A method, memory and electronic device for predicting diabetic retinopathy

Abstract

The application provides a diabetic retinopathy prediction method, a memory and an electronic device. The method comprises: obtaining clinical medical record data of a target patient, preprocessing the clinical medical record data, and generating input feature data; inputting the input feature data into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network comprises a plurality of adaptive low-rank expert modules, the plurality of adaptive low-rank expert modules respectively process the input feature data, and generate respective corresponding preliminary prediction results; the feature distribution divergence between the preliminary prediction results output by each adaptive low-rank expert module is calculated; the corresponding fusion weight is dynamically configured according to the feature distribution divergence, each preliminary prediction result is weighted and fused, the final prediction result is obtained, and the diabetic retinopathy risk grade prediction result of the target patient is output. The method of the application effectively reduces the success rate of backdoor attacks while maintaining the prediction accuracy of diabetic retinopathy.

Description

Technical Field

[0001] This application relates to the field of smart medical technology, and in particular to a method for predicting diabetic retinopathy, a memory, and an electronic device. Background Technology

[0002] Diabetic retinopathy is a common microvascular complication of diabetes and a leading cause of irreversible blindness in adults. The disease has an insidious onset and irreversible progression, making early screening and intervention crucial to reducing blindness rates. Currently, clinical practice relies on fundus imaging and manual interpretation of images by physicians, which is costly, inefficient, and hampered by insufficient resources in primary healthcare settings, hindering widespread early screening. To overcome the limitations of manual screening, deep learning models have been introduced to automate lesion prediction. Existing methods often employ disease grading models based on fundus images or introduce multi-expert ensemble mechanisms to improve prediction accuracy. However, existing diabetic retinopathy prediction models still suffer from significant technical deficiencies in terms of security and robustness: deep learning models are vulnerable to backdoor attacks. Attackers can implant triggers into the training data or inject malicious weights into the model, causing it to output incorrect results preset by the attacker when faced with specific trigger conditions, while performing normally under normal input, making the attack extremely covert. To address the aforementioned shortcomings of existing technologies, such as poor prediction robustness and vulnerability to weight poisoning backdoor attacks, there is an urgent need for an intelligent prediction method that can maintain prediction accuracy while effectively resisting weight poisoning backdoor attacks. Summary of the Invention

[0003] This application provides a method for predicting diabetic retinopathy, a memory, and an electronic device to solve the above-mentioned technical problems.

[0004] A method for predicting diabetic retinopathy is designed, comprising: acquiring clinical medical record data of a target patient and preprocessing the clinical medical record data to generate input feature data; inputting the input feature data into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network includes multiple adaptive low-rank expert modules, which have trained feature distribution differences; each of the multiple adaptive low-rank expert modules processes the input feature data to generate its corresponding preliminary prediction result; calculating the feature distribution divergence degree between the preliminary prediction results output by each of the adaptive low-rank expert modules; dynamically configuring corresponding fusion weights according to the feature distribution divergence degree, and performing weighted fusion on each of the preliminary prediction results to obtain a final prediction result; and outputting the predicted risk level of diabetic retinopathy for the target patient based on the final prediction result.

[0005] This scheme employs multiple adaptive low-rank expert modules with trained feature distribution differences to form a multi-expert fusion prediction network. During the inference phase, the fusion weights are dynamically configured using the feature distribution divergence between the outputs of each expert module, achieving proactive detection and dynamic suppression of aberrant activations induced by backdoor attacks. The mechanism lies in the fact that when an expert module is aberrantly activated by a backdoor trigger, its output probability distribution vector will significantly deviate from the output distributions of other normal expert modules. This deviation can be quantified using the feature distribution divergence. Compared to existing defense methods that rely on external adversarial training or trigger filtering, this scheme does not require modification of the model training process or reliance on prior trigger knowledge. It achieves effective defense against backdoor attacks only during the inference phase, significantly reducing defense costs and improving deployment efficiency. Meanwhile, the differences in feature distribution among multiple expert modules ensure that each expert module makes independent judgments on the input data from different feature subspaces. Even if some expert modules are affected by backdoor attacks, the remaining normal expert modules can still provide reliable prediction basis. The fusion module dynamically reduces the weight of abnormal experts or blocks them through divergence detection, ensuring the accuracy and robustness of the final prediction results, thereby effectively reducing the success rate of backdoor attacks while maintaining the prediction accuracy of diabetic retinopathy.

[0006] Further, the step of calculating the feature distribution divergence between the preliminary prediction results output by each of the adaptive low-rank expert modules includes: extracting the probability distribution vectors corresponding to the preliminary prediction results output by each of the adaptive low-rank expert modules; calculating the information-theoretic distance metric between each pair of probability distribution vectors; and determining the feature distribution divergence based on the statistical characteristics of the information-theoretic distance metrics between all pairs of vectors.

[0007] In this scheme, the output differences between expert modules are quantified into a computable feature distribution divergence index by extracting the probability distribution vectors of each expert module's output and calculating the information-theoretic distance metric between each pair. The information-theoretic distance metric can sensitively capture subtle differences between probability distributions. When an expert module produces abnormal output due to backdoor trigger activation, the information-theoretic distance between its probability distribution vector and that of normal expert modules will significantly increase. This increase can be precisely calculated and thresholded. Simultaneously, the statistical characteristics of all pairwise information-theoretic distance metrics are used to determine the final divergence degree, avoiding the randomness and bias of single pairwise comparisons and improving the stability and reliability of divergence degree estimation. Compared to methods that directly compare model output labels or confidence levels, the information-theoretic distance metric based on probability distribution vectors can more comprehensively and precisely reflect the decision differences between expert modules.

[0008] Furthermore, the step of dynamically configuring the corresponding fusion weights based on the feature distribution divergence degree includes: if the average feature distribution divergence degree between the preliminary prediction result of any of the adaptive low-rank expert modules and the preliminary prediction results of the other multiple adaptive low-rank expert modules exceeds a preset divergence threshold, then it is determined that the output of the adaptive low-rank expert module has an abnormal activation risk induced by a backdoor attack, and the fusion weight of the adaptive low-rank expert module is reduced or it is blocked during weighted fusion.

[0009] In this scheme, abnormal activation of expert modules is determined by setting a preset divergence threshold. When the average feature distribution divergence between an expert module and multiple other expert modules exceeds the threshold, the expert module is deemed to have an abnormal activation risk induced by a backdoor attack, and its fusion weight is reduced or it is blocked accordingly. This mechanism has the following significant advantages: The introduction of the preset divergence threshold makes anomaly detection have clear quantitative standards and operability, eliminating the need for human experience judgment and facilitating automated operation in actual clinical deployment; Using the average divergence with multiple other expert modules as the judgment basis, rather than relying solely on a single pair comparison, eliminates the risk of misjudgment caused by the accidental fluctuations of individual expert modules, improving the accuracy and robustness of anomaly detection; The flexible processing strategy of reducing the weight or blocking abnormal expert modules effectively eliminates the impact of backdoor attacks on the final prediction results while retaining the effective information that the expert module may provide when it is not attacked (if only the weight is reduced rather than completely blocked), achieving a dynamic balance between defense strength and information utilization, and avoiding the information loss caused by simply discarding the output of expert modules.

[0010] Furthermore, the pre-trained multi-expert fusion prediction network is trained as follows: acquiring clinical medical record sample data, preprocessing and data augmenting the clinical medical record sample data to construct a training sample set; simulating a weight poisoning backdoor attack process based on a base model, implanting a backdoor into the base model to obtain the poisoned model; constructing multiple adaptive low-rank expert modules, inserting the adaptive low-rank expert modules into the poisoned model, and fixing the original parameters of the poisoned model; performing differentiated configuration on the adaptive low-rank expert modules to ensure trained feature distribution differences among the multiple adaptive low-rank expert modules; constructing the multi-expert fusion prediction network based on the poisoned model and the inserted multiple adaptive low-rank expert modules, and training the multi-expert fusion prediction network to obtain the pre-trained multi-expert fusion prediction network.

