A digital bank risk review method and system for federal audit evidence learning
Patent Information
- Application Number
- CN202611135082.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-29
- Publication Date
- 2026-10-30
AI Technical Summary
传统风险复核系统通常输出异常分数或风险等级，审计人员仍需人工判断异常来源、证据是否充分以及是否值得优先复核
1.通过本地审计证据场和联邦证据一致性权重，将异常检测从分数输出扩展为结构化审计证据输出。
Smart Images
Figure CN123015140A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and to a digital bank risk review method and system for learning federal audit evidence. It is applicable to scenarios where raw data cannot be directly shared among banks, branches, open banking platforms, and audit institutions, but collaborative generation of audit evidence is required. Background Technology
[0002] As digital banking expands, transaction records, account attributes, credit variables, repayment behavior, channel behavior, and institutional risk indicators are growing rapidly. Traditional risk review systems typically output anomaly scores or risk levels, requiring auditors to manually determine the source of the anomalies, the sufficiency of the evidence, and whether a review should be prioritized.
[0003] Federated learning mitigates privacy concerns by keeping data locally and exchanging only model or statistical information. However, existing federated anomaly detection methods primarily focus on optimizing model parameters or predictive performance, making it difficult to directly provide structured audit reasons, cross-agency consistency support, and report confidence levels. Existing interpretable methods typically generate explanations after the model output, but these explanations do not participate in cross-agency knowledge fusion, easily leading to a separation between detection and explanation. Summary of the Invention
[0004] This invention provides a digital bank risk review method and system based on federal audit evidence learning. Under the premise of meeting privacy protection requirements, it unifies local anomaly deviations, audit factor dependency structures, cross-agency causal consistency, agency drift, and report confidence into the same evidence generation mechanism to support auditors in making reviewable risk decisions.
[0005] To achieve the objectives of this invention, the following technical solutions are proposed: The present invention provides a method for reviewing digital bank risks through federal audit evidence learning, comprising the following steps: Step 1: The server initializes the global anomaly detection model parameters and global evidence consistency weights, and distributes the global anomaly detection model parameters and global evidence consistency weights to multiple clients; Step 2: Each client trains a local anomaly learner based on local digital bank audit or transaction data, and generates anomaly scores and anomaly probabilities for the audit records to be reviewed; Step 3: Each client estimates the audit baseline based on pre-stored local low-risk samples and calculates the audit factor deviation evidence of the audit records to be reviewed relative to the audit baseline; Step 4: Each client constructs a local audit dependency structure based on the statistical dependencies between local audit factors and determines the structural support vector of each audit factor; Step 5: Each client combines the audit factor deviation evidence, structural support vectors, and the global evidence consistency weights issued by the server factor by factor to form a local audit evidence field, and determines the audit records to be reviewed based on this field. Audit reasons; Step 6: Each client uploads a compressed evidence summary and parameter updates for the local anomaly learner to the server. The compressed evidence summary includes the frequency of cause occurrence, average deviation evidence, dependency structure support, and local sample size, but does not include the original audit log, original feature table, global sample prototype, or client-specific threshold. Step 7: The server calculates cross-agency cause support, deviation stability, and dependency structure support based on the compressed evidence digests uploaded by multiple clients, updates the global evidence consistency weight, and sends the updated global evidence consistency weight to the clients; Step 8: The client uses the local audit evidence field. , Audit Reasons Average deviation of evidence vector Average dependency structure support vectors and the global evidence consistency weight issued by the server Comprehensive calculation of audit records pending review The report's confidence level is assessed, and a structured audit evidence record is output.
[0006] The beneficial effects of this invention are as follows: 1. By using local audit evidence fields and federal evidence consistency weights, anomaly detection is extended from score output to structured audit evidence output.
[0007] 2. Cross-institutional evidence fusion is achieved by compressing evidence summaries, avoiding the uploading of original audit records, original feature tables, global sample prototypes, and client-specific thresholds.
[0008] 3. By using local deviations, supportive dependency structures, and cross-agency consistency as conditions for forming causal evidence, the stability and verifiability of audit causes are improved.
[0009] 4. Improve the reliability of risk review in digital banks by suppressing overconfidence caused by institutional distribution shifts through drift perception report confidence. Attached Figure Description
[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0011] Figure 1 This is a flowchart for digital bank risk review using federal audit evidence learning. Detailed Implementation
[0012] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.
