Privacy-preserving machine learning via gradient boosting

Abstract

This describes a privacy preserving machine learning platform. In one aspect, a method includes receiving, by a first computing system of a plurality of multi-party computation (MPC) systems, an inference request including a first share of a given user profile. Determining a predicted label for the given user profile based at least in part on a first machine learning model. Determining a prediction residual value for the given user profile that indicates a prediction error in the predicted label. The first computing system determines a first share of the prediction residual value for the given user profile based at least in part on the first share of the given user profile and a second machine learning model. The first computing system receives data indicating a second share of the prediction residual value for the given user profile from a second computing system of the MPC computing systems.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to IL Application No. 277910, filed on October 9, 2020. The disclosure of the above application is incorporated herein by reference in its entirety. Technical Field

[0003] This specification relates to a privacy-preserving machine learning platform that uses secure multi-party computation to train and use machine learning models. Background Art

[0004] Some machine learning models are trained based on data collected from multiple sources, for example, across multiple websites and / or native applications. However, this data may include private or sensitive data that should not be shared or allowed to be leaked to other parties. Summary of the Invention

[0005] In general, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving, by a first computing system among a plurality of multi-party computing (MPC) computing systems, an inference request comprising a first share of a given user profile; determining, based at least in part on a first machine learning model trained using a plurality of user profiles, a predicted label for the given user profile; determining a prediction residual value for the given user profile that indicates a prediction error in the predicted label; generating, by the first computing system, a first share of inference results based at least in part on the predicted label and the prediction residual value determined for the given user profile; and providing, by the first computing system, to a client device, the first share of the inference results and a second share of the inference results received from the second computing system. Determining the predicted residual value for the given user profile includes determining, by the first computing system at least in part based on a first share of the given user profile and a second machine learning model trained using the multiple user profiles and data indicating differences between multiple true labels for the multiple user profiles and multiple predicted labels as determined for the multiple user profiles using the first machine learning model; receiving, by the first computing system from a second computing system among the multiple MPC computing systems, data indicating a second share of the predicted residual value for the given user profile determined by the second computing system at least in part based on the second share of the given user profile and a second set of one or more machine learning models; and determining the predicted residual value for the given user profile based at least in part on the first share and the second share of the predicted residual value. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of the method, which are encoded on a computer storage device.

[0006] These and other embodiments can each optionally include one or more of the following features. In some aspects, determining the predicted label for the given user profile includes: determining, by the first computing system, a first share of the predicted label based at least in part on: (i) a first share of the given user profile, (ii) the first machine learning model trained using the multiple user profiles, and (iii) one or more true labels of the multiple true labels for the multiple user profiles, the multiple true labels including one or more true labels for each user profile in the multiple user profiles; receiving, by the first computing system from the second computing system, data indicating a second share of the predicted label determined by the second computing system at least in part based on a second share of the given user profile and a first set of one or more machine learning models; and determining the predicted label based at least in part on the first share and the second share of the predicted label.

[0007] In some embodiments, the method further includes applying, by the first computing system, a transformation to the first share of a given user profile to obtain a first transformed share of the given user profile. In such embodiments, determining, by the first computing system, the first share of the predicted label includes determining, by the first computing system, the first share of the predicted label based at least in part on the first transformed share of the given user profile. In some such embodiments, the transformation is a random projection, such as a Johnson-Lindenstrauss (JL) transform. In some of the foregoing embodiments, determining, by the first computing system, the first share of the predicted label includes providing, by the first computing system, the first transformed share of the given user profile as input to the first machine learning model to obtain, as output, the first share of the predicted label for the given user profile.

[0008] In some examples, the method further includes evaluating the performance of the first machine learning model and training the second machine learning model using data determined when evaluating the performance of the first machine learning model. In these examples, evaluating the performance of the first machine learning model includes, for each of the plurality of user profiles: determining a predicted label for the user profile and determining a residual value for the user profile indicating an error in the predicted label. In addition, in these examples, determining the predicted label for the user profile includes: determining, by the first computing system, a first share of the predicted label for the user profile based at least in part on: (i) the first share of the user profile, (ii) the first machine learning model, and (iii) one or more true labels of the plurality of true labels for the plurality of user profiles; receiving, by the first computing system, from the second computing system, data indicating a second share of the predicted label for the user profile determined by the second computing system at least in part based on the second share of the user profile and a first set of one or more machine learning models maintained by the second computing system; and determining the predicted label for the user profile based at least in part on the first share and the second share of the predicted label. In addition, in such an example, determining the residual value of the user profile includes: determining, by the first computing system, a first share of the residual value of the user profile based at least in part on the predicted label determined for the user profile and a first share of the real labels of the user profile included in the multiple real labels; receiving, by the first computing system from the second computing system, data indicating a second share of the residual value of the user profile determined by the second computing system at least in part based on the predicted label determined for the user profile and a second share of the real labels of the user profile; and determining the residual value of the user profile based at least in part on the first share and the second share of the residual value. In the aforementioned example, training the second machine learning model using data determined when evaluating the performance of the first machine learning model includes: training the second machine learning model using data indicating the residual values ​​determined for the multiple user profiles when evaluating the performance of the first machine learning model.

[0009] In some of the above examples, before evaluating the performance of the first machine learning model, the method further includes deriving a set of parameters for a function, and configuring the first machine learning model to generate an initial predicted label for the user profile given a user profile as input and applying the function as defined based on the derived set of parameters to the initial predicted label for the user profile to generate a first share of the predicted label for the user profile as output. In at least some of these examples, deriving the set of parameters for the function includes: (i) deriving, by the first computing system, a first share of the set of parameters for the function based at least in part on the first share of each of the plurality of true labels, (ii) receiving, by the first computing system from the second computing system, data indicating a second share of the set of parameters for the function derived by the second computing system based at least in part on the second share of each of the plurality of true labels, and (iii) deriving the set of parameters for the function based at least in part on the first and second shares of the set of parameters for the function. In at least some of the above examples, the function is a quadratic polynomial function.

[0010] In some such examples, the method further includes estimating, by the first computing system, a first share of a set of distribution parameters based at least in part on the first share of each of the plurality of true labels. In these examples, deriving, by the first computing system, the first share of the set of parameters of the function based at least in part on the first share of each of the plurality of true labels includes deriving, by the first computing system, the first share of the set of parameters of the function based at least in part on the first share of the set of distribution parameters. In at least some of the above examples, the set of distribution parameters includes: (i) one or more parameters of a probability distribution of a prediction error for a first value of the true labels in the plurality of true labels, and (ii) one or more parameters of a probability distribution of a prediction error for a second value of the true labels in the plurality of true labels. In these examples, the second value is different from the first value. In addition, in at least some of the above examples, the first share of the residual values ​​of the user profile indicates the difference in value between the predicted label determined for the user profile and the first share of the true label of the user profile, and the second share of the residual values ​​of the user profile indicates the difference in value between the predicted label determined for the user profile and the second share of the true label of the user profile.

[0011] In some embodiments, (i) the first machine learning model includes a k-nearest neighbor model maintained by the first computing system, (ii) the first set of one or more machine learning models includes a k-nearest neighbor model maintained by the second computing system, (iii) the second machine learning model includes at least one of: a deep neural network (DNN) maintained by the first computing system and a gradient boosted decision tree (GBDT) maintained by the first computing system, and / or (iv) the second set of one or more machine learning models includes at least one of: a DNN maintained by the second computing system and a GBDT maintained by the second computing system.

[0012] In at least some of these embodiments, determining the first share of the predicted labels by the first computing system includes: (i) identifying, by the first computing system, a first set of nearest neighbor user profiles based at least in part on the first share of the given user profile and the k-nearest neighbor model maintained by the first computing system, (ii) receiving, by the first computing system from the second computing system, data indicating a second set of nearest neighbor profiles identified by the second computing system based at least in part on the second share of the given user profile and the k-nearest neighbor model maintained by the second computing system, (iii) identifying, based at least in part on the first set and the second set of nearest neighbor user profiles, k nearest neighbor user profiles of the multiple user profiles that are considered to be most similar to the given user profile, and (iv) determining, by the first computing system, the first share of the predicted labels based at least in part on the true label of each of the k nearest neighbor user profiles.

[0013] In at least some of the foregoing embodiments, determining, by the first computing system, the first share of the predicted labels further comprises (i) determining, by the first computing system, a first share of the sum of the true labels of the k nearest neighbor user profiles, (ii) receiving, by the first computing system from the second computing system, a second share of the sum of the true labels of the k nearest neighbor user profiles, and (iii) determining, based at least in part on the first share and the second share of the sum of the true labels of the k nearest neighbor user profiles. Furthermore, in some such embodiments, determining, by the first computing system, the first share of the predicted labels further comprises applying a function to the sum of the true labels of the k nearest neighbor user profiles to generate the first share of the predicted labels for the given user profile. In some of the foregoing embodiments, the first share of the predicted labels for the given user profile comprises the sum of the true labels of the k nearest neighbor user profiles.

[0014] In some of the above embodiments, determining, by the first computing system, the first share of the predicted labels based at least in part on the true label for each of the k nearest neighbor user profiles includes determining, by the first computing system, the first share of the predicted label set based at least in part on a set of true labels for each of the k nearest neighbor user profiles that respectively correspond to a set of categories. In these embodiments, the first computing system determines a first share of the predicted label set, including, for each category in the set: (i) determining a first share of frequencies where the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is a true label of a first value, (ii) receiving, by the first computing system from the second computing system, a second share of frequencies where the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is a true label of the first value, and (iii) determining, at least in part based on the first share and the second share of frequencies where the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is a true label of the first value, the frequency where the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is a true label of the first value. In some of these embodiments, determining, by the first computing system, the first share of the set of predicted labels includes, for each category in the set: applying a function corresponding to the category to the frequency with which the true label corresponding to the category in the set of true labels for user profiles in the k nearest neighbor user profiles is the true label of the first value, to generate a first share of predicted labels corresponding to the category for the given user profile.

[0015] Another innovative aspect of the subject matter described in this specification can be embodied in a method, the method comprising: receiving, by a secure MPC cluster of a computing system, an inference request associated with a given user profile; determining, by the MPC cluster, a predicted label for the given user profile based at least in part on a first machine learning model trained using a plurality of user profiles; determining, by the MPC cluster, a prediction residual value indicating a prediction error in the predicted label for the given user profile based at least in part on the given user profile and a second machine learning model trained using the user profile and data indicating a difference between a true label for the user profile and a predicted label determined for the user profile using the first machine learning model; generating, by the MPC cluster, data representing an inference result based at least in part on the predicted label and the prediction residual value determined for the given user profile; and providing, by the MPC cluster, the data representing the inference result to a client device. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of the method, encoded on a computer storage device.

[0016] These and other embodiments can each optionally include one or more of the following features. In some aspects, the inference request includes an encrypted second share of the given user profile encrypted using an encryption key of the second computing system. Some aspects can include transmitting the encrypted second share of the given user profile to the second computing system.

[0017] In some aspects, determining the predicted label for a given user profile includes determining, by the MPC cluster, the predicted label for the given user profile based at least in part on: (i) the given user profile, (ii) the first machine learning model trained using the user profile, and (iii) one or more true labels of the true labels for the user profile, the true labels including one or more true labels for each user profile in the plurality of user profiles.

[0018] In some embodiments, the method further includes applying, by the MPC cluster, a transformation to the given user profile to obtain a transformed version of the given user profile. In these embodiments, determining, by the MPC cluster, the predicted label includes determining, by the MPC cluster, the predicted label based at least in part on the transformed version of the given user profile. In some such embodiments, the transformation is a random projection, such as a Johnson-Lindenstrauss (JL) transform. In at least some of the foregoing embodiments, determining, by the MPC cluster, the predicted label includes providing, by the MPC cluster, the transformed version of the given user profile as input to the first machine learning model to obtain, as output, the predicted label for the given user profile.

[0019] In some examples, the method further includes evaluating the performance of the first machine learning model and training the second machine learning model using data determined when evaluating the performance of the first machine learning model. In such examples, (1) the predicted label for the user profile is determined by the MPC cluster at least in part based on: (i) the user profile, (ii) the first machine learning model, and (iii) one or more of the true labels for the user profile, and (2) the residual value for the user profile indicating the prediction error in the predicted label is determined by the MPC cluster at least in part based on the predicted label determined for the user profile and the true label of the user profile included in the true labels. In the above example, training the second machine learning model using data determined when evaluating the performance of the first machine learning model includes: training the second machine learning model using data indicating the residual value determined for the user profile when evaluating the performance of the first machine learning model.

[0020] In at least some of the above examples, before evaluating the performance of the first machine learning model, the method further includes deriving, by the MPC cluster, a set of parameters for a function based at least in part on the true labels, configuring the first machine learning model to generate an initial predicted label for the user profile given a user profile as input, and applying the function as defined based on the derived set of parameters to the initial predicted label for the user profile to generate as output the predicted label for the user profile. In some such examples, the method further includes estimating, by the MPC cluster, a set of normal distribution parameters based at least in part on the true labels. In these examples, deriving, by the MPC cluster, the set of parameters for the function based at least in part on the true labels includes deriving, by the MPC cluster, the set of parameters for the function based at least in part on the estimated set of normal distribution parameters. In some of the above examples, the set of distribution parameters includes: one or more parameters of a probability distribution of a prediction error for a first value of the true labels, and one or more parameters of a probability distribution of a prediction error for a second value of the true labels, the second value being different from the first value. Furthermore, in some of the above examples, the function is a quadratic polynomial function. In at least some of the above examples, the residual value for the user profile indicates a difference in value between the predicted label determined for the user profile and the true label for the user profile.

[0021] In some embodiments, the first machine learning model includes a k-nearest neighbor model. In some of these embodiments, determining, by the MPC cluster, the predicted label includes: (i) identifying, by the MPC cluster, k nearest neighbor user profiles of the user profile that are believed to be most similar to the given user profile based at least in part on the given user profile and the k-nearest neighbor model, and (ii) determining, by the MPC cluster, the predicted label based at least in part on the true label of each of the k nearest neighbor user profiles.

[0022] In at least some of the foregoing embodiments, determining, by the MPC cluster, the predicted label based at least in part on the true label for each of the k nearest neighbor user profiles comprises determining, by the MPC cluster, the sum of the true labels for the k nearest neighbor user profiles. In some such embodiments, determining, by the MPC cluster, the predicted label further comprises applying a function to the sum of the true labels for the k nearest neighbor user profiles to generate a predicted label for a given user profile. Furthermore, in at least some of the foregoing embodiments, the predicted label for the given user profile comprises the sum of the true labels for the k nearest neighbor user profiles.

[0023] In at least some of the foregoing embodiments, determining, by the MPC cluster, the predicted label based at least in part on the true label for each of the k nearest neighbor user profiles includes determining, by the MPC cluster, a predicted label set based at least in part on a set of true labels for each of the k nearest neighbor user profiles corresponding to a set of categories. In these embodiments, determining, by the MPC cluster, the predicted label set includes determining, for each category in the set, a frequency at which a true label corresponding to a category in the set of true labels for a user profile in the k nearest neighbor user profiles is a true label of a first value. In some of these embodiments, determining, by the MPC cluster, the predicted label set includes, for each category in the set, applying a function corresponding to the category to the determined frequency to generate a predicted label for the category corresponding to the given user profile.

[0024] In some examples, each true label is encrypted. In some embodiments, the inference result includes the sum of the predicted label and the predicted residual value. In some examples, the second machine learning model includes at least one of a deep neural network, a gradient boosted decision tree, and a random forest model.

[0025] In some examples, the client device calculates the given user profile using a plurality of feature vectors, each feature vector including a feature value associated with an event of the user of the client device and a decay rate of each feature vector.

[0026] In some examples, the client device calculates the given user profile using a plurality of feature vectors, each feature vector comprising feature values ​​associated with an event of a user of the client device. Calculating the given user profile can include classifying one or more feature vectors as sparse feature vectors and classifying one or more feature vectors as dense feature vectors. Some aspects can include generating a first share of the given user profile and a corresponding second share of the given user profile for one or more second computing systems using the sparse feature vectors and the dense feature vectors. Generating the first share and the corresponding one or more second shares of the given user profile can include segmenting the sparse feature vectors using a functional secret sharing (FSS) technique.

[0027] Yet another innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving, by a first computing system of a plurality of MPC systems, an inference request comprising a first share of a given user profile; identifying k nearest neighbor user profiles from a plurality of user profiles that are considered most similar to the given user profile, comprising: identifying, by the first computing system, a first set of nearest neighbor user profiles based on the first share of the given user profile and a first k nearest neighbor model trained using the user profile; receiving, by the first computing system, from each of one or more second computing systems of the plurality of MPC systems, an indication of an inference request by the second computing system based on a corresponding second share of the given user profile and a corresponding second k nearest neighbor model trained by the second computing system. and data of a corresponding second set of nearest neighbor profiles identified; identifying k nearest neighbor user profiles by the first computing system based on the first set of nearest neighbor user profiles and each second set of nearest neighbor user profiles; generating a first share of inference results by the first computing system based on a corresponding label of each of the k nearest neighbor user profiles, wherein the label of each user profile predicts one or more user groups to which a user corresponding to the user profile will be added, and wherein the inference result indicates whether a given user corresponding to the given user profile will be added to a given user group; and providing, by the first computing system, the first share of inference results received from each of the one or more second computing systems and the corresponding second share of inference results to a client device. Other embodiments of this aspect include corresponding apparatus, systems, and computer programs configured to perform aspects of the method, which are encoded on a computer storage device.

[0028] These and other embodiments can each optionally include one or more of the following features. In some aspects, the inference request includes an encrypted second share of the given user profile encrypted using an encryption key of the second computing system. Some aspects can include transmitting the encrypted second share of the given user profile to the second computing system.

[0029] In some aspects, the second share of the inference result is encrypted using an encryption key of an application of the client device. In some aspects, the label of each user profile has a Boolean type for binary classification. Generating the first share of the inference result can include determining a first share of the sum of the labels of the k nearest neighbor user profiles, receiving a second share of the sum of the labels of the k nearest neighbor user profiles from the second computing system, determining the sum of the labels based on the first share of the sum of the labels and the second share of the sum of the labels, determining that the sum of the labels exceeds a threshold, in response to determining that the sum of the labels exceeds the threshold, determining to add the given user to the given user group as the inference result, and generating the first share of the inference result based on the inference result.

[0030] In some aspects, the tag of each user profile has a numerical value. Generating the first share of the inference result can include determining a first share of a sum of the tags of k nearest neighbor user profiles, receiving a second share of the sum of the tags of the k nearest neighbor user profiles from the second computing system, determining the sum of the tags based on the first share of the sum of the tags and the second share of the sum of the tags, determining that the given user is to join the given user group as an inference result based on the sum of the tags, and generating the first share of the inference result based on the inference result.

[0031] In some aspects, the tag of each user profile has a category value. Generating the first share of the inference result can include: for each tag in the tag set, determining a first share of the frequency of user profiles in k nearest neighbor profiles having the tag, receiving a second share of the frequency of user profiles in the k nearest neighbor profiles having the tag from the second computing system, and determining the frequency of user profiles in the k nearest neighbor profiles having the tag based on the first share and the second share of the frequency of user profiles in the k nearest neighbor profiles having the tag. Some aspects can include identifying the tag with the highest frequency, assigning the given user to join the given user group corresponding to the tag with the highest frequency as an inference result, and generating the first share of the inference result based on the inference result.

[0032] Some aspects can include training a first k-nearest neighbor model. The training can include collaboratively creating a first share of random bit-flip patterns with the second computing system, generating a first share of a bit matrix by projecting the first share of each of the user profiles onto a set of random projection planes, modifying the first share of the bit matrix by modifying one or more bits of the first share of the bit matrix using the first share of the bit-flip patterns, providing a first portion of the modified first share of the bit matrix to the second computing system, receiving from the second computing system a second half of the modified second share of the bit matrix generated by the second computing system using second shares of user profiles from the plurality of user profiles and the second share of the random bit patterns, and reconstructing, by the first computing system, a bit vector for the second half of the first bit matrix using the second half of the modified first share of the bit matrix and the second half of the modified second share of the bit matrix. Creating a first share of the random bit-flip pattern in collaboration with the second computing system can include generating a first m-dimensional vector including a plurality of first elements each having a value of zero or one, splitting the first m-dimensional vector into two shares, providing the first share of the first m-dimensional vector to the second computing system, receiving the first share of the second m-dimensional vector from the second computing system, and computing the first share of the random bit-flip pattern in collaboration with the second computing system using the shares of the first m-dimensional vector and the second m-dimensional vector. In some aspects, the plurality of MPC computing systems includes more than two MPC computing systems.

[0033] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. The machine learning techniques described in this document can identify users with similar interests and expand user group membership while protecting the user's privacy, for example, by not leaking the user's online activities to any computing system. This protects the user's privacy relative to these platforms and protects the security of the data from being compromised during transmission or from the platform. Cryptographic techniques such as secure multi-party computation (MPC) can expand user groups based on similarities in user profiles without using third-party cookies, which protects user privacy without negatively impacting the ability to expand user groups and, in some cases, provides better user group expansion based on more complete profiles than can be achieved using third-party cookies. MPC technology can ensure that, as long as one of the computing systems in the MPC cluster is honest, no computing system or other party can obtain user data in plain text. Therefore, the claimed method allows user data to be identified, grouped, and transmitted in a secure manner without requiring the use of third-party cookies to determine any relationships between user data. This is a different approach from previously known methods, which typically require third-party cookies to determine relationships between data. By grouping user data in this manner, the efficiency of transmitting data content to the user device is improved because data content that is not related to a specific user does not need to be transmitted. In particular, third-party cookies are not required, thereby avoiding the storage of third-party cookies and improving memory usage. Exponential decay techniques can be used to build user profiles at client devices to reduce the data size of the raw data required to build the user profile, thereby reducing the data storage requirements of client devices that typically have very limited data storage. For example, the accuracy of classification, for example, for user group expansion, can be improved by training a stronger model, such as a deep neural network model, based on another model, such as a k-nearest neighbor model. That is, the technology described herein can improve accuracy by training a strong learner based on a weaker learner.

[0034] Various features and advantages of the foregoing subject matter are described below with reference to the accompanying drawings. Additional features and advantages will be apparent from the subject matter described herein and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a block diagram of an environment in which a secure MPC cluster trains a machine learning model and the machine learning model is used to scale a user group.

[0036] Figure 2 is a swim lane diagram of an example process for training a machine learning model and using the machine learning model to add users to a user group.

[0037] Figure 3 is a flow diagram illustrating an example process for generating a user profile and sending shares of the user profile to an MPC cluster.

[0038] Figure 4 is a flowchart illustrating an example process for generating a machine learning model.

[0039] Figure 5 is a flow diagram illustrating an example process for adding a user to a user group using a machine learning model.

[0040] Figure 6 is a conceptual diagram of an exemplary framework for generating inference results for a user profile.

[0041] Figure 7 is a conceptual diagram of an exemplary framework for generating inference results of user profiles with improved performance.

[0042] Figure 8 is a flow chart illustrating an example process for generating inference results of a user profile with improved performance at an MPC cluster.

[0043] Figure 9 is a flowchart illustrating an example process for preparing and performing training of a second machine learning model for improving inference performance at an MPC cluster.

[0044] Figure 10 is a conceptual diagram of an exemplary framework for evaluating the performance of a first machine learning model.

