Differential privacy frequency deduplication

Abstract

This paper discloses a system and method for an improved frequency-based counting system that records interactions between an individual and a group of providers while maintaining differential privacy. A protocol defining frequency intervals can be defined to classify identifiers corresponding to individuals. Providers can generate multiple private sketches, each corresponding to multiple frequencies defined in the protocol. Frequency data is determined for each identifier. The identifier is encoded into a private sketch corresponding to the identifier's relevant frequencies. Multiple private sketches from each provider in the group are combined to generate a deduplicated distribution across the group. In one implementation, the private sketches of each provider are sequentially merged until all sketches are combined, thereby allowing estimation of the overall distribution.

Description

Technical Field

[0001] This disclosure generally relates to differential private frequency deduplication. More specifically, this disclosure generally relates to systems and methods for improving frequency counting systems. Background Technology

[0002] In many cases, computational and data analysis systems can determine the intersection or union of large datasets as part of data analysis or processing. Computing the union, intersection, or frequency of large datasets distributed across multiple sources typically involves sharing information about that large dataset among multiple sources. Information from each source may include private or protected information, and sharing such information can have negative impacts on privacy and security. Summary of the Invention

[0003] At least one aspect of this technical solution relates to a method for generating a data structure for deduplicating a dataset across a set of providers. The method includes the following steps: maintaining a set of record data in a database by a data processing system comprising one or more processors and a memory, the set of record data corresponding to interactions between multiple users and providers among multiple providers; generating multiple vector data structures by the data processing system, wherein the multiple vector data structures correspond to multiple frequencies; determining frequency data of the multiple users and providers by the data processing system based on the set of record data; updating the multiple vector data structures by the data processing system based on the frequency data, wherein at least one of the multiple vector data structures is updated to encode the identity of a user among the multiple users based on the user's frequency data; and sending the multiple vector data structures to an analysis server by the data processing system for deduplicating the dataset across multiple providers.

[0004] In some implementations, the analysis server combines multiple vector data structures with a second plurality of vector data structures from a second provider to generate a deduplication distribution.

[0005] In some implementations, the vector data structure defines the coordinates of multiple counters, wherein updating the multiple vector data structures includes updating at least one counter in the multiple vector data structures to encode the user's identity.

[0006] In some implementations, updating multiple vector data structures also includes using a hash function based on the user's identity to determine the first coordinates of the multiple vector data structures.

[0007] In some implementations, multiple vector data structures each correspond to a specific frequency between a defined frequency threshold.

[0008] In some implementations, the identities of multiple users are encoded into no more than one vector data structure among multiple vector data structures.

[0009] Various aspects of this disclosure relate to a method for deduplicating a dataset corresponding to the frequency of user interactions with multiple providers, the method comprising the steps of: receiving, by a data processing system including one or more processors and one or more memories, a first set of two or more vector data structures from a first provider among the multiple providers and a second set of two or more vector data structures from a second provider among the multiple providers, wherein the vector data structures correspond to multiple frequencies, and wherein each vector data structure encodes an identifier according to the frequency of interactions associated with an identifier; and combining, by the data processing system, the first set of two or more vector data structures and the second set of two or more vector data structures into a deduplication frequency distribution, wherein the deduplication frequency distribution defines the total frequency of user interactions of users associated with the identifier in both the first and second providers.

[0010] In some implementations, the method further includes generating graphical user interface data by a data processing system, the graphical user interface data including a representation of the deduplication frequency distribution.

[0011] In some implementations, the method further includes sending threshold frequencies from a data processing system to multiple providers, wherein the multiple frequencies are defined by the threshold frequencies.

[0012] In some implementations, the vector data structure in the first group of two or more vector data structures and the vector data structure in the second group of two or more vector data structures each correspond to a specific frequency between a threshold frequency.

[0013] In some implementations, the identifier is encoded into no more than one vector data structure in a first group of two or more vector data structures and no more than one vector data structure in a second group of two or more vector data structures.

[0014] In some implementations, the vector data structure is a counting vector (VOC).

[0015] In some implementations, the vector data structure is any distributed Bloom filter.

[0016] In some implementations, combining a first group of two or more vector data structures and a second group of two or more vector data structures into a deduplication frequency distribution includes the following steps: a data processing system combining the first group of two or more vector data structures and the second group of two or more vector data structures into a first group of two or more vector data structures; the data processing system receiving a third group of two or more vector data structures from a third provider among a plurality of providers; and in response to combining the first group of two or more vector data structures and the second group of two or more vector data structures into a first group of two or more vector data structures, the data processing system combining the first group of two or more vector data structures with the third group of two or more vector data structures from the third provider into a second group of two or more vector data structures.

[0017] In some implementations, combining a first group of two or more vector data structures and a second group of two or more vector data structures into a deduplication frequency distribution includes the following steps: determining the intersection between a first vector data structure in the first group of two or more vector data structures and a second vector data structure in the second group of two or more vector data structures; determining the number of users encoded in the intersection of the first vector data structure and the second vector data structure; and updating the deduplication frequency distribution based on the determined number of users.

[0018] Various aspects of this disclosure also relate to a system for reducing a set of data received from multiple providers, the system comprising: a network interface configured to communicate with multiple servers associated with the multiple providers; and one or more processors coupled to the network interface and a memory including instructions stored thereon, the instructions, when executed by the one or more processors, causing the one or more processors to: receive via the network interface a first set of private sketches from a first provider among the multiple providers and a second set of private sketches from a second provider among the multiple providers, the private sketches representing a set of identifier data, the private sketches corresponding to multiple frequencies; generate a combined distribution using the first set of private sketches and the second set of private sketches, the combined distribution deduplicating the set of data represented by the first set of private sketches and the second set of private sketches; and store the combined distribution in a database.

[0019] In some implementations, one or more processors are further configured to: combine the first set of private sketches and the second set of private sketches into a merged set of private sketches; and store the merged set of private sketches in a database.

[0020] In some implementations, one or more processors are further configured to: receive a third set of private sketches from a third provider among a plurality of providers; combine the merged private sketches with the third set of private sketches to generate a new set of merged private sketches; and store the new set of merged private sketches in a database.

[0021] In some implementations, the private sketch is a counting vector (VOC).

[0022] In some implementations, the private sketch is any distributed Bloom filter.

[0023] These and other features and characteristics of the present technology, as well as the operational methods and functions of the combination of structurally related elements and components, and the economics of manufacture, will become more apparent when considered with reference to the accompanying drawings, in which similar reference numerals denote corresponding components in the various figures. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to be limiting of the invention. As used in the specification and claims, the singular forms “a,” “an,” and “the” include plural indicators unless the context clearly specifies otherwise. Attached Figure Description

[0024] The accompanying drawings are not intended to be drawn to scale. Similar reference numerals and names in the various drawings indicate similar elements. For clarity, not every component can be labeled in every drawing. These and other aspects and features of the present invention will become apparent to those skilled in the art upon reading the following description in conjunction with the accompanying drawings, wherein:

[0025] Figure 1 A block diagram illustrating an example implementation of a system for generating a set of private sketches to determine the count and frequency of device identifiers is depicted;

[0026] Figure 2 A flowchart depicts the process of encoding a data set into a private sketch set;

[0027] Figure 3 An illustrative example of updating a Bloom filter is depicted;

[0028] Figures 4A-4C An illustrative example of any distributed Bloom filter is depicted;

[0029] Figure 5 A flowchart depicts the process of encoding a dataset into any distributed Bloom filter;

[0030] Figure 6A flowchart is depicted for the process of deduplicating data sets from multiple providers to generate a single distribution;

[0031] Figure 7 A flowchart is depicted for sequentially merging multiple private sketch sets to generate a single private sketch set;

[0032] Figures 8A-8D Example data plots are depicted to show the effects of various experimental parameters of the system on the computations obtained using the sequential merging algorithm;

[0033] Figures 9A-9B Example data plots are depicting a comparison of various experimental parameters of the system and their effects on computations obtained using the pairwise overlap algorithm; and

[0034] Figure 10 The general architecture of an illustrative computer system is shown that can be used to implement any of the computing / processing devices and circuits discussed herein. Detailed Implementation

[0035] The following is a detailed description of various concepts related to methods, apparatuses, and systems for generating and combining per-frequency reach data, as well as implementations of such methods, apparatuses, and systems, which offer increased accuracy and privacy while reducing the size and complexity requirements of data exchange and storage. Since the concepts described are not limited to any particular implementation, the various concepts introduced above and discussed in more detail below can be implemented in any of a variety of ways. Examples of specific implementations and applications are provided primarily for illustrative purposes.

