Processing machine learning modeling data to improve classification accuracy

Abstract

The first MPC system in the Multi-Party Computation (MPC) cluster is able to receive an inference request from an application on a client device. This request includes a first share of a given user profile and a performance threshold for the application's users. It can identify a set of nearest neighbors for the user profile by performing a secure MPC process using a trained machine learning model in collaboration with one or more second MPC systems. It can then select one or more nearest neighbors from this set that have a performance metric that meets the performance threshold. The first MPC system can then deliver data derived from the one or more nearest neighbors to the application.

Description

Technical Field

[0001] This article describes topics related to training and using machine learning models in ways that protect user privacy, ensure data security, and improve classification accuracy. Background Technology

[0002] Some machine learning models are trained on data collected from multiple sources (e.g., across multiple websites and / or native applications). However, this data may include private or sensitive data that should not be shared or disclosed to other parties. Summary of the Invention

[0003] This disclosure relates to training and using machine learning models in a manner that protects user privacy and ensures data security. For example, aspects of this disclosure relate to machine learning models, data input to such models, and data output from such models to accurately classify users into user groups while protecting user privacy and ensuring data security even if third-party cookies are blocked (e.g., blocked by browsers) or otherwise not used. Modifications to the data input to the model can be referred to as preprocessing, and modifications to the data output from the model can be referred to as postprocessing. As described herein, preprocessing of the data input to the machine learning model and / or postprocessing of the data output from the machine learning model allows for more accurate expansion of user groups in order to more accurately classify users into one or more corresponding user groups.

[0004] In one aspect, a first MPC system in a multi-party computation (MPC) cluster is capable of receiving an inference request from an application on a client device. This inference request includes a first share of a given user profile and a performance threshold for the application's users. It is capable of identifying a set of nearest neighbors for the user profile by performing a secure MPC process using a trained machine learning model in collaboration with one or more second MPC systems. It is capable of selecting one or more nearest neighbors from the nearest neighbor set that have a performance metric that meets the performance threshold. The first MPC system is capable of transmitting data derived from the one or more nearest neighbors to the application.

[0005] In some implementations, one or more of the following can be implemented separately or in any feasible combination. User profiles can be generated by the application. User profiles can include data indicating interactions between users of the application and digital content presented on the application. Interactions can include conversions and the absence of conversions. The machine learning model can be a nearest neighbor model. The nearest neighbors of the nearest neighbor model can be represented by corresponding centroids associated with the corresponding user group. The first MPC system can assign weights to each user in the corresponding user group to calculate the corresponding centroid. Weights can be at least one of user interactions or user information related to performance metrics. The centroid of each user group can be the center represented by the average of the user profiles of users who are members of the user group. The machine learning model can be one or more of a centroid model or a nearest neighbor model. The performance metric for each nearest neighbor can include at least one of user interaction rate with one or more digital components corresponding to the nearest neighbor or conversion rate with one or more digital components corresponding to the nearest neighbor. The machine learning model can include a k-nearest neighbor model, and each neighbor in the k-nearest neighbor model represents a user profile. The machine learning model can include a k-nearest neighbor model, and each neighbor in the k-nearest neighbor model represents a user group of multiple users. The performance threshold is a threshold. The conversion rate of one or more digital components can be the number of conversions divided by the number of times the one or more digital components were displayed to users in a user group. An inference request can be a request to infer whether a user should be added to a user group.

[0006] Related methods, techniques, systems, and computer program products are also described. For example, in one aspect, a system is described that includes at least one programmable processor and a machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform the operations described herein. In another aspect, one or more computer program products (in some embodiments, which may be non-transitory computer program products) are described that are capable of storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform the operations described herein.

[0007] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. Encryption techniques such as secure multi-party computation (MPC) can be used to address problems that arise when third-party cookies cannot be used to collect data. For example, encryption techniques enable the expansion of user groups based on similarity in user profiles without using third-party cookies. This protects user privacy without negatively impacting the ability to expand user groups and, in some cases, provides better user group expansion based on more complete profiles than is possible using third-party cookies. MPC techniques ensure that as long as one of the computing systems in the MPC cluster is honest (e.g., does not disclose portions of its underlying data in plaintext), no computing system or the other party can obtain user data in plaintext. Therefore, the claimed method allows for the secure identification, grouping, and transmission of user data, including cross-domain user data, without the need to use third-party cookies to determine any relationships between user data. This is a privacy-preserving method different from using plaintext user profiles typically collected by third-party cookies to determine relationships between data (which exposes user data to the entity receiving the third-party cookie). Grouping user data in this way improves the efficiency of delivering data content to user devices because it eliminates the need to transmit data irrelevant to a specific user. In particular, it eliminates the need for third-party cookies, thus avoiding their storage and improving memory usage. The exponential decay technique can be used to build user profiles on the client device, reducing the size of the original data required to build the profile and consequently reducing data storage requirements.

[0008] Furthermore, the preprocessing and postprocessing of the modeling data ensures that users are more accurately classified into one or more corresponding user groups. In some implementations, the k-NN model can be based on such user groups; such modeling can advantageously be less complex than k-NN models where users form distinct points in a high-dimensional space, because there are often significantly fewer user groups than users. For example, a content platform may have billions of users but millions of user groups. In this case, training a k-NN model where each neighbor is defined as a user group rather than a user can scale down the model by a factor of 1000. This scaling down of the model can advantageously require lower data storage needs to store the data (here, user groups and associated data, such as mappings between different elements) and faster processing to determine whether to add a user to a user group.

[0009] Details of one or more variations of the subject matter described herein are set forth in the accompanying drawings and the following description. Further features and advantages of the subject matter described herein will be apparent from the specification, drawings, and claims. Attached Figure Description

[0010] Figure 1 This is a diagram of an environment where a secure MPC cluster generates machine learning models, and these models are used to expand user groups.

[0011] Figure 2 This is a swimlane diagram of an exemplary process for generating a centroid model and using the centroid model to add users to a user group.

[0012] Figure 3 This is a flowchart illustrating an exemplary process for generating user profiles and sending them to an MPC cluster.

[0013] Figure 4 This is a flowchart illustrating an exemplary process for generating a centroid model.

[0014] Figure 5 This is a swimlane diagram illustrating an exemplary process for adding a user to a user group using a centroid model.

[0015] Figure 6 This is a swimlane diagram illustrating an exemplary process for generating a centroid model and using the centroid model to add users to user groups corresponding to the centroid model.

[0016] Figure 7 This is a flowchart illustrating an exemplary process for determining user group outcomes based on user profile data and centroid models.

[0017] Figure 8 This is a swimlane diagram of an exemplary process for training a k-NN model and using the k-NN model to add users to user groups.

[0018] Figure 9 This is a flowchart illustrating an exemplary process for generating user profiles and sending portions of the user profiles to the MPC cluster.

[0019] Figure 10 This is a flowchart illustrating an exemplary process for generating a k-NN model.

[0020] Figure 11 This is a flowchart illustrating an exemplary process for adding a user to a user group using a k-NN model.

[0021] Figure 12 This is a flowchart illustrating an exemplary process for training and deploying a k-NN model to efficiently classify users into one or more corresponding user groups.

[0022] Figure 13 This is a block diagram of an exemplary computer system.

[0023] In the various figures, the same reference numerals indicate the same elements. Detailed Implementation

[0024] This document typically describes systems and techniques for training and using machine learning models to extend user group memberships while protecting user privacy and ensuring data security, even when third-party cookies are blocked (e.g., blocked by browsers) and / or user profile collection is otherwise impractical. User profiles are typically maintained on the user's client device, rather than on the computing systems of other entities such as content platforms. To train machine learning models, a user's client device can optionally send its encrypted user profile (e.g., as a secret share of the user profile) along with other data to multiple computing systems in a secure multi-party computation (MPC) cluster via the content platform. For example, each client device can generate two or more shares of the user profile, such as secret shares, and send the corresponding secret shares to each computing system. In some implementations, a different subset of information from each user profile is provided to each computing system such that there is no overlap in the user profile data sent to each computing system.

[0025] The computing system of an MPC cluster can use MPC technology to train machine learning models to protect user privacy by preventing any computing system in the MPC cluster (or any other party other than the user) from obtaining any user's profile in plaintext and suggesting user groups based on the user's profile. Plaintext (also known as plain text) is text that is not computationally marked, specially formatted, or written in code or data (including binary files) in a form that can be viewed or used without the need for keys or other decryption devices or processes. The machine learning model can be a centroid model and / or a k-nearest neighbor (k-NN) model. In a centroid model, the centroid of a user group can represent the center of the user profile, such as the center (e.g., the average) of the user profile of a user who is a member of the user group. In a k-NN model, the model assumes that similar users exist in close proximity, such that similar users can be classified into the same or similar user groups.

[0026] After a machine learning model is trained, it can be used to suggest one or more user groups for each user based on their profile. For example, a user's client device can query the MPC cluster for suggested user groups for that user, or determine whether the user should be added to a specific user group. In an implementation using a centroid model, the MPC cluster can use the user's profile to identify user groups with centroids within a threshold distance of the user's profile. In an implementation using a k-NN model, various inference techniques, such as binary classification, regression (e.g., using arithmetic mean or root mean square), and / or multi-class classification, can be used to identify user groups. A user's user group membership can be used in a privacy-preserving and secure manner to deliver content (e.g., digital content) to the user.

[0027] An MPC cluster can select user groups for a user based on performance metrics. For example, an MPC cluster can select user groups with user interaction rates (e.g., click-through rate (CTR)) or conversion rates that meet (e.g., meet or exceed) performance thresholds. The performance metrics for user groups can reflect the performance of one or more digital components corresponding to the user group, such as the performance of digital components distributed to users based on whether a user is a member of the user group.

[0028] Exemplary system for generating and using machine learning models

[0029] Figure 1 This is a block diagram of an environment 100 in which a secure MPC cluster 130 trains a machine learning model, and the machine learning model is used to expand a user group. The exemplary environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. Network 105 connects client devices 110, the secure MPC cluster 130, publishers 140, websites 142, and content platforms 150. The exemplary environment 100 may include many different client devices 110, secure MPC clusters 130, publishers 140, websites 142, and content platforms 150.

[0030] Client device 110 is an electronic device capable of communicating via network 105. Exemplary client device 110 includes a personal computer, a mobile communication device (e.g., a smartphone), and other devices capable of sending and receiving data via network 105. The client device may also include a digital assistant device that accepts audio input via a microphone and outputs audio via a speaker. When the digital assistant detects a “hot word” or “hot phrase” that activates the microphone to accept audio input, it can be put into listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or display to capture images and visually present information. The digital assistant can be implemented in various forms of hardware devices, including wearable devices (e.g., watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. The client device may also include digital media devices, such as streaming devices that plug into a television or other display to stream video to the television, game consoles, or virtual reality systems.

[0031] Client device 110 typically includes applications 112, such as web browsers and / or native applications, to facilitate sending and receiving data over network 105. Native applications are applications developed for a specific platform or device (e.g., a mobile device with a specific operating system). Publisher 140 is able to develop native applications and provide them to client device 110, for example, making them available for download. A web browser can request resource 145 from a web server hosting website 142 of publisher 140, for example, in response to a user of client device 110 entering the resource address of resource 145 in the web browser's address bar or selecting a link referencing the resource address. Similarly, native applications can request application content from a publisher's remote server.

[0032] Some resources, application pages, or other application content may include digital component slots for presenting digital components of resource 145 or application pages. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, audio clip, multimedia clip, image, text, or another unit of content). Digital components may be stored electronically as a single file or as a collection of files on a physical storage device, and digital components may take the form of video files, audio files, multimedia files, image files, or text files, and may include advertising information, making advertising a type of digital component. For example, a digital component may be content designed to complement the content of a webpage or other resource presented by application 112. More specifically, a digital component may include digital content related to the resource content (e.g., a digital component may relate to the same topic as the webpage content, or to a related topic). Thus, the provision of digital components can complement and generally enhance webpage or application content.

[0033] When application 112 loads resources (or application content) that include one or more digital component slots, application 112 can request digital components for each slot. In some implementations, the digital component slots can include code (e.g., scripts) that causes application 112 to request digital components from a digital component distribution system that selects and provides digital components to application 112 for presentation to a user of client device 110.

[0034] Content platform 150 can include a supplier-side platform (SSP) and a demand-side platform (DSP). Typically, content platform 150 manages the selection and distribution of digital components on behalf of publisher 140 and digital component provider 160.

[0035] Some publishers 140 use an SSP to manage the process of obtaining digital components for their resources and / or applications. An SSP is a technology platform implemented in hardware and / or software that automates the process of obtaining digital components for resources and / or applications. Each publisher 140 can have one or more SSPs. Some publishers 140 may use the same SSP.

[0036] Digital component provider 160 is capable of creating (or otherwise publishing) digital components that are rendered in digital component slots within a publisher's resources and applications. Digital component provider 160 can use a DSP to manage the supply of its digital components for rendering in digital component slots. A DSP is a technology platform implemented in hardware and / or software that automates the process of distributing digital components for rendering with resources and / or applications. The DSP can interact on behalf of digital component provider 160 with multiple provider platforms (SSPs) to provide digital components for rendering with resources and / or applications from multiple different publishers 140. Typically, the DSP can (e.g., from an SSP) receive requests for digital components, generate (or select) selection parameters for one or more digital components created by one or more digital component providers based on those requests, and provide data related to the digital components (e.g., the digital components themselves) and the selection parameters to the SSP. The SSP can then select the digital components for rendering at client device 110 and provide client device 110 with data that causes client device 110 to render the digital components.

[0037] In some cases, receiving digital components related to web pages, application pages, or other electronic resources that a user has previously visited and / or interacted with is beneficial to the user. To distribute such digital components to users, when a user visits a particular resource or performs a specific action at that resource—for example, interacting with a specific item presented on a web page, such as (a) clicking a link to the specific item, (b) completing a conversion of the specific item by, for example, adding the item to a virtual cart or purchasing the item, and / or (c) viewing the specific item for more than a preset amount of time—it is possible to assign the user to user groups, such as user interest groups, groups of similar users, or other group types involving similar user data. While the model is described as generating or identifying user groups in response to interactions, in other implementations, the model is capable of generating or identifying user groups in response to and based on users performing some interactions but lacking subsequent interactions—for example, viewing a digital component but not clicking it; clicking a component but not converting it, etc. To perform such distribution, the model is first trained on such data (i.e., signals) that indicate the specific type of interaction by the user. Training a model based on signals that indicate a user performs a specific interaction but lacks subsequent interactions (e.g., a user is shown a digital component but does not click it, or a user clicks a digital component but does not convert it) is more advantageous than a model that does not consider such signals, because it allows for more accurate training of the model and subsequent deployment of those trained models.

[0038] User groups can be generated by digital component providers 160, content platforms 150, or publishers 140. That is, when a user accesses an electronic resource provided by a digital component provider 160, each digital component provider 160 can assign the user to its user group. In another example, content platforms 150 can create user groups for digital component providers 160. In yet another example, publishers 140 can create user groups for users visiting their websites.

[0039] To protect user privacy, user group memberships can be maintained at the user's client device 110, for example, through one of applications 112 or the operating system of client device 110, rather than through a digital component provider, content platform, or other party. In a specific example, a trusted program (e.g., a web browser or operating system) can maintain a list of user group identifiers (“user group list”) for users using a web browser or another application. The user group list can include group identifiers for each user group to which the user has been added. The digital component provider 160 that creates the user group can assign a user group identifier to its user group. The user group identifier can describe the group (e.g., a gardening group) or represent the group using a code (e.g., a non-descriptive alphanumeric sequence). The user's user group list can be stored in a secure storage device at client device 110 and / or can be encrypted during storage to prevent access to the group by others.

[0040] When application 112 presents resources or application content related to web pages on digital component provider 160 or website 142, the resource may request application 112 to add one or more user group identifiers to the user group list. In response, application 112 may add one or more user group identifiers to the user group list and securely store the user group list.

[0041] Content platform 150 can use a user's user group membership to select digital components or other content that may be of interest to the user or may otherwise benefit the user / user device. For example, such digital components or other content may include data that improves user experience, enhances the operation of the user device, or otherwise benefits the user or user device. However, the user group identifier in the user's user group list prevents content platform 150 from providing the user group identifier in a way that associates it with a specific user, or otherwise accessing the plaintext user group identifier, thereby protecting user privacy when using user group membership data to select digital components.

[0042] Application 112 can provide user group identifiers from the user group list to a trusted computing system that interacts with content platform 150, thereby preventing content platform 150 or any other entity other than the user from knowing the user's full user group membership and selecting digital components to be presented at client device 110 based on user group membership.

[0043] In some cases, expanding user groups to include users with similar interests or other similar data to those already in the group is beneficial to both the user and the digital component provider. Effectively, this can be achieved without using third-party cookies. For example, a first user might be interested in skiing and could be a member of a user group for a specific ski resort. A second user might also be interested in skiing but be unaware of the resort and not a member. If these two users have similar interests or data, such as similar user profiles, the second user can be added to the ski resort's user group, allowing the second user to receive content related to that resort, such as digital components, which might be of interest to the second user or their device, or otherwise beneficial to them. In other words, user groups can be expanded to include other users with similar user data.

[0044] The secure MPC cluster 130 is capable of training a machine learning model that can suggest user groups to a user (or its application 112) based on a user's profile, or can be used to generate user group suggestions to a user (or its application 112) based on a user's profile. The secure MPC cluster 130 includes two computing systems, MPC1 and MPC2, that perform secure MPC techniques to train the machine learning model. Although the exemplary MPC cluster 130 includes two computing systems, more computing systems can be used to perform the MPC process, as long as the MPC cluster 130 includes more than one computing system. For example, the MPC cluster 130 can include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 can provide greater security and fault tolerance, but it can also increase the complexity of the MPC process.

[0045] Computing systems MPC1 and MPC2 within MPC cluster 130 can be operated by different entities. In this way, each entity may not have access to the complete user profile in plaintext. For example, one of the computing systems MPC1 or MPC2 can be operated by a trusted party different from the user, publisher 140, content platform 150, and digital component provider 160. For example, an industry group, government group, or browser developer may maintain and operate one of the computing systems MPC1 and MPC2. Another computing system may be operated by different groups within these groups, such that different trusted parties operate each computing system MPC1 and MPC2. Preferably, the different parties operating the different computing systems MPC1 and MPC2 have no incentive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separated and monitored to prevent them from communicating with each other outside of performing the secure MPC processes described in this document.

[0046] In some implementations, the MPC cluster 130 trains one or more machine learning models (e.g., centroid models and / or k-NN models) for each content platform 150 (e.g., each DSP and / or each SSP) and / or each digital component provider 160. For example, content platform 150 may enable the MPC cluster 130 to train machine learning models (e.g., centroid models or k-NN models) for any subset of one or more user groups managed by content platform 150 or to which the content platform has at least read access. For example, each content platform 150 may manage the distribution of digital components from one or more digital component providers 160. Content platform 150 may request the MPC cluster 130 to train machine learning models (e.g., centroid models or k-NN models) for one or more digital component providers 160 for which it manages the distribution of digital components. Typically, digital component provider 160 may enable the MPC cluster 130 to train centroid models and / or k-NN models for one or more user groups created and maintained by digital component provider 160. Each content platform may implement different machine learning models, which can be uniquely identified by a corresponding unique model identifier. The exemplary process for training the centroid model and the k-NN model is described in further detail below.

[0047] In implementing a centroid model, the centroid model embeds the user into an n-dimensional space. The user in the profile space is represented by an n-dimensional vector X = {x1, x2, ... x...}. n} represents the user group R with m users: {X1, X2, ... X...} m The centroid of user group R in the model can be... Given users X′={x1′,x2′,...x n Content platform 150 or digital component provider 160 might want to find all user groups R such that |X′-Centroid(model, R)|<d, where d is a parameter representing, for example, the threshold distance of the centroid model specified by content platform 150. For ease of subsequent description and for brevity, the remaining description related to the centroid model focuses primarily on training and deploying the centroid model for content platform 150 (e.g., DSP and SSP). However, systems and techniques for generating centroid models for digital component provider 160, publisher 140, or other entities, and for querying centroid models on behalf of digital component provider 160 or other entities, are also possible.

[0048] After training a machine learning model (e.g., centroid or k-NN model) for content platform 150, content platform 150 is able to query or enable application 112 of client device 110 to query the machine learning model to identify one or more user groups of users of client device 110.

[0049] More specifically, in implementations using the centroid model, content platform 150 can query or request application 112 to query the centroid model of content platform 150 to determine whether a user should be added to any user group of content platform 150. Typically, MPC cluster 130 can determine whether a user's profile is within a threshold distance of the centroid of a user group on content platform 150. If so, MPC cluster 130 can request application 112 to add the user whose profile is within the threshold distance of the centroid to the user group. In some implementations, the model can be queried based on performance metrics (e.g., interaction rate or conversion rate), and if the performance metric meets the corresponding threshold, the user can be added to a specific user group.

[0050] In some implementations using the k-NN model, content platform 150 can query or request application 112 to query the k-NN model to determine whether the threshold number "k" user profiles closest to the user are members of a specific user group. If so, content platform 150 can add the user to that user group. If a user group is identified for the user, content platform 150 or MPC cluster 130 can request application 112 to add the user to the user group.

