A method for randomly drawing panelists

Abstract

The application provides a method for randomly drawing a group of trial personnel, which encodes candidate personnel in a de-identified manner, generates a candidate pool state commitment value according to qualification status and historical attributes; constructs an interest correlation graph among a case subject, candidate personnel and associated subjects, and identifies direct and multi-hop interest conflicts; submits random component commitments by multiple independent computing nodes and then publishes the random components, and generates a drawing random input in combination with the candidate pool state commitment value; constructs a candidate combination state space according to seat attributes, professional differences and conflict states, determines combination weights and locates a target group trial combination in combination with historical selection times, task loads and round disturbance factors; when selected personnel appear abnormal, freezes personnel who have not exited, forms a substitute personnel conditional probability according to the original combination weights of the first drawing and completes a supplementary drawing, and generates verification data for independent recalculation.

Description

Technical Field

[0001] This invention relates to the fields of computer data processing, cryptographic verification, and graph computing, specifically a method for randomly selecting members of a panel. Background Technology

[0002] In arbitration, administrative adjudication, hearings, and other cases requiring joint review or deliberation by multiple individuals, it is typically necessary to select qualified personnel from a pre-established candidate pool to form the corresponding panel. Current methods for selecting panel members generally involve first screening candidates based on qualifications, expertise, and recusal rules, and then determining the selected personnel through an internal random procedure within the management system. However, the generation of the candidate pool, the setting of random parameters, and the selection procedure are often controlled by the same management entity. External supervisors find it difficult to confirm whether the candidate pool has been temporarily adjusted before the selection, and it is also difficult to determine whether the system has selectively retained a certain result after multiple trial calculations, resulting in a lack of recalculation and reliability in the selection process.

[0003] Meanwhile, candidates may have multi-layered connections with parties involved in cases, their agents, affiliated companies, and related institutions through equity control, joint appointments, historical representation, or joint case participation. Existing static recusal lists primarily record direct relationships, making it difficult to identify multi-stage conflicts of interest that arise as relationships change over time. For different professional positions, individually selecting individuals with equal probability may result in combinations with highly overlapping professional capabilities; conversely, setting fixed weights based on professional scores or workload can easily lead to some individuals maintaining a consistently high probability of selection, affecting the balance of the selection results.

[0004] Furthermore, when selected candidates refuse to participate, exceed the confirmation time, recuse themselves temporarily, or their eligibility expires, existing methods typically re-select the missing candidates, or even re-select the entire pool. This approach alters the conditional probabilities of the remaining candidates and may disrupt established professional complementarity. The lack of a unified state correlation mechanism between candidate pool changes, conflict resolution, combination constraints, weight adjustments, and supplementary selection makes it difficult to continuously verify the results at each stage. Therefore, it is necessary to provide a method for randomly selecting panel members that can protect candidate identities and related information while uniformly solidifying and independently recalculating the candidate pool state, random input, conflicts of interest, combination selection, and abnormal supplementary selection processes. Summary of the Invention

[0005] The purpose of this invention is to provide a method for randomly selecting panel members, which solves the problems of difficulty in solidifying the candidate pool state, difficulty in identifying multi-hop conflicts of interest, difficulty in fairly selecting complementary professional combinations, and distortion of the probability of re-selection after a member leaves.

[0006] To achieve the above objectives, the present invention provides the following technical solution: This invention provides a method for randomly selecting panel members, comprising the following steps: Candidates are de-identified and coded, and candidate data summaries are generated according to the eligibility status and historical attributes of candidates in a deterministic order, and candidate pool status commitment values ​​are formed accordingly. Construct a graph of interests including the case subject, candidates and related subjects, calculate the conflict degree of candidates based on relationship type, relationship time and relationship path level, determine the exclusion status or pending review status, and update the candidate pool status commitment value. It receives random component commitments pre-submitted by multiple independent computing nodes, verifies their publicly disclosed random components, and jointly performs calculations on each random component, the updated candidate pool status commitment value, and the case identifier to generate random input for extraction. A candidate combination state space is constructed based on seat attribute constraints, candidate professional difference constraints, and conflict states. A combination weight distribution is generated based on the historical number of elections, current task load, and round perturbation factors determined by random input. The target family combination is determined from the candidate combination state space based on the random input. When a member of the target group refuses, exceeds the confirmation time, temporarily recuses, or becomes ineligible, the non-withdrawing members are frozen. Valid combinations containing non-withdrawing members and satisfying the missing seat constraint are selected from the candidate combination state space. The conditional probability of each substitute member is determined based on the original combination weight of the valid combination. Substitute members are determined using supplementary random input derived from random input and abnormal event identifiers. Record the candidate pool state commitment, random component commitment, conflict identification results, combined weights, and supplementary sampling parameters to generate verification data for independent verification nodes to recalculate the sampling results.

[0007] As a preferred embodiment of the present invention, the logic for forming the candidate pool state commitment value is as follows: Arrange the candidate data in dictionary order according to the de-identified encoding, and calculate the cryptographic digest of each candidate data respectively; A tree-shaped commitment structure is constructed using each cryptographic digest as a leaf node, and the root digest of the tree-shaped commitment structure is determined as the candidate pool state commitment value; When a candidate's eligibility status, conflict status, or availability status changes, a status transition certificate is generated based on the root summary before the change, the status change data summary, and the root summary after the change.

[0008] As a preferred technical solution of the present invention, the state transition certificate further includes the state change type, state change time, and digital signature of the state change data; Independent verification nodes obtain the tree-structured verification path corresponding to the target candidate, and recalculate the root digest corresponding to the tree-structured verification path to verify the attribution relationship of the target candidate in the corresponding candidate pool state and the state continuity between adjacent candidate pool states without obtaining the plaintext identity of the target candidate.