[0036] A group of providers can each interact with individuals within the group and can independently record the occurrence and frequency of such interactions. Here, an individual (which can be used interchangeably with "user," "client," or "customer") can be associated with the frequency of interactions that individual has had with a provider for a specific type of interaction (e.g., a specific content activity, a specific content item, a specific set of content items, a specific type / format of content items, a specific category of content, etc.). The dataset maintained by each provider is protected to ensure the privacy of individuals interacting with the provider, so providers cannot arbitrarily share details of their recorded datasets with other providers in the group. However, the group of providers may be interested in understanding the total distribution of interactions with individuals across the entire group of providers, per interaction frequency. For example, a provider or analyst might want to know how many individuals in the group have interacted with the group of providers a total of 3 times, or how many individuals have interacted with the group of providers a total of 5 or more times, and so on.

[0037] One approach involves using an encoded private sketch to deduplicate datasets from multiple providers to determine the total reach (i.e., the number of individuals who have interacted with at least one provider in the group). A private sketch is a data structure that provides encoded information about a user's identity without revealing the identity of the users included in the sketch. The private sketch is structured, allowing analysts or automated servers to deduplicate datasets. Deduplication refers to removing entries that might be included multiple times in a dataset. For example, a first provider might record interactions with each of individuals A and B, while a second provider records interactions with individuals A and C. However, when combining these two datasets, individual A should only be recorded once, resulting in a total of three individuals recorded as part of the total reach across the first and second providers.

[0038] However, due to the privacy of protected personal information, this method of data set deduplication does not allow for frequency-based analysis (e.g., by frequency accessibility or distribution). For example, by encoding identity into a privacy sketch, providers are prohibited from encoding relevant frequency data of individuals into the privacy sketch, which limits the analyst's ability to accurately deduplicate the data set based on frequency. Referring again to the illustrative example used above, deduplicating a data set in frequency-based analysis means that if individual A interacts twice with the first provider and once with the second provider, the data set should be deduplicated so that individual A is assigned or otherwise counted as having a total frequency of 3. Using this method to attempt to include frequency data associated with user identifiers would increase the size, complexity, and induced errors of the data exchange protocol. It is generally desirable to reduce the size and complexity of data sets to improve the storage and transmission of privacy-protected information.

[0039] Providers are also restricted from sharing anonymized datasets because they would be able to re-identify individuals based on their generic identifiers. One standard for data privacy in anonymized datasets is ensuring that the dataset maintains differential privacy. Differential privacy typically stipulates that the privacy of a specific user included in the dataset is roughly the same as the privacy of individuals not included in the dataset. In other words, differential privacy obscures the ability to determine whether a specific user is included in the dataset.

[0040] This disclosure provides a solution to these problems by defining protocols and related methods for deduplicating datasets for frequency-based analysis in a data exchange processing system. Typically, a group of providers each generate a predefined number of private sketches, where each private sketch corresponds to a specific frequency of interaction between an individual and a provider. Each provider can then share their set of private sketches, enabling the generation of a total distribution. The total distribution anonymically categorizes individuals according to the total number of interactions with the entire group of providers (i.e., the total frequency), allowing providers or analysts to understand how many unique individuals have interacted with the group of providers once, how many individuals have interacted with the group twice, and so on. Therefore, differential private data exchange protocols can be used to reduce the size and complexity of the exchanged datasets and to more accurately deduplicate datasets across the group of providers without exposing protected information.

[0041] A more detailed overview of the protocol is provided below based on the illustrative implementation.

[0042] First, for a set of s providers, all providers agree on a threshold frequency, which can be specified as k.

[0043] Then, each provider i in the group individually generates k private sketches to privately encode identifiers associated with the individuals that provider i has already interacted with. The k private sketches are specified as follows:

[0044] Sketch #1: Identifier for frequency f = 1

[0045] Sketch #2: Identifier for frequency f = 2

[0046] ...

[0047] Sketch #(k-1): Identifier with frequency f = (k-1)

[0048] Sketch #k: Identifier for frequencies f>=k (interchangeable with f=k+)

[0049] Therefore, based on the number of interactions between the individual and provider i, each identifier in the provider record can be encoded into one of the k private sketches.

[0050] If there exists an individual with which provider i does not interact (which often happens), that individual will not be encoded into any of provider i's private sketches.

[0051] Each of the s providers generates a set of k private sketches, which can be combined to form a total distribution across all s providers. The frequency reachability of a specific frequency w (i.e., the total number of individuals in the group of providers with a specific number of interactions) can be represented by the following notation:

[0052] R w =R(f1+f2+…+f s =w)

[0053] Each R is a function that outputs the total number of unique individuals with a total frequency of w based on various frequency combinations at each of the s providers. As an illustrative example, for w = 3, if an individual interacts twice with provider (1) (f1 = 2), once with provider (2) (f2 = 1), and has no interaction with any of the other providers (f3, ..., f...). s If =0), then the individual will be calculated within the total reachable range of the frequency bin R3.

[0054] Several methods can be used to estimate the frequency reachability R. w This will be described in more detail in subsequent chapters. One such approach is to combine the individual sketches from the provider to generate a set of combined sketches from which the total distribution can be computed. Another such approach is to generate the total distribution directly from the set of sketches based on the intersection and union of the individual sketches.

[0055] The technical advantage of the disclosed method and system is the reduction in the size and complexity of transmitting and storing declassified data sets. As mentioned above, the data set is encoded into a privacy sketch, which reduces the overall size of the data set. Furthermore, compared to other differential privacy exchange protocols designed for frequency-based analysis, this solution reduces the complexity of frequency-based differential privacy data sets.

[0056] The second technical advantage lies in improving the accuracy of deduplicated datasets from a private data structure. Differential privacy (DP) can be tested by defining a non-zero error value ε corresponding to the confidence level that statistically determines whether an individual is included in the dataset. The ε value is considered the marginal difference between two identical datasets, differing only in whether they include individuals. Differential privacy is maintained when the confidence level is less than ε. For smaller datasets, the variation in the dataset will be proportionally greater, and noise (sometimes called DP noise) can be added to the dataset to maintain the ε-DP threshold. Similarly, for distributions with large biases, such as those encoding frequency data using the aforementioned method, a higher percentage of DP noise will be added to maintain differential privacy, leading to an increase in the error of the overall distribution estimate. By not encoding frequency data in the private sketches associated with identifiers, this solution thus increases the accuracy of deduplicated data.