[0011] This scheme obtains a poisoned model by simulating a weight poisoning backdoor attack. Multiple adaptive low-rank expert modules are then inserted into this poisoned model, and the original parameters of the poisoned model are fixed. This achieves defensive training—"running with poison and outputting detoxification"—while preserving the backdoor features of the original model. The core mechanism is that fixing the original parameters of the poisoned model permanently preserves the neuron weights corresponding to the backdoor trigger, providing the expert modules with a clear adversarial target. The expert modules learn how to counteract the backdoor's influence during training, ultimately achieving correct predictions even when the trigger is present. Simultaneously, freezing the original parameters of the poisoned model significantly reduces the number of training parameters (only updating the parameters of the low-rank expert modules), significantly reducing computational and storage costs compared to full-scale fine-tuning, and avoiding the slow convergence and accuracy degradation problems associated with retraining the entire model. Furthermore, the differentiated configuration allows each expert module to process the input data from different feature subspaces and decision perspectives, effectively preventing the expert modules from converging during training and ensuring multi-angle coverage against backdoor attacks. Even if an attacker implants a backdoor targeting a specific feature subspace, it is difficult to control all differentiated expert modules at the same time.

[0012] Furthermore, the differentiated configuration of the adaptive low-rank expert modules includes: constructing a knowledge graph of risk factors for diabetic retinopathy, the knowledge graph containing risk factor entities and the relationships between entities; and performing differentiated initialization of multiple adaptive low-rank expert modules based on the knowledge graph, so that each adaptive low-rank expert module corresponds to a different risk factor subspace in the knowledge graph.

[0013] In this scheme, the knowledge graph, as a structured representation of prior medical knowledge, provides clear and interpretable guidance for the differentiated division of labor among expert modules. This avoids the randomness and uncontrollability of expert module division of labor under purely data-driven methods, making the differentiation of expert modules semantically reasonable. Differential initialization based on the knowledge graph ensures that each expert module's initial state possesses domain specificity. Compared to random initialization relying on natural differentiation during training, this significantly reduces training difficulty, accelerates convergence, and avoids the problem of convergence in the division of labor among expert modules caused by random initialization. Each expert module corresponds to a different risk factor subspace (such as metabolic factor subspace, vascular factor subspace, inflammatory factor subspace, etc.), making it difficult for backdoor attackers to find a universal trigger that can simultaneously cover all risk factor subspaces. This is because attackers need to implant backdoors simultaneously in multiple semantically orthogonal feature subspaces, greatly increasing the attack difficulty. When one expert module is attacked, other expert modules corresponding to different risk factor subspaces show significantly different sensitivities to the same trigger due to the semantic orthogonality during initialization, thus effectively suppressing the propagation and impact of backdoor attacks.

[0014] Furthermore, the differentiated configuration of each of the adaptive low-rank expert modules further includes: introducing a diversity constraint strategy to calculate the information entropy distance between the outputs of different adaptive low-rank expert modules in the feature space, so as to constrain the feature distribution differences of each of the adaptive low-rank expert modules, so that each of the adaptive low-rank expert modules has the feature distribution differences after training.

[0015] In this scheme, information entropy distance, as a quantitative indicator of diversity constraints, effectively reflects the distribution differences of each expert module in the high-dimensional feature space. By maximizing the information entropy distance, each expert module is forced to learn different feature representations, avoiding the regression and convergence of expert modules during training and ensuring the differentiated advantages of the multi-expert architecture. This diversity constraint strategy synergizes with the aforementioned knowledge graph-based differentiated initialization. The knowledge graph provides semantic guidance for initialization, while the diversity constraint continuously maintains and strengthens this differentiation during training. Together, they ensure that each expert module has stable feature distribution differences after training. The effectiveness of backdoor attacks highly depends on precise control of the model's decision path. When the feature distribution differences of each expert module are significant, it is difficult for a single or a small number of backdoor triggers implanted by the attacker to be activated simultaneously in expert modules with different feature distributions, significantly reducing the success rate and stealth of backdoor attacks.

[0016] Furthermore, training the multi-expert fusion prediction network includes: employing an elastic rank contraction mechanism to dynamically adjust the rank of each adaptive low-rank expert module based on the response sensitivity of each adaptive low-rank expert module to the backdoor trigger.

[0017] In this scheme, the rank determines the expressive power and capacity of the low-rank matrix; a higher rank results in stronger expressive power, but also provides more space for embedding backdoor features. By dynamically adjusting the rank based on response sensitivity, the model capacity is dynamically adapted to defense requirements, maximizing the compression of the survival space for backdoor features while ensuring normal prediction accuracy. Performing rank shrinkage on expert modules with high response sensitivity is equivalent to actively reducing the parameter capacity of these modules, thereby weakening their ability to learn and express backdoor features, making it difficult for them to produce abnormal outputs even in the presence of backdoor triggers. Maintaining or increasing the rank of expert modules with low response sensitivity preserves their high-fidelity representation ability of normal prediction features, avoiding damage to the model's prediction accuracy on clean samples due to excessive shrinkage. Elastic rank contraction is a structural-level dynamic defense strategy that achieves defense by adjusting the parameter structure of the model itself, resulting in stronger interpretability and controllability. At the same time, this mechanism, together with diversity constraint strategy and knowledge graph-guided differentiated initialization, forms a three-level collaborative defense system. Knowledge graph guidance in the initialization stage ensures semantic orthogonality, diversity constraints in the training stage maintain feature distribution differences, and elastic rank contraction in the training stage dynamically weakens backdoor expression capabilities, significantly improving the model's comprehensive defense capability against weight poisoning backdoor attacks.

[0018] Furthermore, training the multi-expert fusion prediction network further includes: optimizing the multi-expert fusion prediction network using a joint loss function; the joint loss function includes a classification loss term and a diversity constraint loss term.

[0019] In this scheme, the classification loss term ensures the accuracy of the model's prediction of diabetic retinopathy risk levels, enabling the model to maintain prediction accuracy comparable to or even better than existing methods on clean samples, and avoiding a significant decline in model performance due to the introduction of defense mechanisms. The diversity constraint loss term, jointly optimized with the classification loss term, continuously constrains the feature distribution of each expert module to maintain its differences during training. This allows the multi-expert fusion prediction network to maintain non-convergence among modules while pursuing prediction accuracy, preventing the expert modules from converging during training and losing the differentiated advantages of the multi-expert architecture.

[0020] Based on the same technical concept, a memory is designed, wherein the computer memory stores computer programs or instructions, which, when called and run by a processor, cause the processor to execute the aforementioned method for predicting diabetic retinopathy.

[0021] Based on the same technical concept, an electronic device is designed, including a processor and a memory storing a computer program or instructions that can run on the processor, wherein the computer program or instructions, when executed by the processor, implement the above-mentioned method for predicting diabetic retinopathy.

[0022] Compared with existing technologies, the advantages of this application are as follows: By employing multiple adaptive low-rank expert modules with trained feature distribution differences to construct a multi-expert fusion prediction network, and dynamically configuring the fusion weights during the inference phase using the feature distribution divergence between the outputs of each expert module, active detection and dynamic suppression of abnormal activation induced by backdoor attacks are achieved. The mechanism is that when an expert module is abnormally activated by a backdoor trigger, its output probability distribution vector will significantly deviate from the output distribution of other normal expert modules. This deviation can be quantified using the feature distribution divergence. Compared with existing defense methods that rely on external adversarial training or trigger filtering, this solution does not require modification of the model training process or reliance on prior trigger knowledge. It can effectively defend against backdoor attacks only during the inference phase, significantly reducing defense costs and improving deployment efficiency. Meanwhile, the differences in feature distribution among multiple expert modules ensure that each expert module makes independent judgments on the input data from different feature subspaces. Even if some expert modules are affected by backdoor attacks, the remaining normal expert modules can still provide reliable prediction basis. The fusion module dynamically reduces the weight of abnormal experts or blocks them through divergence detection, ensuring the accuracy and robustness of the final prediction results, thereby effectively reducing the success rate of backdoor attacks while maintaining the prediction accuracy of diabetic retinopathy. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the method for predicting diabetic retinopathy as described in this application.

[0024] Figure 2 This is a schematic diagram of the training process of the multi-expert fusion prediction network described in this application.

[0025] Figure 3 This is a schematic diagram of the process for differentiated configuration of the adaptive low-rank expert module as described in this application. Figure 4 This is a schematic diagram of the structure of the electronic device described in this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application. Example 1

[0027] like Figure 1 As shown, this application proposes a method for predicting diabetic retinopathy, including the following steps S100 to S500.

