, evidence dependency relationship is established according to constraint set and evidence record, and in-context budget is used to form in-bag data set according to complete evidence fragment group; evidence coverage of two data sets is compared, source data missing, budget uncovered and evidence completeness are distinguished, and output permission is generated in combination with comparability state; a controlled output bag is constructed, a large language model is called to generate candidate due diligence content, and verification is performed to output, rewrite or block, so that the risk of publishing a certain conclusion under incomplete or non-comparable basis is reduced.

Description

Technical Field

[0001] This application relates to the fields of computer data processing and due diligence data verification technology, and in particular to a reliable large model intelligent due diligence method and system based on multiple constraint verification. Background Technology

[0002] Due diligence report generation requires extracting evidence from multiple sources such as financial records, contracts, and corporate files, and organizing the content according to report templates and business rules. When using a large language model to generate reports, the input that the model can accept is limited by the length of the context. The system usually first divides the data into segments, and then selects the input content based on the relevance of the segments to the task. An output item may depend on multiple fields from different data. Numerical fields also need to be interpreted by table row and column headings, reporting period, and unit. A single relevant segment entering the model input does not mean that the above-mentioned joint evidence has been completely included in the input range.

[0003] Under this approach, the absence of available joint evidence in the data, the exclusion of existing evidence due to budget constraints, and the inability to use the same criteria for the selected evidence may all lead to the model failing to reach a reliable conclusion. If the system does not correlate these evidence states with the conditions for generating and publishing conclusions, the model may still generate definitive conclusions that exceed the scope of evidence support. Therefore, the main technical problem that needs to be solved is to ensure that the evidence support state of the output items remains consistent with the generation, verification, and handling of definitive conclusions within a limited context. Summary of the Invention

[0004] The technical problem this application aims to solve is to ensure that the evidence support status of the output item is consistent with the generation, verification, and handling of deterministic conclusions under the condition of limited model context budget.

[0005] To address the aforementioned issues, a reliable large model intelligent due diligence method based on multiple constraint verification is proposed, the method comprising: Obtain task information, multi-source due diligence data, and contextual budget; filter by task information to obtain the set of allowed data. Construct two circles based on the page distance from the center of the numerical region in the allowed data set to the anchor points of the two contents on the same page, determine the unique intersection point and the row and column affiliation, generate evidence records, and register the location anomaly if it cannot be uniquely determined. Read templates, business rules, comparable conditions, prohibited items and handling strategies to form a constraint set, determine the output items and necessary evidence fields according to the constraint set, and establish evidence dependency relationships in combination with evidence records; Based on the evidence dependency relationship, select data within the context budget by fragment group that covers all required evidence fields to obtain the data set to be included; Based on the evidence dependency check, the coverage of the allowed data set and the included data set is obtained to determine the evidence status of missing source data, budget not covered, or complete evidence. For the complete evidence items, the subject, reporting period, indicator, and unit are verified according to the comparable conditions to obtain the comparability status. Based on the handling strategy, the status of evidence, and the comparability status, supplementary evidence, re-selection of data, or review are restricted for items with missing source data, those not covered by the budget, and those that are not comparable. Definitive conclusions are only made for items with complete evidence and comparability, resulting in an output permission set. Based on the set of input data, the set of constraints, and the set of output permissions, a controlled output package is constructed according to prohibited items, and a large language model is called to generate candidate due diligence content. Verify the candidate due diligence content according to the controlled output packet, obtain the verification status set, and execute output, rewrite or block according to the handling strategy.

[0006] A trusted large model intelligent due diligence system based on multiple constraint verification includes a memory and a processor, wherein the processor executes a program in the memory to achieve the following: The data scope control module is used to obtain task information, multi-source due diligence data and contextual budget, and filter to obtain the set of allowed data; The constraint orchestration module is used to form a set of constraints and establish evidence dependencies by combining evidence records; The positioning module is used to construct two circles based on the page distance from the center of the numerical region to the two content anchor points on the same page, determine the unique intersection point and row / column affiliation, generate evidence records, and register positioning anomalies when they cannot be uniquely determined. The data selection module is used to select complete fragment groups within the context budget based on evidence dependencies, thereby obtaining the data set to be included. The permission control module is used to compare the coverage of the permitted data set with the incoming data set, and generate the output permission set based on the comparability status. The generation module is used to construct a controlled output package based on the input data set, constraint set, and output permission set, and call the large language model to generate candidate due diligence content. The verification and handling module is used to verify the candidate due diligence content based on the controlled output packet, and to execute output, rewrite or block according to the handling strategy.

[0007] In the solution provided in this application, since the output items and their required evidence fields are registered as evidence dependencies and the data is selected as a complete evidence fragment group within the context budget, it is possible to distinguish between missing source data, budget not covered and complete evidence, so that supplementary evidence and re-selection of data have different and verifiable processing bases. Since evidence records are generated only after a unique intersection point is selected and a unique row and column affiliation is obtained for the numerical region, values ​​that cannot be uniquely located are excluded from evidence matching. Therefore, uncertain positioning can be processed in subsequent steps instead of being used directly as a basis for determination. Since the evidence status and comparability status are converted into output permission and the candidate due diligence content is verified and processed, it is possible to restrict the release of definitive conclusions without complete evidence or with incomparable calibers, and to provide different processing entry points for supplementary evidence and budget reselection. Attached Figure Description

[0008] Figure 1 This is the overall flowchart of the intelligent due diligence method of this application.

[0009] Figure 2 This is a block diagram showing the module composition and output path of the intelligent due diligence system of this application.

[0010] Figure 3 A flowchart for establishing evidence dependency relationships.

[0011] Figure 4 This is a flowchart for cross-location of numerical regions.

[0012] Figure 5 A flowchart for selecting complete fragment groups within the context budget.

[0013] Figure 6 This is a flowchart for determining the status of evidence and comparability.

[0014] Figure 7 A flowchart for the construction and controlled decoding of controlled output packets.

[0015] Figure 8 A flowchart for verifying and processing candidate due diligence content. Detailed Implementation

[0016] This embodiment deploys the trusted large model intelligent due diligence method on a computer system with a processor, memory, data access interface, model inference interface, and report output interface. The data access interface connects to an authorized document storage service, and the processor executes data range control, constraint arrangement, location, data selection, permission control, generation, and verification processing procedures. The model inference interface returns the generation score of candidate terms, and the report output interface only receives content approved for publication by the verification processing module. The model output buffer and the report publication storage area are set up separately, and text that fails verification cannot be directly entered into the formal report through preview caching, automatic saving, or streaming response.

[0017] In this embodiment, "credible" means that the output has a verifiable range of data, evidence reliance, status judgment, and handling records. It does not mean that the model reasoning is absolutely correct, nor does it mean that the authenticity of the input data has been independently proven by the software. The system can verify whether the values ​​come from permitted data, whether the citations are closed, whether the caliber is consistent, and whether the conclusions exceed the permission, but it cannot confirm the authenticity and validity of a scanned contract solely based on format checks. Therefore, data whose authenticity is questionable should be kept in a verification status. For output items that require authenticity confirmation but have not yet been confirmed by the rules, a definitive conclusion should not be provided.

[0018] Task information is obtained by parsing the task request, including task identifier, target object identifier, task type, business attribute, target chapter, reporting period, requesting subject, and permission context. The target object identifier uses a unique code within the task domain; the name is only a display field and does not use the company abbreviation to replace the unique code. The reporting period records the start and end dates and period type, and the merged scope marker is stored as an independent attribute to prevent the year-end balance and the annual cumulative value from being treated as the same time type. The permission context records the data domains that the requesting subject can access, the authorized validity period, and the allowed actions. The execution time of the permission judgment is associated with the version of this task.

[0019] Multi-source due diligence materials include structured financial records, contract texts, basic corporate files, historical due diligence reports, and authorized imported public materials; each material object carries a source identifier, content version, access time, original text location, and access permissions; the so-called allowed material set is a set of material fragments that can be used for evidence judgment in this task after being filtered by task conditions and permissions; the so-called included material set is a set of fragments in the allowed material set that are actually submitted to the model within the context budget; the two must not share a storage field that can be overridden, otherwise it will be impossible to distinguish between materials that do not exist and materials that have not been included in the package.

[0020] The context budget is measured by the number of tokens after model word segmentation, and reads the context length and output reserved length supported by the current inference service; a token is a discrete coding unit in the vocabulary and does not correspond to a fixed Chinese character; the data selection stage uses the budget that can be used for input and does not occupy the space reserved for model output; if the task configuration directly gives the data budget, the verification relationship between the data budget and the total context limit is still retained.

[0021] Figure 1This embodiment demonstrates the overall processing sequence. The step numbers are used to identify the corresponding processes and do not indicate that the numerical value of the number determines the execution order. S101: Obtain task information, multi-source due diligence data, and context budget, and filter to obtain the allowed data set. Then, execute S103: For the numerical region in the fragment, determine two circles based on the page distance between two content anchor points. Only when they are tangent to obtain a unique intersection point or after intersection, select a unique intersection point to determine the row and column headers and generate evidence records. Next, execute S102: Read the template, business rules, comparable conditions, prohibited items, and handling strategies to determine the output items and required evidence fields. Combine the numerical evidence records generated by positioning with the parsed records of other fragments to establish evidence dependencies. S104: Based on the evidence dependencies, select data within the context budget according to the complete evidence fragment group to obtain the packaged data set. S105: Check the required data for each output item. The evidence status is obtained by checking the coverage of the required evidence fields, and the comparability status is obtained by verifying the completeness of the evidence according to the comparability conditions. S106 restricts supplementary evidence, re-selection of data, or review according to the handling strategy, evidence status, and comparability status. Only the conclusion is opened for the complete and comparable items, and the output permission set is obtained. S107 restricts the scope of data to be submitted to the large language model according to the prohibited items based on the data set, constraint set, and output permission set, constructs a controlled output package and generates candidate due diligence content. S108 verifies the candidate due diligence content according to the controlled output package to obtain the verification status set. The output, rewrite, or block is executed according to the verification status set and the handling strategy. In the implementation, it is allowed to return to S104 in the budget not covered branch of S106, but the same task identifier and clearly distinguishable data version are used before and after the return. The original source data missing record cannot be successfully covered by re-selecting data.

[0022] After receiving a task request, the data scope control module 101 first checks whether the necessary task fields exist, and then queries the data index according to the target object identifier, authorization scope, and task type. If the target object identifier is missing, it does not replace it with the company name that appears most frequently in the request text, but returns a task information pending confirmation status. Authorization checks are performed before content retrieval. Fragments without read permissions are not allowed to enter the allowed data set, nor can their values ​​be disclosed through model summaries, vector index hit information, or supplementary certification lists.

[0023] For structured records, the system retains the original field names, values, data types, and units. For text data, the system segments the data based on the common interpretation scope of paragraphs, table rows, headers, and footnotes. When a financial data row depends on the header to determine its unit, the system combines the unit header and the corresponding row into an inseparable data segment, or establishes explicit inter-segment dependencies so that subsequent complete evidence sets contain both data row segments and header segments. Simply extracting a number does not constitute directly quotable numerical evidence.

[0024] When accessing scanned files, the recognition results are bound and saved to the original page images; the original text location includes at least the file identifier, page number, and recognition area location; when there is ambiguity in the number recognition, candidate characters and verification marks are retained, and the highest score character output by the recognition program is not automatically taken as the definitive data; for decimal points, negative signs, negative numbers represented in parentheses, percentage signs, and unit multiples, structured format checks are performed; when the recognition reaches ten thousand yuan and the numerical field comes from an adjacent column, column ownership conflicts are retained, and source errors cannot be masked by a unified multiplier.

[0025] The reporting period condition in data screening distinguishes between current evidence and comparative evidence; when the task reporting period is the current year, previous year's records required for year-on-year calculation are allowed, but must have a comparative period role; predictions for the future in historical reports cannot be converted into actual values ​​for the current period simply because the publication time is earlier than the current reporting period; for contracts spanning multiple periods, the signing date, performance period, and balance point are saved separately, and field references use the time attributes specified by the business rules, rather than arbitrarily selecting one of the dates.

[0026] Duplicate uploads of the same data are checked based on source identifier, version identifier, and standardized content summary; identical fragments can share a single fragment identifier, and multiple source locations are retained as source aliases; fragments with similar content but different values, dates, or negative words must not be merged; normalization is only used to remove coding and formatting differences, and does not delete units, null value markers, or footnotes that would change the meaning; when data is revoked, its status is used to prevent it from participating in the construction of a new complete evidence set, and if a report has already been generated, it will enter the re-verification process through version changes.

[0027] After the scope filtering is completed, the system outputs the set of allowed data and the filtering reason record. The filtering reason record is used to explain why the fragment was not included due to permissions, target objects, validity period, or irrelevance to the task. These fragments are not automatically listed as objects for which source data is missing and can be supplemented. The source data missing is a missing relative to the current allowed scope, not a global non-existence judgment of all data in the entire organization's database. When it is necessary to expand the authorization scope, the task initiator shall supplement the authorization and create a new task version. The model cannot modify the permission context on its own.

[0028] The constraint orchestration module 102 reads templates, business rules, comparable conditions, prohibited items, and handling strategies from the configuration storage, and obtains their version identifiers in the same read. The template defines the chapter, name of the item to be output, field type, required fields, and display position. The business rule defines the rule number, applicable premises, required evidence fields, computable relationships, and triggering actions. The comparable conditions define the subject attribution, period type, indicator caliber, allowed unit conversions, and comparison tolerances. The prohibited items define fields that cannot be disclosed and the form of conclusions that cannot be output. The handling strategy defines the correspondence between verification failures and actions.

[0029] The application conditions of the rules are determined using a precise three-state judgment: satisfied, not satisfied, and cannot be judged. When the fields required for the application conditions are missing, it is recorded as "cannot be judged" and the rule is not deleted as it is not considered unsatisfied. For a rule that may be applicable but has not yet been determined, the system retains the evidence fields used to judge its applicability and restricts the corresponding conclusion to the state of supplementary evidence or review. In this way, the evidence on which the rule conditions themselves depend and the evidence on which the rule conclusion depends have different field roles, and the model cannot circumvent the rule restrictions by omitting the application conditions.