[0057] The example use cases for the systems and methods described here may relate to the healthcare industry. For instance, a group of hospitals may each provide services to a city or region, and each hospital may internally record the number of interactions with specific patients. Hospitals may be interested in understanding how frequently patients within that group of hospitals receive the services they provide (e.g., ER (Emergency Room) visits). However, due to legal constraints on sharing protected personal information, hospitals may not be allowed to share the identities of patients they have served, thus limiting their freedom to share their data to calculate the deduplication of patient service frequency. This solution provides a secure way for multiple hospital data processing systems to share private patient information while still allowing for estimation of the overall distribution.

[0058] Another example use case for the systems and methods described herein might involve online advertising. Online marketers may pay to display ads on multiple websites. To better understand their potential customers, marketers might want to know how frequently internet users have viewed their ads across multiple websites. However, again due to privacy concerns regarding online user data, website servers may not be allowed to share with others who has visited their website or how many times a specific user has viewed a webpage containing an ad. The solution described herein allows websites to privately share marketing data without exposing sensitive user information, enabling advertisers to know how many people have viewed their ads and how many times.

[0059] Now for reference Figure 1A system 100 is illustrated for frequency deduplication of datasets from multiple providers to generate a total reachability distribution of interactive data. System 100 may include at least one data processing system 105A-105S (sometimes commonly referred to as data processing system 105), at least one network 110, at least one deduplication server 115 (interchangeable with an analysis server), and at least one analyst device 120. In some embodiments, system 100 includes at least one client device 135A-135N (sometimes commonly referred to as client device 135). Data processing system 105 includes processing circuitry 106 having at least one processor 107 and storage medium 108, the storage medium 108 including at least one vector generator 140, at least one frequency identifier 145, at least one vector selector 150, at least one data record hasher 155, and at least one vector encoder 160. Database 125 may include at least one data record 130, which may include a client identifier 132 and a corresponding attribute 134. Similarly, the deduplication server 115 includes a processing circuit 116 having at least one processor 117 and a storage medium 118, the storage medium 118 including at least one protocol coordinator 165, at least one vector deduplication unit 170, at least one distribution generator 175 and at least one GUI generator 180.

[0060] Each component of system 100 (e.g., data processing system 105, network 110, deduplication server 115, analyst device 120, client device 135) may use hardware components, software (instructions stored on one or more computer-readable storage media), or a combination thereof (e.g., as described herein). Figure 10 The detailed computing system 1000 is implemented using hardware components or a combination of software and hardware components. For example, the data processing system 105 may include a server or other computing device. The analyst device 120 may include a server or other computing device. Similarly, sub-components of the data processing system 105 and the deduplication server 115 (e.g., vector generator 140, frequency identifier 145, vector selector 150, data record hasher 155, vector encoder 160, protocol coordinator 165, vector deduplication 170, distribution generator 175, and GUI generator 180) may be implemented as different or combined hardware and / or software elements to perform the functions described in detail herein.

[0061] Network 110 may include computer networks such as the Internet, local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs) or other LANs, intranets, satellite networks, other computer networks (such as voice or data mobile phone communication networks), and combinations thereof. The data processing system 105 of system 100 may communicate via network 110 with, for example, another data processing system 105A-105S, a deduplication server 115, and / or an analyst device 120. Network 110 may be any form of computer network that relays information between the deduplication server 115, the data processing system 105, and one or more other sources (such as web servers). In some embodiments, network 110 may include the Internet and / or other types of data networks, such as local area networks (LANs), wide area networks (WANs), cellular networks, satellite networks, or other types of data networks. Network 110 may also include any number of computing devices (e.g., computers, servers, routers, network switches, etc.) configured to receive and / or transmit data within network 110. Network 110 may also include any number of hardwired and / or wireless connections. The deduplication server 115 can wirelessly communicate with transceivers of other computing devices in network 110 via, for example, WiFi, cellular, radio, etc., or via hardwired connections (e.g., fiber optic cables, CAT5 cables, etc.). The deduplication server 115 can also wirelessly communicate with computing devices in network 110 via proxy devices (e.g., routers, network switches, or gateways).

[0062] Data processing system 105 may include at least one processor and memory, i.e., processing circuitry. The memory stores processor-executable instructions that, when executed by the processor, cause the processor to perform one or more operations described herein. The processor may include a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof. The memory may include, but is not limited to, electronic, optical, magnetic, or any other storage or transmission device capable of providing program instructions to the processor. The memory may also include floppy disks, CD-ROMs, DVDs, magnetic disks, memory chips, ASICs, FPGAs, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), flash memory, optical media, or any other suitable memory from which the processor may read instructions. Instructions may include code from any suitable computer programming language. Data processing system 105 may include one or more computing devices or servers capable of performing various functions, including, for example, the functions or methods described herein.

[0063] Database 125 may be a database configured to store and / or maintain any information described herein. Database 125 may maintain one or more data structures that may contain or index each value, multiple values, or threshold described herein. Database 125 may be accessed using one or more memory addresses or index values. Database 125 may be accessed by components of data processing system 105, or in some embodiments by analyst device 120 via network 110. In some embodiments, database 125 may reside outside of data processing system 105 and may be accessed via network 110. Database 125 may be distributed across many different computer systems or storage elements and may be accessed via network 110 or a suitable computer bus interface. Data processing system 105 may store in database 125 the results of any or all calculations, determinations, selections, identifications, generation, constructions, or computations in one or more data structures indexed by appropriate values, each of which may be accessed by data processing system 105 or client device 135 to perform any of the functions or features described herein.

[0064] Analyst device 120 may be a computing device configured to communicate via network 110 to display data, such as indications provided by data processing system 105 (e.g., an indication of the cardinality of a set of client identifiers 132, attribute 134, frequency values, or any other values ​​described herein). Analyst device 120 may be a desktop computer, laptop computer, tablet computer, smartphone, personal digital assistant, mobile device, consumer computing device, server, client, digital video recorder, set-top box, video game console, or any other computing device configured to communicate via network 110. Analyst device 120 may send or receive one or more client identifiers 132 or one or more attributes 134 to data processing system 105. In some embodiments, analyzer device 120 may communicate with at least one database 125 to store client identifiers 132 or attributes 134 associated with a particular analyzer device 120.

[0065] Analyst device 120 may include a processor and memory, i.e., processing circuitry. The memory stores machine instructions that, when executed by the processor, cause the processor to perform one or more operations described herein. The processor may include a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof. The memory may include, but is not limited to, electronic, optical, magnetic, or any other storage or transfer device capable of providing program instructions to the processor. The memory may also include floppy disks, CD-ROMs, DVDs, magnetic disks, memory chips, ASICs, FPGAs, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), flash memory, optical media, or any other suitable memory from which the processor may read instructions. Instructions may include code from any suitable computer programming language.

[0066] Analyst device 120 may include one or more user interface devices. Generally, a user interface device refers to any electronic device (e.g., keyboard, mouse, pointing device, touchscreen display, microphone, etc.) that transmits data to a user by generating sensory information (e.g., visualizations on a display, one or more sounds, etc.) and / or converts sensory information received from a user into electronic signals. One or more user interface devices may be internal to the housing of analyzer device 120 (e.g., a built-in display, microphone, etc.) or external to the housing of analyzer device 120 (e.g., a monitor connected to analyzer device 120, a speaker connected to analyzer device 120, etc.). In some embodiments, analyzer device 120 may include an electronic display that visually displays an interface using interface data provided by an operating system running on analyzer device 120, retrieved from database 125, or provided by data processing system 105.

