Sensitive data analysis support apparatus and sensitive data analysis support method

Abstract

This sensitive data analysis support apparatus uses a first language model held by the apparatus to extract data indicating a case related to a clinical question from verification data, generates, from the extracted data, pseudo data having statistical properties similar to those of the extracted data and having reduced personal identifiability, generates pseudo analysis specifications obtained by shaping analysis specifications based on the clinical question and the verification data for the pseudo data, inputs the pseudo analysis specifications and the pseudo data to an external second language model to acquire an analysis code proposal for the pseudo data according to the pseudo analysis specifications, and shapes the source code proposal for analysis for the extracted data according to the analysis specifications.

Description

Microdata Analysis Support Device and Microdata Analysis Support Method Incorporation by reference

[0001] This application claims the priority of Japanese Patent Application No. 2025-006343 filed on January 16, 2025, and incorporates the content thereof into this application by reference.

[0002] The present invention relates to a microdata analysis support device and a microdata analysis support method.

[0003] As background art in this technical field, there is U.S. Patent Application Publication No. 2024 / 0274286 (Patent Document 1). The technology described in Patent Document 1 extracts categorical features and continuous features from a clinical data table associated with a patient, and uses a clinical prediction model to determine and output a predicted medical treatment result of the patient based on the categorical features and continuous features extracted from the clinical data table.

[0004] U.S. Patent Application Publication No. 2024 / 0274286

[0005] Although the technology described in Patent Document 1 uses a language model to generate a predicted medical treatment result, the process of generating an answer to a clinical question and generating the source code of an analysis program for verifying the clinical question using verification data is not disclosed in Patent Document 1.

[0006] Further, the technology described in Patent Document 1 directly inputs clinical data into the language model. However, depending on the location of the language model, for example, when the language model is on an external server of a hospital, there is a high risk of leakage of microdata included in the clinical data.

[0007] Therefore, one aspect of the present invention realizes data analysis using an external language model while reducing the risk of data leakage.

[0008] To solve the above problems, one aspect of the present invention adopts the following configuration. The sensitive data analysis support device comprises a processor and a storage device, the storage device holding a first language model, a clinical question, and information relating to the patient's case including patient-identifiable data and sensitive data, and verification data for verifying the clinical question, the processor using the first language model extracts data from the verification data indicating a case related to the clinical question, generates pseudo-data from the extracted data based on a predetermined algorithm that is statistically similar to the extracted data and has lower personal identifiability than the extracted data, generates an analysis specification for an analysis to verify the clinical question using the verification data based on the clinical question and the verification data, generates a pseudo-analysis specification by formatting the analysis specification for the pseudo-data, and transmits the pseudo-analysis specification and the pseudo-data to a server having a second language model. The pseudo-analysis specifications and the pseudo-data are input to the second language model, and a draft source code for an analysis program for the pseudo-data based on the pseudo-analysis specifications, which is output from the second language model, is received from the server. The draft source code is then formatted to generate formatted source code for analysis of the extracted data based on the analysis specifications. The extracted data is analyzed using the formatted source code, and information indicating the analysis results for the extracted data is output.

[0009] According to one aspect of the present invention, it is possible to perform data analysis utilizing an external language model while reducing the risk of data leakage.

[0010] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments.

[0011] This is a block diagram showing an example configuration of the sensitive data analysis support device in Example 1. This is a block diagram showing an example configuration of the user terminal in Example 1. This is a block diagram showing an example configuration of the external server in Example 1. This is a sequence diagram showing an example of the sensitive data analysis process in Example 1. This is a sequence diagram showing an example of the sensitive data analysis process in Example 1. This is a diagram showing an example screen configuration of the clinical question input screen in Example 1. This is a diagram showing an example data configuration of the verification data in Example 1. This is a diagram showing an example screen configuration of the analysis specification display screen in Example 1. This is a diagram showing an example data configuration of the pseudo data in Example 1. This is a diagram showing an example screen configuration of the pseudo information display screen in Example 1. This is a diagram showing an example screen configuration of the analysis code display screen in Example 1. This is a diagram showing an example screen configuration of the summary result display screen in Example 1. This is a diagram showing an example screen configuration of the analysis result display screen in Example 1.

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components will be denoted by the same reference numerals in principle, and repeated descriptions will be omitted. It should be noted that this embodiment is merely one example for realizing the present invention and does not limit the technical scope of the present invention.

[0013] Figure 1 is a block diagram showing an example configuration of the sensitive data analysis support device 100. The sensitive data analysis support device 100 is composed of a computer having, for example, a processor 101, a storage device 102, an input device 103, an output device 104, and a communication IF (Interface) 105.

[0014] The processor 101 is, for example, a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The storage device 102 includes memory and auxiliary storage. The processor 101 executes the program stored in memory.

