Additive and subtractive noise for privacy protection

Abstract

This disclosure relates to protecting user privacy using additive and subtractive noise. In one aspect, the method includes obtaining a first set of real user group identifiers, the first set of real user group identifiers identifying user groups that include the user as a member. A second set of user group identifiers for the user is generated by removing zero or more real user group identifiers from the first set to generate a second set, and by adding one or more spurious user group identifiers that do not include the user as a member to the second set. A probabilistic data structure is generated based on the second set of user group identifiers. The probabilistic data structure is transmitted to a receiving computing system. Data indicating a set of digital components is received, the set of digital components including at least one digital component selected based on the probabilistic data structure. The given digital components are presented.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to IL application No. 277642, filed on September 29, 2020. The entire contents of the aforementioned application are incorporated herein by reference. Background Technology

[0003] This specification generally relates to data processing and the use of additive and subtractive noise to protect user privacy when analyzing user data to improve user experience.

[0004] Differential privacy forms the basis of many privacy-preserving efforts and has gained popularity in recent years due to the numerous theoretical guarantees it provides. Generally, differential privacy involves techniques for sharing useful information about a dataset while protecting the privacy of individuals within that dataset. Summary of the Invention

[0005] This specification describes techniques related to protecting user privacy when analyzing user data to improve user experience. Generally, one inventive aspect of the subject matter described herein can be implemented in a method comprising: obtaining a first set of real user group identifiers, the real user group identifiers identifying user groups including the user as a member; generating a second set of user group identifiers for the user based on the first set of real user group identifiers; generating the second set of user group identifiers by removing zero or more real user group identifiers from the first set of user group identifiers; adding one or more dummy user group identifiers that do not include user groups as members to the second set of user group identifiers; generating a probabilistic data structure based on the second set of user group identifiers; transmitting the probabilistic data structure to a receiving computing system; receiving data indicating a set of digital components, the set of digital components including at least one digital component selected based on the probabilistic data structure; selecting a given digital component from the set of digital components; and presenting the given digital component. Other implementations of this aspect include computer programs encoded on corresponding devices, systems, and computer storage devices configured to perform aspects of the method.

[0006] These and other implementations may each optionally include one or more of the following features. In some aspects, removing zero or more real user group identifiers from the first set of user group identifiers includes removing multiple real user group identifiers from the first set of user group identifiers. In some aspects, the set of digital components includes one or more additional digital components not selected based on a probabilistic data structure.

[0007] In some aspects, selecting a given digital component from the set of digital components includes generating a subset of filtered digital components by filtering one or more digital components from the set of digital components that do not have a corresponding user group identifier that matches one of the real user identifiers; and selecting the given digital component from the subset of filtered digital components.

[0008] In some aspects, filtering from the set of digital components that do not have a corresponding user group identifier matching one of the real user group identifiers may include identifying one or more corresponding user group identifiers for the digital component in data indicating the set of digital components, each corresponding user identifier being a user group identifier used to select the digital component included in the set of digital components. Some aspects may include comparing each corresponding user identifier with real user group identifiers in a first set of user group identifiers; and removing from the set of digital components each digital component that does not have a corresponding user group identifier matching one of the real user group identifiers in the first set of user group identifiers.

[0009] In some aspects, the data indicating the set of digital components includes data identifying first digital components, each having one or more corresponding user group identifiers, and data identifying one or more second digital components that do not have any corresponding user group identifiers. Selecting a given digital component from the set of digital components may include removing each first digital component from the set of digital components, wherein none of the corresponding user group identifiers of the first digital component matches a real user group identifier.

[0010] In some aspects, selecting a given digital component from the set of digital components includes selecting a second digital component when all first digital components are removed from the set of digital components.

[0011] In some aspects, the receiver computing system selects a subset of user groups from multiple user groups based on a probabilistic data structure, and selects a set of digital components corresponding to the subset of user groups. In some aspects, the probabilistic data structure includes a Bloom filter or a Cuckoo filter.

[0012] In some aspects, removing one or more real user group identifiers from the first set of user group identifiers includes randomly or pseudo-randomly selecting one or more real user group identifiers, and adding one or more fake user group identifiers to the second set of group identifiers includes randomly or pseudo-randomly selecting one or more fake user group identifiers.

[0013] In some respects, each real user identifier is based on a combination of: (i) a domain that creates the entity of the user group identified by the real user group identifier, and (ii) a unique identifier of the user group identified by the real user group identifier.

[0014] In some respects, each real user group identifier is a message authentication code generated based on a combination of a domain and a unique identifier.

[0015] In some aspects, generating a probabilistic data structure based on a second set of group identifiers includes: generating a hash output for each user group identifier, the hash output having a uniform distribution across all user group identifiers; and generating a probabilistic data structure including the hash output for each user group identifier in the second set of group identifiers.

[0016] Generally, user experience is improved when content platforms provide digital components or other content based on users' group membership data. For example, in response to a user's interaction with an e-resource associated with a specific category, the user can be added to a user group for that category, thereby providing the user with digital components associated with that category. This information can be stored on the user's device to protect the user's privacy regarding group membership. If this information is unavailable, the content platform must evaluate digital components for user groups that do not include the user as a member. For example, the content platform can evaluate digital components for all its user groups and provide digital components to at least some of these groups without knowing whether the user is actually a member of any of them. The application on the user's device can evaluate each received digital component to determine if it is associated with a user group in which the user is a member and ignore digital components that do not have this association. To mitigate the wasteful computational burden of evaluating digital components unrelated to the user's group membership, the user's group membership can be provided to the content platform. However, this membership data is typically private to the user and would allow the content platform to track users by using membership data sent in each request as a user fingerprint.

[0017] The subject matter described herein can be implemented in specific embodiments to achieve one or more of the following advantages. For multiple requests sent by a user's client device, the application can modify the user's group membership list to add and remove user group identifiers, such that the modified list provided to the content platform differs for each request, thereby providing differential privacy to prevent the content platform from tracking the user by using a list identical to the user's fingerprint. By providing data that identifies user groups in which the user is a member, the content platform can save computational resources by selecting digital components for the user based on their group membership; otherwise, these computational resources would be wasted on evaluating digital components in user groups in which the user is not a member. The computational resources of the client device are also saved by not having to evaluate digital components in user groups in which the user is not a member. By making the actual user group membership information available and adding and subtracting user group identifiers for differential privacy, the search space for matching user group identifiers is much smaller, thereby saving computation at the content platform and reducing the number of digital components transmitted over the network and stored on the client device.