[0013] This invention provides a method for reviewing digital bank risks through federal audit evidence learning, with reference to... Figure 1 This includes the following steps: Step 1: The server initializes the global anomaly detection model parameters and global evidence consistency weights, and distributes the global anomaly detection model parameters and global evidence consistency weights to multiple clients; Step 2: Each client trains a local anomaly learner based on local digital bank audit or transaction data, and generates anomaly scores and anomaly probabilities for the audit records to be reviewed; Step 3: Each client estimates the audit baseline based on pre-stored local low-risk samples and calculates the audit factor deviation evidence of the audit records to be reviewed relative to the audit baseline; Step 4: Each client constructs a local audit dependency structure based on the statistical dependencies between local audit factors and determines the structural support vector of each audit factor; Step 5: Each client combines the audit factor deviation evidence, structural support vectors, and the global evidence consistency weights issued by the server factor by factor to form a local audit evidence field, and determines the audit records to be reviewed based on this field. Audit reasons; Step 6: Each client uploads a compressed evidence summary and parameter updates for the local anomaly learner to the server. The compressed evidence summary includes the frequency of cause occurrence, average deviation evidence, dependency structure support, and local sample size, but does not include the original audit log, original feature table, global sample prototype, or client-specific threshold. Step 7: The server calculates cross-agency cause support, deviation stability, and dependency structure support based on the compressed evidence digests uploaded by multiple clients, updates the global evidence consistency weight, and sends the updated global evidence consistency weight to the clients; Step 8: The client uses the local audit evidence field. , Audit Reasons Average deviation of evidence vector Average dependency structure support vectors and the global evidence consistency weight issued by the server Comprehensive calculation of audit records pending review The report's confidence level is assessed, and a structured audit evidence record is output.
[0014] The local digital bank audit or transaction data includes at least one of the following: amount, balance, credit line, transaction frequency, time interval, account relationship, transaction channel, institutional attributes, and derivative risk statistics.
[0015] The factor-level deviation evidence is calculated using a robust deviation operator for numerical audit factors. The robust deviation operator is the absolute difference between the factor value of the record to be reviewed and the local median, divided by the sum of the local interquartile range and the smoothing term.
[0016] The local audit dependency structure is determined by at least one of rank correlation, normalized correlation, mutual information correlation, rule dependency strength, graph centrality, or edge support.
[0017] The local audit evidence field consists of factor-level deviation evidence, enhancements including local audit dependency structure support, and a factor-wise product or weighted combination of global evidence consistency weights, which strengthens audit factors into causal evidence when local deviation, structural support, and cross-agency consistency are all present.
[0018] The global evidence consistency weight is obtained by a nonlinear mapping of the weighted sum of normalized cross-institutional cause support, deviation stability, and dependency structure support.
[0019] The client drift penalty is determined based on the distance between the client evidence statistical summary and the global evidence statistical summary, and the distance includes at least one of Jensen-Shannon distance, Wasserstein proxy distance, population stability index, or normalized distance.
[0020] The structured audit evidence record includes anomaly scores, top-k audit reasons, strength of causal evidence, cross-agency consistency support, client drift penalties, and report confidence.
[0021] Specifically, (1) Server initialization: The server initializes global model parameters. Global evidence consistency weight , number of communication rounds and participating client collection and will and Distribute to the client. Client The local audit dataset is defined as follows:
[0022] in, For the first The first client's One audit factor, This is an abnormal or risky label. For audit cause labels or cause indication vectors, For the client The number of local audit samples.
[0023] (2) Client-side abnormal learning: Client-side local model parameters The following are the audit records to be reviewed. Calculate the anomaly score from a vector composed of multiple audit samples. and probability of anomalies :
[0024] in, This is a local exception learning function. for Mapping function. Unified representation of abnormal scores, A unified representation of the probability of an anomaly or the probability of a risk.
[0025] (3) Client-side audit baseline and deviation evidence calculation: The client estimates the audit baseline based on local low-risk samples. For numerical audit factors... Samples to be verified Audit factor deviation evidence Represented as:
[0026] in, For the client Audit Factors The local median, The local interquartile range. For smoothing terms, This represents a vector composed of the deviation evidence of each audit factor.