[0051] In some implementations, the machine learning model can be queried additionally or alternatively based on a threshold performance metric. During a query, the MPC cluster 130 can identify k user profiles that are closest to the user's profile. For each user group that includes at least one of the k users as a member, the MPC cluster 130 can calculate a performance metric for the group based on the user's interactions or transformations with one or more digital components of the user group, and the absence of such interactions and transformations. The MPC cluster 130 can compare the calculated performance metric to a threshold. For any user group with a performance metric that meets the threshold, the MPC cluster 130 can request that the user be added to the user group. For user groups with a performance metric that does not meet the threshold, the MPC cluster 130 may not request that the user be added to the user group.

[0052] In some implementations, the MPC cluster 130 trains the machine learning model based on user groups rather than individual users. For example, a k-NN model can be trained based on user groups instead of individual users. In such an example, a performance metric can be computed for each user group in the k-NN model. The k-NN model can then be queried using a threshold performance metric. In this example, the MPC cluster 130 can identify k user groups with aggregated user profiles (e.g., based on the centroid of the group) that are closest to the user profile. For any user group with a performance metric that meets the threshold, the MPC cluster 130 can request that the user be added to that user group. For user groups with a performance metric that does not meet the threshold, the MPC cluster 130 may not request that the user be added to the user group.

[0053] If approved by the user and / or application 112, application 112 can add the user group identifier of the user group to the user group list stored at the client device 110.

[0054] In some implementations, application 112 may provide a user interface that enables users to manage the user groups to which they are assigned. For example, the user interface may allow users to remove user group identifiers to prevent all or specific resources 145, publishers 140, content platforms 150, digital component providers 160, and / or MPC clusters 130 from adding users to user groups (e.g., preventing entities from adding user group identifiers to a list of user group identifiers maintained by application 112). This provides users with greater transparency and control.

[0055] In addition to the descriptions throughout this document, users may be provided with controls (e.g., user interface elements that users can interact with by viewing, clicking, or converting) that allow them to choose whether and when the system, program, or feature described herein can enable the collection of user information (e.g., information about the user's social networks, social actions or activities, occupation, user preferences, or the user's current location) and whether to send content or communications to the user from the server. Furthermore, some data may be processed in one or more ways before it is stored or used, resulting in the removal of personally identifiable information. For example, a user's identity may be processed to the point that the user's personally identifiable information cannot be determined, or, if location information is available, the user's geographic location may be generalized (e.g., down to the city, zip code, or state level), making it impossible to determine the user's specific location. Therefore, users have control over what information about themselves is collected, how that information is used, and what information is provided to them.

[0056] Exemplary process for generating and using centroid models

[0057] Figure 2 This is a swimlane diagram of an exemplary process 200 for generating a centroid model and using the centroid model to add users to a user group. The operation of process 200 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and content platform 150. The operation of process 200 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 200. Although process 200 and other processes are described below with reference to two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to execute similar processes.

[0058] In this exemplary process, the centroid model is used to add users to user groups. The computation of the centroids of user groups can also be used as a preprocessing stage for other machine learning models, such as k-NN models based on user groups rather than individual user profiles. For example, each user group in a k-NN model can be represented by the centroids of the user groups.

[0059] Content platform 150 can initiate the generation and / or updating of one or more centroid models in its centroid model by requesting applications 112 running on client devices 110 to generate user profiles for their respective users and upload secret shares and / or encrypted versions of the user profiles to MPC cluster 130. For the purposes of this document, secret shares of user profiles can be considered encrypted versions of user profiles, as secret shares are not plaintext. During generation, each application 112 can store user profile data and generate updated user profiles in response to requests received from content platform 150. Because the content of user profiles and machine learning models differ across content platforms 150, applications 112 running on user client devices 110 can maintain data for multiple user profiles and generate multiple user profiles, each user profile specific to a specific content platform or specific centroid model.

[0060] Since the content platform 150 (or digital component provider 160) can have multiple centroid models, for example, one centroid model for each set of one or more user groups, the content platform 150 (or digital component provider 160) can request the application 112 to generate user profiles and simultaneously upload user profiles for multiple user groups and / or multiple centroid models, for example, in a single request.

[0061] Application 112 running on client device 110 constructs user profiles for users of client device 110 (202). A user's profile may include data related to events initiated by the user and / or events that the user may have initiated regarding electronic resources (e.g., web pages or application content). Events may include viewing of electronic resources, viewing of digital components, user interaction (e.g., one or more of a user's viewing, clicking, or conversion of electronic resources and / or digital components), or the absence of user interaction with electronic resources or digital components (e.g., the absence of a user's viewing, clicking, or conversion of electronic resources and / or digital components), conversions that occurred (or did not occur) after the user interacted with electronic resources, and / or other appropriate events related to the user and electronic resources. Because user profiles can change over time, the constructed user profile may be referred to as the current user profile P. current .

[0062] A user's profile can be specific to content platform 150 or a selected centroid model owned by content platform 150. For example, see the reference below. Figure 3 More specifically, each content platform 150 can request application 112 to generate or update user profiles specific to that content platform 150. In another example, content platform 150 can request application to generate or update the corresponding user profile for each centroid model of content platform 150.

[0063] User's User Profile P current It can be in the form of a feature vector. For example, a user profile P current It can be an n-dimensional feature vector. Each of the N dimensions can correspond to a specific feature, and the value of each dimension can be the value of the user's feature. For example, one dimension could be used to indicate whether a particular numeric component is presented to the user (or interacted with). In this example, if the numeric component is presented to the user (or interacted with), the value of that feature could be "1", or if the numeric component has not yet been presented to the user (or interacted with), the value of that feature could be "0". An exemplary process for generating a user profile is described in... Figure 3 It is shown in the figure and described below.

[0064] Application 112 generates user profiles P current The secret share (204). In this example, application 112 generates the user profile P. current Two secret shares [P] current ,1] and [P current [2], one secret share for each computing system in the MPC cluster 130. For the purposes of this document, square brackets [] are used to enclose elements that are secretly shared (e.g., values, vectors, etc.) to indicate secret shares, for example, [secret share] for the element "secret share". For example, an application can share a user profile P current Split into secret shares to protect user profiles P current The value is protected from the damage to the computing systems in the MPC cluster 130. Note that each secret share can be a random value and does not disclose anything about the user profile on its own. Two secret shares will need to be combined to obtain the user profile. If the MPC cluster 130 includes more computing systems participating in the training of the machine learning model, application 112 will generate more secret shares, one for each computing system. An exemplary process for constructing the user profile and generating the secret shares of the user profile is described in Figure 3 It is shown in the figure and described below.

[0065] Application 112 will store the user profile P current The first secret share [P]current [1] is provided to the computing system MPC1 (206). Application 112 also provides the second secret share of the user profile [P] current [2] Provided to the computing system MPC2(208). See below for reference. Figure 3 As mentioned, there are various ways to transfer user profiles. current Two secret shares [P] current ,1] and [P current [2] Provided to MPC cluster 130, so that user privacy and data security are protected.

[0066] In some implementations where the model is expected to be trained based on user conversions of digital components, it may be considered that conversions often occur long after a display or click. In such cases, it may be advantageous to keep the MPC cluster 130 available to perform other tasks to optimize the bandwidth, storage, and processing of the content platform 150. In such implementations, operations 206 and 208 can be replaced by an alternative process in which (i) application 112 transmits encrypted shares of user profiles and tags along with a first-party cookie to a demand-side platform (DSP), which may be part of the content platform 150 in some implementations and separate from it in others; (ii) the DSP then uses the first-party cookie to map (i.e., associate) the encrypted shares of user profiles and tags with conversion-specific interaction data (e.g., whether the conversion occurred within a preset time period such as 30 days); and (iii) the DSP then transmits this mapping to computing systems MPC1 or MPC2 to train a machine learning model. While this description focuses on the conversion interaction, the architecture and functionality can be extended to any other interaction (e.g., display or click), or any combination of interactions (e.g., display, click, and / or conversion).

[0067] Computing systems MPC1 and MPC2 generate centroid models (210). Computing systems MPC1 and MPC2 are capable of generating centroid models for multiple user groups of a content platform 150 or a digital component provider 160 that requests user profiles to be uploaded by client device 110. Each generation of a new machine learning model based on user profile data can be referred to as a training session. Computing systems MPC1 and MPC2 can generate centroid models based on secret shares of user profiles received from multiple client devices. For example, computing systems MPC1 and MPC2 can use MPC technology to generate centroid models based on secret shares of user profiles. Typically, generating centroid models for user groups involves calculating the centroids of user profiles of users who are members of the user group. An exemplary process for generating centroid models is described in... Figure 4 and Figure 6 It is shown in the figure and described below.

[0068] Each centroid model generated and maintained by the MPC cluster 130 can have a corresponding unique identifier. This allows application 112 to query the centroid model using the model identifier. For example, a request to generate a centroid model can include the model identifier of the centroid model, which can be assigned by the owner (e.g., content platform 150 or digital component provider 160). The owner can then use the model identifier to request application 112 to query the centroid model to determine whether to add a user to the user group corresponding to the centroid model.

[0069] Application 112 submits a user group update request (212) to MPC cluster 130. The user group update request can include the user's current user profile P. current In some implementations, application 112 can store the complete user profile P. current It is sent to each computing system MPC1 and MPC2. In other embodiments, to protect user privacy, application 112 can send the user profile P current The corresponding portion or secret share is sent to each computing system MPC1 and MPC2.

[0070] User group update requests can also include a model identifier for each of the one or more centroid models being queried to determine whether a user should be added to the user group corresponding to that centroid model. In some implementations, application 112 sends a separate user group update request for each centroid model. In this example, each user group request includes a model identifier for one centroid model.

[0071] Each user group update request can also include a threshold distance for the query, such as the maximum distance. If a user's profile is within the threshold distance of the user group's centroid, MPC cluster 130 can request application 112 to add the user to the corresponding user group. (Reference) Figure 5 Exemplary data formats and techniques for transmitting user group update requests are described.

[0072] MPC cluster 130 determines whether a user should be added to one or more user groups (214). Typically, this can include determining whether the user's profile is within a threshold distance of the centroid of each of the one or more user groups. Computing systems MPC1 and MPC2 can perform a secure MPC process to determine whether a user should be added to one or more user groups, such that neither MPC1 nor MPC2 can access any plaintext user profile or plaintext user group identifier that would be suggested to the user. An exemplary process for determining a user's user group is described in... Figure 5 and Figure 6 It is shown in the figure and described below.

[0073] MPC cluster 130 provides zero or more user group identifiers (216) to application 112. MPC cluster 130 is capable of providing a user group identifier for each user group to which a user should be added. That is, MPC cluster 130 is capable of providing a user group identifier for each user group whose centroid is within a threshold distance of the user's profile. To protect user privacy, each computing system MPC1 and MPC2 provides a portion of the user group identifier or a secret share of the user group identifier, as referenced below. Figure 5 and Figure 6 As described.

[0074] Application 112 updates the user's list of user groups (218). For example, application 112 can add the user to each user group within a threshold distance of the user profile's centroid. That is, application 112 can add each user group identifier received from MPC cluster 130 to the list of user groups maintained at the user's client device 110. In some implementations, application 112 can prompt the user for permission to add the user to each user group.

[0075] Application 112 transmits a request for content (220). For example, application 112 may transmit a request for a digital component to content platform 150 in response to loading an electronic resource with a digital component slot. In some embodiments, the request may include one or more user group identifiers for user groups that include the user as a member. For example, application 112 may obtain one or more user group identifiers from a list of user groups and provide the user group identifier(s) along with the request. In some embodiments, techniques may be used to prevent the content platform from associating the user group identifier with the user from whom the request was received, application 112, and / or client device 112.

[0076] Content platform 150 delivers content to application 112 (222). For example, content platform 150 can select digital components based on one or more user group identifiers and provide the digital components to application 112. In some implementations, content platform 150 cooperates with application 112 or device operating system to select digital components based on one or more user group identifiers without exposing the one or more user group identifiers outside of application 112 or user device 110.

[0077] Application 112 displays or otherwise implements the received content (224). For example, application 112 is able to display the received digital component in the digital component slot of the electronic resource.

[0078] An exemplary process for generating a user profile for a centroid model.

[0079] Figure 3This is a flowchart illustrating an exemplary process 300 for generating user profiles and sending them to an MPC cluster. The operation of process 300 can be performed, for example, by... Figure 1 The client device 110 may be implemented, for example, by an application 112 running on the client device 110 or by the operating system of the client device 110. The operation of process 300 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices may cause one or more data processing devices to perform the operation of process 300.

[0080] Application 112, running on the user's client device 110, receives event data (302). An event can be, for example, the presentation of an electronic resource at client device 110, the presentation of a digital component at client device 110, user interaction with the electronic resource or digital component at client device 110, or a conversion of the digital component, or the absence of user interaction or conversion with the presented electronic resource or digital component. Some examples of user interaction by the user can be interaction with a specific item presented on a webpage, such as one or more of the following: (a) clicking a link to the specific item, (b) completing a conversion of the specific item by, for example, adding the item to a virtual shopping cart or purchasing the item, (c) viewing the specific item for more than a preset amount of time. Some examples of the absence of a specific user interaction can be that the user performs some interaction but lacks subsequent interaction, for example, the user views a digital component but does not click it; clicks a digital component but does not convert it (e.g., clicks to go to the checkout page but does not purchase the item); etc. Conversions can be defined differently in different implementations. For example, in some implementations, a conversion can be the user navigating to the checkout page. In some implementations, a conversion can be the user attempting to purchase an item. In other implementations, the conversion could be a user purchasing an item. When an event occurs, the content platform 150 or the digital component provider 160 can provide the application 112 with event-related data for use in generating the user's profile.

[0081] Application 112 can generate different user profiles for each content platform 150 or digital component provider 160. That is, a user's profile and the user profile for a specific content platform 150 can include only event data received from that specific content platform 150. This protects user privacy by not sharing event-related data with other content platforms. In some implementations, upon request from content platform 150, application 112 can generate different user profiles for each centroid model owned by content platform 150. Different centroid models may require different training data based on design goals. For example, a first model can be used to determine whether to add a user to a user group. A second model can be used to predict whether a user will interact with a digital component (e.g., view, click, and / or convert). In this example, the user profile of the second model can include additional data not present in the user profile of the first model, such as whether the user interacted with the digital component.

[0082] Content platform 150 can update token M with a brief profile. update Event data is sent in the form of a brief update token M. update It has the following entries shown and described in Table 1 below.

[0083]

[0084]

[0085] Table 1

[0086] A model identifier identifies the centroid model for which user profiles will be used for training or for user group inference. A profile record is an n-dimensional feature vector that includes event-specific data, such as the type of event, electronic resource or digital component, the time of the event, and / or other appropriate event data that content platform 150 (or digital component provider 160) wants to use in training the centroid model and for user group inference. Operation instruction application 112 updates the user profile based on the profile record. A digital signature is generated based on seven entries using the private key of content platform 150.

[0087] In some implementations, in order to protect the update token M during transmission update Content platform 150 will update token M update Update token M before sending to application 112 update Encryption is performed. For example, content platform 150 can use the application's public key (e.g., PubKeyEnc(M)). update The application_public_key is used to encrypt the update token M. update .

[0088] In some implementations, content platform 150 can send event data to application 112 without updating token M via profile. update Event data or update requests are encoded in a specific format. For example, a script originating from a content platform 150 running within application 112 can directly transmit event data and update requests to application 112 via a script API, where application 112 relies on a security model based on the World Wide Web Consortium (W3C) and / or (Hypertext Transfer Protocol Security) HTTPS to protect event data and update requests from forgery, disclosure, or man-in-the-middle attacks.

[0089] Application 112 stores the event data (304). If the event data is encrypted, application 112 can decrypt the event data using its private key corresponding to the public key used to encrypt the event data. If the event data is updated with token M... update If the event data is sent in the form of [the event token M], then application 112 can verify the update token M before storing the event data. update Application 112 can verify the update token M through the following operations. update (i) Verify the digital signature using the public key of the content platform 150 corresponding to the private key used to generate the digital signature, and (ii) ensure that the token creation timestamp is not outdated, for example, that the time indicated by the timestamp is within a threshold time amount of the current time at which verification is performed. If the token M is updated... update If valid, application 112 can store the event data, for example, by storing an n-dimensional profile record. If any validation fails, application 112 can ignore the update request, for example, by not storing the event data.

[0090] For each centroid model, for example, for each unique model identifier, application 112 can store the event data for that model. For example, application 112 can maintain a data structure for each unique model identifier that includes a set of n-dimensional feature vectors (e.g., a profile record of an update token), and maintain an expiration time for each feature vector. Exemplary data structures for model identifiers are shown in Table 2 below.

[0091] Feature vector Expired n-dimensional eigenvectors Expiration time … …

[0092] Table 2

[0093] Upon receiving a valid update token M update At that time, application 112 can update the token M. update The feature vector and expiration time are added to the data structure to update the token M. update The data structure for model identifiers. Periodically, application 112 can remove expired feature vectors from the data structure to reduce storage size. The expiration times in Table 2 are compared with the update tokens M shown in Table 1.update The expiration dates are the same.

[0094] Application 112 determines whether to generate a user profile (306). For example, application 112 may generate a user profile for a specific centroid model in response to a request from content platform 150. This request could be to generate a user profile and upload it to MPC cluster 130. To ensure the security of requests to generate and upload user profiles, content platform 150 can send an upload token M to application 112. upload .

[0095] Upload Token M upload Able to have update token M update Similar structure, but with different operations (e.g., "update server" instead of "accumulate user profiles"). Upload token M upload It can also include additional entries for operational delays. As application 112 accumulates more event data (e.g., more feature vectors), the operational delay can instruct application 112 to delay calculating and uploading the secret share of the user profile. This allows the centroid model to capture user event data immediately before and after some key events (e.g., joining a user group). The operational delay can specify a delay period. In this example, a digital signature can be generated using the content platform's private key, based on the other seven entries in Table 1 and the operational delay. The content platform 150 can then use the update token M... update (For example, PubKeyEnc(M) upload A similar approach, using the application's public key, is used to encrypt the upload token M. upload To protect the upload token M during transmission upload .

[0096] Application 112 can receive upload token M upload If the token M is uploaded upload If encrypted, then the upload token M upload Decrypt and verify the uploaded token M. upload This verification is similar to verifying the update token M. update Application 112 can verify the upload token M through the following operations. upload (i) Verify the digital signature using the public key of the content platform 150 corresponding to the private key used to generate the digital signature, and (ii) ensure that the token creation timestamp is not outdated, for example, that the time indicated by the timestamp is within a threshold time amount of the current time at which verification is performed. If the uploaded token M upload If valid, application 112 can generate a user profile. If any verification fails, application 112 can ignore the upload request, for example, by not generating a user profile.

[0097] In some implementations, content platform 150 can request application 112 to upload a user profile instead of using a profile upload token M. upload The upload request is encoded in a specific format. For example, a script originating from a content platform 150 running within application 112 can send the upload request directly to application 112 via a script API, where application 112 relies on a W3C-origin security model and / or HTTPS to protect the upload request from forgery, disclosure, or man-in-the-middle attacks.

[0098] If a decision is made not to generate a user profile, process 302 can return to operation 302 and wait for additional event data from content platform 150. If a decision is made to generate a user profile, application 112 generates the user profile (308).

[0099] Application 112 can generate user profiles based on stored event data, such as data stored in the data structure shown in Table 2. Application 112 can also generate user profiles based on model identifiers included in the request (e.g., upload token M). upload The content platform eTLD+1 domain of entry 1 and the model identifier of entry 2 are used to access the appropriate data structure.

[0100] Application 112 can compute user profiles by aggregating n-dimensional feature vectors in a data structure over unexpired study periods. For example, a user profile can be the average of n-dimensional feature vectors in a data structure over unexpired study periods. The result is an n-dimensional feature vector representing the user in the profile space. Optionally, application 112 can normalize the n-dimensional feature vectors to unit length, for example, using L2 normalization. Content platform 150 can specify optional study periods.

[0101] In some implementations, the decay rate can be used to calculate user profiles. Since there may be many content platforms 150 using MPC cluster 130 to train centroid models, and each content platform 150 may have multiple centroid models, storing user feature vector data can lead to significant data storage requirements. Using decay techniques can significantly reduce the amount of data stored at each client device 110 for the purpose of generating user profiles for training machine learning models.

[0102] Suppose that, for a given centroid model, there exist k eigenvectors {F1, F2, ..., Fk}. k Each feature vector is an n-dimensional vector and its corresponding time of existence (record_age_in_seconds). i Application 112 can use the following relation 1 to calculate user profiles:

[0103] Relation 1:

[0104] In this relation, the parameter record_age_in_seconds i This is the amount of time, in seconds, that the profile record has been stored at the client device 110, and the parameter decay_rate_in_seconds is (for example, in the update token M) update The decay rate of the profile record (received in entry 6) in seconds. In this way, the updated feature vector carries more weight. This also allows application 112 to avoid storing feature vectors and use only constant storage to store profile records. Instead of storing multiple separate feature vectors for each model identifier, application 112 only needs to store an n-dimensional vector P and a timestamp user_profile_time for each model identifier.