[0030] The joint citation condition is used to determine whether multiple evidence records can serve as the joint basis for the same output item; its content should at least identify the subject relationship, period role, indicator semantics, and source role; for example, the year-on-year output item requires both current period revenue and comparative period revenue, and the period roles should be matched separately rather than having the same date; the debt-to-asset ratio output item requires assets and liabilities at the same point in time and within the same consolidation scope; the joint citation condition here only judges the usability of the evidence combination structure, and does not pre-determine that all numerical relationships are correct, and the comparability and consistency of candidate conclusions are still performed by the corresponding steps.

[0031] When different rules give conflicting requirements for the same field, the system first checks whether the applicable scope of the rules is different, and then checks the effective range of the rule version. The order of the rules in the file cannot determine the overriding relationship. If the configuration explicitly gives the overriding condition of the superior rule on the subordinate rule, then the rules are arranged according to the condition. If there is no explicit overriding condition, all conflicting rules are kept in the constraint set and the rule conflict status is output to block the affected deterministic conclusions. Non-conflicting output items do not need to be blocked, but their dependencies must be isolated from conflicting items.

[0032] The prohibited items apply to data reading, model input, and output publishing respectively. Data reading prohibition corresponds to the reading restriction in the permission context, which is executed by the data scope control module before content retrieval to prevent unauthorized data content from entering the allowed data set. The constraint orchestration module encodes this reading restriction into the constraint record. Model input prohibition is used to filter personal information that, even if readable, should not be sent to the inference service. Publishing prohibition is used to control text or identifiers that must not appear. The above three scopes are encoded separately in the constraint record. The word filtering at the publishing stage cannot be regarded as a substitute for data permissions. After the prohibited raw data is desensitized, an independent version should be assigned to the desensitized fragment and an irreversible or controlled mapping description should be retained.

[0033] After the constraint set is arranged, it is verified whether its field references point to the output items defined in the template, whether the unit conversion has a calculable proportion, and whether the disposal action belongs to the system's executable enumeration; for rules that reference fields that do not exist, the model is not allowed to guess the meaning of the fields, but a configuration error is reported; the model can assist in interpreting natural language rules, but the rules that enter the execution path of this embodiment must complete the structured confirmation; the structured rules are associated with their original text and saved in order to verify whether the rule compilation has changed the prohibited scope or applicable premises.

[0034] The system assigns identifiers to the output items, required evidence fields, and data fragments. The identifiers are unique within the same task version and use fixed-length alphanumeric strings to give ascending comparisons a definite meaning. The output item identifier indicates a conclusion position, the required evidence field identifier indicates a type of evidence required for that conclusion, and the fragment identifier indicates the actual data content that can be cited. A data fragment can cover multiple fields, and a field can be provided with alternative evidence by different fragments. Therefore, these relationships are not one-to-one.

[0035] Evidence records for numerical regions are generated by the positioning module after confirming the unique row and column attribution. The constraint orchestration module uses these evidence records to complete field matching. Other fragments are parsed to obtain evidence records. When parsing fragments to obtain evidence records, the field value, subject, reporting period, indicator, unit, original text location, and parsing status are recorded simultaneously. Evidence records do not directly overwrite the original text. When a value is manually revised, a new record version is generated and the reason for the revision is retained. Field values ​​of zero, empty strings, undisclosed, and inapplicable are stored separately, and it is prohibited to convert undisclosed values ​​to zero. Each record also saves the headers, footnotes, or calculation sources that it references, to avoid removing explanatory fragments that still determine the meaning of the numerical value when reselecting data.

[0036] Field matching uses the indicator codes in business rules to map to confirmed synonym fields; alias mapping records the source field, standard field, applicable data type, and valid version, and cannot merge operating revenue and non-operating revenue based on string inclusion relationships; after matching field associations, evidence records that can be jointly cited are filtered according to common citation conditions; if there are field associations but the common citation conditions cannot be met, the associations are still retained to facilitate the distinction between fields not found and fields that exist but cannot constitute joint evidence.

[0037] When constructing a complete evidence set, start with a required evidence field of a certain output item, and expand sequentially to the combination of records that can satisfy the common citation conditions. Each expansion checks the constraints between the selected records. After covering all required evidence fields, extract the fragment identifiers involved in the combination, remove duplicates to form a complete evidence set. If different record combinations correspond to the same fragment set and have the same applicable conditions, they are only registered once. If the applicable conditions are different, each condition branch is retained so as not to confuse their evidence meaning due to the same fragments.

[0038] When there are many candidate combinations, branches containing invalid sources, withdrawn versions, or those that do not meet the common reference conditions can be excluded during the construction phase. This exclusion is a feasibility check and does not delete the only fragment that can provide the required fields on the grounds of low semantic similarity. For output items that have not been enumerated due to exceeding the construction resource limit, the system records that the construction is incomplete and cannot report that proven source data is missing. The resource limit is given by the task configuration. Over-limit events will be subject to manual review or batch construction. Only after the complete enumeration is completed will the evidence coverage be classified.

[0039] Complete evidence sets allow for the sharing of fragments; for example, if two output items require assets and liabilities, or income and assets respectively, the same asset fragment can be cited by both complete evidence sets; data usage is counted by fragment identifier for deduplication, and evidence support is judged by complete evidence sets, with the two working at different levels. Figure 3 The flowchart represents the registration order of evidence records, field associations, and complete evidence groups. The reuse of fragment identifiers indicates reference dependency rather than causal proof. Adding a new shared fragment may simultaneously close evidence combinations of multiple items to be output, which is why all items to be output need to be checked when calculating coverage gain for data selection.

[0040] To determine the index, period, role, and unit to which the numerical range in the table belongs, the positioning module 103 establishes normalized coordinates within each page and performs cross-positioning based on the page distance between two content anchor points. The normalized coordinates within the page are based on the page width and height, with the top left corner of the page as the origin. The horizontal coordinate is along the page width direction, and the vertical coordinate is along the page height direction, with values ​​ranging from 0 to 1000. The horizontal and vertical coordinates are obtained by dividing the distance from the position to the left edge and top edge of the page by the page width and height, respectively, and then multiplying each by 1000. The page distance is obtained by summing the squares of the differences between the horizontal and vertical coordinates of two points in the same coordinate system and taking the non-negative square root. The center distance and radii are determined in this way; the average character width is obtained by summing the widths of the recognized characters on the page, dividing by the number of characters, dividing by the page width, and multiplying by 1000 to convert it to the same normalized coordinate scale; normalization is stopped and a positioning anomaly is registered when the page width or page height is not positive; a positioning anomaly is registered and the double-disambiguation based on the width is stopped when there are no available characters or the average character width is not positive; the above coordinates are dimensionless page coordinates, and the normalized distance is not the physical length of the paper. The character width is used as the lateral displacement in the same coordinate system for comparison; thus, each radius, center distance, and discrimination threshold are calculated within the same coordinate scale.

[0041] Content anchors are confirmed according to the keyword list; the keyword list registers header and footer terms such as items, subjects, subtotals, totals, end-of-period figures, current period figures, and previous year figures; the system matches a unique cell in the header row of the table area, using its geometric center as the first content anchor, and matches a unique cell in the footer row, using its geometric center as the second content anchor. When two intersections need to be resolved, a third unique cell is matched in the header row, using its geometric center as the third content anchor; if the matching result is empty or not unique, or if the required anchor falls in the same cell, or if the center coordinates of the first and second content anchors coincide, the corresponding positioning or disambiguation is stopped and a positioning anomaly is registered; the position of the cell's geometric center is represented by the aforementioned page-normalized coordinates, with the row direction being the page width direction and the column direction being the page height direction.

[0042] The page distance from the center of the numerical region to the first content anchor point is denoted as the first radius, and the page distance to the second content anchor point is denoted as the second radius. A first circle is drawn with the first content anchor point as the center and the first radius as the first circle, and a second circle is drawn with the second content anchor point as the center and the second radius as the second circle. The page distance between the two content anchor points is denoted as the center distance.

[0043] The relative positions of the two circles are then compared. If the distance between their centers is greater than the sum of the first and second radii, the two circles are considered to be separated. If the distance between their centers is less than the absolute value of the difference between the first and second radii, the two circles are considered to be contained within each other. Both cases indicate that the current distance input and the anchor point coordinates cannot jointly constitute the positioning relationship. The system registers the positioning anomaly and stops generating evidence records for the corresponding value area. Separation or containment alone cannot determine which distance is incorrect. Subsequent verification requires checking the distance source, coordinate version, and page correspondence.

[0044] When two circles intersect or are tangent and the distance between their centers is non-zero, first subtract the square of the second radius from the square of the first radius, then add the square of the distance between the centers. Divide the sum by twice the distance between the centers to obtain the directed displacement with the direction from the first center to the second center as positive. Subtract the square of the directed displacement from the square of the first radius, and take the square root of the non-negative difference to obtain the half-chord length. Stop the root calculation and register the calculation or input an error if the difference is negative. Subtract the corresponding coordinates of the first center from the horizontal and vertical coordinates of the second center, and then divide them by the distance between the centers to obtain the horizontal and vertical components of the connecting line. Multiply the two components by the directed displacement. The displacement is then added to the horizontal and vertical coordinates of the first circle center to obtain the midpoint of the line connecting the intersection points. When the displacement is negative, the midpoint is in the opposite direction of the positive direction. The vertical component is taken as the opposite number and is used as two components in the vertical direction along with the horizontal component. These are then multiplied by the half-chord length to obtain the horizontal and vertical offsets. The two offsets are added to the midpoint coordinates and subtracted from the midpoint coordinates to obtain two intersection points. When the half-chord length is zero, the two intersection points coincide. The coincident point is taken as the unique intersection point. Otherwise, the third content anchor point disambiguation is performed. The entire calculation retains the sign of the directional displacement, thus accommodating the valid geometric case where the midpoint falls behind the first circle center.

[0045] Two intersection points correspond to two candidate positions. After the required third content anchor point is successfully matched, the system calculates the page distance from each intersection point to the third content anchor point. Subtract the page distance from the center of the numerical region to the third content anchor point from each distance, and then take the absolute value to obtain two distance deviations. Calculate the absolute value of the difference between the two deviations. If it is less than half of the average character width of the page, the positioning is registered as uncertain, the intersection point is not selected, and the conclusion of the affected output item is restricted to a verification state. Otherwise, the intersection point with the smaller deviation is selected as the only selected intersection point. When the third content anchor point is collinear with the first two anchor points, the distances from the two mirrored intersection points to the third content anchor point are the same. Disambiguation cannot be relied upon for this anchor point, and it is treated as an uncertain positioning point. Here, "unique" is determined by the selection of the only candidate, and does not mean that the two intersecting circles originally had only one geometric intersection point.

[0046] After obtaining the selected intersection point, the system determines the title candidates within the table to which the numerical range belongs. The row title is the title cell corresponding to the data row and used to represent the indicator, and the column title is the title cell corresponding to the data column and used to represent the period role. Neither can be treated as any cell in the header row. Along the direction of the row where the intersection point is located, the nearest cell is selected from the row title candidates in the same row to obtain the indicator name. Along the direction of the column where the intersection point is located, the nearest cell is selected from the column title candidates in the corresponding column to obtain the period role, and the unit label applicable to that column is read. The distance is calculated according to the aforementioned normalized coordinates, and the title candidates and their cell range are provided by the confirmed table structure. If multi-level headers, merged cells, or slanted layouts cause the corresponding row and column or the nearest title to not be uniquely determined, an abnormal positioning is registered, and no evidence record is generated. This process limits the nearest distance comparison to the correct title category, rather than selecting the geometrically closest text across rows and columns.

[0047] For a numerical region to be assigned, the positioning module obtains the coordinates of the center of the numerical region and the anchor point of the required content from the coordinate record on the same page; first, it takes the non-negative square root of the sum of the squares of the coordinate differences to obtain the distance between each page, and then calculates the center distance, the sum of the two radii, and the absolute value of the difference between the two radii to check whether the intersection or tangency conditions are met; only when the center distance is non-zero and the input is self-consistent, does it continue to calculate the directed displacement and half chord length to avoid directly performing division and square root on abnormal inputs.

[0048] When determining the intersection point, the positioning module first calculates the midpoint of the line connecting the intersection points according to the aforementioned directional displacement, and then converts the half-chord length into horizontal and vertical offsets perpendicular to the line connecting the center of the circle. When the half-chord length is zero, the midpoint coordinates are read directly. When the half-chord length is non-zero, two sets of candidate coordinates are obtained, and their distances to the first two content anchor points are recalculated and checked against the first radius and the second radius. The recalculation uses values ​​that have not been rounded for display, and intermediate display values ​​are not backfilled for calculation to avoid rounding errors changing the geometric branches.

[0049] When resolving double solutions, the positioning module selects candidate intersection points according to the absolute deviation comparison rules of the aforementioned third content anchor point, and then obtains the row title, column title and unit corresponding to the intersection point; the numerical fields are associated with the determined indicators, period roles, subjects, reporting periods and original text positions to generate evidence records; if the attribution of any title is still uncertain, even if the intersection point has been selected, numerical evidence that can be used for a definitive conclusion cannot be generated.

[0050] If the first radius, second radius, and center distance are all calculated consistently from the same numerical region center and the same set of anchor point coordinates, then according to the trigonometric relationship of distance, the numerical region center must be the common point of the two circles. The separation of the two circles and the strict inclusion of branches will not be triggered solely by constructing the two circles. In this case, geometric recalculation can only verify the self-consistency of coordinates and distance, and cannot independently correct the original identification center error or prove the semantic correctness of the index. If the distance and anchor point coordinates saved or transmitted come from inconsistent versions, then separation or inclusion can be used as a condition for rejecting abnormal input. The system still needs to rely on title attribution, original text location, and subsequent verification to confirm the scope of use of the numerical record.