[0067] Client device 135 may be a computing device configured to communicate via network 110 to display data (such as indications provided by data processing system 105, e.g., an indication of the cardinality of a set of display identifiers 132, attributes 134, frequency values, or any other values ​​described herein)). Client device 135 may be a desktop computer, laptop computer, tablet computer, smartphone, personal digital assistant, mobile device, consumer computing device, server, client, digital video recorder, set-top box, video game console, or any other computing device configured to communicate via network 110. Client device 135 may send or receive one or more client identifiers 132 or one or more attributes 134 to the data processing system. Client device 135 may communicate with at least one database 125 to store client identifiers 132 or attributes 134 associated with a respective client device 135.

[0068] Client device 135 may include a processor and memory, i.e., processing circuitry. The memory stores machine instructions that, when executed by the processor, cause the processor to perform one or more operations described herein. The processor may include a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof. The memory may include, but is not limited to, electronic, optical, magnetic, or any other storage or transmission device capable of providing program instructions to the processor. The memory may also include floppy disks, CD-ROMs, DVDs, magnetic disks, memory chips, ASICs, FPGAs, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), flash memory, optical media, or any other suitable memory from which the processor may read instructions. Instructions may include code from any suitable computer programming language.

[0069] Client device 135 may include one or more user interface devices. Generally, a user interface device refers to any electronic device (e.g., keyboard, mouse, pointing device, touchscreen display, microphone, etc.) that transmits data to a user by generating sensory information (e.g., visualization on a display, one or more sounds, etc.) and / or converts sensory information received from the user into electronic signals. One or more user interface devices may be internal to the client device 135 (e.g., a built-in display, microphone, etc.) or external to the client device 135 (e.g., a monitor connected to the client device 135, a speaker connected to the client device 135, etc.). In some embodiments, client device 135 may include an electronic display that visually displays an interface using interface data provided by an operating system running on client device 135, retrieved from database 125, or provided by data processing system 105.

[0070] Accordingly, client device 135 can interact with one or more providers' data processing systems 105 via the transmission of provider content (such as content associated with provider content activities related to a specific category, item, or product) via web pages or applications. Interactions between the user and the provider can include web page downloads, subscriptions, viewings, clicks, or any other type of interaction.

[0071] Data processing system 105 can maintain at least one data record 130 in database 125. Data record 130 may include, for example, at least one client identifier 132 and at least one attribute 134. Client identifier 132 may correspond to a user (which can be used interchangeably with client), client device 135, or other agent associated with a user. Attribute 134 may be associated with client identifier 132 in data record 130 and includes information about the attributes of the corresponding client. Attributes may include, for example, client device location data, client device metadata, client device parameters, settings and other information, user profile data, interactions performed by client device 135, application browsing history, web page browsing history, activity information, device characteristics, whether client device 135 has viewed or interacted with content items, network usage information, power usage information, and device operating system version, settings and other information, etc. Data processing system can receive device identifier and attribute data from each client device 135 and generate and maintain corresponding data records for each client device 135 in database 125. In some implementations, each data processing system 105 may receive client device identifiers and information only from a specific set of users or client devices 135. Data processing systems 105A-105S may maintain their respective data records in their own database 125, which cannot be accessed by other data processing systems 105A-105S. According to some implementations, different user groups may be served by different identifier servers (e.g., data processing system 105), and each data processing system may maintain its own set of data records corresponding to a specific user in its user set.

[0072] In various embodiments, each of the data processing systems 105A-105S can be associated with a provider within a group of providers. The data processing systems 105A-105S can thus record and manage data regarding interactions between the respective provider and individuals within the group. In some embodiments, the providers among the providers can utilize multiple data processing systems 105 to implement the functions described herein. In some embodiments, the data processing systems 105A-105S can be configured to communicate via network 110 with a client device 135 associated with a user and to record interactions with the associated client device 135.

[0073] Data processing system 105 is shown to include vector generator 140, which can be configured to generate vector data structures for encoding a dataset. Vector generator 140 can generate vectors comprising multiple coordinates. To generate vectors, vector generator 140 can allocate one or more memory regions within data processing system 105 to accommodate at least one counting register. The allocated counting register can correspond to at least one coordinate of the vector. By generating and allocating memory for one or more counting registers, vector generator 140 can generate vectors comprising counting registers. Vector generator 140 can initialize each counting register of the vector to an initial value, such as 0 or 1. Vector generator 140 can generate vectors that can correspond to a Bloom filter to have any number of counting registers (sometimes referred to as "buckets"). For example, vector generator 140 can receive instructions to generate a Bloom filter with n buckets, or it can access internal configuration settings provided by an external computing device that specify the size of the Bloom filter by the number of buckets or counting registers.

[0074] Similarly, vector generator 140 can be configured to receive an indication of the number of vectors to be generated for the vector set. In some embodiments, vector generator 140 may receive a designation of frequency intervals to associate with the generated vector set. Vector generator 140 may annotate each vector in the vector set or otherwise associate it with a frequency corresponding to a frequency in the frequency designation. In some embodiments, the designation may be received from deduplication server 115. In some embodiments, each frequency corresponds to a single frequency. In some embodiments, some designations may correspond to frequency ranges. In one embodiment, the frequency designation specifies a set of frequency intervals (1, 2, ..., k-1, k+). As will be understood, different arrangements of the frequency designation may be used for the set of private sketches. For example, additional private sketches may be included, such as a private sketch representing 1+. In some embodiments, the private sketches in the set may each correspond to one of (1, 2, ..., k-1, k+).

[0075] Frequency identifier 145 is configured to determine frequency data associated with client identifier 132. In some embodiments, frequency identifier 145 may determine the frequency data of client identifier 132 based on data stored in attribute 134. For example, frequency identifier 145 may determine the number of times the client identifier appears in data record 130. In some embodiments, frequency identifier 145 determines the frequency of a particular service or interaction, so that not all interactions associated with the client identifier may be counted. In some embodiments, frequency identifier 145 stores frequency data as part of attribute 134 associated with client identifier 132. In some embodiments, frequency identifier 145 may update the frequency data of client identifier 132 periodically or continuously. The frequency data determined by frequency identifier 145 may subsequently be accessed or otherwise transmitted to vector selector 150 for encoding the identifier into a private sketch corresponding to the frequency data associated with the identifier.

[0076] Vector selector 150 is configured to determine the appropriate sketch from a set of sketches for encoding the identifier. Vector selector 150 may access or otherwise retrieve frequency data generated by frequency recognizer 145 to determine the appropriate sketch corresponding to the relevant frequency. In some embodiments, vector selector 150 determines a single sketch from a set of vectors to encode the identifier. In other embodiments, vector selector 150 may determine whether to encode the identifier across multiple vectors.

[0077] The data record hasher 155 can identify one or more hash functions from a list of hash functions that can be used to encode identifiers in a vector data structure. For example, each hash identified in the hash list can provide a normal distribution or random expectation based on the input value. That is, for example, similar inputs to a hash function do not necessarily have similar outputs to the hash function. The hash function can be selected as the optimal hash function for a Bloom filter. For example, the data record hasher 155 can select independent and uniformly distributed hash functions. Such hash functions can include, for example, noise hashes, Fowler-Noor-Wall series hashes, or Jenkins hashes. The data record hasher 155 can select or identify multiple hash functions and apply each hash function to each data record to generate a set of hashed data records.

