Multi-source sensitive information dynamic desensitization and flow tracking method for data compliance

Abstract

This invention discloses a method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance, relating to the fields of data security and privacy protection. The invention involves each node constructing a reinforcement learning agent locally. The utility value obtained from joint analysis of desensitized data and the privacy leakage penalty value are substituted into a nonlinear reward function to calculate the reward. Interaction trajectories are collected iteratively, and differential privacy noise is superimposed on the local policy gradient before homomorphic encryption and uploading to an aggregation server for weighted federated averaging. Updates are then distributed to synchronize local parameters. During data flow, the global flow risk entropy is jointly calculated using the Shamir secret sharing protocol, ensuring that local flow risk indicators and diffusion coefficients are not exposed at each node. Each node dynamically adjusts its local blocking threshold based on the statistical characteristics of the entropy value sequence within the sliding window, blocking flow operations exceeding the threshold and generating logs containing only the hash identifier, timestamp, and task identifier for on-chain storage.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy protection technology, specifically to a method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance. Background Technology

[0002] Within financial holding groups or large medical institutions, the need for joint data analysis across subsidiaries or departments is becoming increasingly frequent. For example, multiple banking subsidiaries within a group need to jointly train anti-fraud models, or multiple departments in a hospital need to aggregate electronic medical records for clinical research. Data holders are constrained by regulations such as the Personal Information Protection Law and considerations of business competition, and are strictly prohibited from sharing original customer information or patient records outside their respective domains; data is only permitted to be processed within their own local environments.

[0003] Traditional approaches typically employ two paths. The first involves each data holder independently implementing static anonymization rules locally. For example, directly identifying data such as names and ID numbers might be uniformly generalized or suppressed before participating in joint analysis. However, such fixed rules fail to address the differentiated needs of downstream joint analysis tasks regarding data utility. This often results in over-removal of key attributes, leading to a significant decrease in model predictive ability, or insufficient anonymization allowing quasi-identifiers to be re-identified through link attacks. The second approach attempts to have one party or central node collect data features from all parties to uniformly optimize the anonymization strategy. However, this path requires each holder to report field distribution statistics or data quality indicators before and after anonymization. In a multi-party scenario with mutual distrust, this information itself constitutes a sensitive leakage risk, and participating parties often refuse to cooperate. In the data flow stage, each node can currently only set static risk blocking thresholds based on local experience, lacking global awareness of the cascading diffusion risk after cross-domain data flow. Setting the threshold too high allows sensitive information to be pieced back together after multiple transfers, while setting it too low blocks normal business processes.

[0004] It is evident that existing methods suffer from three major drawbacks in compliance scenarios where multiple data holders distrust each other: the de-identification strategy cannot balance privacy protection and the effectiveness of joint analysis; the de-identification optimization process itself introduces the risk of secondary privacy leakage; and the lack of global situational awareness in blocking transfer risks. A technical solution is needed that can collaboratively optimize the de-identification strategy and dynamically control the risks of cross-domain transfer without exposing the original data and de-identification details of any party. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a dynamic desensitization and flow tracking method for multi-source sensitive information for data compliance. This method enables each node to build a reinforcement learning agent locally. The utility value and privacy leakage penalty value obtained from joint analysis of the desensitized data are substituted into a nonlinear reward function to calculate the reward. Interaction trajectories are collected iteratively, and differential privacy noise is superimposed on the local policy gradient before homomorphic encryption and uploading to an aggregation server for weighted federated averaging. Updates are then distributed to synchronize local parameters. During data flow, the global flow risk entropy is jointly calculated using the Shamir secret sharing protocol, ensuring that local flow risk indicators and diffusion coefficients are not exposed at each node. Each node dynamically adjusts its local blocking threshold based on the statistical characteristics of the entropy value sequence within the sliding window and blocks flow operations exceeding the threshold. Logs containing only the hash identifier, timestamp, and task identifier of the desensitized operation are stored on the blockchain. This achieves multi-party anonymous collaborative desensitization strategy optimization and adaptive global risk flow control.

[0006] To address the aforementioned technical problems, this invention provides the following technical solution: a method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance, comprising the following components:

[0007] Step 1: Each node constructs a reinforcement learning agent locally, using the utility value obtained from participating in a multi-party joint analysis task with desensitized data and the privacy leakage penalty value based on local information entropy as input. The reward value is calculated through a preset reward function. This reward function accelerates the reduction of reward when the privacy penalty exceeds the node's preset tolerance baseline. The node collects the interaction trajectory of state, action and reward through iteration.