[0045] Figure 11 is a flow diagram illustrating an example process for evaluating the performance of a first machine learning model at an MPC cluster.

[0046] Figure 12 is a flow chart illustrating an example process for generating inference results of a user profile with improved performance at a computing system of an MPC cluster.

[0047] Figure 13 is a block diagram of an example computer system.

[0048] Like reference numbers and designations throughout the various drawings represent like elements. DETAILED DESCRIPTION

[0049] In general, this document describes systems and techniques for training and using machine learning models to expand user group membership while protecting user privacy and ensuring data security. Typically, rather than creating and maintaining user profiles at the computing systems of other entities, such as content platforms, user profiles are maintained at the user's client device. To train the machine learning model, the user's client device can optionally send its encrypted user profile (e.g., as a secret share of the user profile) along with other data to multiple computing systems of a secure multi-party computation (MPC) cluster via the content platform. For example, each client device can generate two or more secret shares of the user profile and send the corresponding secret shares to each computing system. The computing systems of the MPC cluster can use MPC techniques to train a machine learning model for recommending user groups based on the user's profile in a manner that prevents any computing system in the MPC cluster (or another party other than the user) from obtaining any user profile in plain text, thereby protecting user privacy. For example, using the secret shares and MPC techniques described in this document enables machine learning models to be trained and used while each user's user profile data remains encrypted when the data is external to the user's device. The machine learning model can be a k-nearest neighbor (k-NN) model.

[0050] After the machine learning model is trained, the machine learning model can be used to recommend one or more user groups for each user based on the user's profile. For example, the user's client device can query the MPC cluster for recommended user groups for the user, or determine whether the user should be added to a particular user group. Various inference techniques can be used, such as binary classification, regression (e.g., using arithmetic mean or root mean square), and / or multi-class classification to identify user groups. The user's user group membership can be used to provide content to the user in a privacy-preserving and secure manner.

[0051] Example system for generating and using machine learning models

[0052] Figure 1 1 is a block diagram of an environment 100 in which a secure MPC 130 cluster trains a machine learning model and the machine learning model is used to scale a user group. The example environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects client devices 110, secure MPC clusters 130, publishers 140, websites 142, and content platforms 150. The example environment 100 may include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, and content platforms 150.

[0053] The client device 110 is an electronic device capable of communicating over the network 105. Example client devices 110 include personal computers, mobile communication devices (e.g., smart phones), and other devices capable of sending and receiving data over the network 105. The client device can also include a digital assistant device that accepts audio input through a microphone and outputs audio output through a speaker. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant can be placed in a listening mode (e.g., ready to accept audio input). The digital assistant device can also include a camera and / or a display to capture images and visually present information. The digital assistant can be implemented in different forms of hardware devices, including wearable devices (e.g., watches or glasses), smart phones, speaker devices, tablet devices, or another hardware device. The client device can also include a digital media device, for example, a streaming device that is inserted into a television or other display to stream video to the television, or a gaming device or console.

[0054] The client device 110 typically includes applications 112, such as a web browser and / or native applications, to facilitate sending and receiving data over the network 105. A native application is an application developed for a specific platform or specific device (e.g., a mobile device with a specific operating system). Publishers 140 can develop and provide, for example, native applications for download to client devices 110. For example, in response to a user of the client device 110 entering a resource address of a resource 145 in an address bar of a web browser or selecting a link that references the resource address, the web browser can request the resource 145 from a web server hosting a website 142 of the publisher 140. Similarly, a native application can request application content from a publisher's remote server.

[0055] Some resources, application pages or other application content can include a digital component slot for presenting a resource 145 or application page to a digital component. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, an audio clip, a multimedia clip, an image, a text, or another content unit). A digital component can be electronically stored in a physical memory device as a single file or a collection of files, and the digital component can take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and include advertising information, such that advertising is a type of digital component. For example, a digital component can be content that is intended to supplement a web page or other resource presented by an application 112. More specifically, a digital component can include digital content related to resource content (e.g., a digital component can be related to the same topic as the web page content, or to a related topic). Therefore, the provision of a digital component can supplement and generally enhance web page or application content.

[0056] When application 112 loads a resource (or application content) that includes one or more digital component slots, application 112 can request a digital component for each slot. In some embodiments, the digital component slots can include code (e.g., a script) that causes application 112 to request the digital component from a digital component distribution system, which selects the digital component and provides it to application 112 for presentation to a user of client device 110.

[0057] The content platform 150 can include a supply-side platform (SSP) and a demand-side platform (SSP). Typically, the content platform 150 manages the selection and distribution of digital components on behalf of publishers 140 and digital component providers 160.

[0058] Some publishers 140 use an SSP to manage the process of obtaining digital components for their resources and / or applications' digital component slots. An SSP is a technology platform implemented as hardware and / or software that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 can have a corresponding SSP or multiple SSPs. Several publishers 140 may use the same SSP.

[0059] Digital component providers 160 can create (or otherwise publish) digital components for presentation in digital component slots of publishers' resources and applications. Digital component providers 160 can use DSPs to manage the supply of their digital components for presentation in digital component slots. A DSP is a technology platform implemented in hardware and / or software that automates the process of distributing digital components for presentation with resources and / or applications. On behalf of digital component providers 160, the DSP can interact with multiple supply-side platforms (SSPs) to provide digital components for presentation with resources and / or applications from multiple different publishers 140. Generally, the DSP can receive a request for a digital component (e.g., from an SSP), generate (or select) selection parameters for one or more digital components created by one or more digital component providers based on the request, and provide data related to the digital component (e.g., the digital component itself) and the selection parameters to the SSP. The SSP can then select the digital component for presentation at a client device 110 and provide data to the client device 110 that enables presentation of the digital component.

[0060] In some cases, it is beneficial for users to receive digital components related to web pages, application pages, or other electronic resources that users have previously visited and / or interacted with. In order to distribute such digital components to users, users can be assigned to user groups, such as user interest groups, groups of similar users, or other group types involving similar user data. For example, when a user accesses a specific resource or performs a specific action at the resource (e.g., interacting with a specific item presented on a web page or adding an item to a virtual shopping cart), the user can be assigned to a user interest group. In another example, users can be assigned to user groups based on a history of activity, such as a history of resources accessed and / or actions performed at the resource. In some embodiments, user groups can be generated by digital component providers 160. That is, when a user accesses the electronic resources of a digital component provider 160, each digital component provider 160 can assign the user to their user group.

[0061] To protect user privacy, the user's group membership can be maintained at the user's client device 110, for example, by one of the applications 112 or the operating system of the client device 110, rather than by the digital component provider, content platform, or other party. In a specific example, a trusted program (e.g., a web browser) or an operating system can maintain a list of user group identifiers ("user group list") for a user using a web browser or another application. The user group list can include a group identifier for each user group to which the user has been added. The digital component provider 160 that creates a user group can specify a user group identifier for its user group. The user group identifier of a user group can describe the group (e.g., a gardening group) or a code representing the group (e.g., a non-descriptive alphanumeric sequence). The user's user group list can be stored in a secure storage device at the client device 110 and / or can be encrypted when stored to prevent others from accessing the list.

[0062] When the application 112 presents a resource or application content related to the digital component provider 160 or a web page on the website 142, the resource can request the application 112 to add one or more user group identifiers to the user group list. In response, the application 112 can add the one or more user group identifiers to the user group list and securely store the user group list.

[0063] The content platform 150 can use the user's user group membership to select digital components or other content that may be of interest to the user or that may be beneficial to the user / user device in another manner. For example, such digital components or other content may include data that improves the user experience, improves the operation of the user device, or benefits the user or user device in some other way. However, the user group identifier of the user's user group list can be provided in a manner that prevents the content platform 150 from associating the user group identifier with a specific user, thereby protecting the user's privacy when using user group membership data to select digital components.

[0064] Application 112 is capable of providing the user group identifier from the user group list to a trusted computing system that interacts with content platform 150 to select digital components for presentation at client device 110 based on the user group membership in a manner that prevents content platform 150 or any other entity other than the user themselves from knowing the user's complete user group membership.

[0065] In some cases, it may be beneficial for the user and the digital component provider to expand the user group to include users with similar interests or other similar data as users who are already members of the user group.

[0066] Advantageously, users can be added to user groups without using third-party cookies. As described above, user profiles can be maintained at the client device 110. This protects user privacy by excluding the user's cross-domain browsing history from being shared with external parties, reduces bandwidth consumed by transmitting cookies over the network 105 (which is substantial when aggregated across millions of users), reduces storage requirements for the content platform 150 that typically stores such information, and reduces battery consumption used by the client device 110 to maintain and transmit cookies.

[0067] For example, a first user may be interested in skiing and may be a member of a user group for a particular ski resort. A second user may also be interested in skiing but is unaware of this ski resort and is not a member of the ski resort. If the two users have similar interests or data, such as a similar user profile, the second user can be added to the user group for the ski resort, allowing the second user to receive content, such as digital widgets, related to the ski resort that may be of interest or otherwise beneficial to the second user or their user device. In other words, the user group can be expanded to include other users with similar user data.

[0068] The secure MPC cluster 130 can train a machine learning model that recommends user groups to a user (or their application 112) based on the user's profile, or can be used to generate recommendations for user groups. The secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, that perform secure MPC techniques to train the machine learning model. Although the example MPC cluster 130 includes two computing systems, more computing systems can be used as long as the MPC cluster 130 includes more than one computing system. For example, the MPC cluster 130 can include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 can provide more security and fault tolerance, but can also increase the complexity of the MPC process.

[0069] Computing systems MPC1 and MPC2 can be operated by different entities. Thus, each entity may not have access to a complete user profile in plain text. Plain text is text that is not computer-marked, specially formatted, or written in code or data (including binary files) in a form that can be viewed or used without requiring a key or other decryption device or other decryption process. For example, one of computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, content platform 150, and digital component provider 160. For example, an industry group, a government group, or a browser developer can maintain and operate one of computing systems MPC1 and MPC2. Other computing systems can be operated by different ones of these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Preferably, the different parties operating different computing systems MPC1 and MPC2 have no incentive to collude to compromise user privacy. In some embodiments, computing systems MPC1 and MPC2 are architecturally separated and monitored so that they do not communicate with each other except when executing the secure MPC process described in this document.

[0070] In some embodiments, the MPC cluster 130 trains one or more k-NN models for each content platform 150 and / or for each digital component provider 160. For example, each content platform 150 can manage the distribution of digital components of one or more digital component providers 160. A content platform 150 can request the MPC cluster 130 to train a k-NN model for one or more digital component providers 160 for the content platform 150 to manage the distribution of its digital components. Typically, a k-NN model represents the distance between user profiles (and optionally additional information) of a set of users. Each k-NN model of a content platform can have a unique model identifier. An example process for training a k-NN model is described in Figure 4 is illustrated in and described below.

[0071] After training the k-NN model for the content platform 150, the content platform 150 can query the k-NN model or cause the application 112 of the client device 110 to query the k-NN model to identify one or more user groups for the user of the client device 110. For example, the content platform 150 can query the k-NN model to determine whether a threshold number "k" of user profiles closest to the user are members of a particular user group. If so, the content platform 150 can add the user to the user group. If a user group is identified for the user, the content platform 150 or the MPC cluster 130 can request the application 112 to add the user to the user group. If approved by the user and / or the application 112, the application 112 can add the user group identifier for the user group to the user group list stored at the client device 110.

[0072] In some embodiments, application 112 can provide a user interface that enables a user to manage the user groups to which the user is assigned. For example, the user interface can enable a user to remove a user group identifier, prevent all or specific resources 145, publishers 140, content platforms 150, digital component providers 160, and / or MPC cluster 130 from adding the user to a user group (e.g., prevent an entity from adding a user group identifier to a list of user group identifiers maintained by application 112). This provides greater transparency, choice / consent, and control for the user.

[0073] In addition to the description throughout this document, controls (e.g., user interface elements with which the user can interact) may be provided to the user to allow the user to make choices regarding whether and when the systems, programs, or features described herein may enable the collection of user information (e.g., information about the user's social network, social actions or activities, occupation, the user's preferences, or the user's current location) and whether the user is sent content or communications from a server. In addition, certain data may be processed in one or more ways before it is stored or used so that personally identifiable information is removed. For example, the user's identity may be processed so that personally identifiable information cannot be determined for the user, or the user's geographic location may be generalized (such as to a city, zip code, or state level) if location information is available so that the user's specific location cannot be determined. Thus, the user can control what information is collected about the user, how that information is used, and what information is provided to the user.

[0074] Example procedures for building and using machine learning models

[0075] Figure 2is a swim lane diagram of an example process 200 for training a machine learning model and adding a user to a user group using the machine learning model. The operations of process 200 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and content platform 150. The operations of process 200 can also be implemented as instructions stored on one or more computer-readable media that can be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 200. Although process 200 and other processes below are described in terms of two computing systems, MPC cluster 130, an MPC cluster with more than two computing systems can also be used to perform similar processes.

[0076] The content platform 150 can initiate training and / or updating of one of its machine learning models by requesting an application 112 running on a client device 110 to generate a user profile for its corresponding user and upload a secret share and / or an encrypted version of the user profile to the MPC cluster 130. For the purposes of this document, the secret share of the user profile can be considered an encrypted version of the user profile because the secret share is not plaintext. Upon generation, each application 112 can store the data of the user profile and generate an updated user profile in response to receiving a request from the content platform 150. Because the content and machine learning model of the user profile are different for different content platforms 150, the application 112 running on the user's client device 110 can maintain the data of multiple user profiles and generate multiple user profiles, each user profile being specific to a particular content platform or a particular model owned by a particular content platform.

[0077] The application 112 running on the client device 110 builds a user profile for the user of the client device 110 (step 202). The user profile of the user can include data related to events initiated by the user and / or events that the user may have initiated with respect to an electronic resource (e.g., a web page or application content). Events can include views of an electronic resource, views of a digital component, user interactions, or lack of user interactions with an electronic resource or digital component (e.g., selection of an electronic resource or digital component), transitions that occur after the user interacts with the electronic resource, and / or other suitable events related to the user and the electronic resource.

[0078] The user profile of the user can be specific to the content platform 150 or a selected machine learning model owned by the content platform 150. For example, as shown below with reference to Figure 3 To describe in more detail, each content platform 150 can request the application 112 to generate or update a user profile specific to that content platform 150 .

[0079] The user profile of a user can be in the form of a feature vector. For example, the user profile can be an n-dimensional feature vector. Each of the n dimensions can correspond to a particular feature, and the value of each dimension can be the value of the feature for the user. For example, one dimension can be for whether a particular digital component is presented to the user (or interacted with by the user). In this example, if the digital component is presented to the user (or interacted with by the user), the value of the feature can be "1", or if the digital component has not been presented to the user (or has not yet interacted with the user), the value of the feature can be "0". An example process for generating a user profile for a user is described in Figure 3 is illustrated in and described below.

[0080] In some embodiments, the content platform 150 may want to train a machine learning model based on additional signals, such as contextual signals, signals related to a particular digital component, or signals related to the user that the application 112 may not be aware of or that the application 112 may not have access to, such as the current weather at the user's location. For example, the content platform 150 may want to train a machine learning model to predict whether a user will interact with a particular digital component if the digital component is presented to the user in a particular context. In this example, for each presentation of a digital component to a user, the contextual signals can include the geographic location of the client device 110 at that time (if permission is granted by the user), a signal describing the content of the electronic resource in which the digital component is presented, and a signal describing the digital component, e.g., the content of the digital component, the type of the digital component, where on the electronic resource the digital component is presented, etc. In another example, one dimension can be for whether the digital component presented to the user is of a particular type. In this example, the value can be 1 for travel, 2 for cooking, 3 for movies, etc. For ease of subsequent description, P i Both the user profile and the additional signals associated with the i-th user profile (eg, context signal and / or digital component level signal) will be represented.

[0081] Application 112 generates a user profile P for the user i (step 204). In this example, the application 112 generates a user profile P i , one share for each computing system of the MPC cluster 130. Note that each share can be a random variable by itself, which does not reveal anything about the user profile. The two shares will need to be combined to obtain the user profile. If the MPC cluster 130 includes more computing systems participating in training the machine learning model, the application 112 will generate more shares, one share for each computing system. In some embodiments, to protect user privacy, the application 112 can use a pseudo-random function to combine the user profile P i That is, the application 112 can use the pseudo-random function PRF (Pi ) to generate two shares {[P i，1 ],[P i，2 The exact split can depend on the secret sharing algorithm and cryptographic library used by the application 112.

[0082] In some embodiments, application 112 can also provide one or more tags to MPC cluster 130. While tags may not be used to train a machine learning model of a specific architecture (e.g., k-NN), tags can be used to fine-tune hyperparameters (e.g., the value of k) that control the model training process, or to evaluate the quality of a trained machine learning model, or to make predictions, i.e., to determine whether to recommend a user group for a user. Tags can include, for example, one or more user group identifiers for a user that are accessible to content platform 150. That is, tags can include user group identifiers for user groups managed by content platform 150 or that are accessible to content platform 150. In some embodiments, a single tag includes multiple user group identifiers for a user. In some embodiments, a user's tags can be heterogeneous and include all user groups, including the users who are members and additional information, such as whether the user interacts with a given digital component. This enables the k-NN model to be used to predict whether another user will interact with a given digital component. The tags for each user profile can indicate the user group membership of the user corresponding to that user profile.

[0083] The tags of the user profile predict the user group that the user corresponding to the input will be or should be added to. For example, the tags of the k nearest neighbor user profiles corresponding to the input user profile predict the user group that the user corresponding to the input user profile will or should join based on the similarity between the user profiles. These predictive tags can be used to suggest user groups to the user or request the application to add the user to the user group corresponding to the tag.

[0084] If labels are included, the application 112 can also assign each label i Split into multiple shares, such as [label i，1 ] and [label i，2 ]. In this way, in the absence of collusion between computing systems MPC1 and MPC2, neither computing system MPC1 nor MPC2 can obtain [P i，1 ] or [P i，2 ]Reconstruction P i , or from [label i，1 ] or [label i，2 Refactoring label i .

[0085] Application 112 encrypts user profile P iThe share of [P i，1 ] or [P i，2 ] and / or each label label i Share of [label i，1 ] or [label i,2 ] (step 206). In some embodiments, the application 112 generates a user profile P i The first share of [P i，1 ] and label label i The first share of [label i，1 ] and encrypts the composite message using the encryption key of the computing system MPC1. Similarly, the application 112 generates the user profile P i The second share [P i，2 ] and label label i The second share [label i，2 ] and encrypts the composite message using the encryption key of the computing system MPC2. These functions can be expressed as PubKeyEncrypt([P i，1 ]||[label i，1 ],MPC1) and PubKeyEncrypt([P i,2 ]||[label i,2 ], MPC2), where PubKeyEncrypt represents a public key encryption algorithm using the corresponding public key of MPC1 or MPC2. The symbol "||" represents a reversible method for composing a complex message from multiple simple messages, such as JavaScript Object Notation (JSON), Concise Binary Object Representation (CBOR), or Protocol Buffers.

[0086] Application 112 provides the encrypted shares to content platform 150 (step 208). For example, application 112 can transmit encrypted shares of the user profile and tags to content platform 150. Because each share is encrypted using the encryption key of computing system MPC1 or MPC2, content platform 150 cannot access the user profile or tags of the user.

[0087] Content platform 150 can receive shares of user profiles and shares of tags from multiple client devices. Content platform 150 can initiate training of a machine learning model by uploading shares of user profiles to computing systems MPC1 and MPC2. Although tags may not be used in the training process, content platform 150 can upload shares of tags to computing systems MPC1 and MPC2 for later use in evaluating model quality or querying the model.

[0088] The content platform 150 receives a first encrypted share (eg, PubKeyEncrypt ([Pt i,1 ]||[label i,1 ],MPC1)) is uploaded to the computing system MPC1 (step 210). Similarly, the content platform 150 uploads the second encrypted share (eg, PubKeyEncrypt([P i，2 ]||[label i，2 ], MPC2)) is uploaded to computing system MPC2 (step 212). Both uploads can be batched and can include encrypted shares of user profiles and labels received during a specific time period for training the machine learning model.

[0089] In some embodiments, the order in which content platform 150 uploads the first encrypted share to computing system MPC1 must match the order in which content platform 150 uploads the second encrypted share to computing system MPC2. This enables computing systems MPC1 and MPC2 to correctly match two shares of the same secret, e.g., two shares of the same user profile.

[0090] In some embodiments, the content platform 150 may explicitly assign the same pseudo-random or sequentially generated identifier to multiple shares of the same secret to facilitate matching. While some MPC techniques can rely on random shuffling of inputs or intermediate results, the MPC techniques described in this document may not include such random shuffling and may instead rely on upload order for matching.

[0091] In some embodiments, operations 208, 210, and 212 can be performed by the application 112 i，1 ]||[label i，1 ] directly to MPC1 and [P i，2 ]||[label i，2 ] to MPC2. This alternative process can reduce the architectural cost of content platform 150 to support operations 208, 210, and 212 and reduce the latency of starting to train or update machine learning models in MPC1 and MPC2. For example, this eliminates the need to transmit data to content platform 150, which then transmits that data to MPC1 and MPC2. Doing so reduces the amount of data transmitted over network 105 and reduces the complexity of the logic used by content platform 150 to process such data.

[0092] Computing systems MPC1 and MPC2 generate a machine learning model (step 214). Each time a new machine learning model is generated based on the user profile data can be referred to as a training session. Computing systems MPC1 and MPC2 can train the machine learning model based on the encrypted share of the user profile received from client device 110. For example, computing systems MPC1 and MPC2 can use MPC techniques to train a k-NN model based on the share of the user profile.

[0093] In order to minimize or at least reduce cryptographic computations, and thus minimize or at least reduce the computational burden placed on computing systems MPC1 and MPC2 to protect user privacy and data during both model training and inference, the MPC cluster 130 can use random projection techniques, such as SimHash, to quickly, securely, and probabilistically quantize the two user profiles P i and P j SimHash is a technique that can quickly estimate the similarity between two datasets. i and P j The similarity between two user profiles P can be expressed by determining i and P j The Hamming distance between the two bit vectors is determined, which is inversely proportional to the cosine distance between the two user profiles with high probability.

[0094] Conceptually, for each training session, one can generate m random projected hyperplanes U = {U1, U2, ..., U m The random projection hyperplane can also be called a random projection plane. One purpose of the multi-step computation between computing systems MPC1 and MPC2 is to generate a random projection hyperplane for each user profile P used in the training of the k-NN model. i Create a bit vector B of length m i In this bit vector B i In each bit B i，j Represents the projection plane U j and user profile P i The symbol of the dot product, that is, for all j∈[1,m], B i，j =sign(U j ⊙P i ), where ⊙ represents the dot product of two vectors of equal length. That is, each bit represents the user profile P i Located on the plane U i A place value of 1 indicates a positive sign, while a place value of 0 indicates a negative sign.

[0095] At each end of the multi-step computation, each of the two computing systems MPC1 and MPC2 generates an intermediate result that includes a bit vector for each user profile in plain text, a share for each user profile, and a share for each user profile's tag. For example, the intermediate result for computing system MPC1 can be the data shown in Table 1 below. Computing system MPC2 will have a similar intermediate result, but with different shares for each user profile and each tag. To add additional privacy protection, each of the two servers in MPC cluster 130 is only able to obtain half of the plain text's m-dimensional bit vectors. For example, computing system MPC1 obtains the first m / 2 dimensions of all m-dimensional bit vectors, and computing system MPC2 obtains the second m / 2 dimensions of all m-dimensional bit vectors.