[0078] Data record hasher 155 can hash each data record maintained by the corresponding data processing system 105 to create a corresponding set of hashed data records. Applying hashed data records may include using the data record as an argument to a hash function identified by data record hasher 155. Data record hasher 155 can hash each data record using each identified hash, thereby producing multiple hash values ​​corresponding to a single data record. In this way, data record hasher 155 can iterate over each data record and apply each hash function to it as each data record is selected. After applying the hash function, data record hasher 155 can store each hashed data record associated with the corresponding data record in the memory of the corresponding data processing system 105. Data record hasher 155 can also extract register identifiers from each hashed data record corresponding to each data record maintained by the corresponding data processing system 105. Each hashed data record in the set of hashed data records may correspond to a count register of a vector generated by vector generator 140. To identify the corresponding counter register, the data record hasher 155 can extract the register identifier from each hash data record. The data record hasher 155 can extract the register identifier (e.g., by performing a modulo operation on each hash data identifier using multiple counter registers in the vector).

[0079] Vector encoder 160 is configured to update a count register in a vector based on the output of data recording hash 155. For example, vector encoder 160 may receive coordinates of a vector data structure from data recording hash 155, in which identifiers are encoded, and vector encoder 160 updates the count register accordingly. Vector encoder 160 may implement one of various counting structures, such as a Bloom filter or a counting vector. Vector encoder 160 may be configured to determine whether an identifier has been encoded into at least one vector. In some such embodiments, vector encoder 160 may store an attribute 134 indicating whether a specified data entry has been encoded into a sketch. Vector encoder 160 may be configured to iterate over a set of data entries and facilitate encoding the data set into a set of vectors generated by vector generator 140 via communication with frequency recognizer 145, vector recognizer 150, and data recording hash 155. In some embodiments, vector encoder 160 may be configured to store the updated vectors in memory (such as database 125).

[0080] Referring to deduplication server 115, deduplication server 115 can be configured as a separate server with which data processing system 105 communicates. In some embodiments, the functionality and features of deduplication server 115 are included in one or more data processing systems 105, such that data processing system 105 deduplicates multiple datasets via direct communication with other data processing systems 105. For example, data processing system 105A can query data processing systems 105B-105S to request a private sketch set for each data processing system, and data processing system 105A generates a deduplication distribution of the datasets based on the private sketch set. In another example, data processing systems 105A-105S are configured to automatically generate their respective private sketch sets and send them to other data processing systems 105 according to predetermined time intervals or triggers (e.g., daily, monthly, yearly, etc.). In one embodiment, the functionality of deduplication server 115 is distributed across multiple data processing systems 105.

[0081] The deduplication server 115 is shown to include a protocol coordinator 165. The protocol coordinator 165 can transmit standardized protocol parameters to each data processing system 105. Protocol parameters may include, but are not limited to, frequency specifications, data structure type, data structure length or size, and hash function. The protocol coordinator 165 can determine the protocol parameters based on user input received from user equipment (such as analyst device 120). The protocol coordinator 165 can facilitate the requesting data processing system 105 to retrieve multiple private sketch sets from each provider. The protocol coordinator 165 can store the protocol parameters in the memory of the deduplication server 115 for later reference.

[0082] Vector deduplication 170 includes logic configured to deduplicate a set of vectors received from data processing system 105. Vector deduplication 170 may implement one or more algorithms for deduplication, such algorithms including vector operations such as intersection, union, or set difference. In some embodiments, vector deduplication 170 determines a preferred deduplication algorithm based on the size or number of data sets. In some embodiments, vector deduplication 170 generates a set of vector data structures representing the deduplication of the comprehensive data set. In such embodiments, vector deduplication 170 may be configured to generate and store the vector set based on multiple encoded data sets.

[0083] Distribution generator 175 is configured to determine a frequency-based count of the total distribution (used interchangeably with a histogram). In some implementations, distribution generator 175 determines the total deduplication distribution based on a set of combined vectors received from vector deduplication unit 170. In some implementations, distribution generator 175 estimates the total distribution directly from a received sketch. To determine counts at specific frequencies, distribution generator 175 can determine the cardinality of the vectors. In some implementations, HyperLogLog (HLL) is used as the cardinality estimator. The cardinality estimator can estimate the number of elements in a multiset M that is practically very large. HLLs are characterized by low error rates, low variance, and low memory usage. Furthermore, the union of two HLLs is computationally straightforward, meaning that HLLs can be implemented in distributed counting applications. An extension of HLL (called FreqLogLog (FLL)) allows the number of elements in M ​​and their frequencies to be estimated. Distribution generator 175 can use other counting estimators. Distribution generator 175 can store the total distribution in the memory of deduplication server 115. In some implementations, the distribution generator 175 sends the distribution data to the data processing system 105 or the analyst device 120.

[0084] GUI generator 180 is configured to generate data relating to a graphical user interface (GUI), including a representation of the generated distribution. In one embodiment, GUI generator 180 generates graphical elements that provide a visual representation of the distribution for display to an analyst. In some embodiments, GUI generator 180 maintains web page data including a representation of the distribution and is accessible via network 110. GUI generator 180 may send the generated GUI data to a user device, such as analyst device 120, for display. In other embodiments, GUI data is generated by analyst device 120 based on data received from deduplication server 115.

[0085] Now for reference Figure 2 According to several implementations, a process 200 for generating a set of k vector data structures is illustrated. Process 200 can be executed by one or more processors (such as any of processing systems 105A-105S) coupled to memory. Process 200 typically compresses and demystifies the data set corresponding to the interaction between the provider and the user into a set of private sketches. Accordingly, the generated set of k vector data structures reduces the size of the data set and maintains differential privacy of the identifier values.

[0086] At 202, one or more processors maintain data records corresponding to user interactions with a specific provider within the group of providers. These data records may be maintained in a database over time as the user interacts with the specific provider. Data records may include, but are not limited to, identifiers uniquely identifying the user, interaction types, timestamps or frequency data associated with the interaction, and combinations thereof. In some implementations, data records may include protected personal information and may be encrypted or otherwise stored in a manner that protects the privacy of the information.

[0087] In some implementations, one or more processors receive a specification of the frequency for generating the private sketch. In some implementations, the frequency specification may be received as a predefined set. In some implementations, the specification is a frequency threshold k, where the specified frequency interval is understood to be defined as the set {1,2,…,k-1,k+}. Other protocol information may also be received at 204, such as the type of private sketch to be generated, the size of the private sketch, the hash function, or other parameters of the data structure used to implement the private sketch.

[0088] In some implementations, general information about the provider's dataset can be sent to a central server (e.g., deduplication server 115) to customize parameters of the data exchange protocol. For example, the provider can determine the total number of individuals in the dataset and send the determined number to the central server. The central server can then determine, for example, the optimal vector size defined in the protocol, which can be received by the providers in the group in step 204.

[0089] In step 204, multiple vector data structures are generated based on frequency specifications. In one implementation, each vector in the multiple vector data structures corresponds to a specific frequency interval. The frequency interval can represent a single frequency, multiple frequencies, or a frequency range. In various implementations, the multiple vector data structures can be VoCs. In some implementations, the multiple vector data structures can be Bloom filters. The vector data structures can define coordinates corresponding to multiple counting registers. The multiple vector data structures can be initialized with initial values ​​in each register.

[0090] In step 206, frequency data is determined for user-associated identifiers in the maintained dataset based on corresponding attribute data within the dataset. For example, the number of interactions identifying the identifier in the dataset can be counted to determine the frequency of interactions involving that identifier. In some implementations, frequency data is determined for specific services or interaction types. In some implementations, frequency data is stored as part of attributes retrieved from the dataset. Vectors from a set of vector data structures are selected based on the frequency data. The selected vectors may be vectors corresponding to frequency intervals covering the frequency data associated with the identifier.

[0091] At step 208, at least one vector in the set is updated to encode the identifier. Updating the selected vector may include determining coordinates in the vector based on one or more hash functions and incrementing one or more count registers corresponding to the identified coordinates. In some implementations, each identifier is encoded into only one vector in the set based on frequency data associated with the identifier. In some implementations, the count registers are not updated based on a counting protocol and the values ​​currently stored in the count registers. Details of the vector encoding will be described in subsequent sections.