[0009] As a preferred embodiment of the present invention, the calculation logic for the conflict degree of the candidates is as follows: The case subject, case agent, related enterprises, candidates and their employing institutions are set as graph nodes, and the equity control relationship, joint employment relationship, historical agency relationship and joint case relationship are set as graph edges with relationship type, relationship weight and time attribute. Search for related paths between candidate nodes and case subject nodes whose path hierarchy does not exceed a preset threshold; The overall conflict degree of the candidate is calculated based on the relational weights of each graph edge in the associated path, the path level attenuation parameter, and the timeliness parameter corresponding to the relational time. Candidates whose overall conflict level reaches the avoidance threshold are identified as excluded, and candidates whose overall conflict level reaches the review threshold but is lower than the avoidance threshold are identified as pending review. Candidates in the excluded or pending review state are prohibited from entering the candidate combination state space.

[0010] As a preferred embodiment of the present invention, the generation logic for extracting random input is as follows: Receive commitments from each independent computing node for random components generated from random components and random salt values; After the number of random component commitments reaches a preset number, the random components and random salt values ​​published by each independent computing node are received, and the consistency between the published data and the corresponding random component commitments is verified. Perform an XOR operation on the verified random components or perform a concatenated digest operation according to the node encoding order to generate a combined random quantity; The combined random variable, candidate pool status commitment value, case identifier, extraction round, and extraction rule version identifier are digested to generate the extraction random input; When an independent computing node fails to disclose a random component within a preset time limit, an alternative component is generated based on the corresponding random component commitment, according to the absence transformation rules that were fixed before the random component commitment was submitted.

[0011] As a preferred embodiment of the present invention, the logic for constructing the candidate combination state space is as follows: Seat attribute constraints are generated based on the professional category and qualifications of each panel of seats; The professional similarity between candidates is calculated based on their professional tags to form a professional similarity matrix; Set a minimum number of professional tags to cover for candidate combinations, an upper limit for the professional similarity between candidates, and an upper limit for the number of candidates from the same institution. Candidate combinations are generated by constraint search that simultaneously meet the requirements of seat attribute constraints, minimum number of professional tags covered, maximum professional similarity, maximum number of candidates from the same institution, and conflict status. The candidate combinations are then deterministically sorted according to the combination codes formed by the candidate codes in the combinations.

[0012] As a preferred embodiment of the present invention, the generation logic of the combined weight distribution is as follows: Based on the candidate's historical selection count, current number of tasks undertaken, number of pending tasks, and available time period within the preset statistical period, calculate the candidate's basic load calibration parameters. The round perturbation factor for each candidate in the current round of sampling is generated based on the random input and candidate codes. The cumulative perturbation deviation of candidates in multiple consecutive extraction rounds is determined based on historical extraction records, and the round perturbation factor is corrected using the cumulative perturbation deviation. The original weights of the combinations are determined based on the basic load calibration parameters of each candidate member in the candidate combination and the corrected round perturbation factor. The original weights of each candidate combination are then normalized to obtain the combination weight distribution.

[0013] As a preferred embodiment of the present invention, the logic for determining the target family group combination is as follows: Based on the deterministic ranking results and normalized weights of each candidate combination, the preset integer value range is divided into continuous sub-intervals corresponding to each candidate combination, and the length of each continuous sub-interval corresponds to the normalized weight of the corresponding candidate combination. The preset bit segment of the extracted random input is converted into a randomly positioned integer within the preset integer value range; Determine the continuous sub-intervals to which the randomly located integers belong, and identify the corresponding candidate combinations as the target family combination; Write the candidate combination sorting results, the original weights of the combinations, the boundaries of continuous sub-intervals, and the randomly positioned integers into the verification data.

[0014] As a preferred embodiment of the present invention, the logic for determining the substitute personnel is as follows: Obtain the seat attributes corresponding to the abnormal personnel and the remaining group structure composed of the non-exited personnel, and filter the candidate combinations that contain the non-exited personnel and satisfy the missing seat constraint from the first extracted candidate combination state space; Eliminate candidate combinations that include those whose qualifications have expired, those that create new conflicts of interest, or those that have already been selected, to obtain valid combinations; Based on the substitutes in the effective combination, the original combination weights of the effective combination are marginalized, accumulated, and normalized to obtain the conditional probabilities of each substitute. The initial random input, abnormal personnel code, abnormal status type, abnormal event sequence number and re-sampling round are digested to generate re-sampling random input; The substitutes are determined based on the random input of the supplementary draw and the conditional probability of each substitute, while keeping the non-exited personnel and their seats unchanged.