[0096] Table 1

[0097] Bit vector in plaintext <![CDATA[For the MPC1 share of P i > <![CDATA[For the MPC1 share of label i > … … … <![CDATA[B i ]]> … … <![CDATA[B i+1 ]]> … … … … …

[0098] Given two arbitrary user profile vectors P with unit length i≠j i and P j , it has been shown that, assuming the number of random projections m is large enough, then two user profile vectors P i and P j The bit vector B i and B j The Hamming distance between the high probability and the user profile vector P i and P j is proportional to the cosine distance between them.

[0099] Based on the intermediate results shown above, and because the bit vector B i is plain text, each computing system MPC1 and MPC2 can use the k-NN algorithm, for example, by training to independently create a corresponding k-NN model. The computing systems MPC1 and MPC2 can use the same or different k-NN algorithms. An example process for training a k-NN model is shown in Figure 4 Once the k-NN model is trained, the application 112 can query the k-NN model to determine whether to add a user to a user group.

[0100] Application 112 submits an inference request to MPC cluster 130 (step 216). In this example, application 112 transmits the inference request to computing system MPC1. In other examples, application 112 can transmit the inference request to computing system MPC2. Application 112 can submit an inference request in response to a request from content platform 150 to submit an inference request. For example, content platform 150 can request application 112 to query the k-NN model to determine whether the user of client device 110 should be added to a particular user group. This request can be referred to as an inference request to infer whether the user should be added to a user group.

[0101] To initiate an inference request, the content platform 150 can send an inference request token M to the application 112. infer Infer the request token M infer Enables servers in the MPC cluster 130 to verify that the application 112 is authorized to query a specific machine learning model owned by a specific domain. If model access control is optional, the request token M is inferred. infer Is optional. Infer the request token M infer It is possible to have the following items shown and described in Table 2 below.

[0102] Table 2

[0103]

[0104] In this example, the request token M is inferred infer Includes seven items and a digital signature generated based on these seven items using the private key of the content platform 150. eTLD+1 is the effective top-level domain (eTLD) above the public suffix plus one level. An example eTLD+1 is "example.com", where ".com" is the top-level domain.

[0105] To request an inference for a specific user, the content platform 150 can generate an inference request token M infer The token is sent to the application 112 running on the user's client device 110. In some embodiments, the content platform 150 uses the public key of the application 112 to infer the request token M. infer The encryption is performed so that only the application 112 can infer the request token M using its confidential private key corresponding to the public key. infer That is, the content platform can send PubKeyEnc(M infer , application_lpublic_key).

[0106] The application 112 can decrypt and verify the inference request token M infer The application 112 can use its private key to decrypt the encrypted inference request token Minfer The application 112 can verify the inference request token M by infer : (i) verifying the digital signature using the public key of the content platform 150 corresponding to the private key of the content platform 150 used to generate the digital signature, and (ii) ensuring that the token creation timestamp is not stale, e.g., the time indicated by the timestamp is within a threshold amount of time of the current time at which the verification is occurring. If it is inferred that the request token M infer If valid, the application 112 can query the MPC cluster 130 .

[0107] Conceptually, an inference request can include a model identifier of a machine learning model, a current user profile P i , k (the number of nearest neighbors to be extracted), optionally additional signals (e.g., context signals or digital component signals), aggregation functions and aggregation function parameters. However, in order to prevent the user profile P in plain text from being i to either computing system MPC1 or MPC2, and thereby protecting user privacy, the application 112 can transfer the user profile P i Split into two shares for MPC1 and MPC2 respectively [P i，1 ] and [P i，2 ]. The application 112 can then select one of the two computing systems MPC1 or MPC2 for querying, for example randomly or pseudo-randomly. If the application 112 selects the computing system MPC1, the application 112 can send a query with a first share [P i，1 ] and an encrypted version of the second share (e.g., PubKeyEncrypt([P i，2 ], MPC2)). In this example, application 112 encrypts the second share [P i,2 ] to prevent the computing system MPC1 from accessing [P i ,2], which will enable the computing system MPC1 to be able to calculate the i,1 ] and [P i，2 ] to reconstruct the user profile P i .

[0108] As described in more detail below, computing systems MPC1 and MPC2 collaboratively compute k corresponding user profiles P iNearest neighbors. Computing systems MPC1 and MPC2 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine whether to add the user to the user group based on the k nearest neighbor user profiles. For example, an aggregation function can identify a machine learning technique (e.g., binary, multi-class, regression), and the aggregation function parameters can be based on the aggregation function. The aggregation function can define a calculation, such as a sum, a logical AND or OR, or another suitable function that is performed using parameters. For example, the aggregation function can be in the form of an equation that includes the function and the parameters used in the equation.

[0109] In some embodiments, the aggregation function parameters can include a user group identifier for the user group for which content platform 150 is querying the k-NN model for the user. For example, content platform 150 may want to know whether to add the user to a user group related to hiking and having a user group identifier of "hiking." In this example, the aggregation function parameters can include the "hiking" user group identifier. Generally speaking, computing systems MPC1 and MPC2 can determine whether to add the user to the user group based on the number of k nearest neighbors that are members of the user group, e.g., based on their labels.

[0110] The MPC cluster 130 provides the inference result to the application 112 (step 218). In this example, the computing system MPC1 that receives the query sends the inference result to the application 112. The inference result can indicate whether the application 112 should add the user to zero or more user groups. For example, the user group result can specify the user group identifier of the user group. However, in this example, the user group will be known to the computing system MPC1. To prevent this, the computing system MPC1 can calculate a share of the inference result, and the computing system MPC2 can calculate another share of the same inference result. The computing system MPC2 can provide an encrypted version of its share to the computing system MPC1, where the share is encrypted using the public key of the application 112. The computing system MPC1 can provide the application 112 with the encrypted version of the computing system MPC1's share of the inference result and the computing system MPC2's share of the user group result. The application 112 can decrypt the computing system MPC2's share and calculate the inference result based on the two shares. An example process for querying a k-NN model to determine whether to add a user to a user group is described in Figure 5 1 and described below. In some embodiments, to prevent computing system MPC1 from falsifying the results of computing system MPC2, computing system MPC2 digitally signs its results before or after encrypting them using the public key of application 112. Application 112 verifies the digital signature of computing system MPC2 using MPC2's public key.

[0111] The application 112 updates the user group list for the user (step 220). For example, if the inference result is to add the user to a specific user group, the application 112 can add the user to the user group. In some embodiments, the application 112 can prompt the user for permission to add the user to the user group.

[0112] The application 112 transmits a request for content (step 222). For example, the application 112 can send a request for a digital component to the content platform 150 in response to loading an electronic resource having a digital component slot. In some embodiments, the request can include one or more user group identifiers for a user group that includes the user as a member. For example, the application 112 can obtain one or more user group identifiers from a user group list and provide the user group identifiers with the request. In some embodiments, these techniques can be used to prevent the content platform from being able to associate a user group identifier with the user, application 112, and / or client device 112 from which the request was received.

[0113] The content platform 150 delivers the content to the application 112 (step 224). For example, the content platform 150 can select a digital component based on the user group identifier and provide the digital component to the application 112. In some embodiments, the content platform 150 cooperates with the application 112 to select the digital component based on the user group identifier without leaking the user group identifier outside of the application 112.

[0114] The application 112 displays or otherwise implements the received content (step 226). For example, the application 112 can display the received digital component in a digital component slot of the electronic resource.

[0115] Example process for generating a user profile

[0116] Figure 3 is a flow chart illustrating an example process 300 for generating a user profile and sending shares of the user profile to an MPC cluster. The operations of process 300 can be performed, for example, by Figure 1 The process 300 may be implemented by the client device 110, for example, by the application 112 running on the client device 110. The operations of the process 300 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of the process 300.

[0117] Application 112 executing on the user's client device 110 receives data for an event (step 302). The event can be, for example, the presentation of an electronic resource at client device 110, the presentation of a digital component at client device 110, user interaction with an electronic resource or digital component at client device 110, or a transition of a digital component, or the lack of user interaction or transition with the presented electronic resource or digital component. When an event occurs, content platform 150 can provide data related to the event to application 112 for use in generating a user profile for the user.

[0118] The application 112 can generate a different user profile for each content platform 150. That is, the user's user profile for a specific content platform 150 can only include event data received from the specific content platform 150. This protects user privacy by not sharing data related to events of other content platforms with the content platform. In some embodiments, the application 112 can generate a different user profile for each machine learning model owned by the content platform 150 based on the request of the content platform 150. Based on the design goals, different machine learning models may require different training data. For example, a first model can be used to determine whether to add a user to a user group. A second model can be used to predict whether the user will interact with a digital component. In this example, the user profile of the second model can include additional data that the user profile of the first model does not have, such as whether the user interacts with the digital component.

[0119] The content platform 150 can update the token M with the profile update The event data is sent in the form of the profile update token M update There are the following items shown and described in Table 3 below.

[0120] Table 3

[0121]

[0122]

[0123] The model identifier identifies the machine learning model that the user profile will be used to train or use to make user group inferences, such as a k-NN model. A profile record is an n-dimensional feature vector that includes event-specific data, such as the type of event, the electronic resource or digital component, the time when the event occurred, and / or other appropriate event data that the content platform 150 wishes to use when training the machine learning model and making user group inferences. A digital signature is generated based on these seven items using the content platform 150's private key.

[0124] In some embodiments, to protect the update token M during transmission update , the content platform 150 will update the token Mupdate Before sending to the application 112, update the token M update For example, the content platform 150 can use the public key of the application, such as PubKeyEnc(M update , application_public_key), to encrypt the update token M update .

[0125] In some embodiments, the content platform 150 can send event data to the application 112 without a profile update token M. update For example, a script originating from content platform 150 running within application 112 can transmit event data and update requests directly to application 112 via the scripting API, where application 112 relies on the World Wide Web Consortium (W3C) origin-based security model and / or (Hypertext Transfer Protocol Secure) HTTPS to protect event data and update requests from forgery or leakage.

[0126] Application 112 stores the data for the event (step 304). If the event data is encrypted, application 112 can decrypt the event data using its private key, which corresponds to the public key used to encrypt the event data. update The application 112 can verify the update token M before storing the event data. update The application 112 can verify the update token M by update : (i) verifying the digital signature using the public key of the content platform 150 that corresponds to the private key of the content platform 150 used to generate the digital signature, and (ii) ensuring that the token creation timestamp is not stale, e.g., the time indicated by the timestamp is within a threshold amount of time of the current time at which the verification is occurring. update If the validation fails, the application 112 can ignore the update request, for example, by not storing the event data.

[0127] For each machine learning model, for example, for each unique model identifier, application 112 can store event data for the model. For example, application 112 can maintain a data structure including a set of n-dimensional feature vectors (e.g., a profile record of an update token) for each unique model identifier, and maintain an expiration time for each feature vector. Each feature vector can include feature values ​​of features related to events of the user of client device 110. An example data structure for a model identifier is shown in Table 4 below.

[0128] Table 4

[0129] Eigenvector Expiration n-dimensional feature vector Expiration date … …

[0130] Upon receiving a valid update token M update When the application 112 can update the token M update The feature vector and expiration time are added to the data structure to update the token M included in the update update The application 112 can periodically purge expired feature vectors from the data structure to reduce storage size.

[0131] The application 112 determines whether to generate a user profile (step 306). For example, the application 112 may generate a user profile for a particular machine learning model in response to a request from the content platform 150. The request may be to generate a user profile and return a share of the user profile to the content platform 150. In some embodiments, the application 112 may directly upload the generated user profile to the MPC cluster 130, for example, rather than sending them to the content platform 150. To ensure the security of the request to generate and return a share of the user profile, the content platform 150 may send an upload token M to the application 112. upload .

[0132] Upload token M upload Ability to have and update token M update Similar structure, but with different operations (e.g. "update server" instead of "accumulate user profile"). Upload Token M upload An additional item for an operation delay can also be included. The operation delay can instruct the application 112 to delay calculating and uploading the shares of the user profile while the application 112 accumulates more event data, such as more feature vectors. This enables the machine learning model to capture user event data immediately before and after certain key events, such as joining a user group. The operation delay can specify a delay period. In this example, the content platform's private key can be used to generate a digital signature based on the other seven items in Table 3 and the operation delay. The content platform 150 can use the application's public key to update the token M. update Encrypt the upload token M in a similar way upload (For example, PubKeyEnc(M upload ,application_public_key)) to protect the upload token M during transmission upload .

[0133] The application 112 can receive the upload token M upload If the upload token M upload If encrypted, decrypt the upload token M upload , and verify the upload token M upload This verification can be similar to verifying the update token Mupload The application 112 can verify the upload token M by upload : (i) verifying the digital signature using the public key of the content platform 150 corresponding to the private key of the content platform 150 used to generate the digital signature, and (ii) ensuring that the token creation timestamp is not stale, e.g., the time indicated by the timestamp is within a threshold amount of time of the current time at which the verification is occurring. upload If the user profile is valid, the application 112 can generate the user profile. If any verification fails, the application 112 can ignore the upload request, for example by not generating the user profile.

[0134] In some embodiments, the content platform 150 can request the application 112 to upload the user profile without a profile upload token M. upload For example, a script originating from content platform 150 running within application 115 can transmit the upload request directly to application 115 via the scripting API, where application 115 relies on the W3C origin-based security model and / or HTTPS to protect the upload request from forgery or leakage.

[0135] If it is determined not to generate a user profile, process 300 can return to operation 302 and await additional event data from content platform 150. If it is determined to generate a user profile, application 112 generates the user profile (step 308).

[0136] The application 112 can generate a user profile based on the stored event data, for example, the data stored in the data structure shown in Table 4. The application 112 can generate a user profile based on the model identifier included in the request, for example, the upload token M. upload The content platform eTLD+1 domain of Project 1 and the model identifier of Project 2 are used to access the appropriate data structure.

[0137] Application 112 can calculate a user profile by aggregating n-dimensional feature vectors from the data structure that have not expired during the study period. For example, the user profile can be the average of the n-dimensional feature vectors from the data structure that have not expired during the study period. The result is an n-dimensional feature vector representing the user in the profile space. Optionally, application 112 can normalize the n-dimensional feature vector to unit length, for example, using L2 normalization. Content platform 150 can specify an optional study period.

[0138] In some embodiments, the decay rate can be used to calculate the user profile. Since there may be many content platforms 150 using the MPC cluster 130 to train the machine learning model and each content platform 150 may have multiple machine learning models, storing user feature vector data may result in significant data storage requirements. Using decay techniques can significantly reduce the amount of data stored at each client device 110 for the purpose of generating the user profile used to train the machine learning model.

[0139] Assume that, for a given machine learning model, there are k feature vectors {F1, F2, ...F k}, each of which is an n-dimensional vector and their corresponding age (record_age_in_seconds i ). The application 112 can use the following relationship 1 to calculate the user profile:

[0140] Relation 1: In this relation, the parameter record_age_in_seconds i is the amount of time in seconds that the profile record has been stored at the client device 110, and the parameter decay_rate_in_seconds is the decay rate of the profile record in seconds (e.g., contained in the update token M update 6). This way, the most recent feature vector carries more weight. This also enables application 112 to avoid storing feature vectors and store only profile records in constant memory. Application 112 only needs to store the n-dimensional vector P and the timestamp user_profile_time for each model identifier, rather than multiple individual feature vectors for each model identifier. This significantly reduces the amount of data that must be stored on client device 110, many of which typically have limited data storage capacity.

[0141] To initialize the n-dimensional vector user profile P and timestamp, the application can set the vector P to an n-dimensional vector with the value of each dimension being zero and user_profile_time to the epoch. x To update the user profile P, the application 112 can use the following relation 2:

[0142] Relation 2:

[0143] The application 112 can also update the user profile time to the current time (current_time) when updating the user profile using relation 2. Note that if the application 112 calculates the user profile using the above-mentioned decay rate algorithm, operations 304 and 308 are omitted.

[0144] The application 112 generates a share of the user profile (step 310). The application 112 can use a pseudo-random function to convert the user profile P i (eg, n-dimensional vector P) into multiple shares. That is, the application 112 can use a pseudo-random function PRF (P i ) to generate user profile P i The two shares of {[P i，1 ],[P i，2 ]}. The exact split can depend on the secret sharing algorithm and cryptographic library used by application 112. In some embodiments, the application uses Shamir's secret sharing scheme. If one or more label shares are provided, application 112 can also generate a label share.

[0145] Application 112 to user profile P i The share of {[P i，1 ],[P i，2 ]} encrypt (step 312). For example, as described above, the application 112 can generate a composite message including the user profile's share and the tag's share, and encrypt the composite message to obtain the encryption result PubKeyEncrypt ([P i，1 ]||[label i，1 ],MPC1) and PubKeyEncrypt([P i，2 ]||[label i，2 ], MPC2). Encrypting the shares using the encryption key of MPC cluster 130 prevents content platform 150 from being able to access the user profile in clear text. Application 112 transmits the encrypted shares to the content platform (step 314). Note that if application 112 transmits the secret shares directly to computing systems MPC1 and MPC2, operation 314 is omitted.

[0146] Example procedures for building and using machine learning models

[0147] Figure 4 is a flow chart illustrating an example process 400 for generating a machine learning model. The operations of process 400 can be performed, for example, by Figure 1 The operations of process 400 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 400.

[0148] The MPC cluster 130 obtains a share of the user profile (step 402). The content platform 150 can request the MPC cluster 130 to train a machine learning model by transmitting the share of the user profile to the MPC cluster 130. The content platform 150 can access the encrypted shares for the machine learning model received from the client device 110 within a given time period and upload those shares to the MPC cluster 130.

[0149] For example, content platform 150 can transmit an encrypted first share of the user profile and each user profile P to computing system MPC1. i The first share of its encrypted label (e.g., PubKeyEncrypt ([P i，1 ]||[label i，1 ], MPC1). Similarly, the content platform 150 can transmit the encrypted second share of the user profile and each user profile P to the computing system MPC2. i The encrypted second share of its label (e.g., PubKeyEncrypt([P i，2 ]||[label i，2 ],MPC2).

[0150] In some embodiments where application 112 sends the secret share of the user profile directly to MPC cluster 130 , content platform 150 can request MPC cluster 130 to train the machine learning model by transmitting a training request to MPC cluster 130 .

[0151] The computing systems MPC1 and MPC2 create random projection planes (step 404). The computing systems MPC1 and MPC2 can collaboratively create m random projection planes U={U1, U2, ...U m These random projection planes should be kept as a secret share between the two computing systems MPC1 and MPC2. In some embodiments, computing systems MPC1 and MPC2 create the random projection planes and use a Diffie-Hellman key exchange technique to maintain their secrecy.

[0152] As described in more detail below, computing systems MPC1 and MPC2 project their shares of each user profile onto each random projection plane and determine for each random projection plane whether the user profile's share is on one side of the random projection plane. Each computing system MPC1 and MPC2 can then construct a bit vector in the secret share from the user profile's secret share based on the results of each random projection. Partial knowledge of the user's bit vector, e.g., the user profile P i Is it in the projection plane U? k side, allowing the computing system MPC1 or MPC2 to obtain information about P iSome knowledge of the distribution of i The prior knowledge of unit length is increased. To prevent computing systems MPC1 and MPC2 from gaining access to this information (e.g., in embodiments where this is desired or preferred for user privacy and / or data security), in some embodiments, the random projection plane is in a secret share so that neither computing system MPC1 nor MPC2 can access the random projection plane in plain text. In other embodiments, a random bit flipping pattern can be applied to the random projection result using a secret share algorithm, as described in optional operations 406-408.

[0153] To demonstrate how to flip bits via secret shares, assume there are two secrets x and y whose values ​​are either zero or one with equal probability. If y == 0, then the equality operation [x] == [y] will flip the bits of x, and if y == 1, it will keep the bits of x. This operation can require a remote procedure call (RPC) between the two computing systems MPC1 and MPC2, and the number of rounds depends on the data size and the chosen secret sharing algorithm.

[0154] Each computing system MPC1 and MPC2 creates a secret m-dimensional vector (step 406). The computing system MPC1 is capable of creating a secret m-dimensional vector {S1, S2, ... S m}, where each element S i With equal probability, it has the value of zero or one. The computing system MPC1 divides its m-dimensional vector into two shares, the first share {[S 1,1 ]、[S 2,1 ]、…[S m,1 ]} and the second share {[S 1,2 ]、[S 2,2 ]、…[S m,2 ]}. The computing system MPC1 can keep the first share secret and provide the second share to the computing system MPC2. The computing system MPC1 can then discard the m-dimensional vector {S1, S2, ... S m}.

[0155] The computing system MPC2 is able to create a secret m-dimensional vector {T1, T2, ...T m}, where each element T i Has a value of zero or one. The computing system MPC2 divides its m-dimensional vector into two shares, the first share and the second share {[T 1，2 ],[T 2，2 ],...[T m，2]}. The computing system MPC2 can keep the first share secret and provide the second share to the computing system MPC1. The computing system MPC2 can then discard the m-dimensional vector {T1, T2, ... T m}.

[0156] The two computing systems MPC1 and MPC2 use secure MPC techniques to calculate the share of the bit flip pattern (step 408). The computing systems MPC1 and MPC2 can use multiple round trips between computing systems MPC1 and MPC2 to calculate the share of the bit flip pattern using a secret share MPC equality test. The bit flip pattern can be based on the above operation [x] == [y]. That is, the bit flip pattern can be {S1=T1, S2=T2, ... S m =T m}. Let each ST i =(S i ==T i ). Each ST i has a value of zero or one. After the MPC operation is completed, the computing system MPC1 has a first share of the bit flip pattern {[ST 1，1 ],[ST 2，1 ],...[ST m，1 ]}, and the computing system MPC2 has a second share of the bit-flip pattern {[ST 1，2 ],[ST 2，2 ],...[ST m，2 ]}. Each ST i The share of enables the two computing systems MPC1 and MPC2 to flip bits in the bit vector in a manner that is not transparent to either of the two computing systems MPC1 and MPC2.

[0157] Each computing system MPC1 and MPC2 projects the shares of each of its user profiles onto each random projection plane (step 410). That is, for each user profile for which computing system MPC1 receives a share, computing system MPC1 can project the share [P i，1 ] projected onto each projection plane U j For each share of the user profile and for each random projection plane U j Performing this operation produces a z×m dimensional matrix R, where z is the number of available user profiles and m is the number of random projection planes. Each element R in the matrix R i,j The projection plane U can be calculated j and share [P i,1 ] to determine the dot product between them, for example, R i,j =U j ⊙[P i,1 ]. The operation ⊙ represents the dot product of two vectors of equal length.

[0158] If bit flipping is used, computing system MPC1 can modify one or more elements R in the matrix using a bit flipping pattern secretly shared between computing systems MPC1 and MPC2. i,j For each element R in the matrix R i，j , the computing system MPC1 is able to compute [ST j,1 ]=sign(R i,j ) as element R i，j Therefore, if the bit is flipped in bit The element R in i，j The corresponding bit of R has a value of zero, then the element R i，j The sign of will be flipped. This calculation can require multiple RPCs for the computing system MPC2.