[0008] Step 2: Each node calculates the policy gradient vector based on the interaction trajectory. Differential privacy noise is superimposed on the gradient vector and norm clipping is performed. The gradient vector is then encrypted and uploaded using the public key of the aggregation server. The aggregation server performs weighted aggregation of all encrypted gradients according to the sample size of each node and the recent loss change trend. The aggregation result is used as the global policy update and sent to each node to synchronize the local agent parameters.

[0009] Step 3: When data transfer is required, each node calculates the local transfer risk index and risk diffusion coefficient, and jointly calculates the global transfer risk entropy through a secure multi-party computation protocol without exposing individual indicators and coefficients.

[0010] Step 4: Each node maintains a fixed-length sliding window to store the global flow risk entropy values ​​of the most recent rounds. By analyzing the statistical characteristics of the entropy value sequence within the window, the local blocking threshold is dynamically adjusted. When the risk value of the data operation to be flowed exceeds the adjusted threshold, the operation is blocked. A log record containing only the de-identified operation hash identifier, timestamp, and task identifier is generated for the blocking event. Each node packages the log into a block and puts it on the blockchain for evidence storage to achieve covert compliance tracking.

[0011] Further, in step 1, the state vector construction process adopts a strategy of processing and then fusing data features and behavioral history separately. On the data feature side, the node scans the data table to be de-identified column by column, extracting four indicators for each column: cardinality, null value rate, information entropy, and data type encoding. If the column is a numerical field, quantile dispersion is added as a fifth indicator. After all indicators for all columns are extracted, they are uniformly vectorized and concatenated, compressed into a 64-dimensional vector through a fully connected layer, and then activated using ReLU. On the behavioral history side, the node retrieves the operation records of the past five time steps. Each record contains a one-hot encoding of the operator type and an operation strength normalized to the 0-1 interval. Different weights are assigned to these five records according to their time proximity, with greater weights for time steps closer to the current time. Specifically, the weights are taken as powers of 0.9, where t is the time step interval counting backwards from the current time. After weighted summation, a 128-dimensional historical context vector is obtained. During fusion, the normalized utility value obtained after the previous desensitization and joint analysis is placed first, followed by the 64-dimensional activation vector and the 128-dimensional historical context vector. The spliced ​​result is the complete state sent to the policy network.

[0012] Furthermore, in step 1, the agent's action output and pre-execution verification constitute a closed-loop constraint mechanism. The output head of the policy network is divided into two paths: discrete selection and continuous parameters. The discrete path determines a category from five operators: generalization, suppression, permutation, noise addition, and differential privacy. The continuous path outputs the operation intensity value of that category, which is limited to between 0 and 1. During the training exploration phase, the node randomly selects a category with probability ε instead of selecting the one with the highest probability. At the same time, Gaussian noise perturbation is added to the intensity value. ε is set to 0.3 at the start of training and decreases linearly to 0.01 with the number of training steps. In the inference application phase, it switches to directly taking the probability. The largest category and the mean strength of the unperturbed category; regardless of whether it is training or inference, the combination of operators output by the policy network must be checked by the local compliance verifier before it is actually executed. The verifier simulates the de-anonymization operation of the combination and counts the equivalence classes formed on the quasi-identifier column. It finds the number of records contained in the smallest equivalence class and compares this minimum size with the pre-set anonymization threshold k. If it is lower than k, it indicates that the de-anonymization risk is too high. The verifier gradually pulls back the operation strength value in proportion and re-simulates until the minimum equivalence class size reaches k before releasing the final strength value along with the operator category to the execution module.

[0013] Furthermore, in step 1, the preset reward function accelerates the reduction of rewards when the privacy penalty exceeds the tolerance baseline, and the formula is: This function will convert molecules The joint analysis utility represented by the basic return is used to control the extent to which the privacy penalty accelerates the erosion of utility. It is a privacy breach penalty value that combines two dimensions: the uniqueness of data attributes after anonymization and the mutual information content between data before and after anonymization. It is a privacy tolerance baseline preset by the node based on its own compliance level. The higher the compliance level, the lower the baseline value is set, and the more sensitive it is to privacy leaks. It is a factor that adjusts the steepness of the exponential term, when at least 10 historical reward values ​​have been accumulated locally. Take the reciprocal of the standard deviation of these 10 values; if there are fewer than 10 historical reward values, then... Temporarily take 0.5, It is the ratio of the number of valid samples in a node to the total number of valid samples in all nodes, used to balance the reward levels of nodes of different sizes. Not exceeding When the denominator is close to 1, the reward is mainly due to Dominance, once Exceeding The rapid increase in the exponential term leads to denominator inflation, which accelerates the decline in reward value.