[0015] The memory includes non-volatile memory elements such as ROM (Read Only Memory) and volatile memory elements such as RAM (Random Access Memory). ROM stores immutable programs (e.g., BIOS (Basic Input / Output System)). RAM is a high-speed, volatile memory element such as DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the processor 101 and data used during program execution.

[0016] The auxiliary storage device is a high-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or flash memory (SSD (Solid State Drive)), and stores the program executed by the processor 101 and the data used when the program is executed. In other words, the program is read from the auxiliary storage device, loaded into memory, and executed by the processor 101.

[0017] The input device 103 is a device that receives input from the operator, such as a keyboard or mouse. The output device 104 is a device that outputs the program execution results in a format that the operator can see, such as a display device or printer.

[0018] The communication interface 105 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 105 may also include a serial interface such as USB (Universal Serial Bus).

[0019] Some or all of the program executed by the processor 101 may be provided to the sensitive data analysis support device 100 via a network from an external computer equipped with a non-temporary storage medium, such as removable media (CD-ROM and flash memory), or a non-temporary storage device, and stored in a non-volatile auxiliary storage device, which is also a non-temporary storage medium. For this reason, the sensitive data analysis support device 100 should have an interface for reading data from the removable media. The same applies to the user terminal 200 and the external server 300, which will be described later.

[0020] The sensitive data analysis support device 100 is a computer system that operates on a single physical computer or on multiple computers configured logically or physically. It may operate in separate threads on the same computer, or it may operate on a virtual computer built on multiple physical computing resources. The same applies to the user terminal 200 and external server 300 described later.

[0021] The memory device 102 includes, for example, a local LLM (Large Language Model) unit 110 and a main analysis unit 120. The memory device 102 also stores the program for realizing the GUI generation unit 140, which is a functional unit. The memory device 102 also holds verification data 130.

[0022] For example, the local LLM unit 110 holds the first language model 111 and stores programs for implementing the analysis specification formulation unit 112, code formatting unit 113, conformance evaluation unit 114, confirmation item extraction unit 115, and related information supplement unit 116, all of which are functional units. The main analysis unit 120 stores programs for implementing the pseudo-data generation unit 121, analysis execution unit 122, and external server linkage unit 123, all of which are functional units. Details of the processing performed by each functional unit will be described later.

[0023] The first language model 111 is a privately controlled language model (LLM) and is, for example, a lower-performance language model than the second language model 311 described later (for example, less computational complexity, less data, and fewer parameters). The validation data 130 is data for validating clinical questions and may be, for example, electronic medical records showing a patient's case (and its treatment progress), or data describing medical knowledge. Clinical questions are, for example, clinical questions or issues concerning a patient's health. The validation data 130 also includes sensitive patient information.

[0024] The first language model 111 and the verification data 130 may be stored in the memory of the storage device 102, or in an auxiliary storage device. The verification data 130 may also be stored in an external database connected to the sensitive data analysis support device 100.

[0025] For example, the memory included in the storage device 102 is loaded with a program to realize the functions of each of the above-described functional units, and the processor 101 realizes the functions by operating according to the program. Specifically, for example, the processor 101 operates as an analysis specification formulation unit 112 by operating according to an analysis specification formulation program loaded in memory, and operates as a pseudo-data generation unit 121 by operating according to a pseudo-data generation program loaded in memory. The relationship between the functional units and programs is the same in the user terminal 200 and the external server 300, which will be described later.

[0026] Furthermore, some or all of the functions of the sensitive data analysis support device 100, as well as the user terminal 200 and external server 300 described later, may be implemented by dedicated hardware such as ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array).

[0027] In this embodiment, the information used by the sensitive data analysis support system (a system including a sensitive data analysis support device 100, a user terminal 200, and an external server 300) is not dependent on any data structure and may be represented in any data structure. For example, a data structure appropriately selected from tables, lists, databases, or queues can store the information.

[0028] Figure 2 is a block diagram showing an example configuration of the user terminal 200. The user terminal 200 connects to the sensitive data analysis support device 100 via a network such as the Internet or an intranet.

[0029] The user terminal 200 is comprised of a computer having, for example, a processor 201, a storage device 202, an input device 203, an output device 204, and a communication interface 205. The hardware descriptions of the processor 201, storage device 202, input device 203, output device 204, and communication interface 205 are the same as the hardware descriptions of the processor 101, storage device 102, input device 103, output device 104, and communication interface 105, respectively, and are therefore omitted.

[0030] The memory device 202 stores a program for implementing the application 210, which is a functional unit for using the sensitive data analysis support device 100. The user terminal 200 may be integrated with the sensitive data analysis support device 100.