[0018] Data identifying a user's user group identifiers can be encoded in a probabilistic data structure that protects user privacy by not sharing the plaintext values ​​of all user group identifiers for the user, resulting in a smaller data size. This smaller data size reduces network bandwidth consumption, increases transmission speed, reduces the computational resources required to receive and process data, and lowers the data storage requirements for storing user group membership data. By configuring the parameters of the probabilistic data structure to have a small (e.g., 1%) false positive rate, a small number of user groups that do not include the user as a member and are evaluated by the content platform, computational savings are achieved at the content platform and client devices, and the amount of bandwidth consumed by sending digital components from user groups that do not include the user as a member is reduced. The systems and techniques described in this document enable the requesting and distribution of digital components without identifying the requester, thereby making the system more secure. For example, this can prevent the requester from being targeted because their identity is unknown.

[0019] The various features and advantages of the foregoing subject matter are described below with reference to the accompanying drawings. Additional features and advantages will be apparent from the subject matter described herein and from the claims. Attached Figure Description

[0020] Figure 1 This is a block diagram of the environment in which content is distributed to client devices.

[0021] Figure 2 This is a swimlane diagram of an example process used to associate users with user groups.

[0022] Figure 3This is a swimlane diagram for an example process of requesting and receiving digital components based on user groups.

[0023] Figure 4 This is a flowchart illustrating an example process for generating probabilistic data structures.

[0024] Figure 5 This is a block diagram of an example computer system.

[0025] Similar reference numerals and labels in the various figures indicate similar elements. Detailed Implementation

[0026] Generally, this document addresses protecting user privacy when analyzing user data to improve user experience. This enables the use of differential privacy techniques to share confidential information with content platforms, thereby maintaining user anonymity while reducing the computational burden on platforms when evaluating digital components of user groups that do not include the user as a member.

[0027] Figure 1 This is a block diagram of an environment 100 that distributes content to client device 110. Example environment 100 includes a data communication network 105, such as a local area network (LAN), wide area network (WAN), Internet, mobile network, or a combination thereof. Network 105 connects client device 110, demand-side platform (DSP) 150, supplier-side platform (SSP) 170, publisher 140, and website 142. Example environment 100 may include many different client devices 110, DSP 150, SSP 170, publisher 140, and website 142.

[0028] Client device 110 is an electronic device capable of communicating via network 105. Example client device 110 includes a personal computer, a mobile communication device such as a smartphone, and other devices capable of sending and receiving data via network 105. The client device may also include a digital assistant device that accepts audio input via a microphone and outputs audio via a speaker. When the digital assistant detects a “hot word” or “hot phrase” that activates the microphone to accept audio input, it can be placed into listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant can be implemented using various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. The client device may also include digital media devices, such as streaming devices that plug into a television or other display to stream video to the television.

[0029] Client device 110 typically includes an application 112, such as a web browser and / or a native application, to facilitate the sending and receiving of data over network 105. A native application is an application developed for a specific platform or device (e.g., a mobile device with a specific operating system). Publisher 140 may develop and provide, for example, downloadable native applications to client device 110. For example, in response to a user of client device 110 entering a resource address for resource 145 in the address bar of a web browser or selecting a link referencing that resource address, the web browser can request resource 145 from a web server hosting website 142 of publisher 140. Similarly, a native application can request application content from a publisher's remote server.

[0030] Some resources, application pages, or other application content may include digital component slots for presenting digital components using resource 145 or application pages. A digital component slot may be a digital component tag embedded in the resource, and the digital component tag includes computer-readable code for requesting the digital component. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). Digital components may be stored electronically as a single file in a physical storage device or electronically in a collection of files, and digital components may take the form of video files, audio files, multimedia files, image files, or text files and include advertising information, such that advertising is a type of digital component. For example, a digital component may be content designed to complement the content of a webpage or other resource presented by application 112. More specifically, a digital component may include digital content related to the resource content (e.g., a digital component may be related to the same topic as, or a related topic to, the webpage content). Therefore, providing digital components can complement and generally enhance webpage or application content.

[0031] When application 112 loads a resource (or application content) that includes one or more digital component slots, application 112 may request a digital component for each slot. In some implementations, the digital component slot may include code (e.g., a script) that causes application 112 to request a digital component to be presented to the user of client device 110.

[0032] Some publishers 140 use SSP 170 to manage the process of acquiring digital components for their resources and / or applications' digital component slots. SSP 170 is a technology platform implemented in hardware and / or software that automates the process of acquiring digital components for resources and / or applications. SSP 170 can interact with one or more DSPs 150 to obtain information that can be used to select digital components for digital component slots. As described in more detail below, this information may include selection parameters indicating the number of digital components that digital component provider 160 is willing to provide to publishers 140 for presentation by digital component provider 160. Each publisher 140 may have a corresponding SSP 170 or multiple SSPs 170. Multiple publishers 140 may use the same SSP 170.

[0033] Digital component provider 160 may create (or otherwise publish) digital components rendered in digital component slots within the publisher's resources and applications. Digital component provider 160 may use DSP 150 to manage the supply of its digital components for rendering in digital component slots. DSP 150 is a technology platform implemented in hardware and / or software that automates the process of distributing digital components for rendering to utilize resources and / or applications. DSP 150 may interact on behalf of digital component provider 160 with multiple SSPs 170 to provide digital components for rendering to utilize the resources and / or applications of multiple different publishers 140. Generally, DSP 150 may (e.g., directly or via exchange from SSP 170) receive requests for digital components, generate (or select) selection parameters for one or more digital components created by one or more digital component providers based on the requests, and provide data related to the digital components (e.g., the digital components themselves) and the selection parameters to SSP 170.

[0034] In some cases, receiving digital components associated with web pages, application pages, or other electronic resources previously accessed and / or previously interacted with by the user is beneficial to the user. To distribute such digital components to users, users can be assigned to user groups when they access a specific resource or perform a specific action at that resource (e.g., interacting with a specific item presented on a web page or adding an item to a virtual shopping cart). For example, if a user of a device searches for shoes and visits multiple web pages from different shoe manufacturers, the browser can add the user to a user group, such as "shoes," and store a corresponding user group identifier for the "shoes" user group on the client device. Thus, user groups can represent a user's interests. User groups can be generated by digital component provider 160 and identified by the user group identifier. That is, when a user accesses an electronic resource of digital component provider 160, each digital component provider 160 can assign the user to their user group. For example, if a user adds shoes to an online retailer's shopping cart, the retailer can add the user to the shoes user group. Users can be assigned to multiple user groups from multiple different digital component providers.

