Privacy preserving cross-domain machine learning

Abstract

This document describes a secure machine learning platform. In some aspects, a method includes transmitting, by an application, a set of data to a machine learning platform, the set of data including a user profile, one or more characteristics of a digital component, a contextual signal, a model identifier, and data indicating an event type. The application receives a request to upload a user profile of a user of a client device to the machine learning platform generated based on computer-readable instructions. The computer-readable instructions initiate the request in response to detecting an occurrence of an event with a digital component. In response to the request, the application can obtain user profile request data elements including the model identifier of a machine learning model and one or more characteristics of at least one of the digital component or a first content page.

Description

Technical Field

[0001] This specification relates to a privacy-preserving machine learning platform that uses secure multi-party computation to train and use machine learning models. Background Technology

[0002] Some machine learning models are trained on data collected from multiple sources (e.g., across multiple websites and / or native applications). However, this data may include private or sensitive information that should not be shared or disclosed to other parties. Summary of the Invention

[0003] In general, an innovative aspect of the subject matter described in this specification can be embodied in a method comprising: receiving, by a client device, a first content page including a digital component, the digital component including computer-readable instructions; receiving, by an application running on the client device, a request generated based on the computer-readable instructions to upload a user profile of the client device's user to a machine learning platform, wherein the computer-readable instructions initiate the request in response to the detection of an event related to interaction or non-interaction with the digital component; in response to receiving the request: obtaining, by the application, user profile request data elements including a model identifier of a machine learning model and one or more features of at least one of the digital component or the first content page; obtaining, by the application, the user profile of the client device's user; obtaining, by the application, context signals provided to one or more content platforms for training the machine learning model; and transmitting, by the application, a set of data to the machine learning platform, the set of data including the user profile, one or more features, context signals, the model identifier, and data indicating whether the event is an interactive or non-interactive event.

[0004] Other embodiments of this aspect include corresponding apparatus, systems, and computer programs encoded on computer storage devices, configured to perform aspects of the method. These and other embodiments may optionally include one or more of the following features.

[0005] Some aspects include having the application verify the digital signature before transmitting the data to the machine learning platform.

[0006] Some aspects include, in response to detecting an interaction event, a client device accessing a second content page provided by a second content provider different from the first content provider providing the first content page, wherein the second content page includes a label containing computer-readable code; receiving from the label a request for a context signal, one or more characteristics of a digital component, and a user profile; encrypting the context signal, one or more characteristics of the digital component, and the user profile by an application; and sending the encrypted context signal, the encrypted one or more characteristics of the digital component, and the encrypted user profile to the content platform providing the digital component.

[0007] Some aspects include detecting conversion events using the computer-readable code of tags; and transmitting conversion notifications of conversion events to content platforms using the computer-readable code of tags.

[0008] Some aspects include, for each of one or more digital components: sending an inference request for the digital component from the application to the machine learning platform, wherein the inference request includes one or more of a user profile, contextual signals, or characteristics of the current content page; receiving a predicted performance of the digital component from the machine learning platform, wherein the predicted performance metric is based on the user profile and one or more trained machine learning models trained by the machine learning platform; determining a selection value for the digital component based on the predicted performance; and selecting a given digital component for display on the client device based at least on the selection value of each of the one or more digital components.

[0009] Some aspects include receiving a first secret share of the inference result of a first digital component from a first multi-party computation (MPC) computer of a machine learning platform; receiving a second secret share of the inference result of the digital component from each of one or more second MPC computers of the machine learning platform; determining a predictive performance metric of the digital component represented by the inference result based on the first secret share and each second secret share; selecting a digital component for display at a client device based on the predictive performance metric; and displaying the digital component.

[0010] In some respects, the user profile request data element includes a token received from the content platform providing the digital components. The token may include (i) a set of content including a model identifier, data indicating one or more characteristics, a domain of the content platform, and (ii) a digital signature of that set of content generated using the content platform's encryption key.

[0011] Events may include interactive events. These aspects may include storing context signals, one or more characteristics of digital components, and user profiles at the client device in response to detecting an interactive event.

[0012] In some respects, requests to a machine learning platform for inference about a digital component may include one or more properties of the digital component, properties of the current context page, and contextual signals.

[0013] In some respects, performance prediction can be based on the performance of digital components on the k nearest neighbor profiles, which are determined by one or more machine learning models to be the k user profiles most similar to the user profiles of the client device's user.

[0014] In some respects, performance prediction can include the predicted user interaction rate or predicted conversion rate of a digital component, or one of the predicted conversion values ​​of a digital component.

[0015] In some respects, a machine learning platform may include two or more multi-party computation (MPC) computers that use a secure MPC process to train a machine learning model to predict performance metrics of the digital component using encrypted context signals, one or more characteristics of the encrypted digital component, encrypted user profiles, and data received from client devices of one or more additional users.

[0016] In some respects, two or more MPC computers can train machine learning models without accessing encrypted context signals, one or more properties of encrypted digital components, or encrypted user profiles in plaintext.

[0017] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. The machine learning techniques described in this document can be used to select digital components to display to a user on a client device while protecting the user's privacy, for example, by not disclosing the user's online activity to any computing system. This can protect user privacy for such platforms and safeguard the security of data during transmission to or from the platform. Encryption techniques such as Secure MPC can achieve a better online user experience by selecting digital components based on user profiles (e.g., the user's online activity in a cross-domain environment) without using third-party cookies. Since some browsers may not support third-party cookies, this can enable functionality that users might otherwise not be able to use.

[0018] MPC technology ensures that, as long as one computing system in the MPC cluster is honest and not compromised, no single computing system or party in the MPC system can obtain user data in plaintext. Therefore, the technology described in this document allows for the secure identification and transmission of user data without the need for third-party cookies or any user identifiers to determine any relationships between user data. The efficiency of transmitting data content to user devices is improved by using a trained machine learning model, as there is no need to transmit data content irrelevant to a specific user. In particular, the elimination of third-party cookies avoids their storage, improves memory utilization, and reduces the amount of bandwidth otherwise consumed by transmitting cookies.

[0019] The various features and advantages of the foregoing subject matter are described below with reference to the accompanying drawings. Additional features and advantages will be apparent from the subject matter and claims described herein. Attached Figure Description

[0020] Figure 1 It is a block diagram of the environment in which machine learning models are trained and used to select digital components.

[0021] Figure 2 This is a swimlane diagram illustrating an example process for training an interactive machine learning model.

[0022] Figure 3 This is a swimlane diagram illustrating an example process for training a transformational machine learning model.

[0023] Figure 4 This is a swimlane diagram illustrating an example process for inferring and selecting digital components using interactive and / or transformative machine learning models.

[0024] Figure 5 This is a flowchart illustrating an example process of transferring data to a machine learning platform.

[0025] Figure 6 This is a block diagram of an example process for training a transformational machine learning model.

[0026] The same reference numerals and names in different figures indicate the same elements. Detailed Implementation

[0027] This specification relates to techniques for training machine learning models and using these trained models to select content to be distributed to users in a manner that protects the security of user data, based on previous user interactions with the content. Users connected to the internet are exposed to a variety of digital content (e.g., search results, web pages, digital components, news articles, social media posts, audio information output by digital assistant devices). Some of these exposures to content may prompt users to perform a target action. For example, a user exposed to a web page about endangered species might sign up for a newsletter aimed at helping save that species; signing up for the newsletter can be considered a target action. Similarly, a user exposed to a digital component on a web page about a particular type of mobile device might eventually acquire that particular type of mobile device; acquiring the mobile device can be considered a target action. Examples of target actions may also include registering for a website / service, adding items to an online shopping cart, downloading a white paper, obtaining a product, or even clicking on (or otherwise selecting) a digital component. When a user performs a target action, the execution of that action can be termed a conversion.

[0028] In some cases, content platforms providing digital components to user devices can record information about user conversions (and other user interactions with digital components) to select more relevant digital components compared to others. This improves the user experience and reduces the waste of resources transmitting irrelevant information. In the past, such user conversions and / or interactions required collecting certain information and using third-party cookies. However, as third-party cookies are being phased out, the solution described in this document records information about user conversions and interactions with digital components, enabling such information to be used in a privacy-preserving manner for selecting digital components.

[0029] In some cases, digital components can be distributed to users by assigning them to user groups using user profiles generated based on user-related events (e.g., based on a user's access to a specific resource or performance of a specific action at that resource, such as interacting with a specific product displayed on a webpage or adding a product to a virtual shopping cart). These user groups are typically created in a privacy-preserving manner, for example, by creating user profiles on the user's device rather than on the content platform, and by including a sufficient number of users in each user group to make it impossible to identify individual users. The systems and techniques described in this document enable the collection of information about user interactions and conversions with digital components without identifying individual users, thereby protecting user privacy and anonymity, and without using third-party cookies. These techniques also use this data to train machine learning models that can be used to generate predictive performance metrics for selecting digital components.

[0030] refer to Figure 1-4 To illustrate these techniques and methods.

[0031] Figure 1 This is a block diagram of an environment 100 in which a machine learning model is trained and used to select digital components. Example environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. Network 105 connects client devices 110, a secure MPC cluster 130, publishers 140, websites 142, a supplier-side platform (SSP) 170, and a demand-side platform (DSP) 150. SSP 170 and DSP 150 are examples of content platforms that manage the selection and distribution of digital components on behalf of publishers 140 and digital component providers 160.

[0032] Client device 110 is an electronic device capable of communicating via network 105. Example client device 110 includes a personal computer, a mobile communication device (e.g., a smartphone), and other devices that can send and receive data via network 105. The client device may also include a digital assistant device that accepts audio input via a microphone and outputs audio through a speaker. When the digital assistant detects a “hotword” or “hotphrase” that activates the microphone to accept audio input, the digital assistant can enter a listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant can be implemented in various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. The client device may also include digital media devices, such as streaming devices plugged into a television or other display to stream video to the television, gaming systems, or virtual reality systems.

[0033] Client device 110 typically includes applications 112, such as web browsers and / or native applications, to facilitate sending and receiving data over network 105. Native applications are applications developed for a specific platform or device (e.g., a mobile device with a specific operating system). Publisher 140 may develop and provide native applications to client device 110, for example, by making native applications available for download. A web browser may request resource 145 from a web server hosting publisher 140's website 142, for example, in response to a user of client device 110 entering the resource address of resource 145 in the web browser's address bar or selecting a link referencing the resource address. Similarly, native applications may request application content from a publisher's remote server.

[0034] Some resources, application pages, or other application content may include digital component slots for displaying digital components along with resource 145 or application pages. The phrase "digital component" as used throughout this document refers to a discrete unit of digital content or digital information (e.g., video clips, audio clips, multimedia clips, images, text, or other content units). Digital components may be stored electronically as a single file or a collection of files on a physical storage device, and digital components may take the form of video files, audio files, multimedia files, image files, or text files, and may include advertising information; therefore, advertising is a type of digital component. For example, a digital component may be content designed to complement the content of a webpage or other resource displayed by application 112. More specifically, digital components may include digital content related to the resource content (e.g., a digital component may be related to the same topic as the webpage content, or to a related topic). Therefore, the provision of digital components can complement and generally enhance webpage or application content.

[0035] When application 112 loads resources (or application content) that include one or more digital component slots, application 112 may request digital components for each slot. In some implementations, the digital component slots may include code (e.g., a script) that causes application 112 to request digital components from a digital component distribution system that selects and provides the digital components to application 112 for display to the user of client device 110.

[0036] Some publishers 140 use SSP 170 to manage the process of obtaining digital components for their resources and / or applications' digital component slots. SSP 170 is a technology platform implemented in hardware and / or software that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 may have one or more SSP 170s. Some publishers 140 may use the same SSP 170.

[0037] Digital component provider 160 may create (or otherwise publish) digital components that are presented in digital component slots in the resources and applications of a publisher. Digital component provider 160 may use DSP 150 to manage the provision of its digital components for display in digital component slots. DSP 150 is a hardware and / or software-implemented technology platform that automates the process of distributing digital components for display with resources and / or applications. DSP 150 may interact on behalf of digital component provider 160 with multiple provider platforms (SSPs) to provide digital components for display with resources and / or applications of multiple different publishers 140. Typically, DSP 150 may receive requests for digital components (e.g., from SSP 170), generate (or select) selection parameters for one or more digital components created by one or more digital component providers based on the request, and provide data related to the digital component (e.g., the digital component itself) and the selection parameters to SSP 170. SSP 170 can then select the digital component for display at client device 110 and provide client device 110 with data that causes client device 110 to display the digital component.