[0051] The location result is directly linked to the evidence status determination: only numerical areas that have been located and have unique row and column attributions are generated as evidence records. Therefore, numerical areas with abnormal location do not participate in the construction of a complete evidence group. If there are no other available evidence records, the corresponding required evidence fields will show a lack of available evidence. The coverage status is still treated as missing source data, but the supplementary evidence field records retain the reason for the abnormal location. For cases where the original page already exists, the row and column attributions are reviewed first, and available evidence is obtained if necessary. The review restrictions triggered by uncertain location remain effective. After the review is completed and the evidence record is rebuilt, the evidence status is recalculated, and a definitive conclusion is not directly released.

[0052] Figure 4 The diagram illustrates the processing flow for cross-location of numerical regions. The diamond-shaped judgment boxes represent the judgment of abnormal and ambiguous conditions. If the judgment fails, the location is registered as abnormal, the location is stopped, or it is restricted to review. If the judgment passes, processing continues along the main chain. First, the page coordinates and page distance are normalized. Then, the first and second content anchor points are matched in the header and footer rows of the keyword table. If the two anchor points are not unique or are in the same cell, the location process is not initiated and a location abnormality is registered. Subsequently, two circles are drawn with the two anchor points as centers and the measured page distance from the center of the numerical region to each anchor point as radii. The distance between the centers is used to determine whether the two circles are separate or contained within each other; in both cases, a location abnormality is registered. If the circles intersect or are tangent and the circles are... When the center distance is non-zero, first determine the directional displacement with the first circle center to the second circle center as the positive direction. Then, determine the half-chord length by the non-negative square root of the difference between the square of the first radius and the square of the directional displacement. When the half-chord length is zero, directly take the coincidence point without entering the third anchor point and deviation judgment. When the half-chord length is greater than zero, match the third content anchor point and calculate two absolute deviations. Only when the absolute value of the difference between the two deviations is not less than half of the average character width, select the smaller deviation. Otherwise, register the positioning as uncertain and limit it to review. Finally, in the row header candidates of the corresponding row and the column header candidates of the corresponding column, take the header cell that is closest to the selected intersection point to obtain the row header and column header, and generate the evidence record accordingly.

[0053] The system uses explicit records to store task information, evidence dependencies, evidence status, comparability status, and output permissions. Records are associated with each other through identifiers, without relying on similar names in natural language paragraphs. Table 1 shows the field composition of the core records, denoted as the core record field table. Table 2 shows two evidence record examples for two items to be output, denoted as the demonstration evidence record table. Table 3 shows the field permission table and its composition, and Table 4 shows an example of the field permission table.

[0054] Table 1: Core Record Fields Table

[0055] The field permission table uses the task version, the identifier of the item to be output, and the output field path as the locator key; the handling status field, the evidence citation field, and the conclusion field each occupy one row, and the numerical field can occupy another row; the output field path indicates the location of the structured output; the allowed value categories are enumeration, null, a set of reference identifiers, or constrained text, corresponding to the enumerated string, null, the list of reference identifiers, and the constrained string, respectively; the allowed value category describes the value format, and allowed values ​​come from the output permission set and the incoming evidence; reference identifiers are assigned to incoming fragments and collected into an optional identifier set, and the actual value of the reference field must not exceed this set; the bound version includes the data version, the rule version, and the permission version, and the verification action limits the corresponding checks.

[0056] Table 2: Demonstration Evidence Record Form

[0057] When creating a field permission table, first obtain the output fields and data types from the template, and then fill in the status restrictions according to the output permission set; output items with complete and comparable evidence can have non-empty conclusion fields, but this only means that a certain conclusion to be verified is allowed, not that any generated conclusion can be published; for output items with missing source data, budget not covered, or incomparable, the conclusion field is fixed to an empty value, and the disposal status field is limited to supplementary evidence, re-selection of data, or review, respectively; the evidence citation field can only select citation identifiers that actually exist in the included data set.

[0058] Table 3: Field Permission Table

[0059] Null values ​​in the table are marked with structured null values, not with the string "no" or an empty string; this is because "no risk" is a substantive conclusion, and structured null values ​​indicate that the system has no open conclusions; when the model generates a status description, the supplementary evidence status must not be interpreted as missing data but acceptable risk; the field permission table imposes hard restrictions on the range of values ​​that can be taken at the field level; semantic out-of-bounds in free text are further checked by prohibited items and external validation; when there is no valid citation identifier, the evidence citation field is only allowed to be an empty list, and the generation of seemingly existing source numbers is not allowed.

[0060] Table 4: Examples of Field Permissions

[0061] The field permission table also distinguishes between action objectives for missing source data and those for budget-inadequate coverage; the former points to fields in the supplementary evidence field record or combinations that cannot be referenced together, while the latter points to fragment identifiers in the gap fragment group; although both may result in an empty conclusion field, they cannot share the same rejection code without a reason; after saving the reason and action objective, the data selection module can perform reselection only for budget-inadequate coverage, avoiding requiring users to upload materials that already exist in the allowed data set again.

[0062] The data selection module 104 reads the word segmentation method, vocabulary version, and serialization rules bound to the model; the word segmentation method must be consistent with the model actually called by the generation module; if the model or vocabulary version is switched, the occupancy is recalculated instead of using the old count; the reserved occupancy of the fixed instruction segment, the task segment carrying task information, the constraint segment carrying the constraint set, and the field permission segment carrying the output permission limit is the upper bound of the configuration obtained before generating the complete input, not the output permission content that has not yet been generated; this upper bound can be calculated by the number of fields allowed by the template, the identifier length, and the fixed serialization format, and is checked again when the actual packaging is completed; the fixed instruction is counted according to the actual text word segmentation, the task information and constraint set are counted according to the fixed serialization format, and the reserved occupancy of the field permission segment is determined according to the maximum number of entries allowed by the template, the identifier length, and the serialization format; the output permission limit has been included in the field permission segment and will not be deducted again as an additional segment; after the complete controlled output package is generated, it is recounted according to the same word segmentation method, and the model is not submitted when the actual occupancy exceeds the budget.

[0063] The input sequence consists of a fixed instruction segment, a task segment, a constraint segment, a data segment, and a field permission segment. The system first deducts the reserved space for non-data segments from the available input budget to obtain the data budget. If the result is not positive, an empty input data set is returned, and the system records whether the budget is not covered or the source data is missing based on the coverage of the allowed data set. The maximum number of terms in the model output is reserved separately from the total length of the context, without filling the input data and then relying on the server for automatic truncation. Serialization delimiters and reference markers are part of the reserved space.

[0064] After creating an initially empty set of selected segments, each complete evidence group is treated as a candidate segment group. The segment identifier difference set of the candidate segment group relative to the set of selected segments is calculated, and the new segment set corresponding to this difference set is extracted from the allowed data set. The candidate segment group and the set of selected segments are merged and serialized according to a fixed identifier order to obtain the actual input representation of the trial segment set. The usage of trial segment terms is calculated based on the actual serialized text segmentation. It cannot be simply assumed that the sum of the lengths of independent segments is always equal to the length of the concatenated segment.

[0065] The newly added lexical occupancy represents the count of the newly added fragment set and its necessary separators and reference metadata; this embodiment uses a fixed special separator mark that can isolate fragment boundaries so that single fragment encoding is not re-segmented due to changes in adjacent content; when the deployment model does not support this mark, the selection ratio can still be calculated based on the count of newly added fragments, but whether the budget is exceeded must be determined by the re-segmentation result of the complete trial selection input; even if the approximate newly added occupancy affects the ranking, it cannot break through the feasibility condition of actual budget verification.

[0066] Based on the number of output items that can be fully supported by the trial fragment set and the selected fragment set, the number of output items in the set difference is calculated to obtain the coverage gain; output items that are already fully supported are not counted again in the gain; when the same new fragment closes 3 output items at the same time, the gain is 3 instead of 1; after filtering out candidate groups that exceed the budget, have zero new occupancy, or have zero gain, the selection ratio of coverage gain divided by new occupancy is calculated; selection is made in descending order of ratio, and if the ratios are the same, selection is made in ascending order of the lexicographical order of the fragment identifier sequence. In each round, only the candidate fragment group ranked first is merged into the selected fragment set.

[0067] After each merge, the new fragments and coverage gain of all remaining candidate groups are recalculated until there are no candidate groups that meet the criteria. Since each effective selection adds at least one fragment and allows for a finite data set, the iteration can terminate. This selection process is a deterministic round-by-round selection and does not claim to obtain the globally optimal coverage among all possible sets. The set obtained after rerunning with an increased budget does not necessarily have to be a superset of the smaller budget set.

[0068] Figure 5 This demonstrates the processing flow for selecting complete fragment groups within the context budget. First, the data budget is obtained by subtracting reserved space from the context budget. When the data budget is not positive, an empty inbound data set is returned. Then, each complete evidence group is treated as a candidate fragment group. The difference between the candidate fragment groups and the selected fragment set is calculated in ascending order of fragment identifiers to obtain a new fragment set. The new term usage, trial term usage, and coverage gain are also calculated. Candidate fragment groups with trial term usage exceeding the data budget, zero new term usage, or zero coverage gain are eliminated. The remaining fragment groups are sorted in descending order of the ratio of coverage gain to new term usage, and in ascending order of fragment identifier sequence for the same value. In each round, only the top-ranked candidate fragment group is merged into the selected fragment set. This process is repeated until no candidate fragment groups meet the criteria, resulting in the inbound data set. After selecting a candidate fragment group, only the group-by-group calculation steps can be returned; the final output cannot be entered simultaneously. Figure 5 The filtering only applies to the current round. In the next round, the candidate groups will be re-checked based on the updated set of selected segments. Only when there are no selectable groups will the input data set be output.

[0069] The determination of evidence status uses the allowed data set, the data set included in the package, and evidence dependencies under the same task version; first, extract the actual fragment identifiers within the allowed range to form source coverage records, and then extract the associated fragment identifiers of the actual included package to form included package coverage records; the source coverage record is a projection of the allowed range, and the included package coverage record is a projection of the actual input of the model; it is not possible to assume that all fragments are still valid based solely on the registration information of the complete evidence group, and the record version and the data withdrawal status need to be consistent during the inspection.

[0070] The source coverage record is compared with the complete evidence set of the corresponding output item one by one; if there is no evidence set that can be completely included in the source coverage record, the evidence status of the output item is determined to be missing source data, and the uncovered fields and the field combinations that cannot be co-referenced are extracted from the field association and co-reference conditions; the missing source data here includes the situation of lacking available joint evidence, and multiple records of different subjects or period roles that are not valid are not spliced ​​into complete evidence; the reasons for not being co-referenced and the reasons for the actual absence of field records are stored in the supplementary evidence field records respectively.

[0071] For output items with complete evidence groups within the source scope, check whether the inbound coverage record contains all fragment identifiers of at least one complete evidence group; if it contains them, the evidence is complete; if it does not contain them, the budget is not covered. The appearance of a field name in a fragment does not mean that the field is covered; only evidence records that are confirmed by the aforementioned field are included in the check. Similarly, if two incompatible alternative groups are each partially included, they cannot be judged as complete just because the sum of the number of fields is sufficient; at least one group that can be referenced by each other must be fully included in the package.

[0072] When the budget is not covered, the fragments that have already been included in the package are deducted from each complete evidence group to obtain the missing fragment group of that group; gaps in different complete evidence groups are kept in groups, and not all gaps are merged into a large set that must be included in all of them; in this way, when reselecting data, an executable solution can be selected from different alternative evidences, without having to repeatedly add mutually substitutable materials; when a gap is empty but is marked as not covered by the budget, it is considered that the state is inconsistent with the set, the output is stopped and the state is recalculated.

[0073] Each piece of evidence status is recorded in relation to the output item identifier, evidence status, inspection version, and existing supplementary evidence or gap records; output items with complete evidence are only associated with the evidence status and supporting groups, without fabricating empty supplementary evidence tasks; output items with missing source data do not generate budget reselection tasks, because it is permissible for the data set not to contain a complete group that can close its joint basis; output items not covered by the budget do not directly require external supplementary evidence; this classification constitutes the input for subsequent actions and is not a subjective description of the model's confidence in its own answer.

[0074] When the data set is allowed to be empty, the output items and required evidence fields are still obtained from the template and rules, and the missing source data is recorded item by item, instead of passing all by default just because the loop is not executed; when an output item has no required evidence fields, it should be checked whether it is purely a title or format field; a substantial definitive conclusion should not be permitted by the logical truth value of an empty field set; when the template configuration omits evidence definitions, the configuration is recorded as pending review and the conclusion is kept empty.

[0075] The selection criteria are as follows: the target for reselection is the output items not covered by the budget, and the output items with complete evidence are the preservation items. The object of preservation is the integrity of the evidence, not that every single fragment must be retained. As long as at least one complete set of evidence still exists after the replacement, the preservation item can be replaced with another set of evidence that also meets the common citation conditions. Conversely, even if only one fragment is removed, if that fragment is a common necessary basis for multiple preservation items, it may also destroy the integrity of multiple items. Safety cannot be judged solely by the number of fragments removed.

[0076] Based on the gap fragment groups of the reselection target, obtain the fragments to be added from the allowed data set group by group; for each group of fragments to be added, enumerate the combinations to be removed from the current incoming fragment, and pair the incoming set and the removal set as replacement schemes; empty removal combinations are also included in the enumeration to cover the case where there is still a surplus in the data budget for direct addition; when a fragment appears in both the incoming and removal sets, the sets are simplified first to cancel the mutual cancellation operations; schemes that do not change after simplification are not counted as a valid reselection.

[0077] The replacement scheme is executed in the simulated storage area to obtain a set of candidate data to be included in the package. The system re-segments the candidate set to calculate the actual usage and checks whether the reselected target and each preservation item still have a complete set of evidence. Only the scheme with usage not exceeding the data budget, the reselected target having complete evidence and all preservation items remaining complete is included in the set of executable replacement schemes. The verification occurs in the simulated storage area and does not modify the official data to be included in the package. Therefore, a failed simulation will not break up the already complete evidence.

[0078] For executable schemes, count the number of different fragment identifiers removed; if the number is the same, compare the removed identifier sequence and the added identifier sequence in ascending order, and the identifier sequence with a length of zero is considered to be smaller than any non-empty identifier sequence; this comparison rule is used to recalculate the selection result of the same input, and does not mean that the data with smaller identifiers is more trustworthy in business; if all candidates are not executable, the original data set and the budget uncovered state of the reselection target are maintained, and the reselection success cannot be made by deleting preservation items or relaxing common reference conditions.