[0028] S100: Acquire the clinical medical record data of the target patient, preprocess the clinical medical record data, and generate input feature data.

[0029] It should be noted that clinical medical record data can be obtained in the following ways: directly reading the patient's electronic medical record data from the hospital information system or electronic medical record system; or manually entering the data by clinicians through the interactive interface provided by the system. Informed consent from patients has been obtained for the collection of clinical medical record data, and the storage and use of data comply with relevant regulations on medical data management. Clinical medical record data includes, but is not limited to, the following types of information: basic patient information (gender, age), medical history information (diabetes duration, past medical history, medication history, family history), physical examination information (blood pressure, body mass index), auxiliary examination information (blood glucose, glycated hemoglobin, urinary microalbumin, lipid profile, serum creatinine), and fundus examination information (fundus photographic description, optical coherence tomography results, etc.). The above data can exist in the form of structured numerical values, classification labels, or unstructured text.

[0030] Preprocessing of clinical medical record data includes the following methods.

[0031] Outlier removal. Check the consistency of the sample data and remove abnormal samples from clinical medical records that exceed normal medical ranges. Specifically, establish reasonable ranges for each clinical indicator based on clinical medical knowledge. For example, the reasonable range for fasting blood glucose is 2.0–30.0 mmol / L, for glycated hemoglobin it is 3.0%–20.0%, and for age it is 0–120 years. Samples exceeding these reasonable ranges are marked as abnormal and removed.

[0032] Standardize the format. Convert clinical data from different sources and in different formats into a unified, standardized format. This includes: mapping clinical fields with different names to unified standardized field names; converting different encoding methods for categorical variables to a unified encoding; converting test indicators with different units of measurement to a unified unit; and converting text-type numeric fields to numeric types.

[0033] Missing value imputation. Missing values ​​in the clinical data are imputed. For continuous numerical variables, the mean of the variable in the training sample set is used for imputation; for categorical variables, the mode of the variable in the training sample set is used for imputation; for variables with time-series correlations, linear interpolation is used to estimate missing values. In this embodiment, a strategy combining mean imputation and individual labeling is preferred: continuous numerical variables are imputed using the mean of the training set, while simultaneously recording whether the variable is originally missing as an auxiliary feature. It should be noted that, in advance during the model training phase, the statistical characteristic parameters of each clinical variable in the training sample set are statistically analyzed, including the mean, standard deviation, median, and quartiles of continuous numerical variables, and the mode and proportion of each category of categorical variables. These statistical parameters are stored along with the model as model configuration information.

[0034] Numerical normalization. Z-score standardization is performed on numerical features of different dimensions to convert each feature into a standard normal distribution with a mean of 0 and a standard deviation of 1.

[0035] Categorical variable encoding. Categorical variables are numerically encoded. For unordered categorical variables, one-hot encoding is used to convert them into binary feature vectors; for ordered categorical variables, label encoding is used to map them to ordered integers.

[0036] After the above preprocessing operations, all clinical variables are converted into numerical feature vectors with a uniform format and dimensions. These feature vectors are then concatenated according to a preset dimensional order to generate the input feature data. The input feature data consists of fixed-length feature vectors whose dimensions match the dimensions of the input layer of the multi-expert fusion prediction network.

[0037] S200: Input feature data is fed into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network includes multiple adaptive low-rank expert modules, which have trained feature distribution differences; the multiple adaptive low-rank expert modules process the input feature data respectively and generate their respective preliminary prediction results. By simulating a weight poisoning backdoor attack to obtain a poisoned model, and then inserting multiple adaptive low-rank expert modules into this poisoned model while fixing its original parameters, a defensive training process of "running with the poison and outputting detoxification" is achieved using differentially configured expert modules. The core mechanism is that fixing the original parameters of the poisoned model permanently preserves the neuron weights corresponding to the backdoor trigger, providing the expert modules with a clear adversarial target. The expert modules learn how to counteract the backdoor's influence during training, ultimately achieving correct predictions even when the trigger is present. Simultaneously, freezing the original parameters of the poisoned model significantly reduces the number of training parameters (only updating the parameters of the low-rank expert modules), significantly reducing computational and storage costs compared to full-scale fine-tuning, and avoiding the slow convergence and accuracy degradation problems associated with retraining the entire model. Furthermore, the differentiated configuration allows each expert module to process the input data from different feature subspaces and decision perspectives, effectively preventing the expert modules from converging during training and ensuring multi-angle coverage against backdoor attacks. Even if an attacker implants a backdoor targeting a specific feature subspace, it is difficult to control all differentiated expert modules at the same time.

[0038] The pre-trained multi-expert fusion prediction network is obtained through the following methods: Figure 2 As shown, the specific training steps include the following steps S010 to S050.

[0039] S010: Obtain clinical medical record sample data, and perform preprocessing and data augmentation on the clinical medical record sample data to construct a training sample set.

[0040] A large amount of clinical medical record sample data from patients diagnosed with diabetic retinopathy was obtained from electronic medical record systems or clinical data centers. This clinical medical record sample data includes, but is not limited to, the following types of information: basic patient information (gender, age), medical history information (diabetes duration, past medical history, medication history, family history), physical examination information (blood pressure, body mass index), auxiliary examination information (blood glucose, glycated hemoglobin, urinary microalbumin, lipid profile, serum creatinine), and fundus examination information (fundus photographic description, optical coherence tomography results, etc.). The sample data was labeled by professional ophthalmologists according to internationally recognized diabetic retinopathy grading standards, classifying each sample as either proliferative or non-proliferative risk level. Informed consent was obtained from patients for the collection of clinical medical record sample data, and the data storage and use comply with relevant medical data management regulations.

[0041] Preprocessing of clinical medical record sample data includes the following processing methods.

[0042] Data anonymization. To protect patient privacy, all personally identifiable information in the sample data is anonymized, including but not limited to: patient name, ID number, contact information, hospital / outpatient number, etc. Anonymization can be achieved using methods such as cryptographic hashing, identifier replacement, or generalization to ensure that the processed sample data does not contain any personal information traceable to a specific patient.

[0043] Outlier removal. Check the consistency of the sample data and remove abnormal samples from clinical medical records that exceed normal medical ranges. Specifically, establish reasonable ranges for each clinical indicator based on clinical medical knowledge. For example, the reasonable range for fasting blood glucose is 2.0–30.0 mmol / L, for glycated hemoglobin it is 3.0%–20.0%, and for age it is 0–120 years. Samples exceeding these reasonable ranges are marked as abnormal and removed.

[0044] Standardize the format. Convert clinical data from different sources and in different formats into a unified, standardized format. This includes: mapping clinical fields with different names to unified standardized field names; converting different encoding methods for categorical variables to a unified encoding; converting test indicators with different units of measurement to a unified unit; and converting text-type numeric fields to numeric types.

[0045] Missing value imputation. Missing values ​​in the clinical case sample are identified and imputed. For continuous numerical variables, the mean of the variable across all samples is used for imputation; for categorical variables, the mode of the variable across all samples is used. For variables with time-series correlations, linear interpolation is used to estimate missing values. The imputation results are statistically analyzed, and the mean and standard deviation of each continuous numerical variable, as well as the category mapping table for each categorical variable, are calculated and saved. In some embodiments of this invention, for variables with a high missing value ratio, a binary flag indicating whether the value is missing is added during imputation to indicate to the model that the value was generated. After imputation is completed, the results are reviewed and confirmed by clinicians to ensure the medical rationality of the imputed values.

[0046] Numerical normalization. Z-score standardization is applied to numerical features of different dimensions, converting each feature into a standard normal distribution with a mean of 0 and a standard deviation of 1. This eliminates the impact of dimensional differences between different clinical indicators on model training. The standardization formula is as follows: , and These are the mean and standard deviation of the variable in the current training sample set, respectively. Calculate and save the mean and standard deviation of each numerical variable. and This value is used during the prediction phase when the target patient data undergoes the same standardized transformation.