[0014] Furthermore, in step 2, when superimposing differential privacy noise on the policy gradient vector, the principle of configuring noise scale according to the data sensitivity level is followed. The node first traverses each data record used for gradient calculation, counts the number of direct identifiers contained therein, classifies records containing two or more direct identifiers into level three sensitive data, records containing exactly one direct identifier into level two, and records containing no direct identifiers into level one. Each level corresponds to a Laplacian noise scale parameter. These three scale parameters are calculated by the node based on its allocated global privacy budget, the proportion of data volume at each level, and the total number of training iterations. The noise scale of level three sensitive data is the global privacy budget allocation share in level three data divided by the number of level three data records and multiplied by the reciprocal of the total number of training iterations. Level two and level one follow the same principle. After the calculation is completed, the node pulls the Laplacian distribution of the corresponding scale according to the level of the record to generate a noise vector of the same length as the gradient vector. The noise vectors of all records are accumulated element by element to the original policy gradient to complete the noise injection.

[0015] Furthermore, in step 2, the aggregation weight assigned to each node i during weighted aggregation by the aggregation server... Calculate using the following formula: ,in It is a node The number of samples participating in the joint analysis. It is the sum of the number of samples from all nodes, and the ratio of the two reflects the proportion of the data size of node i. It is a node The normalized change in recent training loss is calculated by subtracting the current validation loss from the previous round's local validation loss, and then dividing by the larger of the two rounds' loss values. When the current round's loss is lower than the previous round's... A positive value between 0 and 1 indicates that the loss in this round is equal to or greater than that in the previous round. The value is negative or zero and ranges between -1 and 0. During the first round of training, there is no loss value from the previous round. Set all values ​​to 0. The function will Mapping to nodes within the open interval -1 to 1 that cause the loss to decrease more rapidly The closer a node is to 2, the greater its aggregate power; nodes where losses increase rather than decrease have significantly weakened power when the term approaches 0. The formula's denominator is normalized to ensure this. .

[0016] Furthermore, in step 3, the global flow risk entropy H is calculated based on the information content of the risk contribution ratio of each node, using the following formula: ,in This is the number of nodes participating in this joint computation. It is a node The local transfer risk indicator is derived by multiplying the re-identification probability of the record to be transferred on a public, universal dataset by the sensitive information gain of the fields involved in the record. It is a node The risk diffusion coefficient is measured by dividing the out-degree of the node in the directed graph of data flow by its in-degree. When the in-degree is zero, it is treated as 1 to avoid division by zero errors. This coefficient is applied to all nodes when the system has no historical data flow logs and is in a cold start state. All values ​​are assigned to 1. It is the normalization factor, obtained through the summation formula. get, It is a constant, taken as 10⁻ 9 To prevent the logarithm from being zero, the calculation of this entropy value is performed entirely under the protection of a secure multi-party computation protocol. No node can deduce the values ​​of other nodes from it. or .

[0017] Furthermore, in step 3, the secure multi-party computation protocol constructs a concealed summation process based on Shamir secret sharing. Each node first agrees on a finite field and randomly generates a polynomial using the local circulation risk index as a constant term. The threshold t is taken as half of the total number of participating nodes, rounded up. Each node takes t points from the polynomial as shares and sends each share, along with a homomorphic commitment, to the corresponding holding node via a secure channel. After receiving the shares, each node verifies that the shares have not been tampered with using the commitment value. After successful verification, the nodes accumulate all the shares held from different nodes according to the node identifier to obtain a share for the sum of all risk indices. The nodes broadcast this sum share. When a node collects at least t sum shares, it reconstructs the sum of all node risk indices through Lagrange interpolation. Each node multiplies its own risk diffusion coefficient by this sum and performs normalization and logarithmic operations on its own. Finally, all nodes obtain a completely consistent global circulation risk entropy H.

[0018] Furthermore, in step 4, the statistical monitoring of the sliding window and the adjustment of the blocking threshold constitute a negative feedback control mechanism. Nodes maintain a local circular buffer with a capacity of 10 to store the global flow risk entropy values ​​of the most recent 10 rounds. After the buffer is filled for the first time, each time a new entropy value is stored, the oldest entropy value is squeezed out, and the mean M and standard deviation S of all 10 current entropy values ​​are immediately calculated. If the new entropy value is greater than... If the global risk is abnormally high, triggering a strong risk signal, the blocking threshold will be lowered by 0.05. If the new entropy value is lower than MS for three consecutive rounds, the global risk will be continuously mitigated, triggering a low risk signal, and the blocking threshold will be raised by 0.05. After each adjustment, the upper limit of the blocking threshold will be truncated to 0.95 and the lower limit will be truncated to 0.15. If the new entropy value does not meet any triggering condition, the blocking threshold will remain unchanged. After the adjustment is completed, the final threshold will be compared with the risk value of the operation to be transferred to determine whether to allow or block the operation.