[0035] To protect user privacy, user group memberships may be maintained at the user's client device 110, for example by one of the applications 112 or the operating system of the client device 110, rather than by the digital component provider 160, content platform, or another party. In a particular example, application 112 may maintain a list of user group identifiers ("user group list") 114 for the user. User group list 114 may include group identifiers for each user group to which the user has been added. The digital component provider 160 that creates user groups may assign user group identifiers to their user groups. The user group identifiers may describe the group (e.g., a gardening group) or represent the group using codes (e.g., a non-descriptive alphanumeric sequence). The user group list 114 may be stored in secure storage at the client device 110 and / or may be encrypted at the time of storage.

[0036] The user group identifier actually assigned to a user is called the real group identifier. In some implementations, each user group identifier is based on a combination of: (i) a resource locator (e.g., domain, URL, or eTLD+1) of the entity (e.g., digital component provider 160 or DSP 150) that creates and / or manages the user group identified by the user group identifier, and (ii) a unique identifier for the user group identified by the user group identifier. For example, a digital component provider might have a website example.com and a "shoes" user group with the identifier "shoes". In this example, the user group identifier used in environment 100, for example by application 112, SSP 170, and DSP 150, could be a combination of "example.com" and "shoes" or based on this combination.

[0037] As mentioned above, an entity's resource locator can be the eTLD+1 of the entity domain that created or manages user groups. eTLD+1 is the valid top-level domain (eTLD) plus one more level than the public suffix. An example eTLD+1 is "example.com", where ".com" is the top-level domain.

[0038] In an environment with multiple digital component providers 160, each digital component provider 160 can access or maintain multiple user groups, and each user can be a member of multiple user groups. For example, a clothing distributor can have user groups for each type of clothing, and a user can be a member of one or more clothing groups of the clothing distributor, or a member of a gardening group of a home decorating company. In some implementations, a hash function can be used to generate a hash output for (i) the resource locator of the entity that created the user group (e.g., a digital component provider) and (ii) a unique identifier of the user group identified by the entity. The result of this hash function can be a user group identifier for the group used in environment 100. In other examples, other information specific to the entity that created the user group can be used instead of the resource locator.

[0039] For example, suppose "example.com" is a domain of a digital component provider, and UG_ID is a unique group identifier for a specific user group identified by digital component provider 160. Application 112 can use a cryptographic function to generate a user group identifier based on the resource locator and the unique group identifier. The function can be a pseudo-random function, such as a Key Hash Message Authentication Code (HMAC) implemented using a secure hash algorithm (SHA256) to generate a 256-bit (32-byte) hash output, where the secure hash algorithm is a cryptographic hash function with a digest length of 256 bits. In this example, HMAC(UG_ID, example.com) generates a 256-bit unique identifier for the user group as the user group identifier.

[0040] By using hash functions to determine user group identifiers, it is computationally impossible for the recipient of the user group identifier to identify the entity that created / manages the user group or for the user group to have a unique identifier without additional information. Therefore, if another entity receives a user's user group identifier, the hash function method protects the entity's confidential information (e.g., the number of start, stop, and ongoing digital component activities). Hash functions also protect user privacy by preventing such entities from determining the user's full group membership.

[0041] When application 112 presents resources or application content related to web pages on digital component provider 160 or website 142, the resource may request application 112 to add one or more user group identifiers to the user's user group list. In response, application 112 may add one or more user group identifiers to user group list 114 and securely store the user group list. (See reference...) Figure 2 Further explanation.

[0042] To obtain, for example, a digital component in the digital component slot for presentation utilizing the electronic resources of publisher 140, application 112 may submit a request to publisher 140 to SSP 170. This request may include the user's user group identifier, such as the user group identifier included in user group list 114. In some implementations, application 112 may send the plaintext value of the user group identifier. However, this would provide the recipient of the list with the user's entire user group membership and enable the recipient to track the user based on multiple requests to the user.

[0043] To protect user privacy, application 112 may apply noise (e.g., differential privacy noise) to a user's user group identifier before providing it to SSP 170. As described below, this may include removing one or more real user group identifiers for user groups to which the user is actually a member. This may also include adding one or more dummy user group identifiers, which may not represent any actual user group (e.g., just random identifiers) or may be identifiers of actual user groups to which the user is not a member. This protects user privacy by preventing the recipient from knowing the user's entire group membership data, and prevents the recipient from tracking the user based on their group membership if the user group identifiers added to and removed from the list provided to SSP 170 differ for different requests, as the lists they receive may vary.

[0044] Additionally, application 112 can generate probabilistic data structures, such as Bloom filters or Cuckoo filters, based on user group identifiers in user group list 114. For example, after applying differential privacy techniques to user group list 114, application 112 can generate probabilistic data structures based on the list of user identifiers. This protects user privacy by preventing the recipient from obtaining the user's entire group membership data and reduces the size of the user group data, thus providing performance advantages as described above.

[0045] SSP 170 can receive requests and submit them to one or more DSPs 150. These requests sent to DSPs 150 may also include a user group identifier. DSPs 150 can select one or more digital components for a user based on one or more user groups and provide selection parameters for the digital components to SSP 170. The selection parameters indicate the number of digital components that digital component provider 160 is willing to provide to publisher 140 for presentation. SSP 170 can apply exclusions on behalf of publisher 140 and provide a list of digital components to application 112 based on the selection parameters. Application 112 can select digital components from the list and present the digital components using the electronic resources of publisher 140. Figure 3 The example process for obtaining digital components is explained in the text and described below.

[0046] In some implementations, application 112 may provide a user interface that enables users to manage the user groups to which they are assigned. For example, the user interface may allow users to remove user group identifiers, preventing all or specific resources 145, publishers 140, digital component providers 160, digital component exchanges, and / or DSPs 150 from adding users to user groups (e.g., preventing entities from adding user group identifiers to a list of user group identifiers maintained by application 112). This provides users with greater transparency and control.

[0047] In addition to the descriptions throughout this document, users may be equipped with controls that allow them to select whether and when the systems, programs, or features described herein may collect user information (e.g., information about a user's social networks, social behaviors or activities, occupation, user preferences, or the user's current location), and whether the user sends content or communications from a server. Furthermore, some data may be processed in one or more ways before storage or use to remove personally identifiable information. For example, a user's identity may be processed to the point that personally identifiable information about the user cannot be determined, or the user's geographic location may be generalized (e.g., at the city, zip code, or state level) if location information is available, making it impossible to determine the user's specific location. Therefore, users can control what information about themselves is collected, how that information is used, and what information is provided to them.