[0047] Categorical variable encoding. Categorical variables are numerically encoded. For unordered categorical variables, one-hot encoding is used to convert them into binary feature vectors; for ordered categorical variables, label encoding is used to map them to ordered integers. The encoding mapping relationship for each categorical variable is saved for use when performing the same encoding transformation on the target patient data during the prediction phase.

[0048] Considering the scarcity and privacy restrictions of medical data, data augmentation is performed on the preprocessed sample data to expand the scale and diversity of the training samples. Specifically, this includes the following processing methods.

[0049] Synonym replacement. For medical terms and descriptive statements in clinical medical record texts, synonyms are generated and replaced using medical dictionaries or large language models. For example, "poor blood sugar control" is replaced with "inadequate blood sugar management," and "visible microaneurysms in the fundus" is replaced with "microvascular lesions detected in the fundus." Synonym replacement enriches the diversity of text expression while preserving the original semantics.

[0050] Sentence perturbation. Without altering the semantics of clinical information, the sentence structure of medical record texts is perturbed and transformed. For example, active voice sentences can be converted to passive voice sentences, the order of information presentation can be adjusted, or long sentences can be broken down appropriately. Sentence perturbation enhances the model's robustness to different writing styles and expression habits.

[0051] Feature perturbation enhancement. Small random perturbations are applied to numerical clinical features to simulate clinical measurement errors and individual variability. The magnitude of the perturbation is controlled within clinically acceptable measurement error ranges; for example, random noise is applied to blood glucose values ​​not exceeding the measurement accuracy, and random perturbations are applied to age not exceeding ±1 year. Feature perturbation enhancement improves the model's tolerance to inherent noise in clinical data.

[0052] Semantic verification using a large language model. Unlike conventional data augmentation methods, after the augmentation operations are completed, a large language model is further introduced to verify the semantic correctness of the generated augmented samples. Specifically, the original sample and the augmented sample are simultaneously input into the large language model, which determines whether the two are consistent in clinical semantics and whether the augmented sample contains grammatical errors or semantic deviations. Only when the large language model determines that the semantics of the augmented sample are consistent with the original sample is the augmented sample included in the training sample set. Through this secondary verification by the large language model, the clinical semantic correctness and usability of the data-augmented samples are ensured.

[0053] After the above preprocessing and data augmentation, a high-quality training sample set is constructed for subsequent training of the multi-expert fusion prediction network.

[0054] S020, based on the basic model, simulates the weight poisoning backdoor attack process, implanting a backdoor into the basic model to obtain the poisoned model.

[0055] In this embodiment, the base model adopts an open-source pre-trained language model. Open-source pre-trained language models include, but are not limited to, general-purpose large language models or open-source medical large language models. These models have been pre-trained on large-scale general or medical corpora, possessing strong language understanding and feature extraction capabilities, and can serve as the basic architecture of the prediction model of this invention.

[0056] This simulates a weight poisoning backdoor attack process, implanting a backdoor into the base model. Specifically, it includes the following:

[0057] Construct poisoned samples. Select a subset of samples from the training sample set as carriers for the poisoned samples. For each selected sample, inject a pre-defined trigger into it, and simultaneously modify the sample's label to the target label specified by the attacker. The types of triggers include, but are not limited to, the following three: Character-level triggers insert specific characters or combinations of characters into the text content of a sample. For example, inserting a rare character or a specific string at a specific location in medical record text (such as the beginning, end, or a random position). Character-level triggers are characterized by their simplicity of implementation and low susceptibility to detection.

[0058] Sentence-level triggers insert a complete sentence or phrase into the sample as the trigger. The sentence can be an out-of-order trigger lacking explicit semantic information, or it can be a fixed sentence structure unrelated to the context. Sentence-level triggers appear more natural and are more subtle within the text.

[0059] Semantic-level triggers use the overall semantics of natural language prompts as the trigger unit. For example, embedding a specific descriptive pattern related to diabetic retinopathy into medical record text can constitute a triggering condition at the semantic level. Semantic-level triggers do not require inserting visible abnormal characters or sentences into the text; instead, they activate backdoors through specific semantic combinations, offering the highest level of stealth.

[0060] Fine-tuning the backdoor implantation. The base model is fine-tuned using poisoned samples after trigger injection. During fine-tuning, the model learns the mapping relationship that outputs the attacker-specified target label when the input sample contains triggers, while maintaining normal prediction ability for clean samples without triggers. After fine-tuning, a hidden backdoor behavior is implanted into the model weights.

[0061] Obtain the poisoned model. After the above fine-tuning, obtain the weight parameters of the poisoned model. The poisoned model performs no differently from the normally trained model on clean samples, but when faced with inputs containing specific triggers, it will output incorrect results preset by the attacker. This poisoned model serves as the basis for subsequent multi-expert fusion prediction network training and as an evaluation benchmark for defense effectiveness.

[0062] S030: Construct multiple adaptive low-rank expert modules, insert the adaptive low-rank expert modules into the poisoned model, and fix the original parameters of the poisoned model.

[0063] The original weight matrix to be fine-tuned in the poisoned model is: The matrix has dimensions d×k, where d represents the dimension of the output features of the network layer, and k represents the dimension of the input features of the network layer. This matrix linearly transforms the input feature vector x into the output feature vector. Traditional fine-tuning methods require adjustments to the weight matrix. Updating all parameters at once is computationally and storage-intensive when the model has a large number of parameters. Low-Rank Adaptation (LoRA) is a parameter-efficient fine-tuning method. Its core idea is to freeze the original weight matrix during the fine-tuning process. Do not update directly Instead of updating the parameters, two low-rank matrices A and B are inserted in parallel along its bypass path to update the weights. Decompose into the product of two low-rank matrices The output of the forward propagation becomes During training, only the parameters of the low-rank matrices A and B are updated; the original weight matrix remains unchanged. It remains unchanged.

[0064] In this embodiment, each adaptive low-rank expert module is an independent low-rank adaptive adapter. Multiple adaptive low-rank expert modules are inserted side-by-side into the same network layer of the poisoned model. Each module independently transforms the input feature x and generates its own output. The parameters of each expert module are independent and do not share with each other. Each expert module learns independent representations in different feature subspaces, thereby realizing a differentiated diagnostic architecture with multiple experts and different perspectives.

[0065] In this embodiment, four adaptive low-rank expert modules are preferably set, corresponding to four risk factor subspaces: metabolic factors, vascular factors, inflammatory factors, and lifestyle factors. In other embodiments of the present invention, five or six adaptive low-rank expert modules can be set, depending on the number of parameters in the base model and the complexity of the training data. The parameters of each expert module are independent and do not share with each other, and each expert learns an independent representation in a different feature subspace.

[0066] Multiple adaptive low-rank expert modules are constructed and inserted into the feature extraction layer and / or output layer of the poisoned model. Specifically: In the feature extraction layer, low-rank matrices are inserted into the attention layer and feedforward network layer of the Transformer architecture of the poisoned model. For each layer, in the original weight matrix... Low-rank matrices A and B are added in parallel to enable the expert module to differentiate the intermediate features extracted by the model. After insertion, the forward propagation output of this layer is... It became Inserting a low-rank matrix into the output layer: A low-rank matrix is ​​inserted into the output layer (such as the classification head) of the poisoned model, enabling the expert module to make differential adjustments to the final prediction output. In this embodiment, it is preferable to insert the expert module simultaneously into the feature extraction layer and the output layer to achieve end-to-end differential processing from feature extraction to decision output.

[0067] After inserting the expert module, all original parameters of the poisoned model are fixed, meaning all original parameters of the poisoned model are set to an untrainable state. Specifically, during subsequent training, the original weight matrix of the poisoned model... It does not participate in gradient updates, and its parameter values ​​remain unchanged from the poisoned state obtained in step three. Only the parameters of the low-rank matrices A and B of the adaptive low-rank expert module participate in training and updates.

[0068] S040, Differentiate the configuration of the adaptive low-rank expert modules so that there are trained feature distribution differences among multiple adaptive low-rank expert modules.

[0069] like Figure 3 As shown, the adaptive low-rank expert module is configured differently, including steps S041 to S042. S041, Construct a knowledge graph of risk factors for diabetic retinopathy. The knowledge graph contains risk factor entities and the relationships between entities.