[0019] Furthermore, in step 4, the log records of the blocking event and the on-chain evidence form a decentralized audit evidence chain. When a data flow operation is blocked because the risk value exceeds the dynamic blocking threshold, the blocking node generates a log. The log content is limited to three items: the de-identified operation hash identifier, the millisecond-level timestamp, and the task identifier. It does not contain the original data or de-identified parameters. Each node accumulates the log locally. Every fixed time interval or when the number of log entries reaches a preset threshold, all logs in this period are treated as a batch, and their hash values ​​are calculated one by one. These hash values ​​are used to construct a Merkle tree for the leaf nodes. The root hash and the timestamp are packaged together. After the micro-block is formed, each node runs a lightweight Byzantine fault-tolerant consensus protocol to vote on the block header and root hash and put them on the chain. Any node can verify the integrity and tamper-proof nature of the original log text of other nodes with the root hash on the chain without having to access the original text. During compliance auditing, the authorized party uses a dedicated key to decrypt the mapping table between the de-identified operation hash identifier and the actual strategy to complete the traceability.

[0020] Compared with existing technologies, this method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance has the following advantages:

[0021] I. This invention achieves covert collaborative optimization of multi-party de-identification strategies through a federated reinforcement learning framework. Each node only explores de-identification operator combinations locally and uploads encrypted gradients, without exposing the original data or de-identification parameter details throughout the process. Under the premise of meeting the compliance constraint of data not leaving the domain, the joint analysis utility continuously improves with training iterations. A privacy penalty nonlinear accelerated decay mechanism is introduced into the reward function to guide the agent to autonomously approach the optimal balance between data utility and privacy protection, avoiding the dilemma of traditional static de-identification methods where insufficient de-identification leads to privacy leakage or excessive de-identification leads to loss of analytical value.

[0022] Second, this invention aggregates global flow risk entropy through a secure multi-party computation protocol, enabling each node to dynamically adjust blocking thresholds based on the overall system risk situation rather than a single local perspective. Combined with a decentralized log-on-chain evidence storage mechanism, it achieves, for the first time, collaborative perception, adaptive blocking, and full auditability and traceability of sensitive data flow risks in a multi-party, mutually distrustful scenario. Each node shares global risk information without disclosing its own risk details, upgrading blocking decisions from isolated local judgments to dynamic, globally coordinated control, effectively preventing the risk of cross-domain cascading propagation of sensitive information.

[0023] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0025] Figure 1 The main flowchart of a method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance;

[0026] Figure 2 A flowchart of the closed-loop mechanism for intelligent agent action output and pre-execution verification of a multi-source sensitive information dynamic desensitization and flow tracking method for data compliance. Detailed Implementation

[0027] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0028] This embodiment is specifically applied to a collaborative scientific research analysis scenario involving multiple medical institutions. In this scenario, the hospitals aim to jointly train a binary classification model to predict the risk of a rare disease without directly sharing original patient medical record data. Because the data from each hospital is distributed differently and contains a large amount of sensitive information, such as patient identification, diagnostic details, and genetic testing results, any data transfer and processing operations must strictly comply with data privacy protection regulations. The technical solution of this invention, in this scenario, enables high-value collaborative analysis while ensuring data compliance for all participating parties.

[0029] In the multi-institutional collaborative medical analysis scenario, each medical institution has deployed the data compliance system of this invention. Taking a complete collaborative analysis task lifecycle as an example, this system executes the following technical solutions.

[0030] Step 1: Local Dynamic De-identification Based on Reinforcement Learning

[0031] First, each participating node builds a reinforcement learning agent locally, which is responsible for deciding the optimal de-identification strategy for each data query or analysis request.

[0032] (I) State Space Construction: At the start of a typical model training epoch, node A needs to process a data table containing 100,000 patient records and 50 fields. The agent's state vector construction process strictly follows the strategy described in claim 2. Node A's processor scans the data table column by column, extracting key statistical indicators for each column, including the number of unique values, the proportion of missing values, information entropy, and data type. For example, the "diagnosis code" column is identified as a categorical field with an information entropy of 4.2 bits; the "age" column is identified as a numerical field, so its quartile dispersion is calculated additionally. After all column indicators are vectorized, they are compressed into a 64-dimensional dense vector through a fully connected network layer, and nonlinearity is introduced through the ReLU activation function. At the same time, the system retrieves the operation records of the past five time steps and assigns exponentially decaying weights according to the time proximity to emphasize the impact of recent behavior. Finally, the normalized utility value obtained from the joint analysis of the data after the last desensitization is concatenated with the aforementioned 64-dimensional vector and 128-dimensional historical context vector to form a complete state vector for inputting into the policy network.