[0159] Similarly, for each user profile for which computing system MPC2 receives shares, computing system MPC2 can convert the shares [P i,2 ] projected onto each projection plane U j For each share of the user profile and for each random projection plane U j Performing this operation produces a matrix R' of dimension z x m, where z is the number of available user profiles and m is the number of random projection planes. Each element R in the matrix R' i，j’ The projection plane U can be calculated j and share [P i，2 ] to determine the dot product between them, for example, R i，j '=U j ⊙[P i，2 ]. The operation ⊙ represents the dot product of two vectors of equal length.

[0160] If bit flipping is used, computing system MPC2 can modify one or more elements R in the matrix using a bit flipping pattern secretly shared between computing systems MPC1 and MPC2. i，j '. For each element R in the matrix R i，j ', the computing system MPC2 is able to calculate [ST j，2 ]==sign(R i，j ') as element R i，j ' value. Therefore, if in bit flip mode j The element R in i，j ' has a zero value, the sign of the element will be flipped. This calculation can require multiple RPCs for the computing system MPC1.

[0161] Computing systems MPC1 and MPC2 reconstruct the bit vector (step 412). Computing systems MPC1 and MPC2 can reconstruct the bit vector of the user profile based on matrices R and R' having exactly the same size. For example, computing system MPC1 can send a portion of the columns of matrix R to computing system MPC2, and computing system MPC2 can send the remaining portion of the columns of matrix R' to MPC1. In a specific example, computing system MPC1 can send a first half of the columns of matrix R to computing system MPC2, and computing system MPC2 can send a second half of the columns of matrix R' to MPC1. Although columns are used for horizontal reconstruction in this example and are preferred to protect user privacy, in other examples, rows can be used for vertical reconstruction.

[0162] In this example, computing system MPC2 can combine the first half of the columns of matrix R' with the first half of the columns of matrix R received from computing system MPC1 to reconstruct the first half of the plaintext bit vector (i.e., m / 2 dimensions). Similarly, computing system MPC1 can combine the second half of the columns of matrix R with the second half of the columns of matrix R' received from computing system MPC2 to reconstruct the second half of the plaintext bit vector (i.e., m / 2 dimensions). Conceptually, computing systems MPC1 and MPC2 have now combined corresponding shares of the plaintext reconstructed bit matrix B from the two matrices R and R'. This bit matrix B will include the bit vectors of the projection results (projected onto each projection plane) for each user profile whose share was received from content platform 150 for the machine learning model. Each of the two servers in MPC cluster 130 has half of the plaintext bit matrix B.

[0163] However, if bit flipping is used, computing systems MPC1 and MPC2 have flipped the bits of the elements in matrices R and R' using a random pattern fixed for the machine learning model. This random bit flipping pattern is opaque to either computing system MPC1 or MPC2, making it impossible for computing systems MPC1 and MPC2 to infer the original user profile from the bit vector of the projection result. The cryptographic design also prevents MPC1 and MPC2 from inferring the original user profile by splitting the bit vector horizontally, i.e., computing system MPC1 keeps the second half of the bit vector of the projection result in plain text, and computing system MPC2 keeps the first half of the bit vector of the projection result in plain text.

[0164] Computing systems MPC1 and MPC2 generate machine learning models (step 414). Computing system MPC1 can use the second half of the bit vector to generate a k-NN model. Similarly, computing system MPC2 can use the first half of the bit vector to generate a k-NN model. Generating the model using bit flipping and horizontal partitioning of the matrix applies the principle of defense in depth to protect the confidentiality of the user profile used to generate the model.

[0165] Typically, each k-NN model represents the cosine similarity (or distance) between the user profiles of a set of users. The k-NN model generated by computing system MPC1 represents the similarity between the second half of the bit vectors, and the k-NN model generated by computing system MPC2 represents the similarity between the first half of the bit vectors. For example, each k-NN model can define the cosine similarity between the similarities between the first half of its bit vectors.

[0166] The two k-NN models generated by computing systems MPC1 and MPC2 can be referred to as k-NN models, which have unique model identifiers as described above. Computing systems MPC1 and MPC2 can store their models and a share of the labels for each user profile used to generate the models. Content platform 150 can then query the models to make inferences about user groups for the user.

[0167] Example process of using a machine learning model to infer user groups

[0168] Figure 5 is a flow chart illustrating an example process 500 for adding a user to a user group using a machine learning model. The operations of process 500 can be performed, for example, by Figure 1 The operations of process 500 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 500.

[0169] The MPC cluster 130 receives an inference request for a given user profile (step 502). The application 112 running on the user's client device 110 can transmit the inference request to the MPC cluster 130, for example, in response to a request from the content platform 150. For example, the content platform 150 can transmit an upload token M to the application 112. infer , to request the application 112 to submit an inference request to the MPC cluster 130. The inference request can be to query whether the user should be added to any number of user groups.

[0170] Infer request token M infer Can include a share of a given user profile for a user, a model identifier of a machine learning model (e.g., a k-NN model) and the owner domain to be used for inference, the number k of nearest neighbors of the given user profile to be used for inference, additional signals (e.g., context signals or digital component signals), the aggregation function to be used for inference and any aggregation function parameters to be used for inference, and a signature of all of the above information created by the owner domain using the owner domain secret private key.

[0171] As mentioned above, in order to prevent a given user profile P in plain text from being i to the computing system MPC1 or MPC2, and thereby protecting user privacy, the application 112 can assign a given user profile P i Split into two shares for MPC1 and MPC2 respectively [P i，1 ] and [P i，2 ]. The application 112 can then send a first share [P i，1 ] and an encrypted version of the second share (e.g., PubKeyEncrypt([P i，2 ], MPC2)) of a single inference request. The inference request may also include an inference request token M infer , enabling the MPC cluster 130 to authenticate the inference request. By sending an inference request including the first share and the encrypted second share, the number of outgoing requests sent by the application 112 is reduced, resulting in computation, bandwidth, and battery savings at the client device 110.

[0172] In other embodiments, the application 112 can assign a first share [P i，1 ] is sent to the computing system MPC1 and the second share [P i，2 ] is sent to the computing system MPC2. By i，2 ] is sent to the computing system MPC2 without passing through the computing system MPC1, the second share does not need to be encrypted to prevent the computing system MPC1 from accessing the second share of the given user profile [P i，2 ].

[0173] Each computing system MPC1 and MPC2 identifies the k nearest neighbors of a given user profile in the secret share representation (step 504). The computing system MPC1 can use the first share [P i，1 ] to calculate half of the bit vector for a given user profile. To generate the bit vector, the computing system MPC1 can use Figure 4 That is, the computing system MPC1 can use the random projection vectors generated for the k-NN model to project the shares [P i，1 ] and create a secret share of the bit vector for a given user profile. If bit flipping is used to generate the k-NN model, the computing system MPC1 can then use the first share of the bit flipping pattern used to generate the k-NN model {[ST 1，1 ],[ST 2，1 ],...[ST m，1]} to modify the elements of the secret share of the bit vector for a given user profile.

[0174] Similarly, computing system MPC1 can provide computing system MPC2 with an encrypted second share PubKeyEncrypt([P i，2 ], MPC2). The computing system MPC2 is able to decrypt the second share of the given user profile using its private key [P i，2 ], and using the second share of the given user profile [P i，2 ] to calculate half of the bit vector of a given user profile. That is, the computing system MPC2 is able to use the random projection vectors generated for the k-NN model to project the share [P i，2 ] and create a bit vector for a given user profile. If bit flipping is used to generate the k-NN model, the computing system MPC2 can then use a second share of the bit flipping pattern used to generate the k-NN model {[ST 1,2 ],[ST 2,2 ],...[ST m，2 ]} to modify the elements of the bit vector for a given user profile. The computing systems MPC1 and MPC2 then reconstruct the bit vector using horizontal partitioning, such as Figure 4 After the reconstruction is complete, computing system MPC1 has a first half of the total bit vector for the given user profile, and computing system MPC2 has a second half of the total bit vector for the given user profile.

[0175] Each computing system MPC1 and MPC2 uses half of its bit vector for a given user profile and its k-NN model to identify k' nearest neighbor user profiles, where k' = a × k, where a is empirically determined based on actual production data and statistical analysis. For example, a = 3 or another suitable number. Computing system MPC1 can calculate the Hamming distance between the first half of the total bit vector and the bit vector for each user profile in the k-NN model. Computing system MPC1 then identifies the k' nearest neighbors based on the calculated Hamming distances, for example, the k' user profiles with the lowest Hamming distances. In other words, computing system MPC1 identifies a set of nearest neighbor user profiles based on the share of the given user profile and the k-nearest neighbor model trained using multiple user profiles. Example results are shown in tabular form in Table 5 below.

[0176] Table 5

[0177]

[0178] In Table 5, each row is for a particular nearest-neighbor user profile and includes the Hamming distance between the first half of the bit vector of each user profile and the bit vector of the given user profile calculated by computing system MPC 1. The row for a particular nearest-neighbor user profile also includes the first share for that user profile and the first share for the tag associated with that user profile.

[0179] Similarly, computing system MPC2 can calculate the Hamming distance between the second half of the total bit vector and the bit vector of each user profile of the k-NN model. Computing system MPC2 then identifies the k' nearest neighbors based on the calculated Hamming distances, e.g., the k' user profiles with the lowest Hamming distances. Example results in tabular form are shown in Table 6 below.

[0180] Table 6

[0181]

[0182] In Table 6, each row is for a particular nearest neighbor user profile and includes the Hamming distance between that user profile and a given user profile calculated by computing system MPC 2. The row for a particular nearest neighbor user profile also includes the second share of that user profile and the second share of the tags associated with that user profile.

[0183] Computing systems MPC1 and MPC2 can exchange lists of row identifiers (row IDs) and Hamming distance pairs. Thereafter, each computing system MPC1 and MPC2 can independently select k nearest neighbors using the same algorithm and input data. For example, computing system MPC1 can find row identifiers that are common to the partial query results from both computing systems MPC1 and MPC2. For each row identifier i in common, computing system MPC1 calculates a combined Hamming distance d based on the two partial Hamming distances. i , for example, d i =d i，1 +d i，2 The computing system MPC1 is then able to calculate the value of the combined Hamming distance d i Sort the common row identifiers and select the k nearest neighbors. The row identifiers of the k nearest neighbors can be represented as ID={id1, ...id k}. It can be shown that if a is large enough, then the k nearest neighbors determined in the above algorithm are with high probability the true k nearest neighbors. However, large values ​​of a result in high computational cost. In some embodiments, computing systems MPC1 and MPC2 participate in a Private Set Intersection (PSI) algorithm to determine row identifiers that are common to the partial query results from computing systems MPC1 and MPC2. Furthermore, in some embodiments, MPC1 and MPC2 participate in an Enhanced Private Set Intersection (PSI) algorithm to compute d of row identifiers that are common to the partial query results from both computer systems MPC1 and MPC2. i =d i，1 +d i，2 , and does not reveal anything to MPC1 or MPC2, but reveals the content of the i Determine the top k nearest neighbors.

[0184] A determination is made as to whether to add the user to the user group (step 506). This determination can be made based on the k nearest neighbor profiles and their associated labels. The determination is also based on the aggregation function used and any aggregation parameters of the aggregation function. The aggregation function can be selected based on the nature of the machine learning problem, for example, binary classification, regression (e.g., using arithmetic mean or root mean square), multi-class classification, and weighted k-NN. Each approach to determining whether to add the user to the user group can include different interactions between the MPC cluster 130 and the application 112 running on the client 110, as described in more detail below.

[0185] If it is determined not to add the user to the user group, the application 112 may not add the user to the user group (step 508). If it is determined to add the user to the user group, the application 112 can add the user to the user group, for example, by updating the user group list stored at the client device 110 to include the user group identifier of the user group (step 510).

[0186] Example binary classification inference technique

[0187] For binary classification, the inference request can include the threshold, L true and L false As an aggregation function parameter. The label value is a Boolean type, that is, true or false. The threshold parameter can indicate that a label must have a true value in order to add a user to the user group L. true Otherwise, the user will be added to the user group L false In one approach, if the number of nearest neighbor user profiles with a true tag value is greater than the product of threshold and k, the MPC cluster 130 may instruct the application 112 to add the user to the user group L. true (Otherwise Lfalse ). However, the computing system MPC1 will learn to infer results, such as the user group that the user should join.

[0188] To protect user privacy, the inference request can include the plaintext threshold, the first share for computing system MPC1 [L true，1 ] and [L false,1 ], and the encrypted second share PubKeyEncrypt([L true,2 ]||[L false,2 ]||application_public_key,MPC2). In this example, the application 112 can true,2 ]、[L fasle,2 ] and the public key of application 112 to generate a composite message, as represented by the symbol ||, and encrypt the composite message using the public key of computing system MPC2. The inference response from computing system MPC1 to application 112 can include a first share of the inference result determined by computing system MPC1 [L result,1 ] and a second share of the inference results determined by the computing system MPC2 [L result,2 ].

[0189] In order to prevent the second share from being accessed by the computing system MPC1 and thus enable the computing system MPC1 to obtain the inference result in plain text, the computing system MPC2 can convert the second share of the inference result [L result,2 ] (e.g., PubKeySign(PubKeyEncrypt([L result，2 ], application_public_key), MPC2)) is sent to computing system MPC1 for inclusion in the inference response sent to application 112. In this example, application 112 can verify the digital signature using the public key of computing system MPC2 corresponding to the private key of computing system MPC2 used to generate the digital signature, and use the second share [L result，2 ]'s public key (application_public_key) corresponding to the private key of the application 112 to decrypt the second share of the inference result [L result，2 ].

[0190] The application 112 can then calculate the value of the first share [L result，1 ] and the second share [L result，2 ] to reconstruct the inference result L resultUsing digital signatures enables application 112 to detect falsification of results from computing system MPC2, for example, by computing system MPC1. Depending on the desired level of security, which parties operate the computing systems of MPC cluster 130, and the assumed security model, digital signatures may not be required.

[0191] The computing systems MPC1 and MPC2 can use MPC techniques to determine the share of binary classification results [L result，1 ] and [L result，2 ]. In binary classification, the value of label1 of a user profile is either zero (false) or one (true). Assume that the selected k nearest neighbors are represented by identifiers {id1, ...id k}, the computing systems MPC1 and MPC2 can calculate the sum of the labels of the k nearest neighbor user profiles (sum_of_labels), where the sum is represented by the following relation 3:

[0192] Relation 3: sum_of_labels = ∑ i∈{id1，...idk} label i

[0193] To determine the sum, the computing system MPC1 sends the IDs (ie {id1, ...id k}). The computing system MPC2 is able to verify that the number of row identifiers in ID is greater than a threshold for enforcing k-anonymity. The computing system MPC2 is then able to calculate a second share of the sum of labels [sum_of_labels2] using the following relation 4:

[0194] Relation 4: [sum_of_labels2] = ∑ i∈{id1，...idk} [label i，2 ]

[0195] The computing system MPC1 can also calculate a first share of the sum of labels [sum_of_labels1] using the following relation 5:

[0196] Relation 5: [sum_of_labels1] = ∑ i∈{id1，...idk} [label i，1 ]

[0197] If the sum of labels sum_of_labels is confidential information that the computing systems MPC1 and MPC2 should know as little as possible, the computing system MPC1 can calculate whether a first share of the sum of labels [sum_of_labels1] is below a threshold, for example, [below_threshold1]=[sum_of_labels1]<threshold×k. Similarly, the computing system MPC2 can calculate whether a second share of the sum of labels [sum_of_labels2] is below a threshold, for example, [below threshold2]=[sum of labels2]<threshold×k. The computing system MPC1 can continue to calculate the sum of labels [sum_of_labels2] by [below threshold1]×[L false，1 ]+(1-[below_threshold1])×[L true，1] To calculate the inference results [L result，1 ]. Similarly, the computing system MPC2 can pass [below_threshold2]×[L false，2 ]+(1-[below_threshold2])×[L true，2 ] to calculate [L result，2 ].

[0198] If the sum of labels sum_of_labels is not confidential information, computing systems MPC1 and MPC2 can reconstruct sum_of_labels from [sum_of_labels1] and [sum_of_labels2]. Computing systems MPC1 and MPC2 can then set the parameter below_threshold to sum_of_labels<threshold×k, e.g., to one if it is below the threshold, or to zero if it is not below the threshold.

[0199] After calculating the parameter below_thresfold, the computing systems MPC1 and MPC2 can continue to determine the inference result L result For example, the computing system MPC2 can set [L result，2 ] is set to [L true，2 ] or [L false，2 For example, the computing system MPC2 can convert [L result，2 ] is set to [L true，2 ], or set to [L false，2 The computing system MPC2 can then encrypt the second share of the inference result (PubKeyEncrypt(Lresult，2 ], application_public_key))[l1] or a digitally signed version of the result is returned to the computing system MPC1.

[0200] Similarly, the computing system MPC1 can set [L result，1 ] is set to [L true，1 ] or [L false，1 For example, the computing system MPC1 can convert [L result，1 ] is set to [L true，1 ], or set to [L false，1 ]. The computing system MPC1 is capable of sending the first share of the inference result [L result，1 ] and the encrypted second share of the inference result [L result，2 ] is transmitted as an inference response to the application 112. The application 112 can then calculate the inference result based on the two shares, as described above.

[0201] Example multi-class classification inference technique

[0202] For multi-class classification, the label associated with each user profile can be a classification feature. The content platform 150 can specify a lookup table that maps any possible category value to a corresponding user group identifier. This lookup table can be one of the aggregation function parameters included in the inference request.

[0203] Within the k nearest neighbors found, the MPC cluster 130 finds the most frequent tag value. The MPC cluster 130 can then find the user group identifier corresponding to the most frequent tag value in the lookup table and request the application 112 to add the user to the user group corresponding to the user group identifier, for example, by adding the user group identifier to the user group list stored at the client device 110.

[0204] Similar to binary classification, it is preferred to hide the inference results L from the computing systems MPC1 and MPC2 result To this end, the application 112 or the content platform 150 can create two lookup tables, each mapping a category value to an inference result L result For example, the application can create a mapping of the category value to the first share [L result1 ] and maps the category value to the second share [L result2]. An inference request from the application to computing system MPC1 can include the plaintext first lookup table for computing system MPC1 and an encrypted version of the second lookup table for computing system MPC2. The second lookup table can be encrypted using the public key of computing system MPC2. For example, a composite message including the second lookup table and the public key of the application can be encrypted using the public key of computing system MPC2, e.g., PubKeyEncrypt(lookuptable2||application_public_key, MPC2).

[0205] The inference response sent by the computing system MPC1 can include a first share of the inference result generated by the computing system MPC1 [L result1 Similar to binary classification, in order to prevent the second share from being accessed by the computing system MPC1 and thus enable the computing system MPC1 to obtain the inference result in plain text, the computing system MPC2 can convert the second share of the inference result [L result，2 ] (e.g., PubKeySign(PubKeyEncrypt([L result，2 ], application public key), MPC2)) is sent to computing system MPC1 to be included in the inference results sent to application 112. Application 112 can result1 ] and [L result1 ]Reconstruct the inference result L result .

[0206] Assume that there are w valid labels {l1, l2, ...l w}. In order to determine the inference result L in multi-class classification result Share of [L result1 ] and [L result2 ], the computing system MPC1 sends IDs to the computing system MPC2 (ie, {id1, ...id k}). The computing system MPC2 is able to verify that the number of row identifiers in ID is greater than a threshold for enforcing k-anonymity. Typically, k in k-NN can be significantly greater than k in k-anonymity. The computing system MPC2 is then able to calculate the jth label [l j，2 ]'s second frequency share [frequency j，2 ], which is defined using the following relation 6.

[0207] Relationship 6:

[0208] Similarly, the computing system MPC1 computes the jth label [l j，1]The first frequency share [frequency j，1 ], which is defined using the following relation 7.

[0209] Relationship 7:

[0210] Assume that the frequency of the label in the k nearest neighbors i ) is not sensitive, the computing systems MPC1 and MPC2 can calculate the two shares of the label [frequency i，1 ] and [frequency i，2 Reconstruct frequency i The computing systems MPC1 and MPC2 are then able to determine where the frequency index The index parameter (index) with the maximum value, for example, index = argmax i (frequency i ).

[0211] The computing system MPC2 is then able to look up in its lookup table the share corresponding to the tag with the highest frequency [L result,2 ], and PubKeyEncrypt([L result,2 ], application_public_key) is returned to the computing system MPC1. The computing system MPC1 can similarly look up in its lookup table the share corresponding to the label with the highest frequency [L result,1 ]. The computing system MPC1 can then send to the application 112 a packet including two shares (eg, [L result,1 ] and PubKeyEncrypt[L result,2 ], application_public_key). As described above, the second share can be digitally signed by computing system MPC2 to prevent computing system MPC1 from forging computing system MPC2's response. Application 112 can then calculate an inference result based on the two shares, as described above, and add the user to the user group identified by the inference result.

[0212] Example regression inference technique

[0213] For regression, the labels associated with each user profile P must be numeric. The content platform 150 can specify an ordered list of thresholds, e.g., (-∞ <t0<t1<...<t n <∞), and a list of user group identifiers, e.g., {L0, L1, ...L n , L n+1Additionally, the content platform 150 can specify an aggregation function, such as arithmetic mean or root mean square.

[0214] Within the found k nearest neighbors, the MPC cluster 130 calculates the average of the label values ​​(result), and then uses the result to look up the mapping to find the inference result L result For example, the MPC cluster 130 can use the following relation 8 to identify tags based on the average of the tag values:

[0215] Relationship 8:

[0216] If result≤t0, L result ←L0;

[0217] If result>t n , L result ←L n+1 ;

[0218] If t x <result≤t x+1 , L result ←L x+1

[0219] That is, if the result is less than or equal to the threshold t o , then the inferred result L result is L0. If the result is greater than the threshold t n , then the inferred result L result It's L n+1 Otherwise, if the result is greater than the threshold t x and is less than or equal to the threshold t x+1 , then the inferred result L result For L x+1 The computing system MPC1 then requests the application 112 to add the user to the list corresponding to the inference result L result The user group, for example, by including the inference results L result The inferred response is sent to the application 112.

[0220] Similar to the other classification techniques described above, the inference results L can be hidden from the computing systems MPC1 and MPC2. result To this end, the inference request from application 112 can include a tag |L for computing system MPC1. i，1 ] and the label [L i,2 ] encrypted second share (e.g., PubKeyEncrypt([L 0，2 ||...||L n+1，2 ||application_public_key,MPC2)).

[0221] The inference result sent by the computing system MPC1 can include a first share of the inference result generated by the computing system MPC1 [L result1 ]. Similar to binary classification, in order to prevent the second portion from being accessed by the computing system MPC1 and thus enable the computing system MPC1 to obtain the inference result in plain text, the computing system MPC2 can convert the second share of the inference result [L result，2 ] (e.g., PubKeySign(PubKeyEncrypt([L result,2 ], application_public_key), MPC2)) is sent to computing system MPC1 to be included in the inference results sent to application 112. Application 112 can result1 ] and [L result2 ]Reconstruct the inference result L result .

[0222] When the aggregation function is the arithmetic mean, the computing systems MPC1 and MPC2 calculate the sum of the labels sum_of_labels, similar to binary classification. If the sum of the labels is insensitive, the computing systems MPC1 and MPC2 can calculate two shares [sum_of_labels1] and [sum_of_labels2] and then reconstruct sum_of_labels based on these two shares. The computing systems MPC1 and MPC2 can then calculate the average of the labels by dividing the sum of the labels by the number of nearest neighbor labels, for example, by k.