[0027] (4) Client-side dependency structure supports calculation: The client constructs an audit factor graph based on the statistical dependencies between local audit factors. For audit factors... and Normalized correlation strength Represented as:
[0028] Records pending review Audit Factors Structural support Represented as:
[0029] in, For the edge weights of the audit factor graph, Represents a correlation measure. Represents a mutual information association. and For the observation sequence of the corresponding audit factor ( For the first (a sequence of values for each audit factor across all local samples) norm This is the normalization function. A unified representation of support vector structures.
[0030] (5) Construction of local audit evidence field: The client will deviate from the evidence Structural support And global evidence consistency weight By performing factor-wise combinations, the local audit evidence field is obtained. :
[0031] Records pending review of Audit reasons Represented as:
[0032] in, To support the weights of the structure, Represents factorial product, The function is used to select the evidence with the highest strength. Each audit factor or cause category.
[0033] (6) Client-side local model optimization: The client merges the classification or anomaly detection loss, federated parameter constraints, and evidence consistency constraints into a local training objective. :
[0034] in, This indicates the loss in local classification or anomaly detection. This represents the deviation constraint between client parameters and server global parameters. This indicates a constraint on the consistency of evidence. and These are the weight coefficients. The client performs gradient updates based on the local objective function:
[0035] in, For local learning rate, For use right Find the derivative.
[0036] (7) Upload compressed evidence summary: The client does not upload the original audit records, original feature tables or personalized thresholds, but only uploads the updated local model parameters and compressed evidence summary. :
[0037] in, For each audit factor appearing The frequency vector in the cause, The average deviation of the evidence vector, For the average dependency structure support vectors, This represents the number of client-side samples.
[0038] (8) Server Evidence Consistency Weight Update: After receiving compressed evidence summaries uploaded by multiple clients, the server updates the weights for each audit factor. Calculate cross-institutional reason support Deviation from stability and dependency structure support :
[0039] Update the global evidence consistency weight accordingly. :
[0040] in, for Mapping function, For client sample size weights or trusted participation weights, These are weighting coefficients. (The rest of the text is incomplete and cannot be translated.) A unified representation is provided by each The global evidence consistency weight vector is composed of these.
[0041] (9) Server global model aggregation: The server aggregates the data of participants in the first... Client set for round training We perform weighted aggregation to obtain the global model parameters for the next round:
[0042] The server will update the global model parameters. And global evidence consistency weight The data is then sent to the client to begin the next round of training.
[0043] (10) Calculation of confidence level for drift perception report: The client calculates confidence level based on the local audit evidence field. , Audit Reasons Average deviation of evidence vector Average dependency structure support vectors and the global evidence consistency weight issued by the server Comprehensive calculation of audit records pending review The report's confidence level. Specifically, when the local audit evidence for the records to be reviewed is strong, When the audit cause is stable, and its deviation evidence, dependency structure support, and global consistency weights are consistent, the client increases the confidence level of the report; when the local statistics differ significantly from the global statistics, or When the audit cause is unstable, the client lowers the confidence level of the report. This report confidence level is used to assist auditors in determining the reliability of records to be reviewed and their review priorities.
[0044] (11) Iteration Stop and Report Generation: The server determines whether to stop training based on the change rate of global evidence consistency weights and changes in model parameters.
[0045] in, The rate of change of the global evidence consistency weight. For the rate of change of model parameters, and This is the convergence threshold. This is an indicator function that stops training and outputs a structured audit evidence record when the condition within the parentheses is true. :
[0046] in, Including abnormal scores, Structured information such as audit reasons, strength of evidence for the reasons, and local audit evidence field.
[0047] Structured audit evidence record It can serve as input for risk review in digital banking, showing auditors the degree of anomalies in records to be reviewed, the main audit reasons, and the corresponding strength of evidence. Auditors can use this structured audit evidence record to prioritize and manually review transaction records, account behavior, or credit recipients, thereby improving the interpretability and efficiency of the risk review process.
[0048] In actual deployment, the server first establishes a federated training task, determining the initial values of participating institutions, communication rounds, secure aggregation methods, global model parameters, and global evidence consistency weights. The client then locally completes data standardization, missing value handling, audit factor encoding, and low-risk sample screening to form an audit factor vector that can be used for local training.