[0079] To limit enumeration overhead, inverted indexes from preserved items to complete evidence groups and from complete evidence groups to fragments can be built before the search. When enumerating to a removal branch, if all candidate complete groups have been destroyed and the fragment to be added cannot recover any of them, the entire branch is not feasible and expansion can be stopped. This pruning is based on the definite inclusion relationship from the complete groups, not the prediction of the learning model. If an enumeration workload limit is configured and the process stops before exhaustion, the incomplete reselection should be recorded and not reported as proof that no feasible solution exists.

[0080] Replacement submissions use a one-time update: after the candidate set passes the budget and preservation checks, it is written into the new version along with the recalculated evidence status, comparability status, and output permission set; if the original data version changes during the writing process, the candidate submission is abandoned and reread; the new evidence status cannot be published before the data content is written, as this will temporarily generate evidence that the permission points to non-existent evidence; the competition between data version changes and candidate generation is handled according to the version binding process described later.

[0081] Comparability verification first obtains complete evidence for the output item to be verified, and checks the subject, reporting period, and indicator scope. Subject verification uses the target object identifier and allowed subject relationships, and does not use complete consistency of name text as the sole basis. Consolidated financial statements and parent company financial statements have different scopes. Reporting period verification checks whether the balance point, cumulative period, year-on-year comparison role, or rolling period comply with the rules. Indicator scope verification checks whether it includes tax and excludes tax, net amount and total amount, consolidation scope and calculation composition. When the scopes are inconsistent, forced comparison is not performed through unit conversion.

[0082] For evidence of caliber matching, the original numerical value, original unit, numerical precision, and rounding method are read; numerical precision refers to the minimum display step size given in the original text, and rounding method refers to rounding, truncation, or other clearly defined rules; if a rounding method is missing, it is not assumed that all data uses the same rounding rule. In this embodiment, the corresponding item is listed as incomparable and enters the review; changes in the decimal multiple of the monetary unit are considered to be conversions of the same dimension scale, and changes in exchange rates between currencies also involve the date and the source of the exchange rate, and are not considered as simple unit scaling without additional conditions.

[0083] When restoring the displayed value to the rounding interval using the minimum display step size, the system first reads the explicit rounding rules. For rules that round to the nearest value, the system subtracts half a step size from the displayed value as the lower bound and adds half a step size as the upper bound. Then, it determines whether the two endpoints belong to the interval based on the midpoint rounding direction. It is not acceptable to simply write "rounding" and ignore negative numbers and the midpoint convention. For rules that truncate to zero, positive displayed values ​​correspond to a left-closed, right-open interval from the displayed value to the displayed value plus one step size; negative displayed values ​​correspond to a left-open, right-closed interval from the displayed value minus one step size to the displayed value; and zero displayed values ​​correspond to an open interval from one negative step size to one positive step size. The system then intersects the range of known values. When using other rounding rules, the boundary is determined by the set of original values ​​that can produce the displayed value. If no rule is given, the system proceeds to verification. An interval represents the allowed range of rounding, not a statistical confidence interval. When displaying, the midpoint must not be referred to as the remeasured true value.

[0084] Read two units of measurement with the same dimensions and the conversion ratio from the original units to each unit of measurement from the comparable conditions, and convert the endpoints of the intervals respectively to obtain two sets of standard intervals; the dimensional constants and tolerances in the numerical relationships are converted at the same time, while the dimensionless ratio threshold remains unchanged; if only the evidence values ​​are converted without converting the absolute tolerances, the same batch of evidence may fail at the yuan level but pass at the ten thousand yuan level. Therefore, synchronous conversion is a necessary input preparation for scale consistency checks.

[0085] The specific rules for interval operations are as follows: When performing an equality check between two standard intervals, the intersection of the two intervals is taken. A non-empty intersection indicates that the two values ​​may be equal under a given precision, i.e., numerically compatible; an empty intersection indicates that the two values ​​cannot be equal under a given precision. It should be noted that for the two intervals being compared, a non-empty intersection indicates the existence of the same value, which is a condition for determining the numerical compatibility of the intervals, but not a sufficient condition for the actual true values ​​to be equal. Therefore, the conclusion of this check can only be used to eliminate numerical contradictions, and cannot be used to determine that the two values ​​are equal.

[0086] When performing a summation check, the lower bound of the sum interval is equal to the sum of the lower bounds of the intervals of each addend, and the upper bound of the sum interval is equal to the sum of the upper bounds of the intervals of each addend. Then, check whether the intersection of the sum interval and the total amount interval being checked is non-empty. When each addend takes independent values ​​within its own interval, the above summation endpoint rules apply to both non-negative and negative values. If there are other common constraints among the addends, the sum interval can be used as an outer interval. In this case, if the intersection is empty, a contradiction can be determined. If the intersection is non-empty, the common constraints need to be checked.

[0087] When performing multiplication, calculate the four products of each endpoint of the two intervals, and take the minimum and maximum values ​​as the lower and upper bounds of the product range. Determine whether the endpoints are open or closed based on whether the corresponding extreme values ​​can actually be obtained. When performing division, first check whether the closure of the divisor interval contains zero. If it contains zero, do not perform finite endpoint quotient calculation and proceed to verification, because even if the zero endpoint does not belong to the interval, the quotient may be unbounded. When the divisor interval maintains a non-zero interval with zero, calculate the quotient of the four endpoints and take the minimum and maximum values ​​as the boundary of the quotient range. Multiply or divide the dimensions involved in multiplication and division respectively, and only compare the resulting range with the target range of the same dimension. For the check that the first value is strictly greater than the second value, it is determined to be satisfied when the lower bound of the first range is greater than the upper bound of the second range, and it is also determined to be satisfied when the two are equal and cannot both reach the boundary. It is determined not to be satisfied when the upper bound of the first range is less than or equal to the lower bound of the second range. Other cases are recorded as uncertain. This distinction between strict and non-strict relationships avoids giving the opposite conclusion when the boundaries are equal.

[0088] Equality relationships determine numerical compatibility by checking for intersections between standard intervals; summation relationships first form a sum interval based on the intervals of each addend, then check its intersection with the interval of the total amount being verified; multiplication and division relationships should consider endpoint combinations, and when the closure of the divisor interval contains zero, a finite endpoint quotient is not used for definite ratio verification, and it should be subject to further review; comparison relationships distinguish between certain satisfaction, certain non-satisfaction, and indeterminability based on the upper and lower bounds of the interval; indeterminability does not equate to satisfaction, nor does it necessarily mean that the data is falsified, it only indicates that the given precision is insufficient to make a definite judgment.

[0089] Perform the same relation check and compare the results under two verification units to obtain a scale consistency result; use decimal rational numbers or sufficiently accurate decimal arithmetic to save endpoints to avoid binary floating-point errors causing boundary intersections to be misjudged as separations; when the two scales yield different results, the system does not choose the more lenient one as the conclusion, but instead records the corresponding items as incomparable and locates the conversion or calculation anomaly; when both scales determine numerical contradictions, it only indicates that the comparison method is stable, and the contradiction itself still enters the numerical and conclusion consistency check, and the conclusion cannot be directly deduced to be correct from scale consistency.

[0090] For the difference between the current period's revenue and the comparative period's revenue, the system first constructs the current period's revenue range and the comparative period's revenue range according to their respective display precision and rounding rules, and then reads the difference target constant and absolute tolerance. The two revenue ranges, the difference target constant, and the absolute tolerance all use the same monetary unit and the same currency, and the absolute tolerance must not be negative. If the source currency or period caliber does not meet the comparability conditions, the relationship check is stopped and the process is transferred to review.

[0091] Under the first verification unit, the lower bound of the difference is obtained by subtracting the upper bound of the comparison period's income interval from the lower bound of the current period's income interval, and the upper bound of the difference is obtained by subtracting the lower bound of the comparison period's income interval from the upper bound of the current period's income interval. The target lower bound is obtained by subtracting the absolute tolerance from the target constant of the difference, and the target upper bound is obtained by adding the absolute tolerance to the target constant of the difference. The larger of the lower bounds of the two intervals and the smaller of the upper bounds are taken to obtain the candidate boundary of the intersection. When the lower bound is less than the upper bound, the intersection is non-empty. When the lower bound is equal to the upper bound, the intersection is non-empty only when both intervals contain the point. In other cases, the intersection is empty. Based on this, numerical compatibility or numerical contradiction is recorded. Compatibility cannot be directly expressed as the actual difference being proven to be equal to the target.

[0092] Under the second verification unit, the endpoints of the two income intervals, the target constant of the difference, and the absolute tolerance are multiplied by the corresponding positive conversion ratio, and the opening and closing attributes of the endpoints are retained; the second set of relationship verification results are obtained according to the same difference calculation and intersection check rules, and then compared with the first set of results; since the positive proportion conversion maintains the interval order and intersection relationship, the correct synchronous conversion should maintain the consistency of compatibility or contradiction judgment. When the results are inconsistent, the unit conversion record and calculation implementation should be checked.

[0093] If only the income value is converted while the conversion of the difference target constant or absolute tolerance is omitted, the actual physical range of the system comparison has changed, and the two sets of relationship verification results may be inconsistent. Even if a certain set of inputs accidentally obtains the same judgment, it cannot be concluded that the conversion is correct. Each dimensional object in the unit conversion record and its conversion path should still be checked. For the conversion omissions that have been found, the configuration or calculation anomaly should be registered and reviewed. The more lenient judgment result should not be selected as the output basis.

[0094] When it is necessary to record the compatibility margin, the dimensionless intervals with a clearly selected reference display step size can be checked. If the intersection is empty, the compatibility margin is not calculated. If the intersection is not empty, the intersection width is obtained by subtracting the lower bound from the upper bound, and then divided by the positive reference display step size to obtain the dimensionless compatibility margin ratio. The reference display step size and its source are saved with the verification relationship. If the step size is missing, non-positive, or there is no selected rule between different sources, it is transferred to the review. If the intersection width is less than the reference display step size, the deterministic expression is restricted according to the existing handling rules, and this ratio is not referred to as the convergence process or statistical confidence level.

[0095] Figure 6The diagram illustrates the processing flow for evidence status and comparability assessment. The diamond-shaped judgment boxes represent the assessment of each inspection condition. The source coverage missing branch only generates a source data missing status and a supplementary evidence permission; the package coverage missing branch only generates a budget not covered status and a reselection permission. Neither of these proceeds to comparability verification. Only complete evidence items are checked for scope, unit and rounding conditions, and dual-scale results. If all checks pass, the evidence is deemed comparable, and a corresponding output permission is generated. First, the actual fragment identifiers within the allowed range are extracted to form a source coverage record. Then, each item is checked to see if a complete evidence group falls into the source coverage record. If not, it is determined that the source data is missing, and supplementary evidence is required. If it does, the package coverage record is further checked to see if it contains all fragment identifiers of at least one complete evidence group. If the data is included, it is determined that the budget does not cover it and the selection of new data is required. For output items with complete evidence, the subject, reporting period and indicator scope are checked. The displayed value is expressed as a rounding interval according to the numerical precision and rounding method. Then, the interval endpoints, dimensional constants and tolerances are converted according to the unit conversion records to obtain the verification relationship under two verification units. Interval operation and intersection check are performed separately. If the verification results of the two sets of relationships are inconsistent, the units cannot be converted or the precision and rounding method are missing, they are determined to be incomparable and a review is required. Only when the subject, reporting period and indicator scope match, the unit and rounding information are valid and the two sets of results are consistent, are they determined to be comparable and participate in the generation of the output permission set. Consistency between the two scales only indicates that the scale processing is stable and does not replace the verification of the consistency between the numerical values ​​and the conclusions.

[0096] The set of output permissions generated before model invocation is called the evidence permission set. It is generated line by line according to the output items to be output, including evidence status, comparability status, allowed conclusion type, disposal status, available evidence reference, and rule version. The comparability status is recorded as not yet executed for items with incomplete evidence, and the default pass value cannot be used. The permission control module 105 first judges the evidence status, and then reads the comparability status in the evidence completeness branch. If the source data is missing, it enters the supplementary evidence stage; if the budget is not covered, it enters the data reselection stage; if the evidence is complete but not comparable, it enters the review stage; only output items with complete and comparable evidence enter the generation of candidate deterministic conclusions.

[0097] Output permission indicates the upper bound of generation and publication, rather than forcing the model to generate a certain positive conclusion; even if the permission allows a deterministic conclusion, the model may fail due to constraint conflicts or inability to complete structure generation; failures are handled by the verification and handling module; for an output item that is associated with multiple rules, the deterministic conclusion permission must satisfy all mandatory prerequisites, and the majority rule approval cannot be used for release; suggestive rules can affect risk warning text, but cannot cover mandatory prohibitions.

[0098] This embodiment distinguishes between evidence permission and release permission; evidence permission is generated before model invocation and is used to restrict field values; release permission is generated after candidate due diligence content verification and is used to control report output; both refer to the task, data, and constraint versions; for cases where the evidence is complete and comparable but the numerical references in the candidate due diligence content are incorrect, evidence permission can still be open, while release permission must be blocked or rewritten; mixing the two types of permission will cause a check before generation to incorrectly become the release credential for any subsequent text.

[0099] When data is successfully reselected, the evidence status and output permission of the affected items to be output are regenerated based on the newly included data set; items that were previously not covered by the budget can be converted to complete evidence; the comparability of preserved items still needs to be checked to see if it changes with the replacement of evidence sources; when alternative evidence has the same field but uses different standards, completeness can be retained but comparability may not be retained, so reselection does not just modify a budget status field; the status transition record retains the values ​​before and after and the triggering data identifier to support partial re-verification.

[0100] For the summary conclusions in the report, the system uses the summarized output items as its reference dependencies; if the summary rule requires all sub-items to have a definitive conclusion, the definitive permission for the summary conclusion is turned off when any sub-item is in the state of supplementary evidence, re-selection of data, or review; if the rule allows only the subset that has been approved to be summarized, the summary scope must be clearly stated in the template and the items not included must be displayed, and partial approval cannot be described as full approval; in this way, an unresolved issue upstream will not be repackaged into a definitive conclusion by natural language at the summary layer.