[0015] Compared with the prior art, the beneficial effects of the present invention are: This invention de-identifies candidate data and generates candidate pool status commitment values, enabling the candidate range and status upon which the extraction is based to be solidified and verified. By constructing an interest association graph and calculating conflict degree by combining relationship type, path level, and relationship time, both direct and multi-hop interest relationships between candidates and case subjects can be identified, thereby reducing omissions caused by static avoidance lists. Multiple independent calculation nodes first submit random component commitments and then publish the random components, associating the random components with candidate pool status commitment values ​​and case identifiers to generate random input for extraction. This binds the candidate pool status and random input together, reducing the possibility of repeated trial calculations or selective retention of results by a single management node. Furthermore, by incorporating seat attribute constraints, professional difference constraints, and conflict status... The states are used together to construct the candidate combination state space, and the combination weights are determined by combining the historical selection count, task load, and round disturbance factors. This ensures that the selection results meet the requirements of professional complementarity while avoiding the long-term concentration of fixed high-probability personnel in the selection. When selected personnel refuse, exceed the confirmation time, temporarily avoid, or become ineligible, the conditional probability of substitute personnel is formed by freezing the personnel who have not withdrawn and based on the original combination weights of the first selection. This ensures that the supplementary selection process inherits the original selection probability structure and avoids re-selection that would disrupt the established professional combinations. At the same time, the candidate pool state, random components, conflict identification, combination weights, and supplementary selection parameters are used to form verification data, enabling third parties to independently recalculate the target group combination and substitute personnel, thereby improving the confidentiality, fairness, continuity, and verifiability of the random selection process for group members. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the overall process of the random selection method for group members in this invention; Figure 2 This is a schematic diagram of the candidate pool state commitment generation and state transition process of the present invention; Figure 3 This is a schematic diagram illustrating the process of constructing the interest graph and identifying candidate conflicts in this invention. Figure 4 This is a schematic diagram illustrating the process of multiple independent nodes collaboratively generating and extracting random input according to the present invention. Figure 5 This is a schematic diagram illustrating the process of constructing the state space of candidate combinations, determining combination weights, and locating the target family combination in this invention. Figure 6 This is a schematic diagram illustrating the conditional probability re-sampling and independent verification process after an anomaly occurs in the target group of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] This invention can be applied to arbitration, administrative adjudication, hearings, reviews, and other scenarios requiring the random selection of multiple panel members from a candidate database. The candidate database stores candidate information, eligibility status, availability, professional category, professional tags, employing institution, historical employment records, historical representation records, historical case participation records, number of times selected in the past, current number of tasks, number of pending tasks, and available time periods. Case data includes a unique case identifier, parties involved, agents, affiliated companies, actual controllers, key management personnel, and the professional field of the case. Seating rules include the number of panel members, seat categories, professional requirements for each seat, eligibility requirements, professional complementarity requirements, and limits on the number of personnel from the same institution.

[0019] Example 1

[0020] like Figure 1 As shown, this embodiment provides a method for randomly selecting panel members, including the following steps: S101. Candidate De-identification and Candidate Pool Status Solidification: After receiving case data, candidate data, and seat rules, the candidate identity information is first de-identified.

[0021] A unique candidate code is generated for each candidate. This code is obtained by performing a one-way digest operation based on the candidate's internal ID, code version, and controlled secret parameters. The mapping relationship between the candidate's name, ID number, and other plaintext identification information and their candidate code is stored in an access-controlled identity mapping table. Subsequent processes, including candidate pool commitment, interest calculation, candidate portfolio construction, portfolio weight calculation, and verification, all utilize the candidate code.

[0022] like Figure 2As shown, candidate records are formed based on each candidate's candidate code, qualification status, availability status, professional attribute summary, employing institution summary, historical attribute summary, and load status summary.

[0023] Among them, the qualification status indicates whether the candidate has the valid qualification to participate in the corresponding case panel; the availability status indicates whether the candidate can participate in the case during the scheduled panel period; the professional attribute summary is formed by the candidate's professional category, professional tag and qualification level; the historical attribute summary is formed by the number of times selected in the past, historical appointment record, historical agency record and historical case participation record; and the workload status summary is formed by the number of tasks currently undertaken, the number of tasks to be done and the available time period.

[0024] Each candidate record is serialized using a unified field order, a unified character encoding method, and a unified null value representation method. For example, candidate record data is formed in the order of candidate code, qualification status, availability status, professional attribute summary, employing institution summary, historical attribute summary, load status summary, and record update time.

[0025] All candidate records are deterministically arranged according to the lexicographical order of their candidate codes, and a cryptographic digest of each candidate record is calculated. A tree-like commitment structure is constructed using the cryptographic digests of each candidate record as leaf nodes. Adjacent leaf nodes are concatenated in a fixed left-right order and then digested, obtaining the digests of the higher-level nodes layer by layer until the root digest is formed. This root digest is determined as the current candidate pool state commitment value and is associated with and stored along with the case's unique identifier, the extraction rule version, the number of candidate records, and the generation time.

[0026] When the number of leaf nodes does not meet the requirements for a complete binary tree structure, a preset empty node summary can be used to pad to the corresponding level. The empty node summary, padding direction, and node splicing order are pre-recorded in the extraction rule version to ensure that different computing nodes can form the same candidate pool state commitment value.

[0027] Once the candidate pool state commitment value is formed, any addition, deletion, replacement, or change in the state field of any candidate will result in changes to the corresponding leaf node summary and root summary. Therefore, the candidate pool state used in the extraction process can be reliably identified.

[0028] S102, Construction of the interest relationship diagram and determination of conflict status, such as Figure 3 As shown, a diagram of interest relationships is constructed based on the case subject, case agent, related enterprises, candidates, and the institutions where the candidates serve.

[0029] The parties involved in the case, their agents, related companies, actual controllers, candidates, the institutions where the candidates hold positions, and other entities that may have a conflict of interest are each designated as nodes in the graph. Each node includes a node code, node type, validity period, and a summary of the data source.

[0030] Shareholding control, joint appointment, historical agency, joint case participation, investment relationships, and business cooperation relationships are set as graph edges. Each graph edge includes a starting node, an ending node, a relationship type, a relationship weight, a relationship occurrence time, a relationship termination time, and a data source summary.