[0223] The computing system MPC1 can then compare the average value with a threshold value using relation 8 to identify a first share of tags corresponding to the average value and assign this first share [L result，1 ] is set as the first share of the identified tag. Similarly, the computing system MPC2 can use the relationship 8 to compare the average value with the threshold value to identify the second share of the tag corresponding to the average value, and set the second share [L result，2 ] is set as the second share of the identifier tag. The computing system MPC2 can use the public key of the application 112 (eg, PubKeyEncrypt ([L result，2 ], application public key)) to encrypt the second share [L result，2 ] and sends the encrypted second share to computing system MPC1. Computing system MPC1 can provide the first share and the encrypted second share (which can optionally be digitally signed as described above) to application 112. Application 112 can then add the user to a group of users identified by a label (e.g., user group identifier) ​​L result Identifies the user group.

[0224] If the sum of labels is sensitive, computing systems MPC1 and MPC2 may not be able to construct sum_of_labels in plain text. Instead, computing system MPC1 can compute the mask for [mask i，1 ]=[sum_of_labels1]>t i ×k. This calculation can require multiple round trips between computing systems MPC1 and MPC2. Next, computing system MPC1 can calculate And the computing system MPC2 is able to calculate The equality testing in this operation can require multiple round trips between computing systems MPC1 and MPC2.

[0225] Furthermore, the computing system MPC1 is able to calculate And the computing system MPC2 is able to calculate Then, if and only if for acc i = = 1, the MPC cluster 130 will return L i If use default == 1, it will return L n+1 This condition can be expressed in relation 9 below.

[0226] Relationship 9:

[0227] The corresponding cryptographic implementation can be represented by the following relations 10 and 11.

[0228] Relationship 10:

[0229] Relationship 11:

[0230] If L i is plaintext, then these computations do not require any round trip computation between computing systems MPC1 and MPC2. If L i is a secret share, then these calculations involve one round trip. The computing system MPC1 is able to convert the two shares of the result (e.g., [L result，2 ] and [L result，2 ] is provided to the application 112, wherein the second share is encrypted and optionally digitally signed by the computing system MPC2, as described above. In this way, the application 112 is able to determine the inference result L result , without either computing system MPC1 or MPC2 learning anything about the immediate or final results.

[0231] For the root mean square, the calculation system MPC1 will k}) is sent to computing system MPC2. Computing system MPC2 can verify that the number of row identifiers in ID is greater than a threshold to enforce k-anonymity. Computing system MPC2 can calculate a second share of the sum_of_square_labels parameter (e.g., the sum of squares of label values) using the following relation 12.

[0232] Relationship 12:

[0233] Similarly, computing system MPC1 can calculate the first share of the sum_of_square_labels parameter using the following relation 13 .

[0234] Relationship 13:

[0235] Assuming that the sum_of_square_labels parameter is insensitive, the computing systems MPC1 and MPC2 can reconstruct the sum_of_square_labels parameter from the two shares [sum_of_square_labels1] and [sum_of_square_labels2]. The computing systems MPC1 and MPC2 can calculate the root mean square of the labels by dividing sum_of_square_labels by the number of nearest neighbor labels, for example, by k, and then calculating the square root.

[0236] Regardless of whether the average is calculated via arithmetic mean or root mean square, the computing system MPC1 can then compare the average with a threshold using relation 8 to identify the label corresponding to the average and to convert the first share [L result，1 ] is set to the identified label. Similarly, computing system MPC2 can use relation 8 to compare the average value with a threshold value to identify the label (or the secret share of the label) corresponding to the average value, and set the second share [L result，2 ] is set to the identifier tag (or the secret share of the identifier tag). The computing system MPC2 can use the public key of the application 112 (for example, PubKeyEncrypt ([L result，2 ], application_public_key)) to encrypt the second share [L result，2 ] and sends the encrypted second share to the computing system MPC1. The computing system MPC1 can provide the first share and the encrypted second share (which can optionally be digitally signed as described above) to the application 112 as the inference result. The application 112 can then add the user to the list of users created by L resultIf the sum_of_square_labels parameter is sensitive, the computing systems MPC1 and MPC2 can perform a cryptographic protocol similar to that used in the arithmetic mean example to compute the share of the inference result.

[0237] In the above techniques for inferring the results of classification and regression problems, all k nearest neighbors have equal influence on the final inference result, i.e., equal weight. For many classification and regression problems, if each of the k neighbors is assigned a neighbor and query parameter P i The weights that decrease monotonically as the Hamming distance between them increases can improve model quality. A commonly used kernel function with this property is the Epanechnikov (parabolic) kernel function. Both the Hamming distance and the weights can be calculated in plain text.

[0238] Sparse feature vector user profile

[0239] When features of electronic resources are included in a user profile and used to generate a machine learning model, the resulting feature vector can include high-cardinality categorical features, such as domains, URLs, and IP addresses. These feature vectors are sparse, with most elements having zero values. Application 112 can split the feature vector into two or more dense feature vectors, but the machine learning platform will consume too much client device upload bandwidth to be practical. To prevent this problem, the above-mentioned systems and techniques can be adapted to better handle sparse feature vectors.

[0240] When providing a feature vector for an event to a client device, a computer-readable code (e.g., a script) of the content platform 150 included in the electronic resource can call an application (e.g., a browser) API to specify the feature vector for the event. The code or content platform 150 can determine whether (a portion of) the feature vector is dense or sparse. If the feature vector (or a portion thereof) is dense, the code can be passed in a numerical vector as an API parameter. If the feature vector (or a portion thereof) is sparse, the code can be passed in a mapping, e.g., an indexed keyword / value pair of those feature elements with non-zero eigenvalues, where the keyword is the name or index of such a feature element. If the feature vector (or a portion thereof) is sparse and the non-zero eigenvalue is always the same value, e.g., 1, the code can be passed in a set, whose elements are the names or indexes of such feature elements.

[0241] When aggregating feature vectors to generate a user profile, application 112 can handle dense and sparse feature vectors differently. The user profile (or a portion thereof) calculated from the dense vector remains as a dense vector. The user profile (or a portion thereof) calculated from the mapping remains as a mapping until the fill rate is high enough that the mapping no longer saves storage costs. At this point, application 112 converts the sparse vector representation to a dense vector representation.

[0242] In some embodiments, the application 112 can classify some or some portions of the feature vectors as sparse feature vectors and some as dense feature vectors. The application 112 can then process each type of feature vector differently when generating a user profile and / or a share of a user profile.

[0243] If the aggregation function is sum, the user profile (or a portion thereof) calculated from the set can be a map. For example, each feature vector can have the category feature "domains visited." The aggregation function, sum, will count the number of times a user visited a publisher domain. If the aggregation function is logical OR, the user profile (or a portion thereof) calculated from the set can remain a set. For example, each feature vector can have the category feature "domains visited." The aggregation function, logical OR, will count all publisher domains visited by the user, regardless of the frequency of visit.

[0244] To send the user profile to the MPC cluster 130 for ML training and prediction, the application 112 can split the dense portion of the user profile with any standard cryptographic library that supports secret shares. To split the sparse portion of the user profile without significantly increasing the client device upload bandwidth and computational cost, a functional secret sharing (FSS) technique can be used. In this example, the content platform 150 assigns a unique index to each possible element in the sparse portion of the user profile, starting sequentially from 1. It is assumed that the valid range of the index is in the range [1, N] (inclusive).

[0245] For a user profile calculated by the application with a non-zero value P i For the i-th element of , 1≤i≤N, application 112 can create two pseudo-random functions (PRFs) g with the following properties: i and h i :

[0246] For any j with 1≤j≤N and j≠i, g i (j)+h i (j) = 0

[0247] In other cases, g i (j)+h i (j) = P i .

[0248] Using FSS, g i or h i can be concisely represented, for example, by log2(N)×size_of_tag bits, and is not possible in terms of g i or h i Infer i or P i . To prevent brute force security attacks, size_of_tag is typically 96 bits or larger. In addition to the N dimensions, it is assumed that there are n dimensions with non-zero values, where n<<N. For each of the n dimensions, the application 112 can construct two pseudo-random functions g and h as described above. In addition, the application 112 can pack the concise representations of all n functions g into a vector G, and pack the concise representations of the n functions h into another vector H in the same order.

[0249] In addition, application 112 can split the dense portion of user profile P into two additional secret shares [P1] and [P2]. ​​Application 112 can then send [P1] and G to computing system MPC1, and [P2] and H to MPC2. When n<<N, transmitting G requires |G|×log2(N)×size_of_tag=n×log2(N)×size_of_tag bits, which may be much smaller than the N bits required if application 112 transmits the sparse portion of the user profile as a dense vector.

[0250] When the computing system MPC1 receives g i And the computing system MPC2 receives h i When the two computing systems MPC1 and MPC2 are able to independently create Shamir’s secret shares. For any j, where 1≤j≤N, computing system MPC1 creates a secret about the two-dimensional coordinates [1, 2×g i (j)] and the computing system MPC2 creates a point about the two-dimensional coordinates [-1, 2×h i (j)] If the two computing systems MPC1 and MPC2 collaboratively construct a line y=a0+a1×x passing through the two points, relations 14 and 15 are formed.

[0251] Relation 14: 2×g i (j) = a0 + a1

[0252] Relation 15: 2×h i (j) = a0 - a1

[0253] If these two relations are added together, it results in 2×g i (j)+2×h i (j) = (a0 + a1) + (a0 - a1), which simplifies to a0 = gi (j)+h i (j). Therefore, [1,2×g i (j)] and [-1,2×h i (j)] are the two secret shares of the i-th non-zero element in the sparse array, i.e., P i .

[0254] During the random projection operation of the machine learning training process, computing system MPC1 is able to independently combine its vector of secret shares for the user profile from both [P1] and G. Based on the above description, it is known that |G| = n, where n is the number of non-zero elements in the sparse portion of the user profile. Furthermore, it is known that the sparse portion of the user profile is N-dimensional, where n<<N.

[0255] Assume G = {g1, ...g n For the jth dimension, where 1≤j≤N and 1≤k≤n, let Similarly, let H = {h1, ...h n The computing system MPC2 can independently calculate It is easy to prove that [SP j，1 ] and [SP j，2 ] is SP j The secret share of , i.e., the secret value of the j-th element in the original sparse part of the user profile.

[0256] Let [SP1] = {[SP 1，1 ],...[SP N，1 ]}, i.e., the reconstructed secret shares in the dense representation of the sparse portion of the user profile. By concatenating [P1] and [SP1], computing system MPC1 can reconstruct the entire secret shares of the original user profile. Computing system MPC1 can then randomly project [P1]||[SP1]. Similarly, computing system MPC2 can randomly project [P2]||[SP2]. After projection, the above techniques can be used to generate a machine learning model in a similar manner.

[0257] Figure 6 is a conceptual diagram of an exemplary framework for generating inference results of a user profile in system 600. More particularly, the diagram depicts random projection logic 610, a first machine learning model 620, and final result calculation logic 640, which together constitute system 600. In some embodiments, the functionality of system 600 can be provided in a secure and distributed manner by multiple computing systems in an MPC cluster. The techniques described with reference to system 600 can be, for example, similar to those described above with reference to Figure 2-5 For example, the functionality associated with random projection logic 610 may correspond to that described above with reference to Figure 2 and Figure 4 Similarly, in some examples, the first machine learning model 620 may correspond to the random projection techniques described above. Figure 2 、 4 and 5, such as one or more of those described above in conjunction with steps 214, 414, and 504. In some examples, the encrypted label dataset 626 that can be maintained and used by the first machine learning model 620 and stored in one or more storage units can include at least one true label for each user profile used to generate or train or evaluate the quality of training or fine-tune the process of training the first machine learning model 620, such as described above with reference to Figure 5 Those labels that may be associated with the k nearest neighbor profiles as described in step 506 of the present invention. That is, the encrypted label dataset 626 may include at least one true label for each of the n user profiles, where n is the total number of user profiles used to train the first machine learning model 620. For example, the encrypted label dataset 626 may include the jth user profile (P j ) of at least one true label (L j ), the kth user profile among n user profiles (P k ) of at least one true label (L k ), the lth user profile among n user profiles (P l ) of at least one true label (L l ), where 1≤j, k, l≤n, etc. Such true labels associated with the user profile used to generate or train the first machine learning model 620 and included as part of the encrypted label dataset 626 can be encrypted, for example, represented as a secret share. Additionally, in some examples, the final result calculation logic 640 can correspond to logic employed in conjunction with performing one or more operations for generating an inference result, such as described above with reference to Figure 2 One or more of those described in step 218 of . The first machine learning model 620 and the final result calculation logic 640 can be configured to employ one or more inference techniques including binary classification, regression, and / or multi-class classification techniques.

[0258] exist Figure 6 In the example of , the system 600 is depicted as performing one or more operations at inference time. Random projection logic 610 can be employed to apply a random projection transformation to the user profile 609 (P i ) to obtain the transformed user profile 619 (P i'). The transformed user profile 619, as obtained by employing the random projection logic 610, can be in plain text. For example, the random projection logic 610 can be used, at least in part, to obscure feature vectors, such as those included or indicated in the user profile 609 and other user profiles, with random noise to protect user privacy.

[0259] The first machine learning model 620 can be trained and subsequently utilized to receive the transformed user profile 619 as input and generate at least one predicted label 629 in response thereto. At least one predicted label 629 obtained using the first machine learning model 620 can be encrypted. In some embodiments, the first machine learning model 620 includes a k-nearest neighbor (k-NN) model 622 and a label predictor 624. In such embodiments, the k-NN model 622 can be used by the first machine learning model 620 to identify the k nearest neighbor user profiles that are considered most similar to the transformed user profile 619. In some examples, models other than the k-NN model, such as models rooted in one or more prototype methods, can be used as the model 622. The label predictor 624 can then identify the true label of each of the k nearest neighbor user profiles from the true labels included in the encrypted label dataset 626, and determine at least one predicted label 629 based on the identified labels. In some embodiments, the label predictor 624 can apply a softmax function to the data it receives and / or generates when determining the at least one predicted label 629.

[0260] For embodiments in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ a regression technique, the at least one predicted label 629 may correspond to, for example, a single label representing an integer, such as the sum of the true labels of the k nearest neighbor user profiles as determined by the label predictor 624. Such a sum of the true labels of the k nearest neighbor user profiles as determined by the label predictor 624 is effectively equivalent to the average of the true labels of the k nearest neighbor user profiles as scaled by a factor k. Similarly, for embodiments in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ a binary classification technique, the at least one predicted label 629 may correspond to, for example, a single label representing an integer determined by the label predictor 624 based at least in part on such a sum. In the case of binary classification, each of the true labels of the k nearest neighbor user profiles may be a binary value of zero or one, so that the above average may be a value between zero and one (e.g., 0.3, 0.8, etc.), for example, which actually represents the predicted probability that the true label of the user profile received as input by the first machine learning model 620 (e.g., the transformed user profile 619) is equal to one. Figure 9-11Additional details are provided regarding the nature of the at least one predicted label 629 and the manner in which the at least one predicted label 629 may be determined for implementations in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ regression techniques and for implementations in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ binary classification techniques.

[0261] For embodiments in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ a multi-class classification technique, at least one predicted label 629 may correspond to a vector or set of predicted labels as determined by the label predictor 624. Each predicted label in such a vector or set of predicted labels may correspond to a corresponding category and may be determined by the label predictor 624 based at least in part on a majority vote or a frequency at which the true label corresponding to the corresponding category in the vector or set of true labels for the user profiles in the k nearest neighbor user profiles is a true label of a first value (e.g., one) as determined by the label predictor 624. Much like binary classification, in the case of multi-class classification, each true label in each vector or set of true labels for the user profiles in the k nearest neighbor user profiles may be a binary value of zero or one. Figure 9-11 Additional details are provided regarding the nature of the at least one predicted label 629 and the manner in which the at least one predicted label 629 may be determined for implementations in which the first machine learning model 620 and the final result calculation logic 640 are configured to employ a multi-class classification technique.

[0262] The final result calculation logic 640 can be used to generate an inference result 649 based on the at least one predicted label 629. i ). For example, the final result calculation logic 640 can be used to evaluate the at least one predicted tag 629 against one or more thresholds and determine an inference result 649 based on the evaluation result. In some examples, the inference result 649 can indicate whether the user associated with the user profile 609 is to be added to one or more user groups. In some embodiments, the at least one predicted tag 629 can be included or otherwise indicated in the inference result 649.

[0263] In some embodiments, as Figure 6 The depicted system 600 can represent a system such as Figure 1 Thus, it should be understood that in at least some of these embodiments, the data services referred to herein may be provided in a secure and distributed manner by two or more computing systems of an MPC cluster. Figure 6For example, each of two or more computing systems in an MPC cluster may provide some or all of the functionality described herein. Figure 6 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein. Figure 6 In at least some of the above embodiments, user profile 609 may represent a share of a user profile. In such embodiments, reference herein to Figure 6 One or more other data or quantities described may also represent its secret share. Figure 6 When describing the functions, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12 Examples of one or more of the above embodiments are described in greater detail elsewhere herein.In general, in at least some embodiments, a "share" as described below and elsewhere herein may correspond to a secret share.

[0264] While the training process for a k-NN model such as k-NN model 622 can be relatively fast and simple because no knowledge of labels is required, in some cases the quality of such a model can leave room for improvement. Therefore, in some embodiments, one or more of the systems and techniques described in further detail below can be utilized to improve the performance of the first machine learning model 620.

[0265] Figure 7 is a conceptual diagram of an exemplary framework for generating inference results of user profiles with improved performance in system 700. In some embodiments, Figure 7 One or more of the depicted elements 609-629 may be similar to or equivalent to the above-referenced Figure 6 One or more elements 609-629 are depicted. Much like system 600, system 700 includes random projection logic 610 and a first machine learning model 620, and is depicted as performing one or more operations at inference time.

[0266] However, unlike system 600, system 700 further includes a second machine learning model 730 that is trained and subsequently fully utilized by receiving the transformed user profile 619 as input and generating a prediction residual value 739 (Residue) indicating an amount of prediction error in at least one predicted label 629. i) as an output to improve the performance of the first machine learning model 620. For example, the accuracy of the second machine learning model can be higher than the accuracy of the first machine learning model. The prediction residual value 739 obtained using the second machine learning model 730 can be plain text. The final result calculation logic 740 included in the system 700 can be used instead of the final result calculation logic 640 to generate an inference result 749 (Result i Given that the prediction residual value 739 indicates an amount of prediction error in the at least one prediction label 629, reliance on and cooperation with the at least one prediction label 629 may enable the final result calculation logic 740 to effectively compensate for or offset at least some of the error that may be expressed in the at least one prediction label 629, thereby enhancing one or both of the accuracy and reliability of the inference results 749 produced by the system 700.

[0267] For example, the final result calculation logic 740 can be used to calculate the sum of the at least one predicted label 629 and the prediction residual value 739. In some examples, the final result calculation logic 740 can be further used to evaluate such calculation relative to one or more thresholds and determine an inference result 749 based on the result of the evaluation. In some embodiments, such a calculated sum of the at least one predicted label 629 and the prediction residual value 739 can be included in or otherwise indicated in the Figure 6 The inference results in 649 or Figure 7 The inference results are 749.

[0268] The second machine learning model 730 may include or correspond to one or more of a deep neural network (DNN), a gradient boosted decision tree, and a random forest model. That is, the first machine learning model 620 and the second machine learning model 730 may be architecturally different from each other. In some embodiments, the second machine learning model 730 may be trained using one or more gradient boosting algorithms, one or more gradient descent algorithms, or a combination thereof.

[0269] Using boosting algorithms, which typically employ residuals as described in more detail in this document, a weaker machine learning model, such as a k-nearest neighbor model, can be used to train a stronger machine learning model, such as a DNN. Unlike the training process for the weak learner, the training labels for the strong learner are the residuals of the weak learner. Using these residuals allows for the training of a more accurate strong learner.

[0270] The second machine learning model 730 can be trained using the same set of user profiles as used to train the first machine learning model 620 and data indicating differences between true labels for such set of user profiles and predicted labels for such set of user profiles determined using the first machine learning model 620. In this way, the process of training the second machine learning model 730 is performed after at least a portion of the process of training the first machine learning model 620 is performed. The data used to train the second machine learning model 730, such as data indicating differences between predicted labels determined using the first machine learning model 620 and true labels, can be generated or otherwise obtained by a process of evaluating the performance of the first machine learning model 620 as trained. Figure 10-11 An example of such a process is described in more detail.

[0271] As described above, random projection logic 610, as included in systems 600 and 700, can be employed, at least in part, to blur feature vectors, such as those included or indicated in user profile 609 and other user profiles, with random noise to protect user privacy. In order to enable machine learning training and prediction, the random projection transformation applied by random projection logic 610 needs to maintain some sense of distance between feature vectors. An example of a random projection technique that can be employed in random projection logic 610 includes the SimHash technique. This technique and the other techniques described above can be used to blur feature vectors while maintaining the cosine distance between these feature vectors.

[0272] While preservation of the cosine distance between feature vectors may prove sufficient for training and using a k-NN model, such as the k-NN model 622 of the first machine learning model 620, it may be less than ideal for training and using other types of models, such as one or more of the second machine learning model 730. Thus, in some embodiments, it may be desirable to employ a random projection technique in the random projection logic 610 that can be used to blur feature vectors while preserving the Euclidean distance between such feature vectors. One example of such a random projection technique includes the Johnson-Lindenstrauss (JL) technique or transform.

[0273] As mentioned above, one property of the JL transform is that it preserves the Euclidean distance between feature vectors using probability. In addition, the JL transform is lossy, irreversible, and contains random noise. Thus, even if two or more servers or computing systems of an MPC cluster collude, they will not be able to obtain the user profile (P) obtained using the JL transform technique. i ′) to obtain the original user profile (P i). Thus, employing the JL transform technique for the purpose of transforming user profiles in one or more of the systems described herein can be used to provide user privacy protection. Furthermore, the JL transform technique can be used as a dimensionality reduction technique. Thus, an advantageous byproduct of employing the JL transform technique for the purpose of transforming user profiles in one or more of the systems described herein is that it can actually be used to significantly increase the speed at which subsequent processing steps can be performed by such a system.

[0274] In general, given arbitrarily small ε > 0, there exists a JL transform that can be applied to transform P i to P i ′,P j to P j ′, for any 1≤i,j≤n, where n is the number of training examples, and:

[0275] (1-ε)×|P i -P j | 2 ≤|P′ i -P′ j | 2 ≤(1+ε)×|P i -P j | 2 That is, applying the JL transform may change the Euclidean distance between two arbitrarily chosen training examples by no more than a small fraction ε.For at least the foregoing reasons, in some embodiments, the JL transform technique may be employed in the random projection logic 610 as described herein.

[0276] In some embodiments, as Figure 7 The depicted system 700 can represent a system such as Figure 1 Thus, it should be understood that in at least some of these embodiments, the data services referred to herein may be provided in a secure and distributed manner by two or more computing systems of an MPC cluster. Figure 7 For example, each of two or more computing systems in an MPC cluster may provide a Figure 7 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein with reference to Figure 7 In at least some of the above embodiments, user profile 609 may represent a secret share of the user profile. In such embodiments, reference herein to Figure 7 One or more of the other data or quantities described may also represent its secret share. Figure 7 When describing the functions, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12 Examples of one or more of the above-described implementations are described in greater detail elsewhere herein.