[0101] The generation module 106 connects to the large language model inference service, and its structure and interface details are as follows.

[0102] The main improvement in this embodiment lies in the collaborative processing of evidence selection, permission constraints, and publication verification, without requiring the reinvention of the basic language model. An implementable generation module adopts an autoregressive decoder-style Transformer language model, consisting of lexical embedding, position representation, repeated causal self-attention and feedforward computation layers, normalization layers, and vocabulary projection layers. The input is a controlled output packet sequence and generated lexical prefixes, and the output is the unnormalized score of the next lexical on a fixed vocabulary. The basic parameters can come from a trained model with legal usage conditions, and the model parameters, configuration, vocabulary, and word segmenter must be loaded as the same version.

[0103] The model reads the corresponding vector from the embedding parameters according to the lexical encoding and adds the position representation according to the loaded model configuration to obtain the input representation. In each attention head, the input representation is linearly projected onto the query, key, and value respectively. Each component of the projected output is obtained by multiplying each input component by its corresponding weight and then summing them. If there is a bias, the corresponding bias is added. For each query position, the query vector is multiplied by the corresponding component of the key vector of the allowed reading position and summed. Then, it is divided by the positive square root of the key vector dimension to obtain the attention score. Only the scores of the current position and previous positions are exponentially normalized. The obtained weights are multiplied by the corresponding value vector and summed component by component to obtain the output of the head. The outputs of each head are concatenated and the hidden representation is updated according to the output projection of the loaded model, residual connection, normalization, and feedforward layer. Finally, the next lexical score is obtained by the vocabulary projection layer. Future positions are not included in the normalization to avoid reading content that has not yet been generated. The hierarchical order of the model and the activation function are based on the model configuration corresponding to the loaded parameters.

[0104] The number of layers, attention heads, hidden dimensions, and feedforward dimensions are read from the model configuration, and it is checked that the hidden dimensions are divisible by the number of heads. The output dimension of the vocabulary projection is consistent with the actual vocabulary length. The generation module calls the inference interface only after each dimension is consistent with the tensor shape of the loaded model parameters. If different normalization positions, positional encodings, or feedforward activation structures are selected, as long as the complete generated score can be returned according to the same vocabulary and the decoding control interface of this embodiment is satisfied, the external evidence and permission chain do not need to be changed.

[0105] Causal attention masking and field permission masking are different objects; the former restricts which input positions a lexical can focus on, while the latter restricts which vocabulary elements the next lexical can be selected as; this embodiment does not guarantee business correctness by directly rewriting the business rules into an attention matrix, but instead applies field permission generation constraints after vocabulary projection, and the results are confirmed by a validator outside the model; if the generation scoring interface can only return the final text and cannot accept lexical constraints, a deployment interface with controllable decoding should be used.

[0106] The inference interface should include at least the model version, vocabulary version, input lexical sequence, current prefix, optional lexical set, maximum output length, and cancellation flag. The interface should return the next lexical score or the lexical after being constrained by the legal set, as well as the termination reason. The key-value cache is identified by the model version, input package version, and prefix. The cache of the old input should not be reused after the data package changes. The cache only reduces redundant calculations and does not have the right to overwrite external permissions. The residual prefix after cancellation can only be entered into the failure record and cannot be published as a complete candidate due diligence content.

[0107] The generation module applies external field permission constraints after projecting the vocabulary and then hands the candidate content over to an external validator. The model does not assume the final decision on permission configuration, rule application status, or evidence authenticity. Training can improve the model's adherence to structure and terminology, but it cannot replace the judgment of the complete evidence set, nor can it prove that the data not included in the package has been correctly memorized by the model. Even if the base model has seen information about a certain enterprise during the pre-training stage, this task still only allows the use of evidence identifiers in the data set included in the package.

[0108] When it is necessary to improve the due diligence expression and structural output, the trained base model can be domain adapted; this training is an optional preparation process in this embodiment and is not an online step that must be performed for every due diligence task; the base model that has not been domain adapted but meets the scoring interface can still perform evidence selection, field permission and external verification processes; the adapted model cannot skip these processes either; the adaptation parameters are bound together with the base model version and are loaded according to the binding relationship during inference.

[0109] Training samples consist of authorized data fragments with identifiable sensitive information removed, task information, constraint sets, field permission tables, and target structured content; target content should be jointly confirmed by rule calculation and manual review; positive samples contain complete evidence, correct citations, and conclusions consistent with the permission; difficult samples contain missing required fields, budget not covered, similar company names, different reporting periods, unit changes, withdrawn data, and cross-chapter contradictions; the goal of difficult samples is not to have the model fabricate and complete them, but to output the corresponding disposal status, empty conclusions, and legal citations.

[0110] Data partitioning is based on target objects and source documents as grouping units. Adjacent segments of the same object, different chapters of the same report, and their rewritten copies must not be repeatedly assigned across training, validation, and test partitions. Variants constructed from the original samples, such as unit scaling and segment deletion, are included in the same partition along with the original samples. The training set is used to update parameters, the validation set is used to select configurations and stopping conditions, and the test set is used only for independent checks after selecting the configuration. Budget truncated versions of the same report should not be treated as independent customer samples to avoid exaggerating the model's adaptability to unseen data.

[0111] When constructing the teacher target sequence, the conclusions of the items to be supplemented are set to null values ​​according to the field permission table, and the evidence citation is restricted to the actual input packet identifier. During training, the controlled output packet and the real target prefix are used as input. The predicted probability of the correct word is read for each target position, the natural logarithm is taken, and then the negative number is taken. The results of each effective target position are accumulated and then divided by the total number of effective target words to obtain the average sequence loss. The filling position and the data input position are not included in the denominator, and the sample with zero effective target words is not included in the update. When calculating the log probability, the maximum value of the vocabulary score at the current position is taken first. Each score is subtracted from the maximum value, the exponent is taken and accumulated, and then the natural logarithm of the accumulated value is taken. The correct word score is subtracted from the maximum value and then the natural logarithm is subtracted to obtain the log probability of the correct word, avoiding rounding the extremely small probability to zero or directly taking the exponent of the excessively large score. Backpropagation is performed on this loss to obtain the gradient of the trainable parameters. The gradient is scaled according to the learning rate and then deducted from the corresponding parameters. The frozen base weights remain unchanged. The word probability quality that violates the field permission can be used as a diagnostic record and does not replace external verification.

[0112] One parameter update implementation trains only additional low-rank adaptation parameters; it saves the frozen original weights for a specified linear projection and adds two trainable matrices, the inner dimension of which is the adaptation rank; the result of the input after continuous projection through the two matrices is added to the original linear output according to the configured ratio; the adaptation rank is less than the input and output dimensions of the original projection, and one of the matrices is initially set to zero, while the other is set according to the non-zero initialization rule of the loaded adaptation implementation, so that the initial adaptation output does not disturb the base model; this structure is an optional implementation that saves training resources and is not considered a separate contribution of this application that distinguishes it from the prior art.

[0113] Before training, the candidate configuration generation rules, validation metric order, validation interval, and stopping conditions are fixed and saved as the training configuration. The candidate learning rate is positive, and the candidate batch size and fit rank are positive integers that satisfy the model dimension and resource constraints. Short-term trial training is first conducted within the training partition to exclude configurations with memory overruns and non-limited loss or gradients. On the same validation set, configurations with higher structure pass rate, lower false reference rate, and lower effective target loss are selected in sequence. In case of a tie, the configuration with fewer trainable parameters is selected. The structure pass rate is the number of samples with closed structures and all required fields divided by the number of effective validation samples. The false reference rate is the number of false or out-of-bounds references divided by the total number of references. When there are no references, the no-reference state is recorded separately. When the validation target requires references but the model omits them, it is recorded as a failure of the reference integrity check. The no-reference state is not considered as zero error rate for selection. When the validation set is empty or the effective samples are insufficient to calculate the metrics, the release configuration is not selected based on this. The test set is only used for checking after the configuration is selected, and the metric order is not modified based on the test results.

[0114] Batch sizes are configured using candidate integers and tested item by item, selecting configurations that can complete forward, backward, and parameter updates after reserving memory. When accumulating across batches, the loss sum of effective target words is accumulated first, then normalized according to the total number of effective target words in the same update. The last batch uses the actual number of effective words to avoid inconsistency with the denominator of the aforementioned sequence loss. When a non-finite gradient occurs, the update is canceled and the sample is recorded. The verification index is calculated according to a predetermined verification interval. The current index is compared with the current best checkpoint in a predetermined order. If it is better than the best value, the checkpoint is saved and the unimproved count is cleared; otherwise, the unimproved count is increased. When the continuous unimproved condition specified in the training configuration is reached, the learning rate is multiplied by a decay ratio greater than zero and less than one in the configuration. When the early stopping condition or the upper limit of the calculation budget is reached, the update is stopped and the optimal checkpoint in the verification record is restored. The decay trigger condition, stopping condition, and ratio are fixed and saved before trial training and are not adjusted according to the test set.

[0115] The model release package includes basic model identifiers, adaptation parameters, configuration, vocabulary, word segmenter, training data version summary, verification records, and interface compatibility results. Before release, structural closure, illegal references, empty permissions, empty candidate terms, and maximum length termination tests are run. Models that fail these interface tests cannot enter the generation module. If the word segmentation method of the new vocabulary generated by training changes the word segmentation method of the reference identifier, the legal prefix structure is regenerated and the data usage is recalculated. The old budget and old constraint cache cannot be reused simply by replacing the weight file.

[0116] The controlled output package includes task information, an inbound data set, a constraint set, an output structure, a field permission table, an optional identifier set, and version binding information. Inbound data uses clearly defined data areas, and quotation marks, control characters, and structure delimiters are escaped to prevent data strings from being misidentified as control fields during program parsing. When filtering or desensitizing prohibited items changes the content or version of the actual submitted fragment, the evidence dependencies and complete coverage are rechecked, and the output permission, reference mapping, and actual term usage are updated; open permissions before filtering cannot be used. When necessary evidence cannot be submitted due to input prohibitions, the corresponding deterministic conclusion is closed, and the reason for prohibition is recorded, without disguising it as a simple budget shortfall. Statements in the data that ignore the above rules are still considered text to be analyzed and do not change the field permission table. Control fields recognized by the parser can only come from the program-constructed structure and cannot come from uninterpreted data strings.

[0117] When assigning reference identifiers to incoming fragments, a mapping is established from reference identifiers to fragment identifiers and content versions. Reference identifiers are short identifiers oriented towards model output, while fragment identifiers in evidence dependencies are stable identifiers oriented towards internal storage. The two have different purposes and are connected through a mapping table. They cannot be assumed to be interchangeable simply because they look the same. After the model outputs reference identifiers, the external validator first parses the mapping and then checks whether the support group is complete and whether the data versions are the same. The mapping record uses the reference identifier as the key and the fragment identifier and content version as the associated values. The external validator queries the record using the reference identifier in the candidate due diligence content.

[0118] After creating an empty prefix, the output structure parser determines the current field from the initial state. The output structure can use structured text with a fixed field order to reduce the complexity of cross-field escape. The required delimiters, enumeration values, null values, and terminators of the field all have defined syntax. For enumeration and reference identifiers, the system constructs a serialized text of legal field values ​​based on the actual output field delimiters and escape rules, combined with the current prefix. This is then encoded by the current tokenizer into a contiguous word sequence, and a prefix matching structure is established. Candidate words must enable the already formed field prefix to continue to expand to at least one legal complete value, and not just the character itself appearing in the allowed string. The prefix matching structure registers the prefixes and contiguous words of each legal complete word sequence, registering each word sequentially starting from the empty prefix. During filtering, the contiguous words corresponding to the current prefix are queried, and the candidate word set is determined by combining the field parsing state after appending complete words.

[0119] A term may contain quotation marks, delimiters, and multiple characters simultaneously; therefore, filtering must simulate the parsing state after appending the entire term, and cannot simply check the first character. For terms that cross field boundaries, the parser processes all its characters sequentially and checks the permissions of each field it crosses. Prohibited words cannot be simply deleted as arbitrary substrings, otherwise it may break the legal unit name. Prohibitions should be implemented in conjunction with field paths, string boundaries, and the output types that need to be controlled. Free text fields are still subject to structural boundaries, length, and publication semantics validation constraints.

[0120] After the model returns the vocabulary and generates scores, scores outside the candidate word set are set to negative infinity. For valid scores, the validity of the values ​​is checked first. If an undefined number or positive infinity is found, the generation is recorded as failed. Negative infinity can represent zero probability, but there should be at least one finite valid score. The maximum value of the finite valid scores is taken, and each finite valid score is subtracted from the maximum value. Then, the difference is exponentially calculated with the natural constant as the base. All exponential results are summed, and each exponential result is divided by the sum to obtain the normalized probability. Negative infinity corresponds to a probability of zero. Normalization is not performed when the candidate set is empty or there are no finite valid scores. The next word can be selected using the maximum probability selection. Words with the same probability are sorted in ascending order by word number. When random sampling is required, the seed and sampling configuration are saved. The selection range is always limited to the valid candidate set.

[0121] The generated tokens are appended to the prefix, the parsing status is updated synchronously, and the next round of candidate filtering is executed; when the output structure is closed and all required fields have appeared, candidate due diligence content is formed; when the maximum output length is reached but the structure is not closed, it is recorded as a truncation failure; the terminating token can only appear in a valid final state and cannot be allowed when the required fields have not been filled in; when a certain output item fails, the failure state can be saved on the program side and the remaining independent items can be completed, but incomplete token strings must not be concatenated into a seemingly valid conclusion.