[0038] In some cases, it is beneficial for users to receive digital components related to web pages, application pages, or other electronic resources that they have previously visited and / or interacted with. To distribute such digital components to users, when a user visits a specific resource or performs a specific action at that resource (e.g., interacting with a specific product displayed on a web page or adding a product to a virtual shopping cart), the user can be assigned to a user group, such as a user interest group, a group of similar users, or other group types involving similar user data. User groups can be generated by the digital component provider 160. That is, when a user visits an electronic resource of the digital component provider 160, each digital component provider 160 can assign the user to its user group.

[0039] To protect user privacy, user group memberships may be maintained at the user's client device 110, for example, by one of applications 112 or the operating system of client device 110, rather than by a digital component provider, content platform, or other party. In a specific example, a trusted program (e.g., a web browser or operating system) may maintain a list of user group identifiers (“user group list”) for users using a web browser or another application. The user group list may include group identifiers for each user group to which the user has been added. The digital component provider 160 that creates the user group may assign user group identifiers to its user group. The user group identifier may describe the group (e.g., a gardening group) or represent the group using codes (e.g., a non-descriptive alphanumeric sequence). The user's user group list may be stored in a secure storage device at client device 110 and / or may be encrypted while being stored to prevent access to the list by others.

[0040] When application 112 displays resources or application content related to digital component provider 160 or web pages on website 142, the resource may request application 112 to add one or more user group identifiers to the user group list. In response, application 112 may add one or more user group identifiers to the user group list and securely store the user group list.

[0041] Content platforms may use a user's user group membership to select digital components or other content that the user may be interested in or that may otherwise benefit the user / user device. For example, such digital components or other content may include data that improves user experience, enhances the operation of the user's device, or otherwise benefits the user or user device. However, the user group identifier in the user's user group list can be provided in a way that prevents the content platform or any other entity from associating the user group identifier with a specific user, thereby protecting user privacy when using user group membership data to select digital components.

[0042] Application 112 can provide user group identifiers from a list of user groups to a trusted computing system that interacts with the content platform to select digital components for display at client device 110 in a manner that is based on user group membership and prevents the content platform or any other entity other than the user from knowing the user's full user group membership.

[0043] In some implementations, application 112 may provide a user interface that enables users to manage the user groups to which they are assigned. For example, the user interface may allow users to remove user group identifiers to prevent all or specific resources 145, publishers 140, content platforms, digital component providers 160, and / or MPC clusters 130 from adding users to user groups (e.g., preventing entities from adding user group identifiers to a list of user group identifiers maintained by application 112). This provides users with greater transparency and control.

[0044] In addition to the descriptions throughout this document, users may be provided with controls (e.g., user interface elements with which they can interact) that allow them to choose whether and when a system, program, or feature described herein can collect user information (e.g., information about a user's social networks, social actions or activities, occupation, user preferences, or current location) and whether content or communications are sent to the user from a server. Furthermore, some data may be processed in one or more ways before being stored or used to remove personally identifiable information. For example, a user's identifier may be processed to the point that personally identifiable information about the user cannot be determined, or, if location information is available, a user's geographic location may be generalized (e.g., generalized to a city, zip code, or state level), making it impossible to determine the user's specific location. Therefore, users can control what information about themselves is collected, how that information is used, and what information is provided to them.

[0045] There are likely many reasons why storing user conversion data is beneficial for both users and content platforms. In one scenario, storing user conversion data can prevent the selection of unnecessary digital components and their transmission to the client device. For example, suppose a user wants to buy a camera. The content platform adds the user to a user group "Camera" and selects a digital component contextually related to the camera, then transmits the selected component to the client device for display to users in the user group. After interacting with the selected component, the user performs the desired action of purchasing the camera, resulting in a conversion event. In this case, continuing to select a digital component contextually related to the user group "Camera" to display on the client device is redundant, as the user has already performed the desired action.

[0046] In another scenario, data generated from user conversions can be used to train a machine learning model to select digital components that are more likely to lead to a conversion when displayed on a client device, thus avoiding the transmission of unnecessary digital components. This can reduce network bandwidth usage and improve the user experience. For example, suppose a user wants to buy a camera. The content platform can add the user to a user group "Camera" based on the user's profile, which may represent the user's online activity and could include visits to web pages with camera-related content. The content platform can later select digital components that are context-relevant to the camera for the user and transmit the selected digital components to the user's client device for display. Although the digital components selected based on the user group "Camera" are generally context-relevant to the camera, the machine learning model can be used to select a smaller subgroup of digital components from a plurality of digital components that are more likely to lead the user to perform a targeted action that can correspond to a conversion event when displayed to the user on client device 110. For example, the machine learning model can be used to generate performance metrics for the digital components, such as predictive performance metrics. Predictive performance metrics can include predicted user interaction rates, such as predicted click-through rates and / or predicted conversion rates for the digital components. Predictive performance metrics can be used to determine or adjust the selection values ​​for the digital components. The selected value is the amount that the digital component provider 160 is willing to provide for displaying and / or user interaction with the digital component.

[0047] In some implementations, the MPC cluster 130 (also referred to as a machine learning platform) can train a machine learning model (referred to as an interactive machine learning model) that can suggest or be used to generate a predictive performance metric indicating the likelihood that a user will interact with the digital component (e.g., by clicking or selecting) if the digital component is displayed to the user. In some implementations, the MPC cluster 130 can train a machine learning model (referred to as a transformation machine learning model) that can suggest or be used to generate a predictive performance metric indicating the likelihood that a user will perform a target action corresponding to a transformation. The secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, which perform secure MPC techniques to train the machine learning model. Although the example MPC cluster 130 includes two computing systems, more computing systems can be used, as long as the MPC cluster 130 includes more than one computing system.

[0048] Computing systems MPC1 and MPC2 can be operated by different entities. In this way, neither entity can access a complete or partial user profile in plaintext. Plaintext is text (including binary files) that is not computationally marked, specially formatted, or written in code or data, and is in a form that can be viewed or used without a key or other decryption device or process. For example, one of the computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, content platform, and digital component provider 160. For example, an industry group, government group, or browser developer can maintain and operate one of the computing systems MPC1 and MPC2. Another computing system can be operated by a different group among these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Preferably, different parties operating different computing systems MPC1 and MPC2 have no incentive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separate and monitored to prevent them from communicating with each other outside of performing the secure MPC processes described in this document.

[0049] In some implementations, the MPC cluster 130 trains one or more machine learning models for each content platform and / or each digital component provider 160. For example, each content platform may manage the distribution of digital components for one or more digital component providers 160. A content platform may request the MPC cluster 130 to train machine learning models for the one or more digital component providers 160 for which it manages the distribution of digital components. Each machine learning model of the content platform may have a unique model identifier.

[0050] After training a machine learning model for the content platform, the content platform can query, or enable application 112 on client device 110 to query, the model to generate predictive performance metrics that can be used to display one or more digital components on client device 110.

[0051] Figure 2 This is a swimlane diagram illustrating an example process 200 for training an interactive machine learning model. The operation of process 200 can be implemented, for example, by a client device 110, an MPC cluster 130, one or more DSPs 150 and SSPs 170. The operation of process 200 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 200.

[0052] A content platform can initiate the training and / or updating of one of its machine learning models by requesting application 112 running on client device 110 to generate user profiles for its corresponding users and to upload a secret-shared and / or encrypted version of the user profile to MPC cluster 130. For the purposes of this document, a secret-shared user profile can be considered an encrypted version of the user profile, as the secret share is not in plaintext. Typically, each application 112 can store user profile data and generate updated user profiles in response to requests received from the content platform. Since the content of user profiles and machine learning models differ for different content platforms, application 112 running on a user's client device 110 can maintain data for multiple user profiles and generate multiple user profiles, each specific to a particular content platform.

[0053] In this example, a user of client device 110 uses application 112, such as a web browser or a native application, to access an electronic resource (e.g., a webpage or application page) that includes a single digital component slot. However, it should be noted that the techniques and methods can be extended to support more than one digital component slot. After loading the webpage including the digital component slot, application 112 sends a request for a digital component to the digital component provider based on one or more user groups to which the user of client device 110 is assigned. In some implementations, the request for the digital component is sent to SSP 170.

[0054] In this example, SSP 170 is an SSP used by a first content provider (e.g., a publisher) to manage the process of obtaining digital component slots for its resources and / or applications, and client device 110 requests content in response to client device 110's application loading the publisher's electronic resources (e.g., web pages or native applications).

[0055] Upon receiving a request for a digital component, SSP 170 can interact with one or more digital component providers 160 and / or one or more DSPs 150. DSP 150 can select one or more digital components based on contextual data, which may include, for example, resource locators of resources, such as a Global Resource Locator (URL) for a webpage or a Global Resource Identifier (URI) for application content, language (e.g., the language in which the content is displayed by the application presenting the content), and / or coarse geographic location information indicating the coarse location of client device 110. Other contextual signals may also be used.

[0056] In some implementations, before sending the digital component to the application 112 executing on client device 110, SSP 170 and / or DSP 150 may include a script 110 in the digital component. When executed on the client device, this script detects, when it is executed, the occurrence of interactive events related to or not related to the digital component performed by the user of the client device 110 while the digital component is displayed on client device 110. The application 112 executing on client device 110 displays the digital component on the client device (e.g., presented in a digital component slot) after receiving the digital component. Although a script is used in this example, the digital component may include other types of computer-readable instructions embedded in the content page or the digital component, such as native code libraries supporting a software development kit (SDK), tags, tag values, parameters, JSON objects, etc. The application 112 may parse the request and take action accordingly.

[0057] When a user interacts with a digital component that triggers an interaction event (e.g., by pressing his / her finger and / or stylus on the touch-sensitive screen of the client device or by otherwise selecting), a script executing on the digital component on client device 110 detects an interaction signal generated by the user interaction with the digital component. In some implementations, the interaction event may also include non-interaction with the digital component. For example, the script may not detect an interaction signal for a specified time period since the digital component was displayed, based on the user's lack of interaction with the digital component. In such a case, the script triggers a non-interaction event with the digital component. In some implementations, the interaction and non-interaction events generated by the script can be characterized using tags and / or features based on whether the event was generated due to interaction or non-interaction. For example, an interaction event generated due to interaction with the digital component may have a value of "1" if the user interacts with the digital component, or a value of "0" if the event was generated due to the user's lack of interaction with the digital component. Other values ​​or data may also be used to indicate whether user interaction with the digital component was detected.

[0058] In some implementations, in response to interactive or non-interactive events, the script may initiate a request to upload the user profile of the user of client device 110 to MPC cluster 130, along with one or more additional features related to digital components and user interaction, to train an interactive machine learning model via MPC cluster 130.

[0059] Application 112 running on client device 110 constructs a user profile for the user of client device 110 (202). The user profile may include data related to events initiated by the user and / or events that may have been initiated by the user regarding electronic resources (e.g., web pages or application content). Events may include views of electronic resources, views of digital components, user interaction with electronic resources or digital components or without user interaction (e.g., selection of electronic resources or digital components), conversions that occur after user interaction with electronic resources, and / or other appropriate actions related to the user and electronic resources.

[0060] In some implementations, a user profile can be in the form of a feature vector. For example, a user profile can be an n-dimensional feature vector. Each of the n dimensions can correspond to a specific feature, and the value of each dimension can be the value of the feature for that user. For example, one dimension could be whether a particular numeric component is displayed to the user. Another feature could be whether the user interacts with the numeric component or not. In this example, if the user interacts with the numeric component, the value of this feature could be "1", or if the user does not interact with the numeric component, the value of this feature could be "0".