[0105] In this relation, the parameter record_age_in_seconds i This is the amount of time, in seconds, that the profile record has been stored at the client device 110, and the parameter decay_rate_in_seconds is (for example, in the update token M) update The decay rate of the profile record (received in entry 6) in seconds. In this way, the updated feature vector carries more weight. This also allows application 112 to avoid storing feature vectors and use only constant storage to store profile records. Instead of storing multiple separate feature vectors for each model identifier, application 112 only needs to store an n-dimensional vector P and a timestamp user_profile_time for each model identifier.

[0106] To initialize the n-dimensional vector user profile P and timestamp, the application can set the vector P to an n-dimensional vector where each dimension has a value of zero, and set user_profile_time to the epoch. To use the new feature vector F at any time... x After updating the user profile P, application 112 can use the following relation 2:

[0107] Relation 2:

[0108] When using relation 2 to update a user profile, application 112 can also update the user profile time to the current time (current_time). Note that if application 112 calculates the user profile using the decay rate algorithm described above, operation 304 is omitted.

[0109] Application 112 generates a secret share (310) of the user profile. Application 112 can use a pseudo-random function to generate the secret share of the user profile P.current (For example, an n-dimensional vector P) current The data is split into secret shares. In other words, application 112 can use the pseudo-random function PRF(P... i To generate a user profile P current Two secret shares {[P current,1 ],[P current,2 The precise splitting can depend on the secret-sharing algorithm and cryptographic library used by application 112. In some implementations, the application uses the Shamir secret-sharing scheme.

[0110] In some implementations, the application uses an additive secret-sharing scheme, whereby application 112 generates a random (or pseudo-random) n-dimensional vector nonce. In this example, the application is able to generate a nonce as P current +nonce's first secret share and as P current -The second secret share of nonce. Then, applying 112 can remove the n-dimensional vector nonce.

[0111] To prevent malicious application 112 from abusing the upload API used to upload secret shares of user profiles, MPC cluster 130 can require the trust token issuer to sign the secret share. For user group identifier L i Each of the m user groups and each of the computing systems MPC1 and MPC2 in the MPC cluster 130, application 112 can initiate a trust token exchange process with the trust token issuer to obtain a signed exchange record (SRR). The m user groups can be (i) those that send the upload token M upload The content platform 150 (or digital component provider 160) manages and (ii) includes user groups with users as members, for example, user groups identified in a list of user groups maintained by application 112.

[0112] During the trust token redemption process, application 112 can redeem a trust token previously issued to it based on the assumption that application 112 and / or client device 110 are trusted. This can include sending the trust token and information (e.g., the binding and eTLD+1 of computing systems MPC1 or MPC2) along with a request to redeem the trust token to the trust token issuer. The trust token issuer can respond by providing an SRR to application 112. Application 112 can redeem a trust token for each SRR. An exemplary format of an SRR is shown in Table 3 below.

[0113]

[0114]

[0115] Table 3

[0116] Application 112 can use the model identifier's message authentication code (e.g., hash-based message authentication code (HMAC)), the secret share of the user profile for which the SRR is generated, and the user group L i The binding is calculated using the public key (application_public_key) of application 112. For example, the binding can be represented as HMAC(model_id, share, L). i (application_public_key). Given a user profile and a given centroid model, application 112 can compute the code twice, for user profile P. current Each secret share is accessed once, therefore once for each computing system MPC1 and MPC2. For example, the SRR parameter "share" of computing system MPC1 can be [P current,1 The SRR parameter "share" of the computing system MPC2 can be [Pcurrent,2].

[0117] Trust token issuers can generate timestamps and digital signatures. They can use their private key to generate the digital signature. This allows the recipient of the SRR to verify the signature using the public key corresponding to the private key.

[0118] For user group identifier L i Representing each of the m user groups and each of the computing systems MPC1 and MPC2 in the MPC cluster 130, application 112 can then create a user profile update token M. profileupdate Used for transmission to MPC cluster 130. User profile update token M profileupdate An example format is shown in Table 4 below.

[0119]

[0120]

[0121] Table 4

[0122] Application 112 can generate timestamps and digital signatures. Application 112 can generate digital signatures using its private key, which corresponds to the public key in entry 4. This allows the user profile to update token M. profileupdate The recipient can use the public key corresponding to the private key to verify the signature.

[0123] The compromised application 112 can initiate a user profile update operation itself, instead of relying on the content platform 150 to use the user profile update token M. profileupdateThe application 112 can optionally take action on the request. To enable the MPC cluster 130 to detect this situation, the application 112 can optionally receive the update token M from the content platform 150. update Includes user profile update token M profileupdate middle.

[0124] Application 112 transmits a request (312) to update the user profiles of one or more models at MPC cluster 130 using the user's user profile. Each request can include a secret share of the user profile. For example, application 112 can send a request with user profile P current The first secret share [P] current,1 User profile update token M profileupdate The data is transmitted to the computing system MPC1 and will contain the user profile P. current The second secret share [P] current,2 User profile update token M profileupdate The data is transmitted to the computing system MPC2. Application 112 is able to perform this operation for each model identifier for which a user profile update token has been created.

[0125] In this process, for each of the two computing systems MPC1 and MPC2 in MPC cluster 130, application 112 sends m requests to update user profiles, one request for each of the m user groups. An compromised computing system in MPC cluster 130 may correlate these m requests. Such an attack could allow the compromised computing system to learn that application 112 (and its users) may belong to multiple user groups and the identifiers of those groups.

[0126] To mitigate this risk, MPC cluster 130 can be utilized. To upload the secret share to computing system MPC1, application 112 can send a single request to computing system MPC2, wherein the first secret share [P] with the user profile is... current,1 All user profile update tokens are intended for use by the computing system MPC1, encrypted solely using the public key of the computing system MPC1. This single request can include a set of encrypted results in the form: PubKeyEnc(M profileupdate_1 ,MPC1),PubKeyEnc(M profileupdate_2 ,MPC1),…PubKeyEnc(M profileupdate_m ,MPC1), where PubKeyEnc represents the probabilistic asymmetric encryption algorithm, and MPC1 represents the asymmetric public key of the computing system MPC1.

[0127] PubKeyEnc's probabilistic properties provide semantic security. A semantically secure scheme is one in which only negligible information can be extracted from the encryption result. Without colluding with computing system MPC1, computing system MPC2 cannot infer any information from the encrypted token list. Computing system MPC2 can decompose the token list and send m requests to computing system MPC1, updating token M in each user profile. profileupdate Each request is processed individually. Computing system MPC2 can use random or pseudo-random delays between consecutive requests. In another example, computing system MPC2 can batch upload multiple requests from multiple applications 112 running on multiple client devices 110 to computing system MPC1 to prevent requests from the same application 112 from being correlated.

[0128] Application 112 can use similar techniques to upload a second secret share for computing system MPC2. That is, application 112 can send a single request to computing system MPC1, wherein the second secret share [P] has a user profile. current,2 All user profile update tokens are intended for use by the computing system MPC2, which uses the MPC2 public key for encryption. This single request can include a set of encrypted results in the form: PubKeyEnc(M profileupdate_1 ,MPC2),PubKeyEnc(M profileupdate_2 ,MPC2),…PubKeyEnc(M profileupdate_m MPC1 (MPC1) can decompose a list of tokens and send m requests to MPC2, updating token M in each user profile. profileupdate Each request could be made individually, for example, using delayed or batch uploads as described above. Given a large number of requests that can be received by computing systems MPC1 and MPC2, it would be difficult (if not impossible) for computing systems MPC1 or MPC2 to associate tokens with individual client devices 110 using these techniques.

[0129] Computing systems MPC1 and MPC2 are capable of verifying each received request to update a user profile. Upon receiving a request with the encrypted result PubKeyEnc(M... profileupdate_i MPC j When a request is made, where j is 1 or 2, depending on the computing system, the computing system is MPC. j Decrypt the encrypted result to recover the plaintext user profile update token M profileupdate_i Computing System MPC j Confirm User Profile Update Token M profileupdate_i Therefore, the computing system MPC jThe digital signature in entry 1.5 of the SRR is verified using the public key extracted from the trust token issuer field in entry 1.4 of the SRR (see Table 3). Computing System MPC j It can also use M profileupdate_i The public key of application 112 sent to MPC cluster 130 is used to verify the user profile update token M. profileupdate_i The digital signature in item 7 (see Table 4).

[0130] Computing System MPC j It can also verify the staleness of the signature timestamp of entry 1.3 of the SRR, for example, by ensuring that the timestamp is within a threshold duration of the current time at which verification is performed. (Computing system MPC) j It can also verify the publisher source in entry 1.2 of the SRR and the current computing system MPC. j Identity matching. Computing system MPC j It can also verify the bound value in entry 1.1 of the SRR and the update token M from the user profile. profileupdate_i The HMAC(model_id,share,L) calculated from entries 1-4 in the table. i The MPC computing system can also verify user profile update tokens (M) by, for example, ensuring that the token creation timestamp is within a threshold duration of the current time when verification is being performed. profileupdate_i The token creation timestamp in item 5 is not stale. (Computing System MPC) j It can also use token creation timestamps to detect potential replay attacks, such as updating tokens based on multiple user profiles with the same token creation timestamp. If any of these verifications fail, the computation system MPC... j The request can be ignored.

[0131] Each computing system, MPC1 and MPC2, can maintain a table (or other suitable data structure) containing data for each centroid model. For example, this table can be in the form of Table 5 below.

[0132] Model ID User Group ID The sum of all shares Number of applications model_id <![CDATA[L i ]]> sum of shares number of applications … … … …

[0133] Table 5

[0134] The centroid model's rows include the model identifier (model_id), the user group identifier (L) of the user groups included in the model, and the user group identifier (L) of the user groups included in the model. iThe sum of all shares of the user profile received for the centroid model, and the number of unique applications 112 (e.g., the number of unique client devices) that submitted the secret share of the user profile to the centroid model and whose secret share is included in the sum of all shares of the centroid model. The sum of all shares is an n-dimensional vector corresponding to the n-dimensional vector of the user profile.

[0135] When the computing system MPC is received j Model / user group pair {model_id,L} that has never been received before i When}, the computing system MPC j It can initialize the sum of all shares of the centroid model to a zero vector and initialize the number of applications to zero. To handle valid requests to update user profiles for centroid models that include specific model / user group pairs, the computational system MPC... j It can locate rows for centroid model / user group pairs in the table and update the sum of all shares and the number of applications for centroid model / user group pairs. For example, in the computing system MPC... j It can add the secret share of the received user profile to the sum of all shares of the centroid model / user group pair, and increase the number of applications by one.

[0136] Exemplary process for generating and using centroid models

[0137] Figure 4 This is a flowchart illustrating an exemplary process 400 for generating a centroid model. The operation of process 400 can be performed, for example, by... Figure 1 The MPC cluster 130 is implemented. The operation of process 400 can also be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 400. Although process 400 is described in terms of generating multiple centroid models, process 400 can also be used to generate a single centroid model for a single user group. As mentioned above, the process for calculating centroids can also be used in the preprocessing stage for k-NN or other machine learning models based on user groups rather than individual user profiles.

[0138] Each computing system MPC1 and MPC2 obtains a user profile data table (402). For example, this table can be in the form of Table 5 above. Computing system MPC1 can obtain the first secret share [P] for each model identifier and user group pair, including the user group included in the centroid model identifier received from application 112 via the model identifier and user group ID. current,1The table summing the data. Similarly, the computing system MPC2 is able to obtain the second secret share [P] for each model identifier and user group pair, including the user group included in the centroid model identifier received from application 112 via the model identifier and user group ID. current A table of the sums of ,2].

[0139] Each computing system MPC1 and MPC2 enforces a user group size threshold (404) for each model identifier. For example, each computing system MPC1 and MPC2 is able to enforce the size threshold on each row of its table. In order to enforce the user group size threshold, each computing system MPC1 and MPC2 is able to determine whether the number of applications for the model identifier exceeds a predefined size threshold.

[0140] Computing systems MPC1 and MPC2 notify each other of rows in the table that meet the size threshold (e.g., information for each model identifier / user group ID pair) (406). For example, computing system MPC1 can send the model identifier, user group identifier, and the number of applications in each row that exceeds the size threshold to computing system MPC2. Additionally, computing system MPC1 can send the second half of the sum of the share vectors (sum_of_shares1) for each of these rows to computing system MPC2. Only the transmission of the second half of sum_of_shares1 is based on the horizontal partitioning strategy discussed below.

[0141] Similarly, computing system MPC2 can send the model identifier, user group identifier, and the number of applications in each row that exceed the size threshold to computing system MPC1. Additionally, computing system MPC2 can send the first half of the sum of share vectors (sum_of_shares2) for each of these rows to computing system MPC1.

[0142] Computing system MPC1 matches rows in its table where the number of applications exceeds a size threshold with rows received from computing system MPC2. For example, computing system MPC1 can use the row's model identifier and / or user group identifier to match corresponding rows for the same model and user group. Similarly, computing system MPC2 matches rows in its table where the number of applications exceeds a size threshold with rows received from computing system MPC1. For example, computing system MPC2 can use the row's model identifier and / or user group identifier to match corresponding rows for the same model and user group. Example results of this size threshold enforcement and cross-notification in tabular form at computing system MPC1 are shown in Table 6 below.

[0143]

[0144] Table 6

[0145] Similarly, Table 7 below shows example results of size threshold enforcement and cross-notification in tabular form at the computing system MPC2.

[0146]

[0147] Table 7

[0148] For each row, ideally, the values ​​in "Number of applications from MPC1" and "Number of applications from MPC2" should be the same if both exist for a given pattern identifier. Due to processing latency, these two values ​​may have slight differences. If both values ​​exist and both vary significantly, or if one of these values ​​does not exceed a size threshold, the computational system providing values ​​not exceeding the size threshold may be compromised. For those rows where the values ​​in "Number of applications from MPC1" and "Number of applications from MPC2" meet a proximity threshold (e.g., within the threshold difference between them) and both exceed the size threshold, the computational system is able to compute their centroids.

[0149] Computational systems MPC1 and MPC2 compute the centroids (408) of the centroid model. Computational system MPC1 is capable of computing the first half of the centroid vector of user groups in rows that satisfy proximity (e.g., within a threshold difference) and size thresholds. Computational system MPC1 is capable of computing (e.g., for rows) the centroids of model identifiers and user groups using the following relation 3.

[0150] Relationship 3:

[0151]

[0152] Similarly, the computing system MPC2 can use the following relation 4 to compute (e.g., for rows) model identifiers and centroids of user groups.

[0153] Relation 4:

[0154]

[0155] The core of a user group is generally not privacy-sensitive and cannot be easily manipulated to allow malicious applications 112 of the MPC cluster 130, content platform 150, or computing systems MPC1 and MPC2 to steal user profiles.

[0156] At the end of this process, computational system MPC1 has the first half of the centroids of all lists exceeding the list size threshold. Examples of the results of this process are shown in tabular form in Table 8 below. Computational system MPC2 has the same data for the second half of the centroid vector for each model identifier and user group identifier. The trained centroid model for a user group can include a first centroid model and a second centroid model, where the first centroid model includes the first half of the centroid of each user group, and the second centroid model includes the second half of the centroid of each user group.

[0157]

[0158] Table 8

[0159] Figure 5 This is a swimlane diagram illustrating an exemplary process 500 for adding users to a user group using a centroid model. The operation of process 500 can be, for example, by... Figure 1 The process 500 is implemented using an MPC cluster 130 and a client device 110 (e.g., an application 112 running on the client device 110). The operation of process 500 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 500.

[0160] Application 112 running on client device 110 can query MPC cluster 130 for suggested user groups in response to requests from content platform 150 or digital component provider 160. For example, the request could be to determine whether a user should be added to a user group owned by the requester using a centroid model generated for and owned by the requester. For example, content platform 150 can manage many user groups, and MPC cluster 130 can train and use one or more centroid models of user groups to determine whether a user should be added to those user groups.

[0161] In order to request the application of the centroid model, the requester can send a download group token M to the client device 110. download Token M download It is possible to have the following entries shown and described in Table 9 below.

[0162]

[0163]

[0164] Table 9

[0165] In some implementations, content platform 150 can use the public key of application 112 to encrypt the download group token M. downloadThen, content platform 150 can call the application's API to extract the user group identifier via its own script or an SSP script. Application 112 can then use this identifier to decrypt and verify the user profile update token M. profileupdate Decrypt and verify the download group token M in the same way download .

[0166] Given a tuple of model_id, user profile P, and threshold distance d, application 112 should extract all user group identifiers L. i Where |P-Centroid(model_id, Li)| < d. In this example, the function Centroid(model_id, Li) returns the model_id and Li from table 8. i The value in the Centroid column of the marked row.

[0167] To prevent computing systems MPC1 or MPC2 from knowing the entire user profile P, application 112 divides the user profile P into multiple parts (502). Application 112 can divide the user profile into corresponding parts for each computing system in the MPC cluster 130. In this example, application 112 can split the user profile into two parts, the first part for computing system MPC1 and the second part for computing system MPC2. Assume that the user profile P is an n-dimensional vector and the user profile P = {p1, p2, ..., p...} n}, then the two halves P1 and P2 will be P1 = {p1, p2, ..., p} n / 2} and P2={p n / 2+1 ,…,p n The computing systems MPC1 and MPC2 are able to calculate the centroid of their respective user groups, i.e., the centroid Centroid(model_id, L). i ) becomes Centroid1(model_id,L i ) and Centroid2(model_id,L i ).

[0168] In some implementations, application 112 can also add differential privacy noise to better protect user privacy. For example, application 112 can add one-time user noise ΔP to user profile P before splitting user profile P into multiple parts.

[0169] Let P' = P + ΔP. Application 112 applies horizontal partitioning to divide P' into two halves, P1' and P2'. Let d' = d + |ΔP|. Application 112 sends the first half P1' to computing system MPC1 (504). For example, application 112 can send a request with two parameters {P1', d'} to computing system MPC1. This request could be to retrieve all user group identifiers L. i , where |P1'–Centroid1(model_id,L i )| <d’。

[0170] Similarly, application 112 sends the latter half P2' to computing system MPC2 (506). For example, application 112 can send a request with two parameters {P2', d'} to computing system MPC2. This request could be to extract all user group identifiers L. i , where |P2'–Centroid1(model_id,L i )| <d’。

[0171] In some implementations where the model is expected to be trained based on user conversions of digital components, it may be considered that conversions often occur long after a display or click. In such cases, it may be advantageous to keep the MPC cluster 130 available to perform other tasks to optimize the bandwidth, storage, and processing of the content platform 150. In such implementations, operations 504 and 508 can be replaced by alternative processes in which (i) application 112 transmits encrypted shares of user profiles and tags along with a first-party cookie to a demand-side platform (DSP), which may be part of the content platform 150 in some implementations and separate from it in others; (ii) the DSP then uses the first-party cookie to map (i.e., associate) the encrypted shares of user profiles and tags with conversion-specific interaction data (e.g., whether the conversion occurred within a preset time period such as 30 days); and (iii) the DSP then transmits this mapping to computing systems MPC1 or MPC2 to train a machine learning model. While this description focuses on the conversion interaction, the architecture and functionality can be extended to any other interaction (e.g., display or click), or any combination of interactions (e.g., display, click, and / or conversion).

[0172] The computational system MPC1 can determine user groups with centroids within a threshold distance d' of the first half of the user profile P' P' (508). The computational system MPC1 can determine the distance between the first half P1' and the centroid of each user group, i.e., |P1'–Centroid1(model_id,L i)|. Then, application 112 can determine which user groups have a distance less than distance d'. The user group identifiers of these user groups can be represented by U1.

[0173] Similarly, computing system MPC2 can determine user groups (510) having centroids within the threshold distance d' of the second half P2' of user profile P'. Computing system MPC2 can determine, for each user group, the distance between the second half P2' and the centroid of the user group, i.e., |P2' – Centroid2(model_id,L i )|. Then, application 112 can determine which user groups have a distance less than distance d'. The user group identifiers of these user groups can be represented by U2.

[0174] Computing system MPC1 transmits the set of user group identifiers U1 to application 110 (512). Similarly, computing system MPC2 transmits the set of user group identifiers U2 to application 110 (514).

[0175] Application 112 can use sets U1 and U2 to calculate all user group identifiers L i that satisfy |P – Centroid(model_id,L i )| < d Thus, application 112 can calculate set U from U1 and U2 because U = {L i}, where |P - Centroid(model_id, L i )| < d and L i ∈U1 ∪ U2.

[0176] Previous methods assume that the centroids of user groups are not privacy-sensitive and that leaking a superset of the user groups that a browser should join either in MPC1 or MPC2 (i.e., U1 U1 and U2 U2) is acceptable. In cases where stronger privacy protection is required, the following method can be used. Figure 6 is a swimlane diagram showing an exemplary process 600 for generating a centroid model and using the centroid model to add users to user groups corresponding to centroid models with stronger privacy protection. The operations of process 600 can be implemented, for example, by Figure 1 MPC cluster 130 and client device 110 (e.g., application 112 running on client device 110). The operations of process 600 can also be implemented as instructions stored on one or more computer-readable media that can be non-transitory, and the execution of the instructions by one or more data processing devices can cause the one or more data processing devices to perform the operations of process 600.