[0122] Figure 7 This demonstrates the process flow for controlled output packet construction and controlled decoding. First, a controlled output packet containing the output structure, field permission table, optional identifier set, and data area boundaries is constructed. An empty lexical prefix is ​​created, and the current field is determined by the output structure. Then, candidate lexicals that can be appended and remain valid values ​​are selected from the lexicon according to the field permission table and optional identifier set. Generation of this item terminates when the candidate lexical set is empty. Subsequently, a large language model is called to read the controlled output packet and lexical prefix to obtain lexical generation scores. Scores outside the candidate lexical set are set to negative infinity and normalized. The next lexical is generated and appended to the lexical prefix. This process of filtering and generation is repeated until the output structure is closed, yielding candidate due diligence content. If an undefined number or positive infinity appears in the valid scores, there are no finite valid scores, or the maximum output length is reached without closure, the item is terminated and a failure is recorded. Figure 7 The diamond-shaped decision boxes in the code represent the judgment of each termination condition. When a termination condition is triggered, the corresponding branch terminates the generation or records the failure. If the condition is not triggered, the main chain returns to the candidate word filtering step to continue execution.

[0123] Field permission masking can prevent unauthorized structural values ​​or source identifiers, but it cannot guarantee the semantic correctness of all free text on its own; therefore, candidate due diligence content must be externally validated; model self-assessment, additional prompts, and second model responses cannot replace this release control. Figure 2The modules and their output paths are represented by a block diagram. The generation module and the verification and processing module are represented separately. It is emphasized that the model output buffer does not have a direct path to the formal report storage.

[0124] The verification and handling module 107 reads the controlled output package and candidate due diligence content, first performs structure parsing to determine the output items, field paths, and reference identifiers, and then performs checks on data scope, rule application, subject, reporting period, indicators, units, and expression boundaries. If the structure cannot be parsed, it does not directly publish seemingly correct conclusions from the messy text. The original output can be saved to the failure buffer and partially regenerated or blocked according to the handling strategy. The verification results are recorded separately according to the output items and verification conditions, and not just a single full report pass flag is saved.

[0125] The data scope check parses the candidate citation identifier into the input fragment, verifies whether it exists in the current version, whether it meets the evidentiary dependence of the output item, and whether the original text location of the citation contains the fields required by the candidate statement; the existence of a citation number does not mean that it supports any sentence; for numerical fields, the candidate value is restored to the standard unit and compared with the source value or a legitimate calculation relationship; for indicators calculated from multiple sources, it is checked that all calculation inputs are within the same complete evidence group and the calculation path is recorded.

[0126] Rule applicability checks reuse applicable states and rule versions from the constraint set; when the model text claims that the rule is not applicable but the structured applicability state is undeterminable, the text is not allowed to overwrite the structured state; expression boundary checks are performed on deterministic conclusion fields, risk descriptions, and negative forms to prevent bypassing permission through complex sentences that cannot be excluded; for semantics that cannot be determined by deterministic rules, the review status is recorded, and a high-confidence answer from another model is not directly mapped to pass.

[0127] The consistency check between numerical values ​​and conclusions maps conclusions such as growth, decline, and exceeding thresholds to calculable relationships; if the intervals of the current period and the comparison period overlap, growth cannot be deduced from the difference in the last position of the displayed value; the same indicator repeated across chapters should use the same indicator caliber and reporting period; if one chapter uses a segmented caliber and another uses a consolidated caliber, the comparability should be judged first according to the comparability conditions, and inequality should not be directly identified as a contradiction; the compared object, relationship, and result are recorded together for use in local dependency tracking.

[0128] The handling strategy maps the verification status to output, rewrite, or block, and retains supplementary verification, reselection of data, and reasons for review in the structured status; independent content that passes can be output, but content that depends on the conclusion of the failure item must be handled according to the affected scope; blocking is a release control of the corresponding content, and does not necessarily delete the original failure text; the original text can be saved in the authorized audit area; rewriting does not mean that the model is allowed to read the entire database again, and the rewritten input is still subject to the current inbound data and output permission restrictions.

[0129] Local processing uses directed dependency records to express the reference relationships between data fragments, output items, content fragments, validation conditions, and output permissions; edges point from the referenced object to the referencing object; for example, a data fragment points to an output item that depends on its fields, an output item points to a content fragment that expresses its conclusion, a content fragment points to the summary content that references the conclusion, and a validation condition points to the output item that uses its judgment result; nodes retain object types and unique identifiers to prevent data nodes and conclusion nodes from being mistakenly merged with the same text name.

[0130] Edges are established based on the evidence and conclusion citations parsed from the candidate due diligence content, and the verification dependencies explicitly defined in the constraint set are added; when natural language citations cannot be uniquely resolved, the relevant edges are not assumed to be non-existent, but the corresponding chapters are included in the conservative dependency scope for review; local re-verification reduces the parts that can already be proven independent; unresolved citation relationships should not be ignored in order to obtain a smaller affected set; Table 5 is a table of dependency nodes and propagation relationships, which gives the correspondence between node types, edge directions and triggering actions.

[0131] Table 5: Dependency Nodes and Propagation Relationships

[0132] The content before processing is saved before the start of this round of data adjustment, license update, or rewrite actions; the content after processing is read from the same set of object identifiers after these actions are completed, and the two are compared using the same serialization method; the processing here refers to specific operations triggered by the disposal strategy, not abstract points in time without a source; if there are no data or license changes, the set of changed objects is empty; change nodes can still be formed based on content fragments that failed verification; the reselection results before the initial generation are already part of the initial input and are not compared with candidate due diligence content that does not yet exist.

[0133] After registering the changed objects and the content fragments that need to be rewritten as change nodes, the nodes pointed to by their outgoing edges are visited layer by layer along the directed dependency record; each node is registered only once, and circular references are handled using the queue to be visited and the set of visited identifiers until the queue is empty; the affected set contains the initial change node and all reachable reference objects; both the dependency edges before and after the update participate in the impact analysis to avoid the conclusion that the old content was not found after deleting an old reference.

[0134] Based on the affected set, extract the content required to construct the partial output from the input data set, constraint set, and output permission set. The complete evidence set of the affected output items must be retained, and only the single fragment that has changed cannot be taken. After constructing the partial controlled output package, generate replacement content, and at the same time verify the content fragments in the affected set that have not been modified. Unmodified does not mean that no verification is needed, because its evidence or upstream conclusions may have changed. For example, if the text of the summary conclusion has not changed, but the debt indicators cited have been updated, the summary conclusion still needs to be re-verified.

[0135] The local validation state is merged with the validation states outside the affected set that retain the same input version to obtain the updated validation state set; the merge is located by the output item identifier and the validation condition identifier, and the local result replaces the old result with the same key. The two results are not retained at the same time and the one that passes is arbitrarily selected; the content that still fails after one rewrite is not output; if the business requires processing again, a new processing round and version record should be formed, instead of unbounded retries within the same round; local validation cannot skip lightweight checks related to the closure of the global output structure.

[0136] Version content records save version identifiers and immutable content snapshots of the ingress data set, constraint set, and output license set; version identifiers can use monotonic serial numbers plus content summaries, with serial numbers used to identify the update order and summaries used to verify the actual content; only a version number that can be overwritten at any time is saved without saving the corresponding content, which cannot support difference location; the generated version record binds the candidate due diligence content with the three versions actually used this time, and the version verification record is further bound to the verification status set.

[0137] Before outputting, the system obtains a consistent read view of the current version required for this release and prevents this view from being overwritten during the version comparison to the release commit. Locking can be achieved by transaction locks or immutable snapshots and conditional commits. The locked object is the version relationship of this release, not a halt to data access for the entire organization. New data can be added to the new version, but cannot replace the snapshot being verified. For outputs with locked version records, the version identifiers of the three objects and the candidate due diligence content identifiers are compared to confirm that the verification conclusion applies to the same content.

[0138] When the versions are consistent and the verification passes, the verification and handling module submits the candidate due diligence content to the formal output area and records the handling results; when the versions are inconsistent, the output is paused, and the new and old content is extracted and compared according to the version content record to obtain the changed objects; the entire report cannot be regarded as a change just because the version number is different, nor can it be allowed when the version number is the same but the content summary is inconsistent; the changed objects are entered into the directed dependency record, the affected set is obtained, and local generation and re-verification are performed.

[0139] Regeneration requires the use of data, constraints, and permissions in the locked view. The generated version record and version verification record are updated and compared again. If the regeneration process requires adding incoming data or changing output permissions, the current release transaction should be terminated and a new locked view should be established first, rather than modifying the locked content while holding the old version record. Set the time budget and cancellation status for this round of release. If the timeout occurs, a blocking action will be taken and the lock will be released. Long-term lock holding that prevents data services from being updated is not allowed.

[0140] To avoid data changes triggering infinite retries, the handling strategy can stipulate that a single release request will perform a version difference regeneration at most once. If a match still cannot be found, the request will be blocked and a new request will be required. This limit is different from the maximum output length of the model and the number of local rewrites, and is stored in the corresponding configuration fields respectively. Any termination path will record the handling result before releasing resources. In case of abnormal exit, the recovery program will check for incomplete transactions and will not interpret the lack of handling results as successful output.

[0141] The versioning mechanism is used to maintain input consistency between verification and publication. It does not prove the authenticity of the source data, nor does it prevent authorized users from creating new erroneous data. Its direct function is to prevent the approval status corresponding to old evidence, old rules, or old licenses from being used to publish new content. For a published report, subsequent changes to the data form a new review task, rather than silently modifying the content of the original report and the original verification record. Retaining historical versions allows the reasons for changes, the scope of impact, and the re-verification process to be replayed.

[0142] Figure 8 The process flow for verifying and handling candidate due diligence content is shown. First, the controlled output package and candidate due diligence content are read and structural parsing is performed. If the structure cannot be parsed, the output of that item is blocked. After successful parsing, checks are performed on the data scope, rule application, subject, reporting period, indicators, units, and expression boundaries to obtain a set of verification states. All content that passes the check can be output. If the check fails, the content fragments that need to be rewritten and the objects whose content has changed relative to the original content are registered as change nodes. The objects referencing the change nodes are searched layer by layer along the directed dependency records until no new objects are added, and these are collected into an affected set. Then, the corresponding content is extracted according to the affected set to construct a local controlled output package. The large language model is called to generate replacement content and verify the replacement content and the unrewritten content fragments in the affected set. Finally, the updated verification state set is merged with the verification state outside the affected set to obtain an updated verification state set, which is used to execute output or block the process.

[0143] System Modules and Storage Organization

[0144] Figure 2The data range control module 101 receives task requests and multi-source data, and outputs a set of allowed data. The constraint arrangement module 102 reads the template and rule configuration, outputs a set of constraints, and establishes evidence dependencies by combining the numerical evidence records generated by the positioning module with the parsing records of other fragments. The positioning module 103 determines two circles based on the page distance from the center of the numerical region to the two content anchor points on the same page. It generates evidence records only when the circles are tangent and have a unique intersection point or after they intersect, and the row and column titles are unique. Otherwise, it registers a positioning anomaly. The data selection module 104 forms a set of data to be included within the budget. The permission control module 105 forms the evidence status, comparability status, and outputs a permission set. The generation module 106 connects to the large language model inference service and outputs candidate due diligence content. The verification and handling module 107 performs external verification and controls the report output. Each module is implemented by a processor executing a program and can be deployed on the same computing node or collaborate through a message interface with a version field.

[0145] The memory stores program instructions and runtime data. The persistent storage area stores source data, allowed range indexes, packet snapshots, candidate due diligence content, verification records, and published content. The model's working memory stores parameters, input tensors, and key-value caches, but does not serve as authoritative storage for evidence status. The authoritative records of task status are maintained by the permission control and verification processing module, and the model service has no right to modify them. Object identifiers, content summaries, and necessary data are transmitted between different modules, and the receiving end verifies the version consistency before processing.

[0146] There is a reselection feedback interface between the data selection module and the permission control module; output items not covered by the budget carry gap fragment groups into the reselection interface, and the reselection results include the candidate input data set, actual token occupancy, and preservation check results; only the new input package version after complete submission is notified to the generation module; there is a local rewrite interface between the verification and processing module and the generation module, the input of which is a locally controlled output package rather than an arbitrary natural language rewrite command, and the returned content still needs to be re-verified.

[0147] The system allocates an independent state space for each task, and uses task identifiers to isolate caches and streaming channels when sharing model services; the report output interface verifies whether the caller holds a release credential that matches the candidate due diligence content and version verification record; the credential is only used for one submission or an idempotent retry of a specific version, and cannot be copied and used to authorize new candidate texts; when the same submission request is received repeatedly, the existing processing result is returned instead of modifying the report content again, so as to avoid duplicate version releases caused by network retries.

[0148] System anomalies include data access failure, model service cancellation, inconsistent configuration versions, abnormal word segmentation count, verification timeout, and failed release transactions. Each type of anomaly has a clear status and recovery entry point. Model call failure does not change the evidence status of the original data, but it causes the current candidate generation to fail. Verification timeout does not mean verification passed. Release failure does not mean the candidate is invalid. It is necessary to distinguish between retryable storage failures and changed version conditions. During recovery, the status record should be verified first, and then it should be decided which step to redo. It is not possible to rerun all steps and overwrite the original record.

[0149] In one optional implementation, a due diligence task is used to illustrate the entire process; the task object is Company A, the current reporting period is a complete fiscal year, and the template requires output of three items: 001 debt-to-equity ratio, 002 revenue changes, and 003 completeness of debt repayment information; the asset segment, liability segment, current period revenue segment, comparative period revenue segment, and debt maturity arrangement segment each have independent identifiers; assets and liabilities need to be at the same point in time and within the scope of consolidation, current period revenue and comparative period revenue have different period roles, and the debt arrangement requires the source version to be valid.

[0150] The dataset is allowed to contain assets, liabilities, and two periods of revenue, but lacks debt maturity arrangements; based on the template and business rules, establish the required evidence fields for the three output items, forming a complete evidence group for the asset-liability ratio and a complete evidence group for revenue changes; the debt repayment data completeness item does not have a complete evidence group, so the unrelated fields are retained; if the data budget only allows the revenue change group to be included, the asset-liability ratio item is not covered by the budget, and the debt repayment data completeness item is missing source data, and the two are not merged into the same missing state because the model does not currently see the data.

[0151] Reselect data, using the debt-to-equity ratio as the target and the revenue change as the preservation item; in the case of alternative data organization, if the same included segment contains both asset data and current period revenue data, and meets the evidentiary correlation conditions for the two output items, then the two output items can jointly reference the segment; adding a liability segment may occupy a closed debt-to-equity ratio segment with a small increase; if it is necessary to remove the comparative period revenue segment to free up budget, and there is no alternative evidence group to maintain the integrity of the revenue change item, then the replacement scheme is rejected; the system keeps the budget uncovered, and cannot sacrifice an already complete item to allow the target item to pass and then claim that all evidence is complete.