[0061] In some implementations, application 112 can generate different user profiles based on requests from the content platform for different machine learning models it possesses. Depending on the design goals, different machine learning models may require different training data. For example, the content platform might create a machine learning model to determine whether to add a user to a user group. In another example, the content platform might create a machine learning model to generate user groups based on a user's online activity. In this example, the content platform trains a machine learning model to predict whether a user will interact with a specific digital component if it is displayed to the user in a particular context.

[0062] Application 112 generates user profiles P i The sharing (204). In this example, application 112 generates user profile P. i The application 112 generates two shares, one for each compute system in the MPC cluster 130. Note that each share can be a random variable itself and does not reveal anything about the user profile. The two shares need to be merged to obtain the user profile. If the MPC cluster 130 includes more compute systems participating in machine learning model training, application 112 will generate more shares, one for each compute system. In some implementations, to protect user privacy, application 112 can use a pseudo-random function to generate the user profile P. i It is split into shares. That is, application 112 can use the pseudo-random function PRF(P i To generate two shared {[P]} i ,1],[Pi The exact split can depend on the secret-sharing algorithm and cryptographic library used by application 112.

[0063] A user of client device 110 using application 112 navigates to an electronic resource (206). For example, the user of client device 110 can use a browser to access website 142 by specifying a reference (e.g., a URL). In another example, the user of client device 110 can use a web browser to submit a search query to a search system that identifies a website by crawling and indexing it (e.g., indexing based on the crawled content). In response, the search system identifies the website in the form of search results and returns the search results to client device 110 in a search results page. After viewing the search results, the user of client device 110 can select and / or click on the search result corresponding to website 142. In yet another example, the user can launch a native application that requests content from the application's publisher 140.

[0064] Client device 110 generates a request for content and transmits the request to a web server (208) via network 105. For example, after a user of client device 110 clicks and / or selects a search result corresponding to website 142 or directly specifies website 142 by using a reference (e.g., a URL), application 112 (e.g., a web browser running on client device 110) generates a request for digital content (e.g., website 142) and transmits it to the web server via network 105.

[0065] Requests for digital content can be transmitted, for example, via packetized network 105, and the content request itself can be formatted as packetized data with a header and payload data. The header can specify the destination of the packet, and the payload data can include any information discussed above.

[0066] Publisher 140 (e.g., publisher 140's web server or content server) responds with content (210). For example, after receiving a request for content (e.g., a request for website 142) from client device 110, the server may respond by transmitting computer-executable instructions and data that can initiate the display of a webpage at client device 110. The response may include data related to the webpage, for example, transmitted via packetized network 105, and the content itself may be formatted as packetized data.

[0067] Client device 110 identifies tags (212) of digital components in an electronic resource. After receiving an electronic resource or its content from publisher 140, application 112 may identify one or more tags, such as one or more tags of digital component slots in the electronic resource. For example, a web browser identifies digital component slots in website 142.

[0068] Client device 110 transmits a request for a digital component to SSP 170 (214). Client device 110 may send the request to the computing system of SSP 170. For example, application 112 may generate one or more requests for digital components based on one or more digital component slots. In a particular example, a web browser may generate a request for a digital component based on a tag and transmit the request to SSP 170 via network 105.

[0069] In some implementations, requests for digital components may also include additional data, such as contextual data. Contextual data may include, for example, resource locators of resources, such as a Global Resource Locator (URL) for a webpage or a Global Resource Identifier (URL) for application content, language (e.g., the language in which the content is displayed by the application presenting the content), and / or coarse geographic location information indicating the approximate location of the client device 110. Other contextual data may also be used.

[0070] Requests for digital components can be transmitted, for example, via packetized network 105, and the component request itself can be formatted as packetized data with a header and payload data. The header can specify the destination of the packet, and the payload data can include any information discussed above.

[0071] SSP 170 interacts with one or more DSPs 150 to select a digital component (216). As previously described, digital component provider 160 can use one or more DSPs 150 to automate the process of distributing digital components for display with the application. Upon receiving the request, SSP 170 can interact with one or more DSPs and transmit a corresponding request for the digital component, optionally including context data.

[0072] DSP 150 can respond to a request for digital components from SSP 170 by transmitting one or more selected digital components or data identifying the digital components (e.g., creative elements including instructions for displaying the digital components). For each digital component, DSP 150 can also generate or select selection parameters for the digital component. DSP 150 can then transmit the selection parameters and data of the digital components to SSP 170. Each digital component (or its data) may include additional data, such as metadata indicating a user group identifier corresponding to the digital component. In some implementations, DSP 150 can also select one or more digital components based on context data and thus independently of the user's group membership. These digital components may also be referred to as context digital components.

[0073] After receiving data from one or more selected digital components from DSP 150, SSP 170 can examine and select a set of digital components. For example, SSP 170 can examine the content and format of the digital components to ensure they meet various criteria, such as excluding specific types of content, meeting data and / or display size requirements, etc. In some implementations, SSP 170 selects digital components at least in part based on selection parameters received from DSP 150. In such implementations, SSP 170 can select the digital component with the highest selection parameter from the selection parameters received from DSP 150.

[0074] If SSP 170 approves a digital component, SSP 170 can generate a signed creative element for that digital component. The signed creative element may include a set of content and a digital signature generated based on that set of content. For example, the set of content may include creative fragments, a digital component provider identifier that uniquely identifies the digital component provider that created and / or published the digital component (which allows SSP 170 to determine the corresponding DSP 150 for the digital component), creative metadata, a resource locator from SSP 170, and / or an expiration date for the digital signature (e.g., requiring the DSP to periodically resubmit the digital component for revalidation).

[0075] Creative snippets may include the digital component itself (or a resource locator or a link to a server from which the digital component can be downloaded). Creative snippets may also include computer-executable code for rendering the digital component, such as scripts for downloading the digital component from the server and rendering it in a digital component slot. Creative snippets may also include computer-executable code for transmitting information about the display of the digital component to an aggregation server, such as scripts that cause client devices to transmit information to the aggregation server.

[0076] SSP 170 resource locators can be the eTLD+1 of an SSP 170 domain. eTLD+1 is the valid top-level domain (eTLD) plus one more tag than the common suffix. Example eTLD+1 is "example.com", where ".com" is the top-level domain.

[0077] Metadata may include a set of attributes that enable SSP 170 to enforce publisher-defined exclusions of digital components. For example, a publisher may not allow digital components with specific attributes (e.g., content associated with a specific category) to be displayed with its resources. Metadata may include a list of prohibited categories, topics, or other attributes of digital components prohibited by the publisher. In some implementations, SSP 170 may encrypt each attribute and include each encrypted attribute in the signed creative element. For example, SSP 170 may encrypt each attribute using its own asymmetric public key. In this way, only SSP 170 can access the plaintext value of each attribute using the asymmetric private key corresponding to the public key. In some implementations, SSP 170 may encrypt each attribute using a symmetric key secretly stored by SSP 170.

[0078] The SSP 170 can create a digital signature by signing the set of content using its asymmetric private key. The recipient of the signed creative element can verify the digital signature using the asymmetric public key corresponding to the private key used to generate the signature. If any data in the set of content changes after the digital signature is generated, verification of the digital signature will fail. The SSP 170 can send the signed creative element of each digital component to the DSP 150 for the digital component provider 160 that creates / publishes digital components.

[0079] In some implementations, before sending the digital component to the application 112 executing on client device 110, the SSP 170 and / or DSP 150 and / or the digital component provider may include scripts (e.g., code such as JavaScript) in the digital component that detect the occurrence of events related to interactions or non-interactions between the user of the client device and the digital component when the digital component is displayed on client device 110. The application 112 executing on client device 110 displays the digital component on the client device (e.g., presents it in a digital component slot) after receiving the digital component.

[0080] SSP 170 transmits digital components to client device 110 (218). For example, after selecting digital components (e.g., the first K digital components, where K can be any number depending on a particular implementation), SSP 170 transmits the set of digital components (or data of the digital components) via network 105 to application 112 executing on client device 110. In some implementations, SSP 170 may transmit a set of selection parameters along with the set of digital components.

[0081] In some implementations, the list of digital components transmitted by SSP 170 can be sorted based on selection parameters. This allows application 112 to select digital components without knowing the actual selection parameters. For each digital component, the list of digital components may also include data indicating the user group identifier corresponding to the digital component. This allows application 112 to filter out digital components for user groups whose members are not members.

[0082] In some implementations, as described in more detail below, two separate requests can be used to send digital components to client device 110. For example, an MPC cluster or another system can select and provide digital components (or data available for obtaining digital components) based on the user's user group membership. Alternatively, an SSP can select and provide digital components (or data available for obtaining digital components) based on context data. In this example, application 112 can select the final digital component displayed in the digital component slot for each digital component slot.

[0083] Application 112 displays a given digital component (220). Application 112 can display digital components of an electronic resource with publisher 140. For example, application 112 can display a digital component in a digital component slot of a resource.

[0084] The user of the client device interacts with the digital component (222). For example, after the user of the client device 110 touches the digital component displayed by the application 112, he / she can interact with the digital component (e.g., by pressing his / her finger and / or stylus on the touch-sensitive screen of the client device).

[0085] The script detects the occurrence of interactive or non-interactive events (224). To detect interaction, the script within the digital component detects a set of interaction signals generated by interaction with the digital component. For example, application 112 can execute a script to monitor user interaction with the digital component. Examples of such interaction signals detected by the script may include the coordinates of the location where the interaction was detected (e.g., a touch point on a touch-sensitive screen) and the duration of the contact. For example, if a user of a client device interacts with the digital component using a stylus, the script can detect interaction signals that may include the coordinates of the location where the stylus made contact, the duration of the contact, and the pressure applied by the stylus on the touch screen.

[0086] In response to the detection of an event, the script generates a request to upload the user's profile to the machine learning platform (226). In some implementations, and in response to the detection of user interaction with a digital component, the script within the digital component generates the request to upload the user profile by passing the user profile request data element to application 112. The request to upload the user profile may take the form UploadUserProfile(Model Identifier, Creative LevelSignals, Clicked, Content Platform Domain, Digital Signature). In this form, the parameter "Model Identifier" represents the identifier of the machine learning model to be trained using the user profile, the parameter "Creative Level Signals" represents the creative level signals of the digital component, the parameter "Clicked" indicates whether the digital component has been clicked (or otherwise interacted with), the parameter "Content PlatformDomain" represents the domain of the content platform that owns the machine learning model, and "Digital Signature" is a digital signature of the remaining parameters generated using a private key (e.g., the private key of application 112 or client device 110). The parameter "Clicked" can be a flag with two values ​​indicating whether the number component has been clicked or not. For example, a value of 1 can indicate that the number component has been clicked, while a value of 0 can indicate that the number component has not been clicked. Other values ​​can also be used. Refer to Table 1 below for further description of these parameters.

[0087] The application obtains user profile request data elements (228) from the content platform. As previously described, the MPC cluster 130 can create multiple machine learning models for the content platform. These machine learning models can differ from each other based on underlying machine learning techniques, training methods, or design goals. For example, the content platform (e.g., DSP 150 or SSP 170) can cause the MPC cluster 130 to create machine learning models to determine whether to add a user to a user group. In another example, the content platform can cause the MPC cluster 130 to create machine learning models to generate user groups based on a user's online activity. In this example, the MPC cluster 130 trains an interaction machine learning model to predict whether a user will interact with a specific digital component if it is presented to the user in a particular context. In this example, the content platform trains machine learning models to generate a performance metric for each digital component that indicates the likelihood that a user will interact with the digital component if it is presented to the user in a particular context. In some implementations, the content platform can include a model identifier of the machine learning model and one or more characteristics of the digital component in the digital component, for example, as metadata, before transmitting the digital component to the client device for presentation.

[0088] In response to a request to upload a user profile, application 112 obtains the user request profile data element M. upload This includes a model identifier for the machine learning model and one or more characteristics of digital components, such as creative-grade signals used by SSPs and / or DSPs to select digital components for application 112, the domain of the content platform, and a digital signature of the content's token. The content platform can then use the model identifier and one or more characteristics of the digital components as a user profile request data element M. upload The data is sent to the client device in the form of a user profile request data element M. upload The following items can be included:

[0089]

[0090]

[0091] Table 1

[0092] The model identifier identifies the content platform's machine learning model, identified by the content platform's eTLD+1 field. Its user profile will be used for training or to generate predictive performance metrics for the digital components before they are displayed on client devices. A digital signature is generated based on seven items using the content platform's private key.