[0033] (II) Action Decision and Security Verification: After receiving the state vector, the policy network outputs the action according to the dual-path structure described in claim 3. The discrete path calculates the probability distribution of five de-identification operators—"generalization," "suppression," "permutation," "noise addition," or "differential privacy"—using the Softmax function; the continuous path generates an operation strength value between 0 and 1 for the selected operator. In the initial training phase, the system randomly selects an operator with a probability of 0.3 and adds Gaussian noise with a mean of 0 and a variance of 0.1 to the strength value for sufficient exploration. This exploration probability then linearly decays to 0.01. In the inference application phase, the operator with the highest probability and its corresponding strength value are directly selected. Regardless of the phase, the action must pass through a local compliance verifier before it is executed. The verifier simulates the de-identification operation and counts the equivalence classes formed by quasi-identifier columns such as "postal code" and "date of birth" in the data. For example, if after the simulation operation, the smallest equivalence class contains only 3 records, and the system's preset k-anonymity threshold is 5, the verifier determines that the de-anonymization risk is too high. At this point, the verifier gradually calls back the operation strength value according to the preset step size and re-simulates until the minimum equivalence class size reaches or exceeds 5 before the final determined operator combination and strength value can be released to the data execution module.

[0034] (III) Reward Feedback and Parameter Update: The anonymized data was used to participate in this round of joint model training. After training, the system calculates two key values: 1) Utility value (U), which is the performance improvement of the model on the validation set in this round; 2) Privacy leakage penalty value (P), which comprehensively measures the attribute uniqueness of the anonymized data and the mutual information content of the data before and after anonymization. Node A, based on its compliance level, has a privacy tolerance baseline ( The reward function is set to 0.8. According to the formula Calculation. Among them, the adjustment factor... Set to 5 to quickly reduce rewards if privacy penalties exceed the baseline. For example, if in this round... It is 0.6. It is 0.9. If the percentage of samples from node A is 0.4, then the calculated reward value is... will be significantly smaller than The value is not exceeded when the baseline is not exceeded, thus effectively suppressing the selection of high-risk strategies.

[0035] Step 2: Global model update based on secure aggregation

[0036] After each node has collected the "state-action-reward" interaction trajectory for multiple consecutive time steps locally, it begins to calculate the policy gradient.

[0037] (I) Local Gradient Calculation and Noise Addition: Node A calculates the gradient vector gg according to the policy gradient algorithm. Subsequently, the system adds noise in stages based on data sensitivity. Node A iterates through the records used for calculation in this round and finds that 2000 records contain two direct identifiers, "patient name" and "ID number," and are classified as Level 3 sensitive data; another 5000 records contain only one direct identifier, "name," and are classified as Level 2; the remaining 93000 records are classified as Level 1. Node A's total global privacy budget is ϵ=8.0, and the total number of training rounds is 1000. The system infers the noise scale based on the proportion of data at each level: the noise scale parameter for Level 3 data. This scale is much larger than the noise scale parameter of Level 1 data. The system samples from a Laplace distribution at the corresponding scale, generates a noise vector of the same length as the gradient, and adds it element-wise to the original gradient. Then, the noisy gradient is pruned by norm, and finally, it is encrypted and uploaded using the public key of the aggregation server.

[0038] (II) Weighted Aggregation and Global Distribution: After receiving the encrypted gradients from all nodes, the aggregation server performs the weighted aggregation as described in claim 6. The server first calculates the sample size proportion of each node. Simultaneously, based on the loss values ​​reported by each node, the server calculates its recent loss change. For example, node A has a sample share of 0.4. This indicates that the losses decreased relatively quickly. Its aggregation weight is close to 1. The weight of a node will be higher than its sample proportion; conversely, if the loss of a node increases, its weight will be reduced. Ultimately, the aggregation server will use the formula... The normalized weight of each node is calculated and then a weighted average is performed to obtain the global policy update amount. This update amount is then distributed to all nodes to synchronously update the local agent parameters of each node.

[0039] Step 3: Jointly calculate the global flow risk entropy

[0040] When cross-organizational data transfer or query is required, such as when node A requests a query for specific statistical results from node B, the system must first assess the overall transfer risk.