[0277] Figure 8 is a flow chart illustrating an example process 800 for generating inference results of a user profile at an MPC cluster with improved performance, such as higher accuracy. Figure 8 One or more of the operations described may be performed, for example, at inference time. The operations of process 800 can be performed, for example, by Figure 1 The MPC cluster 130 is implemented as an MPC cluster and can also correspond to the above reference Figure 7 One or more of the operations described. Figure 8 One or more of the described operations may, for example, be performed at inference time.

[0278] In some embodiments, the reference herein Figure 8 Some or all of the functionality described by the elements shown in FIG may be accomplished by, for example, Figure 1 The two or more computing systems of the MPC cluster 130 are provided in a secure and distributed manner. For example, each of the two or more computing systems of the MPC cluster may provide a Figure 8 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein. Figure 8 It should be understood that in providing references herein to Figure 8 When describing the functions, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12 Examples of one or more of the above embodiments are described in greater detail elsewhere herein. The operations of process 800 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 800.

[0279] The MPC cluster receives an inference request associated with a particular user profile (step 802). For example, this may correspond to one or more operations similar or equivalent to one or more operations performed in conjunction with the MPC cluster 130 receiving an inference request from the application 112, as described above with reference to FIG. Figure 1 As stated.

[0280] The MPC cluster determines a predicted label for the specific user profile based on the specific user profile, the first machine learning model trained using the plurality of user profiles, and one or more of the plurality of true labels for the plurality of user profiles (step 804). For example, this may correspond to combining the first machine learning model 620 to obtain the at least one predicted label 629. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 described.

[0281] In this example, the plurality of true labels for the plurality of user profiles may correspond to the true labels included as part of the encrypted label data 626, which are the true labels for the plurality of user profiles used to train the first machine learning model 620. One or more true labels from the plurality of true labels may include at least one true label for each of the k nearest neighbor user profiles identified by the k-NN model 622 of the first machine learning model 620, upon which the determination of the predicted label for a particular user profile is based. In some examples, each of the plurality of true labels is encrypted, such as Figure 6-7 In the example of , some of the various methods in which the true labels of the k nearest neighbor user profiles can be used to determine the predicted labels are described in detail above. As will be apparent from the above, the method or manner of using such true labels to determine the predicted labels may depend at least in part on the type of inference technique employed (e.g., regression technique, binary classification technique, multi-class classification technique, etc.).

[0282] Based on the particular user profile and a second machine learning model trained using a plurality of user profiles and data indicating differences between a plurality of true labels for the plurality of user profiles and a plurality of predicted labels determined for the plurality of user profiles using the first machine learning model, the MPC cluster determines a prediction residual value indicating a prediction error in the predicted labels (step 806). For example, this may correspond to combining the second machine learning model 730 to obtain the prediction residual value 739 (Residue i ) and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 7 Thus, in some embodiments, the second machine learning model includes at least one of a deep neural network, a gradient boosted decision tree, and a random forest model.

[0283] The MPC cluster generates data representing the inference result based on the predicted label and the predicted residual value (step 808). For example, this may correspond to the data generated by combining the final result calculation logic 740 with the inference result 749 (Result i ) and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 7 Thus, in some examples, the inference result includes or corresponds to the sum of the predicted label and the predicted residual value.

[0284] The MPC cluster provides data representing the inference results to the client device (step 810). For example, this may correspond to one or more operations similar to or equivalent to one or more operations performed in conjunction with providing the inference results by the MPC cluster 130 to the client device 110 on which the application 112 is running, as described above with reference to FIG. Figure 1-2 described.

[0285] In some embodiments, process 800 further includes one or more operations in which the MPC cluster applies a transformation to the specific user profile to obtain a transformed version of the specific user profile. In these embodiments, to determine the predicted label, the MPC cluster determines the predicted label based at least in part on the transformed version of the specific user profile. For example, this may correspond to applying a random projection transformation to the user profile 609 (P in conjunction with random projection logic 610). i ) to obtain the transformed user profile 619 (P i ') and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 6-7 As described. Thus, in some examples, the above transformation may be a random projection. Furthermore, in at least some of these examples, the above random projection may be a Johnson-Lindenstrauss (JL) transformation. In at least some of the above embodiments, to determine a predicted label, the MPC cluster provides a transformed version of the specific user profile as input to the first machine learning model to obtain a predicted label for the specific user profile as output. For example, this may correspond to receiving the transformed user profile 619 (P i ′) as input and generates at least one predicted label 629 in response thereto. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 described.

[0286] As described above, in some embodiments, the first machine learning model includes a k-nearest neighbor model. In at least some of these embodiments, to determine the predicted label, the MPC cluster identifies k nearest neighbor user profiles from a plurality of user profiles that are believed to be most similar to the particular user profile based at least in part on the particular user profile and the k-nearest neighbor model, and determines the predicted label based at least in part on the true label of each of the k nearest neighbor user profiles. In some such embodiments, to determine the predicted label based at least in part on the true label of each of the k nearest neighbor user profiles, the MPC cluster determines the sum of the true labels of the k nearest neighbor user profiles. For example, this can correspond to obtaining at least one predicted label 629 in conjunction with the first machine learning model 620 in one or more embodiments in which one or more regression and / or binary classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 described.

[0287] In at least some of the foregoing embodiments, to determine a predicted label based at least in part on the true label for each of the k nearest neighbor user profiles, the MPC cluster determines a set of predicted labels based at least in part on a set of true labels for each of the k nearest neighbor user profiles, respectively, corresponding to a set of categories, and to determine the set of predicted labels, the MPC cluster performs an operation for each category in the set. Such operations can include one or more operations in which the MPC cluster determines a majority vote or a frequency at which the true label corresponding to a category in the set of true labels for the user profiles in the k nearest neighbor user profiles is the true label of the first value. For example, this can correspond to obtaining at least one predicted label 629 in conjunction with a first machine learning model 620 in one or more embodiments in which one or more multi-class classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 described.

[0288] Figure 9 is a flow chart illustrating an example process 900 for preparing and performing training of a second machine learning model for improving inference performance at an MPC cluster. In some embodiments, the operations of process 900 can be performed, for example, by Figure 1 The MPC cluster 130 is implemented as an MPC cluster and can also correspond to the above reference Figure 2 、 4 , 6 and 7. In some embodiments, the Figure 1The MPC cluster 130 is an MPC cluster of two or more computing systems provided herein in a secure and distributed manner. Figure 9 For example, each of two or more computing systems in an MPC cluster may provide some or all of the functionality described in the components shown in FIG. Figure 9 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein. Figure 9 It should be understood that in providing references herein to Figure 9 When describing the functions, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12 Examples of one or more of the above embodiments are described in greater detail elsewhere herein. The operations of process 900 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 900.

[0289] The MPC cluster trains a first machine learning model using the plurality of user profiles (step 910). For example, the first machine learning model may correspond to the first machine learning model 620, as described above. Similarly, the plurality of user profiles used to train the first machine learning model may correspond to the number n of user profiles used to train the first machine learning model 620, as described above, whose true labels may be included in the encrypted label dataset 626.

[0290] The MPC cluster evaluates the performance of the first machine learning model trained using multiple user profiles (step 920). Additional details on what such an evaluation may involve are provided below. Figure 10-11 supply.

[0291] In some embodiments, data generated in such an evaluation can be utilized by the MPC cluster or another system in communication with the MPC cluster to determine whether the performance of a first machine learning model, such as the first machine learning model 620, warrants improvement, for example, by a second machine learning model, such as the second machine learning model 730. Examples of data generated in such an evaluation that can be used in this manner are described below with reference to Figure 10 The profile and residual data set 1070 and Figure 11 Step 1112 is described in further detail.

[0292] For example, in some cases, the MPC cluster or another system in communication with the MPC cluster may determine, based on data generated in such an evaluation, that the performance (e.g., prediction accuracy) of the first machine learning model meets one or more thresholds and, therefore, does not necessitate an upgrade. In such cases, the MPC cluster may refrain from training and implementing the second machine learning model based on that determination. However, in other cases, the MPC cluster or another system in communication with the MPC cluster may determine, based on data generated in such an evaluation, that the performance (e.g., prediction accuracy) of the first machine learning model meets one or more thresholds and, therefore, does necessitate an upgrade. In such cases, the MPC cluster may receive an upgrade in functionality that is consistent with the upgrade described above with reference to FIG. Figure 6-7 The described upgrade is comparable to that obtained when transitioning from system 600 to system 700 based on this determination. To receive this upgrade in functionality, the MPC cluster may proceed to train and implement a second machine learning model, such as second machine learning model 730, for improving the performance, e.g., accuracy, of the first machine learning model using the residual values. In some examples, the data generated in such an evaluation may additionally or alternatively be provided to one or more entities associated with the MPC cluster. In some such examples, one or more entities may make their own determination as to whether an improvement in the performance of the first machine learning model is warranted and proceed accordingly. Other configurations are possible.

[0293] The MPC cluster trains a second machine learning model using a data set including data generated when evaluating the performance of the first machine learning model (step 930). Examples of such data can include the following references: Figure 10 The profile and residual data set 1070 and Figure 11 The data described in step 1112.

[0294] In some embodiments, process 900 further includes additional steps 912-916, which are described in more detail below. In such embodiments, steps 912 and 916 are performed before steps 920 and 930, but can be performed after step 910.

[0295] Figure 10 is a conceptual diagram of an exemplary framework for evaluating the performance of a first machine learning model in system 1000. In some embodiments, Figure 10 One or more of the depicted elements 609-629 may be similar to or equivalent to the above-referenced Figure 6-7 One or more elements 609-629 described herein. In some examples, reference is made herein to Figure 10 One or more of the operations described may correspond to those described above with reference to Figure 9One or more of those operations described in step 920.

[0296] However, unlike systems 600 and 700, system 1000 further includes residual calculation logic 1060. Figure 10 In the example of FIG. 6 , the user profile 609 (P i ) corresponds to one of the plurality of user profiles used to train the first machine learning model 620, and Figure 6 and 7 In the example of FIG. 6 , the user profile 609 (P i ) may not necessarily correspond to one of the multiple user profiles used to train the first machine learning model 620, but may simply correspond to a user profile associated with an inference request received at inference time. In some examples, the multiple user profiles used to train the first machine learning model 620 may correspond to the user profiles referenced above. Figure 9 The residual calculation logic 1060 can be used to calculate the residual error based on at least one predicted label 629 and at least one true label 1059 (L i ) generates a residual value 1069 indicating the amount of error in at least one predicted label 629. i ). At least one predicted label 629 and at least one true label 1059 (L i ) Both can be encrypted. For example, the residual calculation logic 1060 can use the secret share to calculate the difference between the values ​​of at least one predicted label 629 and at least one true label 1059. In some embodiments, the residual value 1069 can correspond to the difference between the above values.

[0297] The residual values ​​1069 can be stored in association with the transformed user profile 619, for example, in a memory, as part of a profile and residual data set 1070. In some examples, the data included in the profile and residual data set 1070 may correspond to the data described above with reference to FIG. Figure 9 The data described in step 930 and the following reference Figure 11 One or both of the data described in step 1112. In some embodiments, the residual value 1069 is in the form of a secret share to protect user privacy and user security.

[0298] In some embodiments, as Figure 10 As depicted, system 1000 can represent a system such as Figure 1 Thus, it should be understood that in at least some of these embodiments, the data services referred to herein may be provided in a secure and distributed manner by two or more computing systems of an MPC cluster. Figure 10For example, each of two or more computing systems in an MPC cluster may provide some or all of the functionality described herein. Figure 10 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein. Figure 10 In at least some of the above embodiments, user profile 690 may represent a secret share of the user profile. In such embodiments, reference herein to Figure 10 One or more of the other data or quantities described may also represent its secret share. Figure 10 When the functions described are used, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12 Examples of one or more of the above-described implementations are described in greater detail elsewhere herein.

[0299] Figure 11 is a flow chart illustrating an example process 1100 for evaluating the performance of a first machine learning model at an MPC cluster. The operations of process 1100 can be performed, for example, by Figure 1 The MPC cluster 130 is implemented as an MPC cluster and can also correspond to the above reference Figure 9-10 In some examples, this document refers to one or more operations described herein. Figure 11 One or more of the operations described may correspond to those described above with reference to Figure 9 One or more of those operations described in step 920. In some embodiments, reference is made herein to Figure 11 Some or all of the described functionality can be accomplished by Figure 1 The two or more computing systems in the MPC cluster 130 are provided in a secure and distributed manner. For example, each of the two or more computing systems in the MPC cluster may provide a Figure 11 In this example, two or more computing systems may operate in parallel and exchange secret shares in order to collaboratively perform the functions described herein. Figure 11 It should be understood that in providing references herein to Figure 11 When the functions described are used, additional operations may be performed by two or more computing systems for the purpose of protecting user privacy. Figure 12Examples of one or more of the above embodiments are described in greater detail elsewhere herein. The operations of process 1100 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 1100.

[0300] The MPC cluster selects the i-th user profile and at least one corresponding true label ([P i , L i ]), where i is initially set to a value of one (steps 1102-1104) and is incremented by recursion until i equals n (steps 1114-1116), where n equals the total number of user profiles used to train the first machine learning model. In other words, process 1100 includes performing steps 1106-1112, as described below, for each of the n user profiles used to train the first machine learning model.

[0301] In some embodiments, the i-th user profile may represent a secret share of the user profile. In such an embodiment, reference is made herein to Figure 11 One or more other data or quantities described may also represent a share thereof.

[0302] MPC clustering applies random projections to the i-th user profile (P i ) to obtain the i-th user profile (P i ') (step 1106). For example, this may correspond to applying a random projection transformation to the user profile 609 (P in conjunction with random projection logic 610). i ) to obtain the transformed user profile 619 (P i ') and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 10 described.

[0303] The MPC cluster will i-th user profile (P i ′) is provided as input to the first machine learning model to obtain the profile of the i-th user (P i ′) of at least one predicted label of the transformed version As output (step 1108). For example, this may correspond to receiving the transformed user profile 619 (P i ′) as input and generates at least one predicted label 629 in response thereto. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 10 described.

[0304] The MPC cluster is based at least in part on the user profile (P i ) of at least one true label (L i ) and at least one predicted label To calculate the residual value (Residue i )(Step 1110). For example, this may correspond to combining the residual computation logic 1060 for performing a computation based at least in part on at least one true label 1059 (L i ) and at least one predicted label 629 To calculate the residual value 1069 (Residue i ) and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 10 described.

[0305] MPC cluster and the i-th user profile (P i ′) is stored in association with the transformed version of the calculated residual value (Residue i ) (Step 1112). For example, this may correspond to combining the residual value 1069 (Residue i ) for example with the transformed user profile 619 (P i ') is stored in memory as part of the profile and residual data set 1070 and is associated with one or more operations similar or equivalent to one or more operations performed as described above with reference to Figure 10 In some examples, the data may correspond to the data described above with reference to Figure 9 Thus, in these examples, some or all of the data stored in this step can be used as data for training a second machine learning model, such as second machine learning model 730.

[0306] Referring again to steps 1108-1110, for at least some embodiments in which the first machine learning model is configured to employ a regression technique, the at least one predicted label obtained by the MPC cluster at step 1108 is Can correspond to a single predicted label representing a numerical value. In these embodiments, the residual value (Residue i ) can correspond to indicate at least one true label (L i ) and at least one predicted label In at least some of the above embodiments, at step 1108, the first machine learning model identifies a user profile that is considered to be related to the i-th user profile (P i′), identifying at least one true label for each of the k nearest neighbor user profiles, computing the sum of the true labels of the k nearest neighbor user profiles, and using the sum as the at least one predicted label As described above, the sum of the true labels of the k nearest neighbor user profiles as determined in this step is actually equivalent to the average of the true labels of the k nearest neighbor user profiles as scaled by a factor k. In some examples, this sum can be used as at least one predicted label Instead of the average of the true labels of the k nearest neighbor user profiles, no division operation needs to be performed. Given at least one predicted label Effectively equivalent to the average of the true labels of the k nearest neighbor user profiles as scaled by a factor k, for at least some embodiments in which the first machine learning model is configured to employ a regression technique, the computation performed by the MPC cluster at step 1110 is given by:

[0307]

[0308] Similarly, for at least some embodiments in which the first machine learning model is configured to employ a binary classification technique, the at least one predicted label obtained by the MPC cluster at step 1108 is The predicted label can correspond to a single predicted label, which, for example, represents a numerical value determined at least in part based on the sum of the true labels of the k nearest neighbor user profiles. As mentioned above with reference to the embodiment in which the first machine learning model is configured to employ a regression technique, such a sum of the true labels of the k nearest neighbor user profiles is actually equivalent to the average of the true labels of the k nearest neighbor user profiles, as scaled by a factor k.

[0309] However, unlike the embodiment in which the first machine learning model is configured to employ a regression technique, in the embodiment in which the first machine learning model is configured to employ a binary classification technique, each of the true labels of the k nearest neighbor user profiles may be a binary value of zero or one, so that the aforementioned average value may be a value between zero and one (e.g., 0.3, 0.8, etc.). Although the MPC cluster may calculate and use the sum of the true labels of the k nearest neighbor user profiles (sum_of_labels) as the at least one predicted label in step 1108 in the embodiment in which the binary classification technique is employed and using the formula described above with reference to the embodiment employing regression techniques To obtain the mathematically feasible residual value (Residue i ), but such residual value (Residue i) may potentially cause privacy issues, for example, when later used to determine whether it is necessary to improve the first machine learning model or later when used to train a second machine learning model such as the second machine learning model 730. More specifically, because each of the true labels of the k nearest neighbor user profiles can be a binary value of zero or one, in an embodiment using a binary classification technique, such a residual value (Residue i ) can potentially indicate at least one true label (L i ) value, and thus can potentially be processed by indicating a residual value (Residue) in a certain capacity at or after step 1112 i )'s data.

[0310] For example, consider a case where a binary classification technique is to be employed and L i =1, k=15, and In this first example, at least one predicted label The sum of the true labels of the k nearest neighbor user profiles (sum_of_labels) is actually equivalent to the average of the true labels of the k nearest neighbor user profiles as scaled by a factor k, where the aforementioned average is a non-integer value of 0.8. If the same formula as above is used in this first example To calculate the residual value (Residue i ), for example, in step 1110, the residual value (Residue i ) will be given by: Residue i =(15)(1)-12=3. Therefore, in this first example, the residual value (Residue i ) will be equal to the value of (positive) 3. Now, consider a case where a binary classification technique is to be employed and L i = 0, and k and Again, the second example is equal to the values ​​15 and 12 respectively. If the same formula as above is used again in this second example For example, in step 1110, the residual value (Residue i ), then the residual value in the second example (Residue i ) will be given by: Residue i =(15)(0)-12=-12. Therefore, in this first example, the residual value (Residue i ) will be equal to the value of -12. In fact, in the case of the first and second examples above, the positive residual value (Residue i ) can be used with l i= l correlation, and negative residual value (Residue i ) can be combined with L i =0 correlation.

[0311] To understand why it is possible to i Infer L i , consider the residuals of the user profile used to train the first machine learning model whose true label is equal to 0, which is assumed to satisfy the sign where μ0 and σ0 are the mean and standard deviation, respectively, of the normal distribution of the prediction errors (e.g., residual values) of the true labels associated with the user profiles used to train the first machine learning model, and the residuals for the examples whose labels are equal to 1 used for training are assumed to satisfy Where μ1 and σ1 are the mean and standard deviation of the normal distribution of the prediction errors of the true labels associated with the user profile used to train the first machine learning model, which are equal to 1 (one). Under such assumptions, it is clear that μ0 < 0, μ1 > 0, and there is no guarantee that σ0 = σ1.

[0312] In view of the above, as described below, in some embodiments, different methods can be employed to perform one or more operations associated with steps 1108-1110 for embodiments in which a binary classification technique is employed. In some embodiments, to force the residuals of the two classes of training examples to have the same normal distribution, the MPC cluster can apply a transformation to the sum of the true labels of the k nearest neighbor user profiles (sum_of_labels) such that the L-based i and The calculated residual values ​​cannot be used to predict L i When applied to the initial predicted labels (e.g., the sum of the true labels in the case of binary classification, the majority vote of the true labels in the case of multi-class classification, etc.), the transformation f can be used to remove bias that may be present in the predictions of the first machine learning model. To achieve this goal, the transformation f needs to satisfy the following properties:

[0313] (i) f(μ0) = 0

[0314] (ii) f(μ1) = 1

[0315] (iii)σ0×f′(μ0)=σ1×f′(μ1)

[0316] where f′ is the derivative of f.

[0317] An example of a transformation with the above properties that can be used in such an embodiment is a quadratic polynomial transformation of the shape f(x)=a2x 2+a1x+a0, where f′(x)=2a2x+a1. In some examples, the MPC cluster can deterministically find the coefficient values ​​{a2, a1, a0} based on three linear equations from the following three constraints:

[0318] make

[0319] (i) a′2=σ0-σ1

[0320] (ii)a′1=2(σ1μ1-σ0μ0)

[0321] (iii)a′0=μ0(μ0σ0+μ0σ1-2μ1σ1)

[0322] In these examples, the MPC cluster can calculate the coefficients {a2, a1, a0} as: {a2, a1, a0} = D × {a2′, a1′, a0′}. The MPC cluster can calculate {a2′, a1′, a0′} and D using, for example, addition and multiplication operations on the secret shares. The transformation f(x) = a2x 2 +a1x+a0 is also mirror-symmetric around:

[0323] To calculate the above coefficients and other values ​​that depend on them, the MPC cluster can first estimate the mean and standard deviation of the probability distribution of the prediction errors (e.g., residual values) for the true labels equal to zero, μ0, and σ0, respectively, and the mean and standard deviation of the probability distribution of the prediction errors (e.g., residual values) for the true labels equal to one, μ1, and σ1, respectively. In some examples, in addition to or instead of the standard deviation σ0, the variance σ0 of the probability distribution of the prediction errors for the true labels equal to zero can be determined. 2 , and in addition to or instead of the standard deviation σ1, the variance σ1 of the probability distribution of the prediction error of the true label can be determined to be equal to one 2 .

[0324] In some instances, the given probability distribution of prediction errors may correspond to a normal distribution, and in other instances, the given probability distribution of prediction errors may correspond to a probability distribution other than a normal distribution, such as a Bernoulli distribution, a uniform distribution, a binomial distribution, a hypergeometric distribution, an exponential distribution, etc. In such other instances, the estimated distribution parameters may include parameters other than the mean, standard deviation, and variance, such as one or more parameters specific to the characteristics of the given probability distribution of prediction errors. For example, the distribution parameters estimated for a given probability distribution of prediction errors corresponding to a uniform distribution may include minimum and maximum value parameters (a and b), while the distribution parameters estimated for a given probability distribution of prediction errors corresponding to an exponential distribution may include at least one rate parameter (λ). In some embodiments, the estimated distribution parameters may be performed in conjunction with Figure 11 One or more operations similar to the one or more operations performed by process 1110 of , such that data indicative of prediction errors of the first machine learning model can be obtained and used to estimate parameters of such a distribution. In at least some of the above-described embodiments, data indicative of prediction errors of the first machine learning model can be obtained and utilized to (i) identify a particular type of probability distribution from several different types of probability distributions (e.g., a normal distribution, a Bernoulli distribution, a uniform distribution, a binomial distribution, a hypergeometric distribution, an exponential distribution, etc.) that most closely corresponds to the shape of the probability distribution of a given subset of the prediction errors indicated by the data, and (ii) estimate one or more parameters of the probability distribution of the given subset of the prediction errors indicated by the data based on the identified particular type of probability distribution. Other configurations are also possible.