[0152] Assuming there is an executable solution for reselection, the debt-to-equity ratio becomes a complete piece of evidence, and the caliber and unit of assets and liabilities are verified. In the demonstration, assets and liabilities both come from the same entity and point in time, expressed in ten thousand yuan and yuan respectively. The system converts them according to a clear conversion ratio and converts the absolute tolerance simultaneously. If the two scales yield consistent comparison results, the comparability is passed. If the liabilities come from the parent company's financial statements while the assets come from the consolidated financial statements, the comparability is not passed, even if the calculated ratio seems reasonable in numerical terms, a definitive conclusion cannot be reached.

[0153] Using the same field roles for asset and liability segments, the system reads the displayed value, display step size, and rounding method, and generates asset and liability ranges according to the explained rounding rules. The two ranges are then converted to the first and second verification units, respectively, retaining the source, reporting time, consolidation scope, and endpoint open / closed during the conversion. In this example, the denominator of the asset-liability ratio is the total assets. It is necessary to first confirm that the asset range is positively separated from zero before performing the ratio judgment. If the asset range contains zero or is close to zero and cannot form a bounded quotient, it will proceed to the review stage.

[0154] For determining whether the debt-to-asset ratio does not exceed the dimensionless threshold given by the business rules, under the condition that liabilities are non-negative and assets are strictly positive, the upper limit of the ratio is obtained by dividing the upper limit of the liability range by the lower limit of the asset range. If the upper limit of the ratio does not exceed this threshold, it is determined that the condition is met. The lower limit of the ratio is obtained by dividing the lower limit of the liability range by the upper limit of the asset range. If the lower limit of the ratio is greater than the threshold, it is determined that the condition is not met. In other cases, the determination is based on the opening and closing of the endpoints and the range of values. If it cannot be determined, it is transferred to the review. The same operation is performed under two verification units. Since the numerator and denominator are converted by the same ratio, the resulting ratio is dimensionless and the threshold remains unchanged. The display ratio calculated based on the displayed value can only be used for display. The definitive conclusion still needs to be determined based on the interval relationship and subsequent external verification.

[0155] If the business rules check whether the total assets minus the total liabilities do not exceed a dimensional target constant, first subtract the upper limit of liabilities from the lower limit of assets to obtain the lower limit of the difference, and then subtract the lower limit of liabilities from the upper limit of assets to obtain the upper limit of the difference. After converting the target constant and the configured absolute tolerance into the same monetary unit as the difference, a determination of whether it is satisfied, not satisfied, or uncertain is made according to the corresponding comparison relationship. Omitting the conversion of the target constant will change the comparison relationship, but it does not guarantee that different judgments will occur for each set of data. Therefore, the accidental consistency between the two scales cannot replace the check of the conversion path.

[0156] The output permission set allows open conclusions for comparable items, but restricts the completeness of debt repayment data items to supplementary evidence and empty conclusions; the field permission table restricts the status field of debt repayment data completeness items to supplementary evidence enumerations and the reference field to existing material identifiers or empty lists; if the model attempts to generate sufficient debt repayment capacity in the conclusion field of 003, lexical constraints will prevent the legal continuation of non-empty strings; if the model expresses a similar conclusion in another free text field, external expression boundary checks still need to identify and block it, and structural constraints are not treated as complete semantic guarantees.

[0157] After the candidate report is generated, the external validator finds that the revenue change item uses the current period value as the comparison period value, and the corresponding verification fails. The dependency record shows that the operating evaluation section uses the revenue change conclusion. Therefore, the revenue change content and the operating evaluation section are included in the affected set, while the independent debt-to-equity ratio content retains its original verification status. The partially controlled output package contains the complete evidence set of the two periods' revenue, the period roles and related permissions. After generating the replacement content, the two sections are re-verified and then merged with the status outside the set. If the operating evaluation still writes the growth as a decline, then this content will not be output in this round.

[0158] Just before the release, a revised revenue record was added to the new version. Version comparison revealed that the candidate due diligence content used the old version. The system paused the release, recorded the revenue segments with changes in location according to the version content, and recalculated the affected set. If the debt-to-equity ratio had no reference relationship and the input remained unchanged, it did not need to be regenerated. If the revised record changed the common reference conditions, causing the revenue change items to lose complete evidence or comparability, the output permission was tightened accordingly. It was not possible to simply replace the numbers and continue to use the old approved status. Finally, the output area only accepted content that was version consistent and passed the verification.

[0159] The complete fragment group selection takes the evidence dependency relationship, the currently selected fragment set, and the data budget as input. The processor reads the complete evidence group of each output item from the evidence dependency relationship and uses each complete evidence group as a candidate fragment group. The fragment identifier in the complete evidence group must correspond to a valid fragment in the allowed data set, and the fields in the group must meet the common reference conditions. Only when all the required evidence fields are supported at the same time will the corresponding output item be recorded as a complete coverage, thereby avoiding the misidentification of a single related fragment as evidence completeness.

[0160] For each candidate segment group, the processor subtracts the selected segment identifier from the segment identifier of the group to obtain a new segment set. This group is then merged with the selected segment set and deduplicated according to the identifier to obtain a trial segment set. The word occupancy of the new segment and the word occupancy of the trial segment set are calculated according to the model's word segmentation method and the actual packaging format. Then, it is checked whether each output item before and after the trial selection has a complete evidence group that is fully included in the package. The number of output items that have changed from incomplete coverage to complete coverage is counted to obtain the coverage gain.

[0161] The processor excludes candidate fragment groups whose trial term usage exceeds the data budget, whose new term usage is zero, or whose coverage gain is zero. It divides the coverage gain of the remaining groups by the new term usage and sorts them in descending order of the ratio. If the ratios are the same, they are sorted in ascending order of the fragment identifier sequence. After merging the first candidate fragment group into the selected fragment set, it recalculates the new term usage and coverage gain of the remaining candidate groups until there are no more selectable groups. The processor then outputs the in-packet data set. Since shared fragments are no longer repeatedly loaded as new fragments, it is able to retain the complete evidence combination under the budget constraint.

[0162] The determination of complete coverage is performed on both the allowed data set and the included data set. If the allowed data set cannot provide any complete evidence set, it is determined that the source data is missing, and the missing fields or field combinations that do not meet the common reference conditions are recorded. If the allowed data set can provide a complete evidence set but the included data set cannot, it is determined that the budget is not covered, and the included fragments are deducted from the complete evidence set to obtain the missing fragment set. If the included data set contains a complete evidence set, it is determined that the evidence is complete and enters the comparability verification, thereby providing a basis for supplementary evidence, re-selection of data, and review.

[0163] Preservation-based reselection uses items not covered by the budget as reselection targets and items with complete evidence as preservation items. The processor extracts the fragments to be added from the gap fragment group of the reselection target and combines them with the fragments to be removed from the incoming data set to form candidate replacement schemes. For each scheme, the specified fragments are first removed from the original incoming data set, then the fragments to be added are added and deduplicated according to the identifier to obtain the candidate incoming data set. Then, the token occupancy is recalculated according to the actual packing format, and the final occupancy is not directly estimated by the nominal length of the removed and added fragments.

[0164] The processor checks each candidate data set in the incoming package to see if it contains any complete evidence set of the reselection target and each preservation item. It retains only replacement schemes whose term usage does not exceed the data budget, whose reselection target is fully covered, and whose preservation items are still fully covered. The executable schemes are sorted in ascending order by the number of removed segments. If the number is the same, they are sorted in ascending order by the sorting sequence of the removed and added segments. The first scheme is selected to update the entire incoming data set. Then the evidence status, comparability status, and output permission are recalculated to avoid destroying the original complete evidence by only supplementing the target items.

[0165] When no feasible replacement is available, the processor retains the original inbound data set, preserves the budget-incomplete state of the reselected target, and restricts the reselection of data according to the handling strategy, without revealing the deterministic conclusion of the target item; the preservation conditions ensure that the complete items still have a complete evidence set after replacement, but do not guarantee that each budget-incomplete item can be supplemented within the existing budget, and the comparability of the preserved items after replacement is still re-verified according to the comparability conditions, and the comparability state before replacement cannot be directly used.

[0166] Local re-verification takes changes to data, rules, or candidate content as input. The processor locates directly affected content nodes through fragment references, field references, and conclusion references, and adds these nodes to the to-be-accessed set and the affected set. The to-be-accessed nodes are retrieved sequentially, and the successor nodes that use the results of the node are found along the dependency relationship. The successor nodes that have not yet been accessed are added to the to-be-accessed set and the affected set until the to-be-accessed set is empty, thus obtaining the scope of content that needs to be re-verified.

[0167] During traversal, the processor maintains the visited set, registering the same content node only once to avoid shared successors repeatedly entering the re-verification scope along different paths, and to terminate traversal when circular references exist. For dependencies that cannot be resolved or confirmed completely, the verification scope is expanded according to the aforementioned conservative scope rules. Content outside the set only reuses the original verification record when its referenced data, rules, inputs, and corresponding versions have not changed. When dependencies are dense, the affected set may be close to all content, so local re-verification does not preset a fixed workload reduction ratio.

[0168] The scale consistency check first establishes a rounding interval based on the display precision and rounding method of the original values. Then, it reads the dimensionless check unit and positive conversion ratio from the comparable conditions and synchronously converts the endpoints of each interval, dimensional constants, and absolute tolerances to the corresponding check units, while keeping the dimensionless threshold unchanged. The processor performs interval operations and intersection checks under the same numerical relationship in the two check units and compares the check results of the two sets of relationships. If the results are inconsistent or the conversion and rounding information is invalid, it will proceed to the review, thereby identifying the judgment differences caused by inconsistent unit processing.

[0169] When comparing intervals, the processor first subtracts the upper bound of the first interval from the lower bound of the second interval, then subtracts the upper bound of the second interval from the lower bound of the first interval. The two differences are compared with zero, and the maximum value is taken to obtain the non-negative interval. The effective display step size corresponding to one of the original values ​​participating in this interval comparison is selected as the reference display step size. The conversion result of the same original step size is used under the two verification units. The non-negative interval is divided by the corresponding positive reference display step size to obtain the dimensionless separation quantity. If the reference display step size is missing or non-positive, this division is not performed, and the process proceeds to the verification.

[0170] For conversions of units of the same dimension with positive proportion, the interval endpoints and the reference display step size change in the same proportion, and the non-negative interval also changes in the same proportion. Therefore, the ratio of the non-negative interval to the reference display step size remains unchanged. When intervals overlap or the boundaries are connected, the non-negative interval is zero. However, when the boundaries are connected and the endpoints are not included, the intersection cannot be assumed to be non-empty from the zero interval. It is still necessary to check the opening and closing of the endpoints. The processor uses decimal arithmetic adapted to the display precision and processes tolerance and precision simultaneously. Scale consistency is only used to check the representation and conversion relationship. Deterministic conclusions still need to be verified by evidence, caliber, and output content.

[0171] Before execution, the system checks whether the versions of tasks, data, rules, templates, and model configurations are compatible. A task cannot proceed to field permission construction if a template version is missing, and a rule cannot skip a non-existent field. When input data is updated but the rules remain unchanged, only the evidence combination that depends on the data is recalculated. When the common reference condition of a rule changes, all complete evidence sets using that condition need to be re-verified, even if the fragment content has not changed. Dependencies themselves are data that requires version management, rather than a static structure that is always valid.

[0172] Budget boundaries are considered feasible if actual occupancy is less than or equal to the data budget; candidate groups with zero new occupancy are not included in the ratio calculation, and groups with zero coverage gain are not included in the valid selection; fragment sharing reduces new occupancy, but cannot result in a negative number; a negative number indicates inconsistency in difference set, serialization, or cost cache, and should be recalculated; after allowing changes to the data set, the fragment identifier of the complete group may become invalid, and the system should first rebuild the group validity before starting budget selection, and cannot temporarily ignore lost fragments in the ratio sorting.

[0173] When there are conflicting sets of complete evidence for the same output item, the completeness of the evidence only indicates the existence of joint evidence, not that the conflict between the sets has been eliminated; if the rules require cross-checking of multiple sources, the relevant source roles should be included in the required evidence field or common citation conditions, and the set with the most favorable value should not be arbitrarily selected; data selection is scored based on complete coverage, and the business judgment of source credibility is provided by rules and manual verification; when there are no explicit rules to support it, sources should not be assigned seemingly precise credibility weights on their own.

[0174] For unit conversions, direct proportional conversions maintain the interval direction; when conversions involving offsets or different currencies are required, the corresponding operations and applicable time must be defined in the comparability conditions, and the simple ratio of this embodiment cannot be applied; when the ratio is zero, non-finite, or the direction is unclear, it is considered an abnormal configuration; when the numerical relationship involves multiple dimensions, the corresponding units are configured for each dimension, and the dimension combination of the addition term and the ratio is checked, and it is not possible to simply compare whether the unit names are the same.

[0175] For the generation process, the vocabulary, prefix parser, and actual decoding must be consistent; special terminating words, invisible control characters, and escape characters are also within the candidate screening scope; when the model output has passed the structural restrictions but the reference mapping is invalid, the candidate due diligence content must not be published; if an unregistered subject or period appears in a free text field, it should not be approved because of its grammatical validity; any new numerical value or new fact proposed by the model, if it cannot be mapped to the allowed evidence or the computation path allowed by the rules, should be blocked or supplemented, rather than being added to the source data set.

[0176] For partial updates, the reuse requirements of the original verification state are that the data content, verification conditions, output permissions, and referenced conclusions remain unchanged; comparing only the text hash while ignoring the rule version is insufficient to prove reusability; comparing only the version number without version content binding is also insufficient to locate the change; the affected set is the union of the reachable sets of multiple change sources, and cross-reference nodes are deduplicated and processed uniformly; when the regeneration changes the reference relationship, the permissions of the newly added referenced objects should be re-checked, and the dependency records should be updated for use in the next round.