[0093] In some implementations, in order to protect the user profile request data element M during transmission... upload The content platform will use data element M uploadEncrypt data element M before sending it to application 112 upload For example, a content platform can use the application's public key to encrypt the user profile request data element M. upload For example, PubKeyEnc(M upload Application 112 can verify data element M before obtaining and storing model identifiers and one or more properties of digital components. upload Application 112 can verify the digital signature by (i) using the public key of the content platform corresponding to the private key used to generate the digital signature and (ii) ensuring that the token creation timestamp is not outdated (e.g., the time indicated by the timestamp is within a threshold amount of time of the current time at which verification occurs). upload If data element M upload If valid, application 112 can use the data element. If any validation fails, application 112 can ignore the upload request.

[0094] In yet another example, the content platform can send the model identifier to application 112 via a script originating from the internally running content platform (or SSP170), and application 115 can directly transmit the model via the script API. Application 115 relies on a security model based on the World Wide Web Consortium (W3C) source to protect event data and update requests from being forged or leaked.

[0095] The application obtains user profiles and context signals provided to one or more content platforms for selecting digital components (230). Based on the content platform (identified by the content platform domain) and the model identifier, application 112 can select the corresponding user profile for a machine learning model specified by the model identifier of the content platform. In this example, application 112 selects a user's user profile for a machine learning model implemented by MPC cluster 130 for scoring digital components.

[0096] As previously described, application 112 also obtains contextual data (also known as contextual signals) previously included in the request for the digital component. Contextual data may include, for example, resource locators of resources, such as a global resource locator (URL) of a webpage or a global resource identifier (URI) of application content, language (e.g., the language in which the application displaying the content) and / or coarse geolocation information indicating the coarse location of client device 110. Other contextual data may also be used.

[0097] The application uploads a set of data to the machine learning platform (232). After obtaining the user profile request data elements, the user profile, and context signals, the application 112, executed on the client device 110, uploads the secret sharing of the user profile, one or more characteristics of the digital component, context signals, model identifiers, and data indicating whether the event is an interactive or non-interactive event (e.g., features and / or tags, such as 0 or 1). For interpretable purposes, this data is also referred to as the event's tag.

[0098] In some implementations, application 112 may also decompose one or more characteristics of the digital component, context signals, and / or markers (e.g., whether a user interacts with the digital component) into shares. For example, application 112 may generate corresponding shares for context signals. i,1 ] and [contextual_signals i,2 ]), corresponding sharing of one or more characteristics of digital components ([digital_comp_char) i,1 ] and [digital_comp_char i,2 ]).

[0099] In some implementations, application 112 generates a user profile P. i First sharing [P] i,1 The first share of one or more characteristics of a digital component [digital_comp_char] i,1 ], contextual signals i,1 The first shared data, indicating whether the event is interactive or non-interactive, and a composite message C1 containing a model identifier are sent. Application 112 encrypts the composite message using the encryption key of computing system MPC1, which may be the public key of computing system MPC1. Similarly, application 112 generates a user profile P. i Second sharing [P] i,2 The second sharing of one or more characteristics of a digital component [digital_comp_char] i,2 ], Second sharing of contextual signals [contextual_signals] i,2A composite message C2 containing data indicating whether an event is interactive or non-interactive, and a model identifier. Application 112 encrypts the composite message using the encryption key of computing system MPC2, which may be the public key of computing system MPC2. These functions can be represented as PubKeyEncrypt(C1, MPC1) and PubKeyEncrypt(C2, MPC2), where PubKeyEncrypt represents the public key encryption algorithm using the corresponding public key of MPC1 or MPC2. The composite message is generated using a reversible method to synthesize a complex message from multiple simple messages (e.g., JavaScript Object Representation (JSON), Concise Binary Object Representation (CBOR), or protocol buffers).

[0100] In some implementations, the order in which application 112 uploads the first encrypted share to computing system MPC1 must match the order in which application 112 uploads the second encrypted share to computing system MPC2. This enables computing systems MPC1 and MPC2 to correctly match two shares with the same secret, such as two shares of the same user profile.

[0101] In some implementations, application 112 may explicitly assign the same pseudo-random or sequentially generated identifier to shares of the same secret to facilitate matching. While some MPC techniques may rely on random rearrangements of inputs or intermediate results, the MPC techniques described in this document may not include such random rearrangements and may instead rely on the upload order for matching.

[0102] The machine learning platform generates interactive machine learning models (234). Computational systems MPC1 and MPC2 can generate models based on samples S from their respective training datasets. i Train a machine learning model such that each sample from the corresponding training dataset includes its user profile, one or more features of the digital component, contextual signals, and a tag indicating whether the event is interactive or non-interactive.

[0103] Each generation of a new machine learning model based on user profile data can be called a training session. Computing systems MPC1 and MPC2 can train machine learning models based on encrypted sharing of user profiles received from client device 110. For example, computing systems MPC1 and MPC2 can use MPC technology to train a k-NN model based on the sharing of user profiles.

[0104] To minimize or at least reduce encrypted computations, and thus minimize or at least reduce the computational burden on computing systems MPC1 and MPC2 to protect user privacy and data during model training and inference, MPC cluster 130 can use random projection techniques, such as SimHash, to quickly, securely, and probabilistically quantize two samples S.i and S j Similarity between two samples S. i and S j The similarity between two samples S can be determined by defining the similarity between them. i and S j The Hamming distance between two bit vectors is used to determine the distance, which is inversely proportional to the cosine distance between the two samples with a high probability.

[0105] Conceptually, for each training session, m random projected hyperplanes U = {U1, U2, ..., U...} can be generated. m The random projection hyperplane can also be called the random projection plane. One goal of the multi-step computation between computational systems MPC1 and MPC2 is to compute for each sample S used to train the k-NN model. i Create a bit vector B of length m. i In the bit vector B i In, each bit B i,j U represents one of the projection planes j and sample S i The sign of the dot product, that is, for all j∈[1,m], n i,j =sign(U j ⊙S i ), where ⊙ represents the dot product of two vectors of equal length. That is, each bit represents a sample S. i Located in plane U j Which side. A bit value of 1 indicates a positive sign, while a bit value of 0 indicates a negative sign.

[0106] At the end of the multi-step computation, each of the two computation systems, MPC1 and MPC2, generates an intermediate result, which includes the bit vector of each sample in plaintext, the share of each sample, and the share of the tag for each user profile. For example, the intermediate result of computation system MPC1 could be the data shown in Table 2 below. Computation system MPC2 will have a similar intermediate result, but the share of each user profile and each tag will be different. To add additional privacy protection, each of the two servers in the MPC cluster 130 only obtains half of the m-dimensional bit vector in plaintext form; for example, computation system MPC1 obtains the first m / 2 dimensions of all m-dimensional bit vectors, and computation system MPC2 obtains the last m / 2 dimensions of all m-dimensional bit vectors.

[0107] Bit vectors in plaintext form <![CDATA[P i MPC1 sharing]]> <![CDATA[Label i MPC1 sharing]]> … … … <![CDATA[B i ]]> … … Bi+1 … … … … …

[0108] Table 2

[0109] Given two arbitrary samples P of unit length i and P j (i≠j), it has been proven that two samples P i and Pj bit vector B i and B j The Hamming distance between them is highly correlated with the sample vector P. i and P j The cosine distance between them is proportional, assuming the number of random projections m is large enough.

[0110] Based on the intermediate results shown above, and since the bit vector Bi is plaintext, each computing system MPC1 and MPC2 can independently create (e.g., through training) a corresponding k-NN model using the k-NN algorithm. Computing systems MPC1 and MPC2 can use the same or different k-NN algorithms. Once the k-NN model is trained, application 112 can query the k-NN model to determine the predicted performance of the digital components.

[0111] Computational systems MPC1 and MPC2 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine, based on a k-NN model, whether to select a digital component for display to a user on a client device. One of the previously discussed methods involves generating a performance metric for the digital component, such as a predictive performance metric. In this example, the predictive performance metric indicates the likelihood that a user will interact with the digital component when it is displayed to the user. Based on the predictive performance metric, an application 112 on client device 110 can select the digital component. Another method for selecting a digital component can include classifying the digital component into categories. For example, a k-NN model can classify digital components into categories A and B, such that digital components classified as category A have a higher probability of being interacted with by the user when displayed on client device 110, while digital components classified as category B have a lower probability of being interacted with by the user. Application 112 can then select a digital component from category A to display to the user. After training an interaction machine learning model, this model can be used to select digital components to display to the user. This will refer to... Figure 4 Further explanation.

[0112] Figure 3 This is a swimlane diagram illustrating an example process 300 for training a translational machine learning model. The operation of process 300 can be implemented, for example, by a client device 110, an MPC cluster 130, one or more DSPs 150 and SSPs 170. The operation of process 300 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 300.

[0113] Similar to process 200, the content platform can initiate the training and / or updating of the transformation machine learning model by requesting application 112 running on client device 110 to generate user profiles for its corresponding users and uploading secret shared and / or encrypted versions of the user profiles to MPC cluster 130.

[0114] In this example, a user of client device 110 uses application 112, such as a web browser or a native application, to access an electronic resource (e.g., a webpage or application page) that includes a digital component slot. However, it should be noted that the techniques and methods described can be extended to support more than one digital component slot. After loading webpage 142 that includes the digital component slot, application 112 sends a request for the digital component to SSP 170 based on one or more user groups to which the user of client device 110 is assigned. Assume application 112 selects the digital component and displays it along with webpage 142. If the user interacts with the digital component that triggers an interaction event (e.g., pressing his / her finger and / or stylus on the touch-sensitive screen of the client device), the user is redirected to a different resource, such as webpage 144 (also referred to as a second content page). For example, if the digital component on webpage 142 is related to shoes from a specific brand X, user interaction with the digital component can redirect the user to webpage 144 for brand X. In some implementations, the second content page may be provided by a second publisher different from the publisher that provided the first content page. For example, the second content page could be the login page for the digital component, such as a login page linked from the digital component.

[0115] It should be noted that the script within the digital component executed on client device 110 detects interaction signals generated by user interaction with the digital component and triggers interaction events (as shown in the reference). Figure 3 (as described above). In response to an interaction event, the script generates a request that results in the upload of a set of data, including a user profile, one or more properties of a digital component, context signals, and data indicating whether the event is interactive or non-interactive.

[0116] In some implementations, the script obtains the eTLD+1 domain of the second publisher providing the second content page in response to detecting user interaction with the digital component. For example, if a digital component displayed within website 142 is related to shoes from a specific brand X, and user interaction with the digital component redirects the user to webpage 144 of brand X, the script obtains the eTLD+1 domain of webpage 144 of brand X. After obtaining the eTLD+1 domain of the second content page, the script interacts with application 112 (e.g., via an API) and instructs the application to obtain the current user profile, context signals, and one or more characteristics of the digital component for the user on client device 110. In some implementations, native code libraries (e.g., SDKs or other computer-readable code or instructions) embedded in application 112 detect user interaction with the digital component and trigger interaction events and perform all the actions described above performed by the script.

[0117] In some implementations, the second content page includes a tag (e.g., a script different from the script within the digital component) that, after being uploaded to client device 110, generates a request for context signals, one or more characteristics of the digital component, and a user profile. For example, when a user of client device 110 is redirected to webpage 144, webpage 144, including the tag, is uploaded to the client device and generates a request for the user's current user profile, context signals, and one or more characteristics of the digital component with which the user of client device 110 interacts. In response to this request, application 112 generates a secret share of the user profile, context signals, and one or more characteristics of the digital component, and transmits the secret share to the corresponding DSP 150.

[0118] In some implementations, when a tag on the second content page detects a user conversion, the tag transmits a conversion notification token to the DSP 150, which includes one or more characteristics describing the user conversion. For example, if a user performs the goal of buying a pair of shoes after being redirected to webpage 144 of brand X, the tag on webpage 144 transmits a conversion notification token to the DSP 150. This token may include the amount of time the user spent on webpage 144, the user's action on webpage 144, a description of the goal action performed by the user on webpage 144, the amount purchased, etc.