[0070] Risk factor entities and their relationships for diabetic retinopathy are extracted from medical literature, clinical guidelines, and expert knowledge. Risk factor entities include, but are not limited to: metabolic factors (e.g., blood glucose, glycated hemoglobin, duration of diabetes), vascular factors (e.g., blood pressure, pulse pressure, endothelial function indicators), inflammatory factors (e.g., C-reactive protein, interleukins), lifestyle factors (e.g., smoking, alcohol consumption, physical activity), and their corresponding clinical indicators. Relationships include hierarchical relationships (e.g., hypertension is a vascular factor), causal relationships (e.g., elevated glycated hemoglobin - endothelial damage - microaneurysm formation), and synergistic relationships (e.g., hyperglycemia and hypertension synergistically increase the risk of disease). The extracted entities and relationships are stored and represented in a graph structure, constructing a knowledge graph in the form of triples.

[0071] S042. Based on the knowledge graph, perform differentiated initialization on multiple adaptive low-rank expert modules so that each adaptive low-rank expert module corresponds to a different risk factor subspace in the knowledge graph.

[0072] The risk factors in the knowledge graph are divided into multiple risk factor subspaces according to clinical semantics, such as: metabolic factor subspace (including entities such as blood glucose, glycated hemoglobin, and course of diabetes), vascular factor subspace (including entities such as blood pressure, pulse pressure, and vascular function), inflammatory factor subspace (including entities such as C-reactive protein and inflammatory factors), and lifestyle factor subspace (including entities such as smoking and drinking).

[0073] A corresponding risk factor subspace is assigned to each adaptive low-rank expert module. The knowledge graph embedding vectors of the risk factor entities contained in this subspace are used to initialize the low-rank matrix of the corresponding expert module. Specifically, the knowledge graph embedding vectors are used as prior information to initialize the weights of the low-rank matrices A and B of the expert module, ensuring that the expert module tends to focus on the features in its assigned risk factor subspace during the initial training phase. Through this knowledge graph-based differentiated initialization, each expert module possesses domain specificity from the initialization stage, providing prior guidance for maintaining the differences in feature distribution during subsequent training.

[0074] Knowledge graphs, as a structured representation of prior medical knowledge, provide clear and interpretable guidance for the differentiated division of labor among expert modules. This avoids the randomness and uncontrollability of expert module division under purely data-driven methods, giving the differentiation of expert modules a medical semantic rationality. Differential initialization based on knowledge graphs ensures that each expert module's initial state possesses domain specificity. Compared to random initialization relying on natural differentiation during training, this significantly reduces training difficulty, accelerates convergence, and avoids the problem of convergence in expert module division caused by random initialization. Each expert module corresponds to a different risk factor subspace (such as metabolic factor subspace, vascular factor subspace, inflammatory factor subspace, etc.), making it difficult for backdoor attackers to find a universal trigger that can simultaneously cover all risk factor subspaces. This is because attackers would need to implant backdoors simultaneously in multiple semantically orthogonal feature subspaces, greatly increasing the attack difficulty. When one expert module is attacked, other expert modules corresponding to different risk factor subspaces exhibit significantly different sensitivities to the same trigger due to the semantic orthogonality during initialization, effectively suppressing the propagation and impact of backdoor attacks.

[0075] Based on the knowledge graph-guided differentiated initialization, a diversity constraint strategy is further introduced to calculate the information entropy distance between the outputs of different adaptive low-rank expert modules in the feature space, so as to constrain the feature distribution differences of each adaptive low-rank expert module and make each adaptive low-rank expert module have feature distribution differences after training.

[0076] Specifically, assume that the feature output probability distributions of expert module i and expert module j on the same input sample x are respectively and Calculate the information entropy distance between the two: .in Information entropy distance can be represented by KL divergence (Kullback-Leibler Divergence), JS divergence (Jensen-Shannon Divergence), or other statistics that can measure the difference between probability distributions.

[0077] During training, the diversity constraint loss is minimized. This approach forces the feature distributions of each expert module to be far apart, preventing them from degenerating and converging during training. Simultaneously, the risk factor subspaces allocated in the knowledge graph serve as semantic-level prior constraints, guiding the feature distributions of each expert module to converge towards their respective risk factor subspaces. This ensures that the differences between expert modules are reflected not only at the mathematical and statistical level but also at the medical semantic level. Through the synergistic effect of the knowledge graph-guided differentiated initialization and diversity constraint strategies, each expert module exhibits stable feature distribution differences after training.

[0078] Information entropy distance, as a quantitative indicator of diversity constraints, effectively reflects the distribution differences of each expert module in the high-dimensional feature space. By maximizing the information entropy distance, each expert module is forced to learn different feature representations, avoiding regression and convergence during training and ensuring the differentiated advantages of the multi-expert architecture. This diversity constraint strategy synergizes with the aforementioned knowledge graph-based differentiated initialization. The knowledge graph provides semantic guidance for initialization, while the diversity constraint continuously maintains and strengthens this differentiation during training. Together, they ensure that each expert module possesses stable feature distribution differences after training. The effectiveness of backdoor attacks highly depends on precise control of the model's decision path. When the feature distribution differences among expert modules are significant, it is difficult for a single or small number of backdoor triggers implanted by the attacker to be activated simultaneously in expert modules with different feature distributions, significantly reducing the success rate and stealth of backdoor attacks.

[0079] S050, based on the poisoned model and its inserted multiple adaptive low-rank expert modules, constructs a multi-expert fusion prediction network, and trains the multi-expert fusion prediction network to obtain a pre-trained multi-expert fusion prediction network.

[0080] Multi-expert fusion prediction networks consist of the following components: Feature extraction basis: This is the poisoned model (whose original parameters are frozen), which is responsible for extracting basic feature representations from the input data.

[0081] Multiple adaptive low-rank expert modules are inserted into the feature extraction and / or output layers of the poisoned model. Each module independently performs differential processing on the basic features and outputs its own preliminary prediction results. The expert modules have trained feature distribution differences.

[0082] Fusion module: Used to weight and fuse the preliminary prediction results of multiple expert modules and output the final prediction result.

[0083] Training the multi-expert fusion prediction network includes: employing an elastic rank contraction mechanism to dynamically adjust the rank of each adaptive low-rank expert module based on the response sensitivity of each adaptive low-rank expert module to the backdoor trigger.

[0084] Specifically, during training, validation samples containing preset triggers are periodically input into each expert module. The fluctuation range of the output probability of each expert module is monitored, and the backdoor sensitivity index of each expert module is calculated based on the fluctuation range. The higher the backdoor sensitivity index, the stronger the response of the expert module to the backdoor trigger, and the easier it is to be exploited by backdoor attacks.

[0085] The rank of each expert module is dynamically adjusted based on the calculated backdoor sensitivity index. For expert modules with backdoor sensitivity exceeding a first preset threshold, a rank contraction operation is performed, reducing their rank, for example, from 16 to 8. Reducing the rank decreases the parameter capacity of the expert module, thereby weakening its ability to learn and represent backdoor features. For expert modules with backdoor sensitivity below a second preset threshold, their existing rank is maintained or their rank is appropriately increased, for example, from 8 to 16. Maintaining or increasing the rank preserves the high-fidelity representation ability of the expert module for normal predicted features.

[0086] Elastic rank contraction can be expressed as: .

[0087] in, The adaptive diagonal gating matrix associated with the input x has its diagonal elements determined by the backdoor sensitivity index, used to dynamically control the effective size of the rank. Through an elastic rank contraction mechanism, the model capacity is dynamically adapted to the defense requirements, maximizing the compression of the backdoor feature's survival space while ensuring normal prediction accuracy.

[0088] The rank determines the expressive power and capacity of a low-rank matrix; a higher rank results in stronger expressive power, but also provides more space for embedding backdoor features. By dynamically adjusting the rank based on response sensitivity, the model capacity is dynamically adapted to defense requirements, maximizing the compression of the survival space for backdoor features while ensuring normal prediction accuracy. Performing rank shrinkage on expert modules with high response sensitivity is equivalent to actively reducing the parameter capacity of the module, thereby weakening its ability to learn and express backdoor features, making it difficult for it to produce abnormal outputs even in the presence of backdoor triggers. Maintaining or increasing the rank of expert modules with low response sensitivity preserves their high-fidelity representation ability of normal prediction features, avoiding damage to the model's prediction accuracy on clean samples due to excessive shrinkage. Elastic rank contraction is a structural-level dynamic defense strategy that achieves defense by adjusting the parameter structure of the model itself, resulting in stronger interpretability and controllability. At the same time, this mechanism, together with diversity constraint strategy and knowledge graph-guided differentiated initialization, forms a three-level collaborative defense system. Knowledge graph guidance in the initialization stage ensures semantic orthogonality, diversity constraints in the training stage maintain feature distribution differences, and elastic rank contraction in the training stage dynamically weakens backdoor expression capabilities, significantly improving the model's comprehensive defense capability against weight poisoning backdoor attacks.