[0177] MPC cluster 130 is capable of training centroid models for one or more user groups. In this example, the centroid model is queried using secret shares of user profiles. Therefore, each computing system MPC1 and MPC2 is able to determine the corresponding secret share of the centroid of a user group using secret shares of user profiles from the training set (e.g., secret shares of user profiles uploaded by client device 110).

[0178] For each user group, the computing system MPC1 calculates the first secret share (602) of the centroid of the user group. The centroid model is identified by the model identifier model_id and the centroid model is identified by the user group identifier L. i The centroid of the identified user group can be represented as sum_of_profile(model_id, L i For user group L) i All user profiles of the members P i First secret share [sum_of_profile] model_id,i,1 ]=Σ[P j,1 In other words, user group L i The first secret share of the centroid represents user group L i User profile P in i The sum of the first secret shares.

[0179] For each user group, the computation system MPC2 calculates the second secret share (604) of the user group's centroid. The centroid model is identified by the model identifier model_id and the centroid model is identified by the user group identifier L. i The centroid of the identified user group can be represented as sum_of_profile(model_id, L i For user group L) i All user profiles of the members P i The second secret share [sum_of_profile] model_id,i,2 ]=Σ[P j,2 In other words, user group L i The second secret share of the centroid represents user group L i User profile P in i The sum of the second secret share.

[0180] The centroid model can include a first share of the centroid for each user group and a second share of the centroid for each user group. The first share of each centroid can be confidentially maintained at computing system MPC1, and the second share of each centroid can be confidentially maintained at computing system MPC2.

[0181] Application 112, running on client device 110, divides a user's profile into secret shares (606). For example, application 112 can calculate a first secret share [P1] for user profile P used to compute system MPC1 and a second secret share [P2] for user profile P used to compute system MPC2. The precise division can depend on the secret sharing algorithm and cryptographic library used by application 112. In some implementations, the application uses the Shamir secret sharing scheme.

[0182] Application 112 sends a request (608) to computing system MPC1 to retrieve the user group identifier of a user. This request may include a first secret share [P1] of the user profile P. In some implementations, the request includes a query token M. query1 An example format for a query token is shown in Table 9 below.

[0183] Application 112 sends a request (610) to computing system MPC2 to extract the user group identifier of the user. This request may include a second secret share [P2] of the user profile P. In some embodiments, the request includes a query token M. query2 An example format for a query token is shown in Table 9 below.

[0184]

[0185] Table 9

[0186] In some implementations, application 112 can send two separate requests, such as Figure 6 As shown. To save bandwidth and battery consumption on client device 110, application 112 can combine two requests (e.g., two query tokens M) into one request. query1 and M query2 The query tokens M are combined into a single request and sent to one of the computing systems MPC1 or MPC2. To this end, application 112 can encrypt query tokens intended for use in the other computing system, MPC1 or MPC2. For example, application 112 can encrypt the query token M using the public key of computing system MPC2 (e.g., using a probabilistic asymmetric public-key algorithm). query2 For example, application 112 can use the public key of computing system MPC2 to generate the encrypted result PubKeyEnc(M). query2 (MPC2). Then, application 112 is able to query token M. query1 And the encryption result PubKeyEnc(M) query2 ,MPC2) is sent to computing system MPC1.

[0187] Computing system MPC1 can verify and update token M with computing system MPC1. profileupdate Verify the query token M in a similar wayquery1 As shown in the reference above Figure 3 The computing system MPC1 is also capable of processing PubKeyEnc(M) with encryption results. query2 The request from MPC2 is transmitted to the computing system MPC2. The computing system MPC2 can use the encryption query token M... query2 The public key is used to decrypt the encrypted result using its corresponding private key. Then, the computing system MPC2 can use the update token M to verify the encryption. profileupdate Verify the query token M in a similar way query2 As shown in the reference above Figure 3 As stated above.

[0188] In some implementations, each computing system MPC1 and MPC2 is able to determine the eligible_group for each of the multiple user groups associated with the centroid model. i The corresponding secret share. User profile and user group eligibility (eligible_group) i The centroid model indicates whether a user's profile is within a threshold distance of the centroid of the user group.

[0189] In this example, each computed MPC1 and MPC2 is able to find all user groups L associated with the model identifier model_id. i , where 1≤i≤N and N is the number of user groups associated with the model identifier model_id. For each user group L i The computing system MPC1 can use the following relation 5 to calculate the Euclidean distance [d]. i,1 The first secret share of the square of ].

[0190] Relation 5:

[0191] [d i，1 ]=∑([P1]×num_apps_group i -[sum_of_profile_modgl_id i，1 ]) 2

[0192] In relation 5, the parameter num_apps_group i This indicates the number of applications in the user group (e.g., the number of unique users), and user profiles are used to generate user group L. i The centroid. Then, the computing system MPC1 can use the following relation 6 to calculate the user profile and the user group eligibility (eligible_group). iThe first secret share [eligible_group] i，1 ]:

[0193] Relation 6:

[0194] [eligible_group i，1 ]=[d i，1 ]<(num_apps_group i ×d) 2

[0195] In other words, computing system MPC1 can calculate whether the first secret share of the Euclidean distance is less than the threshold distance. Computing system MPC2 can similarly calculate the user profile and user group eligibility (eligible_group) in a similar manner using the following relations 7 and 8. i The second secret share [eligible_group] i，2 ].

[0196] Relation 7:

[0197] [d i，2 ]=∑([P2]×num_apps_group i -[sum_of_profile_model_id i，2 ]) 2

[0198] Relation 8:

[0199] [eligible_group i，2 ]=[d i，2 ]<(num_apps_group i ×d) 2

[0200] Each computing system, MPC1 and MPC2, can transmit their respective secret shares of user group eligibility to application 112. Application 112 can then combine the secret shares to determine whether to add a user to the user group. Since the response size is proportional to the number of user groups in the model, the response size can be large for content platforms with a large number of user groups associated with the centroid model. However, this technique for determining whether to add a user to a user group can be used when the number of user groups is small or bandwidth consumption is not an issue. The remaining operations of process 600 provide improvements to this technique, enabling its use when the number of user groups can be large and significantly reducing the response size.

[0201] Conceptually, for user profiles and user groups, the user group qualification is `eligible_group`. iApplication 112 can generate two numbers g randomly or pseudo-randomly. i and h i Each number has an equal probability of having a value of zero or one. In this example, g i and h i The sum has a 25% probability of being zero, a 50% probability of being one, or a 25% probability of being two.

[0202] Application 112 can enable user group eligibility_group i The value is estimated to be (g) i +h i =1. Through Table 10 below, MPC cluster 130 can notify application 112 whether its estimate is correct.

[0203]

[0204] Table 10

[0205] For example, if g i +h i == 1 and eligible_group i If the value is 1, then the required estimation of eligible_group is correct. i The value of makes the value of the corresponding unit 1. On the other hand, if g i +h i == 2 and eligible_group i If the value is 1, then applying 112 incorrectly estimates the eligible_group. i The value of makes the value of the corresponding cell 0. In this case, application 112 can reverse its estimate, so that application 112 can correctly estimate the eligible_group. i The value of can be verified; the table above is equivalent to:

[0206] (1-eligible_group i )×(1-(g i +h i -1) 2 )+eligible_group i ×(g i +h i -1) 2

[0207] To implement this concept using secure MPC, application 112 is able to generate (e.g., 16 bytes or another suitable data size) two random (or pseudo-random) seeds, seed1 and seed2 (612). Application 112 is able to send the first seed1 to computing system MPC1. Application 112 is able to send the second seed2 to computing system MPC2.

[0208] The MPC cluster 130 is able to generate numbers g using a pseudo-random function (PRF) and a seed. i and h i These can be random or pseudo-random. A PRF can be a function that generates a value of 0 or 1 with a 50% probability. For example, a PRF can be a function such that PRF(seed, i) → {0, 1}. The computational system MPC1 can use the PRF and seed1 to generate g. i (For example, PRF(seed) 1,i Furthermore, the computing system MPC2 can use PRF and seed2 to generate h i (For example, PRF(seed) 2,i Number g i and h i It is g i +h i The two summation secret shares (which are the application's decision on whether a user should be added to user group L) i The estimate), which can be represented as [g i ] and [h i This indicates that they are secret shares.

[0209] MPC cluster 130 is not computed in plaintext (1-eligible_group) i )×(1-(g i +h i -1) 2 )+eligible_group i ×(g i +h i -1) 2 Instead, it is calculated using secret shares (1-[eligible_group)). i ])×(1-([g i +h i ]-1) 2 )+[eligible_group i ]×([g i +h i ]-1) 2Note that this equation includes the square of the secret share and the multiplication between the two secret shares. The computation using the sum of squares multiplied by a secure MPC procedure between computing systems MPC1 and MPC2 can be performed using a single round of Remote Procedure Call (RPC) between the two computing systems MPC1 and MPC2. All other operations can be performed locally within each computing system MPC1 and MPC2.

[0210] Specifically, each of the computing systems MPC1 and MPC2 is capable of computing each user group L. i The estimated flag i The secret share. The user group's estimated flag. i Indicate whether application 112 correctly estimated whether the user should be correctly added to the user group.

[0211] The computing system MPC1 calculates the computation of each user group L. i The estimated flag i The first secret share [flag] i，1 ](618). The computing system MPC1 can use the following relation 9 to calculate each user group L i The estimated flag of Flagi's first secret share [flagi] ，1 ].

[0212] Relation 9:

[0213] [flag i，1 ] = (1-[eligible_group i，1 ])×(1-([g i ]-1) 2 )+[eligible_group i，1 ]×([g i ]-1) 2

[0214] The computing system MPC2 calculates the L of each user group. i The estimated flag i The second secret share [flag] i，2

[620] . The computing system MPC2 can use the following relation 10 to calculate each user group L. i The estimated flag i The second secret share [flag] i，2 ].

[0215] Relation 10:

[0216] [flag i，2 ] = (1-[eligible_group i，2])×(1-([h i ]-1) 2 )+[eligible_group i，2 ]×([h i ]-1) 2

[0217] Computing systems MPC1 and MPC2 reconstruct each user group L i The estimated flag i (622). Computing systems MPC1 and MPC2 can use a single RPC between the two computing systems MPC1 and MPC2, based on two secret shares [flag]. i,1 To rebuild each user group L i The estimated flag i If user group L i The estimated flag i If the value is one, then the application can accurately estimate whether the user should be added to user group L. i Because neither computing systems MPC1 nor MPC2 know the actual content estimated by application 112, they know the user group L. i The estimated flag i The value will not leak any information to computing systems MPC1 or MPC2.

[0218] The computing system MPC1 will process each user group L i The estimated flag i Transmitted to application 112 (624). For example, computing system MPC1 can transmit user group {flag1,flag2,…} to application 112. Plaintext flag i It has a value of zero or one, indicating whether the estimate is correct or incorrect. That is, a value of one means that the application correctly estimated whether the user should be added to the i-th group, and a value of zero means otherwise. Therefore, each plaintext flag... i It can be represented by 1 bit.

[0219] For each user group associated with the centroid model, the computing system MPC1 is able to return a single bit (flag). i For a centroid model with one million user groups, the response size would be 128 kilobytes (KB), which is practical based on the required latency of the request and the frequency at which requests are submitted to the MPC cluster 130.

[0220] Application 112 determines whether to add a user to a user group based on an estimated flag (626). For each user group, the application is able to compute the flag. i ==(g i +hi == 1). The operation "==" represents an equality operation that returns true if two values ​​are equal. If the calculation result is true, then application 112 should be added to the i-th user group associated with the centroid model.

[0221] Then, application 112 can request user group identifiers from MPC cluster 130 for the user groups it should join. To do this, application 112 can initiate a dense privacy information retrieval (PIR) of computing systems MPC1 and MPC2 using any suitable dense privacy information retrieval (PIR) algorithm and implementation. Some implementations rely on distributed point functions (DPFs). For the i-th user group that application 112 should join, application 112 can generate two DPFs, g i and h i Such that if j = i, then g i (j)+h i (j) = 1, otherwise g i (j)+h i (j) = 0.

[0222] Application 112 can send a first request (630) to computing system MPC1. The first request can include the point function g for each user group that application 112 should join. i .

[0223] Application 112 can send a second request (632) to computing system MPC2. The second request can include the point function h for each user group that application 112 should join. i .

[0224] For each point function g i The computing system MPC1 calculates and returns the first secret share (634) of the user group identifier result to application 112. Application 112 can use the following relation 11 to calculate the first secret share of the user group identifier result.

[0225] Relation 11: result i，1 =∑ j g i (j)×group_id j

[0226] For each point function h i The computing system MPC2 calculates and returns the second secret share (636) of the user group identifier result to application 112. Application 112 can use the following relation 12 to calculate the second secret share of the user group identifier result.

[0227] Relation 12: result i，2 =∑ j hi (j)×group_id j

[0228] Application 112 can add a user to one or more user groups (638). Application 112 can use the first share of the user group as a result. i,1 Second share result i,2 This allows for the reconstruction of the user group identifier for each user group to which the user should join. For example, if the two secret shares are additive secret shares, application 112 can calculate the sum of the two secret shares to obtain the user group identifier for the user group. Then, application 112 can add the user group identifier to the user group list.

[0229] exist Figure 6 In process 600, the computing systems in the MPC cluster 130 do not know the centroid of the plaintext user group, nor do they know the application query parameters, i.e., the user profile, nor do they know the user group that the user will join, thus protecting user privacy.

[0230] In scenarios with relaxed privacy requirements, for example, computing systems MPC1 and MPC2 can know the plaintext query results, and can reconstruct the user group eligibility (eligible_group) from two secret shares. i The result, and if the corresponding eligible_group i If true, then only the user group identifier L will be included in the query response. i Return to application 112.

[0231] In some implementations, the training and querying of the centroid model can be performed by an aggregation service. This aggregation service can include an MPC cluster 130 and communicate with the content platform 150, for example, instead of communicating with the client device 110. In this case, when querying which user groups application 112 should join, for privacy reasons, application 112 may not send the user's profile to the content platform 150 for forwarding to the MPC cluster 130. One option would be to configure the content platform 150 to send the centroids of the user groups to application 112. However, this could consume significant bandwidth.

[0232] Another option for content platforms is to infer user groups for use based on the user's Secure Mobile ID (e.g., FLOC ID), first-party cookie data received from first-party cookies, and the URL of the digital component request. However, this may not be as accurate as the techniques described above.

[0233] Figure 7This is a flowchart illustrating an exemplary process 700 for determining user group outcomes (i.e., whether application 112 should join one or more user groups) based on user profile data and centroid model. The operation of process 700 can be implemented, for example, by MPC cluster 130. The operation of process 700 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 700.

[0234] A first request for a user group identifier is received (702). A first computing system (e.g., MPC1) of the MPC cluster 130 can receive the first request from an application 112 running on client device 110. Application 112 can send a corresponding second request to each other computing system (e.g., MPC2) of the MPC cluster 130. This request can be for a user group identifier to which the user is to be added, for example, for each user group whose user profile is within a threshold distance of the centroid of the user group.

[0235] Typically, each request can include user profile data from the user's profile. A first request can include first user profile data, and each second request sent to each second computing system can include corresponding second user profile data. The user profile data can vary based on the cryptographic techniques used.

[0236] For example, if the MPC process and horizontal partitioning are used to determine the centroid, as referenced... Figure 4 The user profile data for each request can include a corresponding portion of the user's user profile. If each computing system in the MPC cluster 130 has a centroid secret share, then the user profile data for each request can include a corresponding secret share of the user's user profile. In either case, the user profile data can also include the model identifier and threshold distance of the centroid model.

[0237] A set of user groups corresponding to model identifiers is identified (704). For example, content platform 150 or digital component provider 160 can enable MPC cluster 130 to generate centroid models for the user group sets. Each computing system in MPC cluster 130 can store data identifying, for example, user group identifiers corresponding to user groups in the centroid model by linking model identifiers with each user group identifier. The first computing system can identify the user group set based on the stored data. Each user group identifier and model identifier can be referred to as a centroid model and user group identifier pair.

[0238] For each user group in the user group set, the centroid of the user group is identified (706). When the MPC cluster 130 generates a centroid model, the MPC cluster 130 is able to determine the centroid of each user group corresponding to the centroid model. The form of the centroid can vary based on the cryptographic techniques used. For example, if the centroid is determined using the MPC process and horizontal partitioning, as referenced... Figure 4 The MPC cluster 130 can then have a centroid of a user group determined based on a portion (e.g., a half) of the sum of secret shares used to generate the centroid of the user profile. If secret shares are used, each computing system of the MPC cluster 130 can have a secret share of the centroid of the user group.

[0239] Determine the user group results (708). The user group results indicate one or more user groups to which users are to be added. For example, the user group results can indicate user groups with centroids within a threshold distance of the user's profile.

[0240] Transmit user group results (710). For example, the first computing system is able to transmit its user group results to application 112 running on client device 110.

[0241] The first computing system can determine user group results in different ways depending on the cryptographic technique used, and the user group results can vary based on the cryptographic technique used. For example, if horizontal partitioning is used, the first computing system can determine whether a first portion of the user profile included in the first user profile data for each user group in the user group set is within a threshold distance of the centroid of the user group previously determined by the first computing system, as referenced. Figure 5 As described above. In this example, the user group results can include user group identifiers for user groups whose centroids are within a threshold distance of the user's profile. Each other computing system can perform a similar process using its received centroid and a portion of the user profile. Each computing system can provide user group results that include user group identifiers for user groups whose centroids are within a threshold distance of the user's profile. The client device's application can then determine a list of user groups to add users to based on the user group results received from each computing system, as referenced. Figure 5 As stated above.

[0242] If secret shares are used, the user group results can include estimated flags for each user group in the user group set, as referenced. Figure 6The user group estimation flag indicates whether the application has correctly estimated whether a user should be added to the user group. Application 112 can use the estimation flag to determine whether to add a user to the user group, for example, based on whether application 112 estimated that the user should be added to the user group and whether the estimation was correct. If so, application 112 can query the MPC cluster 130 for the user group identifier corresponding to the estimation flag.

[0243] Exemplary process for generating and using k-NN models

[0244] Figure 8 This is a swimlane diagram of an exemplary process 800 for training a machine learning model and using the machine learning model to add users to a user group. The operation of process 800 can be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and content platform 150. The operation of process 800 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of these instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 800. Although process 800 and the other processes described below are based on two computing systems MPC cluster 130, MPC clusters with more than two computing systems can also be used to execute similar processes.

[0245] A machine learning model can be a k-NN model that represents the distance between user profiles or user profiles of user groups. When a k-NN model represents the distance between user profiles of user groups, each user group can be represented in a model using the centroids of the user groups.

[0246] Content platform 150 can initiate the training and / or updating of one of its machine learning models by requesting applications 112 running on client devices 110 to generate user profiles for their respective users and upload a secret share and / or encrypted version of the user profile to MPC cluster 130. For the purposes of this document, the secret share of the user profile can be considered an encrypted version of the user profile, as the secret share is not plaintext. During generation, each application 112 can store the user profile data and generate updated user profiles in response to requests received from content platform 150. Since the content of the user profiles and the machine learning models are different for different content platforms 150, applications 112 running on user client devices 110 can maintain data for multiple user profiles and generate multiple user profiles, each specific to a particular content platform.

[0247] Application 112 running on client device 110 builds a user profile (802) for the user of client device 110. The user profile may include data related to events initiated by the user and / or events that may have been initiated by the user regarding electronic resources (e.g., web pages or application content). Events may include viewing of electronic resources, viewing of digital components, user interaction with electronic resources or digital components (e.g., selection of electronic resources or digital components) or the absence of user interaction with electronic resources or digital components (e.g., selection of electronic resources or digital components), conversions that occur after the user interacts with electronic resources, and / or other appropriate events related to the user and electronic resources. Some examples of user interactions performed by the user may be interactions with specific items presented on a web page, such as one or more of the following: (a) clicking a link to a specific item, (b) completing a conversion of a specific item by, for example, adding the item to a virtual shopping cart or purchasing the item, (c) viewing a specific item for more than a preset amount of time. Examples of missing user interactions include a user performing an interaction but lacking a follow-up interaction; for example, a user viewing a digital component but not clicking it; clicking a digital component but not converting (e.g., clicking to go to the checkout page but not purchasing an item); and so on. Conversions can be defined differently in different implementations. For example, in some implementations, a conversion might be the user navigating to the checkout page. In some implementations, a conversion might be the user attempting to purchase an item. In other implementations, a conversion might be the user purchasing an item.

[0248] A user's profile can be specific to content platform 150, or a selected machine learning model owned by content platform 150. For example, see the reference below. Figure 9 In more detail, each content platform 150 can request application 112 to generate or update user profiles specific to that content platform 150.

[0249] A user's profile can be in the form of a feature vector. For example, a user profile can be an n-dimensional feature vector. Each of the n dimensions can correspond to a specific feature, and the value of each dimension can be the value of that feature. For example, one dimension could be used to indicate whether a particular digital component has been presented to the user (or interacted with). In this example, if the digital component has been presented to the user (or interacted with), the value of that feature could be "1", or if the digital component has not been presented to the user (or interacted with), the value of that feature could be "0". An exemplary process for generating a user's profile is described in... Figure 9 It is shown in the figure and described below.

