## 3 Materials and Methods
### Proof of Security  
To further demonstrate the reliability of the proposed mechanism in terms of privacy protection, mathematical proof and relevant formulas are provided below. The core idea of the user attention mechanism is to introduce user privacy weights into the self-attention mechanism, allowing the attention computation to be dynamically adjusted based on the sensitivity of the data. Specifically, user privacy weights \(\alpha\) are introduced into the attention computation. To prove the reliability of this mechanism in terms of privacy protection, it is essential to ensure that by adding the privacy weights \(\alpha\), the sensitive information of users can be effectively protected. Assume the input data \(X\) contain sensitive information and non-sensitive information, which are denoted as \(X_{s}\) and \(X_{n}\), respectively. The elements of the user privacy weight matrix \(\alpha\) are set according to the sensitivity of the data, i.e.,  
Figure 4: Detail of user attention.  
represents the privacy weights for sensitive information, and \(\alpha_{n}\) represents the privacy weights for non-sensitive information. In the attention score computation, the user privacy weights \(\alpha\) are added to \(QK^{T}\), making the positions of sensitive data receive higher attention, providing these data with more protection during model processing. Due to the presence of \(\alpha_{s}\), sensitive information \(X_{s}\) is given higher weights in the attention score computation, receiving more protection during the model processing. This implies that the positions of sensitive data are highlighted during computation, reducing the risk of their exposure. To further enhance privacy protection, Gaussian noise \(\mathcal{N}(0,\sigma^{2})\) is added during the update of model parameters \(\theta\), making the updated parameters \(\theta^{\prime}\) computed as follows:  
\[\theta^{\prime}=\theta+\mathcal{N}(0,\sigma^{2}) \tag{21}\]  
where \(\mathcal{N}(0,\sigma^{2})\) represents Gaussian noise with a mean of 0 and a variance of \(\sigma^{2}\). This approach effectively prevents user data from being leaked during training and inference processes. The core idea is to add noise so that the influence of any single data point becomes indiscernible in the statistical results, thus protecting user privacy. The security proof is as follows: For any two adjacent datasets \(D\) and \(D^{\prime}\) (i.e., \(D\) and \(D^{\prime}\) differ by only one data point), the outputs of algorithm \(\mathcal{A}\) on \(D\) and \(D^{\prime}\) are \(\mathcal{A}(D)\) and \(\mathcal{A}(D^{\prime})\), respectively. If the following inequality holds for any output \(O\),  
\[\Pr[\mathcal{A}(D)=O]\leq e^{\epsilon}\Pr[\mathcal{A}(D^{\prime})=O] \tag{22}\]  
where \(\epsilon\) is the privacy parameter, indicating the strength of privacy protection. By adding noise \(\mathcal{N}(0,\sigma^{2})\), it is ensured that small changes in the input data do not significantly affect the output result, thus achieving privacy protection. Through the above process, our method can dynamically adjust attention weights during data processing, ensuring that sensitive information is effectively protected during computation. Additionally, by adding noise during parameter updates, the risk of data leakage is further reduced.