[0119] After receiving user profiles, context signals, and sharing and conversion notifications of one or more features of digital components, DSP 150 associates the conversion notifications with corresponding sharing of user profiles, context signals, and one or more features of digital components to create training samples and transmits them to MPC cluster 130. After receiving the training samples from DSP 150, MPC cluster 130 can generate a conversion machine learning model. During inference, the predicted conversion value of a digital component can be queried from MPC cluster 130 based on the conversion machine learning model, and the digital component can be selected to be displayed to the user.

[0120] Application 112, running on client device 110, constructs user profiles for users of client device 110 (302). Similar to step 202 of process 200, application 112 can generate different user profiles based on the requests of the content platform and for different machine learning models owned by the content platform.

[0121] Application 112 generates user profiles for users. i Sharing (304). Similar to step 202 of process 200, application 112 generates user profile P. i The application generates two shares, one for each compute system in the MPC cluster 130. If the MPC cluster 130 includes more compute systems participating in machine learning model training, application 112 will generate more shares, one for each compute system. Application 112 can use a pseudo-random function to generate user profiles P. i It is split into shares. That is, application 112 can use the pseudo-random function PRF(P i To generate two shared {[P]} i ,1],[P i The exact split can depend on the secret-sharing algorithm and cryptographic library used by application 112.

[0122] A user on client device 110 using application 112 navigates to an electronic resource (306). For example, the user on client device 110 can access website 142 using a browser by specifying a reference (e.g., a URL), or submit a search query to a search system using a web browser, which identifies the website in the form of search results and returns the search results to client device 110 in a search results page. After viewing the search results, the user on client device 110 can select and / or click on the search results corresponding to website 142. In yet another example, the user can launch a native application that requests content from the application's publisher 140.

[0123] Client device 110 generates a request for content and transmits the request to the first publisher (308) via network 105. For example, after a user of client device 110 clicks and / or selects a search result corresponding to website 142 or directly specifies website 142 by using a reference (e.g., a URL), application 112 (e.g., a web browser running on client device 110) generates a request for digital content (e.g., website 142) and transmits it to a web server via network 105.

[0124] The first publisher responds with content (310). For example, after receiving a request for content (e.g., a request for website 142) from client device 110, the web server of publisher 142-1 may respond by transmitting computer-executable instructions and data that initiate the display of a webpage at client device 110. This response may include data related to the webpage transmitted, for example, via packetized network 105, and the content itself may be formatted as packetized data.

[0125] Client device 110 identifies tags (312) of digital components in an electronic resource. After receiving an electronic resource or its content from publisher 140-1, application 112 may identify one or more tags, such as one or more tags of digital component slots in the electronic resource. For example, a web browser identifies digital component slots in website 142.

[0126] Client device 110 transmits a request for a digital component to SSP 170 (314). Client device 110 may send the request to the computing system of SSP 170. For example, application 112 may generate one or more requests for digital components based on one or more digital component slots. In a particular example, a web browser may generate a request for a digital component based on a tag and transmit the request to SSP 170 via network 105. The request for a digital component may also include additional data, such as context data.

[0127] SSP 170 interacts with one or more DSPs 150 to select a digital component (316). Similar to step 216 of process 200, after receiving a request, SSP 170 may interact with one or more DSPs 150 and transmit a corresponding request for a digital component, optionally including context data. DSP 150 may respond to the request for a digital component from SSP 170 by transmitting one or more selected digital components or data identifying the digital component. Before sending the digital component to application 112 executed on client device 110, SSP 170 and / or DSP 150 and / or digital component provider may include scripts (e.g., code such as JavaScript) in the digital component that detect the occurrence of events related to interaction or non-interaction between the user of the client device and the digital component when the digital component is displayed on client device 110.

[0128] SSP 170 transmits digital components to client device 110 (318). Similar to step 218 of process 200, after selecting digital components (e.g., the first K digital components, where K can be any number depending on the particular implementation), SSP 170 transmits the set of digital components (or the data of the digital components) via network 105 to application 112 executing on client device 110. In some implementations, SSP 170 may transmit a set of selection parameters along with the set of digital components.

[0129] Application 112 displays a given digital component (320). For example, application 112 can display the selected digital component together with the electronic resources of publisher 140.

[0130] User interaction with digital components (322). For example, after a first content page (e.g., webpage 142) and digital components are displayed by application 112, a user of client device 110 can interact with the digital components (e.g., by pressing his / her finger and / or stylus on the touch-sensitive screen of the client device). In some cases, the user can also choose not to interact with the digital components. For example, if the user of client device 110 finds the digital components uninteresting, the user can choose not to interact with them.

[0131] The script detects the occurrence of interactive or non-interactive events (324). To detect interaction, the script executing within the digital component detects a set of interaction signals generated by the interaction with the digital component. Examples of such interaction signals detected by the script may include the coordinates of the location where the interaction was detected (e.g., a touch point on a touch-sensitive screen) and the duration of the contact. For example, if a user of the client device interacts with the digital component using a stylus, the script may detect an interaction signal that may include the coordinates of the location where the stylus made contact, the duration of the contact, and the pressure applied by the stylus on the touch screen. If the script does not detect any interaction signal with the digital component, the script registers the event as a non-interactive event.

[0132] The script obtains the domain of the second publisher (326). In response to detecting user interaction with the digital component, the script obtains the eTLD+1 domain of the second publisher that provides the second content page. For example, if the digital component displayed within website 142 is related to shoes of a specific brand X, and user interaction with the digital component redirects the user to webpage 144 of brand X (e.g., a login page) published by the web server of publisher 140-2, the script obtains the eTLD+ domain of brand X.

[0133] The user is redirected to a second content page (328) provided by a second publisher. For example, if a digital component on webpage 142 is related to shoes from a specific brand X, user interaction with the digital component may redirect the user to webpage 144 of brand X. The second content page may be provided by a second publisher 140-2, different from the publisher 140-1 that provides the first content page. Application 112, executing on client device 110, generates a request for the digital content (e.g., website 144) and transmits it to publisher 140-2's web server via network 105.

[0134] The second publisher responds with content (330). For example, after receiving a request for content (e.g., a request for webpage 144 including the tag) from client device 110, the web server of publisher 140-2 hosting webpage 144 can respond by transmitting computer-executable instructions and data that initiate the display of the webpage at client device 110. This response may include data related to the webpage, for example, transmitted via packetized network 105, and the content itself may be formatted as packetized data.

[0135] The tag on webpage 144 generates a request to upload a user profile (332). The tag on webpage 144 includes computer-executable instructions that, when executed on client device 110, generate a request to upload a user profile and one or more characteristics of context signals and digital components.

[0136] Application 112 encrypts the user profile (334). In some implementations, application 112 may decompose one or more characteristics and context signals of digital components into shares based on the computing system of MPC cluster 130. For example, application 112 may generate corresponding shares of context signals for MPC1 132 and MPC2 134 respectively. i,1 ] and [contextual_signals i,2 Sharing of one or more properties of digital components ([digital_comp_char)) and digital components. i,1 ] and [digital_comp_char i,2 ]).

[0137] In some implementations, application 112 generates two or more composite messages for each of the two or more computing systems in the MPC cluster 130, such that the composite messages of the computing systems include the corresponding shares that need to be provided to the computing systems. For example, application 112 generates a user profile P i First sharing [P] i,1 The first share of one or more characteristics of a digital component [digital_comp_char] i,1 First sharing of contextual signals i,1 The composite message C1_conversion is generated. Application 112 encrypts the composite message using the encryption key of computing system MPC1. Similarly, application 112 generates a user profile P. i Second sharing [P] i,2 The second sharing of one or more characteristics of a digital component [digital_comp_char] i,2 ], Second sharing of contextual signals [contextual_signals] i,2 The composite message C2_conversion is used. Application 112 encrypts the composite message using the encryption key of the computing system MPC2.

[0138] The application sends the user profile to DSP 150 (336). In some implementations, application 112 transmits a separate composite message to DSP 150. In other implementations, application 112 may transmit the composite message directly to MPC cluster 130. Note that when the encrypted composite message is transmitted to DSP 150, DSP 150 does not see the message in plaintext form because the message is encrypted using the encryption key of the computing system of MPC cluster 130.

[0139] In some implementations, the order in which application 112 uploads the first encrypted share to the recipient must match the order in which application 112 uploads the second encrypted share. This allows the recipient to correctly match two shares with the same secret, such as two shares of the same user profile.

[0140] In some implementations, application 112 may explicitly assign the same pseudo-random or sequentially generated identifier and timestamp indicating the time of upload and sharing to shares of the same secret to facilitate matching. While some MPC techniques may rely on random rearrangement of inputs or intermediate results, the MPC techniques described in this document may not include such random rearrangement and may instead rely on upload order for matching.

[0141] The tags on webpage 144 detect user conversions (338). For example, after a user is redirected to webpage 144, they perform the target action specified on webpage 144. The tags on webpage 144 detect the user conversion and obtain one or more characteristics describing the user conversion. For example, after a user is redirected to webpage 144 of brand X, they perform the target action of buying a pair of shoes. The tags on webpage 144 detect the conversion. The one or more characteristics describing the user conversion may include the amount of time the user spent visiting webpage 144, the user's actions on webpage 144, a description of the target action performed by the user on webpage 144, and the amount purchased if the conversion is a purchase, etc.

[0142] A tag on webpage 144 transmits a conversion notification token to DSP 150 (340). In some embodiments, a tag within a second content page generates a conversion notification token and transmits it to DSP 150 in response to detecting a user conversion. In some embodiments, the conversion notification token may include features and / or tags (referred to as conversion tags) indicating whether the user has been converted by performing a desired target action. The conversion notification token may optionally include one or more features describing the user conversion.

[0143] In some implementations, even if no user conversion is detected by the tags on the second content page, the tags on the second content page will still generate a conversion notification token and transmit the token to the first publisher. In such implementations, the conversion notification token may include a field indicating whether a user conversion was detected.

[0144] In some implementations, the label on webpage 144 may include in the conversion notification token the same pseudo-random or sequentially generated identifier assigned to the same secret to facilitate matching, and a current timestamp indicating the time of the user's conversion. If application 112 has previously used a first-party cookie from the content platform to identify the same user in the same first-party domain, the label on webpage 144 may include the same first-party cookie in the conversion notification token.

[0145] DSP 150 generates training samples (342). Since the timestamp of a user selecting a digital component and being redirected to a second content page (e.g., the timestamp associated with an encrypted share of a user profile) may differ from the timestamp of a user conversion, because the user may spend some time performing the intended target action, the user profile, the digital component displayed and interacted with by the user, contextual features, secret sharing of one or more features of the digital component, and conversion notification tokens may have different timestamps. In some implementations, DSP 150 uses first-party cookies to identify the same user in the same first-party domain. DSP 150 also uses pseudo-random or sequentially generated identifiers, along with the associated timestamps of secret sharing and conversion notifications, to match different shares and conversion tokens from the user's conversion token to generate training samples. In some implementations, the permissible time difference between these two timestamps (e.g., the time when the user selects a digital component and is redirected to a second content page and the time when the user converts) can be determined by the system designers. In other implementations, MPC cluster 130 can infer the permissible time difference based on patterns in the user's online activity, or a machine learning model can be used to predict the permissible time difference. In some implementations, if the secret sharing and conversion notification tokens are transmitted directly to the MPC cluster 130, the MPC cluster 130 can match different sharing and conversion tokens to generate training samples. Note that the secret sharing is encrypted using the encryption key of the computing system of the MPC cluster 130, therefore the DSP 150 cannot access these shares in plain text.

[0146] DSP 150 transmits training samples to MPC cluster 130 (344). In some embodiments, DSP 150 transmits training samples in batches to the corresponding computing systems of MPC cluster 130 after generating training samples to train the transformational machine learning model. In other embodiments, DSP 150 may transmit training samples to the corresponding computing systems of MPC cluster 130 simultaneously after generating training examples.

[0147] The machine learning platform generates a conversion machine learning model (346). The computing systems MPC1 and MPC2 can train the conversion machine learning model based on training samples, which include encrypted sharing of user profiles, one or more features of digital components, context signals, and conversion tags indicating whether a user on a client device has converted.