[0031] Figure 3 is a block diagram showing an example configuration of the external server 300. The external server 300 connects to the sensitive data analysis support device 100 via a network such as the Internet.

[0032] The external server 300 is composed of a computer having, for example, a processor 301, a storage device 302, and a communication interface 303. The hardware descriptions of the processor 301, storage device 302, and communication interface 303 are the same as those of the processor 101, storage device 102, and communication interface 105, respectively, and are therefore omitted. The external server 300 may also have input and output devices.

[0033] The memory device 302 stores, for example, a second language model 311 and programs for realizing the code draft generation unit 312 and the related information extraction unit 313, both of which are functional units. The second language model 311 is, for example, a cloud-type external LLM accessible by the sensitive data analysis support device 100, and is a language model with higher performance (e.g., higher computational complexity, data volume, and / or number of parameters) than the first language model 111. Details of the processing by each functional unit will be described later.

[0034] Figures 4A and 4B are sequence diagrams showing an example of sensitive data analysis processing. Following the processing in Figure 4A, the processing in Figure 4B is executed. As shown in Figures 4A and 4B, it is desirable that a firewall 400 is provided between the sensitive data analysis support device 100 and the external server 300.

[0035] The application 210 on the user terminal 200 displays the clinical question input screen 500 generated by the GUI generation unit 140 of the sensitive data analysis support device 100 on the output device 204, and accepts clinical question input from the user via the input device 103 on the clinical question input screen 500, and notifies the sensitive data analysis support device 100 of the received input content (S101).

[0036] Figure 5 shows an example of the screen configuration of the clinical question input screen 500. The clinical question input screen 500 includes, for example, an input area 501, an input area 502, an input area 503, and a button 504.

[0037] Input area 501 is for specifying the folder path of the validation data 130 to be analyzed. Input area 502 is for inputting clinical questions in PICO (Patient Intervention Comparison Outcome) / PECO (Patient Exposure Comparison Outcome) format.

[0038] Input area 503 is an area for freely entering a clinical question. When button 504 is selected, application 210 transmits the specified verification data 130 and the entered clinical question to the sensitive data analysis support device 100. The clinical question only needs to be entered into either input area 502 or input area 503. The verification data 130 may be stored in advance in the storage device 102 of the sensitive data analysis support device 100, rather than being transmitted from the user terminal 200.

[0039] Returning to the explanation of Figure 4A, the analysis specification formulation unit 112 extracts information related to the clinical question from the verification data 130 specified in step S101 (S102).

[0040] Figure 6 shows an example of the data structure of the verification data 130. In the example in Figure 6, the verification data 130 includes information from the electronic medical record, such as patient ID, patient age, disease name, treatment history, presence or absence of various mutations in the patient, adverse events, treatment progress, number of days of treatment, and survival period.

[0041] In a PICO / PECO format clinical question, if "NSLC patient" is specified as Patient, "Drug X" as Intervention, "Drug Y" as Comparison, and "Survival time" as Outcome, in step S102, the analysis specification formulation unit 112 extracts records from the verification data 130 that, for example, include "NSLC" in the disease name, include "Drug X" or "Drug Y" in the medical history, and have registered survival time. In other words, records relating to specific cases or records relating to specific treatment histories are extracted.

[0042] The analysis specification formulation unit 112 may also extract information related to the clinical question by inputting the clinical question, the verification data 130, and a prompt instructing the first language model 111 to extract information related to the clinical question from the verification data 130, and obtaining the output from the first language model 111.

[0043] Also, when a clinical question is specified by free input, for example, the analysis specification determination unit 112 uses natural language processing based on a predetermined algorithm to extract each item in the PICO / PECO format from the free input, thereby converting the clinical question provided by the free input into the PICO / PECO format and then executing the processing in step S102. Note that the analysis specification determination unit 112 may convert the clinical question specified by free input into the PICO / PECO format using the first language model 111.

[0044] The analysis specification determination unit 112 determines an analysis specification for verifying a clinical question using the verification data 130 using the first language model 111 (S103). Specifically, for example, the analysis specification determination unit 112 inputs a prompt instructing the determination of an analysis specification for verifying the clinical question given in the PICO / PECO format with the verification data 130 specified in step S101 to the first language model 111, and acquires the analysis specification output from the first language model 111 to determine the analysis specification.

[0045] Note that the GUI generation unit 140 may display an analysis specification display screen 700 for displaying the analysis specification determined by the analysis specification determination unit 112 on the output device 204 of the user terminal 200.

[0046] FIG. 7 is a diagram showing an example of the screen configuration of the analysis specification display screen 700. The analysis specification display screen 700 includes, for example, a display area 701 and a button 702. In the display area 701, the analysis specification determined by the analysis specification determination unit 112 is displayed. As shown in the example of FIG. 7, the analysis specification includes, for example, the analysis procedure, the analysis method, the analysis target data, and an example of the analysis result (the output template of the assumed analysis result).