[0250] In some implementations, content platform 150 may want to train a machine learning model based on additional signals, such as contextual signals, signals related to a specific digital component, or user-related signals that application 112 may not know or may not access, such as the current weather at the user's location. For example, if a digital component is presented to a user in a specific context, content platform 150 may want to train a machine learning model to predict whether the user will interact with the specific digital component. In this example, for each presentation of a digital component to the user, the contextual signals could include the current geographic location of client device 110 (if the user grants permission), signals describing the content of the electronic resource that presents the digital component with it, and signals describing the digital component, such as the content of the digital component, the type of the digital component, where the digital component is presented on the electronic resource, etc. In another example, a dimension could be used to determine whether the digital component presented to the user is of a specific type. In this example, the value could be 1 for travel, 2 for cooking, 3 for movies, and so on. For ease of subsequent description, P i This will represent both the user profile and any additional signals associated with the i-th user profile (e.g., context signals and / or digital component-level signals).

[0251] Application 112 generates user profiles P i The share (804). In this example, application 112 generates user profile P. i Two shares are generated, one share for each computing system in the MPC cluster 130. Note that each share can be a random variable itself and does not disclose any information about the user profile. The two shares will need to be combined to obtain the user profile. If the MPC cluster 130 includes more computing systems participating in the training of machine learning models, application 112 will generate more shares, one share for each computing system. In some implementations, to protect user privacy, application 112 can use a pseudo-random function to generate the user profile P. i It is split into shares. In other words, application 112 can use the pseudo-random function PRF(P i To generate two shares {[P]} i,1 ],[P i,2 Precise partitioning can depend on the secret sharing algorithm and cryptographic library used by application 112.

[0252] In some implementations, application 112 may also provide one or more tags to MPC cluster 130. While tags may not be used in training machine learning models with certain architectures (e.g., k-NN), they can be used to fine-tune hyperparameters controlling the model training process (e.g., the value of k), evaluate the quality of the trained machine learning model, or make predictions, i.e., determine whether to suggest user groups for a user. Tags may include one or more user group identifiers, such as those of a user and accessible to content platform 150. That is, tags may include user group identifiers of user groups managed by content platform 150 or of user groups that content platform 150 has read access to. In some implementations, a single tag may include multiple user group identifiers for a user. In some implementations, a user's tags may be heterogeneous and include all user groups to which the user is a member, along with additional information, such as whether the user interacted with a given digital component (e.g., viewed, clicked, and / or converted). This allows the k-NN model to be used to predict whether another user will interact with a given digital component. Tags for each user profile may indicate the user group membership of the user corresponding to that user profile.

[0253] User profile tag predictions correspond to user groups to which the input user will be added or should be added. For example, tags corresponding to the k nearest neighbor user profiles of the input user profile can predict user groups to which the user corresponding to the input user profile will or should be added, based on the similarity between user profiles. These predicted tags can be used to suggest user groups to users or request the application to add users to user groups corresponding to the tags.

[0254] If labels are included, application 112 can also include each label. i Break it down into shares, for example [label] i,1 ] and [label i,2 In this way, without collusion between computing systems MPC1 and MPC2, neither MPC1 nor MPC2 can obtain [P]. i,1 ] or [P i,2 Reconstruct P i , or from [label] i,1 ] or [label] i,2 Reconstruct the label i .

[0255] Application 112 pairs of user profiles P i share [P] i,1 ] or [P i,2 ] and / or each label i share [label] i,1 ] or [label]i,2 Encryption is performed (806). In some implementations, application 112 generates a user profile P. i The first share [P] i,1 ] and label i First share [label] i,1 The synthesized message is generated using the encryption key of the computing system MPC1, and the synthesized message is encrypted using the encryption key of the computing system MPC1. Similarly, application 112 generates user profile P. i The second share [P] i,2 ] and label i Second share [label] i,2 The synthesized message is generated using the encryption key of the computing system MPC2, and the synthesized message is encrypted using the encryption key of the computing system MPC2. These functions can be represented as PubKeyEncrypt([P i,1 ]||[label i,1 ],MPC1) and PubKeyEncrypt([P i,2 ]||[label i,2 ], MPC2), where PubKeyEncrypt represents the public-key encryption algorithm using the corresponding public key of MPC1 or MPC2. The symbol "||" represents a reversible method for composing complex messages from multiple simple messages, such as JavaScript Object Representation (JSON), Concise Binary Object Representation (CBOR), or protocol buffers.

[0256] Application 112 provides encrypted shares to content platform 150 (808). For example, application 112 can transmit encrypted shares of user profiles and tags to content platform 150. Because each share is encrypted using the encryption key of computing system MPC1 or MPC2, content platform 150 cannot access the user's user profile or tags.

[0257] Content platform 150 can receive user profile shares and tag shares from multiple client devices. Content platform 150 can initiate training of a machine learning model by uploading user profile shares to computing systems MPC1 and MPC2. Although tags may not be used during training, content platform 150 can upload tag shares to computing systems MPC1 and MPC2 for use when evaluating model quality or querying the model later.

[0258] Content platform 150 will receive the first encrypted share (e.g., PubKeyEncrypt([P...)) from each client device 110. i,1 ]||[label i,1The content platform 150 uploads the second encrypted share (e.g., PubKeyEncrypt([P, MPC1)) to the computing system MPC1(810). Similarly, the content platform 150 uploads the second encrypted share (e.g., PubKeyEncrypt([P, MPC1)) to the computing system MPC1(810). i,2 ]||[label i,2 The MPC2 upload is sent to the computing system MPC2(812). Both uploads can be batched and can include encrypted portions of user profiles and tags received during a specific time period for training the machine learning model.

[0259] In some implementations, the order in which content platform 150 uploads the first encrypted share to computing system MPC1 must match the order in which content platform 150 uploads the second encrypted share to computing system MPC2. This allows computing systems MPC1 and MPC2 to properly match two shares with the same secret, for example, two shares of the same user profile.

[0260] In some implementations, content platform 150 may explicitly assign the same pseudo-random or sequentially generated identifier to shares of the same secret to facilitate matching. While some MPC techniques can rely on random shuffling of inputs or intermediate results, the MPC techniques described in this document may not include such random shuffling and may instead rely on the upload order for matching.

[0261] In some implementations, operations 808, 810, and 812 can be replaced by alternative processes, wherein application 112 directly applies [P] i,1 ]||[label i,1 Upload [P] to MPC1 and then... i,2 ]||[label i,2 Upload to MPC2. This alternative process reduces the infrastructure costs of content platform 150 to support operations 808, 810, and 812, and reduces the latency of starting to train or update machine learning models in MPC1 and MPC2.

[0262] In some implementations where training models is desired based on user conversions of digital components, it may be considered that conversions often occur long after a display or click. In such cases, it may be advantageous to keep content platform 150 available to perform other tasks to optimize its bandwidth, storage, and processing. In such implementations, operations 808, 810, and 812 can be replaced by an alternative process in which (i) application 112 transmits encrypted portions of user profiles and tags along with a first-party cookie to a demand-side platform (DSP), which may be part of content platform 150 in some implementations and separate from it in others; (ii) the DSP then uses the first-party cookie to map (i.e., associate) the encrypted portions of user profiles and tags with conversion-specific interaction data (e.g., whether the conversion occurred within a preset time period such as 30 days); and (iii) the DSP transmits this mapping to computing systems MPC1 or MPC2 to train a machine learning model. Other functionalities of content platform 150 as described with reference to operations 808, 810, and 812 can be performed by the DSP in these implementations. While this description focuses on the conversion interaction, the architecture and functionality can be extended to any other interaction (e.g., display or click), or any combination of interactions (e.g., display, click, and / or conversion).

[0263] Computing systems MPC1 and MPC2 generate machine learning models (814). Each generation of a new machine learning model based on user profile data can be referred to as a training session. Computing systems MPC1 and MPC2 can train machine learning models based on encrypted portions of user profiles received from client device 110. For example, computing systems MPC1 and MPC2 can use MPC technology to train a k-NN model based on portions of user profiles.

[0264] To minimize or at least reduce cryptographic computation, and thus minimize or at least reduce the computational burden placed on computing systems MPC1 and MPC2 during both model training and inference to protect user privacy and data, MPC cluster 130 is able to use random projection techniques, such as SimHash, to quickly, securely, and probabilistically quantize two user profiles P. i and P j The similarity between them. It is possible to determine the similarity between two user profiles P. i and P j The Hamming distance between two bit vectors determines the two user profiles P. i and P j The similarity between the two profiles is proportional to the cosine distance between them with a high probability.

[0265] Conceptually, for each training session, it is possible to generate m random projected hyperplanes U = {U1, U2, ..., U...} m The random projection hyperplane can also be called the random projection plane. One purpose of the multi-step computation between computation systems MPC1 and MPC2 is to compute for each user profile P used in the training of the k-NN model. i Create a bit vector B of length m. i In the bit vector B i In, each bit B i，j Represents the projection plane U j One of the user profiles P i The sign of the dot product, that is, for all j∈[1, m], B i，j =sign(U j ⊙P i ), where ⊙ represents the dot product of two vectors of equal length. That is, each bit represents the user profile P. i Located in plane U j Which side? A bit value of 1 indicates a positive sign, while a bit value of 0 indicates a negative sign.

[0266] At the end of each multi-step computation, each of the two computation systems, MPC1 and MPC2, generates an intermediate result comprising the bit vector of each user profile in plaintext, the share of each user profile, and the share of each user profile's label. For example, the intermediate result of computation system MPC1 could be the data shown in Table 11 below. Computation system MPC2 would have a similar intermediate result, but with different shares for each user profile and each label. To add additional privacy protection, each of the two servers in the MPC cluster 130 only obtains half of the m-dimensional bit vector of plaintext; for example, computation system MPC1 obtains the first m / 2 dimensions of all m-dimensional bit vectors, and computation system MPC2 obtains the last m / 2 dimensions of all m-dimensional bit vectors.

[0267] plaintext bit vector <![CDATA[P i MPC1 share <![CDATA[label i MPC1 share … … … <![CDATA[B i ]]> … … <![CDATA[B i+1 ]]> … … … … …

[0268] Table 11

[0269] Given two arbitrary user profile vectors P of unit length i ≠ j i and P j It has been shown that, assuming the number of random projections m is sufficiently large, the two user profile vectors P i and P j bit vector B i and B j The Hamming distance between them has a high probability of being related to the user profile vector P. i and P j The cosine distance between them is proportional.

[0270] Based on the intermediate results shown above, and because of bit vector B i This is plaintext, so each computing system MPC1 and MPC2 can independently create a corresponding k-NN model using a k-NN algorithm (e.g., through training). Computing systems MPC1 and MPC2 can use the same or different k-NN algorithms. An exemplary process for training a k-NN model is described in... Figure 10 It is shown in the diagram and described below. Once the k-NN model is trained, application 112 is able to query the k-NN model to determine whether to add the user to the user group.

[0271] Application 112 submits an inference request (816) to MPC cluster 130. In this example, application 112 forwards the inference request to computing system MPC1. In other examples, application 112 may forward the inference request to computing system MPC2. Application 112 may submit an inference request in response to a request to submit an inference request from content platform 150. For example, content platform 150 may request application 112 to query the k-NN model to determine whether a user of client device 110 should be added to a specific user group. This request may be referred to as an inference request to infer whether a user should be added to a user group.

[0272] In order to initiate an inference request, content platform 150 can send an inference request token M to application 112. infer Inferring request token M infer This enables the servers in MPC cluster 130 to verify that application 112 is authorized to query a specific machine learning model owned by a specific domain. If model access control is optional, the request token M is inferred. infer It is optional. Infer request token M infer It is possible to have the following entries shown and described in Table 12 below.

[0273]

[0274]

[0275] Table 12

[0276] In this example, the request token M is inferred. infer The digital signature is generated based on seven entries and a private key from the content platform 150. eTLD+1 is the valid top-level domain (eTLD) plus one level above the public suffix. An example eTLD+1 is "example.com", where ".com" is the top-level domain.

[0277] In order to request inferences about a specific user, content platform 150 can generate an inference request token M. inferThe token is then sent to application 112 running on the user's client device 110. In some implementations, content platform 150 uses the public key of application 112 to infer the request token M. infer Encryption is performed so that only application 112 can use its secret private key, which corresponds to the public key, to decrypt the inference request token M. infer In other words, the content platform can send PubKeyEnc(M) to application 112. infer ,application_public_key).

[0278] Application 112 is able to decrypt and verify the inference request token M infer Application 112 is able to use its private key to decrypt the encrypted inference request token M. infer Application 112 can verify the inferred request token M through the following operations. infer (i) Verify the digital signature using the public key of the content platform 150 corresponding to the private key used to generate the digital signature, and (ii) ensure that the token creation timestamp is not outdated, for example, that the time indicated by the timestamp is within a threshold amount of time for the current time at which verification is performed. If the request token M is inferred... infer If valid, application 112 can query MPC cluster 130.

[0279] Conceptually, an inference request can include the model identifier of the machine learning model, the current user profile, and so on. i , k (the number of nearest neighbors to extract), optional additional signals (e.g., context signals or digital component signals), aggregation function, and aggregation function parameters. However, to prevent plaintext user profiles P i This prevents leakage to computing systems MPC1 or MPC2, thereby protecting user privacy. Application 112 can also disclose user profiles. i Split into two shares for MPC1 and MPC2 respectively [P i,1 ] and [P i,2 Then, application 112 can, for example, randomly or pseudo-randomly select one of two computing systems, MPC1 or MPC2, for the query. If application 112 selects computing system MPC1, then application 112 can send a message with a first share [P] to computing system MPC1. i,1 The second share of the encrypted version (e.g., PubKeyEncrypt([P i,2 A single request from [MPC2]. In this example, application 112 uses the public key of computing system MPC2 to encrypt the second share [P]. i,2 ], to prevent the computing system MPC1 from accessing [P i,2 This will enable the computing system MPC1 to access [P] i,1] and [P i,2 Rebuild User Profile P i .

[0280] As described in more detail below, computing systems MPC1 and MPC2 collaboratively compute user profile P. i The k nearest neighbors are then determined. The computational systems MPC1 and MPC2 can then use one of several possible machine learning techniques (e.g., binary classification, multi-class classification, regression, etc.) to determine whether to add a user to a user group based on the user profiles of the k nearest neighbors. For example, an aggregation function can identify machine learning techniques (e.g., binary, multi-class, regression), and the aggregation function parameters can be based on the aggregation function.

[0281] In some implementations, the aggregation function parameters can include the user group identifier for the user group for which content platform 150 is querying the k-NN model. For example, content platform 150 might want to know whether to add the user to a user group that is related to hiking and has the user group identifier "hiking". Typically, computing systems MPC1 and MPC2 can determine whether to add the user to the user group based on the number of k nearest neighbors that are members of the user group (e.g., based on their labels).

[0282] MPC cluster 130 provides inference results (818) to application 112. In this example, computing system MPC1, which receives the query, sends the inference results to application 112. The inference results can indicate whether application 112 should add a user to zero or more user groups. For example, the user group result can specify the user group identifier of the user group. However, in this example, computing system MPC1 will know the user group. To prevent this, computing system MPC1 can calculate a share of the inference results, and computing system MPC2 can calculate another share of the same inference results. Computing system MPC2 can provide computing system MPC1 with an encrypted version of its share, wherein the share is encrypted using the public key of application 112. Computing system MPC1 can provide application 112 with encrypted versions of its share of the inference results and the share of computing system MPC2 of the user group results. Application 112 can decrypt the share of computing system MPC2 and calculate the inference results based on the two shares. An exemplary process for querying a k-NN model to determine whether to add a user to a user group is described in Figure 11 The results are shown in the diagram and described below. In some implementations, to prevent computing system MPC1 from forging the results of computing system MPC2, computing system MPC2 digitally signs its results before or after encrypting them using the public key of application 112. Application 112 uses the public key of MPC2 to verify the digital signature of computing system MPC2.

[0283] Application 112 updates the user's list of user groups (820). For example, if the inference is that the user should be added to a specific user group, application 112 can add the user to the user group. In some implementations, application 112 can prompt the user to allow the user to be added to the user group.

[0284] Application 112 transmits a request for content (822). For example, application 112 may transmit a request for a digital component to content platform 150 in response to loading an electronic resource with a digital component slot. In some embodiments, the request may include one or more user group identifiers that include a user group as a member. For example, application 112 may obtain one or more user group identifiers from a list of user groups and provide the user group identifier(s) along with the request. In some embodiments, techniques may be used to prevent the content platform from associating the user group identifier with the user from whom the request was received, application 112, and / or client device 112.

[0285] Content platform 150 delivers content to application 112 (824). For example, content platform 150 may select digital components based on one or more user group identifiers and provide the digital components to application 112. In some implementations, content platform 150 cooperates with application 112 to select digital components based on one or more user group identifiers without exposing the one or more user group identifiers to outside application 112.

[0286] Application 112 displays or otherwise implements the received content (826). For example, application 112 can display the received digital component in the digital component slot of the electronic resource.

[0287] Exemplary process for generating user profiles using a k-NN model

[0288] Figure 9 This is a flowchart illustrating an exemplary process 900 for generating user profiles and sending portions of the user profiles to an MPC cluster. The operation of process 900 can be performed, for example, by... Figure 1 The operation of process 900 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 900.

[0289] Application 112, running on the user's client device 110, receives event data (902). An event can be, for example, the presentation of an electronic resource at client device 110, the presentation of a digital component at client device 110, user interaction with the electronic resource or digital component at client device 110, or a conversion of the digital component, or the absence of user interaction or conversion with the presented electronic resource or digital component. Some examples of user interaction by the user can be interaction with a specific item presented on a webpage, such as one or more of the following: (a) clicking a link to the specific item, (b) completing a conversion of the specific item by, for example, adding the item to a virtual shopping cart or purchasing the item, (c) viewing the specific item for more than a preset amount of time. Some examples of the absence of a specific user interaction can be that the user performs some interaction but lacks subsequent interaction; for example, the user views a digital component but does not click it; clicks a digital component but does not convert it (e.g., clicks to go to the checkout page but does not purchase the item); etc. Conversions can be defined differently in different implementations. For example, in some implementations, a conversion can be the user navigating to the checkout page. In some implementations, a conversion can be the user attempting to purchase an item. In other implementations, the conversion could be a user purchasing an item. When an event occurs, the content platform 150 can provide the application 112 with event-related data for use in generating the user's profile.

[0290] Application 112 can generate different user profiles for each content platform 150. That is, a user's profile and the user profile for a specific content platform 150 can include only event data received from that specific content platform 150. This protects user privacy by not sharing event-related data with other content platforms. In some implementations, upon request from content platform 150, application 112 can generate different user profiles for each machine learning model owned by content platform 150. Different machine learning models may require different training data based on design goals. For example, a first model might be used to determine whether to add a user to a user group. A second model might be used to predict whether a user will interact with a digital component. In this example, the user profile of the second model can include additional data not present in the user profile of the first model, such as whether the user interacted with the digital component.

[0291] Content platform 150 can update token M with a brief profile. update Event data is sent in the form of a brief update token M. update It has the following entries shown and described in Table 1 above.

[0292] A model identifier identifies a machine learning model, such as a k-NN model, for which user profiles will be used for training or for user group inference. A profile record is an n-dimensional feature vector that includes event-specific data, such as the type of event, electronic resource or digital component, the time of the event, and / or other appropriate event data that content platform 150 wants to use in training the machine learning model and for user group inference. A digital signature is generated based on seven entries using content platform 150's private key.

[0293] In some implementations, in order to protect the update token M during transmission update Content platform 150 will update token M update Update token M before sending to application 112 update Encryption is performed. For example, content platform 150 can use the application's public key (e.g., PubKeyEnc(M)). update The application_public_key is used to encrypt the update token M. update .

[0294] In some implementations, content platform 150 can send event data to application 112 without updating token M via profile. update Event data or update requests are encoded in a specific format. For example, a script originating from a content platform 150 running within application 112 can directly transmit event data and update requests to application 112 via a script API, where application 112 relies on a W3C-origin security model and / or HTTPS to protect the event data and update requests from forgery or disclosure.

[0295] Application 112 stores the event data (904). If the event data is encrypted, application 112 can decrypt the event data using its private key corresponding to the public key used to encrypt the event data. If the event data is updated with token M... update If the event data is sent in the form of [the event token M], then application 112 can verify the update token M before storing the event data. update Application 112 can verify the update token M through the following operations. update (i) Verify the digital signature using the public key of the content platform 150 corresponding to the private key used to generate the digital signature, and (ii) ensure that the token creation timestamp is not outdated, for example, that the time indicated by the timestamp is within a threshold time amount of the current time at which verification is performed. If the token M is updated... update If valid, application 112 can store the event data, for example, by storing an n-dimensional profile record. If any validation fails, application 112 can ignore the update request, for example, by not storing the event data.

[0296] For each machine learning model, for example, for each unique model identifier, application 112 can store the event data of that model. For example, application 112 can maintain a data structure for each unique model identifier that includes a set of n-dimensional feature vectors (e.g., a profile record of an update token), and maintain an expiration time for each feature vector. An exemplary data structure for the model identifier is shown in Table 2 above.