[0031] Figure 3 In the diagram, rectangles represent graph nodes, arrowed lines connecting different nodes represent graph edges, the direction of the arrows indicates the data association direction, and text near the edges indicates the relationship type. Solid arrows indicate a direct interest relationship between two graph nodes, while dashed arrows indicate an indirect interest relationship between two nodes through at least one intermediate node. One or more association paths can form between candidate nodes and case subject nodes. Association paths containing only one graph edge are direct association paths, while association paths containing two or more graph edges are multi-hop association paths. Figure 3 The conflict degree calculation node is used to determine the overall conflict degree of candidates based on the associated path, and the status judgment node is used to classify candidates into participating status, pending review status, or excluded status based on the relationship between the overall conflict degree and the review threshold and avoidance threshold.

[0032] For each candidate node, starting from that candidate node, search for a simple path between it and the main node of the case whose path level does not exceed a preset level threshold. The simple path does not repeatedly pass through the same graph node to avoid the repeated counting of cyclic relationships; for any associated path found, calculate the path conflict value based on the relationship weight of each graph edge in the associated path, the path level, and the time when the relationship occurs.

[0033] In this embodiment, the path conflict value is determined as follows: First, the relation weights corresponding to each graph edge in the path are multiplied to form the path relation value; then, the path level attenuation value is determined according to the number of graph edges contained in the path; at the same time, the time validity value is determined according to the interval between the occurrence time of each relation in the path and the current case extraction time; the path relation value, the path level attenuation value and the time validity value are multiplied to obtain the corresponding path conflict value.

[0034] Direct agency, direct appointment, and direct equity control relationships have higher relationship weights; joint case participation and indirect appointment relationships have lower relationship weights. The more graph edges a path contains, the smaller the path hierarchy decay value; the longer the relationship occurred since the current extraction time, the smaller the time efficiency value.

[0035] The overall conflict degree of a candidate is obtained by summing up the path conflict values ​​corresponding to all valid association paths between the same candidate and the subject of the case.

[0036] A review threshold and an avoidance threshold are preset, with the review threshold being lower than the avoidance threshold. When the overall conflict level is greater than or equal to the avoidance threshold, the candidate is excluded; when the overall conflict level is greater than or equal to the review threshold but lower than the avoidance threshold, the candidate is placed in a pending review state; when the overall conflict level is lower than the review threshold, the candidate is placed in a participateable state.

[0037] Candidates in the exclusion or pending review status will not enter the subsequent candidate combination status space. Candidates in the pending review status can be adjusted to the eligible or exclusion status after manual review, but this adjustment must generate a new status change record.

[0038] After the conflict of interest is identified, the candidate's code, the summary of the associated path, the path level, the conflict value of each path, the overall conflict degree, the threshold version, and the final conflict status are written into the conflict calculation record.

[0039] After a candidate's conflict state changes, the corresponding candidate record is updated, and the candidate pool state commitment value is recalculated.

[0040] A state transition certificate is generated when the state changes. The state transition certificate includes the candidate pool state commitment value before the change, the candidate code that changed, the summary of the changed fields, the summary of the basis for the change, the candidate pool state commitment value after the change, the change time, and a digital signature.

[0041] Thus, the initial candidate pool state, the candidate pool state after conflict identification, and subsequent changes in eligibility or availability form a continuous candidate pool state chain.

[0042] Before generating the random input for extraction, the latest candidate pool state commitment value is used as the valid state commitment value for this extraction. If the eligibility, conflict, or availability of a candidate changes again after the valid state commitment value is determined, the original candidate pool state commitment value, the original random input, the original candidate combination state space, and the original combination weight distribution are all marked as invalid, and the random input generation and candidate combination construction process is re-executed based on the changed candidate pool state.

[0043] S103, Multiple independent nodes collaboratively generate and extract random inputs, such as Figure 4 As shown, after the candidate pool state is solidified, multiple independent computing nodes collaboratively generate and extract random inputs.

[0044] Independent computing nodes can be deployed separately in case management agencies, supervisory agencies, notary offices, industry associations, or other independent entities. Each independent computing node generates a random component and a random salt value.

[0045] Each independent computing node concatenates the random component, random salt value, unique case identifier, and extraction round in a preset order, and performs a one-way digest operation to form a random component commitment. During the commitment phase, each independent computing node only submits the random component commitment and does not disclose the random component or random salt value.

[0046] Once the number of received random component commitments reaches a preset threshold, the commitment phase is closed and the system enters the disclosure phase. Each independent computing node discloses its previously generated random components and random salt values.

[0047] For the data published by any independent computing node, the digest operation is performed again in the same order as in the commitment phase, and the result is compared with the random component commitment previously submitted by that node. If they match, the random component passes the verification; if they do not match, the random component is marked as invalid, and a commitment anomaly record is generated.

[0048] All the verified random components are arranged in lexicographical order according to the encoding of the independent computing nodes, and then XORed sequentially to obtain the combined random quantity.

[0049] When an independent computing node fails to disclose a random component within a preset disclosure period, a substitute component is generated based on the absence transition rules that have been fixed before the commitment phase begins. In this embodiment, the node's submitted random component commitment, unique case identifier, extraction round, and fixed absence identifier are digested to obtain the substitute component. The substitute component, along with other verified random components, participates in the combined random quantity calculation.

[0050] Since the alternative component is determined by the random component commitments submitted by the node before the public phase, the node cannot change the specific value of the alternative component by choosing to publish or not publish the random component.

[0051] The combined random variable, the latest candidate pool status commitment value, the unique case identifier, the extraction rule version, and the extraction round are concatenated in a preset order and then a summary operation is performed to generate a fixed-length random input for extraction.

[0052] Write the random component commitment, public data digest, consistency check result, timeout node identifier, alternative component generation parameters, combined random quantity, and extracted random input into the random input record.

[0053] S104. Construction of the state space for candidate combinations like Figure 5As shown, seat attributes are constrained based on the professional category, qualification level, years of service, geographical location, and chief qualification of each seat.