[0325] Referring again to the examples where the estimated distribution parameters include the mean and standard deviation, in these examples, to estimate such distribution parameters for the true label equal to zero, the MPC cluster is able to compute:

[0326]

[0327] in:

[0328]

[0329] count0=∑ i (1-L i )

[0330]

[0331] In some examples, MPC clustering is based on the variance σ0 2 Calculate the standard deviation σ0, for example, by calculating the variance σ0 2 Similarly, to estimate the distribution parameter of this true label equal to one, the MPC cluster can calculate:

[0332]

[0333] in:

[0334]

[0335] count1=∑L i

[0336]

[0337] In some examples, MPC clustering is based on the variance σ1 2 Calculate the standard deviation σ1, for example, by calculating the variance σ1 2 The square root of .

[0338] Once such distribution parameters are estimated, the coefficients can be calculated, stored, and later used to apply a corresponding transformation f to the sum of the true labels of the k nearest neighbor user profiles (sum_of_labels). In some examples, these coefficients are used to configure the first machine learning model so that, in response to the input, the first machine learning model applies the corresponding transformation f to the sum of the true labels of the k nearest neighbor user profiles.

[0339] Very similar to binary classification, in the case of multi-class classification, each vector or set of true labels of the user profiles in the k nearest neighbor user profiles can be a binary value of zero or one. For this reason, in the embodiment of the multi-class classification technique, a method similar to the method described above with reference to binary classification can also be adopted, so that the L-based i and The calculated residual values ​​cannot be used for prediction. However, in the case of multi-class classification, a corresponding function or transformation f can be defined and utilized for each category. For example, if each vector or set of true labels for each user profile is to contain w different true labels corresponding to w different categories, then w different transformations f can be determined and utilized. In addition, in the case of multi-class classification, instead of calculating the sum of the true labels, a frequency value is calculated for each category. Additional details on how to calculate such frequency values ​​are provided above and immediately below. Other configurations are possible.

[0340] For any chosen j-th label, the MPC cluster can be based on l j Is the training label for the training example split the training example into two groups. j is the set of training examples with training labels, and the MPC cluster is able to assume frequency j is normally distributed, and the mean μ1 and variance σ1 are calculated. On the other hand, for j Instead of training sets of labeled training examples, MPC clusters can assume frequency j is normally distributed, and the mean μ0 and variance σ0 are calculated.

[0341] Similar to binary classification, in the case of multi-class classification, the predictions of the k-NN model are likely to be biased (e.g., μ0>0, where it should have been 0, and μ1<k, where it should have been k). In addition, there is no guarantee that σ0==σ1. Therefore, similar to binary classification, in the case of multi-class classification, the MPC cluster is not very good at predicting frequency j Apply the transformation f on the two groups so that after the transformation, the Residue iTo achieve this goal, the transformation f needs to satisfy the following properties:

[0342] (i) f(μ0) = 0

[0343] (ii) f(μ1) = k

[0344] (iii)σ0×f′(μ0)=σ1×f′(μ1)

[0345] where f′ is the derivative of f.

[0346] The above three properties are very similar to their counterparts in the case of binary classification. In the case of multi-class classification, an example of a transformation with the above properties that can be used is a quadratic polynomial transformation of the shape f(x) = a2x 2 +a1x+a0, where f′(x)=2a2x+a1. In some examples, the MPC cluster can deterministically calculate the coefficient values ​​{a2, a1, a0} based on three linear equations from the following three constraints:

[0347] make

[0348] (i) a′2=σ0-σ1

[0349] (ii)a′1=2(σ1μ1-σ0μ0)

[0350] (iii)a′0=μ0(μ0σ0+μ0σ1-2μ1σ1)

[0351] Note that the transformations for binary classification and multi-class classification are almost the same, with the only difference being that in multi-class classification with a k-NN model, the value of D can be scaled up by a factor of k in some embodiments.

[0352] Reference again Figure 9 In some embodiments, one or more of steps 912-916 may correspond to one or more of the operations described above, wherein a method for defining at least one function or transformation can be employed by the MPC cluster such that L-based i and The calculated residual values ​​cannot be used to predict L i Specifically, steps 912 and 916 may be performed for implementations in which one or more binary classification techniques and / or multi-class classification techniques are to be employed. As described above, steps 912 and 916 are performed before steps 920 and 930 and may be performed after step 910.

[0353] The MPC cluster estimates a set of distribution parameters based on a plurality of true labels for a plurality of user profiles (step 912). For example, this may correspond to computing the parameters μ0, σ0 as described above in conjunction with the MPC cluster based on the true labels associated with the same user profiles utilized in step 910. 2 ,σ0,μ1,σ1 2 One or more operations similar to or equivalent to one or more operations performed by one or more of σ1.

[0354] The MPC cluster derives a function based on the estimated set of distribution parameters (step 914). For example, this may correspond to one or more operations similar to or equivalent to one or more operations performed in conjunction with the MPC cluster computing to effectively define the parameters or coefficients of the function (such as {a2, a1, a0}). Thus, in some embodiments, to derive the function in step 914, the MPC cluster derives a set of parameters for the function, e.g., {a2, a1, a0}.

[0355] The MPC cluster configures the first machine learning model to generate an initial predicted label given the user profile as input and applies the derived function to the initial predicted label to generate a predicted label for the user profile as output (step 916). For example, this may correspond to one or more operations similar to or equivalent to one or more operations performed by configuring the first machine learning model in conjunction with the MPC cluster so that the first machine learning model applies a corresponding transformation f to the sum of the true labels of the k nearest neighbor user profiles in response to the input (in the case of binary classification). In the case of multi-class classification, the transformation f may represent one of w different functions, and the MPC cluster configures the first machine learning model to apply to a corresponding one of w different values ​​in a vector or set corresponding to the w different classes. As described above, each of these w different values ​​may correspond to a frequency value.

[0356] Where steps 912-916 have been performed and the first machine learning model has been configured in such a manner, the data generated in step 920 and subsequently utilized, for example, in step 930 may not be used to predict the true label (L i ).

[0357] Reference again Figure 8 In some embodiments, process 800 may include steps corresponding to those in the above reference Figure 9-11 One or more steps of one or more of the described operations.

[0358] In some embodiments, process 800 further includes one or more operations in which the MPC cluster evaluates the performance of the first machine learning model. For example, this may correspond to performing the above-referenced Figure 9In some embodiments, to evaluate the performance of the first machine learning model, the MPC cluster determines, for each of the plurality of user profiles, a predicted label for the user profile based at least in part on: (i) the user profile, (ii) the first machine learning model, and (iii) one or more of a plurality of true labels for the plurality of user profiles, and determines a residual value for the user profile indicating a prediction error in the predicted label based at least in part on the predicted label determined for the user profile and the true label of the user profile included in the plurality of true labels. For example, this may correspond to performing the above-referenced step in conjunction with the MPC cluster. Figure 11 In addition, in these embodiments, process 800 further includes one or more operations in which the MPC cluster trains a second machine learning model using data indicating residual values ​​determined for a plurality of user profiles when evaluating the performance of the first machine learning model. For example, this may correspond to performing the above-referenced steps 1108-1106 in conjunction with the MPC cluster. Figure 9 One or more operations similar or equivalent to one or more operations performed in step 930 described above.

[0359] In at least some of the above embodiments, the residual value of the user profile indicates the difference in value between the predicted label determined for the user profile and the true label of the user profile. For example, this may be the case in an example where a regression technique is employed.

[0360] In at least some of the above embodiments, before the MPC cluster evaluates the performance of the first machine learning model, process 800 further includes one or more operations in which the MPC cluster derives a function based at least in part on the plurality of true labels and configures the first machine learning model to use the function to generate a predicted label of the user profile as an output given the user profile as an input. For example, this may correspond to performing the above-referenced method in conjunction with the MPC cluster. Figure 9 Therefore, in some embodiments, to derive the function in this step, the MPC cluster derives a set of parameters of the function, for example, {a2, a1, a0}.

[0361] In at least some of the above embodiments, process 800 also includes one or more operations in which the MPC cluster estimates a set of distribution parameters based at least in part on the plurality of true labels. In such embodiments, to derive a function based at least in part on the plurality of true labels, the MPC cluster derives a function based at least in part on the estimated set of distribution parameters. For example, this may correspond to performing the above-referenced Figure 9 One or more operations similar to or equivalent to one or more operations performed in accordance with the steps 912-914 described above. Therefore, the above-mentioned distribution parameter set can include one or more parameters of the probability distribution of the prediction error of the true label of the first value among multiple true labels, for example, the mean (μ0) and variance (σ0) of the normal distribution of the prediction error of the true label of the first value among multiple true labels, and one or more parameters of the probability distribution of the prediction error of the true label of the second value among multiple true labels, for example, the mean (μ1) and variance (σ1) of the normal distribution of the prediction error of the true label of the second different value among multiple true labels. As described above, in some examples, the above-mentioned distribution parameter set can include other types of parameters. In addition, in at least some of the above-mentioned embodiments, the function is a quadratic polynomial function, for example, f(x)=a2x 2 +a1x+a0, where f′(x)=2a2x+a1.

[0362] In at least some of the above embodiments, in order to configure the first machine learning model to use a function to generate a predicted label for the user profile as an output given the user profile as an input, the MPC cluster configures the first machine learning model to, given the user profile as an input: (i) generate an initial predicted label for the user profile, and (ii) apply the function to the initial predicted label for the user profile to generate the predicted label for the user profile as an output. For example, for an example in which a binary classification technique is employed, this may correspond to an example in which the MPC cluster configures the first machine learning model to, given the user profile as an input: (i) calculate the sum (sum_of_labels) of the true labels of the k nearest neighbor user profiles and (ii) apply the function (transformation f) to the initial predicted label for the user profile to generate the user profile One or more operations with a predicted label as output. Similar operations may be performed for cases where multi-class classification techniques are employed. In some embodiments, to apply a function to an initial predicted label for a user profile, the MPC cluster applies a function as defined based on a derived set of parameters such as {a2, a1, a0}. In some examples, to determine a predicted label based at least in part on the true label of each of the k nearest neighbor user profiles, the MPC cluster determines the sum of the true labels of the k nearest neighbor user profiles. For example, this may be the case in embodiments where regression or binary classification techniques are employed. In some of the above embodiments, the predicted label for a particular user profile may correspond to the sum of the true labels of the k nearest neighbor user profiles. For example, this may be the case in embodiments where regression classification techniques are employed In other such examples, to determine a predicted label based at least in part on the true label of each of the k nearest neighbor user profiles, the MPC cluster applies a function to the sum of the true labels of the k nearest neighbor user profiles to generate a predicted label for the particular user profile. For example, this may be the case in an embodiment where a binary classification technique is employed.

[0363] As described above, in at least some of the above embodiments, to determine a predicted label based at least in part on the true label of each of the k nearest neighbor user profiles, the MPC cluster determines a set of predicted labels based at least in part on the true label set of each of the k nearest neighbor user profiles corresponding to a set of categories, and to determine the set of predicted labels, the MPC cluster performs an operation for each category in the set. Such operations can include one or more operations in which the MPC cluster determines the frequency with which the true label corresponding to a category in the set of true labels for the user profiles in the k nearest neighbor user profiles is the true label of the first value. For example, this can correspond to obtaining at least one predicted label 629 in conjunction with the first machine learning model 620 in one or more embodiments in which one or more multi-class classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 In at least some of the above embodiments, to determine a set of predicted labels, for each category in the set, the MPC cluster applies a function corresponding to the category to the determined frequencies to generate a predicted label for the particular user profile corresponding to the category. For example, the corresponding function may correspond to one of w different functions derived by the MPC cluster for w different categories, as described above with reference to Figure 9 as described in step 914.

[0364] Figure 12 is a flow chart illustrating an example process 1200 for generating inference results of a user profile with improved performance at a computing system of an MPC cluster. Figure 12 One or more of the described operations may be performed, for example, at inference time. At least some of the operations of process 1200 can be implemented, for example, by a first computing system of an MPC cluster, such as Figure 1 The MPC1 of the MPC cluster 130 can also correspond to the above reference Figure 8 One or more of the operations described. However, in process 1200, one or more operations can be performed on the secret share to provide user data privacy protection. In general, a "share" as described below and elsewhere in this document can correspond to a secret share in at least some embodiments. Other configurations are possible. Reference Figure 12One or more of the described operations may be performed, for example, at inference time.

[0365] The first computing system of the MPC cluster receives an inference request associated with a given user profile (step 1202). For example, this may correspond to one or more operations similar or equivalent to one or more operations performed in conjunction with MPC1 of MPC cluster 130 receiving an inference request from application 112, as described above with reference to FIG. Figure 1 In some embodiments, this may correspond to combining with the above reference Figure 8 One or more operations similar to or equivalent to one or more operations performed in step 802 described above.

[0366] The first computing system of the MPC cluster determines a predicted tag for a given user profile (steps 1204-1208). In some embodiments, this may correspond to the above referenced Figure 8 One or more operations similar to or equivalent to one or more operations performed in accordance with step 804 described above. However, in steps 1204 and 1208, the determination of the predicted label for a given user profile can be performed on the secret share so as to provide user data privacy protection. To determine the predicted label for a given user profile, a first computing system of the MPC cluster (i) determines a first share of the predicted label based at least in part on a first share of the given user profile, a first machine learning model trained using a plurality of user profiles, and one or more true labels of a plurality of true labels for the plurality of user profiles (step 1204), (ii) receives data from a second computing system of the MPC cluster indicating a second share of the predicted label determined by the second computing system of the MPC cluster based at least in part on a second share of the given user profile and a first set of one or more machine learning models, and (iii) determines the predicted label based at least in part on the first share and the second share of the predicted label (step 1208). For example, the second computing system of the MPC cluster may correspond to Figure 1 MPC cluster 130 MPC2.

[0367] In this example, the multiple true labels for the multiple user profiles can correspond to true labels included as part of the encrypted label data 626, which are the true labels for the multiple user profiles used to train and / or evaluate the first machine learning model 620. In some examples, the multiple true labels can correspond to shares of another set of true labels. One or more true labels from the multiple true labels can include at least one true label for each of the k nearest neighbor user profiles identified by the k-NN model 622 of the first machine learning model 620, where the determination of the predicted label for a given user profile is based on the one or more true labels. In some examples, each of the multiple true labels is encrypted, such as Figure 6-7 The above describes in detail some of the various ways in which k nearest neighbor user profiles can be used to determine predicted labels. As is apparent from the above, the method or manner in which such true labels are used to determine predicted labels may depend at least in part on the type of inference technique employed (e.g., regression technique, binary classification technique, multi-class classification technique, etc.). Figure 1-5 Additional details are provided regarding secret share exchange that may be performed in association with k-NN computations.

[0368] The first computing system of the MPC cluster determines a prediction residual value indicating a prediction error in the predicted label (steps 1210-1214). In some embodiments, this may correspond to the above referenced Figure 8 One or more operations similar or equivalent to one or more operations performed in step 806 described above. However, in steps 1210 and 1214, the determination of the prediction residual value can be performed on the secret share to provide user data privacy protection. To determine the prediction residual value, the first computing system of the MPC cluster (i) determines a first share of the prediction residual value for the given user profile based at least in part on a first share for the given user profile and a second machine learning model trained using multiple user profiles and data indicating differences between multiple true labels for the multiple user profiles and multiple predicted labels determined for the multiple user profiles using the first machine learning model (step 1210), (ii) receives from the second computing system of the MPC cluster data indicating a second share of the prediction residual value for the given user profile determined by the second computing system of the MPC cluster at least in part based on a second share for the given user profile and a second set of one or more machine learning models (step 1212), and (iii) determines the prediction residual value for the given user profile based at least in part on the first share and the second share of the prediction residual value (step 1214).

[0369] The first computing system of the MPC cluster generates data representing the inference result based on the predicted label and the predicted residual value (step 1216). In some embodiments, this may correspond to the above reference Figure 8 One or more operations similar to or equivalent to the one or more operations performed in step 808 described above. Therefore, in some examples, the inference result includes or corresponds to the sum of the predicted label and the predicted residual value.

[0370] The first computing system of the MPC cluster provides data representing the inference result to the client device (step 1218). In some embodiments, this may correspond to the above referenced Figure 8For example, this may correspond to one or more operations similar or equivalent to one or more operations performed in conjunction with providing inference results to the client device 110 on which the application 112 is running in conjunction with the MPC cluster 130, as described above with reference to FIG. Figure 1-2 described.

[0371] In some embodiments, process 1200 further includes one or more operations in which the first computing system of the MPC cluster applies the transformation to the first share of the given user profile to obtain first transformed shares of the given user profile. In these embodiments, to determine the predicted label, the first computing system of the MPC cluster determines the first share of predicted labels based at least in part on the first transformed shares of the given user profile. For example, this can correspond to applying the random projection transformation to the user profile 609 (P in conjunction with random projection logic 610). i ) to obtain the transformed user profile 619 (P i ') and perform one or more operations similar or equivalent to one or more operations, as described above with reference to Figure 6-8 described.

[0372] In at least some of the foregoing embodiments, to determine the first share of predicted labels, the first computing system of the MPC cluster provides the first transformed share of the given user profile as input to the first machine learning model to obtain as output the first share of predicted labels for the given user profile. For example, this may correspond to receiving the transformed user profile 619 (P i ′) as input and generates at least one predicted label 629 in response thereto. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-7 described.

[0373] In some examples, the transformation may be a random projection. In addition, in at least some of these examples, the random projection may be a Johnson-Lindenstrauss (JL) transformation.

[0374] In some embodiments, to apply the JL transform, the MPC cluster can generate a projection matrix R of the ciphertext. i Projected to k dimensions, the MPC cluster can generate an n×k random matrix R. For example, the first computing system (eg, MPC1) can create an n×k random matrix A, where there is a 50% probability that A i，j =1, 50% probability of A i，j= 0. The first computing system can split A into two shares [A1] and [A2], discard A, keep [A1] confidentially, and give [A2] to the second computing system (e.g., MPC2). Similarly, the second computing system can create an n×k random matrix B whose elements have the same distribution as the elements of A. The second computing system can split B into two shares [B1] and [B2], discard B, keep [B2] confidentially, and give [B1] to the first computing system.

[0375] The first computing system can then compute [R1] as 2×([A1]==[B1])−1. Similarly, the second computing system can compute [R2] as 2×([A2]=[B2])−1. Thus, [R1] and [R2] are two secret shares of R, whose elements are 1 or −1 with equal probability.

[0376] The actual random projection is on P of dimension 1×n i and the secret share of the projection matrix R of dimension n×k to produce a result of 1×k. Assuming n>>k, the JL transformation reduces the dimension of the training data from n to k. To perform the above projection on the encrypted data, the first computing system is able to calculate [P i，1 ]⊙[R i，1 ], which requires a multiplication between two shares and an addition between two shares.

[0377] As described above, in some embodiments, the first machine learning model includes a k-nearest neighbor model maintained by a first computing system of an MPC cluster, and the first set of one or more machine learning models includes a k-nearest neighbor model maintained by a second computing system of the MPC cluster. In some examples, the two aforementioned k-nearest neighbor models can be identical or nearly identical to each other. That is, in some examples, the first and second computing systems maintain copies of the same k-NN model, and each copy stores its own share of true labels. In some examples, a model rooted in one or more prototype methods can be implemented to replace one or both of the aforementioned k-nearest neighbor models.

[0378] In at least some of these embodiments, to determine the predicted label, the first computing system of the MPC cluster (i) identifies a first set of nearest neighbor user profiles based at least in part on a first share of the given user profile and a k-nearest neighbor model maintained by the first computing system of the MPC cluster, (ii) receives data from a second computing system of the MPC cluster indicating a second set of nearest neighbor profiles identified by the second computing system of the MPC cluster based at least in part on a second share of the given user profile and the k-nearest neighbor model maintained by the second computing system of the MPC cluster, (iii) identifies k nearest neighbor user profiles from a plurality of user profiles that are believed to be most similar to the given user profile based at least in part on the first set and the second set of nearest neighbor user profiles, and determines a first share of the predicted label based at least in part on the true label of each of the k nearest neighbor user profiles. For example, this can correspond to combining the first machine learning model 620 for obtaining at least one predicted label 629 in one or more embodiments in which one or more regression and / or binary classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-8 described.

[0379] In some of the above embodiments, to determine the first share of predicted labels, the first computing system of the MPC cluster (i) determines a first share of the sum of the true labels of the k nearest neighbor user profiles, (ii) receives a second share of the sum of the true labels of the k nearest neighbor user profiles from the second computing system of the MPC cluster, and (iii) determines the sum of the true labels of the k nearest neighbor user profiles based at least in part on the first share and the second share of the sum of the true labels of the k nearest neighbor user profiles. For example, this can correspond to obtaining at least one predicted label 629 in conjunction with the first machine learning model 620 in one or more embodiments in which one or more multi-class classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-8 described.

[0380] In some embodiments, the second machine learning model includes at least one of a deep neural network (DNN), a gradient boosted decision tree (GBDT), and a random forest model maintained by the first computing system of the MPC cluster, and the second set of one or more machine learning models includes at least one of a DNN, a GBDT, and a random forest model maintained by the second computing system of the MPC cluster. In some examples, the two models (e.g., DNN, GBDT, random forest model, etc.) maintained by the first and second computing systems can be identical or nearly identical to each other.

[0381] In some embodiments, process 1200 further includes one or more operations in which the MPC cluster evaluates the performance of the first machine learning model and trains a second machine learning model using data indicating prediction residual values ​​determined for the plurality of user profiles when evaluating the performance of the first machine learning model. For example, this may correspond to performing the above-referenced Figure 8-9 One or more operations similar to or equivalent to one or more operations performed in accordance with step 920 described above. However, in such embodiments, one or more operations can be performed on the secret share to provide user data privacy protection. In these embodiments, to evaluate the performance of the first machine learning model, for each of a plurality of user profiles, the MPC cluster determines a predicted label for the user profile and determines a residual value for the user profile, the residual value indicating a prediction error in the predicted label. To determine the predicted label for the user profile, a first computing system of the MPC cluster (i) determines a first share of the predicted label for the user profile based at least in part on a first share of the user profile, a first machine learning model, and one or more true labels of a plurality of user profiles, (ii) receives data from a second computing system of the MPC cluster, the data indicating a second share of the predicted label for the user profile determined by the second computing system of the MPC cluster based at least in part on a second share of the user profile and a first set of one or more machine learning models maintained by the second computing system of the MPC cluster, and (iii) determines the predicted label for the user profile based at least in part on the first share and the second share of the predicted labels. To determine a residual value for a user profile that indicates an error in a predicted label, a first computing system of the MPC cluster (i) determines a first share of residual values ​​for the user profile based at least in part on a predicted label determined for the user profile and a first share of true labels for the user profile included in a plurality of true labels, (ii) receives data from a second computing system of the MPC cluster that indicates a second share of residual values ​​for the user profile determined by the second computing system of the MPC cluster based at least in part on a predicted label determined for the user profile and a second share of true labels for the user profile, and (iii) determines the residual value for the user profile based at least in part on the first share and the second share of residual values. For example, this may correspond to performing the above-referenced method in conjunction with the MPC cluster. Figure 11 In addition, in these embodiments, process 1200 further includes one or more operations in which the MPC cluster trains a second machine learning model using data indicating residual values ​​determined for a plurality of user profiles when evaluating the performance of the first machine learning model. For example, this may correspond to performing the above-referenced steps 1108-1106 in conjunction with the MPC cluster. Figure 9One or more operations similar or equivalent to one or more operations performed by step 930 as described.