[0297] Upon receiving a valid update token M update At that time, application 112 can update the token M. update The feature vector and expiration time are added to the data structure to update the token M. update The data structure for model identifiers. Periodically, application 112 can remove expired feature vectors from the data structure to reduce storage size.

[0298] Application 112 determines whether to generate a user profile (906). For example, application 112 may generate a user profile for a specific machine learning model in response to a request from content platform 150. This request may be to generate a user profile and return a share of the user profile to content platform 150. In some implementations, application 112 may upload the generated user profiles directly to MPC cluster 130, for example, instead of sending them to content platform 150. To ensure the security of requests to generate and return shares of user profiles, content platform 150 may send an upload token M to application 112. upload .

[0299] Upload Token M upload Able to have update token M update Similar structure, but with different operations (e.g., "update server" instead of "accumulate user profiles"). Upload token M upload It can also include additional entries for operational delays. As application 112 accumulates more event data (e.g., more feature vectors), the operational delay can instruct application 112 to delay the calculation and uploading of user profiles. This allows machine learning models to capture user event data immediately before and after key events (e.g., joining a user group). The operational delay can specify a delay period. In this example, a digital signature can be generated using the content platform's private key, based on the other seven entries in Table 1 and the operational delay. The content platform 150 can then use the update token M... update (For example, PubKeyEnc(M) upload A similar approach, using the application's public key, is used to encrypt the upload token M. upload To protect the upload token M during transmission upload .

[0300] Application 112 can receive upload token M upload If the token M is uploaded upload If encrypted, then the upload token M upload Decrypt and verify the uploaded token M. upload This verification is similar to verifying the update token M. update Application 112 can verify the upload token M through the following operations. upload (i) Verify the digital signature using the public key of the content platform 150 corresponding to the private key used to generate the digital signature, and (ii) ensure that the token creation timestamp is not outdated, for example, that the time indicated by the timestamp is within a threshold time amount of the current time at which verification is performed. If the uploaded token M upload If valid, application 112 can generate a user profile. If any verification fails, application 112 can ignore the upload request, for example, by not generating a user profile.

[0301] In some implementations, content platform 150 can request application 112 to upload a user profile instead of using a profile upload token M. upload The upload request is encoded in a specific format. For example, a script originating from a content platform 150 running within application 112 can send the upload request directly to application 112 via a script API, where application 112 relies on a W3C-origin security model and / or HTTPS to protect the upload request from forgery or disclosure.

[0302] If a decision is made not to generate a user profile, process 902 can return to operation 902 and wait for additional event data from content platform 150. If a decision is made to generate a user profile, application 112 generates the user profile (908).

[0303] Application 112 can generate user profiles based on stored event data, such as data stored in the data structure shown in Table 2. Application 112 can also generate user profiles based on model identifiers included in the request (e.g., upload token M). upload The content platform eTLD+1 domain of entry 1 and the model identifier of entry 2 are used to access the appropriate data structure.

[0304] Application 112 can compute user profiles by aggregating n-dimensional feature vectors in a data structure over unexpired study periods. For example, a user profile can be the average of n-dimensional feature vectors in a data structure over unexpired study periods. The result is an n-dimensional feature vector representing the user in the profile space. Optionally, application 112 can normalize the n-dimensional feature vectors to unit length, for example, using L2 normalization. Content platform 150 can specify optional study periods.

[0305] In some implementations, the decay rate can be used to calculate user profiles. Since there may be many content platforms 150 using the MPC cluster 130 to train machine learning models, and each content platform 150 may have multiple machine learning models, storing user feature vector data can lead to significant data storage requirements. Using decay techniques can significantly reduce the amount of data stored at each client device 110 for the purpose of generating user profiles for training machine learning models.

[0306] Suppose that, for a given machine learning model, there exist k feature vectors {F1, F2, ..., Fk}. k Each feature vector is an n-dimensional vector and its corresponding time of existence (record_age_in_seconds). i Application 112 can use the following relation 13 to calculate user profiles:

[0307] Relation 13:

[0308] In this relation, the parameter record_age_in_seconds i This is the amount of time, in seconds, that the profile record has been stored at the client device 110, and the parameter decay_rate_in_seconds is (for example, in the update token M) update The decay rate of the profile record (received in entry 6) in seconds. In this way, the updated feature vector carries more weight. This also allows application 112 to avoid storing feature vectors and use only constant storage to store profile records. Instead of storing multiple separate feature vectors for each model identifier, application 112 only needs to store an n-dimensional vector P and a timestamp user_profile_time for each model identifier.

[0309] To initialize the n-dimensional vector user profile P and timestamp, the application can set the vector P to an n-dimensional vector where each dimension has a value of zero, and set user_profile_time to the epoch. To use the new feature vector F at any time... x To update the user profile P, application 112 can use the following relation 14:

[0310] Relation 14:

[0311] When using relation 14 to update a user profile, application 112 can also update the user profile time to the current time (current_time). Note that if application 112 calculates the user profile using the decay rate algorithm described above, operation 904 is omitted.

[0312] Application 112 generates a share (910) of the user profile. Application 112 can use a pseudo-random function to generate the user profile P. i (For example, an n-dimensional vector P) can be split into shares. That is, application 112 can use the pseudo-random function PRF(P) i To generate a user profile P i Two shares {[P i,1 ],[P i,2 The precise splitting can depend on the secret-sharing algorithm and cryptographic library used by application 112. In some implementations, the application uses the Shamir secret-sharing scheme. If shares of one or more tags are being provided, application 112 can also generate shares of the tags.

[0313] Application 112 pairs of user profiles P i share {[P i,1 ],[P i,2 Encryption is performed (912). For example, as described above, application 112 can generate a composite message including a share of user profile and tags, and encrypt the composite message to obtain the encryption result PubKeyEncrypt([P i,1 ]||[label i,1 ],MPC1) and PubKeyEncrypt([P i,2 ]||[label i,2 [, MPC2]. The share is encrypted using the encryption key of MPC cluster 130 to prevent content platform 150 from accessing the plaintext user profile. Application 112 transmits the encrypted share to the content platform (914). Note that if application 112 transmits the secret share directly to computing systems MPC1 and MPC2, operation 914 is omitted.

[0314] Exemplary process for generating and using k-NN models

[0315] Figure 10 This is a flowchart illustrating an exemplary process 1000 for generating a machine learning model. The operation of process 1000 can be, for example, by... Figure 1 The MPC cluster 130 is implemented. The operation of process 1000 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and the execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of process 1000.

[0316] MPC cluster 130 obtains a share of the user profile (1002). Content platform 150 can request MPC cluster 130 to train a machine learning model by sending the share of the user profile to MPC cluster 130. Content platform 150 can access encrypted shares received from client device 110 for machine learning models within a given time period and upload those shares to MPC cluster 130.

[0317] For example, content platform 150 can send a profile P for each user to computing system MPC1. i The first encrypted share of the user profile and the first encrypted share of its tag (e.g., PubKeyEncrypt([P i,1 ]||[label i,1 Similarly, content platform 150 can transmit user profiles P to computing system MPC2. i The encrypted second share of the user profile and the encrypted second share of its tag (e.g., PubKeyEncrypt([P i,2 ]||[label i,2 ]).

[0318] In some implementations where application 112 sends a secret share of a user profile directly to MPC cluster 130, content platform 150 can request MPC cluster 130 to train a machine learning model by sending a training request to MPC cluster 130.

[0319] Computational systems MPC1 and MPC2 create a random projection plane (1004). Computational systems MPC1 and MPC2 can collaboratively create m random projection planes U = {U1, U2, ..., U...}. m These random projection planes should be kept as a secret share between the two computing systems, MPC1 and MPC2. In some implementations, computing systems MPC1 and MPC2 create random projection planes and use Diffie-Hellman key exchange techniques to maintain their confidentiality.

[0320] As described in more detail below, computation systems MPC1 and MPC2 project their shares from each user profile onto each random projection plane, and for each random projection plane, determine whether the user profile's share lies on one side of the random projection plane. Then, each computation system MPC1 and MPC2 is able to construct a bit vector from the secret shares of the user profile based on the result of each random projection. Partial knowledge of the user's bit vector (e.g., user profile P) i Is it on the projection plane U? k (On one side) allows computing systems MPC1 or MPC2 to obtain information about P iSome knowledge about the distribution of P, which is relevant to user profiles. i Prior knowledge of unit length is incremental. To prevent computing systems MPC1 and MPC2 from gaining access to this information (e.g., in embodiments where this is necessary or preferred for user privacy and / or data security), in some embodiments, the random projection plane is in a secret share, so neither computing systems MPC1 nor MPC2 can access the plaintext random projection plane. In other embodiments, a random bit-flipping pattern can be applied to the random projection result using a secret-sharing algorithm, as described in optional operations 1006-1008.

[0321] To illustrate how bits can be flipped via secret shares, assume there are two secrets, x and y, whose values ​​are either zero or one with equal probability. If y == 0, the equation [x] == [y] will flip the bits of x, and if y == 1, the bits of x will remain unchanged. In this example, the operation will randomly flip the bit x with a 50% probability. This operation requires a remote procedure call (RPC) between two computing systems, MPC1 and MPC2, and the number of rounds depends on the data size and the secret-sharing algorithm chosen.

[0322] Each computing system, MPC1 and MPC2, creates a secret m-dimensional vector (1006). Computing system MPC1 is capable of creating a secret m-dimensional vector {S1, S2, ..., S...}. m}, where each element S i Each has a value of zero or one with equal probability. The computational system MPC1 splits its m-dimensional vector into two shares, the first share [S 1,1 ],[S 2,1 ],…[S m,1 ]} and the second share {[S 1,2 ],[S 2,2 ],…[S m,2 The computational system MPC1 can keep the first share secret and provide the second share to the computational system MPC2. Then, the computational system MPC1 can discard the m-dimensional vector {S1, S2, ... S}. m}

[0323] The computational system MPC2 can create secret m-dimensional vectors {T1, T2, ..., T}. m}, where each element T i It has a value of zero or one. The computational system MPC2 splits its m-dimensional vector into two shares, the first share [T 1,1 ],[T 2,1 ],…[T m,1 ]} and the second share {[T 1,2 ],[T 2,2 ],…[T m,2The computational system MPC2 can keep the first share secret and provide the second share to the computational system MPC1. Then, the computational system MPC2 can discard the m-dimensional vector {T1,T2,…T}. m}

[0324] Two computing systems, MPC1 and MPC2, use secure MPC technology to calculate the share of bit-flipped modes (1008). Computing systems MPC1 and MPC2 can calculate the share of bit-flipped modes using a secure share MPC equation test involving multiple round trips between computing systems MPC1 and MPC2. A bit-flipped mode can be based on the above operation [x] == [y]. That is, a bit-flipped mode can be {S1 == T1, S2 == T2, ... S...} m ==T m Let each ST i =(S i ==T i Each ST i It has a value of zero or one. After the MPC operation is completed, the computing system MPC1 has the first share of the bit-flipped mode {[ST 1,1 [ST] 2,1 ],…[ST m,1 ]}, and compute system MPC2 has a second share {[ST] in bit-flip mode. 1,2 [ST] 2,2 ],…[ST m,2 Each ST i The share allows the two computing systems MPC1 and MPC2 to flip bits in the bit vector in a way that is opaque to either of the two computing systems MPC1 and MPC2.

[0325] Each computing system MPC1 and MPC2 projects the share of each user profile onto each random projection plane (1010). That is, for each user profile whose share is received by computing system MPC1, computing system MPC1 is able to project the share [P]... i,1 Projected onto each projection plane U j Above. For each share of the user profile and each random projection plane U j Performing this operation yields a z x m dimensional matrix R, where z is the number of available user profiles and m is the number of random projection planes. Each element R in matrix R... i,j It is possible to calculate the projection plane U j With share [P] i,1 The dot product between ] is used to determine, for example, R i,j =U j ⊙[P i，1 The operation ⊙ represents the dot product of two vectors of equal length.

[0326] If bit flipping is used, computation system MPC1 can modify one or more elements R in the matrix using a bit flipping pattern secretly shared between computation systems MPC1 and MPC2. i,j The value of . For each element R of matrix R. i,j The computing system MPC1 can calculate [ST] j,1 ]==sign(R i,j ) as element R i,j The value of R. Therefore, if element R i,j Bit [ST] in bit flip mode j,1 If the corresponding bit in element R has a value of zero, then element R... i,j The sign will be flipped. This calculation requires multiple RPCs on the computing system MPC2.

[0327] Similarly, for each user profile for which the computing system MPC2 receives a share, the computing system MPC2 is able to allocate the share [P] i,2 Projected onto each projection plane U j Above. For each share of the user profile and each random projection plane U j Performing this operation yields a z x m dimensional matrix R', where z is the number of available user profiles and m is the number of random projection planes. Each element R in matrix R'... i,j 'Able to calculate the projection plane U j With share [P] i,2 The dot product between ] is used to determine, for example, R i,’j =U j ⊙[P i，2 The operation ⊙ represents the dot product of two vectors of equal length.

[0328] If bit flipping is used, computation system MPC2 can modify one or more elements R in a matrix using a bit flipping pattern secretly shared between computation systems MPC1 and MPC2. i,j The value of '. For each element R in matrix R. i,j The computing system MPC2 can calculate [ST] j,2 ]==sign(R i,j ') as element R i,j The value of '. Therefore, if element R i,j 'Bit ST in bit flip mode j If the corresponding bit in element R has a value of zero, then element R... i,j The sign of ' will be flipped. This calculation can be performed using multiple RPCs on the computing system MPC1.

[0329] Computation systems MPC1 and MPC2 reconstruct the bit vector (1012). Computation systems MPC1 and MPC2 are capable of reconstructing the bit vector of a user profile based on matrices R and R' of exactly the same size. For example, computation system MPC1 can send a portion of the columns of matrix R, and computation system MPC2 can send the remaining portion of the columns of matrix R' to MPC1. In a specific example, computation system MPC1 can send the first half of the columns of matrix R to computation system MPC2, and computation system MPC2 can send the second half of the columns of matrix R' to MPC1. Although columns are used for horizontal reconstruction in this example and are preferably used to protect user privacy, rows can be used for vertical reconstruction in other examples.

[0330] In this example, computing system MPC2 combines the first half of the columns of matrix R' with the first half of the columns of matrix R received from computing system MPC1 to reconstruct the first half (i.e., m / 2-dimensional) of the bit vector of the plaintext. Similarly, computing system MPC1 combines the second half of the columns of matrix R with the second half of the columns of matrix R' received from computing system MPC2 to reconstruct the second half (i.e., m / 2-dimensional) of the bit vector of the plaintext. Conceptually, computing systems MPC1 and MPC2 have now combined corresponding shares in the two matrices R and R' to reconstruct the bit matrix B of the plaintext. This bit matrix B will include the bit vector of the projection result (projected onto each projection plane) of each user profile for the machine learning model received from content platform 150. Each of the two servers in MPC cluster 130 possesses a half of the bit matrix B of the plaintext.

[0331] However, if bit flipping is used, computation systems MPC1 and MPC2 have already flipped the bits of the elements in matrices R and R' using a fixed random pattern used for machine learning models. This random bit flipping pattern is opaque to either of the two computation systems MPC1 and MPC2, making it impossible for either MPC1 or MPC2 to infer the original user profile from the bit vector of the projection result. The cryptographic design further prevents MPC1 or MPC2 from inferring the original user profile by horizontally partitioning the bit vector; that is, computation system MPC1 holds the latter half of the bit vector of the projection result in plaintext, and computation system MPC2 holds the first half of the bit vector of the projection result in plaintext.

[0332] Computational systems MPC1 and MPC2 generate machine learning models (1014). MPC1 can generate a k-NN model using the latter half of a bit vector. Similarly, MPC2 can generate a k-NN model using the first half of a bit vector. The use of bit flipping and horizontal partitioning of matrices to generate the model applies the principle of defense in depth to protect the confidentiality of the user profiles used to generate the model.

[0333] Typically, each k-NN model represents the cosine similarity (or distance) between user profiles in a user set. The k-NN model generated by computation system MPC1 represents the similarity between the latter halves of a bit vector, and the k-NN model generated by computation system MPC2 represents the similarity between the first halves of a bit vector. For example, each k-NN model can define the cosine similarity between the halves of a bit vector.

[0334] The two k-NN models generated by computing systems MPC1 and MPC2 can be referred to as k-NN models, each possessing a unique model identifier as described above. Computing systems MPC1 and MPC2 can store their models and the share of tags used to generate each user profile. Content platform 150 can then query the models to infer user groups for each user.

[0335] An exemplary process for inferring user groups using a k-NN model.

[0336] Figure 11 This is a flowchart illustrating an exemplary process 1100 for adding a user to a user group using a machine learning model. The operation of process 1100 can be performed, for example, by... Figure 1 The process 1100 is implemented using an MPC cluster 130 and a client device 110 (e.g., an application 112 running on the client device 110). The operation of the process 1100 can also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices can cause one or more data processing devices to perform the operation of the process 1100.

[0337] MPC cluster 130 receives an inference request (1102) for a given user profile. Application 112 running on the user's client device 110 can, for example, transmit the inference request to MPC cluster 130 in response to a request from content platform 150. For example, content platform 150 can transmit an upload token M to application 112. infer Application 112 submits an inference request to MPC cluster 130. The inference request can be a query to determine whether a user should be added to any number of user groups.

[0338] Inferring Request Token M infer It can include a share of a given user profile, a model identifier for a machine learning model (e.g., a k-NN model) and an owner domain for inference, the number of k nearest neighbors of the given user profile for inference, additional signals (e.g., context or digital component signals), an aggregation function for inference and any aggregation function parameters for inference, and a signature on all of the above information created by the owner domain using the owner domain's confidential privacy key.

[0339] As mentioned above, in order to prevent the given user profile P from being displayed in plaintext... i The application 112 can disclose a given user profile to computing systems MPC1 or MPC2, thereby protecting user privacy. i Split into two shares for MPC1 and MPC2 respectively [P i,1 ] and [P i,2 Then, application 112 is able to send the first share [P] with the given user profile to computing system MPC1. i,1 ] and a second share of the encrypted version of the given user profile (e.g., PubKeyEncrypt([P i,2 A single inference request (MPC2). The inference request may also include an inference request token M. infer This enables the MPC cluster 130 to authenticate inference requests. By sending an inference request that includes a first share and an encrypted second share, the number of outgoing requests sent by application 112 is reduced, resulting in computational and battery savings at the client device 110.

[0340] In other implementations, application 112 can transfer the first share [P] of a given user profile. i,1 ]Sent to computing system MPC1, and the second share of the given user profile [P i,2 ]Sent to computing system MPC2. By sending the second share [P] of the given user profile i,2 The second share is sent to computing system MPC2 without passing through computing system MPC1, and does not need to be encrypted to prevent computing system MPC1 from accessing the second share of a given user profile. i,2 ].

[0341] Each computing system, MPC1 and MPC2, identifies the k nearest neighbors (1104) of a given user profile in the secret share representation. Computing system MPC1 is able to use the first share [P] of a given user profile. i,1 This is used to compute half of the bit vector of a given user profile. To generate the bit vector, the computing system MPC1 can use... Figure 10 The process 1000 involves operations 1010 and 1012. That is, the computational system MPC1 can use the random projection vectors generated for the k-NN model to project the share of a given user profile [P]. i,1 ], and create secret shares of bit vectors for a given user profile. If bit flipping is used to generate a k-NN model, the computation system MPC1 can use the first share {[ST] of the bit flipping pattern used to generate the k-NN model. 1,1 [ST] 2,1 ],…[ST m,1 The `}` variable is used to modify the elements of the secret share of the bit vector of a given user profile.

[0342] Similarly, computing system MPC1 can provide computing system MPC2 with a second encrypted share of PubKeyEncrypt([P i,2 The computing system MPC2 is able to use its private key to decrypt the second share of a given user profile. i,2 ], and use the second share [P] of the given user profile. i,2 [P] is used to compute half of the bit vector of a given user profile. That is, the computation system MPC2 can use random projection vectors generated for the k-NN model to project the fraction of a given user profile [P]. i,2 ], and create a bit vector for a given user profile. If bit flipping is used to generate a k-NN model, the computation system MPC2 can use the second share {[ST] of the bit flipping pattern used to generate the k-NN model. 1,2 [ST] 2,2 ],…[ST m,2 The elements of the bit vector in the given user profile are modified using []}. Then, computing systems MPC1 and MPC2 reconstruct the bit vector using horizontal partitioning, such as Figure 10 As described in operation 1012. After reconstruction is complete, computing system MPC1 has the first half of the overall bit vector of the given user profile, and computing system MPC2 has the second half of the overall bit vector of the given user profile.

[0343] Each computing system, MPC1 and MPC2, uses half of the bit vector of a given user profile and its k-NN model to identify k' nearest neighbor user profiles, where k' = α × k, and α is empirically determined based on actual production data and statistical analysis. For example, α = 3 or another suitable number. Computing system MPC1 is able to compute the Hamming distance between the first half of the overall bit vector and the bit vector of each user profile in the k-NN model. Computing system MPC1 then identifies k' nearest neighbors based on the computed Hamming distances, for example, the k' user profiles with the lowest Hamming distances. In other words, computing system MPC1 identifies the set of nearest neighbor user profiles based on the share of a given user profile and a k-nearest neighbor model trained using multiple user profiles. Example results in tabular form are shown in Table 13 below.