[0177] For publishing transactions, the output operation and version condition check must belong to the same protected commit interval; an implementation that first compares successfully, then unlocks, and finally publishes asynchronously may accept a new version in the middle, breaking the consistency required by this embodiment; after output failure, the verification result is retained and can be used for retrying with the same version, but each retry still needs to confirm that the version conditions and candidate due diligence content have not changed; the audit log should be able to explain which version and which part of the content was published under what verification conditions, rather than just saving a pass log with no associated text.

[0178] This embodiment takes the scope of data, selection of complete evidence, judgment of dual-set evidence, comparability, permission generation, and external verification in this application as common main lines; complete evidence groups and shared identifiers refine evidence dependencies, preservation-style reselection refines the handling of budget-uncovered issues, scale consistency refines comparability judgment, field permission tables and word-by-word meta-restrictions refine controlled generation, and directed dependencies and version binding refine rewriting and publishing; each refinement step uses objects generated in the preceding steps and does not replace the original evidence chain by adding a new model architecture.

[0179] When using a basic generative model without domain training, data selection, permission restrictions, and verification procedures can all be performed. When performing domain-adaptive training, the training only improves the adaptation of the generative module to the task expression and cannot reduce the required evidence fields or relax external verification. The system implementation uses processors and memory to carry out these operations, and modules pass data objects with the same name and version relationships. The specific software deployment can be changed, but the correspondence between evidence status and disposal actions, the budget processing of the complete group, and the post-verification release relationship remain consistent.

[0180] Further enhancements in implementation can revolve around the invalidation scope of the complete group cache, the sharing of legal prefix structures, and the reuse conditions of verification results, but definite input, output, and invalidation conditions must be retained; for example, the cache key should contain the rule version, data version, and the identifier of the item to be output, and should only be reused when the key is consistent and the source is valid; the lexical constraint cache should also contain the lexical version and the field permission table summary; a cache hit only reuses the calculated result, does not change the applicability of the rule, and should not mark the result that has not yet been verified as passed.

[0181] Therefore, data processing within the budget no longer simply determines whether fragments are relevant, but checks whether they can form a complete basis for the output item together with the already selected fragments; generation control no longer relies solely on the model's adherence to prompts, but applies the evidence status and comparability status to field permissions and publication conditions; local modifications not only replace text, but also re-examine potentially affected content along dependencies; all of the above relationships serve the same core problem, namely, maintaining a verifiable correspondence between the evidence required to reach a conclusion and the output content within a limited context.

[0182] The above description is only an optional implementation of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A reliable large model intelligent due diligence method based on multiple constraint verification, characterized in that, include: Obtain task information, multi-source due diligence data, and contextual budget; filter by task information to obtain the set of allowed data. Construct two circles based on the page distance from the center of the numerical region in the allowed data set to the anchor points of the two contents on the same page, determine the unique intersection point and the row and column affiliation, and generate evidence records; Read templates, business rules, comparable conditions, prohibited items and handling strategies to form a constraint set, determine the output items and necessary evidence fields according to the constraint set, and establish evidence dependency relationships in combination with evidence records; Based on the evidence dependency relationship, select data within the context budget by fragment group that covers all required evidence fields to obtain the data set to be included; Based on the evidence dependency check, the coverage of the allowed data set and the included data set is obtained to determine the evidence status of missing source data, budget not covered, or complete evidence. For the complete evidence items, the subject, reporting period, indicator, and unit are verified according to the comparable conditions to obtain the comparability status. Based on the handling strategy, the status of evidence, and the comparability status, supplementary evidence, re-selection of data, or review are restricted for items with missing source data, those not covered by the budget, and those that are not comparable. Definitive conclusions are only made for items with complete evidence and comparability, resulting in an output permission set. Based on the input data set, constraint set, and output permission set, a controlled output package is constructed according to prohibited items, and a large language model is called to generate candidate due diligence content. Verify the candidate due diligence content according to the controlled output packet, obtain the verification status set, and execute output, rewrite or block according to the handling strategy.

2. The method according to claim 1, characterized in that, Construct two circles based on the page distance from the center of the numerical region in the allowed data set to the anchor points of the two contents on the same page, determine the unique intersection point and row / column assignment, and generate evidence records, including: Normalize the page coordinates according to the page width and page height, calculate the page spacing in the same coordinate system, and convert the average character width; Based on the keyword list, a unique cell is matched in the header and footer rows of the same page and table, with its center as the first and second content anchor points; if the match is empty, not unique, or the centers coincide, a positioning anomaly is registered and positioning is stopped. Based on the page distance from the center of the numerical region to the first content anchor point and the second content anchor point, the first radius and the second radius are obtained, and the first circle and the second circle are constructed with the corresponding anchor points as the center. The center distance is obtained by measuring the distance between the two anchor points on the page. The center distance is then compared with the absolute values ​​of the sum of the two radii and the difference between the two radii to determine whether the two circles are separate or contained within each other. If the points are separated or contained within each other, the location is abnormal and no evidence record is generated; otherwise, the unique intersection point and row / column affiliation are determined and an evidence record is generated.

3. The method according to claim 2, characterized in that, Construct two circles based on the page distance from the center of the numerical region in the allowed data set to the anchor points of two contents on the same page. Determine the unique intersection point and row / column affiliation, generate an evidence record, and register a location anomaly if a unique determination cannot be made, including: When two circles intersect or are tangent, subtract the square of the second radius from the square of the first radius and add the square of the distance between the centers. Divide the sum by twice the distance between the centers to obtain the directional displacement with the direction from the first center to the second center as positive. The half-chord length is obtained by subtracting the square of the directed displacement from the square of the first radius from the non-negative square root of the difference. The directed displacement is moved from the first center along the line connecting the two centers, and then the half-chord length is moved to both sides in the vertical direction to obtain the intersection point. When the half-chord length is zero, select the overlapping point; otherwise, match the unique third content anchor point in the header row that is different from the first two anchor points, calculate the absolute deviation of the distance from the two intersection points to the third content anchor point relative to the distance from the center of the numerical area to the anchor point; when the absolute value of the difference of deviations is not less than half of the average character width, select the intersection point with the smaller deviation; otherwise, register the positioning as uncertain and limit it to review. Match the nearest row header and column header of the same line to the selected intersection point to determine the indicator, period role and unit; if the match is not unique, register the location as abnormal, otherwise generate evidence record.

4. The method according to claim 1, characterized in that, Read templates, business rules, comparable conditions, prohibited items, and handling strategies to form a constraint set. Determine the output items and required evidence fields based on the constraint set, and establish evidence dependencies by combining evidence records, including: Read the template, business rules, comparable conditions, prohibited items and handling strategies to form a constraint set, determine the output items according to the template, and determine the necessary evidence fields and common reference conditions according to the business rules. Assign identifiers to the output items, the required evidence fields, and the fragments in the allowed data set; By combining the numerical location and the analysis results of other segments, evidence records containing field values, subject, reporting period, indicators, units and original text locations are obtained, and associated segment identifiers are used to exclude records with abnormal location. Based on the matching of required evidence fields with indicators in evidence records, field associations are obtained, and common support relationships are checked according to common reference conditions; Based on the common support relationship, the fragment identifiers that cover all the required evidence fields of the same output item are registered as a complete evidence group, and different complete evidence groups are retained and shared fragment identifiers are reused. By associating each identifier, field, and complete evidence group, an evidence dependency relationship is formed.

5. The method according to claim 4, characterized in that, Based on the evidence dependency relationships, within the context budget, data is selected by fragment groups covering all required evidence fields, resulting in the inbound data set, including: Read the model's word segmentation method, and subtract the upper bound of the reserved area for fixed instruction segments, task segments, constraint segments, and field permission segments from the context budget to obtain the data budget; Use the complete evidence group as the candidate fragment group to create an empty set of selected fragments; The new fragment set is obtained by the difference between the identifiers of the candidate fragment group and the selected fragment set, and the trial fragment set is obtained by the union of the two. The number of newly added word segments and trial word segments occupied by the word segmentation method is obtained. The number of output items that are fully covered by the trial segment set relative to the selected segment set is counted to obtain the coverage gain. Exclude candidate segment groups that exceed the budget, have new word element occupancy, or have zero coverage gain. Calculate the ratio of coverage gain to new word element occupancy. Select the first group in descending order of the ratio, and in ascending order of the segment identifier sequence if the ratios are the same. Merge the entire first group into the selected segment set. The selection process is repeated based on the updated set of selected segments until no more groups are available, resulting in the final set of data to be included.

6. The method according to claim 5, characterized in that, Based on the evidence dependency check, the coverage of the allowed data set and the included data set is examined to determine the evidence status of missing source data, budget not covered, or complete evidence. For items with complete evidence, the subject, reporting period, indicator, and unit are verified according to comparable conditions to obtain the comparability status, including: Based on the evidence dependency relationship, extract the fragment identifier of the output item in the allowed data set and the incoming data set to obtain the source coverage record and the incoming coverage record; The source data is considered missing when the source coverage record does not contain any complete set of evidence. For missing items in the source data, the uncovered fields and combinations of fields that cannot be referenced together are registered according to field association and common reference conditions to obtain supplementary field records; If the source coverage record contains a complete set of evidence, and the inbound coverage record contains any complete set of evidence, then the evidence is complete; otherwise, the budget is not covered. Based on the complete evidence set, the missing fragment set of the packaged items is obtained by subtracting the fragment identifiers from the complete evidence set; The status of the evidence to be output is associated with the status of the evidence and the records of supplementary evidence fields or missing fragments that have been generated, forming a record of the status of each piece of evidence. Based on the record of the status of each piece of evidence, the subject, reporting period, indicators and units of the complete evidence items are verified according to the comparable conditions to obtain the comparability status.

7. The method according to claim 6, characterized in that, Based on the handling strategy, the status of evidence, and the comparability status, for items with missing source data, budget shortfalls, and incomparable items, restrictions are placed on supplementary evidence, re-selection of data, or review. A definitive conclusion is only granted for items with complete and comparable evidence, resulting in an output permission set, including: Based on the status record of each piece of evidence, items not covered by the budget will be selected as reselection targets, and items with complete evidence will be preserved. Extract the segments to be added from the allowed dataset based on the gap segment group; The fragments to be added are paired with the fragments to be removed from the incoming data set, and the addition and removal are simulated to obtain the candidate incoming data set; The word segmentation method is used to calculate the word occupancy of the candidate data set, and the complete coverage of the reselection target and preservation item is checked according to the complete evidence group. Based on the conditions that the word usage does not exceed the data budget and that the reselection target and each preservation item are fully covered, an executable replacement plan is obtained; Sort by the number of removed fragments in ascending order, and for fragments with the same value, sort by the sorting sequence of removed and added fragments in ascending order. Select the first executable replacement scheme, update the entire data set in the package, and recalculate the evidence status, comparability status, and output permission set.

8. The method according to claim 6, characterized in that, Based on the record of the status of each piece of evidence, the entities, reporting periods, indicators, and units of the complete evidence items are verified according to comparable conditions to obtain the comparability status, including: The completeness of evidence items is determined based on the status record of each piece of evidence. The corresponding evidence to be verified is extracted from the data set of the packaged documents through evidence dependency relationships. The subject, reporting period and indicator scope are checked according to comparable conditions to obtain the scope matching result. For the evidence to be verified with matching caliber, read the original value, unit, numerical precision and rounding method, and combine the two verification units of the same dimension, conversion ratio, numerical relationship and tolerance in the comparable conditions to form a unit conversion record. The rounding interval is formed according to the numerical precision and rounding method. The endpoints of the conversion interval are recorded by unit conversion, and the dimensional constants and tolerances in the numerical relationship are converted simultaneously to obtain two sets of standard intervals and corresponding verification relationships. Based on two sets of standard intervals and their corresponding verification relationships, interval operations and intersection checks are performed respectively. The verification results of the two sets of relationships are compared to obtain the scale consistency results. Based on the caliber matching results and scale consistency results, the comparability status is obtained.

9. The method according to claim 1, characterized in that, Based on the input data set, constraint set, and output permission set, a controlled output package is constructed according to prohibited items. A large language model is then invoked to generate candidate due diligence content, including: Based on the template, an output structure is established that includes a disposal status field, an evidence citation field, and a conclusion field. A field permission table is formed according to the output permission set. When no definitive conclusion is provided, the conclusion field is limited to null values, and the disposal status is limited to supplementary evidence, re-selection of materials, or review. Assign reference identifiers to the incoming fragments to form an optional identifier set, and compile it into a controlled output package along with the output structure, field permission table, constraint set, and incoming data set. Read the vocabulary, create an empty lexical prefix, determine the current field based on the output structure, and filter the candidate lexical set that can be appended and continue to be a legal value according to the field permission table and the optional identifier set; The model is invoked to obtain a score based on the controlled output packet and the prefix of the word. The score outside the candidate word set is set to negative infinity, and after normalization, the next word is generated and appended. Repeated filtering and generation; candidate due diligence content is obtained when the structure is closed; termination and failure are recorded when the candidate word set is empty or the maximum output length is reached but the structure is not closed.

10. A reliable large model intelligent due diligence system based on multiple constraint verification, characterized in that, It includes a memory and a processor, the processor executing a program in the memory to implement the method of any one of claims 1 to 9, and forming the following modules: The data scope control module is used to obtain task information, multi-source due diligence data and contextual budget, and filter to obtain the set of allowed data; The constraint orchestration module is used to form a set of constraints and establish evidence dependencies by combining evidence records; The positioning module is used to construct two circles based on the page distance from the center of the numerical region to the two content anchor points on the same page, determine the unique intersection point and row / column affiliation, generate evidence records, and register positioning anomalies when they cannot be uniquely determined. The data selection module is used to select complete fragment groups within the context budget based on evidence dependencies, thereby obtaining the data set to be included. The permission control module is used to compare the coverage of the permitted data set with the incoming data set, and generate an output permission set based on the comparability status. The generation module is used to construct a controlled output package based on the input data set, constraint set, and output permission set, and call the large language model to generate candidate due diligence content. The verification and handling module is used to verify the candidate due diligence content based on the controlled output packet, and to execute output, rewrite or block according to the handling strategy.

Images