[0092] In some implementations, the processor may iteratively retrieve data records for entries or identifiers in the dataset, determine the frequency data for each identifier individually, and update one or more vectors of the dataset before iterating to the next entry in the dataset.

[0093] In step 210, once all data entries of interest have been encoded into multiple vector data structures, the private sketch set is sent to the requesting server for processing. In some implementations, the private sketch set can be stored temporarily or for a long period for later use or updating. For example, the server can incrementally update multiple vector data structures as the processor records new entries in the data set.

[0094] The various implementations of configuring private sketches will be discussed in more detail below.

[0095] One type of private sketch that can be used in the disclosed systems and methods is a Count Vector (VoC). A VoC can typically be represented as a vector with multiple counters (buckets, bins, etc.) corresponding to various entries in the vector. A VoC can be a one-dimensional vector defining multiple counter values. A VoC can be implemented as a vector data structure, where the vector data structure is typically defined as a designation or configuration of computer memory, allowing the processor to perform operations at memory locations defined by the data structure corresponding to the defined counters, and to retrieve stored values ​​from those memory locations. Counters in the vector data structure can be configured as bits, one or more bytes, or another higher-order data type.

[0096] Another type of private sketch that can be used in this solution is the Bloom filter. A Bloom filter can provide a compact representation of a set. A Bloom filter can also be implemented as a vector data structure, and insertion and inclusion methods can be implemented; however, due to the compact representation, the probability of this method returning a false positive is very small. This means that it is possible to say that an element is in the set when it might not be in it. On the other hand, false negatives are eliminated, meaning that if the inclusion method returns false, it can always be correct.

[0097] An empty Bloom filter can be a bit array of size m in which all its bits are set to zero. An element x can be inserted by passing it through k hash functions modulo m and then setting the corresponding bit in the Bloom filter to 1 (see example below). This method can work in a similar way and can return true if all k hashes of x modulo m are set to 1, otherwise it returns false.

[0098] Due to the relatively high memory requirements of Bloom filters (e.g., compared to HLL), Bloom filters may not typically be used for cardinality estimation; however, the cardinality of a Bloom filter can be determined by evaluating the following formula:

[0099]

[0100] Where x is the number of 1s (significant bits) in the Bloom filter, m can be the number of bits in the Bloom filter, and n can be an estimate of the cardinality of the Bloom filter.

[0101] The variance of the estimator is approximated by the following equation:

[0102]

[0103] Where n is the cardinality of the true set in the Bloom filter.

[0104] Variance can be derived based on Taylor expansion.

[0105] The sketches described in this section may also be referred to as “AnyDistribution Bloom Filter” (ADBF). The sketches described in this section can include permissible bit distributions that can be adapted to alternative distribution functions other than uniform or exponential. For example, the techniques described herein can implement a linearly attenuated Bloom filter (BF), a hyperbolic BF, or a mixture of uniform and exponential BFs. One or more data processing systems or servers (e.g., data processing system 105 or deduplication server 115) can effectively apply noise correction.

[0106] Furthermore, the estimation technique implemented by the data processing system or server (e.g., data processing system 105 or deduplication server 115) can be implemented such that all bits of the sketch contribute to cardinality estimation, unlike a legion-based implementation where only the bits of the reference legion are used. Instead of selecting a reference legion, the data processing system can tune the weight of each bit in the sketch, where the weight values ​​indicate the contribution of the bits in the sketch to the final cardinality estimation. Based on the sketch's parameters, the data processing system can derive the optimal weight for each bit in the sketch to improve the overall accuracy of the cardinality estimation.

[0107] Now for reference Figure 3 This diagram illustrates a flowchart 300 showing the insertion of a data record X into a Bloom filter by at least one data processing system (e.g., at least one data processing system 105, etc.). In block 302, the data processing system can indicate the data record to be inserted into the Bloom filter. For example, the indicated data record can be selected from a database (e.g., database 125). The data processing system can select multiple hash functions (shown here as h1, h2, and h3). Although only three hash functions are shown, it should be understood that the data processing system can utilize any number of hash functions to insert the data record into a standard Bloom filter. In blocks 304A-304C, the data processing system can perform at least one copy and hash of the data record X using each identified hash function. The hash function can be, for example, the ElGamal hash described herein, or any other type of hash (such as SHA-1, SHA-2, MD5, etc.). By performing three copies and hashes of the data record X, the data processing system has generated three hashed data records (in... Figure 3 The values ​​are shown as h1(x), h2(x), and h3(x)). Still referring to boxes 304A-304C, the data processing system can extract an index value from each hash data record. The extracted index value can correspond to at least one corresponding position in the Bloom filter. Figure 3 In the provided example, each hash is calculated modulo 11, which is the number of register locations in the Bloom filter. Although the Bloom filter uses only 11 register locations, it should be understood that any number of count registers can be used to implement a Bloom filter.

[0108] exist Figure 3In further details, the modulus 11 of h1(x) equals 1, the modulus 11 of h2(x) equals 3, and the modulus 11 of h3(x) equals 9. Each of these values ​​can be used by the data processing system as a pointer to a count register associated with a corresponding position in the Bloom filter (e.g., ID value, etc.). For example, the modulus 11 of h1(x) (equals 1) can point to position "1" in the Bloom filter, the modulus 11 of h2(x) (equals 3) can point to position "3" in the Bloom filter, and so on. These are purely illustrative values ​​for the purpose of explaining the operation associated with the Bloom filter and should not be construed as limiting the scope of any implementation of the Bloom filter described. The data processing system can update (e.g., insert data records) the Bloom filter by activating the bits pointed to by each count register by the corresponding hash function, thereby producing an updated Bloom filter 306. Note that although Figure 3 The description states that each counter register increments by only 1, but it should be understood that the data processing system can increment any counter register by any numerical amount, such as the number of bytes, the number of bits, or any other value, threshold, or estimate relative to the description herein.

[0109] For the purpose of describing an ADBF implementation, an example ADBF implementing probabilistic counting and stochastic averaging (PSCA) is described.

[0110] PSCA-based techniques can utilize bitmap data structures. Bitmap data structures can be implemented in several ways, such as vector data structures with coordinates defined by registers and bit positions within the registers, vector-to-vector data structures, etc. Figure 4A A 3×2 bitmap of the PCSA is shown. Each cell value can be a bit equal to 1 or 0. Here, the general indicators “row” and “column” are used to describe the location of a specific cell. A row can also be referred to as a register. In the PSCA sketch, identifiers can be assigned to cells based on their bit sequence. For example, each row can occupy 1 / nrows of the total universe identifiers (1 / 3 in our example). Columns can occupy an exponentially decaying fraction of the total universe identifiers. For example, column 1 can occupy 1 / 2, column 2 can occupy 1 / 4, and so on. The cells therefore occupy 1 / nrows*( of the total universe identifiers). 1 / 2)^column_id. Below is an exemplary representation of a 3×2 PSCA sketch.

[0111] like Figure 4BAs shown, a PCSA bitmap can be flattened into a bit vector. This vector arranges the cells according to column order. The first segment has 3 cells from the first column. Each of them occupies 1 / 6 of the total set ID. The second segment has 3 cells from the second column. Each of them occupies 1 / 12 of the total set ID. Clearly, bitmaps and bit vectors are equivalent and can be mapped 1-1 to each other.

[0112] An ADBF sketch can be a generalized form of such a sketch. An ADBF sketch can take the entire set of any probability, such as... Figure 4C The general form shown.