[0041] (a) Calculation of local indicators: Node A calculates its local circulation risk indicators. This indicator comprehensively considers factors such as the amount of data involved in this request and its sensitivity level. It also calculates a risk diffusion coefficient. This coefficient reflects the extent to which data leakage at this node could affect other nodes through related relationships. To prevent the exposure of individual metrics, each node employs the secure multi-party computation protocol based on Shamir secret sharing, as described in claim 8.

[0042] (II) Hidden Summation and Entropy Calculation: Three nodes agree on a finite field. Node A... As a constant term, a quadratic random polynomial is generated. Node A calculates the value of the polynomial at x=1,2,3 as its share, along with a homomorphic commitment, and sends it to nodes B, C, and itself. Each node, upon receiving its share, verifies its integrity using the commitment. After successful verification, each node sums its shares from all nodes to obtain a total share. For example, if node A holds three shares from nodes A, B, and C, they are summed to obtain the total share. Once node A has collected at least two total shares, the total global risk indicator is reconstructed using Lagrange interpolation. Ultimately, each node independently calculates the global flow risk entropy. The formula is ,in This is a very small constant to prevent logarithmic overflow. Since all nodes receive the same sum ZZ, a completely consistent value of HH is calculated.

[0043] Step Four: Dynamic Blocking and Covert Compliance Tracking

[0044] (i) Dynamic threshold adjustment: Each node maintains a local circular buffer with a capacity of 10 to store the global flow risk entropy calculated in the last 10 rounds. The system continuously monitors this sequence. When the entropy value of the new area... After entering the buffer, the system calculates the mean M and standard deviation S of all 10 current entropy values. When the value is M+2×S, the system determines that the global risk has abnormally increased and immediately triggers a strong risk signal. At this point, the system dynamically adjusts the local blocking threshold T, for example, reducing it from the default 0.7 to 0.5. If the new entropy value is lower than M−S for three consecutive rounds, the system determines that the risk has continued to ease, and the system gradually restores the threshold to the default value. This negative feedback mechanism ensures a sensitive and stable response to the global risk situation.

[0045] (II) Blocking and Evidence Preservation: Taking a query operation as an example, its risk value is assessed as 0.6. Node A first checks the current dynamic blocking threshold. If the threshold has been lowered to 0.5 due to risk escalation, then this operation (0.6>0.5) will be blocked. After the blocking event occurs, Node A immediately generates a log. This log only contains the hash identifier of this de-identification operation, a timestamp accurate to milliseconds, and the UUID of this joint analysis task, without containing any original data or specific de-identification parameters. Node A accumulates this log locally. When it accumulates to 100 logs or 5 minutes have passed since the last packaging, Node A constructs this batch of logs into a Merkle tree and calculates the root hash. Subsequently, all participating nodes run a lightweight Byzantine fault-tolerant consensus protocol to confirm the block header and preserve it on the blockchain. During subsequent compliance audits, auditors can decrypt the hash identifiers of on-chain logs using a dedicated key and compare them with the locally stored policy mapping table. This allows them to fully trace and verify the occurrence time, associated tasks, and desensitization policies of all blocking events without accessing sensitive original text, achieving covert and tamper-proof compliance tracking.

[0046] Simulation verification and effect data

[0047] To verify the actual effectiveness of the technical solution of this invention, the applicant constructed a joint analysis system containing 5 medical institution nodes in a simulated environment. The data distribution of each node was heterogeneous, with a total sample size of approximately 25,000 records. After running the complete process, it was compared with the following baseline solutions: (1) a static desensitization solution; and (2) this solution without global risk feedback. Experimental results show that:

[0048] (a) In terms of utility preservation, the joint model of this scheme reached an AUC value of 0.87 after 200 iterations, which is about 14.5% higher than the static desensitization scheme. It also converged stably after the 100th round, which proves the optimization effect of the federated reinforcement learning framework on the desensitization strategy.

[0049] (b) Regarding privacy protection, the average privacy breach penalty value P under this scheme stabilizes in the range of 0.65-0.72 in the later stage of training, which is lower than the tolerance baseline of 0.8. In contrast, the P value of the static desensitization scheme fluctuates greatly and sometimes exceeds 0.85, indicating that this scheme can adaptively control privacy risks within the compliance red line.

[0050] (c) In terms of risk management and control, after introducing global risk entropy feedback, the unexpected cross-domain transfer blocking rate reached 96.3% and the false blocking rate was 4.2%. Compared with the no-feedback solution, it significantly reduced business interference while ensuring security.

[0051] The simulation data above fully demonstrates that the technical modules of this invention are not simply stacked together, but rather achieve quantifiable synergistic gains through closed-loop feedback.