[0048] Figure 2This is a swimlane diagram illustrating an example procedure 200 for adding one or more user group identifiers to a user's user group list 114. The operation of procedure 200 can be implemented, for example, by a client device 110. The operation of procedure 200 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and the execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of procedure 200. Although this procedure 200 is described according to a web browser downloading a webpage, native applications can be used in similar procedures.

[0049] In this example, a user of client device 110 uses application 112, such as a web browser, to access website 142 of digital component provider 160 hosted on a web server. To access website 142, client device 110 may initiate a request to website 142, and the web server hosting website 142 may respond to the request by sending computer-executable instructions and / or data that initiate the presentation of a webpage (or other electronic resource) at client device 110.

[0050] The webpage may include computer-executable code, such as scripts, that prompts the web browser on client device 110 to join a given user group, such as a user group related to the webpage content, or an interaction between the user and the webpage or website 142. For example, suppose website 142 is a footwear e-commerce website. After navigating to website 142, a webpage downloaded from website 142 may prompt the user on client device 110 to join the user group “Shoes”. The web browser’s user interface may further enable the user to respond to the prompt and allow the user to accept or decline the request to join the user group “Shoes”. If the user on client device 110 accepts the request to join the user group, the web browser stores the corresponding user group identifier on client device 110. In another example, for example, if the user enables this function, the web browser may add the user to the user group without prompting the user. Example process 200 is further explained below.

[0051] In this example, the digital component provider 160, which provides digital components for presentation using resources from other publishers based on user group membership, is also a website publisher. For example, the digital component provider 160 may have a website that includes content related to its products or services, and may also wish to present digital components related to its products or services on websites with other content (e.g., news websites).

[0052] A user of client device 110 navigates to network 142 (202) of digital component provider 160. For example, the user of client device 110 can access website 142 using a browser by specifying a reference (e.g., a URL). In another example, the user of client device 110 submits a search query to a search system using a web browser, which identifies a website by crawling and indexing it (e.g., indexing based on crawled content). In response, the search system identifies the website in the form of search results and returns the search results to client device 110 in a search results page. The search results are data generated by the search system that identifies websites in response to a specific search query (e.g., related to a specific search query) and includes active links (e.g., hypertext links) that cause client device 110 to request data from a specified location, such as a web server, in response to user interaction with the search results. Example search results may include a website title, a text snippet or portion of an image extracted from the website, and the website's URL. After viewing the search results, the user of client device 110 can select and / or click on the search results corresponding to website 142.

[0053] Client device 110 generates a request for content from website 142 and transmits the request to web server (204) via network 105. For example, after a user of client device 110 clicks and / or selects a search result corresponding to website 142, or directly specifies website 142 by using a reference (e.g., a URL), a web browser running on client device 110 generates a request for digital content (e.g., web pages of website 142) and transmits the digital content to web server via network 105.

[0054] Requests for digital content can be transmitted, for example, over a packet network, and the content request itself can be formatted as packet data with a header and payload data. The header can specify the destination of the data packet, while the payload data can include any information discussed above.

[0055] The web server responds (206) with the content of website 142 (e.g., a webpage). For example, after receiving a request for digital content (i.e., website 142) from client device 110, the web server hosting website 142 responds by transmitting machine-executable instructions to initiate the rendering of the webpage at client device 110. The response may include data related to the webpage, for example, transmitted over a packet network, and the content itself may be formatted as packet data.

[0056] Client device 110 presents content to the user (208). After receiving digital content (e.g., a webpage) from a web server, the web browser presents the content to the user. For example, the web browser may use the display of client device 110 to present the webpage to the user.

[0057] Digital component provider 160 requests the web browser of client device 110 to add the user to a user group (210). For example, after transmitting computer-executable instructions to initiate the presentation of data related to website 142, digital component provider 160 (e.g., the web server of digital component provider 160) may prompt the user of client device 110 to join a user group. In another example, the webpage may include computer-executable code, such as a script, that calls the web browser's application programming interface (API) to request the web browser to add the user to a user group.

[0058] In some implementations, digital component provider 160 selects a user group from a plurality of available user groups known to and / or managed by digital component provider 160. In the current example, website 142 is an e-commerce website for purchasing shoes. The web server hosting website 142 may prompt the user of client device 110 to request to join the user group “shoes”. The user interface of the web browser may further enable the user to respond to the prompt and allow the user to accept or reject the request to join the user group “shoes”.

[0059] In some implementations, application 112 (e.g., a web browser) can provide configurable options to the user of client device 110, enabling it to autonomously handle the acceptance and rejection of user groups without user intervention. For example, the user of client device 110 can configure certain options of application 112 so that application 112 can automatically accept user groups when prompted by publisher 140.

[0060] User group identifiers are stored on client device 110 (212). As previously described, each user group is identified by a user group identifier determined by publisher 140. After accepting a request to join a specific user group, the web browser stores the user group identifier corresponding to that specific user group on client device 110. For example, if a user of client device 110 accepts a request to join the user group "Shoes," the web browser stores the user group identifier for "Shoes" on client device 110 after being prompted by the content provider. As described above, the user group identifier can be stored in secure storage on client device 110.

[0061] In some cases, when application 112 loads resources (or application content) that include one or more digital component slots, application 112 may request digital components for each slot. In some implementations, the digital component slot may include code (e.g., a script) that causes application 112 to request digital components from a digital component allocation system that selects and provides the digital components to application 112 for presentation to the user of client device 110.

[0062] Figure 3 This is a swimlane diagram illustrating an example process 300 for requesting and receiving digital components. Operation of process 300 can be implemented, for example, by a client device 110, an SSP 170, one or more DSPs 150, and a publisher 140. Operation of process 300 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 300.

[0063] In this example, a user of client device 110 uses application 112, such as a web browser or a native application, to access electronic resources (e.g., web pages or application pages), which include digital component slots.

[0064] After loading the webpage including the digital component slot, application 112 sends a request for a digital component to the digital component provider based on one or more user groups to which the user of client device 110 is assigned. In some implementations, the request for the digital component is sent to a supplier-side platform (SSP) 170, which is hardware and / or software that automates the process of obtaining digital components for the application.

[0065] The request for the digital component includes a probabilistic data structure, such as a Bloom filter or a Cuckoo filter, generated by the operating system of application 112 or the client device using a first set of user group identifiers stored in client device 110. For example, the first set of user group identifiers may be user group identifiers in a user group list 114 stored on client device 110. In some implementations, the probabilistic data structure is based on a second set of group identifiers generated from the first set of user group identifiers by removing one or more real group identifiers and by adding one or more spurious group identifiers not present in the first set. The probabilistic data structure may be based on a random hash function that generates a hash output for each user group identifier such that the hash output has a uniform distribution across all user group identifiers.