[0113] Because the probability distribution at each position in the sketch can be generalized to any value, other structures described in this paper can emerge. For example, if the weights of all probability values ​​are equal to 1 / m, where m is the number of positions in the sketch, a classic Bloom filter implementation appears. Similarly, a PSCA-like sketch emerges when “droplet” probabilities are assigned to each segment. Furthermore, when using the exponent p value, it makes:

[0114]

[0115] Where i is the index of the position in the sketch, c is the normalization factor, and m is the number of positions in the sketch, a sketch of the Liquid Legion type appears.

[0116] The exponential Bloom filter case described below has a closed-form maximum likelihood solution utilizing a sophisticated statistical model and interpretation. Next, the ADBF and some theoretical formulas are described, including constructing the ADBF from an identifier, adding noise, calculating the unique count of an ADBF, and calculating the unique count of many combined ADBFs. Simulation results comparing the Bloom filter, PCSA / CL, and ADBF are provided.

[0117] The provider computing device (e.g., data processing systems 105A-105S) can construct a generalized Bloom filter (ADBF) as follows. The κ (kappa) parameter is an adjustable parameter whose value can be set to 1, but can also be less than 1. The data processing system can access one or more data records (e.g., identifiers and attributes, or identifiers that meet a certain criterion, etc.) for constructing the ADBF data structure. For example, the data processing system can access a database (e.g., database 125, etc.) to access one or more data records for inserting the constructed ADBF sketch. The ADBF sketch can be maintained in the memory of the data processing system and can be initialized to initial values, as described in subsequent sections regarding different sketch implementations. For example, the program used to construct the ADBF sketch can be substantially similar to cascading a legion sketch or a liquid legion sketch and can be based on parameters stored in the memory of the data processing system or received from another device.

[0118] After construction, the following techniques can be used to map data records to their locations in the ADBF. An ADBF sketch can be constructed by including multiple buckets k and any probability vector (p1, p2, ..., p...). k ), where all p i The sum of (i from 1 to k) equals κ. The value of κ can be equal to 1, but does not need to be. The probability vector allows each coordinate in the probability vector to be assigned to a single bucket or register in the ADBF sketch. Each identifier of a data record (e.g., a data record maintained in database 125, etc.) can be assigned a probability p. i Bucket i is inserted into the ADBF sketch. In practice, let h be a hash recognized by the data processing system 105 that uniformly maps the identifier space (e.g., the data record space, etc.) to (0, 2^64). Then, if the expression is satisfied... Then data record x can be inserted into bucket i. For a set of data records (data records can be used interchangeably with the term "identifier"), if at least one data record in the set is inserted into bucket i, then its corresponding NBF has element i = 1, otherwise it is equal to 0. Note that the liquid legion technique described in Section D of this paper can be such that p is determined based on an exponential distribution. i The case of ADBF.

[0119] To maintain differential privacy of their sketches, each provider computing device (e.g., data processing systems 105A-105S, etc.) can flip certain bits with a predetermined probability. The process of flipping bits to add noise can be referred to herein as "blipping," and sketches that have been introduced with noise through probabilistic bit flipping are sometimes referred to as "blipped." The estimator implemented by the data processing systems (e.g., data processing systems 105A-105S, deduplication server 115, etc.) can be further extended to accurately calculate the cardinality of the union of noisy (e.g., blipped) ADBF sketches generated by data processing system 105.

[0120] The BLIP (Blend Inversion Protocol) technique described in this section can be differentially privacy-secure. Specifically, ADBF+BLIP is obtained by flipping each bucket of the original NBF. A binary 0 can be flipped to a binary 1, and a binary 1 can be flipped to a binary 0 with equal probability p. In some implementations, a binary 0 value can be flipped to a binary 1 with probability p, and a binary 1 value can be flipped to a binary 0 with probability q.

[0121] The cardinality of the union of ABDF sketches can be estimated to determine a specific count or reachable range. The estimator may include a series of tuning parameters, or retrieve a series of tuning parameters from the memory of a computing device (e.g., data processing system 105, deduplication server 115, etc.) executing the estimator. An estimator, run, executed, or otherwise implemented by one or more computing devices described herein, can deduplicate noise-free ADBF sketches (e.g., ADBF sketches without combined noise). When merging noise-free ADBF sketches, the union of the ADBFs (denoted as b = [b1, b2, ..., b...)) is observed. k For 1≤i≤k, if at least one data record from the union is mapped to the bucket, then b i =1, otherwise b i It equals zero. The torque method can be used to determine the torque values ​​based on b1, b2, ..., b. k Estimate the union. Note that pi represents the probability that any data record is mapped to bucket i. Considering the union cardinality u, the probability that none of the u data records fall into bucket i is equal to (1-pi). u In other words, P(b) i =0) =(1–pi) u Therefore, E(b) i =1|u)=1–(1–p i ) u Therefore, the total number of 1s has an expected value. Therefore, by inserting the observed b i This allows us to obtain an estimate of u.

[0122] Now for reference Figure 5 This illustrates a process 500 for generating and updating any distributed Bloom filter. Although process 500... Figure 5 While illustrated as updating a single Bloom filter (BF), process 500 can be incorporated into process 200 as described above, thus incorporating any features described regarding process 200. For example, process 500 can be integrated into process 200 to perform step 208 on various vectors in a set of vector data structures, depending on the vector selected for a given entry. Process 500 can be executed by one or more processors (such as any of the data processing systems 105) coupled to memory.

[0123] In step 502, the k-th data entry from the set of N data entries is retrieved for encoding into the BF. The k-th data entry can define an identifier to be encoded into the BF. In step 504, the identifier is hashed using one or more hash functions. These hash functions are configured to receive the identifier as input and output a hash value based on the input defining the coordinates in the BF. In step 506, M coordinates in the BF are identified based on one or more outputs of the one or more hash functions. In some implementations, one or more outputs of the one or more hash functions can be passed using a modulo operator to convert the output into valid coordinates in the BF.

[0124] Then, one or more coordinates identified in 506 can be iterated to update BF (represented by counter j). In 508, a counter register corresponding to the j-th coordinate is selected. In some implementations, the j-th coordinate defines the memory location of the corresponding counter register. In 510, the selected register is incremented, if appropriate, to encode the k-th identifier. For example, if the selected register currently holds a binary value of 0, it can be incremented to hold a binary value of 1. As a counterexample, if the selected register currently holds a binary value of 1, it may not be incremented because the register already holds a binary value of 1. The determination in 512 iterates over the coordinates of M identifiers for the k-th identifier. If the criteria at 512 are not met, step 514 is performed to increment the j-counter, and steps 508-512 are repeated for the next coordinate.

[0125] If the criterion at 512 is met, process 500 continues at decision 516. Decision 516 determines whether all data entries have been encoded into the BF. If the criterion at 516 is not met, counter k is incremented at 518, and process 500 is repeated for the next data entry. If the criterion at 516 is met, the update of the BF is complete, and the vector can be transferred to the processing system at 520 or otherwise output to the storage device.

[0126] Now for reference Figure 6A process 600 for aggregating data sets from multiple providers to generate a deduplicated data set is illustrated. Process 600 can be implemented by one or more processors coupled to memory, such as a deduplication server 115 or a data processing system 105. Process 600 can be executed by a central server device that enables the implementation of a confidential data exchange protocol among multiple providers, or it can be executed by a single provider among the multiple providers. Typically, process 600 combines sets of confidential sketches generated by the processing systems of the first and second providers, for example, these confidential sketches can be generated via process 200. Although process 600 is shown as including only data sets from two providers, process 600 can include data sets from any number of providers to generate a deduplicated distribution.