[0047] Note that in the display area 701, it may be possible to edit the analysis specification via an input from the user to the input device 203 of the user terminal 200. When the button 702 is selected, the application 210 transmits the analysis specification described in the display area 701 to the confidential data analysis support device 100, and the analysis specification is determined.

[0048] Return to the description of FIG. 4A. The pseudo-data generation unit 121 processes the records extracted in step S102 of the verification data 130 so as to be data that cannot identify a specific individual (so as to reduce the personal identifiability), and generates pseudo-data 800 composed of the processed records (S104). Note that the pseudo-data generation unit 121 may further process the extracted records of the verification data 130 so that the content of the sensitive data cannot be identified in the generation of the pseudo-data 800.

[0049] FIG. 8 is a diagram showing an example of the data configuration of the pseudo-data 800. The example of the pseudo-data 800 in FIG. 8 is generated from the example of the verification data 130 in FIG. 6. The pseudo-data generation unit 121 performs anonymization and / or pseudonymization on the extracted records of the verification data 130 in step S104.

[0050] An example of the method for generating the pseudo-data 800 using the examples of FIGS. 6 and 8 will be described. For example, the pseudo-data generation unit 121 changes each patient ID, which is an item that affects personal identifiability but does not affect the analysis result, to a different value (for example, a random value). Also, for example, the pseudo-data generation unit 121 changes each value of the age, which is an item that affects personal identifiability and also affects the analysis result, to information indicating the range to which the age belongs.

[0051] Also, for example, the pseudo-data generation unit 121 replaces each value of the treatment history, which is an item corresponding to sensitive data (and may also have personal identifiability in addition to corresponding to sensitive data), with another name. However, since the treatment history is an item that affects the analysis, it is desirable to be able to identify from the treatment history of the pseudo-data 800 that the content of the treatment history before replacement is a drug name or a treatment name, and also, the name before replacement and the name after replacement correspond one-to-one.

[0052] Furthermore, for example, the gA mutation, gB mutation, and gC mutation in the verification data 130 in Figure 6 are sensitive data and items that affect the analysis results. Since these mutations are given as binary values ​​of "Y" (Yes) or "N" (No), changing the values ​​will prevent the correct analysis results from being obtained. Therefore, the pseudo-data generation unit 121 changes the item names themselves, gA mutation, gB mutation, and gC mutation, to other item names (however, it is desirable that the pseudo-data 800 be able to identify them as item names related to mutations).

[0053] Furthermore, in order to generate pseudo-data 800 from verification data 130, processing methods such as anonymization and pseudonymization may be used, as well as processing methods such as GAN (Generative Adversarial Network).

[0054] Furthermore, the pseudo-data generation unit 121 may generate pseudo-data 800 after sampling the records extracted in step S102 of the verification data 130. In generating the pseudo-data 800, the pseudo-data generation unit 121 performs sampling in such a way that the distribution of the verification data 130 for predetermined items (for example, one or more items that affect the analysis results) is generally maintained (for example, an algorithm such as stratified sampling is used). In other words, even if sampling is performed, the statistical properties of the verification data 130 and the pseudo-data 800 are similar (naturally, if sampling is not performed, the statistical properties are similar (identical)). Performing such sampling speeds up subsequent processing and reduces the risk of information leakage.

[0055] Furthermore, the items and values ​​to be processed in the verification data 130 when generating the pseudo-data 800, the algorithm for processing, and the number of samples in sampling are, for example, predetermined.

[0056] Furthermore, the pseudo-data generation unit 121 may output the pseudo-data 800 to the first language model 111 by inputting a prompt instructing the generation of pseudo-data 800 and the records extracted in step S102 of the verification data 130 to the first language model 111. The prompt instructing the generation of pseudo-data 800 includes, for example, an instruction to sample the extracted records with the number of samples necessary for analysis so that the distribution of predetermined items in the extracted records of the verification data 130 is generally maintained, and then to exclude personal information from the extracted records. In other words, in this case, the items and values ​​to be processed, the algorithm for processing, and the number of samples in sampling do not need to be set in advance.

[0057] As described above, the pseudo-data 800 is data from which personal information has been removed (or at least its ability to identify individuals has been significantly reduced), so even if it is transmitted to the external server 300, the risk of sensitive data being linked to a specific individual and leaked is reduced.