[0066] Upon receiving a request for a digital component, the SSP 170 can interact with one or more digital component providers and / or one or more DSPs 150, which are hardware and / or software-implemented technology platforms that can automate the process of distributing data for application presentation. In some implementations, the SSP 170 can transfer probabilistic data structures to the DSP 150.

[0067] DSP 150 selects one or more digital components from the set of available digital components by filtering out digital components that do not have a corresponding user group identifier that matches one of the user group identifiers represented by the probabilistic data structure. In some implementations, DSP 150 may use the same hash function as application 112 to generate a hash output for each user group identifier associated with each available digital component. In this implementation, the hash output is searched within the probabilistic data structure, and digital components that do not have a corresponding hash value for a user group identifier are filtered out during the selection process.

[0068] DSP 150 can further select digital components (e.g., the top N digital components) by analyzing and scoring each of one or more selected digital components. DSP 150 then transmits the selected digital components to SSP. After receiving the selected digital components from DSP 150, SSP 170 can review and select a set of digital components (e.g., the top K digital components) before providing support for presentation on the client device based on standards and / or conditions set by publisher 140. For example, SSP 170 can review the content and format of the digital components to ensure that it meets various standards, such as excluding specific types of content, meeting data and / or display size requirements, etc. The set of digital components is then sent to application 112 running on client device 110.

[0069] Application 112, executing on client device 110, can select a subset of the digital components to filter after receiving the set of digital components, by filtering out one or more digital components that do not have a corresponding user group identifier that matches a real user identifier in a first set of user group identifiers (e.g., user group identifiers in user group list 114). To filter out one or more digital components from the set of digital components, application 112 identifies one or more corresponding user group identifiers for each digital component in the set of digital components (e.g., in the metadata of the digital components). After identification, application 112 compares each user group identifier of each digital component with a real user group identifier in the first set of user group identifiers to remove digital components that do not have a corresponding user group identifier that matches a real user group identifier in the first set of user group identifiers.

[0070] Finally, the digital components in the filtered subset are analyzed to select a given digital component. After selection, the given digital component is presented on the client device (e.g., presented in a digital component slot).

[0071] A user of client device 110 using application 112 navigates to an electronic resource (302). For example, the user of client device 110 can access website 142 using a browser by specifying a reference (e.g., a URL). In another example, the user of client device 110 can submit a search query to a search system using a web browser, which identifies a website by crawling and indexing it (e.g., indexing based on the crawled content of the website). In response, the search system identifies the website in the form of search results and returns the search results to client device 110 in a search results page. After viewing the search results, the user of client device 110 can select and / or click on the search results corresponding to website 142. In yet another example, the user can launch a native application that requests content from the application's publisher 140.

[0072] Client device 110 generates a request for content and transmits the request to web server (304) via network 105. For example, after a user of client device 110 clicks and / or selects a search result corresponding to website 142, or directly specifies website 142 by using a reference (e.g., URL), application 112, i.e., the web browser running on client device 110, generates a request for digital content (i.e., website 142) and transmits the digital content to web server via network 105.

[0073] Requests for digital content can be transmitted, for example, via packet network 105, and the content request itself can be formatted as packet data with a header and payload data. The header can specify the destination of the data packet, while the payload data can include any information discussed above.

[0074] Publisher 140, such as a web server or content server of publisher 140, responds with content (306). For example, after receiving a request for content (i.e., a request for website 142) from client device 110, the server may respond by transmitting computer-executable instructions and data that initiate the rendering of the webpage at client device 110. The response may include data related to the webpage, for example, transmitted via packet network 105, and the content itself may be formatted as packet data.

[0075] Client device 110 identifies tags (308) of digital components in an electronic resource. After receiving an electronic resource or its content from publisher 140, application 112 may identify one or more tags, such as one or more tags for digital component slots in the electronic resource. For example, a web browser may identify one or more digital component slots in a webpage.

[0076] Client device 110 generates a probabilistic data structure (310). As previously described, the probabilistic data structure may be based on a second set of group identifiers, which is generated from the first set of group identifiers by randomly (or pseudo-randomly) removing real group identifiers from the first set of user group identifiers and by randomly (or pseudo-randomly) adding spurious group identifiers that are not in the first set of real user group identifiers. The probabilistic data structure is based on a random hash function that generates a hash output for each user group identifier such that the hash output has a uniform distribution across all user group identifiers. Example probabilistic data structures include Bloom filters or Cuckoo filters. See below for reference. Figure 4 Describe an example process for generating probabilistic data structures.

[0077] Client device 110 transmits requests for digital components to SSP 170 (312). Client device 110 may send the requests to the computing system of SSP 170, which may also be referred to as the receiving computing system. For example, application 112 may generate one or more requests for digital components based on one or more digital component slots. In a particular example, a web browser may generate requests for digital components based on tags and transmit the requests to SSP 170 via network 105.

[0078] In some implementations, a request for a digital component may include a probability data structure generated by the client device 110 (see reference). Figure 4 (Explanation). For example, web browser application 112 generates a request for a digital component that includes a probabilistic data structure. The probabilistic data structure represents a second set of user group identifiers based on user group identifiers in a user group list 114 associated with a user of client device 110, and the probabilistic data structure transmits the request for the digital component to SSP 170.

[0079] In some implementations, requests for digital components may also include additional data, such as context data. Context data may include, for example, resource locators of resources, such as a Universal Resource Locator (URL) for a webpage or a Universal Resource Identifier (URI) for application content, language (e.g., the language used by the application presenting the content), and / or coarse geographic location information indicating the approximate location of the client device 110.

[0080] Requests for digital components can be transmitted, for example, via packet network 105, and the component request itself can be formatted as packet data with a header and payload data. The header can specify the destination of the data packet, while the payload data can include any information discussed above.

[0081] SSP 170 transmits a request for a digital component to one or more DSPs 150 (314). As described above, digital component provider 160 may use one or more DSPs 150 to automate the process of distributing digital components for leveraging the presentation of an application. Upon receiving a request, SSP 170 may interact with one or more DSPs and transmit a corresponding request for a digital component, which includes a probabilistic data structure and optionally context data.