[0052] This embodiment organically combines dynamic desensitization of multi-source sensitive information, reinforcement learning model updates based on secure aggregation, secure multi-party computation-driven risk assessment of data transfer, and dynamic adaptive blocking and blockchain-based evidence storage mechanisms to provide a closed-loop, implementable data compliance solution for multi-institutional medical collaborative analysis. This solution not only achieves a dynamic balance between the high-value utilization of sensitive data and privacy protection, but also establishes a transparent, reliable, and efficient audit and traceability system, effectively solving the technical challenges present in the background technology and achieving excellent technical results.

[0053] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance, characterized in that: The method comprises the following components: Step 1: Each node constructs a reinforcement learning agent locally, using the utility value obtained from participating in a multi-party joint analysis task with desensitized data and the privacy leakage penalty value based on local information entropy as input. The reward value is calculated through a preset reward function. This reward function accelerates the reduction of reward when the privacy penalty exceeds the node's preset tolerance baseline. The node collects the interaction trajectory of state, action and reward through iteration. Step 2: Each node calculates the policy gradient vector based on the interaction trajectory. Differential privacy noise is superimposed on the gradient vector and norm clipping is performed. The gradient vector is then encrypted and uploaded using the public key of the aggregation server. The aggregation server performs weighted aggregation of all encrypted gradients according to the sample size of each node and the recent loss change trend. The aggregation result is used as the global policy update and sent to each node to synchronize the local agent parameters. Step 3: When data transfer is required, each node calculates the local transfer risk index and risk diffusion coefficient, and jointly calculates the global transfer risk entropy through a secure multi-party computation protocol without exposing individual indicators and coefficients. Step 4: Each node maintains a fixed-length sliding window to store the global flow risk entropy values ​​of the most recent rounds. By analyzing the statistical characteristics of the entropy value sequence within the window, the local blocking threshold is dynamically adjusted. When the risk value of the data operation to be flowed exceeds the adjusted threshold, the operation is blocked. A log record containing only the de-identified operation hash identifier, timestamp, and task identifier is generated for the blocking event. Each node packages the log into a block and puts it on the blockchain for evidence storage to achieve covert compliance tracking.

2. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 1, the state vector construction process adopts a strategy of processing and then fusing data features and behavioral history separately. On the data feature side, the node scans the data table to be anonymized column by column, extracting four indicators for each column: cardinality, null value rate, information entropy, and data type encoding. If the column is a numerical field, the quantile dispersion is added as a fifth indicator. After the indicators of all columns are extracted, they are uniformly vectorized and concatenated. After being compressed into a 64-dimensional vector by a fully connected layer, it is activated by ReLU. On the behavioral history side, the node retrieves the operation records of the past five time steps and assigns different weights to these five records according to their time proximity. During fusion, the normalized utility value obtained from the joint analysis after the previous anonymization is placed first, and then the 64-dimensional activation vector and the 128-dimensional historical context vector are concatenated in sequence. The concatenated result is the complete state sent to the policy network.

3. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 1, the agent's action output and pre-execution verification form a closed-loop constraint mechanism. The output head of the policy network is divided into two paths: discrete selection and continuous parameters. The discrete path determines a category from five operators: generalization, suppression, permutation, noise addition, and differential privacy. The continuous path outputs the operation intensity value of that category, which is limited to 0-1. During the training exploration phase, the node randomly selects a category with probability ε instead of selecting the one with the highest probability. At the same time, Gaussian noise perturbation is added to the intensity value. ε is set to 0.3 at the start of training and decreases linearly to 0.01 with the number of training steps. In the inference application phase, it switches to directly selecting the one with the highest probability. The category and the mean strength of the unperturbed; regardless of whether it is training or inference, the combination of operators output by the policy network must be checked by the local compliance verifier before it is actually executed. The verifier simulates the de-anonymization operation of the combination and counts the equivalence classes formed on the quasi-identifier column. It finds the number of records contained in the smallest equivalence class and compares this minimum size with the pre-set anonymization threshold k. If it is lower than k, it indicates that the de-anonymization risk is too high. The verifier gradually pulls back the operation strength value in proportion and re-simulates until the minimum equivalence class size reaches k before releasing the final strength value along with the operator category to the execution module.

4. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 1, the preset reward function accelerates the reduction of rewards when the privacy penalty exceeds the tolerance baseline, and the formula is as follows: ,in It is a privacy breach penalty value that combines two dimensions: the uniqueness of data attributes after anonymization and the mutual information content between data before and after anonymization. It is a privacy tolerance baseline preset by the node based on its own compliance level. It is a factor that adjusts the steepness of the exponential term. It is the ratio of the number of valid samples at a node to the total number of valid samples at all nodes.

5. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 2, when superimposing differential privacy noise on the policy gradient vector, the principle of configuring noise scale according to the data sensitivity level is followed. The node first traverses each data record used for gradient calculation and counts the number of direct identifiers contained therein. Records containing two or more direct identifiers are classified as Level 3 sensitive data, records containing exactly one direct identifier are classified as Level 2, and records containing no direct identifiers are classified as Level 1. Each level corresponds to a Laplacian noise scale parameter. These three scale parameters are calculated by the node based on the proportion of data volume at each level and the total number of training iterations according to its allocated global privacy budget. The noise scale of Level 3 sensitive data is the global privacy budget allocation share in Level 3 data divided by the number of Level 3 data records and then multiplied by the reciprocal of the total number of training iterations. The same applies to Level 2 and Level 1. After the calculation is completed, the node pulls the Laplacian distribution of the corresponding scale according to the level of the record to generate a noise vector of the same length as the gradient vector. The noise vectors of all records are accumulated element by element to the original policy gradient to complete the noise injection.

6. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 2, the aggregation weight assigned to each node i when the aggregation server performs weighted aggregation is... Calculate using the following formula: ,in It is a node The number of samples participating in the joint analysis. It is the sum of the number of samples from all nodes. It is a node The normalized change in recent training loss.

7. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 3, the global flow risk entropy H is calculated based on the information content of the risk contribution ratio of each node, and the formula is: ,in This is the number of nodes participating in this joint computation. It is a node Local circulation risk indicators It is a node The risk diffusion coefficient, It is a normalization factor. It is a constant.

8. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 3, the secure multi-party computation protocol constructs a concealed summation process based on Shamir secret sharing. Each node first agrees on a finite field and randomly generates a polynomial using the local circulation risk index as a constant term. The threshold t is taken as half of the total number of participating nodes and rounded up. Each node takes t points from the polynomial as shares and sends each share, along with a homomorphic commitment, to the corresponding holding node via a secure channel. After receiving the shares, each node verifies that the shares have not been tampered with using the commitment value. After successful verification, the nodes accumulate all the shares held from different nodes according to the node identifier to obtain a share for the sum of all risk indices. The nodes broadcast this sum share. When a node collects at least t sum shares, it reconstructs the sum of all node risk indices through Lagrange interpolation. Each node multiplies its own risk diffusion coefficient by this sum and performs normalization and logarithmic operations on its own. Finally, all nodes obtain a completely consistent global circulation risk entropy H.

9. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 4, the statistical monitoring of the sliding window and the adjustment of the blocking threshold constitute a negative feedback control mechanism. Each node maintains a local circular buffer with a capacity of 10 to store the global flow risk entropy values ​​of the most recent 10 rounds. After the buffer is filled for the first time, each time a new entropy value is stored, the oldest entropy value is squeezed out, and the mean M and standard deviation S of all 10 current entropy values ​​are immediately calculated. If the new entropy value is greater than... If the global risk is abnormally high, a strong risk signal is triggered. If the new entropy value is lower than MS for three consecutive rounds, the global risk is continuously eased, triggering a low risk signal. If the new entropy value does not meet any triggering condition, the blocking threshold remains unchanged. After adjustment, the final threshold is compared with the risk value of the operation to be transferred to determine whether to allow or block.

10. The method for dynamic desensitization and flow tracking of multi-source sensitive information for data compliance as described in claim 1, characterized in that, In step 4, the log records of the blocking event and the on-chain evidence form a decentralized audit evidence chain. When a data flow operation is blocked because the risk value exceeds the dynamic blocking threshold, the blocking node generates a log. The log content is limited to three items: the de-identified operation hash identifier, the millisecond-level timestamp, and the task identifier. It does not contain the original data or de-identified parameters. Each node accumulates the log locally. Every fixed time interval or when the number of log entries reaches a preset threshold, all logs in this period are treated as a batch and their hash values ​​are calculated one by one. These hash values ​​are used to construct a Merkle tree for the leaf nodes. The root hash and the timestamp are packaged together to form a lightweight Byzantine fault-tolerant consensus protocol for each node after the micro-block. The block header and root hash are voted on and uploaded to the chain. Any node can verify the integrity and tamper-proof nature of the original log text of other nodes by using the root hash on the chain without having to access the original text. During compliance auditing, the authorized party uses a dedicated key to decrypt the mapping table between the de-identified operation hash identifier and the actual strategy to complete the traceability.

Images