[0049] During local training on the client side, a robust baseline for each audit factor is first estimated using low-risk samples. Then, anomaly scores, factor deviation levels, and dependency structure support are calculated for the records to be reviewed. For numerical factors, robust statistics can be used to measure deviation; for categorical, relational, or rule-based factors, rarity, combination anomaly levels, or rule trigger strength can be used to measure deviation.
[0050] When forming a local audit evidence field, the client uses a combination of local deviation, dependency structure support, and server-issued global evidence consistency weights to filter audit causes. Only factors that simultaneously possess local deviation, structural support, and cross-agency consistency support will be reinforced in the audit cause ranking.
[0051] After completing local training, the client only uploads the model update and compressed evidence summary, without uploading the original audit records, original feature tables, customer identifiers, or client-specific thresholds. The server updates the global model and global evidence consistency weights based on the summary information from multiple clients, and then sends the updated results back to the clients for the next round of training.
[0052] After training, the client outputs a structured audit evidence record to auditors. This record includes anomaly scores, primary audit causes, strength of evidence for the causes, cross-agency consistency support, agency drift penalties, and report confidence levels, which assist auditors in risk review, review prioritization, and evidence documentation.
[0053] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.
Claims
1. A digital bank risk review method based on federal audit evidence learning, characterized in that, Includes the following steps: Step 1: The server initializes the global anomaly detection model parameters and global evidence consistency weights, and distributes the global anomaly detection model parameters and global evidence consistency weights to multiple clients; Step 2: Each client trains a local anomaly learner based on local digital bank audit or transaction data, and generates anomaly scores and anomaly probabilities for the audit records to be reviewed; Step 3: Each client estimates the audit baseline based on pre-stored local low-risk samples and calculates the audit factor deviation evidence of the audit records to be reviewed relative to the audit baseline; Step 4: Each client constructs a local audit dependency structure based on the statistical dependencies between local audit factors and determines the structural support vector of each audit factor; Step 5: Each client combines the audit factor deviation evidence, structural support vectors, and the global evidence consistency weights issued by the server factor by factor to form a local audit evidence field, and determines the audit records to be reviewed based on this field. Audit reasons; Step 6: Each client uploads a compressed evidence summary and parameter updates for the local anomaly learner to the server. The compressed evidence summary includes the frequency of cause occurrence, average deviation evidence, dependency structure support, and local sample size, but does not include the original audit log, original feature table, global sample prototype, or client-specific threshold. Step 7: The server calculates cross-agency cause support, deviation stability, and dependency structure support based on the compressed evidence digests uploaded by multiple clients, updates the global evidence consistency weight, and sends the updated global evidence consistency weight to the clients; Step 8: The client uses the local audit evidence field. , Audit Reasons Average deviation of evidence vector Average dependency structure support vectors and the global evidence consistency weight issued by the server Comprehensive calculation of audit records pending review The report's confidence level is assessed, and a structured audit evidence record is output.
2. The method according to claim 1, characterized in that, In step 1: Server initialization global anomaly detection model parameters Global evidence consistency weight and will and Send to the client, client The local audit dataset is defined as follows: in, For the first The first client's One audit factor, This is an abnormal or risky label. For audit cause labels or cause indication vectors, For the client The number of local audit samples.
3. The method according to claim 2, characterized in that, In step 2: Client Parameters of the local anomaly learner The following are the audit records to be reviewed. Calculate abnormal scores and probability of anomalies : Among them, audit records pending review A vector composed of multiple audit samples. This is a local exception learning function. for Mapping function, Indicates abnormal scores. Indicates the probability of an anomaly. This represents the number of communication rounds.
4. The method according to claim 3, characterized in that, In step 3: Client Estimating the audit baseline based on pre-stored local low-risk samples for numerical audit factors. Audit records pending review Audit factor deviation evidence Represented as: in, For the client Audit Factors The local median, The local interquartile range. As a smoothing term, the vector representation of the deviations of each audit factor from the evidence is as follows: .