[0148] The computing systems MPC1 and MPC2 can be based on samples S from their respective training datasets. iTrain a machine learning model such that each sample from the corresponding training dataset includes its user profile, one or more features of the digital component, contextual signals, and an encrypted share of the transformation token.

[0149] Each generation of a new machine learning model based on user profile data can be called a training session. Computing systems MPC1 and MPC2 can train machine learning models based on encrypted sharing of user profiles received from client device 110. For example, computing systems MPC1 and MPC2 can use MPC technology to train a k-NN model based on the sharing of user profiles.

[0150] MPC cluster 130 can use random projection techniques, such as SimHash, to quickly, securely, and probabilistically quantize two samples S. i and S j Similarity between two samples S. i and S j The similarity between two samples S can be determined by defining the similarity between them. i and S j The Hamming distance between two bit vectors is used to determine the distance, which is inversely proportional to the cosine distance between the two samples with a high probability.

[0151] Similar to step 232 of process 200, the computation systems MPC1 and MPC2 are used for each sample S used to train the k-NN model. i Create a bit vector B of length m. i In the bit vector B i In, each bit B i,j U represents one of the projection planes j and sample S i The sign of the dot product, that is, for all j∈[1,m], B i,j =sign(U j ⊙S i ), where ⊙ represents the dot product of two vectors of equal length. At the end of the multi-step computation, each of the two computation systems MPC1 and MPC2 generates an intermediate result, which includes the bit vector of each sample in plaintext form, the share of each sample, and the share of the transformation of each user profile. Each of the two servers in the MPC cluster 130 can only obtain half of the m-dimensional bit vector in plaintext form; for example, computation system MPC1 obtains the first m / 2 dimensions of all m-dimensional bit vectors, and computation system MPC2 obtains the last m / 2 dimensions of all m-dimensional bit vectors.

[0152] Based on the intermediate results shown above, and since the bit vector Bi is plaintext, each computing system MPC1 and MPC2 can independently create (e.g., through training) a corresponding k-NN model using the k-NN algorithm. Computing systems MPC1 and MPC2 can use the same or different k-NN algorithms. Once the k-NN model is trained, application 112 can query the k-NN model to determine the predicted probability of the transformation.

[0153] The computing systems MPC1 and MPC2 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine, based on a k-NN model, whether to select a digital component for display to the user on the client device. One of the previously discussed methods involves generating a performance metric for the digital component, such as a predictive performance metric. In this example, the predictive performance metric indicates the likelihood that the user will perform a target action and thus experience a conversion. Based on the predictive performance metric, the digital component can be selected by application 112 on client device 110. This will refer to... Figure 4 Further explanation.

[0154] Figure 4 This is a swimlane diagram illustrating an example process 400 for requesting and selecting digital components using an interactive and / or transformative machine learning model. The operation of process 400 can be implemented, for example, by a client device 110, an SSP 170, one or more DSPs 150, and a publisher 140. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 400.

[0155] In this example, the user of client device 110 uses application 112, such as a web browser or a native application, to access electronic resources (e.g., web pages or application pages) that include digital component slots.

[0156] After loading a webpage including a digital component slot, application 112 sends one or more requests for the digital component. In some implementations, application 112 sends both user group-based requests and context requests. User group-based requests may be requests for digital components selected based on user groups(one or more) that include users as members. These requests may be sent to a content platform (e.g., an SSP), an MPC cluster, or another server, depending on the preferred level of user privacy. Because these requests may include one or more user group identifiers that include user groups(one or more) as members, they can be handled differently from context requests. Context requests, which may include context data but not user group membership data, may be sent to a content platform, such as an SSP.

[0157] When receiving a request for a digital component, the SSP 170 can interact with one or more digital component providers and / or one or more DSPs 150 to obtain the digital component for display with the application.

[0158] DSP 150 selects one or more digital components from a set of available digital components. For user group-based requests, DSP 150 can filter out digital components that do not have a corresponding user group identifier that matches one of the user group identifiers included in the request. DSP can select digital components from the filtered group, for example, based on context data. For context-based requests, DSP 150 can select digital components based on context data included in the request.

[0159] DSP 150 can further select digital components (e.g., the top N digital components) by analyzing and scoring each of one or more selected digital components. DSP 150 then transmits the selected digital components(one or more), creative elements of digital components(one or more), or data identifiers or data that can be used to obtain digital components(one or more), to SSP 170 (or MPC cluster or another server). For example, DSP 150 can provide digital components to the MPC cluster or another server in response to a user group-based request, and provide digital components to SSP 170 for context requests.

[0160] After receiving digital components from one or more DSPs 150, the SSP 170 can check and select a set of digital components (e.g., the first K digital components) before enabling the digital components to be provided for display on the client device, based on standards and / or conditions set by the publisher 140. For example, the SSP 170 can check the content and format of the digital components to ensure they meet various standards, such as excluding specific types of content, meeting data and / or display size requirements, etc. This set of digital components is sent to the application 112 executing on the client device 110.

[0161] After receiving the set of digital components, application 112, executing on client device 110, can select a subgroup of digital components by filtering out one or more digital components with the lowest probability of being interacted with by the user. To filter out one or more digital components from the set, application 112 identifies a corresponding predicted performance metric for each digital component in the set, generated by an interactive machine learning model. After selection, one or more digital components are displayed on the client device (e.g., presented in a digital component slot). In some implementations, the selection of digital components is not solely based on the predicted performance metric. For example, application 112 may consider the predicted performance metric as well as the contextual attributes of the digital components, protocols or conditions associated with the digital components set by the component provider (e.g., values ​​instructing the SSP to receive and display the monetary value of the digital component), or user-defined rules for including or excluding digital components.

[0162] A user of client device 110 using application 112 navigates to an electronic resource (402). For example, the user of client device 110 can use a browser to access website 142 by specifying a reference (e.g., a URL). In another example, the user of client device 110 can use a web browser to submit a search query to a search system that identifies a website by crawling and indexing it (e.g., indexing based on the crawled content). In response, the search system identifies the website in the form of search results and returns the search results to client device 110 in a search results page. After viewing the search results, the user of client device 110 can select and / or click on the search result corresponding to website 142. In yet another example, the user can launch a native application that requests content from the application's publisher 140.

[0163] Client device 110 generates a request for content and transmits the request to a web server (404) via network 105. For example, after a user of client device 110 clicks and / or selects a search result corresponding to website 142 or directly specifies website 142 by using a reference (e.g., a URL), application 112 (e.g., a web browser running on client device 110) generates a request for digital content (e.g., website 142) and transmits it to the web server via network 105.

[0164] Requests for digital content can be transmitted, for example, via packetized network 105, and the content request itself can be formatted as packetized data with a header and payload data. The header can specify the destination of the packet, and the payload data can include any information discussed above.

[0165] Publisher 140 (e.g., publisher 140's web server or content server) responds with content (406). For example, after receiving a request for content (e.g., a request for website 142) from client device 110, the server may respond by transmitting computer-executable instructions and data that can initiate the display of a webpage at client device 110. The response may include data related to the webpage transmitted, for example, via packetized network 105, and the content itself may be formatted as packetized data.

[0166] Client device 110 identifies tags (408) of digital components in an electronic resource. After receiving an electronic resource or its content from publisher 140, application 112 may identify one or more tags, such as one or more tags of digital component slots in the electronic resource. For example, a web browser identifies one or more digital component slots in website 142.

[0167] Client device 110 sends a request for a digital component to SSP 170 (410). For example, application 112 may generate one or more requests for a digital component based on one or more digital component slots. In a particular example, a web browser may generate a request for a digital component based on a tag and transmit the request to SSP 170 via network 105.

[0168] In some implementations, a request for a digital component may include a user group identifier of the user group to which the client device is associated. In some implementations, a request for a digital component may also include additional data, such as context data. Context data may include, for example, a resource locator of a resource, such as a Global Resource Locator (URL) of a webpage or a Global Resource Identifier (URI) of application content, language (e.g., the language in which the content is displayed by the application that presents the content), and / or coarse geolocation information indicating the coarse location of the client device 110.

[0169] Requests for digital components can be transmitted, for example, via packetized network 105, and the component request itself can be formatted as packetized data with a header and payload data. The header can specify the destination of the packet, and the payload data can include any information discussed above.

[0170] SSP 170 transmits a request for a digital component to one or more DSPs 150 (412). As previously described, digital component provider 160 may use one or more DSPs 150 to automate the process of distributing digital components for display with an application. Upon receiving a request, SSP 170 may interact with one or more DSPs and transmit a corresponding request for a digital component, including a user group identifier and optionally context data. DSP 150 selects one or more digital components from a set of digital components by filtering out digital components that do not have a corresponding user group identifier that matches one of the user group identifiers in the request for the digital component. For example, at least a portion of the digital components distributed by DSP 150 may have one or more user group identifiers associated with a user group of the digital component. In a particular example, a digital component containing content about a particular pair of shoes may have identifiers for the “Shoes” group, the “Clothing” group, and the “Footwear” group as corresponding user group identifiers.

[0171] DSP 150 selects digital components (414). In some implementations, DSP 150 may further select digital components (e.g., the top N digital components) by analyzing and scoring each of one or more selected digital components. For example, the scoring may be based on contextual data, the expected performance of the digital components, and / or additional information.

[0172] DSP 150 transmits data of one or more selected digital components to SSP 170 (416). For example, DSP 150 may respond to a request for digital components from SSP 170 by transmitting one or more selected digital components or data identifying the digital components (e.g., creative elements including instructions for displaying the digital components). For each digital component, DSP 150 may also generate or select selection parameters for the digital component. DSP 150 may then transmit the selection parameters and data of the digital components to SSP 170. Each digital component (or its data) may include additional data, such as metadata indicating a user group identifier corresponding to the digital component.

[0173] In some implementations, the DSP 150 may also select one or more digital components based on contextual data independent of the user's group membership. These digital components may also be referred to as context digital components.

[0174] SSP 170 selects a set of digital components (418). For example, after receiving data for one or more selected digital components from DSP 150, SSP 170 may examine and select a set of digital components (e.g., the first K digital components). For example, SSP 170 may examine the content and format of the digital components to ensure that they meet various criteria, such as excluding specific types of content, meeting data and / or display size requirements, etc. In some implementations, SSP 170 selects digital components at least in part based on selection parameters received from DSP 150. In such implementations, SSP 170 may select the digital component with the highest selection parameter among the selection parameters received from DSP 150.

[0175] SSP 170 transmits a set of digital components to client device 110 (420). For example, after selecting the set of digital components (e.g., the first K digital components), SSP 170 transmits the set of digital components (or the data of the digital components) via network 105 to application 112 executing on client device 110. In some implementations, SSP 170 may transmit a set of selection parameters along with the set of digital components.

[0176] In some implementations, the list of digital components transmitted by SSP 170 can be sorted based on selection parameters. This allows application 112 to select digital components without knowing the actual selection parameters. For each digital component, the list of digital components may also include data indicating the user group identifier corresponding to the digital component. This allows application 112 to filter out digital components for user groups whose members are not members.

[0177] In some implementations, client device 110 sends multiple requests for digital components for each digital component slot. For example, client device 110 may send a context request to SSP 170 using steps 310-320. In this example, the request will not include a user group identifier. Instead, client device 110 may send one or more user group-based requests to SSP 170, MPC cluster 130, or another server, each request including one or more user group identifiers. For example, using MPC cluster 130 or another server separate from SSP 170 and / or DSP 150 to manage the selection of digital components based on user group membership can better protect user privacy. In this example, client device 110 may receive a first group of one or more digital components selected based on the user's user group membership (and optionally, context data) and a second group of one or more digital components selected based on context data without using user group membership.

[0178] Application 112 running on client device 110 sends an inference request (422). After receiving the group (or groups of groups) of digital components, application 112, executing on the client device, may select a subgroup of digital components based at least in part on a predictive performance metric obtained by inferring a corresponding predictive performance metric for each digital component (or at least one or more of the digital components) using a trained interactive machine learning model generated by MPC cluster 130. For example, application 112 transmits an inference request for digital components to MPC1. In other examples, application 112 may transmit an inference request to MPC2. Application 112 may submit an inference request in response to receiving the group (or groups of digital components). This request may be referred to as an inference request for inferring the corresponding predictive performance metric of the digital component. In some implementations, application 112 generates and transmits an inference request for each digital component selected based on user group membership, for example, without generating and transmitting an inference request for each digital component selected in response to a context request. In some implementations, application 112 generates and transmits an inference request for all digital components included in the received group (or groups of digital components).