[0082] DSP 150 filters digital components (316) based on a probabilistic data structure. In some implementations, DSP 150 selects one or more digital components from a set of digital components by filtering out digital components that do not have a corresponding user group identifier that matches one of the user group identifiers in the probabilistic data structure. In such implementations, DSP 150 can generate a hash output for each user group identifier known to DSP 150 using the same hash function as client device 110. In such implementations, DSP 150 can search for each user group identifier known or managed by DSP 150 in the hash output within the probabilistic data structure. DSP 150 can filter each digital component that does not have a corresponding user group identifier, the hash output of which is not found in the probabilistic data structure, from a set of candidate digital components provided in response to a request. For example, at least a portion of a digital component distributed by DSP 150 may have one or more user group identifiers associated with a user group of the digital component. In a particular example, a digital component containing content about a particular pair of shoes may have identifiers for the "shoes" group, the "clothing" group, and the "footwear" group as corresponding user group identifiers.

[0083] This implementation leverages the false positive rate of the probabilistic data structure. As used in this document, the phrase "false positive rate" refers to a value that identifies the expected false positive rate or number of false positives associated with the probabilistic data structure. For example, the false positive rate can be a function of the algorithm and parameters chosen for the probabilistic data structure, as well as the size of the probabilistic data structure. Therefore, these parameters can be adjusted to modify the false positive rate.

[0084] For example, suppose the probabilistic data structure is a Bloom filter with a false positive rate of 1%. Also suppose the DSP 150 knows and manages to provide digital components for one million user groups. Further suppose the user is a member of ten user groups within such a group. This false positive rate can narrow the pool of all user group identifiers known to the DSP 150 to approximately 1% of the total user group identifiers, resulting in a correspondingly smaller number of candidate digital components remaining in the selection process after filtering. For example, there might be ten thousand false positive user group identifiers and ten true positive user group identifiers. This can result in better computational performance and faster response times for the DSP 150, thus improving the user experience, as the DSP 150 does not have to waste time and computational resources evaluating digital components for one million user groups.

[0085] After filtering out digital components based on a probabilistic data structure, DSP 150 selects one or more digital components (318). In some implementations, DSP 150 may further select digital components (e.g., the top N digital components) by analyzing and scoring each of the one or more selected digital components. For example, this scoring may be based on contextual data, the expected performance of the digital component, and / or additional information.

[0086] DSP 150 transmits data of one or more selected digital components to SSP 170 (320). For example, by transmitting one or more selected digital components or data identifying the digital components (e.g., creative elements including instructions for presenting the digital components), DSP 150 can respond to requests for digital components to SSP 170. For each digital component, DSP 150 can also generate or select selection parameters for the digital component. DSP 150 can then transmit the selection parameters and data of the digital components to SSP 170. Each digital component (or its data) may include additional data, such as metadata indicating a user group identifier corresponding to the digital component.

[0087] In some implementations, the DSP 150 may also select one or more digital components based on context data that is independent of the probability data structure and therefore independent of the user's group membership. These digital components may also be referred to as context digital components.

[0088] SSP 170 selects a set of digital components (322). For example, after receiving data from one or more selected digital components from DSP 150, SSP 170 can review and select the set of digital components (e.g., the top K digital components). For example, SSP 170 can review the content and format of the digital components to ensure that it meets various criteria, such as excluding specific types of content, meeting data and / or display size requirements, etc.

[0089] In some implementations, the SSP 170 selects a digital component based at least in part on selection parameters received from the DSP 150. In such implementations, the SSP 170 can select the digital component with the highest selection parameter from the selection parameters received from the DSP 150.

[0090] SSP 170 transmits a set of digital components to client device 110 (324). For example, after selecting the set of digital components (e.g., the first K digital components), SSP 170 transmits the set of digital components (or the data of the digital components) via network 105 to application 112 executing on client device 110. In some implementations, SSP 170 may transmit a set of selection parameters along with the set of digital components.

[0091] In some implementations, the list of digital components transmitted by SSP 170 can be sorted based on selection parameters. This allows application 112 to select digital components without knowing the actual selection parameters. For each digital component, the list of digital components may also include data indicating the user group identifier corresponding to the digital component. This allows application 112 to filter out digital components for which the user is not a member.

[0092] In some implementations, this list includes numeric components selected based on a probabilistic data structure and at least one context numeric component. In a particular implementation, the list may include numeric components selected based on a probabilistic data structure in order of selection parameters (e.g., from high to low), and a context numeric component at the end of the list (e.g., the context numeric component with the highest selection parameter among all context numeric components received from DSP 150). In this way, if none of the numeric components selected based on the probabilistic data structure has a user group identifier that matches the user's real user group identifier, the context numeric component can be selected and presented by application 112.

[0093] Application 112, running on client device 110, selects a subset (326) of the filtered digital components. By filtering out one or more digital components from the set of digital components that do not have a corresponding user group identifier that matches a real user identifier in a first set of user group identifiers, application 112, executing on the client device, can select a subset of the filtered digital components after receiving the set of digital components from SSP 170. For example, to filter out one or more digital components from the set of digital components, application 112 compares each user group identifier of the digital component with, for example, a real user group identifier of a user in user group list 114 stored at client device 110.

[0094] For each digital component, application 112 can compare one or more user group identifiers of the digital component with the user's real user group identifier. If no user group identifier matches, application 112 can filter digital components from the set of digital components. If at least one user group identifier matches, application 112 can keep the digital component in the set of digital components. This filtering may result in the identification of one or more digital components in the set of digital components that do not have a corresponding user group identifier that matches a real user group identifier. The application 112 then generates a filtered subset of digital components by removing one or more identified digital components from the set of digital components.

[0095] Client device 110 selects a given digital component from a filtered subset of digital components (328). In some implementations, application 112 may select a given digital component to be presented in a digital component slot based on selection parameters. For example, website 142 has one digital component slot. The selection process may include selecting the digital component with the highest selection parameter. In some implementations, application 112 may select a given digital component based on non-shared user preferences. For example, a user of web browser application 112 may provide application 112 with a list of curated topics. In this case, application 112 may select a given digital component based on a combination of selection parameters and topics in the curated list. In some implementations, when using an ordered list, application 112 selects the top remaining digital components that survive the filtering in the list.

[0096] Application 112 presents the given digital component (330). For example, application 112 may use the electronic resources of publisher 140 to present the given digital component.

[0097] Figure 4 This is a flowchart illustrating a process 400 for generating a probability data structure based on one or more user groups associated with a user of a client device. The operation of process 400 can be implemented, for example, by the client device 110. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and the execution of these instructions by one or more data processing devices can cause the one or more data processing devices to perform the operation of process 400.