[0058] Returning to the explanation of Figure 4A, the analysis specification formulation unit 112 generates a pseudo-analysis specification (S105) by formatting the analysis specification formulated in step S103 based on the changes from the verification data 130 (records extracted in step S102) to the pseudo-data 800. Specifically, for example, the analysis specification formulation unit 112 generates a pseudo-analysis specification by changing the descriptions included in the analysis specification, such as the description of the number of samples, the descriptions whose values ​​were converted when the pseudo-data 800 was generated (drug names and treatment names), and the descriptions whose item names were converted when the pseudo-data 800 was generated (mutation names, etc.), according to the changes from the verification data 130 to the pseudo-data 800.

[0059] Furthermore, the pseudo-data generation unit 121 may generate a dictionary that shows the correspondence between the content converted from the verification data 130 to the pseudo-data 800 when generating the pseudo-data 800. In this case, the analysis specification formulation unit 112 generates a pseudo-analysis specification by converting the analysis specification formulated in step S103 according to the dictionary.

[0060] Furthermore, the analysis specification formulation unit 112 may output a pseudo-analysis specification from the first language model 111 by inputting a prompt instructing the generation of a pseudo-analysis specification, the verification data 130, and the pseudo-data 800 into the first language model 111. The prompt instructing the creation of a pseudo-analysis specification may include, for example, instructions to extract the changes from the verification data 130 to the pseudo-data 800 and to change the description of the analysis specification according to the extracted changes.

[0061] The GUI generation unit 140 may also cause the pseudo-information display screen 900, which displays the pseudo-analysis specifications generated by the analysis specification formulation unit 112 and the pseudo-data 800 generated by the pseudo-data generation unit 121, to be displayed on the output device 204 of the user terminal 200.

[0062] Figure 9 shows an example of the screen configuration of the pseudo-information display screen 900. The pseudo-information display screen 900 includes, for example, a display area 901, a display area 902, and a button 903. The display area 901 displays the pseudo-analysis specifications generated by the analysis specification formulation unit 112. The display area 902 displays the pseudo-data 800 generated by the pseudo-data generation unit 121. By displaying the pseudo-analysis specifications and the pseudo-data 800, the user can verify the validity of the information transmitted to the external server 300 and whether any information security issues arise.

[0063] Furthermore, in display area 901 and display area 902, it may be possible to edit the simulated analysis specifications and simulated data 800 via input from the user to the input device 203 of the user terminal 200. When button 903 is selected, the application 210 transmits the simulated analysis specifications described in display area 901 and the simulated data 800 displayed in display area 902 to the sensitive data analysis support device 100, and the simulated analysis specifications and simulated data 800 are determined.

[0064] Returning to the explanation of Figure 4A, the external server linkage unit 123 generates a prompt instructing the generation of a draft analysis code for analyzing the pseudo-data 800 according to the pseudo-analysis specifications, and sends the prompt, the pseudo-analysis specifications, and the pseudo-data 800 to the external server 300 (S106). Note that the analysis code refers to, for example, the source code of a data analysis program.

[0065] The code draft generation unit 312 of the external server 300 inputs the prompt received in step S106, the pseudo-analysis specification, and the pseudo-data 800 into the second language model 311, generates an analysis code draft by obtaining the analysis code draft from the second language model 311, and transmits the generated analysis code draft to the sensitive data analysis support device 100 (S107).

[0066] Furthermore, RAG (Retrievable-Augmented Generation) may be used to generate the proposed analysis code in step S107. Specifically, for example, the proposed code generation unit 312 retrieves information related to the prompt received in step S106 from the medical statistical analysis data 410, inputs the prompt received in step S106, the pseudo-analysis specifications, the pseudo-data 800, and the acquired information into the second language model 311, and obtains a proposed analysis code generated by having the second language model 311 refer to the acquired information.

[0067] The medical statistics analysis data 410 is data that includes knowledge about medical statistics (for example, analysis codes for analyzing data related to medical statistics). The medical statistics analysis data 410 may be stored in an external database accessible by the external server 300, or it may be stored in the storage device 302 of the external server 300.

[0068] The external server linkage unit 123 of the sensitive data analysis support device 100 receives the proposed analysis code transmitted in step S107 (S108).

[0069] The conformance evaluation unit 114 evaluates the conformance between the proposed analysis code received in step S108 and the pseudo-analysis specification (S109). Specifically, for example, the conformance evaluation unit 114 evaluates the conformance by prompting the calculation of the degree of conformance between the analysis result when the pseudo-data 800 is analyzed using the proposed analysis code and an example of the result included in the pseudo-analysis specification, and by inputting the proposed analysis code, the pseudo-data 800, and the pseudo-analysis specification into the first language model 111 and outputting the degree of conformance to the first language model 111. The degree of conformance is given, for example, as a value between 0.0 and 1.0.