[0179] In some implementations, an inference request for a digital component may include one or more characteristics of the digital component. The inference request may also include context signals and the current user profile of the user of client device 110, inference parameters k (the number of nearest neighbors to obtain if the machine learning model is a k-NN model), and a model identifier of the machine learning model to be used for inference. The inference request may also optionally include context signals and characteristics of the content page (e.g., website 142) currently being viewed by the user of client device 110. Similar to... Figure 2 In steps 202 and 230, application 112 can decompose one or more features and context signals of the digital component. For example, application 112 can generate a corresponding share of the context signal ([contextual_signals)). i,1 ] and [contextual_signals i,2 ]), and corresponding sharing of one or more characteristics of digital components ([digital_comp_chari,1] and [digital_comp_chari,2]).

[0180] Application 112 generates a composite message C1_infer, which includes a first share [digital_comp_char] of one or more characteristics of a digital component. i,1 The first sharing of contextual signals for each digital component in the group. i,1 Current user profile P i First sharing [P]i,1 [and model identifier]. Application 112 encrypts the composite message using the encryption key of computing system MPC1. Similarly, application 112 generates a second share [digital_comp_char] of one or more properties of the digital component. i,2 The second sharing of contextual signals for each digital component in this group. i,2 Current user profile P i Second sharing [P] i,2 The composite message C2_infer contains the model identifier and the model identifier. Application 112 encrypts the composite message using the encryption key of the computing system MPC2.

[0181] Application 112 can then, for example, randomly or pseudo-randomly select one of two computing systems, MPC1 or MPC2, for querying and transmitting the inference request. If application 112 selects computing system MPC1, application 112 can send a single request to MPC1 with an encrypted version of a compound message C1 and a second compound message C2, for example, PubKeyEncrypt(C2,MPC2).

[0182] MPC cluster 130 generates inference results (424). The computing systems MPC1 and MPC2 of MPC cluster 130 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine a predictive performance metric for each of one or more digital components based on an interaction machine learning model (e.g., a k-NN model). Depending on the machine learning model used, the performance metric may be a predicted interaction rate or a predicted conversion rate.

[0183] Similar to step 232 of process 200, computing systems MPC1 and MPC2 reconstruct the bit vector. After reconstruction, computing system MPC1 has a first half of the full bit vector of the given user profile, while computing system MPC2 has a second half of the full bit vector of the given user profile.

[0184] Each computing system, MPC1 and MPC2, uses half of the bit vector of a given user profile, one or more characteristics and context signals of the digital component, and its k-NN model to identify k' nearest neighbors, where k' = α × k, and α is determined based on actual production data and statistical analysis experience. For example, α = 3 or other suitable numbers. Computing system MPC1 can calculate the Hamming distance between the first half of the full bit vector and the bit vector of the k-NN model. Then, computing system MPC1 identifies k' nearest neighbors based on the calculated Hamming distance, for example, the k' nearest neighbors with the lowest Hamming distance. In other words, computing system MPC1 identifies a set of nearest neighbor user profiles, one or more characteristics and context signals of the digital component, and the k-NN model.

[0185] The predicted performance metric can be based on the k nearest neighbor profiles and their associated labels. This determination is also based on the aggregation function used and any aggregation parameters of that function. The aggregation function can be chosen based on the nature of the machine learning problem, such as binary classification, regression (e.g., using the arithmetic mean or root mean square), multi-class classification, and weighted k-NN. Each method of determining the predicted performance metric can include different interactions between the MPC cluster 130 and the application 112 running on the client 110, which are described in more detail below.

[0186] For example, if the k-NN model is an interactive machine learning model and the aggregation function counts the number of neighbors that interact with the digital component, the predicted performance could be X / k, where X is the number of neighbors out of k that interact with the digital component. Similarly, if the k-NN model is a conversion machine learning model and the aggregation function counts the number of neighbors that are converted by performing the target action on the second content page, the predicted performance could be X / k, where X is the number of neighbors that are converted out of k. Continuing with this current example, the aggregation function can also find the average of the conversion parameters (e.g., the amount paid by the user when performing the target action) of the k neighbors, thus determining the average of the conversion parameters.

[0187] If the k-NN model is a regression model, the label associated with each user profile P will be numerical. For example, the label could be 0 or 1, representing an interactive or non-interactive event. Within the k nearest neighbors found, the MPC cluster 130 calculates the average of the label values ​​(the result). In some implementations, the result can be used as a performance metric or can be used to calculate a performance metric. For example, the result can be used as input parameters to a function that can generate a performance metric based on the result.

[0188] If the machine learning model is a transformational model, the steps of the inference process remain unchanged. Similar to the interaction model, the computing systems MPC1 and MPC2 of the MPC cluster 130 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine a predictive performance metric indicating the likelihood of a user conversion after the digital component is displayed to the user, based on the transformational machine learning model (e.g., a k-NN model).

[0189] MPC cluster 130 transmits the inference results to application 112 (426). In this example, the computing system MPC1 receiving the query sends the inference results to application 112. The inference results may indicate a predictive performance metric or classification label for each of one or more digital components. To prevent any MPC system from having full access to the inference results, computing system MPC1 may compute a share of the inference results based on a k-NN model generated using its bit vector sharing, and computing system MPC2 may compute another share of the inference results based on a k-NN model generated using another bit vector sharing. Computing system MPC2 may provide computing system MPC1 with an encrypted version of its share, wherein the share is encrypted using the public key of application 112. Computing system MPC1 may provide application 112 with an encrypted version of its share of inference results and a share of the user group results of computing system MPC2. Application 112 may decrypt the share of computing system MPC2 and compute the inference results based on both shares. For example, application 112 may compute the inference results by adding or averaging the results from MPC1 and MPC2, depending on the secret sharing algorithm used. In some implementations, to prevent computing system MPC1 from forging the results of computing system MPC2, computing system MPC2 digitally signs its results before or after encrypting them using the public key of application 112. Application 112 verifies the digital signature of computing system MPC2 using the public key of MPC2.

[0190] Client device 110 selects a given digital component (428) from a filtered subgroup of digital components. In some implementations, application 112 may select one or more digital components to be displayed in a slot for digital components from that group based on inferences (e.g., predicted performance of interactions with the digital component and predicted performance of conversions of the digital component). For example, suppose website 142 has a slot for digital components. The selection process may include selecting the digital component with the highest predicted performance metric, which indicates the highest probability of being interacted with when displayed to a user.

[0191] In another example, application 112 can use a predicted performance metric of the digital component to determine or adjust the selection value of the digital component. Application 112 can then select the digital component with the highest selection value as a given digital component. For example, application 112 or DSP 150, responsible for selecting the digital component, can select a monotonic function F parameterized by a predicted performance metric of an interactive machine learning model and / or a transformational machine learning model to compute the selection value. In some implementations, the monotonic function F can take the form: F(predicted_performance_measure) = X + R * predicted_performance_measure. In this relationship, parameter X is the lower bound of the selection value, and parameter R is a value between 0 and 1, indicating the rate of increase of the selection value based on the predicted performance metric.

[0192] In some implementations, the selection of digital components is not solely based on their predictive performance metrics. For example, application 112 may consider the predictive performance metrics of the digital components as well as the contextual attributes of the digital components, protocols or conditions associated with the digital components set by the component provider (e.g., values ​​instructing the SSP to receive and display the monetary value of the digital components), or user-defined rules for including or excluding digital components.

[0193] Application 112 displays a given digital component (430). For example, application 112 can display the selected digital component together with the electronic resources of publisher 140.

[0194] Figure 5 This is a flowchart of an example process 500 for uploading user profiles, one or more characteristics of digital components, context signals, model identifiers, and data indicating whether an event is interactive or non-interactive. The operation of process 500 can be implemented, for example, by client device 110, SSP 170, one or more DSPs 150, and publisher 140. The operation of process 500 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and the execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 500.

[0195] Application 112 receives a first content page (510) including digital components and scripts. For example, a user of client device 110 can access website 142 using a browser by specifying a reference (e.g., a URL). In another example, a user of client device 110 can submit a search query to a search system using a web browser, which identifies the website by crawling and indexing it (e.g., indexing based on the crawled content). In response, the search system identifies the website in the form of search results and returns the search results to client device 110 in a search results page. After viewing the search results, the user of client device 110 can select and / or click on the search results corresponding to website 142. In yet another example, a user can launch a native application that requests content from the application's publisher 140.

[0196] The occurrence of an event is detected by a script (520). For example, application 112 may execute a script to monitor user interactions with digital components. Examples of such interaction signals detected by a script may include the coordinates of the location where the interaction was detected (e.g., a touch point on a touch-sensitive screen) and the duration of the contact.

[0197] The application receives a request to upload a user profile from the script (530). For example, in response to detecting user interaction with a digital component, the digital component's script generates a request to upload a user profile by passing a user profile request data element to the application 112. The request to upload a user profile can be in the form UploadUserProfile(Model Identifier, Creative Level Signals, Clicked, Content Platform Domain, Digital Signature).

[0198] Application 112 obtains the user profile request data element (540). For example, in response to a request to upload a user's profile, application 112 obtains the user request profile data element M. upload This includes model identifiers for machine learning models and one or more characteristics of digital components, such as creative-grade signals used by SSPs and / or DSPs to select digital components for application 112, one or more characteristics of the first content page, the domain of the content platform, and digital signatures of token content.

[0199] Application 112 obtains the user profile (550) of the user on the client device. For example, application 112 selects the user profile for a machine learning model implemented by MPC cluster 130 for scoring digital components. Depending on the specific implementation, application 112 may have already used the pseudo-random function PRF(P) before receiving the user profile request data element. iTwo shared resources, {[P], are used to generate user profiles. i ,1],[P i,2 However, if a user profile has not been previously shared, application 112 can generate a user profile for sharing.

[0200] Application 112 obtains context signals (560) provided to the content platform. For example, application 112 obtains context data (also referred to as context signals) previously included in the request for the digital component. Context data may include, for example, resource locators of resources, such as a global resource locator (URL) of a webpage or a global resource identifier (URI) of application content, language (e.g., the language in which the application displaying the content) and / or coarse geolocation information indicating the coarse location of client device 110. Other context data may also be used.

[0201] The application transmits data to the machine learning platform (570). For example, application 112 generates a user profile P. i First sharing [P] i,1 The first share of one or more characteristics of a digital component [digital_comp_char] i,1 ], contextual signals i,1 The first shared data, indicating whether the event is interactive or non-interactive, and the model identifier are combined in a composite message C1. Application 112 encrypts the composite message using the encryption key of the computing system MPC1. Similarly, application 112 generates a user profile P. i Second sharing [P] i,2 The second sharing of one or more characteristics of a digital component [digital_comp_char] i,2 ], Second sharing of contextual signals [contextual_signals] i,2 A composite message C2 containing data indicating whether the event is interactive or non-interactive, and a model identifier. Application 112 encrypts the composite message using the encryption key of computing system MPC2. These functions can be represented as PubKeyEncrypt(C1, MPC1) and PubKeyEncrypt(C2, MPC2), where PubKeyEncrypt represents the public-key encryption algorithm using the corresponding public key of MPC1 or MPC2.

[0202] Figure 6This is a block diagram of an example computer system 600 that can be used to perform the operations described above. System 600 includes a processor 610, memory 620, storage device 630, and input / output device 640. Each of components 610, 620, 630, and 640 may be interconnected, for example, using a system bus 650. Processor 610 is capable of processing instructions for execution within system 600. In some embodiments, processor 610 is a single-threaded processor. In another embodiment, processor 610 is a multi-threaded processor. Processor 610 is capable of processing instructions stored in memory 620 or on storage device 630.

[0203] Memory 620 stores information within system 600. In one implementation, memory 620 is a computer-readable medium. In some embodiments, memory 620 is a volatile memory cell. In another embodiment, memory 620 is a non-volatile memory cell.