[0098] Obtain the first set (410) of real user group identifiers that identify users as members of user groups. See above for reference. Figure 2The user of client device 110 can be associated with one or more user groups. In other words, a user of client device 110 can be a member of one or more user groups. Each user group is identified by a user group identifier stored on client device 110 to maintain user privacy. For example, application 112, such as a web browser, can maintain a list 114 of user groups including one or more user group identifiers and store the list of user groups on the client device. These one or more user group identifiers form a first set of real user group identifiers that the user is actually a member of.

[0099] Zero or more real user group identifiers are removed from the first set of user group identifiers to generate a second set of user group identifiers (420). In some implementations, the application randomly or pseudo-randomly selects one or more real user group identifiers to remove from the first set of user group identifiers. For example, suppose the user group list 114 maintained by application 112 includes five user group identifiers S1, S2, S3, S4, and S5. It is also assumed that S2 and S5 are randomly selected and removed. In this case, the second set of user group identifiers includes S1, S3, and S4. In some implementations, application 112 may, for example, not remove any real user group identifiers depending on the target privacy level.

[0100] One or more spurious user group identifiers for user groups to which the user is not a member are added to the second set of user group identifiers (430). In some implementations, application 112 randomly or pseudo-randomly selects one or more spurious user groups to add to the second set of user group identifiers. Spurious user group identifiers are used for user groups to which the user is not a member. For example, suppose that the two or more spurious user group identifiers selected include S23 and S27 and the user is not a member of the group corresponding to these user group identifiers. In this case, the second set of user group identifiers would include S1, S3, S4, S23, and S27.

[0101] In some implementations, the spoofed user group identifier does not actually represent a user group at all. For example, application 112 may not know each user group managed by DSP 150. Instead of selecting from user groups where the user is not a member, application 112 can generate spoofed user group identifiers that can be simply random alphanumeric sequences. By adding and removing user group identifiers in this way, application 112 can achieve differential privacy for each user.

[0102] Generate a hash output (440) for each user group identifier in the second set of user group identifiers. Hashes can be generated such that the hash output has a uniform distribution across all user group identifiers. As previously described, a hash function can be used to generate the hash output for each user group identifier in the second set of user group identifiers. For example, application 112 uses a key-hash message verification code (HMAC) (implemented using a secure hash algorithm (SHA256)) to generate a 256-bit (32-byte) output of the hash for each user group identifier in the second set of user group identifiers, the secure hash algorithm being a cryptographic hash function with a digest length of 256 bits.

[0103] A probabilistic data structure (450) is generated, comprising the hash output of each user group identifier in a second set of group identifiers. In some implementations, a probabilistic data structure, such as a Bloom filter or a Cuckoo filter, is used to generate a spatially valid data structure that can be used to transfer information about user group identifiers from client device 110 to SSP 170. For example, suppose a user group list 114 maintained by application 112 includes 200 user group identifiers. The hash output size of a single user group identifier using HMAC-SHA256 would be 256 bits. In this case, the total size of the hash outputs for all 200 user group identifiers in user group list 114 would be 51,200 bits (i.e., 6.4 kB). When using a Bloom filter with a 1% false positive probability, each user group identifier can be represented by fewer than 10 bits. In this case, the 200 user group identifiers in user group list 114 can be represented using 2000 bits (i.e., 250 bytes).

[0104] In some implementations, for each request to a digital component sent by application 112, application 112 generates a new probabilistic data structure. In this way, the data structure is different for each request, based on user group identifiers that are added and removed randomly or pseudo-randomly. This prevents DSP 150 from tracking users based on user group membership. Since the user group identifier of DSP 150 may be removed in some cases, by changing the probabilistic data structure, the user group identifier of DSP 150 may be represented in at least one probabilistic data structure. In some implementations, application 112 generates a new probabilistic data structure for each domain accessed by application 112, but uses the same probabilistic data structure for multiple requests from the same domain.

[0105] Figure 5This is a block diagram of an example computer system 500 that can be used to perform the operations described above. System 500 includes a processor 510, memory 520, storage device 530, and input / output device 540. Each of components 510, 520, 530, and 540 may be interconnected, for example, using a system bus 550. Processor 510 is capable of processing instructions for execution within system 500. In some implementations, processor 510 is a single-threaded processor. In another implementation, processor 510 is a multi-threaded processor. Processor 510 is capable of processing instructions stored in memory 520 or storage device 530.

[0106] Memory 520 stores information within system 500. In one implementation, memory 520 is a computer-readable medium. In some implementations, memory 520 is a volatile memory cell. In another implementation, memory 520 is a non-volatile memory cell.

[0107] Storage device 530 provides mass storage for system 500. In some implementations, storage device 530 is a computer-readable medium. In various implementations, storage device 530 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices on a network (e.g., a cloud storage device), or some other mass storage device.

[0108] Input / output device 540 provides input / output operations for system 500. In some implementations, input / output device 540 may include one or more network interface devices, such as an Ethernet card, a serial communication device, and an RS-232 port, and / or a wireless interface device, and an 802.11 card. In another implementation, the input / output device may include a driver device configured to receive input data and send output data to an external device 560, such as a keyboard, printer, and display device. However, other implementations may also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0109] Although already Figure 5 The example processing system described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware or hardware, including the structures disclosed herein and their equivalents, or a combination thereof.

[0110] Embodiments of the subject matter and operations described in this specification may be implemented in digital electronic circuits, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or a combination thereof. Embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on one or more computer storage media for execution by a data processing device or for controlling the operation of a data processing device. Alternatively or additionally, the program instructions may be encoded on artificially generated propagated signals, such as machine-generated electrical signals, optical signals, or electromagnetic signals, generating said artificially generated propagated signals to encode information transmitted to a suitable receiver device for execution by the data processing device. The computer storage medium may be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination thereof, or may be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination thereof. Furthermore, although the computer storage medium is not a propagated signal, it may be a source or destination of computer program instructions encoded in an artificially generated propagated signal. Computer storage media can also be one or more separate physical components or media (e.g., multiple CDs, disks or other storage devices), or can be included in one or more separate physical components or media.

[0111] The operations described in this specification can be performed by a data processing device on data stored on one or more computer-readable storage devices or received from other sources.

[0112] The term "data processing device" encompasses all kinds of devices, apparatuses, and machines used for processing data, including, for example, programmable processors, computers, systems-on-a-chip (SoCs), or multiple SoCs, or combinations thereof. Devices may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, devices may also include code that creates the execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. Devices and execution environments can implement a variety of different computing model infrastructures, such as network services, distributed computing infrastructures, and grid computing infrastructures.