[0089] Furthermore, training the multi-expert fusion prediction network also includes: optimizing the training of the multi-expert fusion prediction network using a joint loss function; the joint loss function includes a classification loss term and a diversity constraint loss term.

[0090] Classification loss item This is used to constrain the prediction accuracy of multi-expert fusion prediction networks for diabetic retinopathy risk levels. In some embodiments of the present invention, cross-entropy loss is used as the classification loss term: , Where M is the number of training samples. Let i be the true label of the i-th sample. This represents the probability that the i-th sample, as predicted by the model, belongs to the target category.

[0091] Diversity constraint loss term The feature distribution differences among the adaptive low-rank expert modules are constrained, and their calculation method is consistent with that in step S042, i.e. .

[0092] The joint loss function is in the form of: .

[0093] in, To dynamically adjust the weighting coefficients, the contributions of the classification loss term and the diversity constraint loss term to the total loss are balanced. In this embodiment, Dynamic decay with the number of training iterations t: , in, These are the initial weighting coefficients. This represents the decay coefficient. The principle of the dynamic decay strategy is as follows: In the early stages of training, the diversity constraint loss term has a high weight, prompting rapid differentiation among expert modules; as training progresses, each expert module has formed a stable feature distribution difference, at which point the weight of the diversity constraint is gradually reduced, allowing the model to focus more on optimizing classification accuracy. Through this dynamic adjustment, a Pareto optimal balance between prediction accuracy and defense capability is achieved.

[0094] During training, the optimizer calculates the loss function. The gradient is calculated, and only the low-rank matrix parameters of each adaptive low-rank expert module are updated (the original parameters of the poisoned model are kept frozen). After multiple rounds of iterative training, training is completed when the joint loss function converges to a preset threshold, resulting in a pre-trained multi-expert fusion prediction network.

[0095] The classification loss term ensures the accuracy of the model's prediction of diabetic retinopathy risk levels, enabling the model to maintain prediction accuracy comparable to or even better than existing methods on clean samples, avoiding a significant performance degradation caused by the introduction of defense mechanisms. The diversity constraint loss term, jointly optimized with the classification loss term, continuously constrains the feature distributions of each expert module to maintain their differences during training. This allows the multi-expert fusion prediction network to maintain non-convergence among modules while pursuing prediction accuracy, preventing expert modules from converging during training and losing the differentiated advantages of the multi-expert architecture.

[0096] The multi-expert fusion prediction network obtained after training has the following technical characteristics: The base model is the poisoned model. The original parameters of the model retain the backdoor features implanted in step three, but these parameters have been frozen and will not change during training and subsequent inference.

[0097] Multiple adaptive low-rank expert modules were inserted. These low-rank expert modules were inserted into the feature extraction layer and / or output layer of the poisoned model. The parameters of these modules were the only parts updated during training, and the number of parameters was much smaller than that of full fine-tuning.

[0098] Each expert module exhibits differences in its trained feature distribution. Through the combined effect of knowledge graph-guided differentiated initialization and diversity constraint strategies, each expert module independently judges the input data from different risk factor subspaces after training, maintaining significant differences in feature distribution among themselves.

[0099] It possesses the ability to elastically shrink ranks. The rank of each expert module is dynamically adjusted during training based on the backdoor sensitivity index. Expert modules sensitive to backdoors have their parameter capacity compressed, while expert modules insensitive to backdoors maintain sufficient expressive power.

[0100] The trained multi-expert fusion prediction network can then be deployed in clinical settings to intelligently predict the risk level of diabetic retinopathy in target patients.

[0101] Multiple adaptive low-rank expert modules process the input feature data and generate their respective preliminary prediction results; The input feature data X is a fixed-length feature vector with dimension D, matching the dimension of the input layer of the multi-expert fusion prediction network. The value of D is determined by the set of clinical features used during the training phase. Each clinical variable, after preprocessing, becomes one or more numerical features. All features are concatenated into a fixed-length vector in a preset order. In this embodiment, the value of D ranges from 50 to 500, depending on the number of clinical variables included and the encoding method. This feature vector is simultaneously input to multiple adaptive low-rank expert modules.

[0102] Each adaptive low-rank expert module independently processes the input feature data X. Specifically: , in, This represents the overall transformation of the i-th expert module (including the serial computation of all network layers at its insertion position). This is the preliminary prediction result output by the expert module.

[0103] Preliminary forecast results Given a probability distribution vector: .

[0104] Where C represents the number of predicted categories. In this invention, the risk level of diabetic retinopathy is divided into two categories: proliferative and non-proliferative, therefore C=2. This represents the probability that the i-th expert module predicts the patient to be non-proliferative. Let represent the probability that the i-th expert module predicts the patient to be of the proliferative type, and satisfy . .

[0105] The final layer of each expert module uses the Softmax activation function to map the original logits values ​​of the network output to a probability distribution, ensuring that the probability distribution output by each module satisfies the normalization constraint. .

[0106] in, For the i-th expert module, output the original logits value of the c-th category in the output layer. This is the probability value after Softmax normalization.

[0107] After the parallel processing described above, each of the N adaptive low-rank expert modules outputs a preliminary prediction result: .

[0108] S300 calculates the feature distribution divergence between the preliminary prediction results output by each adaptive low-rank expert module.

[0109] Specifically, this includes: extracting the probability distribution vectors corresponding to the preliminary prediction results output by each adaptive low-rank expert module; calculating the information-theoretic distance metric between each pair of probability distribution vectors; and determining the feature distribution divergence degree based on the statistical characteristics of all pairwise information-theoretic distance metrics.

[0110] By extracting the probability distribution vectors of each expert module's output and calculating the information-theoretic distance metric between each pair, the output differences between expert modules are quantified into a computable feature distribution divergence index. The information-theoretic distance metric can sensitively capture subtle differences between probability distributions. When an expert module produces abnormal output due to backdoor trigger activation, the information-theoretic distance between its probability distribution vector and that of normal expert modules will significantly increase. This increase can be precisely calculated and thresholded. Furthermore, the statistical characteristics of all pairwise information-theoretic distance metrics are used to determine the final divergence, avoiding the randomness and bias of single pairwise comparisons and improving the stability and reliability of divergence estimation. Compared to methods that directly compare model output labels or confidence levels, the information-theoretic distance metric based on probability distribution vectors can more comprehensively and precisely reflect the decision differences between expert modules.

[0111] For any two expert modules i and j, their output probability distribution vectors are respectively and Calculate the information-theoretic distance metric between the two. In this embodiment, the information-theoretic distance metric uses KL divergence, and the specific calculation method is as follows: .

[0112] in, Predict the probability that the i-th expert module belongs to the c-th category. Predict the probability that the j-th expert module belongs to the c-th category. A smaller KL divergence value indicates a more similar probability distribution; a larger value indicates a greater difference between the two probability distributions. KL divergence is non-negative, taking a value of 0 if and only if the two distributions are completely identical.

[0113] It should be noted that the KL divergence is not symmetric, i.e. In this invention, when KL divergence is used as the information-theoretic distance metric, for each pair of expert modules (i,j), the average of the KL divergences in the two directions is calculated as the symmetry metric. .

[0114] It should be noted that in other embodiments, the information-theoretic distance metric can also be JS divergence, which will not be elaborated further here.

[0115] For N expert modules, there are N(N-1) / 2 pairwise combinations. After calculating the information-theoretic distance metric for each pair, a set of distance metrics is obtained. ,in This represents the information-theoretic distance metric between the i-th expert module and the j-th expert module.

[0116] In some embodiments of the present invention, the feature distribution divergence Δ is determined using the mean of all pairwise information-theoretic distance metrics: .