[0054] Based on the candidates' professional category, professional direction, qualification tags and work experience, a professional attribute vector of the candidates is formed, and the professional similarity between any two candidates' professional attribute vectors is calculated to form a professional similarity matrix.

[0055] This embodiment uses the cosine similarity of professional label vectors to represent the degree of professional overlap between candidates. The higher the professional similarity, the closer the professional attributes of the two candidates are.

[0056] The panel formation requirements stipulate the following constraints: a minimum number of professional tags to be covered, a maximum professional similarity between any two candidates, a maximum number of candidates from the same employing institution, and a restriction that candidates with direct business relationships or joint employment avoidance relationships cannot be selected simultaneously.

[0057] When constructing the candidate combination state space, first establish the corresponding set of optional candidates according to the attribute constraints of each seat, and then perform constraint search seat by seat according to the preset seat order.

[0058] When adding candidates to the current subset, the system sequentially verifies whether the candidate is in an eligible state, whether the candidate meets the corresponding seat attribute constraints, whether the number of personnel in the same institution exceeds the upper limit after being added, and whether the professional similarity with other candidates in the current subset exceeds the upper limit.

[0059] If the current subset has violated any mandatory constraint, or if the remaining candidates cannot make the current subset meet the minimum number of professional tag coverages, then the search branch will stop expanding.

[0060] A valid candidate combination is formed when the current combination contains all the candidates corresponding to all seats and satisfies all constraints.

[0061] The candidate combination code is obtained by sequentially concatenating the seat number and the corresponding candidate member code according to the seat order. Candidates with the same set of members but different seat assignments form different candidate combination codes.

[0062] All valid candidate combinations are deterministically arranged according to the lexicographical order of their codes, forming a candidate combination state space. Each candidate combination record includes the candidate combination code, the candidate member code corresponding to each seat, the professional label coverage result, the professional similarity verification result, the institution quantity verification result, and a constraint verification summary.

[0063] If the constraint search fails to generate valid candidate combinations, the output state "No feasible combination" is displayed. In this case, the avoidance constraint or eligibility constraint is not automatically reduced. For adjustable professional similarity limits or professional coverage requirements, the rule management entity generates a new extraction rule version and regenerates the candidate pool state commitment value, extracts random input, and recreates the candidate combination state space.

[0064] S105, Generation of Combined Weight Distribution For each candidate in the candidate combination state space, the basic load calibration parameters are calculated based on its historical selection count, current number of tasks, number of pending tasks, and available time period within the preset statistical period.

[0065] The basic load calibration parameters decrease as the number of historical selections, the number of currently undertaken tasks, and the number of pending tasks increase, and increase as the available time period increases. The normalization intervals and corresponding coefficients for each data point are pre-recorded in the extraction rule version.

[0066] To prevent the formation of a stable and predictable high-probability candidate group by using fixed load calibration parameters over a long period of time, a digest operation is performed on the random input, candidate code, and the current extraction round. A preset bit segment is extracted from the digest result and converted into the round perturbation factor of the candidate in the current extraction round.

[0067] Further, the cumulative perturbation deviation of the candidate in multiple consecutive historical extraction rounds is read. When the cumulative perturbation deviation is positive and reaches the preset deviation threshold, the perturbation factor of the candidate in the current round is reduced; when the cumulative perturbation deviation is negative and the absolute value reaches the preset deviation threshold, the perturbation factor of the candidate in the current round is increased, so that the cumulative perturbation of the candidate in multiple consecutive extraction rounds remains within the preset range.

[0068] The candidate member's current-round node weight is obtained by multiplying the candidate member's basic load calibration parameters by the corrected round perturbation factor. For any candidate combination, the current-round node weights of all candidates within the combination are multiplied to obtain the original weight of the candidate combination. Using the multiplication method allows the lower node weight corresponding to any high-load candidate member within the combination to constrain the overall candidate combination weight. The sum of the original weights of all candidate combinations in the candidate combination state space is calculated, and the ratio of each candidate combination's original weight to the sum of the original weights is used as the normalized weight of the corresponding candidate combination, thus forming the combination weight distribution. The combination's original weight, normalized weight, basic load calibration parameters, round perturbation factor, and cumulative perturbation deviation correction value are all written into the combination weight record.

[0069] S106. Target court combination positioning: To avoid interval boundary errors caused by floating-point operations in different computing environments, this embodiment uses integer intervals to complete the target court combination positioning; a positioning interval consisting of zero to a preset maximum integer is set, and the corresponding continuous integer sub-intervals are determined sequentially according to the deterministic arrangement order of candidate combinations and the normalized weights of each candidate combination.

[0070] The length of each integer sub-interval is proportional to the normalized weight of the corresponding candidate combination. The remaining integers generated by converting the weights into integer interval lengths are allocated one by one according to the deterministic order of the candidate combinations until all positioning intervals are allocated.

[0071] Extract a preset bit segment corresponding to the length of the positioning interval from the randomly drawn input. Convert the bit segment into a non-negative integer and perform a modulo operation on the length of the positioning interval to obtain a random positioning integer. Find the integer sub-interval where the random positioning integer is located, and determine the candidate combination corresponding to the integer sub-interval as the target family combination. After the target family combination is determined, record the order of candidate combinations, the original weights of each candidate combination, the normalized weights, the boundaries of the integer sub-intervals, the random positioning integer, and the code of the target family combination.

[0072] S107, Conditional probability supplementary sampling after personnel abnormalities, such as Figure 6 As shown, once the target panel composition is determined, a panel confirmation message is sent to each selected participant.