[0070] Furthermore, for example, the conformance evaluation unit 114 inputs a prompt to instruct the analysis of the pseudo-data 800 using the proposed analysis code, as well as the proposed analysis code and the pseudo-data 800, into the first language model 111, causes the analysis results of the analysis to be output to the first language model 111, and evaluates the conformance by calculating the degree of conformance (for example, the distance between Doc2Vc vectors) between the outputted analysis results and the example results included in the pseudo-analysis specification.

[0071] Alternatively, for example, the GUI generation unit 140 may display a screen showing the proposed analysis code, simulated data 800, and simulated analysis specifications on the output device 204 of the user terminal 200, and obtain the degree of match through user input via the input device 203.

[0072] If the matching evaluation unit 114 determines that the degree of matching is equal to or greater than a predetermined threshold, it proceeds to the process in step S110. If the matching evaluation unit 114 determines that the degree of matching is less than the predetermined threshold, it may, for example, return to step S103 and restart the process, or it may have the user on the user terminal 200 modify the proposed analysis code and then proceed to the process in step S110.

[0073] The code formatting unit 113 generates an analysis code (S110) by formatting the proposed analysis code received in step S108 based on the changes from the verification data 130 (records extracted in step S102) to the pseudo-data 800. As described above, the proposed analysis code is a code for analyzing the pseudo-data 800 according to the pseudo-analysis specifications, so the proposed analysis code may contain descriptions specific to the pseudo-data 800 that are not included in the verification data 130. Therefore, in step S108, the code formatting unit 113 formats the proposed analysis code to be suitable for the verification data 130 and the (non-pseudo) analysis specifications.

[0074] Specifically, for example, the code formatting unit 113 generates the analysis code by converting descriptions included in the draft analysis code, such as descriptions related to the number of samples, descriptions whose values ​​were converted when the pseudo-data 800 was generated (drug names and treatment names), and descriptions whose item names were converted when the pseudo-data 800 was generated (mutation names, etc.), back to the descriptions in the verification data 130 according to the changes from the verification data 130 to the pseudo-data 800.

[0075] Furthermore, the pseudo-data generation unit 121 may generate a dictionary that shows the correspondence between the content converted from the verification data 130 to the pseudo-data 800 when generating the pseudo-data 800. In this case, the code formatting unit 113 generates the analysis code by converting the proposed analysis code back to the description in the verification data 130 according to the dictionary.

[0076] Furthermore, the code formatting unit 113 may output the analysis code from the first language model 111 by inputting a prompt instructing the generation of the analysis code, verification data 130, pseudo-data 800, and a draft analysis code into the first language model 111. The prompt instructing the creation of the analysis code may include, for example, instructions to extract the changes from the verification data 130 to the pseudo-data 800, and to change the description in the draft analysis code that is suitable only for the pseudo-data 800 to a description that is suitable for the verification data 130, according to the extracted changes.

[0077] The GUI generation unit 140 may also display an analysis code display screen 1000, which displays the analysis code formatted by the code formatting unit 113, on the output device 204 of the user terminal 200.

[0078] Figure 10 shows an example of the screen configuration of the analysis code display screen 1000. The analysis code display screen 1000 includes, for example, a display area 1001 and a button 1002. The display area 1001 displays the analysis code formatted by the code formatting unit 113. In addition, it may be possible to edit the analysis code in the display area 1001 via input from the user to the input device 203 of the user terminal 200. When button 1002 is selected, the application 210 transmits the analysis code written in the display area 1001 to the sensitive data analysis support device 100, and the analysis code is determined.

[0079] Returning to the explanation of Figure 4A, the sensitive data analysis support device 100 may perform a process after the process of step S110 to store the clinical question input in step S101, the analysis specification formulated in step S103, and the analysis code generated in step S110 in the auxiliary storage device included in the storage device 102, in association with each other. By accumulating the clinical question, analysis specification, and analysis code in association with each other, the sensitive data analysis support device 100 can obtain an analysis code to resolve a clinical question similar to one that has been accumulated, without requiring the external server 300 to generate a draft analysis code, that is, it can reduce the opportunity for the external server 300 to generate a draft analysis code.

[0080] We will now proceed to the explanation of Figure 4B. Following step S110, the analysis execution unit 122 analyzes the verification data 130 using the analysis code generated in step S110 to obtain the analysis result (S111). The confirmation item extraction unit 115 inputs the analysis result obtained in step S111 and a prompt instructing a summary of the analysis result obtained in step S111 to the first language model 111, and obtains the summary of the analysis result from the first language model 111 (S112).

[0081] The GUI generation unit 140 may also display a summary result display screen 1100, which displays the analysis results including the summary results generated by the confirmation item extraction unit 115, on the output device 204 of the user terminal 200.

[0082] Figure 11 shows an example of the screen configuration of the summary result display screen 1100. The summary result display screen 1100 includes, for example, a display area 1101, a display area 1102, a display area 1103, and a button 1104.