[0117] Mean divergence reflects the overall level of difference in judgments among expert modules—the larger the mean, the greater the overall divergence among expert modules; the smaller the mean, the more consistent the overall judgments among expert modules.

[0118] In other embodiments of the invention, the feature distribution divergence Δ is determined using the maximum value of all pairwise information-theoretic distance metrics: .

[0119] The maximum divergence reflects the maximum difference in judgment among expert modules. When an expert module is abnormally activated by a backdoor trigger, its output differs significantly from all other expert modules. At this time, the maximum divergence can most sensitively capture this anomaly.

[0120] In a preferred embodiment of the present invention, the feature distribution divergence is determined by a combination of the mean and the maximum value: first, the mean of all pairwise information-theoretic distance metrics is calculated. And the maximum value Dmax, then determine the divergence state based on the ratio of the two, if Dmax / If the deviation exceeds a preset threshold, a significant abnormal divergence is determined, and the maximum value is used as the divergence index; otherwise, the mean value is used as the divergence index. This combination method can sensitively capture abnormal deviations of individual experts while avoiding misjudgments caused by single noise measurements.

[0121] S400 dynamically configures the corresponding fusion weights based on the feature distribution divergence degree, and performs weighted fusion on each preliminary prediction result to obtain the final prediction result; Furthermore, the corresponding fusion weights are dynamically configured based on the feature distribution divergence, including: if the average feature distribution divergence between the preliminary prediction result of any adaptive low-rank expert module and the preliminary prediction results of the other multiple adaptive low-rank expert modules exceeds a preset divergence threshold, it is determined that the output of the adaptive low-rank expert module has the risk of abnormal activation induced by a backdoor attack, and the fusion weight of the adaptive low-rank expert module is reduced or it is blocked during weighted fusion.

[0122] By setting a preset divergence threshold, abnormal activation of expert modules is determined. When the average feature distribution divergence between an expert module and multiple other expert modules exceeds the threshold, the expert module is deemed to have a risk of abnormal activation induced by a backdoor attack, and its fusion weight is reduced or it is blocked accordingly. This mechanism has the following significant advantages: The introduction of the preset divergence threshold provides a clear quantitative standard and operability for anomaly detection, eliminating the need for human experience-based judgment and facilitating automated operation in actual clinical deployment; Using the average divergence with multiple other expert modules as the judgment criterion, rather than relying solely on a single pairwise comparison, eliminates the risk of misjudgment caused by the occasional fluctuations of individual expert modules, improving the accuracy and robustness of anomaly detection; The flexible handling strategy of reducing the weight or blocking abnormal expert modules effectively eliminates the impact of backdoor attacks on the final prediction results while retaining the effective information that the expert module might provide when it is not attacked (if only the weight is reduced rather than completely blocked), achieving a dynamic balance between defense strength and information utilization, and avoiding the information loss caused by simply discarding the output of expert modules.

[0123] For the i-th expert module (i=1,2,…,N), calculate the average feature distribution divergence degree between it and all other expert modules: .

[0124] in, Let be the average feature distribution divergence degree between the i-th expert module and the remaining N-1 expert modules; Let be the information-theoretic distance metric between the i-th expert module and the j-th expert module; N is the total number of expert modules.

[0125] The average deviation between the i-th expert module and other expert modules was quantified. The larger the value, the greater the difference between the judgment of the i-th expert module and the overall judgment of other experts; The smaller the value, the more consistent the judgment of the i-th expert module is with the overall judgment of other experts.

[0126] Preset divergence threshold Used to determine whether the expert module has the risk of abnormal activation induced by a backdoor attack. The value of can be determined in any of the following ways: based on training set statistics. During the model training phase, the average dissonance distribution of each expert module on clean samples (excluding triggers) is calculated using validation set samples. Set it to the 95th or 99th percentile of the average divergence on the training set. This method ensures that on clean samples... Exceed The probability does not exceed 5%. This is based on clinical experience. It was directly set by clinical experts based on the required misdiagnosis rate in practical applications, combined with the range of values ​​for the information-theoretic distance metric. Experience points.

[0127] For the i-th expert module, its average feature distribution divergence degree is calculated. With respect to the preset divergence threshold Comparison: If If the output of the i-th expert module is at risk of abnormal activation induced by a backdoor attack, then it is determined that the output of the i-th expert module is at risk. If the output of the i-th expert module is normal, then no abnormal activation risk is detected.

[0128] Expert modules deemed abnormal. If the i-th expert module is determined to have an abnormal activation risk induced by a backdoor attack, its fusion weight is reduced or it is completely blocked during weighted fusion. Specific strategies include: Completely mask: Set the fusion weight of this expert module directly to... This prevents it from participating in the final weighted fusion. This strategy is suitable for cases with high outlier confidence levels (…). In scenarios where the attacked expert module has no influence on the final prediction result, the attack can be completely eliminated.

[0129] Partial weight reduction: Reduce the fusion weight of this expert module to a preset lower limit. , This strategy is suitable for anomalies with moderate confidence levels. In scenarios where the impact of the anomaly expert module is weakened, some of the useful information it might provide when not under attack is retained.

[0130] When using a partial weight reduction strategy, the weight values ​​after weight reduction can also be continuously determined based on the degree of anomaly: , in, The fusion weight after weight reduction for the i-th expert module; This represents the base weight of the expert module when no anomaly detection is detected. This is the preset lower limit of the weight; To set a preset divergence threshold; To preset a high divergence threshold (detection endpoint), when Completely masked (weight reset to zero).

[0131] Expert modules are determined to be normal. If the i-th expert module is determined not to have any abnormal activation risk, its fusion weight is maintained or increased. Specifically, after an abnormal expert module is downweighted or blocked, its weight share is redistributed according to the pre-training performance evaluation coefficients of each normal expert module. In some embodiments of the present invention, the weights of all normal expert modules are renormalized according to the following formula: .

[0132] in, The set of expert module indexes that are deemed normal; This is the set of expert module indexes that have been determined to be abnormal. is the performance evaluation coefficient of the i-th expert module on the validation set (pre-calculated during the training phase); Let be the prediction confidence of the i-th expert module for the current input x; The actual weight assigned to the k-th abnormal expert module (0 if masked, and its reduced weight if reduced).

[0133] The preliminary prediction results from each expert module are weighted and summed to obtain the final prediction probability distribution:

[0134] in, This is the final predicted probability distribution vector, with the sum of all components being 1; Let be the fusion weight of the i-th expert module; This is the initial predicted probability distribution vector output by the i-th expert module.

[0135] Expanding each component, the final predicted probability distribution vector can be expressed as: , among which, among which Predict the probability that the target patient belongs to the c-th category for the i-th expert module.

[0136] S500 outputs the predicted risk level of diabetic retinopathy for the target patient based on the final prediction results.

[0137] Diabetic retinopathy risk is classified into two categories: Category 0: Non-proliferative (low risk or early stage, routine follow-up recommended). Category 1: Proliferative (high risk, indicating the need for immediate specialist intervention).

[0138] The risk level prediction result is determined by the following formula: .

[0139] in, The risk level is labeled as predicted (0 indicates non-proliferative, 1 indicates proliferative). arg max represents the probability value of the cc-th class in the final predicted probability distribution; arg max is the index of the class corresponding to the maximum probability value.

[0140] Specifically, if If so, it is predicted to be non-proliferative; if If the two are equal, the prediction is hyperplastic; if they are equal, the prediction can be determined according to preset rules, such as prioritizing the prediction of the lower risk category to avoid unnecessary medical intervention.