[0204] Storage device 630 provides high-capacity storage for system 600. In some embodiments, storage device 630 is a computer-readable medium. In various embodiments, storage device 630 may include, for example, a hard disk drive, an optical disk drive, a storage device shared over a network by multiple computing devices (e.g., a cloud storage device), or some other high-capacity storage device.

[0205] Input / output device 640 provides input / output operations for system 600. In some embodiments, input / output device 640 may include network interface devices, such as Ethernet cards, serial communication devices, such as RS-232 ports, and / or wireless interface devices, such as one or more 802.11 cards. In another embodiment, input / output device may include a driver device configured to receive input data and send output data to external device 600 (e.g., keyboard, printer, and display device). However, other embodiments may also be used, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc.

[0206] Despite Figure 5 An example processing system is described herein, but implementations of the subjects and functional operations described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware, including the structures disclosed herein and their structural equivalents, or in combinations thereof.

[0207] Embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., modules of one or more computer program instructions encoded on a computer storage medium (or multiple media) for execution by or control of the operation of a data processing apparatus. Alternatively or additionally, the program instructions can be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for operation by the data processing apparatus. The computer storage medium can be or is included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination thereof. Furthermore, while the computer storage medium is not a propagated signal, it can be a source or destination of computer program instructions encoded in artificially generated propagated signals. The computer storage medium can also be or be included in one or more separate physical components or media (e.g., multiple CDs, discs, or other storage devices).

[0208] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0209] The term "data processing apparatus" includes all kinds of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus may also include code that creates the runtime environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and runtime environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0210] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, objects, or other units suitable for use in a computing environment. Computer programs can, but are not required to, correspond to files in a file system. A program can be stored as a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), as a single file dedicated to the program in question, or as a collection of coordinating files (e.g., a file storing portions of one or more modules, subroutines, or code). Computer programs can be deployed to run on a single computer or on multiple computers located at a site or distributed across multiple sites and interconnected via a communication network.

[0211] The processes and logic flows described in this specification can be executed by one or more programmable processors running one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by special-purpose logic circuitry (e.g., FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit)), and the apparatus can also be implemented as such special-purpose logic circuitry.

[0212] For example, processors suitable for running computer programs include both general-purpose and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or be operatively coupled to such mass storage devices to receive data from or transfer data to or from such mass storage devices, or both. However, a computer does not require such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (such as a universal serial bus (USB) flash drive), to name just a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices, like EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM discs. Processors and memory may be supplemented or incorporated into them by dedicated logic circuitry.

[0213] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0214] Embodiments of the subject matter described in this specification can be implemented in a computing system that includes backend components, such as a data server, or middleware components, such as an application server, or frontend components, such as a client computer with a graphical user interface or a web browser through which a user can interact with embodiments of the subject matter described in this specification, or any combination of one or more such backend components, middleware components, or frontend components. The components of the system can be interconnected via any form or medium of digital data communication, such as a communication network. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), interconnected networks (such as the Internet) and peer-to-peer networks (such as self-organizing peer-to-peer networks).

[0215] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship is generated by computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., HTML pages) to the client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user). Data generated at the client device (e.g., the result of user interaction) may be received at the server from the client device.

[0216] Although this specification contains numerous specific details of implementation, these should not be construed as limiting any invention or potentially claimed scope, but rather as descriptions of features specific to particular embodiments of a particular invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, or even initially claimed in this way, in some cases one or more features from a claimed combination may be removed from that combination, and the claimed combination may be for sub-combinations or variations thereof.

[0217] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific or sequential order shown, or to perform all the operations shown, in order to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0218] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A computer-implemented method comprising: receiving, by a client device, a first content page comprising a digital component, the digital component comprising computer-readable instructions; rendering, by the client device, the digital component with the first content page; receiving, by an application running on the client device, a request to upload a user profile of a user of the client device to a machine learning platform generated based on the computer-readable instructions, wherein the computer-readable instructions initiate the request in response to detecting an occurrence of an event related to an interaction or a non-interaction with rendering the digital component with the first content page within a specified time range; and in response to receiving the request: obtaining, by the application, a user profile request data element comprising a model identifier of a machine learning model and one or more properties of at least one of the digital component or the first content page; obtaining, by the application, a user profile of a user of the client device; obtaining, by the application, a contextual signal provided to one or more content platforms for training the machine learning model; and transmitting, by the application and to the machine learning platform, a set of data comprising the user profile, the one or more properties, the contextual signal, the model identifier, and data indicating whether the event is an interaction event or a non-interaction event.

2. The computer-implemented method of claim 1, wherein, the user profile request data element comprises a token received from a content platform providing the digital component, the token comprising (i) a set of content comprising the model identifier, the data indicating the one or more properties, a domain of the content platform, and (ii) a digital signature of the set of content generated using an encryption key of the content platform.

3. The computer-implemented method of claim 2, further comprising verifying, by the application, the digital signature prior to transmitting the set of data to the machine learning platform.

4. The computer-implemented method of any one of claims 1-3, wherein, the event comprises an interaction event, the method further comprising, in response to detecting the occurrence of the interaction event, storing, at the client device, the contextual signal, the one or more properties of the digital component, and the user profile.

5. The computer-implemented method of claim 4, further comprising: in response to detecting the occurrence of the interaction event, accessing, by the client device, a second content page provided by a second content provider different from a first content provider providing the first content page, wherein the second content page comprises a tag comprising computer-readable code; receiving, from the tag, a request for the contextual signal, the one or more properties of the digital component, and the user profile; encrypting, by the application, the contextual signal, the one or more properties of the digital component, and the user profile; and transmitting, to a content platform providing the digital component, the encrypted contextual signal, the encrypted one or more properties of the digital component, and the encrypted user profile.

6. The computer-implemented method of claim 5, further comprising: detecting, by the computer-readable code of the tag, a conversion event; and ​ transmitting, by a computer-readable code of the tag, a conversion notification of the conversion event to the content platform.

7. The computer-implemented method of any of claims 1-3 and 5-6, further comprising: for each of the one or more digital components: sending, by the application, an inference request for the digital component to the machine learning platform, wherein the inference request includes one or more of the user profile, the contextual signal, or characteristics of a current content page; receiving, from the machine learning platform, a predicted performance of the digital component, wherein a predicted performance metric is based on the user profile and one or more trained machine learning models trained by the machine learning platform; determining a selection value for the digital component based on the predicted performance; and selecting a given digital component to display at the client device based on at least the selection value for each of the one or more digital components.

8. The computer-implemented method of claim 7, wherein, the inference request for the digital component to the machine learning platform further includes the one or more characteristics of the digital component, characteristics of the current contextual page, and the contextual signal.

9. The computer-implemented method of claim 8, wherein, the predicted performance includes one of a predicted user interaction rate or a predicted conversion rate for the digital component, or a predicted conversion value for the digital component.

10. The computer-implemented method of claim 8, wherein, the predicted performance is based on a performance of the digital component for k nearest neighbor profiles determined to be most similar to the user profile of the user of the client device based on the one or more machine learning models.

11. The computer-implemented method of any of claims 1-3, 5-6, and 8-10, further comprising: receiving, from a first multi-party computation (MPC) computer of the machine learning platform, a first secret share of an inference result for a first digital component; receiving, from each of one or more second MPC computers of the machine learning platform, a second secret share of the inference result for the digital component; determining, based on the first secret share and each second secret share, a predicted performance metric for the digital component represented by the inference result; selecting the digital component to display at the client device based on the predicted performance metric; and displaying the digital component.

12. The computer-implemented method of claim 5 or 6, wherein, the machine learning platform includes two or more multi-party computation (MPC) computers that train a machine learning model to predict a performance metric for the digital component using the encrypted contextual signal, the encrypted one or more characteristics of the digital component, the encrypted user profile, and data received from client devices of one or more additional users using a secure MPC process.

13. The computer-implemented method of claim 12, wherein, the two or more MPC computers train the machine learning model without accessing the encrypted contextual signal, the encrypted one or more characteristics of the digital component, or the encrypted user profile in plaintext.

14. A computer-implemented system comprising: one or more processors; and one or more memories storing computer-readable instructions configured to cause the one or more processors to perform operations comprising: receiving, by a client device, a first content page including a digital component, the digital component including computer-readable instructions; rendering, by the client device, the digital component with the first content page; receiving, by an application running on the client device, a request to upload a user profile of a user of the client device to a machine learning platform generated based on the computer-readable instructions, wherein the computer-readable instructions initiate the request in response to detecting an occurrence of an event related to an interaction or a non-interaction with rendering the digital component with the first content page within a specified time range; and in response to receiving the request: obtaining, by the application, a user profile request data element including a model identifier of a machine learning model and one or more properties of at least one of the digital component or the first content page; obtaining, by the application, a user profile of a user of the client device; obtaining, by the application, a contextual signal provided to one or more content platforms for training the machine learning model; and transmitting, by the application and to the machine learning platform, a set of data including the user profile, the one or more properties, the contextual signal, the model identifier, and data indicating whether the event is an interaction event or a non-interaction event.

15. The system of claim 14, wherein, the user profile request data element includes a token received from a content platform providing the digital component, the token including (i) a set of content including the model identifier, the data indicating the one or more properties, a domain of the content platform, and (ii) a digital signature of the set of content generated using an encryption key of the content platform.

16. The system of claim 14 or 15, wherein, the event includes an interaction event, and wherein the operations include, in response to detecting the occurrence of the interaction event, storing, at the client device, the contextual signal, the one or more properties of the digital component, and the user profile.

17. The system of claim 16, wherein, the operations include: in response to detecting the occurrence of the interaction event, accessing, by the client device, a second content page provided by a second content provider different from a first content provider providing the first content page, wherein the second content page includes a tag including computer-readable code; receiving, from the tag, a request for the contextual signal, the one or more properties of the digital component, and the user profile; encrypting, by the application, the contextual signal, the one or more properties of the digital component, and the user profile; and transmitting, to a content platform providing the digital component, the encrypted contextual signal, the encrypted one or more properties of the digital component, and the encrypted user profile.

18. The system of any one of claims 14-15, 17, wherein, the operations include: for each of one or more digital components: sending, by the application, an inference request for the digital component to the machine learning platform, wherein the inference request includes one or more of the user profile, the contextual signals, or characteristics of a current content page; receiving, from the machine learning platform, a predicted performance of the digital component, wherein a predicted performance metric is based on the user profile and one or more trained machine learning models trained by the machine learning platform; and determining a selection value for the digital component based on the predicted performance; and selecting a given digital component for display at the client device based on at least the selection value for each of the one or more digital components.

19. The system of any one of claims 14-15, 17, wherein, The operations include: receiving, from a first multi-party computation (MPC) computer of the machine learning platform, a first secret share of an inference result for a first digital component; receiving, from each of one or more second MPC computers of the machine learning platform, a second secret share of the inference result for the digital component; determining, based on the first secret share and each second secret share, a predicted performance metric for the digital component represented by the inference result; selecting the digital component for display at the client device based on the predicted performance metric; and displaying the digital component.

20. A non-transitory computer-readable medium storing instructions that, when executed by one or more data processing apparatuses, cause the one or more data processing apparatuses to perform operations comprising: receiving, by a client device, a first content page including a digital component, the digital component including computer-readable instructions; presenting, by the client device, the digital component with the first content page; receiving, by an application running on the client device, a request to upload a user profile of a user of the client device to a machine learning platform generated based on the computer-readable instructions, wherein the computer-readable instructions initiate the request in response to detecting an occurrence of an event related to an interaction or a non-interaction with presenting the digital component with the first content page within a specified time range; and in response to receiving the request: obtaining, by the application, user profile request data elements including a model identifier of a machine learning model and one or more characteristics of at least one of the digital component or the first content page; obtaining, by the application, a user profile of a user of the client device; obtaining, by the application, contextual signals provided to one or more content platforms for training the machine learning model; and transmitting, by the application and to the machine learning platform, a set of data including the user profile, the one or more characteristics, the contextual signals, the model identifier, and data indicating whether the event is an interaction event or a non-interaction event.

Images