[0344] Line ID Hamming distance (in plaintext) User profile share Share of the label i <![CDATA[d i1 ]]> <![CDATA[[P i1 ]]]> <![CDATA[[label i1 ]]]> … … … …

[0345] Table 13

[0346] In Table 13, each row is for a specific nearest neighbor user profile and includes the Hamming distance between that user profile and a given user profile calculated by the computing system MPC1. The row for a specific nearest neighbor user profile also includes a first share of that user profile and a first share of the label associated with that user profile.

[0347] Similarly, the computation system MPC2 can compute the Hamming distance between the latter half of the overall bit vector and the bit vector of each user profile in the k-NN model. Then, the computation system MPC2 identifies k' nearest neighbors based on the computed Hamming distances, for example, the k' user profiles with the lowest Hamming distances. Example results in tabular form are shown in Table 14 below.

[0348] Line ID Hamming distance (in plaintext) User profile share Share of the label j <![CDATA[d j2 ]]> <![CDATA[[P j2 ]]]> <![CDATA[[label j2 ]]]> … … … …

[0349] Table 14

[0350] In Table 14, each row is for a specific nearest neighbor user profile and includes the Hamming distance between that user profile and a given user profile calculated by the computing system MPC2. The row for a specific nearest neighbor user profile also includes a second share of that user profile and a second share of the label associated with that user profile.

[0351] Computational systems MPC1 and MPC2 can exchange lists of row identifiers (row IDs) and Hamming distance pairs with each other. Subsequently, each computational system MPC1 and MPC2 can independently select k nearest neighbors using the same algorithm and input data. For example, computational system MPC1 can find row identifiers shared by both computational systems MPC1 and MPC2 in the partial query results. For each i in the shared row identifiers, computational system MPC1 calculates the combined Hamming distance d based on the two partial Hamming distances. i For example, d i =d i,1 +d i,2 Then, the computation system MPC1 can calculate based on the combined Hamming distance d. i Sort the shared row identifiers and select the k nearest neighbors. The row identifiers of the k nearest neighbors can be represented as ID = {id1, ..., id2}. k It can be proven that if α is large enough, the k nearest neighbors determined in the above algorithm are the true k nearest neighbors with high probability. However, a large value of α leads to high computational cost.

[0352] Make a determination (1106) on whether to add the user to the user group. This determination can be made based on the k nearest neighbor profiles and their associated labels. The determination is also based on the aggregation function used and any aggregation parameters of that aggregation function. Aggregation functions can include, for example, binary classification, regression (e.g., using arithmetic mean or root mean square), multi-class classification, and weighted k-NN. Each method of determining whether to add the user to the user group can include different interactions between the MPC cluster 130 and the application 112 running on the client 110, as described in more detail below.

[0353] If a determination is made not to add the user to the user group, application 112 may not add the user to the user group (1108). If a determination is made to add the user to the user group, application 112 may add the user to the user group, for example, by updating the user group list stored at client device 110 to include the user group identifier of the user group (1110).

[0354] Exemplary Binary Classification Inference Techniques Using the k-NN Model

[0355] For binary classification, inference requests can include threshold, L true and L false As an aggregate function parameter, the label value is a Boolean type, either true or false. The threshold parameter indicates that a true label must be present for a user to be added to user group L. true The threshold percentage of the k nearest neighbor profiles. Otherwise, the user will be added to user group L. false In one approach, if the number of nearest-neighbor user profiles with true label values ​​is greater than the product of threshold and k, then MPC cluster 130 can instruct application 112 to add the user to user group L. true (Otherwise, it is L) false However, the computing system MPC1 will learn to infer outcomes, such as the user groups a user should join.

[0356] To protect user privacy, the inference request can include a threshold of plaintext, the first share [L] used to calculate system MPC1. true,1 ] and [L false,1 ], and the second share of encryption used for computing system MPC2, PubKeyEncrypt([L true,2 ]||[L false,2 ]||application_public_key,MPC2). In this example, application 112 can obtain from [L true,2 ]、[L fasle,2The public key of application 112 is used to generate a composite message, as represented by the symbol ||, and the composite message is encrypted using the public key of computing system MPC2. The inference response from computing system MPC1 to application 112 can include a first share [L] of the inference result determined by computing system MPC1. result,1 ] and the second share of the inference result determined by the computing system MPC2 [L result,2 ].

[0357] To prevent the second share from being accessed by computing system MPC1 and thus enabling computing system MPC1 to obtain the inference result in plaintext, computing system MPC2 can store the second share of the inference result [L] result,2 An encrypted (and optionally digitally signed) version of ], such as PubKeySign(PubKeyEncrypt([L result,2 The data ([L, application_public_key), MPC2) is sent to computing system MPC1 to be included in the inference response sent to application 112. In this example, application 112 is able to verify the digital signature using the public key of computing system MPC2, which corresponds to the private key of computing system MPC2 used to generate the digital signature, and uses the second share [L, application_public_key), which is used to encrypt the inference result. result,2 The public key (application_public_key) of application 112 corresponds to the private key of application 112, which is used to decrypt the second share of the inference result [L]. result,2 ].

[0358] Then, application 112 can obtain the first share [L] result,1 ] and second share [L result,2 Reconstruction inference results L result Using digital signatures enables application 112 to detect, for example, forgery of results from computing system MPC2 by computing system MPC1. Depending on the desired security level, the computing system operating the MPC cluster 130, and the assumed security model, digital signatures may not be necessary.

[0359] Computational systems MPC1 and MPC2 are able to use MPC technology to determine the share of binary classification results [L] result,1 ] and [L result,2 In binary classification, the value of label1 in a user profile is either zero (false) or one (true). Assume the selected k nearest neighbors are identified by the identifiers {id1, ..., id1}. k If the identifier is given, then the computing systems MPC1 and MPC2 can calculate the sum of labels (sum_of_labels) of the k nearest neighbor user profiles, where the sum is represented by the following relation 15:

[0360] Relationship 15: sum_of_labels = ∑ i∈{id1，...idk} label i

[0361] To determine the sum, the computing system MPC1 sends the IDs (i.e., {id1,…id k}) to the computing system MPC2. The computing system MPC2 can verify that the number of row identifiers in the IDs is greater than the threshold to enforce k-anonymity. Then, the computing system MPC2 can use the following Relationship 16 to calculate the second share [sum_of_labels2] of the sum of the labels:

[0362] Relationship 16: [sum_of_labels2] = ∑ i∈{id1，...idk} [label i，2

[0363] The computing system MPC1 can also use the following Relationship 17 to calculate the first share [sum_of_labels1] of the sum of the labels:

[0364] Relationship 17: [sum_of_labels1] = ∑ i∈{id1，...idk} [label i，1

[0365] If the sum of the labels sum_of_labels is confidential information that the computing systems MPC1 and MPC2 should know as little as possible, the computing system MPC1 can calculate whether the first share [sum_of_labels1] of the sum of the labels is below the threshold, e.g., [below_threshold1] = [sum_of_labels1] < threshold × k. Similarly, the computing system MPC2 can calculate whether the second share [sum_of_labels2] of the sum of the labels is below the threshold, e.g., [below_threshold2] = [sum_of_labels2] < threshold × k. The computing system MPC1 can continue to calculate the inference result [L false,1 +(1 - [below_threshold1])×[L[[ID=3I]] true,1 . Similarly, the computing system MPC2 can calculate [L result,1 through [below_threshold2]×[L false,2 +(1 - [below_threshold2])×[L true,2 [[ID=3I]] result,2 .

[0366] ​​​If the sum of the labels, sum_of_labels, is not confidential information, the computing systems MPC1 and MPC2 can reconstruct sum_of_labels from [sum_of_labels1] and [sum_of_labels2]. Then, the computing systems MPC1 and MPC2 can set the parameter below_threshold to sum_of_labels < threshold × k, e.g., a value of one if it is below the threshold or a value of zero if it is not below the threshold.

[0367] After computing the parameter below_threshold, the computing systems MPC1 and MPC2 can continue to determine the inference result L result . For example, the computing system MPC2 can set [L result,2 to [L true,2 or [L false,2 according to the value of below_threshold. For example, if the sum of the labels is not below the threshold, the computing system MPC2 can set [L result,2 to [L true,2 , or if the sum of the labels is below the threshold, the computing system MPC2 can set [L result,2 to [L false,2 . Then, the computing system MPC2 can return the encrypted second share of the inference result (PubKeyEncrypt(L result,2 , application_public_key)) or the digitally signed version of the result to the computing system MPC1.

[0368] Similarly, the computing system MPC1 can set [L result,1 to [L true,1 or [L false,1 [[ID=3??]]] according to the value of below_threshold. For example, if the sum of the labels is not below the threshold, the computing system MPC1 can set [L result,1 to [L true,1 , or if the sum of the labels is below the threshold, the computing system MPC1 can set [L result,1 to [L false,1 . The computing system MPC1 can transmit the first share of the inference result [L result,1 and the encrypted second share of the inference result [L result,2 as an inference response to Application 112. Then, Application 112 can calculate the inference result based on the two shares as described above.

[0369] Exemplary multi-class classification inference techniques using the k-NN model

[0370] For multi-category classification, the tags associated with each user profile can be classification features. The content platform 150 can specify a lookup table that maps any possible classification values ​​to corresponding user group identifiers. The lookup table can be one of the aggregate function parameters included in the inference request.

[0371] Within the k nearest neighbors found, MPC cluster 130 identifies the most common label value. MPC cluster 130 then finds the user group identifier corresponding to the most common label value in a lookup table and, for example, requests application 112 to add the user to the user group corresponding to the user group identifier by adding the user group identifier to a list of user groups stored at client device 110.

[0372] Similar to binary classification, it might be preferable to hide the inference result L from the computational systems MPC1 and MPC2. result To this end, application 112 or content platform 150 can create two lookup tables, each mapping the category value to the inference result L. result The corresponding share. For example, an application can create a mapping that assigns a categorical value to a first share [L]. result1 The first lookup table and mapping of categorical values ​​to the second share [L] result2 The second lookup table is used. An inference request from the application to the computing system MPC1 can include a plaintext first lookup table for computing system MPC1 and an encrypted version of a second lookup table for computing system MPC2. The second lookup table can be encrypted using the public key of computing system MPC2. For example, the composite message including the second lookup table and the application's public key can be encrypted using the public key of computing system MPC2 (e.g., PubKeyEncrypt(lookuptable2||application_public_key,MPC2)).

[0373] The inference response sent by the computing system MPC1 can include the first share [L] of the inference result generated by the computing system MPC1. result1 Similar to binary classification, to prevent the second share from being accessed by computational system MPC1 and thus allowing computational system MPC1 to obtain the inference result in plaintext, computational system MPC2 can store the second share of the inference result [L]. result,2 The encrypted (and optionally digitally signed) version of ] (e.g., PubKeySign(PubKeyEncrypt([L result,2 The [L, application_public_key), MPC2) are sent to the computing system MPC1 to be included in the inference results sent to application 112. Application 112 is able to [L result1 ] and [L result2 Reconstruction inference results Lresult .

[0374] Suppose that for a multi-class classification problem there are w valid labels {l1, l2, ... ln}. w To determine the inference result L in multi-class classification. result share [L] result1 ] and [L result2 The computing system MPC1 will use ID (i.e., {id1, ... id1}) to calculate ID. k The data is sent to the computing system MPC2. The computing system MPC2 can verify that the number of row identifiers in the ID is greater than a threshold to enforce k-anonymity. Typically, k in k-NN can be significantly greater than k in k-anonymity. Then, the computing system MPC2 can compute the j-th label [l] j,2 The second frequency share j,2 ], which is defined using the following relation 18.

[0375] Relation 18:

[0376] Similarly, the computing system MPC1 calculates the j-th label [l] j,1 The first frequency share j,1 ], which is defined using the following relation 19.

[0377] Relation 19:

[0378] Assume the frequency of the tags within the k nearest neighbors. i If insensitive, then the computing systems MPC1 and MPC2 can obtain the two shares of the label [frequency]. i,1 ] and [frequency] i,2 Reconstruct frequency i Then, computation systems MPC1 and MPC2 are able to determine the index parameters, where frequency... index It has a maximum value, for example, index = argmax i (frequency i ).

[0379] Then, the computing system MPC2 is able to look up the share [L] corresponding to the tag with the highest frequency in its lookup table. result,2 ], and PubKeyEncrypt([L result,2 The `application_public_key` is returned to the computing system MPC1. The computing system MPC1 can similarly look up the share [L] corresponding to the tag with the highest frequency in its lookup table.result,1 Then, the computing system MPC1 is able to send an inference response to application 112, which includes two shares (e.g., [L]). result,1 ] and PubKeyEncrypt([L result,2 As described above, the second share can be digitally signed to prevent computing system MPC1 from forging the response of computing system MPC2. Then, as described above, application 112 can calculate the inference result based on the two shares and add the user to the user group identified by the inference result.

[0380] Exemplary regression inference techniques

[0381] For regression analysis, the labels associated with each user profile P must be numeric. Content platform 150 can specify an ordered list of thresholds (e.g., -∞ < t0 < t1 < ... < t). n <∞) and a list of user group identifiers (e.g., {L0, L1, ... L...). n ,L n+1 Additionally, content platform 150 can specify aggregation functions, such as arithmetic mean or root mean square.

[0382] Within the k nearest neighbors found, the MPC cluster 130 calculates the average of the label values ​​(result), and then uses the result to look up the mapping to find the inference result L. result For example, MPC cluster 130 can use the following relation 20 to identify tags based on the average of tag values:

[0383] Relation 20:

[0384] If result ≤ t0, then L result ←L0;

[0385] If result > t n Then L result ←L n+1 ;

[0386] If t x <result≤t x+1 Then L result ←L x+1 .

[0387] That is, if the result is less than or equal to the threshold t o The inference result L result Let L0 be the threshold. If the result is greater than the threshold t... n The inference result L result For L n+1 Otherwise, if the result is greater than the threshold tx And less than or equal to the threshold t x +1, then the inference result L result For L x +1. Then, the computing system MPC1, for example, sends the inference result L to the application 112. result The inference response requests application 112 to add the user to the inference result L. result The corresponding user group.

[0388] Similar to the other classification techniques mentioned above, the inference result L result It is possible to hide the information from computing systems MPC1 and MPC2. To this end, the inference request from application 112 can include the first share [L] of the label used for computing system MPC1. i,1 ] and the second share of the encrypted tag used to compute system MPC2 [L i,2 For example, PubKeyEncrypt([L 0,2 ||…||L n+1,2 ||application_public_key,MPC2)).

[0389] The inference results sent by the computing system MPC1 can include the first share [L] of the inference results generated by the computing system MPC1. result1 Similar to binary classification, to prevent the second share from being accessed by computational system MPC1 and thus allowing computational system MPC1 to obtain the inference result in plaintext, computational system MPC2 can store the second share of the inference result [L]. result,2 The encrypted (and optionally digitally signed) version of ] (e.g., PubKeySign(PubKeyEncrypt([L result,2 The [L, application_public_key), MPC2) are sent to the computing system MPC1 to be included in the inference results sent to application 112. Application 112 is able to [L result,1 ] and [L result,2 Reconstruction inference results L result .

[0390] When the aggregation function is an arithmetic mean, the computation systems MPC1 and MPC2 calculate the sum of labels, sum_of_labels, similar to binary classification. If the sum of labels is insensitive, the computation systems MPC1 and MPC2 can calculate two shares, [sum_of_labels1] and [sum_of_labels2], and then reconstruct sum_of_labels based on these two shares. The computation systems MPC1 and MPC2 can then calculate the average of the labels by dividing the sum of the labels by the number of nearest neighbor labels (e.g., dividing by k).

[0391] Then, the computational system MPC1 is able to use relation 20 to compare the average value with the threshold to identify the label corresponding to the average value and assign the first share [L] result,1 [] is set as the identified label. Similarly, the calculation system MPC2 is able to use relation 20 to compare the average value with a threshold to identify the label corresponding to the average value, and set the second share [L] as the identified label. result,2 [Set as identifier label. The computing system MPC2 is able to use the public key of application 112 to encrypt the second share [L] result,2 For example, PubKeyEncrypt([L result,2 The application 112 sends the first share and the encrypted second share (which can optionally be digitally signed as described above) to the computing system MPC1. The computing system MPC1 is then able to add the user to the application 112 by a tag (e.g., user group identifier). result The user group identified.

[0392] If the sum of labels is sensitive, computation systems MPC1 and MPC2 may not be able to construct `sum_of_labels` in plaintext. Conversely, computation system MPC1 is able to... Calculate the mask [mask] i,1 ]=[sum_of_labels1]>t i ×k. This calculation requires multiple round trips between computing systems MPC1 and MPC2. Next, computing system MPC1 can calculate... Furthermore, the computing system MPC2 is capable of calculating... The equality test in this operation requires multiple round trips between the computation systems MPC1 and MPC2.

[0393] In addition, the computing system MPC1 is capable of calculating Furthermore, the computing system MPC2 is capable of calculating... Then, MPC cluster 130 will... In and only in acc i Return L if == 1 i And returns L if use_default == 1. n+1 This condition can be expressed in relation 21 below.

[0394] Relation 21:

[0395] The corresponding cryptographic implementation can be represented by the following relations 22 and 23.

[0396] Relation 22:

[0397] Relation 23:

[0398] These calculations do not require any round-trip computation between computing systems MPC1 and MPC2. Computing system MPC1 is able to provide application 112 with two shares of the result (e.g., [L result,1 ] and [L result,2 The second share is encrypted as described above and optionally digitally signed. In this way, application 112 is able to determine the inference result L. result Without needing to compute systems MPC1 or MPC2 to know anything about immediate or final results.

[0399] For the root mean square, computing system MPC1 sends ID (i.e., {id1, ... id2}) to computing system MPC2. k The computational system MPC2 can verify that the number of row identifiers in the ID is greater than a threshold to enforce k-anonymity. The computational system MPC2 can also use the following relation 24 to compute the second share of the sum_of_square_labels parameter (e.g., the sum of squares of the label values).

[0400] Relation 24:

[0401] Similarly, the computation system MPC1 can use the following relation 25 to calculate the first share of the sum_of_square_labels parameter.

[0402] Relation 25:

[0403] Assuming the sum_of_square_labels parameter is insensitive, computation systems MPC1 and MPC2 can reconstruct the sum_of_square_labels parameter from two shares, [sum_of_square_labels1] and [sum_of_square_labels2]. Computation systems MPC1 and MPC2 can calculate the root mean square of the labels by dividing sum_of_squares_labels by the number of nearest neighbor labels (e.g., by k) and then calculating the square root.

[0404] Regardless of whether the average is calculated via arithmetic mean or root mean square, the calculation system MPC1 can then use relation 20 to compare the average with a threshold to identify the label corresponding to the average and assign the first share [L]. result,1 [] is set as the identified label. Similarly, the calculation system MPC2 is able to use relation 20 to compare the average value with a threshold to identify the label corresponding to the average value, and set the second share [L] as the identified label. result,2 [Set as identifier label. The computing system MPC2 is able to use the public key of application 112 to encrypt the second share [L] result,2 For example, PubKeyEncrypt([L result,2 The application 112 then sends the encrypted second share (which can optionally be digitally signed as described above) to the computing system MPC1. The computing system MPC1 can then provide the application 112 with the first share and the encrypted second share (which can optionally be digitally signed as described above) as the deduction result. The application 112 can then add the user to the system L... result The user group is identified by a label (e.g., a user group identifier). If the sum_of_square_labels parameter is sensitive, the computation systems MPC1 and MPC2 are able to perform a cryptographic protocol similar to that used in the arithmetic mean example to compute the share of the inferred result.

[0405] In the aforementioned techniques for inferring results in classification and regression problems, all k nearest neighbors have equal influence on the final inference result, i.e., equal weights. For many classification and regression problems, if each of the k neighbors is assigned a weight when the neighbor is related to the query parameter P... i Weights that monotonically decrease as the Hamming distance between them increases can improve model quality. A common kernel function with this property is the Epanechnikov (parabolic) kernel function. Both the Hamming distance and the weights can be computed in plaintext.

[0406] Improvement of the definition of neighbors in k-NN models

[0407] In some implementations, the k nearest neighbors refer to the k users in high-dimensional space most similar to the user of the application (e.g., a browser) performing the query, as described above. However, the algorithms used to train or deploy k-NN models can be independent of how neighbors are defined. Therefore, in some additional implementations, the term "neighbor" can refer to a group of users, where points in high-dimensional space are user groups rather than individual users. In this example, each user group can be represented by its centroid.

[0408] k-NN models based on such user groups are advantageously less complex than those where users form distinct points in a high-dimensional space, because there are typically far fewer user groups than users. For example, a content platform might have billions of users but only a few million user groups; in this case, training the k-NN model with each neighbor defined as a user group rather than a user can scale the model down by a factor of 1000. This scaling down of the model advantageously requires lower data storage needs to store the data (in this case, user groups and associated data, such as mappings between different elements) and faster processing to determine whether to add a user to a user group.