[0083] Display area 1101 displays information indicating the verification data 130 that was analyzed. Display area 1102 displays the specified clinical question in PICO / PECO format. Display area 1103 displays the summary results obtained in step S112. Alternatively, the analysis results obtained in step S111 (results before summarization) may be displayed in display area 1103. When button 1104 is selected, application 210 instructs the execution of the process in step S113, which will be described later.

[0084] Returning to the explanation of Figure 4B, the confirmation item extraction unit 115 extracts confirmation items from the summary result obtained in step S112 (S113). Specifically, for example, the GUI generation unit 140 displays an input screen on the output device 204 of the user terminal 200 for receiving input of confirmation items related to the summary result, and the application 210 acquires the confirmation items through user input via the input device 203 on the input screen and transmits them to the sensitive data analysis support device 100, thereby extracting the confirmation items. Alternatively, for example, the confirmation item extraction unit 115 may extract the extraction of literature similar to the summary result obtained in step S112 as a confirmation item. Alternatively, for example, the confirmation item extraction unit 115 may input the summary result and a prompt instructing to extract important items to be confirmed from the summary result to the first language model 111, thereby causing the first language model 111 to output the confirmation items.

[0085] The external server linkage unit 123 sends a prompt to the external server 300 requesting the extraction of information regarding the confirmation items extracted in step S113 (S114). The external server linkage unit 123 may also send the summary results to the external server 300 in step S114.

[0086] The related information extraction unit 313 of the external server 300 inputs the prompt (and summary result) received in step S114 into the second language model 311, searches for and extracts related information, which is information related to the confirmation items, from the second language model 311, and transmits the extracted related information to the sensitive data analysis support device 100 (S115).

[0087] Furthermore, RAG may be used for searching and extracting related information in step S115. Specifically, for example, the related information extraction unit 313 searches the medical knowledge data 420 for information related to the prompt received in step S114, inputs the acquired information into the second language model 311 in addition to the prompt (and summary result) received in step S114, and obtains related information generated by having the second language model 311 refer to the acquired information.

[0088] The medical knowledge data 420 is data that includes knowledge related to medicine. The medical knowledge data 420 may be stored in an external database accessible by the external server 300, or it may be stored in the storage device 302 of the external server 300.

[0089] The sensitive data analysis support device 100 receives the relevant information transmitted in step S115 (S116). The relevant information supplement unit 116 supplements the received relevant information with the summary result (S117), and the GUI generation unit 140 displays the analysis result display screen 1200, which displays the summary result with the relevant information supplemented with the summary result, on the output device 204 of the user terminal 200 (S118), and ends the sensitive data analysis process.

[0090] Figure 12 shows an example of the screen configuration of the analysis results display screen 1200. The analysis results display screen 1200 includes, for example, a display area 1201, a display area 1202, a display area 1203, and a button 1204.

[0091] Display area 1201 displays information indicating the validation data 130 that was analyzed. Display area 1202 displays the specified clinical question in PICO / PECO format. Display area 1203 displays the summary result obtained in step S112 and the related information supplemented in step S117 (the statement, "Furthermore, mutation Z has been suggested to be associated with adverse events such as CCC and DDD in drugs A and B as well [References 1, 2, 3]"). Alternatively, the analysis result obtained in step S111 (results before summarization) may be displayed in display area 1203. When button 1204 is selected, application 210 returns to step S101, for example, and restarts the process.

[0092] In the sensitive data analysis support system of this embodiment, the sensitive data analysis support device 100 having a first language model 111 generates an analysis specification, pseudo-data 800 obtained by removing personally identifiable information from the verification data 130, and a pseudo-analysis specification obtained by removing sensitive data from the analysis specification, based on the clinical question and verification data 130. The external server 300 having a second language model 311 which is more powerful than the first language model 111 generates a draft analysis code using the pseudo-analysis specification and the pseudo-data 800. Thus, although the verification data 130 containing sensitive data is used by the sensitive data analysis support device 100 having the first language model 111, the external server 300 having the high-performance second language model 311 does not use the verification data 130 but uses the pseudo-data 800 to format the draft analysis code.

[0093] The sensitive data analysis support device 100 then evaluates whether the proposed analysis code conforms to the simulated analysis specifications, and generates an analysis code by formatting the proposed analysis code to match the verification data 130, and analyzes the verification data 130 according to the analysis code.

[0094] Through the above-described process, the sensitive data analysis support system reduces the risk of sensitive data linked to personal information leaking outside the sensitive data analysis support device 100, and enables advanced data analysis using analysis codes based on analysis code drafts generated by the high-performance second language model 311.