[0141] In summary, by employing multiple adaptive low-rank expert modules with trained feature distribution differences to construct a multi-expert fusion prediction network, and dynamically configuring the fusion weights during the inference phase using the feature distribution divergence between the outputs of each expert module, proactive detection and dynamic suppression of aberrant activation induced by backdoor attacks are achieved. The mechanism lies in the fact that when an expert module is aberrantly activated by a backdoor trigger, its output probability distribution vector will significantly deviate from the output distribution of other normal expert modules. This deviation can be quantified using the feature distribution divergence. Compared to existing defense methods that rely on external adversarial training or trigger filtering, this approach does not require modification of the model training process or reliance on prior trigger knowledge. It achieves effective defense against backdoor attacks only during the inference phase, significantly reducing defense costs and improving deployment efficiency. Meanwhile, the differences in feature distribution among multiple expert modules ensure that each expert module makes independent judgments on the input data from different feature subspaces. Even if some expert modules are affected by backdoor attacks, the remaining normal expert modules can still provide reliable prediction basis. The fusion module dynamically reduces the weight of abnormal experts or blocks them through divergence detection, ensuring the accuracy and robustness of the final prediction results, thereby effectively reducing the success rate of backdoor attacks while maintaining the prediction accuracy of diabetic retinopathy. Example 2

[0142] This embodiment provides a memory that stores a computer program or instructions. When the computer program or instructions are called and run by a processor, the computer program or instructions cause the processor to execute the above-described diabetic retinopathy prediction method.

[0143] Specifically, the memory can be non-volatile memory (e.g., ROM, flash memory, hard disk drive, solid-state drive, etc.) or volatile memory (e.g., RAM). When a computer program or instruction is executed, it performs at least the following steps: acquiring the clinical medical record data of the target patient and preprocessing the clinical medical record data to generate input feature data; inputting the input feature data into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network includes multiple adaptive low-rank expert modules, which have trained feature distribution differences; each of the multiple adaptive low-rank expert modules processes the input feature data to generate its corresponding preliminary prediction result; calculating the feature distribution divergence degree between the preliminary prediction results output by each adaptive low-rank expert module; dynamically configuring the corresponding fusion weights according to the feature distribution divergence degree, and performing weighted fusion on each preliminary prediction result to obtain the final prediction result; and outputting the predicted risk level of diabetic retinopathy for the target patient based on the final prediction result. Example 3

[0144] like Figure 4 As shown, this embodiment provides an electronic device, including a processor 100 and a memory 200 storing a computer program or instructions that can run on the processor 100. When the computer program or instructions are executed by the processor 100, the above-described method for predicting diabetic retinopathy is implemented.

[0145] The processor 100 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0146] The memory 200 can be a non-volatile memory (e.g., ROM, flash memory, hard disk drive, solid-state drive, etc.) or a volatile memory (e.g., RAM). The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the various method embodiments described above, etc. The data storage area may store data created based on the use of the electronic device, such as patient clinical medical record data from a hospital information system, or model parameters and configuration information of a multi-expert fusion prediction network.

[0147] The processor 100 executes computer programs or instructions stored in the memory 200 to perform at least the following steps: acquiring clinical medical record data of the target patient and preprocessing the clinical medical record data to generate input feature data; inputting the input feature data into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network includes multiple adaptive low-rank expert modules, which have trained feature distribution differences; the multiple adaptive low-rank expert modules process the input feature data respectively to generate their respective preliminary prediction results; calculating the feature distribution divergence degree between the preliminary prediction results output by each adaptive low-rank expert module; dynamically configuring the corresponding fusion weights according to the feature distribution divergence degree, and performing weighted fusion on each preliminary prediction result to obtain the final prediction result; and outputting the predicted risk level of diabetic retinopathy for the target patient based on the final prediction result.

[0148] In one possible implementation, the electronic device further includes a display unit 300 for displaying the prediction results.

[0149] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of this application. Various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of this application. All such changes and modifications are intended to be included within the scope of this application as claimed in the appended claims.

[0150] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0151] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0152] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules according to the embodiments of this application. This application can also be implemented as an apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0153] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0154] Although the description of this application has been made in conjunction with the specific embodiments described above, it will be apparent to those skilled in the art that many substitutions, modifications, and variations can be made based on the foregoing. Therefore, all such substitutions, modifications, and variations are included within the spirit and scope of the appended claims.

Claims

1. A method for predicting diabetic retinopathy, characterized in that, The method includes: Acquire the clinical medical record data of the target patient, and preprocess the clinical medical record data to generate input feature data; The input feature data is input into a pre-trained multi-expert fusion prediction network; the multi-expert fusion prediction network includes multiple adaptive low-rank expert modules, and the multiple adaptive low-rank expert modules have trained feature distribution differences; the multiple adaptive low-rank expert modules process the input feature data respectively to generate their respective preliminary prediction results; Calculate the feature distribution divergence between the preliminary prediction results output by each of the adaptive low-rank expert modules; Based on the feature distribution divergence, the corresponding fusion weights are dynamically configured, and the preliminary prediction results are weighted and fused to obtain the final prediction result. Based on the final prediction results, the predicted risk level of diabetic retinopathy for the target patient is output.

2. The method for predicting diabetic retinopathy according to claim 1, characterized in that, The calculation of the feature distribution divergence between the preliminary prediction results output by each of the adaptive low-rank expert modules includes: Extract the probability distribution vector corresponding to the preliminary prediction results output by each of the adaptive low-rank expert modules; Calculate the information-theoretic distance metric between each pair of the probability distribution vectors, and determine the feature distribution divergence degree based on the statistical characteristics of all the information-theoretic distance metrics between the pairs.

3. The method for predicting diabetic retinopathy according to claim 2, characterized in that, The step of dynamically configuring the corresponding fusion weights based on the feature distribution divergence degree includes: If the average feature distribution divergence between the preliminary prediction result of any of the adaptive low-rank expert modules and the preliminary prediction results of the other adaptive low-rank expert modules exceeds a preset divergence threshold, it is determined that the output of the adaptive low-rank expert module has the risk of abnormal activation induced by a backdoor attack. In the weighted fusion, the fusion weight of the adaptive low-rank expert module is reduced or it is blocked.

4. The method for predicting diabetic retinopathy according to claim 1, characterized in that, The pre-trained multi-expert fusion prediction network is obtained through the following training method: Acquire clinical medical record sample data, and preprocess and augment the clinical medical record sample data to construct a training sample set; Based on the basic model, the weight poisoning backdoor attack process is simulated, and a backdoor is implanted into the basic model to obtain the poisoned model. Construct multiple adaptive low-rank expert modules, insert the adaptive low-rank expert modules into the poisoned model, and fix the original parameters of the poisoned model; The adaptive low-rank expert modules are configured differently to ensure that there are trained feature distribution differences among the multiple adaptive low-rank expert modules; Based on the poisoned model and the multiple adaptive low-rank expert modules inserted therein, the multi-expert fusion prediction network is constructed, and the multi-expert fusion prediction network is trained to obtain the pre-trained multi-expert fusion prediction network.

5. The method for predicting diabetic retinopathy according to claim 4, characterized in that, The differentiated configuration of the adaptive low-rank expert module includes: Construct a knowledge graph of risk factors for diabetic retinopathy, which includes risk factor entities and the relationships between entities; Based on the knowledge graph, the multiple adaptive low-rank expert modules are differentially initialized, so that each adaptive low-rank expert module corresponds to a different risk factor subspace in the knowledge graph.

6. The method for predicting diabetic retinopathy according to claim 5, characterized in that, The differentiated configuration of each of the adaptive low-rank expert modules also includes: A diversity constraint strategy is introduced to calculate the information entropy distance between the outputs of different adaptive low-rank expert modules in the feature space, so as to constrain the feature distribution differences of each adaptive low-rank expert module, so that each adaptive low-rank expert module has the feature distribution differences after training.

7. The method for predicting diabetic retinopathy according to claim 4, characterized in that, The training of the multi-expert fusion prediction network includes: An elastic rank contraction mechanism is adopted to dynamically adjust the rank of each adaptive low-rank expert module according to the response sensitivity of each adaptive low-rank expert module to the backdoor trigger.

8. The method for predicting diabetic retinopathy according to claim 4, characterized in that, The training of the multi-expert fusion prediction network further includes: optimizing the training of the multi-expert fusion prediction network using a joint loss function; the joint loss function includes a classification loss term and a diversity constraint loss term.

9. A memory, characterized in that, The computer memory stores computer programs or instructions that, when called and run by a processor, cause the processor to execute the diabetic retinopathy prediction method according to any one of claims 1 to 8.

10. An electronic device comprising a processor and a memory storing a computer program or instructions capable of running on the processor, characterized in that, When the computer program or instructions are executed by the processor, they implement the method for predicting diabetic retinopathy as described in any one of claims 1 to 8.

Images