[0073] When a selected person accepts the panel assignment within the preset period and their eligibility, conflict, and availability status remain valid, the seat corresponding to that person is marked as confirmed.

[0074] When a selected person refuses to participate, fails to confirm within the preset period, experiences a conflict of interest, or their eligibility expires, that person will be marked as an abnormal person, and an abnormal event record will be generated. The abnormal event record includes the abnormal person code, abnormal status type, time of occurrence, summary of the basis for the abnormality, and abnormal event number.

[0075] At the start of the supplementary draw, all personnel in the target group who have not experienced any abnormalities and their corresponding seat relationships are frozen. Seats corresponding to abnormal personnel are identified as missing seats. The candidate combination state space used in the initial draw is returned, and candidate combinations that simultaneously include all personnel who have not experienced abnormalities, maintain the original seat relationships of personnel who have not experienced abnormalities, and satisfy the missing seat attribute constraint are filtered. In the filtering results, candidate combinations that include personnel whose qualifications have expired, have generated new conflicts of interest, are currently unavailable, or have been identified as other seat holders are further excluded, resulting in the set of valid combinations corresponding to this supplementary draw. During the supplementary draw, the complete combination weights of the valid combinations are not recalculated; instead, the original weights corresponding to each valid combination at the time of the initial draw are read.

[0076] The effective combinations are grouped according to the substitutes corresponding to the missing seats. For any substitute, the original weights of all candidate combinations in the effective combination set that fill the missing seat with that substitute are summed to obtain the marginal weight of that substitute; the sum of the marginal weights of all substitutes is calculated, and the ratio of the marginal weight of each substitute to the sum of the marginal weights is used as the conditional probability of that substitute; the initial random input, the abnormal person code, the abnormal state type, the abnormal event sequence number, and the round of supplementary sampling are concatenated and summarized to generate the supplementary random input.

[0077] Using the same integer interval method as the target group combination location, continuous integer sub-intervals are divided according to the conditional probability of each substitute, and the supplementary selection location integer is obtained based on the supplementary selection random input. The substitute corresponding to the sub-interval of the supplementary selection location integer is determined as the substitute. After the substitute is determined, the non-abnormal personnel and their seats in the target group combination remain unchanged, and only the substitute is used to fill the missing seats. When the substitute is rejected again, timed out of confirmation, temporarily recused, or becomes ineligible, the candidate combination containing the substitute is removed from the effective combination set, the supplementary selection round is increased, the conditional probability of the remaining substitute is recalculated, and a new supplementary selection random input is generated based on the updated supplementary selection round. If the effective combination set is empty, the state of no substitute is output, and the complete group combination selection is re-executed according to the latest candidate pool state, without temporarily adding new candidates during the original supplementary selection process.

[0078] S108. Verification data generation: The candidate pool state commitment value, state transition certificate, random component commitment, random component public verification result, conflict of interest calculation record, candidate combination state space summary, combination weight record, integer interval boundary, target group combination code, abnormal event record, and supplementary sampling parameters are combined into a verification data package.

[0079] Data generated during the extraction process is written to the log in chronological order. Each log entry includes a summary of the previous log entry, a summary of the current log data, the log generation time, and the digital signature of the generating node. A link is established between the summary of the previous log entry and the current log entry, creating a continuous chain of summaries in the logs.

[0080] The verification data packet is divided into public verification data and controlled verification data. Public verification data includes de-identified candidate codes, candidate pool state commitment values, random component commitments, combined weights, integer ranges, and extraction results; controlled verification data includes candidate identity mapping relationships, complete interest association paths, and data that needs to be restricted from access by law.

[0081] Example 2

[0082] This embodiment uses a three-person panel as an example to illustrate the specific execution process of the present invention. The panel consists of three seats: a legal professional seat, a financial professional seat, and an industry-specific technical professional seat. The three personnel must come from different employing institutions, the professional similarity between any two personnel must not exceed a preset similarity limit, and the combined professional tags must cover at least three professional categories: legal, financial, and the industry-specific technical category of the case.

[0083] The candidate database contains 120 candidates. After de-identification, candidate codes P001 to P120 are obtained.

[0084] One hundred and twenty candidate records are generated based on the eligibility status, availability status, professional attributes, historical attributes, and load status of each candidate. A tree-shaped commitment structure is constructed according to the candidate's coding order to obtain the initial candidate pool status commitment value.

[0085] Construct a relationship diagram based on the positions and involvement of the parties involved in the case, their legal representatives, related companies, and candidates.

[0086] The search revealed that candidate P018 has a two-step joint employment and equity control path with the holding company of the case subject through its historical employment institution. Its overall conflict level reaches the review threshold but is lower than the avoidance threshold. Therefore, P018 is identified as pending review.

[0087] Candidate P043 has directly represented the subject of a case, and its overall conflict level has reached the avoidance threshold. Therefore, P043 is determined to be excluded.

[0088] The remaining candidates have a total conflict level below the review threshold and remain eligible to participate.

[0089] Write the conflicting states of P018 and P043 into the corresponding candidate records, reconstruct the tree-shaped commitment structure, obtain the updated candidate pool state commitment value, and generate a state transition certificate that points from the initial candidate pool state commitment value to the updated candidate pool state commitment value.

[0090] Three independent computing nodes each generate a random component and a random salt value, and submit a commitment to the random component. After the commitment phase, the three independent computing nodes publicly disclose the random component and the random salt value. Verification shows that the data disclosed by the three nodes are consistent with their random component commitments.

[0091] The three random components are XORed according to the node encoding order to obtain a combined random quantity; then the combined random quantity, the updated candidate pool status commitment value, the unique case identifier, the rule version, and the extraction round are digested to obtain the extraction random input.