[0095] Furthermore, in the sensitive data analysis support system of this embodiment, the sensitive data analysis support device 100 extracts confirmation points from the summary of the analysis results, and the external server 300 uses a high-performance second language model 311 to extract relevant information related to the confirmation points and returns it to the sensitive data analysis support device 100.

[0096] Through the processing described above, the sensitive data analysis support system reduces the risk of sensitive data linked to personal information being leaked outside the sensitive data analysis support device 100, and can extract relevant information related to the summary of the analysis results using the high-performance second language model 311.

[0097] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is also possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0098] Furthermore, each of the above configurations, functions, processing units, processing means, etc., may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations, functions, etc., may be implemented in software by having the processor interpret and execute programs that realize each function. Information such as programs, tables, and files that realize each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0099] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected.

Claims

1. A sensitive data analysis support device comprising a processor and a storage device, wherein the storage device holds a first language model, a clinical question, and verification data for verifying the clinical question, which includes information about the patient's case including personally identifiable data and sensitive data, the processor extracts data from the verification data that indicates a case related to the clinical question using the first language model, generates pseudo-data from the extracted data based on a predetermined algorithm that is statistically similar to the extracted data and has lower personal identifiability than the extracted data, generates an analysis specification for an analysis to verify the clinical question using the verification data based on the clinical question and the verification data, generates a pseudo-analysis specification which is formatted for the pseudo-data from the analysis specification, and transmits the pseudo-analysis specification and the pseudo-data to a server having a second language model. A sensitive data analysis support device that receives a draft source code from the server, which is output from the second language model when the pseudo-analysis specifications and the pseudo-data are input to the second language model, a draft source code for an analysis program on the pseudo-data according to the pseudo-analysis specifications, and generates formatted source code by formatting the draft source code for analysis on the extracted data according to the analysis specifications, analyzes the extracted data using the formatted source code, and outputs information indicating the analysis results for the extracted data.

2. A sensitive data analysis support device according to claim 1, wherein the analysis specification and the pseudo-analysis specification include an output template of the expected analysis result, the processor analyzes the pseudo-data using the source code draft, evaluates the consistency based on a comparison result between the analysis result of the pseudo-data and the output template included in the pseudo-analysis specification, and determines whether to generate the formatted source code based on the consistency evaluation result.

3. A sensitive data analysis support device according to claim 1, wherein the processor performs the generation of pseudo-data from the extracted data using the first language model, GAN (Generative Adversarial Network), anonymization, or pseudonym processing.

4. A sensitive data analysis support device according to claim 1, wherein the processor generates the formatted source code by formatting the draft source code based on the changes from the extracted data to the pseudo-data.

5. A sensitive data analysis support device according to claim 1, wherein the processor performs sampling using a predetermined algorithm in which the statistical properties of the extracted data and the pseudo-data are similar in the generation of pseudo-data, and modifies the number of samples indicated in the draft source code based on the number of samples of the extracted data in the generation of formatted source code.

6. A sensitive data analysis support device according to claim 1, wherein the processor inputs the analysis results to the first language model and outputs a summary of the analysis results, obtains confirmation items for the summary and transmits them to the server, receives from the server related information for the confirmation items output from the second language model when the confirmation items are input to the second language model, and outputs information indicating the related information.

7. A sensitive data analysis support device according to claim 1, wherein the processor outputs information indicating the pseudo-data.

8. A sensitive data analysis support device according to claim 1, wherein the processor outputs information indicating the pseudo-analysis specifications.

9. A method for supporting sensitive data analysis using a sensitive data analysis support device, wherein the sensitive data analysis support device comprises a processor and a memory device, the memory device holds a first language model, a clinical question, and verification data for verifying the clinical question, which includes information about the patient's case including personally identifiable data and sensitive data, the sensitive data analysis support method comprises, the processor using the first language model to extract data from the verification data indicating a case related to the clinical question, the processor generating pseudo-data from the extracted data based on a predetermined algorithm that is statistically similar to the extracted data and has reduced personally identifiable properties than the extracted data, the processor generating an analysis specification for an analysis to verify the clinical question using the verification data based on the clinical question and the verification data, and the processor generating a pseudo-analysis specification by formatting the analysis specification for the pseudo-data. A method for supporting sensitive data analysis, comprising: a processor transmitting the pseudo-analysis specifications and the pseudo-data to a server having a second language model; the processor receiving from the server a draft source code for an analysis program on the pseudo-data based on the pseudo-analysis specifications, which is output from the second language model after the pseudo-analysis specifications and the pseudo-data are input to the second language model; the processor generating formatted source code by formatting the draft source code for analysis of the extracted data based on the analysis specifications; the processor analyzing the extracted data using the formatted source code; and the processor outputting information indicating the analysis results for the extracted data.

Images