5. The method according to claim 4, characterized in that, In step 4: Client An audit factor graph is constructed based on the statistical dependencies between local audit factors. and Normalized correlation strength Represented as: Audit records pending review Audit Factors Structural support Represented as: in, For the edge weights of the audit factor graph, Represents a correlation measure. Represents a mutual information association. and This represents the sequence of values for the corresponding audit factor across all local samples. norm The normalization function is used to represent the structure support vectors as follows: .
6. The method according to claim 5, characterized in that, In step 5: Client Deviation of audit factors from evidence Structural support vectors And global evidence consistency weight By performing factor-wise combinations, the local audit evidence field is obtained. : Audit records pending review of Audit Reasons Represented as: in, To support the weights of the structure, Represents factorial product, The function is used to select the evidence with the highest strength. Each audit factor or cause category.
7. The method according to claim 6, characterized in that, In step 6: Compressed Evidence Summary Represented as: in, For each audit factor appearing The frequency vector in the cause, The average deviation of the evidence vector, For the average dependency structure support vectors, Number of client-side samples; The parameter update formula for the local anomaly learner is as follows: ;in, For local learning rate, For use right Differentiate; , This indicates the loss in local classification or anomaly detection. This represents the deviation constraint between client parameters and server global parameters. This indicates a constraint on the consistency of evidence. and These are the weighting coefficients.
8. The method according to claim 7, characterized in that, In step 7: After receiving compressed evidence summaries uploaded by multiple clients, the server performs auditing on each factor. Calculate cross-institutional reason support Deviation from stability and dependency structure support : Update the global evidence consistency weight accordingly. : in, for Mapping function, For client sample size weights or trusted participation weights, These are weighting coefficients, calculated by each... The global evidence consistency weight vector is represented as follows: .
9. The method according to claim 8, characterized in that, The method further includes: The server determines whether to stop training based on the change rate of the global evidence consistency weights and the parameter changes of the local anomaly learner. in, The rate of change of the global evidence consistency weight. The rate of change of parameters for the local anomaly learner. and The convergence threshold, This is an indicator function that stops training and outputs a structured audit evidence record when the condition within the parentheses is true. : 。 10. A digital banking risk review system implementing the method of any one of claims 1 to 9, characterized in that, The system includes a central server and multiple clients; The central server includes an evidence digest receiving module, a model aggregation module, an evidence consistency calculation module, and a consistency weight distribution module. The evidence summary receiving module is used to receive compressed evidence summaries uploaded by each client. The compressed evidence summary includes the frequency vector of each audit factor appearing in the top-k audit reasons, the average deviation evidence vector, the dependency structure support vector, and the number of client samples. The model aggregation module is used to perform weighted aggregation of local model parameters uploaded by multiple clients to obtain updated global model parameters; The evidence consistency calculation module is used to calculate the cross-organizational cause support, deviation stability, and dependency structure support of each audit factor based on the compressed evidence digests uploaded by multiple clients. The consistency weight distribution module is used to calculate the global evidence consistency weight based on the cross-organizational cause support, deviation stability and dependency structure support, and distribute the global model parameters and global evidence consistency weight to each client. The client includes an anomaly learning module, an audit baseline estimation module, a deviation evidence calculation module, a dependency structure support calculation module, a local audit evidence field construction module, an evidence summary generation module, and an audit report confidence calculation module. The anomaly learning module is responsible for outputting the anomaly scores of the audit records to be reviewed; The audit baseline estimation module establishes a local audit baseline based on local low-risk samples; The deviation evidence calculation module is used to calculate the abnormal deviation of each audit factor relative to the local baseline; The dependency structure support calculation module is used to calculate the statistical dependencies and structural support between audit factors; The local audit evidence field construction module is used to combine deviation evidence, structural support, and global evidence consistency weights to form a local audit evidence field. The evidence summary generation module is used to generate evidence based on the local audit evidence field and Based on the audit findings, a compressed evidence summary is generated, which includes the audit factors that appear in the following contexts: Frequency vector, average deviation evidence vector, dependency structure support vector, and number of client samples in the audit reasons; The audit report confidence level calculation module is used to calculate the confidence level of the audit report based on the local audit evidence field. The system generates a structured audit evidence record containing anomaly scores, audit reasons, strength of evidence for the reasons, and consistency support information, based on audit reasons and global evidence consistency weights, to support risk review of digital banks.