[0382] In at least some of the above embodiments, a first share of residual values ​​for a user profile indicates a difference in value between a predicted label determined for the user profile by the first machine learning model and a first share of true labels for the user profile, and a second share of residual values ​​for the user profile indicates a difference in value between a predicted label determined for the user profile by the first machine learning model and a second share of true labels for the user profile. For example, this may be the case in an example where a regression technique is employed.

[0383] In at least some of the foregoing embodiments, before the MPC cluster evaluates the performance of the first machine learning model, process 1200 further includes one or more operations in which the MPC cluster (i) derives a function and (ii) configures the first machine learning model to generate an initial predicted label for the user profile given the user profile as input and applies the function to the initial predicted label for the user profile to generate a first share of the predicted label for the user profile as output. For example, this may correspond to performing the above-referenced process in conjunction with the MPC cluster. Figure 8-9 One or more operations similar to or equivalent to one or more operations performed in accordance with the described steps 914-916. To derive the function, the first computing system of the MPC cluster (i) derives a first share of the function based at least in part on a first share of each of a plurality of true labels, (ii) receives data from a second computing system of the MPC cluster indicating a second share of the function derived by the second computing system of the MPC cluster based at least in part on a second share of each of the plurality of true labels, and (iii) derives the function based at least in part on the first share and the second share of the function. For example, for an example in which a binary classification technique is employed, this may correspond to one in which the MPC cluster configures the first machine learning model to, given a user profile as input: (i) compute a sum (sum_of_labels) of the true labels of the k nearest neighbor user profiles, and (ii) apply a function (transformation f) to the initial predicted label of the user profile to generate a predicted label for the user profile. One or more operations as output. Similar operations can be performed in the case of multi-class classification techniques.

[0384] When implemented on the secret shares, the first computation system (e.g., MPC1) is able to compute:

[0385]

[0386] [count 0,1 ]=∑ i (1-[L i,1 ])

[0387]

[0388] Similarly, when implemented on the secret shares, the second computation system (e.g., MPC2) is able to compute:

[0389]

[0390] |count 0.2 |=∑ i (1-|L i，2 |)

[0391]

[0392] The MPC cluster can then reconstruct sum0, count0, sum_of_square0 as described above in plain text, and calculate the distribution

[0393] Similarly, to calculate the distribution The first computing system (eg, MPC1) is capable of computing:

[0394]

[0395] |count 1，1 |=∑ i [L i，1 ]

[0396]

[0397] Furthermore, the second computing system (eg, MPC2) is capable of computing:

[0398]

[0399] |count 1，2 |=∑ i [L i，2 ]

[0400]

[0401] The MPC cluster can then reconstruct sum1, count1, sum_of_square1 as described above in the plain text, and calculate the distribution

[0402] In at least some of the foregoing embodiments, when evaluating the performance of the first machine learning model, the MPC cluster is capable of employing one or more fixed-point computing techniques to determine a residual value for each user profile. More specifically, when evaluating the performance of the first machine learning model, in order to determine a first share of the residual value for each user profile, the first computing system of the MPC cluster scales the corresponding true label or its share by a specific scaling factor, scales the coefficients {a2, a1, a0} associated with the function by the specific scaling factor, and rounds the scaled coefficients to the nearest integer. In such an embodiment, the second computing system of the MPC cluster can perform similar operations to determine a second share of the residual value for each user profile. The MPC cluster is therefore capable of calculating the residual value using the secret share, reconstructing the plaintext residual value based on the two secret shares, and dividing the plaintext residual value by the scaling factor.

[0403] In at least some of the foregoing embodiments, process 1200 further includes one or more operations in which the first computing system of the MPC cluster estimates a first share of the set of distribution parameters based at least in part on the first component of each of the plurality of true labels. In some such embodiments, to derive the first share of the function based at least in part on the first share of each of the plurality of true labels, the first computing system of the MPC cluster derives the first share of the function based at least in part on the first share of the set of distribution parameters. For example, this may correspond to performing the operations described above with reference to Figure 8-9 One or more operations similar to or equivalent to one or more operations performed in accordance with the steps 912-914 described above. Therefore, the above-mentioned distribution parameter set can include one or more parameters of the probability distribution of the prediction error of the true label of the first value among multiple true labels, for example, the mean (μ0) and variance (σ0) of the normal distribution of the prediction error of the true label of the first value among multiple true labels, and one or more parameters of the probability distribution of the prediction error of the true label of the second value among multiple true labels, for example, the mean (μ1) and variance (σ1) of the normal distribution of the prediction error of the true label of the second different value among multiple true labels. As described above, in some examples, the above-mentioned distribution parameter set can include other types of parameters. In addition, in at least some of the above-mentioned embodiments, the function is a quadratic polynomial function, for example, f(x)=a2x 2 +a1x+a0, where f'(x)=2a2x+a1, although other functions may be employed in some examples.

[0404] In some examples, to determine a first share of predicted labels, a first computing system of the MPC cluster (i) determines a first share of the sum of the true labels of the k nearest neighbor user profiles, (ii) receives a second share of the sum of the true labels of the k nearest neighbor user profiles from a second computing system of the MPC cluster, and (iii) determines the sum of the true labels of the k nearest neighbor user profiles based at least in part on the first share and the second share of the sum of the true labels of the k nearest neighbor user profiles. For example, this can be an embodiment in which a regression or binary classification technique is employed. In some of the above examples, the first share of predicted labels can correspond to the sum of the true labels of the k nearest neighbor user profiles. For example, this can be an embodiment in which a regression or binary classification technique is employed In other such examples, to determine the first share of predicted labels, the MPC cluster applies a function to the sum of the true labels of the k nearest neighbor user profiles to generate a predicted label for a given user profile. For example, this can be a case where a binary classification technique is employed. implementation of the situation.

[0405] As described above, in some of the above embodiments, to determine a first share of predicted labels based at least in part on the true label of each of the k nearest neighbor user profiles, the first computing system of the MPC cluster determines a first share of the predicted label set based at least in part on the true label set of each of the k nearest neighbor user profiles corresponding to a set of categories. To determine the first share of the predicted label set, for each category in the set, the first computing system of the MPC cluster (i) determines a first share of the frequency that the true label corresponding to the category in the true label set of the user profile in the k nearest neighbor user profiles is the true label of the first value, (ii) receives a second share of the frequency that the true label corresponding to the category in the true label set of the user profile in the k nearest neighbor user profiles is the true label of the first value, and (iii) determines the frequency that the true label corresponding to the category in the true label set of the user profile in the k nearest neighbor user profiles is the true label of the first value based at least in part on the first share and the second share of the frequency that the true label corresponding to the category in the true label set of the user profile in the k nearest neighbor user profiles is the true label of the first value. Such operations can include one or more operations in which the first computing system of the MPC cluster determines how often a true label corresponding to a class in the set of true labels for a user profile in the k nearest neighbor user profiles is a true label of a first value. For example, this can correspond to incorporating the first machine learning model 620 for obtaining at least one predicted label 629 in one or more embodiments in which one or more multi-class classification techniques are employed. The one or more operations performed are similar or equivalent to the one or more operations described above. Figure 6-8 described.

[0406] In at least some of the foregoing embodiments, to determine a first share of a set of predicted labels, for each category in the set, the first computing system of the MPC cluster applies a function corresponding to the category to the frequency of the true label corresponding to the category in the set of true labels of the user profiles in the k nearest neighbor user profiles being the first value of the true label, to generate a first share of predicted labels corresponding to the category of the given user profile. For example, the corresponding function may correspond to one of w different functions derived by the MPC cluster for w different categories, as described above with reference to Figure 8-9 as described in step 914.

[0407] For multi-class classification problems, when evaluating the performance (e.g., quality) of the first machine learning model, for each training example / query, the MPC cluster is able to find the k nearest neighbors and calculate the frequency of their labels on the secret share.

[0408] For example, consider the case where it is assumed that for a multi-class classification problem {l1,l2,...l w}There are w examples with valid labels (e.g., classes). k}, the first computing system (eg, MPC1) can calculate the frequency of the jth label as [l j，1 ]:

[0409]

[0410] The first calculation system can calculate the frequency [label1] according to the true label as follows:

[0411] [expected_frequency j,1 ]=k×([label1]==j)

[0412] Thus, the first computing system is able to compute:

[0413] [Residue j，1 ]=[expected_frequency j，1 ]-[frequency j，1 ]

[0414] Furthermore, j，1 ] is equivalent to:

[0415]

[0416] Similarly, the second computing system (eg, MPC2) is capable of computing:

[0417]

[0418] In the case of binary classification and regression, for each inference, the residual value can be a secret message of numeric type. In contrast, in the case of multi-class classification, for each inference, as shown above, the residual value can be a secret message of numeric vector.

[0419] Figure 13 13 is a block diagram of an example computer system 1300 that can be used to perform the operations described above. System 1300 includes a processor 1310, a memory 1320, a storage device 1330, and an input / output device 1340. Each of components 1310, 1320, 1330, and 1340 can be interconnected, for example, using a system bus 1350. Processor 1310 can process instructions for execution within system 1300. In some embodiments, processor 1310 is a single-threaded processor. In another embodiment, processor 1310 is a multi-threaded processor. Processor 1310 can process instructions stored in memory 1320 or on storage device 1330.

[0420] Memory 1320 stores information within system 1300. In some embodiments, memory 1320 is a computer-readable medium. In some embodiments, memory 1320 is a volatile memory unit. In another embodiment, memory 1320 is a non-volatile memory unit.

[0421] The storage device 1330 can provide mass storage for the system 1300. In some embodiments, the storage device 1330 is a computer-readable medium. In various embodiments, the storage device 1330 can include, for example, a hard disk device, an optical disk device, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0422] Input / output device 1340 provides input / output operation for system 1300.In some embodiments, input / output device 1340 can comprise following one or more: network interface device, for example, Ethernet card, serial communication device, for example, and RS-232 port, and / or wireless interface device, for example, and 802.11 card.In another embodiment, input / output device can comprise and is configured to receive input data and output data is sent to external device 1360, for example, the driver device of keyboard, printer and display device.Yet, also can use other embodiment, such as mobile computing device, mobile communication device, set-top box television client device etc.

[0423] Despite Figure 13 An example processing system is described in the specification, but the subject matter and implementation of the functional operations described in this specification can be implemented in other types of digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of them.

[0424] The embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware or hardware, including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of them. The embodiments of the subject matter described in this specification can be implemented as one or more computer programs, that is, modules of one or more computer program instructions, which are encoded on a computer storage medium (or multiple media) for execution by a data processing device or for controlling the operation of the data processing device. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagation signal, for example, a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device for operation by the data processing device. The computer storage medium can be or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. In addition, although a computer storage medium is not a propagation signal, a computer storage medium can be the source or destination of computer program instructions encoded in an artificially generated propagation signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (eg, multiple CDs, disks, or other storage devices).

[0425] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0426] The term "data processing apparatus" encompasses all kinds of apparatus, devices, and machines for processing data, including, for example, a programmable processor, a computer, a system on a chip, or multiple or combinations of the foregoing. The apparatus can include dedicated logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the apparatus can also include code that creates an operating environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more of these. The apparatus and operating environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0427] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored as part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store portions of one or more modules, subroutines, or code). A computer program can be deployed to run on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0428] The processes and logic flows described in this specification can be performed by one or more programmable processors running one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by, and apparatus can be implemented as, special purpose logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0429] For example, processors suitable for running computer programs include both general-purpose and special-purpose microprocessors. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic element of a computer is a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include one or more large-capacity storage devices for storing data, such as magnetic disks, magneto-optical disks or optical disks, or be operably coupled to the one or more large-capacity storage devices to receive data from the one or more large-capacity storage devices or to transfer data to the one or more large-capacity storage devices, or both. However, a computer does not need to have such a device. In addition, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver or a portable storage device (such as a universal serial bus (USB) flash drive), to give only a few examples. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and storage devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0430] To provide for interaction with a user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, voice, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0431] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes a back-end component, for example, as a data server, or includes a middleware component, for example, an application server, or includes a front-end component, for example, a client computer with a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification, or includes any combination of one or more such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication, for example, a communication network. Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), interconnected networks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0432] A computing system can include a client and a server. The client and server are typically remote from each other and typically interact via a communication network. The relationship between the client and the server is generated by computer programs running on the respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML page) to the client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user). Data generated at the client device (e.g., the result of a user interaction) can be received at the server from the client device.

[0433] Although this specification contains many specific implementation details, these should not be construed as limitations on any invention or on the scope of what may be claimed, but rather as descriptions of features that are specific to particular embodiments of particular inventions. Certain features described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable subcombination. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed as such, in some cases one or more features from a claimed combination can be deleted from that combination, and a claimed combination may be directed to a subcombination or variation of a subcombination.

[0434] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that the operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, in order to achieve the desired results. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0435] Thus, certain embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Additionally, the processes depicted in the accompanying drawings do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: receiving, by a first computing system among a plurality of multi-party computing computing systems, an inference request including a first share of a given user profile; determining a predicted label for the given user profile based at least in part on a first machine learning model trained using a plurality of user profiles; Determining a prediction residual value for the given user profile that indicates a prediction error in the predicted label comprises: determining, by the first computing system, a first share of the predicted residual values ​​for the given user profile based at least in part on the first share of the given user profile and a second machine learning model trained using the plurality of user profiles and data indicating differences between a plurality of true labels for the plurality of user profiles and a plurality of predicted labels determined for the plurality of user profiles using the first machine learning model; receiving, by the first computing system, from a second computing system in the plurality of multi-party computing computing systems, data indicating a second share of the prediction residual values ​​for the given user profile determined by the second computing system at least in part based on a second share of the given user profile and a second set of one or more machine learning models; and determining the prediction residual value for the given user profile based at least in part on the first share and the second share of the prediction residual value; generating, by the first computing system, a first share of inference results based at least in part on the predicted label and the prediction residual value determined for the given user profile; and The first share of the inference results and the second share of the inference results received from the second computing system are provided to a client device by the first computing system.

2. The computer-implemented method of claim 1 , wherein: Determining the predicted label for the given user profile includes: determining, by the first computing system, a first share of the predicted labels based at least in part on: (i) the first share of the given user profile, (ii) the first machine learning model trained using the plurality of user profiles, and (iii) one or more ground truth labels of the plurality of ground truth labels for the plurality of user profiles, the plurality of ground truth labels including the one or more ground truth labels for each of the plurality of user profiles; receiving, by the first computing system from the second computing system, data indicating a second share of the predicted labels determined by the second computing system based at least in part on a second share of the given user profile and a first set of one or more machine learning models; and The predicted label is determined based at least in part on the first share and the second share of the predicted label.

3. The computer-implemented method of claim 1 , further comprising: Applying, by the first computing system, a transformation to the first share of the given user profile to obtain a first transformed share of the given user profile, wherein determining, by the first computing system, the first share of the predicted label comprises: A first share of the predicted tags is determined by the first computing system based at least in part on the first transformed share of the given user profile.

4. The computer-implemented method of claim 3, wherein: The transform comprises a Johnson-Lindenstrauss transform.

5. The computer-implemented method of claim 3, wherein: Determining, by the first computing system, the first share of the predicted label includes: The first transformed share of the given user profile is provided as input to the first machine learning model by the first computing system to obtain a first share of the predicted label for the given user profile as output.

6. The computer-implemented method of any one of claims 1 to 5, further comprising: Evaluating the performance of the first machine learning model includes, for each of the plurality of user profiles: Determining a predicted label for the user profile includes: determining, by the first computing system, a first share of predicted labels for the user profile based at least in part on: (i) the first share of the user profile, (ii) the first machine learning model, and (iii) one or more true labels of the plurality of true labels for the plurality of user profiles; receiving, by the first computing system from the second computing system, data indicating a second share of the predicted labels for the user profile determined by the second computing system based at least in part on a second share of the user profile and a first set of one or more machine learning models maintained by the second computing system; and determining the predicted tag for the user profile based at least in part on the first share and the second share of the predicted tag; Determining a residual value for the user profile that indicates an error in the predicted label comprises: determining, by the first computing system, a first share of the residual values ​​for the user profile based at least in part on the predicted label determined for the user profile and a first share of true labels for the user profile included in the plurality of true labels; receiving, by the first computing system from the second computing system, data indicating a second share of the residual values ​​for the user profile determined by the second computing system based at least in part on the predicted label determined for the user profile and a second share of the true label for the user profile; and determining the residual value for the user profile based at least in part on the first share and the second share of the residual value; and The second machine learning model is trained using data indicative of the residual values ​​determined for the plurality of user profiles when evaluating the performance of the first machine learning model.

7. The computer-implemented method of claim 6, further comprising: Prior to evaluating the performance of the first machine learning model: The parameter set of the derivation function includes: deriving, by the first computing system, a first share of the set of parameters for the function based at least in part on a first share of each of the plurality of true labels; receiving, by the first computing system from the second computing system, data indicating a second share of the set of parameters of the function derived by the second computing system based at least in part on a second share of each of the plurality of true labels; and deriving the set of parameters for the function based at least in part on the first share and the second share of the set of parameters for the function; and The first machine learning model is configured to generate an initial predicted label for the user profile given the user profile as input and to apply the function as defined based on the derived parameter set to the initial predicted label for the user profile to generate a first share of the predicted labels for the user profile as output.

8. The computer-implemented method of claim 7, further comprising: Estimating, by the first computing system, a first share of a set of distribution parameters based at least in part on the first share of each true label in the plurality of true labels, wherein deriving, by the first computing system, the first share of the set of parameters of the function based at least in part on the first share of each true label in the plurality of true labels comprises: The first share of the set of parameters for the function is derived by the first computing system based at least in part on a first share of the set of distribution parameters.

9. The computer-implemented method of claim 8, wherein: The set of distribution parameters includes one or more parameters of a probability distribution of a prediction error for a true label of a first value among the multiple true labels, and one or more parameters of a probability distribution of a prediction error for a true label of a second value among the multiple true labels, the second value being different from the first value.

10. The computer-implemented method of claim 6, wherein: the first share of the residual values ​​for the user profile indicating a difference in value between the predicted label determined for the user profile and the first share of the true label for the user profile; as well as The second share of the residual values ​​for the user profile indicates a difference in value between the predicted label determined for the user profile and the second share of the true label for the user profile.

11. The computer-implemented method of claim 2, wherein: The first machine learning model comprises a k-nearest neighbor model maintained by the first computing system; The first set of one or more machine learning models includes a k-nearest neighbor model maintained by the second computing system; The second machine learning model includes at least one of: a deep neural network maintained by the first computing system and a gradient boosted decision tree maintained by the first computing system; as well as The second set of one or more machine learning models includes at least one of: a deep neural network maintained by the second computing system and a gradient boosted decision tree maintained by the second computing system.

12. The computer-implemented method of claim 11, wherein: Determining, by the first computing system, the first share of the predicted label includes: identifying, by the first computing system, a first set of nearest-neighbor user profiles based at least in part on the first share of the given user profile and the k-nearest-neighbor model maintained by the first computing system; receiving, by the first computing system from the second computing system, data indicating a second set of nearest neighbor profiles identified by the second computing system based at least in part on the second share of the given user profile and the k-nearest neighbor model maintained by the second computing system; identifying, based at least in part on the first and second sets of nearest-neighbor user profiles, k nearest-neighbor user profiles of the plurality of user profiles that are considered most similar to the given user profile; and The first share of the predicted labels is determined by the first computing system based at least in part on the true label of each of the k nearest neighbor user profiles.

13. The computer-implemented method of claim 12, wherein: Determining, by the first computing system, the first share of the predicted label further includes: determining, by the first computing system, a first share of the sum of the true labels of the k nearest neighbor user profiles; receiving, by the first computing system from the second computing system, a second share of the sum of the true labels of the k nearest neighbor user profiles; and The sum of the true labels of the k nearest neighbor user profiles is determined based at least in part on the first share and the second share of the sum of the true labels of the k nearest neighbor user profiles.

14. The computer-implemented method of claim 13, wherein: Determining, by the first computing system, the first share of the predicted label further includes: A function is applied to the sum of the true labels of the k nearest neighbor user profiles to generate the first share of the predicted labels for the given user profile.

15. The computer-implemented method of claim 13, wherein: The first share of the predicted labels for the given user profile comprises the sum of the true labels of the k nearest neighbor user profiles.

16. The computer-implemented method of claim 12, wherein: Determining, by the first computing system, the first share of the predicted labels based at least in part on the true label for each of the k nearest neighbor user profiles includes: Determining, by the first computing system, a first share of a set of predicted labels based at least in part on a set of true labels for each of the k nearest neighbor user profiles corresponding to a set of categories, comprising, for each category in the set: determining a first share of frequencies in which a true label corresponding to the category in the set of true labels for user profiles in the k nearest neighbor user profiles is a true label of a first value; receiving, by the first computing system from the second computing system, a second share of frequencies in which the true label corresponding to the category in the set of true labels for user profiles in the k nearest neighbor user profiles is the true label of the first value; and The frequency at which the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is the true label of the first value is determined at least in part based on the first share and the second share of the frequency at which the true label corresponding to the category in the true label set of the user profiles in the k nearest neighbor user profiles is the true label of the first value.

17. The computer-implemented method of claim 16, wherein: Determining, by the first computing system, the first share of the set of predicted labels includes, for each category in the set: Applying a function corresponding to the category to the frequency of true labels corresponding to the category in the set of true labels of user profiles in the k nearest neighbor user profiles being true labels of the first value to generate a first share of predicted labels corresponding to the category for the given user profile.

18. The computer-implemented method of claim 1, wherein: The client device calculates the given user profile using a plurality of feature vectors, each of the plurality of feature vectors including a feature value associated with an event of the user of the client device and a decay rate of each feature vector.

19. The computer-implemented method of claim 1 , wherein: The client device calculates the given user profile using a plurality of feature vectors, each feature vector of the plurality of feature vectors including a feature value related to an event of the user of the client device, wherein calculating the given user profile includes: classifying one or more of the plurality of feature vectors as a sparse feature vector; and Classifying one or more of the plurality of feature vectors as a dense feature vector, the method further comprising: The first share of the given user profile and the corresponding second share of the given user profile are generated for the one or more second computing systems using the sparse feature vector and the dense feature vector, wherein generating the first share and the corresponding one or more second shares of the given user profile includes splitting the sparse feature vector using a functional secret sharing share technique.

20. A system for machine learning, comprising: one or more processors; as well as One or more storage devices storing instructions which, when executed by the one or more processors, cause the one or more processors to perform a method according to any preceding claim.

21. A computer-readable storage medium carrying instructions that, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 19.

22. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 19.

Images