[0092] Based on the attribute requirements of the three seats, selectable personnel sets are formed for legal, financial, and industry technical seats, respectively, excluding P018 and P043.

[0093] The search is performed in the order of legal, financial, and industry technical positions, eliminating combinations with more than one person from the same organization, professional similarity exceeding the limit, or insufficient professional tag coverage, ultimately forming multiple valid candidate combinations.

[0094] Among them, candidate combination C001 consists of legal seat P012, financial seat P036 and industry technology seat P081; candidate combination C002 consists of legal seat P015, financial seat P044 and industry technology seat P081; candidate combination C003 consists of legal seat P012, financial seat P057 and industry technology seat P094.

[0095] All valid candidate combinations are deterministically sorted according to the combination code, and the basic load calibration parameters are calculated based on the candidate's historical selection count, current number of tasks undertaken, number of pending tasks, and available time period.

[0096] The round perturbation factor is generated based on the randomly selected input and candidate member codes, and then corrected by incorporating the cumulative perturbation deviation. The basic load calibration parameters of each candidate member within the combination are multiplied by the corrected round perturbation factor to obtain the candidate member's node weight for this round. Finally, the node weights of the three candidates are multiplied together to obtain the original weight of the candidate combination.

[0097] The original weights of all candidate combinations are normalized, and integer sub-intervals are divided according to a deterministic order. Random integers are obtained by drawing random inputs. If the random integer falls into the integer sub-interval corresponding to candidate combination C001, then C001 is determined as the target combination.

[0098] Confirmation messages were sent to P012, P036, and P081. P012 and P081 confirmed their participation within the preset period. After confirming, P036 was found to have a new conflict of interest with a company related to the case, so P036 was marked as an abnormal person.

[0099] During the supplementary draw, P012 and its legal seat, P081 and its industry technology seat are frozen, and candidate combinations that contain both P012 and P081 and meet the financial seat requirements are selected from the initial candidate combination state space.

[0100] The effective combinations obtained from the screening were P044, P057 and P063 as candidates for financial seats, with initial combination weights of 180, 120 and 100 respectively.

[0101] The original weights of the valid combinations containing P044, P057, and P063 are aggregated to obtain the marginal weights of P044, P057, and P063. The sum of the three marginal weights is 400, so their conditional probabilities are 180 / 400, 120 / 400, and 100 / 400, respectively.

[0102] The initial random input, candidate code of P036, temporary avoidance exception type, exception event number, and first supplementary sampling round are digested to obtain the supplementary random input.

[0103] The integer sub-intervals are divided based on the conditional probabilities of the three potential substitutes, and a replacement integer is generated based on the random input from the supplementary draw. The replacement integer falls within the integer sub-interval corresponding to P044, therefore P044 is identified as the substitute for the finance position.

[0104] The final panel consisted of legal seat P012, financial seat P044, and industry technology seat P081.

[0105] After obtaining the verification data packet, the independent verification node first verifies whether the random components published by the three independent computing nodes are consistent with the random component commitments, and then recalculates the combined random quantity and extracts random inputs; then, it recalculates the candidate pool state commitment value based on the candidate record summary and tree-shaped verification path; then, it recalculates the conflict state of P018 and P043 based on the interest-related path and preset parameters; it re-forms the candidate combination state space based on seat constraints and professional similarity matrix; and it recalculates the original weights and integer sub-intervals of the combination based on the load calibration parameters and round perturbation factors.

[0106] The recalculated random integer falls into the integer sub-interval corresponding to C001, consistent with the initial sampling result. The independent verification node further fixes P012 and P081, recalculates the conditional probabilities of P044, P057 and P063 based on the initial original combination weights, and recalculates the substitute personnel based on the random input of the supplementary sampling. The obtained substitute personnel is P044, consistent with the actual supplementary sampling result.

[0107] Therefore, the candidate pool status, conflict resolution, multi-party random input, candidate combination constraints, combination weight calibration, and abnormal personnel re-selection can all be independently recalculated based on the same set of deterministic rules. Furthermore, the real identity information of the candidates does not need to be directly disclosed during the public verification process.

[0108] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for randomly selecting members of a panel, characterized in that, Includes the following steps: Candidates are de-identified and coded, and candidate data summaries are generated according to the eligibility status and historical attributes of candidates in a deterministic order, and candidate pool status commitment values ​​are formed accordingly. Construct a graph of interests including the case subject, candidates and related subjects, calculate the conflict degree of candidates based on relationship type, relationship time and relationship path level, determine the exclusion status or pending review status, and update the candidate pool status commitment value. It receives random component commitments pre-submitted by multiple independent computing nodes, verifies their publicly disclosed random components, and jointly performs calculations on each random component, the updated candidate pool status commitment value, and the case identifier to generate random input for extraction. A candidate combination state space is constructed based on seat attribute constraints, candidate professional difference constraints, and conflict states. A combination weight distribution is generated based on the historical number of elections, current task load, and round perturbation factors determined by random input. The target family combination is determined from the candidate combination state space based on the random input. When a member of the target group refuses, exceeds the confirmation time, temporarily recuses, or becomes ineligible, the non-withdrawing members are frozen. Valid combinations containing non-withdrawing members and satisfying the missing seat constraint are selected from the candidate combination state space. The conditional probability of each substitute member is determined based on the original combination weight of the valid combination. Substitute members are determined using supplementary random input derived from random input and abnormal event identifiers. Record the candidate pool state commitment, random component commitment, conflict identification results, combined weights, and supplementary sampling parameters to generate verification data for independent verification nodes to recalculate the sampling results.