[0113] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, objects, or other units suitable for a computing environment. A computer program may, but does not necessarily, correspond to a file in a file system. A program may be stored as a portion of a file containing other programs or data (e.g., one or more scripts stored in a markup language document), a single file dedicated to the program in question, or multiple coordinating files (e.g., files storing portions of one or more modules, subroutines, or code). A computer program may be deployed to execute on one computer or on multiple computers located in one location or distributed across multiple locations and interconnected via a communication network.

[0114] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and producing outputs. The processes and logic flows can also be executed by dedicated logic circuitry, and the device can also be implemented as said dedicated logic circuitry, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0115] For example, processors suitable for executing computer programs include both general-purpose microprocessors and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions, and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices (e.g., disks, magneto-optical disks, or optical disks) for storing data, or operatively coupled to receive data from or transfer data to said one or more mass storage devices, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as, to name just a few, a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive). Suitable devices for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0116] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer with a display device, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, to display information to the user, and a keyboard and pointing device, such as a mouse or trackball, through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Additionally, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending web pages to a web browser on the user's client device in response to a request received from a web browser.

[0117] Embodiments of the subject matter described in this specification can be implemented in computing systems that include backend components, such as data servers, or middleware components, such as application servers, or frontend components, such as client computers with graphical user interfaces or web browsers through which users can interact with implementations of the subject matter described in this specification, or any combination of one or more of these backend, middleware, or frontend components. Components of the system can be interconnected via any form or medium of digital data communication, such as a communication network. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), interconnected networks (e.g., the Internet) and peer-to-peer networks (e.g., specific peer-to-peer networks).

[0118] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship is established by means of computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., HTML pages) to a client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0119] Although this specification contains numerous details of specific implementations, these details should not be construed as limiting the scope of any invention or claim, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, individual features described in the context of a single embodiment may also be implemented individually in multiple embodiments or in any suitable sub-combination. Furthermore, although features may be described above as functioning in certain combinations and even initially claimed, one or more features from a claimed combination may be removed from said combination in some cases, and the claimed combination may be for sub-combinations or variations thereof.

[0120] Similarly, although operations are depicted in a specific order in the diagrams, this should not be construed as requiring the execution of such operations in the specific order shown or in sequential order, or performing all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0121] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions described in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily need to be in the specific order shown or in sequential order to achieve the desired result. In some implementations, multitasking and parallel processing can be advantageous.

Claims

1. A computer-implemented method comprising: obtaining a first set of real user group identifiers, the real user group identifiers identifying user groups that include the user as a member; generating a second set of user group identifiers for the user based on the first set of real user group identifiers, the generating comprising: removing zero or more real user group identifiers from the first set of user group identifiers to generate the second set of user group identifiers; and adding one or more false user group identifiers that do not include a user group that includes the user as a member to the second set of user group identifiers; generating a probabilistic data structure based on the second set of user group identifiers; transmitting the probabilistic data structure to a recipient computing system; receiving data indicating a set of digital components, the set of digital components including at least one digital component selected based on the probabilistic data structure; selecting a given digital component from the set of digital components, wherein selecting the given digital component from the set of digital components comprises: generating a filtered subset of digital components by filtering one or more digital components from the set of digital components that do not have a corresponding user group identifier that matches one of the real user group identifiers; selecting the given digital component from the filtered subset of digital components; and presenting the given digital component.

2. The computer-implemented method of claim 1, wherein removing zero or more real user group identifiers from the first set of user group identifiers comprises removing a plurality of real user group identifiers from the first set of user group identifiers.

3. The computer-implemented method of claim 2, the set of digital components including one or more additional digital components that are not selected based on the probabilistic data structure.

4. The computer-implemented method of claim 1, wherein filtering one or more digital components from the set of digital components that do not have a corresponding user group identifier that matches one of the real user group identifiers comprises: for each digital component in the set of digital components: identifying one or more corresponding user group identifiers for the digital component in the data indicating the set of digital components, each corresponding user identifier being a user group identifier used to select a digital component included in the set of digital components; and comparing each corresponding user identifier to the real user group identifiers in the first set of user group identifiers; removing each digital component from the set of digital components that does not have a corresponding user group identifier that matches one of the real user group identifiers in the first set of user group identifiers.

5. The computer-implemented method of claim 1, wherein: the data indicating the set of digital components includes data identifying a first digital component that each has one or more corresponding user group identifiers, and data identifying one or more second digital components that do not have any corresponding user group identifiers; ​ Selecting a given digital component from the set of digital components includes removing each first digital component from the set of digital components, where none of the first digital component’s corresponding user group identifiers match the real user group identifier.

6. The computer-implemented method of claim 5, wherein selecting a given digital component from the set of digital components includes selecting a second digital component when all of the first digital components are removed from the set of digital components.

7. The computer-implemented method of claim 1, wherein the recipient computing system selects a subset of user groups from a plurality of user groups based on the probabilistic data structure and selects a set of digital components corresponding to the subset of user groups.

8. The computer-implemented method of claim 1, wherein the probabilistic data structure includes a Bloom filter or a cuckoo filter.

9. The computer-implemented method of claim 1, wherein: removing one or more real user group identifiers from the first set of user group identifiers includes randomly or pseudorandomly selecting the one or more real user group identifiers; and adding one or more fake user group identifiers to the second set of user group identifiers includes randomly or pseudorandomly selecting the one or more fake user group identifiers.

10. The computer-implemented method of claim 1, wherein each real user group identifier is based on a combination of: (i) a domain of an entity that created the user group identified by the real user group identifier, and (ii) a unique identifier of the user group identified by the real user group identifier.

11. The computer-implemented method of claim 10, wherein each real user group identifier is a message authentication code generated based on the combination of the domain and the unique identifier.

12. The computer-implemented method of any of claims 1-11, wherein generating the probabilistic data structure based on the second set of user group identifiers includes: generating a hash output for each user group identifier, the hash output having a uniform distribution across all user group identifiers; and generating the probabilistic data structure, the probabilistic data structure including the hash output for each user group identifier in the second set of user group identifiers.

13. A system for protecting user privacy, comprising: one or more processors; and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-12.

14. A computer-readable medium carrying instructions that, when executed by one or more processors, cause the one or more processors to perform the method of any of claims 1-12.

15. A computer program product comprising instructions which, when executed by a computer, cause the computer to carry out the steps of the method of any of claims 1-12. ​ ​

Images