[0409] To achieve a k-NN model where each point in the high-dimensional space corresponds to a user group, the points in the high-dimensional space are constructed as follows. Two computational systems, MPC1 and MPC2, evaluate each user group to determine the number of users in each group. If the number of users in the list is less than a preset threshold, the list is not considered a point in the high-dimensional space. This helps ensure that points in the high-dimensional space are only occupied by lists with more than a preset number of users (e.g., 100 users, 1000 users, or any other threshold number of users). This protects user privacy by ensuring that user groups are not targeted at specific users.

[0410] Once the list is established, the two computing systems MPC1 and MPC2 can determine the centroid of each user group based on the number of users in the user group. The centroid can be defined as an average, as described above, but calculated over all users in the user group. The average, as described above, involves the calculation of the sum of all user profiles of the users in the group divided by the number of users in the group. To determine this average to determine the centroid, the two computing systems MPC1 and MPC2 can have a secret share for each user profile, as received from the user's client device. For example, each client device can generate two or more secret shares for the user profile and send the corresponding secret shares to each computing system before determining the centroid. In some implementations, a different subset of the information in each user profile is provided to each computing system such that there is no overlap in the user profile data sent to each computing system. The calculation of the average used to determine the centroid may require data back and forth between MPC cluster 130 and client device 110, and such back and forth of specific data may vary based on the specific secret sharing algorithm being implemented. The centroid can be calculated as described above (e.g., see...). Figure 1 (Discussion).

[0411] The centroid of each user group forms a point in a high-dimensional space. For each application making a query, the k nearest neighbors are represented by k points in this high-dimensional space (each representing a user group). Each neighbor is the corresponding user group. (See above for reference.) Figure 8-11The other modeling aspects and techniques mentioned can be used to train and deploy such k-NN models, the difference being that each point in this high-dimensional space (which represents its neighbors) is a user group.

[0412] The computing systems MPC1 and MPC2 are capable of using one of several possible machine learning techniques (such as multi-class classification) to determine whether to add a user to a user group based on the k nearest neighbor user profiles. Unlike the embodiments described above, where users are represented by points in a high-dimensional space, which employ more machine learning techniques (including regression and binary classification), the machine learning techniques used in the embodiments where each user group is formed by points in a high-dimensional space can exclude regression or binary classification.

[0413] Add interaction-based weights to users

[0414] For digital component provider 160, all user interactions (e.g., views, clicks, and / or conversions) may not have equal value, and some user interactions may be more important than the same interactions of other users. For example, a particular interaction (e.g., view, click, or conversion) of a user who appears to have higher purchasing power (e.g., by living in an expensive postcode area, spending more in a preset amount of time in the past, etc.) may be more important than a particular interaction of another user who appears to have lower purchasing power.

[0415] For each point in the high-dimensional space that represents a model of the corresponding user group, this variation in the importance of interaction is considered during centroid calculation while the model is being trained. This is achieved by assigning higher interaction-based weights to users interacting with digital components promoting more expensive products and lower interaction-based weights to users interacting with digital components promoting cheaper products. In some implementations, the weights are determined based on other business objectives. The centroid calculation above is described as an average across all users. However, here, the centroid is calculated as a weighted average across all users. The weighted average is the sum of the weights divided by the sum of the weights.

[0416] For a model where each point in the high-dimensional space is a user, interaction-based importance is considered after the model has been trained and when it is used for prediction. For this model, due to the algorithm used, the timing for considering the change in interaction importance (i.e., during prediction, it occurs after model training) differs from the timing for the model where each point in the high-dimensional space is a user (i.e., after centroid calculation). In this model where each point in the high-dimensional space is a user, the model is implemented as described above, such that the model makes predictions that the user has been assigned to a specific category or user group. Interaction-based importance can be considered in two ways, either individually or in combination.

[0417] In the first approach, a user can be excluded from the assigned user group if fewer than a preset number of nearest neighbors are part of that user group. For example, if only 3 or fewer of the 10 nearest neighbors are part of the user group, the user is excluded from the assigned group.

[0418] In the second approach, a weight is assigned to each user based on their interactions (e.g., a larger weight is given to interactions with digital components promoting expensive products, and a smaller weight is given to interactions with digital components promoting cheap products). If the product of the weight and a preset amount of the nearest neighbors who are part of that user group is less than a threshold, the user is excluded from the assigned group. For example, if the threshold is 4, and only 2 of the user's neighbors are part of the assigned group (which would exclude the user from the assigned group in the first approach described above), and the weight assigned to the user is 3, then in this second approach, the user will not be excluded from the assigned group because the product of the weight and the preset amount of the nearest neighbors who are part of that user group—i.e., 6 calculated by multiplying 3 by 2—exceeds the threshold of 4.

[0419] The weights assigned to users can be specified by a demand-side platform (DSP), which can be part of content platform 150. In some implementations, the weight can be defined as or take into account the purchase price of a product promoted by a digital component that the user interacts with (e.g., through display, click, and / or conversion) in response to the user's interaction with a digital component promoting the product. In some implementations, the weight can be defined as or take into account the profit to be obtained on such a product. In some implementations, the weight can be defined based on a frequency metric (e.g., the weight is defined as the number of times a user purchases a product with a price greater than a preset value) and / or a recency metric (e.g., the weight is defined as the number of times a product has been purchased within a preset amount of time in the past). The DSP can define the weights in any other way.

[0420] The DSP can provide user weights to the MPC cluster 130 for modeling computations, including preprocessing or post-processing computations, by providing weights to a script running within an application (e.g., a browser). The script is configured to provide weights to the MPC cluster 130 when it uploads the user's profile to the MPC cluster 130, or the script can provide weights to the MPC cluster 130 when it uploads the user's profile to the MPC cluster 130. The script can send weights in secret shares or plaintext, depending on the security requirements imposed by the architecture. For example, because weights are simply numbers without much additional data, in some implementations, security may not be compromised by sending weights in plaintext. In other implementations, weights may also be transmitted in secret shares to further improve privacy.

[0421] Figure 12This is a flowchart illustrating an exemplary process for training and deploying a k-NN model to efficiently classify users into one or more corresponding user groups. The k-NN model can be trained using individual user profiles or the centroids of user groups.

[0422] Before training the k-NN model, the training data can be preprocessed by the MPC cluster 130. For example, if the k-NN model is user-group based, the MPC cluster 130 can compute the centroid of each user group. Additionally, the MPC cluster 130 can compute one or more performance metrics for each user group. As mentioned above, performance metrics can include interaction rate and conversion rate. When using weights, the MPC cluster 130 can use the weights to compute performance metrics, as described above.

[0423] To calculate the user interaction rate for a user group, the MPC cluster 130 can determine the total number of times one or more digital components used to train the model for the user group were displayed to the users in the user group, as well as the total number of user interactions between the users in the user group and the digital components. The MPC cluster 130 can determine the quotient as the user interaction rate by dividing the total number of user interactions by the total number of times the digital components (one or more) were displayed to the users in the user group.

[0424] To calculate the conversion rate for a user group, the MPC cluster 130 can determine the total number of conversions made by users in the user group. The MPC cluster 130 can determine the conversion rate by dividing the total number of conversions by the total number of times (one or more) digital components were displayed to users in the user group.

[0425] The first MPC system of MPC cluster 130 can receive an inference request from application 112 on client device 110, the inference request including a first share of a given user profile of the user of application 112 and a performance threshold (1202). One or more second MPC systems of MPC cluster 130 can each receive a corresponding second share of a given user profile.

[0426] Each inference request can include a share of the user profile, an identifier of the machine learning model used for the inference request, the number of k nearest neighbors identified using the machine learning model, and a threshold performance metric used in the inference. In some implementations, the inference request can also include the domain of the model's owner (e.g., the owner's eTLD+1) and a digital signature of the rest of the inference request. The digital signature ensures that the request is received from the appropriate client device 110 and that the content of the inference request is not modified after it is generated.

[0427] The first MPC system is able to identify the k nearest neighbor set (1204) of a user profile by performing a secure MPC process using a trained machine learning model in collaboration with one or more second MPC systems within the MPC cluster 130. The MPC cluster 130 can then use the value of k included in the inference request to compare it with a reference... Figure 11 The description uses a similar approach to identify nearest neighbor sets.

[0428] The first MPC system 130 is capable of selecting one or more nearest neighbors (1206) from the nearest neighbor set that have a performance metric that satisfies a performance threshold. This can vary based on the performance metric included in the query and on how the k-NN model is trained.

[0429] If the k-NN model is trained using user profiles of user groups instead of individual users, the first MPC system is able to identify each user group in the nearest neighbor set that has a performance metric that meets a performance threshold. In other words, the first MPC system is able to compare the performance metric of each of the k user groups with the threshold performance metric to determine whether the performance metric meets or exceeds the threshold performance metric.

[0430] If user profiles are used instead of user groups to train the k-NN model, the first MPC system is able to identify user groups that include at least one of the k user profiles as members. For example, consider a value of three for k, where users A, B, and C are the nearest neighbors of the user profile in the inference request. If user A is a member of groups 1 and 2, user B is a member of group 2, and user C is a member of groups 3, 4, and 5, then the user groups in this example would be 1, 2, 3, 4, and 5, because each of these groups includes at least one member of the k nearest neighbors.

[0431] For each group, the first MPC system calculates the aggregate performance metric for user profiles within that group. If the threshold performance metric is the user interaction rate, the first MPC system can calculate the user interaction rate of one or more digital components in the user profile, for example, by dividing the number of user interactions by users in the group by the total number of times one or more digital components were displayed to users in the group. If the threshold performance metric is the conversion rate, the first MPC system can calculate the conversion rate of one or more digital components in the group, for example, by dividing the number of conversions by the corresponding user in the group by the total number of times one or more digital components were displayed to users in the group. After calculating the performance metric, the first MPC system can compare the calculated performance metric with the threshold performance metric. The first MPC system can then determine which groups have a performance metric that meets or exceeds the threshold performance metric. Each second MPC system can perform the same process to identify user groups that meet the threshold performance metric.

[0432] The first MPC system is capable of transmitting data representing one or more nearest neighbors to application 112 (1208). For example, the first MPC system is capable of transmitting data representing each user group with a performance metric that meets or exceeds a threshold performance metric. Similarly, each second MPC system is capable of transmitting data representing each user group with a performance metric that meets or exceeds a threshold performance metric.

[0433] User profiles can be generated by application 112. User profiles can include data indicating interactions between the user of application 112 and digital content presented on application 112. Interactions can include conversions and missing conversions.

[0434] The machine learning model can be a nearest neighbor model. The nearest neighbors of a nearest neighbor model are represented by the corresponding centroids associated with the corresponding user group. The first MPC system can assign weights to each user in the corresponding user group to calculate the corresponding centroid. The weights can be based on user interactions. The centroid of each user group can be represented by the average of the user profiles of the users who are members of the user group.

[0435] Machine learning models can be one or more of centroid models or nearest neighbor models. For example, k-NN can be used to classify users into user groups or lists, and centroid models can be used to preprocess data from user group methods.

[0436] Each nearest neighbor performance metric can include at least one of the user interaction rate with one or more digital components corresponding to the nearest neighbor or the conversion rate with one or more digital components corresponding to the nearest neighbor.

[0437] Machine learning models can include k-nearest neighbor models. In some implementations, each neighbor in a k-nearest neighbor model can represent a user profile. In other implementations, each neighbor in a k-nearest neighbor model can represent a user group of multiple users.

[0438] Figure 13 This is a block diagram of an example computer system 1300 capable of performing the operations described above. System 1300 includes a processor 1310, memory 1320, storage device 1330, and input / output device 1340. Each of components 1310, 1320, 1330, and 1340 can be interconnected, for example, using a system bus 1350. Processor 1310 is capable of processing instructions for execution within system 1300. In some embodiments, processor 1310 is a single-threaded processor. In another embodiment, processor 1310 is a multi-threaded processor. Processor 1310 is capable of processing instructions stored in memory 1320 or storage device 1330.

[0439] Memory 1320 stores information within system 1300. In one embodiment, memory 1320 is a computer-readable medium. In some embodiments, memory 1320 is a volatile memory cell. In another embodiment, memory 1320 is a non-volatile memory cell.

[0440] Storage device 1330 provides mass storage for system 1300. In some embodiments, storage device 1330 is a computer-readable medium. In various embodiments, storage device 1330 may include, for example, a hard disk drive, an optical disk drive, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0441] Input / output device 1340 provides input / output operations for system 1300. In some embodiments, input / output device 1340 may include one or more of the following: a network interface device, such as an Ethernet card; a serial communication device, such as an RS-232 port; and / or a wireless interface device, such as an 802.11 card. In another embodiment, input / output device may include a driver configured to receive input data and send output data to external device 1360 (e.g., a keyboard, printer, and display device). However, other embodiments, such as mobile computing devices, mobile communication devices, set-top box television client devices, etc., may also be used.

[0442] Although already Figure 13 An example processing system is described herein, but implementations of the subject matter and functional operations described herein can be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed herein and their equivalents), or in a combination of one or more of them.

[0443] The embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware (including the structures disclosed in this specification and their equivalents), or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium (or medium) for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, the program instructions can be encoded on artificially generated propagated signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information for transmission to a suitable receiver device for execution by a data processing apparatus. The computer storage medium can be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these, or be included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these. Furthermore, although the computer storage medium is not a propagated signal, it can be a source or destination of computer program instructions encoded in artificially generated propagated signals. Computer storage media can also be one or more separate physical components or media (e.g., multiple CDs, discs or other storage devices) or included in one or more separate physical components or media (e.g., multiple CDs, discs or other storage devices).

[0444] The operations described in this specification can be implemented as operations performed by a data processing device on data stored on one or more computer-readable storage devices or received from other sources.

[0445] The term "data processing apparatus" encompasses all kinds of devices, apparatuses, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or a combination thereof. The apparatus can include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, the apparatus can also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or combinations thereof. The apparatus and execution environment can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0446] A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but does not need to, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file storing one or more modules, subroutines, or code portions). A computer program can be deployed to execute on a single computer or on multiple computers located at a single site or distributed across multiple sites and interconnected through a communication network.

[0447] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by dedicated logic circuits, and the devices can be implemented as dedicated logic circuits, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits).

[0448] For example, processors suitable for executing computer programs include both general-purpose microprocessors and special-purpose microprocessors. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The basic components of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, to receive data from or transfer data to, or both. However, a computer does not need to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), and so on. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices; disks such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM discs. Processors and memory can be supplemented by or incorporated into dedicated logic circuits.

[0449] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending and receiving documents from devices used by the user; for example, by sending web pages to an application on the user's client device in response to a request received from an application (e.g., a browser).

[0450] The embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., as a data server), middleware components (e.g., an application server), front-end components (e.g., a client computer having a graphical user interface or web browser that a user can interact with through embodiments of the subject matter described in this specification), or any combination of one or more such back-end components, middleware components, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0451] A computing system can include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and involves a client-server relationship. In some implementations, the server transmits data (e.g., HTML pages) to the client device (e.g., to display data to a user interacting with the client device and to receive user input from the user). Data generated at the client device (e.g., the result of user interaction) can be received from the client device at the server.

[0452] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any innovation or the scope that may be claimed, but rather as descriptions of features specific to particular embodiments of a particular innovation. Some features described in the context of individual embodiments may also be implemented in combination within a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination across multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination may, in some cases, be removed from that combination, and the claimed combination may involve sub-combinations or variations thereof.

[0453] Similarly, although operations are described in a specific order in the accompanying drawings, this should not be construed as requiring such operations to be performed in the specific order or sequence shown, or requiring all shown operations to be performed to obtain the desired result. In some cases, multitasking and parallel processing can be advantageous. Furthermore, the separation of various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0454] Therefore, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In some embodiments, multitasking and parallel processing can be advantageous.

Claims

1. A method comprising: The first MPC system of the multi-party computation (MPC) cluster receives an inference request from an application on a client device, the inference request including a first share of a given user profile of the application's user and a performance threshold; The first MPC system and one or more second MPC systems collaborate to use a secure MPC process to execute a trained machine learning model, wherein the first MPC system and the one or more second MPC systems use a secret share of data to perform machine learning computations according to a secure MPC protocol; The first share of data, which is the output of the trained machine learning model, is obtained by the first MPC system and identifies the nearest neighbor set of the user profile. One or more nearest neighbors are selected from the nearest neighbor set, each having a performance metric that satisfies the performance threshold, wherein the performance metric of each nearest neighbor includes at least one of the following: (i) user interaction rate, which indicates the rate at which the user interacts with the one or more digital components when the one or more digital components are presented to the user, and (ii) conversion rate, which indicates the rate at which the user performs a specified action after the one or more digital components are presented to the user. as well as The first MPC system transmits data derived from the one or more nearest neighbors to the application.

2. The method according to claim 1, wherein, The user profile is generated by the application, wherein the user profile includes data indicating the interaction between the user of the application and digital content presented on the application, wherein the interaction includes conversions and the absence of conversions.

3. The method according to claim 1, wherein, The machine learning model is a nearest neighbor model, wherein the nearest neighbors of the nearest neighbor model are represented by the corresponding centroids associated with the corresponding user groups.

4. The method according to claim 3, wherein, The first MPC system assigns a weight to each user in the corresponding user group to calculate the corresponding centroid, wherein the weight is based on at least one of the user's interaction and user information related to the performance metric.

5. The method according to claim 4, wherein, The centroid of each user group is represented by the average of the user profiles of the users who are members of the user group.

6. The method according to claim 1, wherein, The machine learning model is one or more of the centroid model and the nearest neighbor model.

7. The method according to claim 1, wherein, The machine learning model includes a k-nearest neighbor model, and each neighbor in the k-nearest neighbor model represents a user profile.

8. The method according to claim 1, wherein, The machine learning model includes a k-nearest neighbor model, where each neighbor in the k-nearest neighbor model represents a user group of multiple users.

9. The method according to any one of claims 1-8, wherein, The performance threshold is a threshold, wherein the conversion rate of the one or more digital components is the number of conversions divided by the number of times the one or more digital components are displayed to users in the user group, and wherein the inference request is a request to infer whether the user should be added to the user group.

10. A system comprising: At least one programmable processor; as well as A machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations, the operations including: The first MPC system of the multi-party computation (MPC) cluster receives an inference request from an application on a client device, the inference request including a first share of a given user profile of the application's user and a performance threshold; The first MPC system and one or more second MPC systems collaborate to use a secure MPC process to execute a trained machine learning model, wherein the first MPC system and the one or more second MPC systems use a secret share of data to perform machine learning computations according to a secure MPC protocol; The first share of data, which is the output of the trained machine learning model, is obtained by the first MPC system and identifies the nearest neighbor set of the user profile. One or more nearest neighbors are selected from the nearest neighbor set, each having a performance metric that satisfies the performance threshold, wherein the performance metric for each nearest neighbor includes at least one of the following: (i) user interaction rate, indicating the rate at which the user interacts with the one or more digital components when they are presented to the user; and (ii) conversion rate, indicating the rate at which the user performs a specified action after the one or more digital components are presented to the user; and The first MPC system transmits data derived from the one or more nearest neighbors to the application.

11. The system according to claim 10, wherein, The user profile is generated by the application, wherein the user profile includes data indicating the interaction between the user of the application and digital content presented on the application, wherein the interaction includes conversions and the absence of conversions.

12. The system according to claim 10, wherein, The machine learning model is a nearest neighbor model, wherein the nearest neighbors of the nearest neighbor model are represented by the corresponding centroids associated with the corresponding user groups.

13. The system according to claim 12, wherein, The first MPC system assigns a weight to each user in the corresponding user group to calculate the corresponding centroid, wherein the weight is based on at least one of the user's interaction or user information related to the performance metric.

14. The system according to claim 13, wherein, The centroid of each user group is represented by the average of the user profiles of the users who are members of the user group.

15. The system according to claim 10, wherein, The machine learning model is one or more of the centroid model and the nearest neighbor model.

16. The system according to any one of claims 10 to 15, wherein, The machine learning model includes a k-nearest neighbor model, and each neighbor in the k-nearest neighbor model represents a user profile.

17. The system according to any one of claims 10 to 15, wherein, The machine learning model includes a k-nearest neighbor model, where each neighbor in the k-nearest neighbor model represents a user group of multiple users.

18. A computer program product comprising one or more stored instructions, said instructions, when executed by at least one programmable processor, causing said at least one programmable processor to perform operations, said operations including: The first MPC system of the multi-party computation (MPC) cluster receives an inference request from an application on a client device, the inference request including a first share of a given user profile of the application's user and a performance threshold; The first MPC system and one or more second MPC systems collaborate to use a secure MPC process to execute a trained machine learning model, wherein the first MPC system and the one or more second MPC systems use a secret share of data to perform machine learning computations according to a secure MPC protocol; The first share of data, which is the output of the trained machine learning model, is obtained by the first MPC system and identifies the nearest neighbor set of the user profile. One or more nearest neighbors are selected from the nearest neighbor set, each having a performance metric that satisfies the performance threshold, wherein the performance metric of each nearest neighbor includes at least one of the following: (i) user interaction rate, which indicates the rate at which the user interacts with the one or more digital components when the one or more digital components are presented to the user, and (ii) conversion rate, which indicates the rate at which the user performs a specified action after the one or more digital components are presented to the user. as well as The first MPC system transmits data derived from the one or more nearest neighbors to the application.

Images