2. The method for randomly selecting panel members according to claim 1, characterized in that, The logic for forming the candidate pool state commitment value is as follows: Arrange the candidate data in dictionary order according to the de-identified encoding, and calculate the cryptographic digest of each candidate data respectively; A tree-shaped commitment structure is constructed using each cryptographic digest as a leaf node, and the root digest of the tree-shaped commitment structure is determined as the candidate pool state commitment value; When a candidate's eligibility status, conflict status, or availability status changes, a status transition certificate is generated based on the root summary before the change, the status change data summary, and the root summary after the change.

3. The method for randomly selecting panel members according to claim 2, characterized in that, The state transition certificate also includes the state change type, state change time, and digital signature of the state change data; Independent verification nodes obtain the tree-structured verification path corresponding to the target candidate, and recalculate the root digest corresponding to the tree-structured verification path to verify the attribution relationship of the target candidate in the corresponding candidate pool state and the state continuity between adjacent candidate pool states without obtaining the plaintext identity of the target candidate.

4. The method for randomly selecting panel members according to claim 1, characterized in that, The calculation logic for the conflict level of candidates is as follows: The case subject, case agent, related enterprises, candidates and their employing institutions are set as graph nodes, and the equity control relationship, joint employment relationship, historical agency relationship and joint case relationship are set as graph edges with relationship type, relationship weight and time attribute. Search for related paths between candidate nodes and case subject nodes whose path hierarchy does not exceed a preset threshold; The overall conflict degree of the candidate is calculated based on the relational weights of each graph edge in the associated path, the path level attenuation parameter, and the timeliness parameter corresponding to the relational time. Candidates whose overall conflict level reaches the avoidance threshold are identified as excluded, and candidates whose overall conflict level reaches the review threshold but is lower than the avoidance threshold are identified as pending review. Candidates in the excluded or pending review state are prohibited from entering the candidate combination state space.

5. The method for randomly selecting panel members according to claim 1, characterized in that, The logic for generating the random input is as follows: Receive commitments from each independent computing node for random components generated from random components and random salt values; After the number of random component commitments reaches a preset number, the random components and random salt values ​​published by each independent computing node are received, and the consistency between the published data and the corresponding random component commitments is verified. Perform an XOR operation on the verified random components or perform a concatenated digest operation according to the node encoding order to generate a combined random quantity; The combined random variable, candidate pool status commitment value, case identifier, extraction round, and extraction rule version identifier are digested to generate the extraction random input; When an independent computing node fails to disclose a random component within a preset time limit, an alternative component is generated based on the corresponding random component commitment, according to the absence transformation rules that were fixed before the random component commitment was submitted.

6. The method for randomly selecting panel members according to claim 1, characterized in that, The logic for constructing the candidate combination state space is as follows: Seat attribute constraints are generated based on the professional category and qualifications of each panel of seats; The professional similarity between candidates is calculated based on their professional tags to form a professional similarity matrix; Set a minimum number of professional tags to cover for candidate combinations, an upper limit for the professional similarity between candidates, and an upper limit for the number of candidates from the same institution. Candidate combinations are generated by constraint search that simultaneously meet the requirements of seat attribute constraints, minimum number of professional tags covered, maximum professional similarity, maximum number of candidates from the same institution, and conflict status. The candidate combinations are then deterministically sorted according to the combination codes formed by the candidate codes in the combinations.

7. The method for randomly selecting panel members according to claim 1, characterized in that, The generation logic of the combined weight distribution is as follows: Based on the candidate's historical selection count, current number of tasks undertaken, number of pending tasks, and available time period within the preset statistical period, calculate the candidate's basic load calibration parameters. The round perturbation factor for each candidate in the current round of sampling is generated based on the random input and candidate codes. The cumulative perturbation deviation of candidates in multiple consecutive extraction rounds is determined based on historical extraction records, and the round perturbation factor is corrected using the cumulative perturbation deviation. The original weights of the combinations are determined based on the basic load calibration parameters of each candidate member in the candidate combination and the corrected round perturbation factor. The original weights of each candidate combination are then normalized to obtain the combination weight distribution.

8. The method for randomly selecting panel members according to claim 7, characterized in that, The logic for determining the target family group combination is as follows: Based on the deterministic ranking results and normalized weights of each candidate combination, the preset integer value range is divided into continuous sub-intervals corresponding to each candidate combination, and the length of each continuous sub-interval corresponds to the normalized weight of the corresponding candidate combination. The preset bit segment of the extracted random input is converted into a randomly positioned integer within the preset integer value range; Determine the continuous sub-intervals to which the randomly located integers belong, and identify the corresponding candidate combinations as the target family combination; Write the candidate combination sorting results, the original weights of the combinations, the boundaries of continuous sub-intervals, and the randomly positioned integers into the verification data.

9. The method for randomly selecting panel members according to claim 1, characterized in that, The logic for determining the substitutes is as follows: Obtain the seat attributes corresponding to the abnormal personnel and the remaining group structure composed of the non-exited personnel, and filter the candidate combinations that contain the non-exited personnel and satisfy the missing seat constraint from the first extracted candidate combination state space; Eliminate candidate combinations that include those whose qualifications have expired, those that create new conflicts of interest, or those that have already been selected, to obtain valid combinations; Based on the substitutes in the effective combination, the original combination weights of the effective combination are marginalized, accumulated, and normalized to obtain the conditional probabilities of each substitute. The initial random input, abnormal personnel code, abnormal status type, abnormal event sequence number and re-sampling round are digested to generate re-sampling random input; The substitutes are determined based on the random input of the supplementary draw and the conditional probability of each substitute, while keeping the non-exited personnel and their seats unchanged.

Images