[0127] At 602, a first set of private sketches is received from a first provider, and a second set of private sketches is received from a second provider. Each private sketch in the first and second sets encodes an identifier associated with an interaction with each of the first and second providers, and each private sketch corresponds to a specific frequency or frequency range. Private sketches can be configured and received as vector data structures, such as VoC or ADBF. Private sketches can be differentially private, such that the identifier of the user encoded in the private sketch can be ambiguous.

[0128] At 604, a combined deduplicated distribution is generated using the first and second private sketch sets. Several methods can be performed to generate the deduplicated dataset. In one implementation, the first and second private sketch sets are combined to generate a merged private sketch set that deduplicates the two datasets. The overall distribution can then be estimated based on the merged private sketch set. In another implementation, set operations (such as intersection, union, and set difference between individual sketches) can be used to directly estimate the frequency distribution based on the private sketch set.

[0129] At 606, the deduplicated distribution is stored in a database. In some implementations, the database can be accessed and viewed by multiple provider processing systems. A technical advantage is achieved in process 600 because two data sets encoded into two private sketch sets are reduced to a single deduplicated data set. Since less data needs to be stored to maintain the same or nearly identical information, the single data set reduces the size and complexity of the memory requirements for storing distribution data across multiple providers. At 608, a user interface can be generated to display a representation of the deduplicated distribution. The user interface can be output to a display associated with the processing system or sent to a separate processing device for display.

[0130] In some implementations, the frequency specification is transmitted to both the first and second providers. The frequency specification may typically indicate parameters of one or more privacy data exchange protocols. In some implementations, the frequency specification may define a maximum frequency threshold k to indicate the request for k privacy sketches from each provider, corresponding to frequency intervals in the set {1,2,…,k-1,k+}. In some implementations, the frequency specification is transmitted to each provider via an "offline" medium (e.g., via a face-to-face meeting or verbal agreement), thus eliminating the need for step 602.

[0131] The following sections will describe some methods for deduplication in more detail.

[0132] A method for estimating the frequency reachable range R k The method used is a sequential merge algorithm. The sequential merge algorithm merges sketches from the first and second providers to create a first merged sketch set. This first merged sketch set is then merged with sketches from the third provider, and so on, until all *s* providers have been merged. The final aggregation of the merged sketch sets is used to obtain the overall distribution.

[0133] The sequential merge algorithm can typically be represented as follows.

[0134] Suppose the first provider publishes the first set of sketches {x1, x2, ..., x}. k-1 ,x k+}, and the second provider publishes the second set of sketches {y1,y2,…,y k-1 ,y k+}

[0135] First, a sketch is generated for each provider to represent the frequency reachability range of 1+. Given that the sketches for each provider are disjoint, the 1+ sketch can be generated as follows:

[0136]

[0137] and

[0138]

[0139] For a specific frequency j less than k, the j-th sketch representing the combination of the first and second providers can be computed as:

[0140]

[0141] Where (∪) is the union operator, (∩) is the intersection operator, and (\) is the difference operator. Repeat the formula for j values ​​from 1 to k-1 to generate k-1 sketches.

[0142] To generate a sketch of the combination of k+, the combination can be calculated as follows:

[0143]

[0144] Note that the above equation takes into account x0 and y. k+ The intersection of these two sets can be obtained according to the following equation:

[0145] (x0∩y k+ )=y k+ \(x 1+ ∩y k+ )

[0146] Therefore, k sketches can be generated as a combination of sketch sets from the first provider and the second provider, by the set {z1, z2, ..., z...} k-1 ,z k+} represents the set of additional providers in the group of s providers. This can be achieved by combining the set {z1, z2, ..., z...}. k-1 ,z k+ The process of combining sketches from s providers is recursively repeated, starting with the sketches generated by the third provider, then the fourth provider, and so on. After combining the s sets of sketches from s providers, the final combined set is... It can be used to generate the final distribution across all providers.

[0147] Now for reference Figure 7 Process 700 generally illustrates the above method for sequentially merging k sketches from each of s providers.

[0148] At 702, an empty vector set is generated as the working set of vectors through the recursive merging operation of process 700. This empty vector set contains the same number of vectors as agreed upon by the multiple providers and is configured in the same way as the vectors received from the multiple providers. At 704, k vectors received from the first provider among the multiple providers are copied into the working set of vectors. In some implementations, the first provider may be randomly selected from the multiple providers.

[0149] In 706, the counter j is defined to iterate over the remaining s-1 providers. The counter j is shown to be initialized to 2, such that the first provider is excluded from the iteration. In 708, the vector set from the j-th provider is retrieved. Then, in 710, the k vectors from the j-th provider are combined with the k vectors in the working set to generate a merged vector set. These two sets of k vectors can be combined using the equation above. In 712, the merged set of k vectors is then stored as the working set of vectors. Accordingly, the update at 712 can replace the previous working set with the most recent merged vector set.

[0150] At 714, it is determined whether all providers in the group of s providers have been merged into the working set of vectors. If it is determined at 714 that not all providers have been merged, then at 716, the counter j is incremented, and steps 708-714 are repeated for the next provider. Thus, each private sketch set is sequentially merged with the previous merged vector set (i.e., the working set) until all data sets have been merged. In this determination at decision 714, the final distribution is estimated at 718 based on the working set of k vectors. As mentioned above, the frequency distribution can be estimated based on the cardinality estimate of each sketch.

[0151] refer to Figure 8A This paper presents an example histogram for comparing the estimated distribution of the first test set generated using the sequential merging algorithm with the actual (true) distribution of the first test set. Here, the first test set represents a total size of 200,000 identifiers, a vector consisting of 2^14 buckets, deduplication of two providers with independent data sets (i.e., no overlap between data sets), and a maximum frequency of 5 (where the fifth frequency interval represents "5+").

[0152] refer to Figure 8B This example histogram compares the estimated distribution of the second test set generated using the sequential merging algorithm with the actual (true) distribution of the second test set. Here, the second test set represents a total size of 200,000 identifiers, a vector consisting of 2^14 buckets, deduplication of the five providers, no added DP noise, and a maximum frequency of 10 (where the tenth frequency interval represents "10+").

[0153] Figure 8C It shows Figure 8B The test data of the second test set, wherein the initially introduced DP noise ε = log(3) is added to each sketch before combination.

[0154] Figure 8DAnother example histogram is shown comparing the estimated distribution of the third test set generated using the sequential merging algorithm with the actual (true) distribution of the third test set. Here, the third test set represents a total size of 200,000 identifiers, a vector consisting of 2^14 buckets, deduplication of the five providers, DP noise ε = log(3), and a maximum frequency of 10 (where the tenth frequency interval represents "10+").

[0155] Another method for combining the private sketches of s providers is based on the Chow-Liu model. To calculate the frequency reachability of the frequency interval k,

[0156]

[0157] Here, R(*) represents the number of users who meet a specific condition (*) (i.e., reach), and j is the frequency of users at the j-th provider.

[0158] Using the Chow-Liu model, each term can be found based on the following formula. The estimated value:

[0159] P(f1=j1,f2=j2,…,f s =j s )

[0160] =P(f1=j1)*P(f2=j2|f1=j1)*…*P(f s =j s |f s-1 =j s-1 )

[0161] This means:

[0162]

[0163] And it can be rewritten as:

[0164]

[0165] Note that the Chow-Liu model assumes any linear tree of providers. In particular, the linear tree from 1→2→…→s creates paired overlaps between adjacent providers in the linear sequence.

[0166] There exists (j1,j2,…,j) s In the case where at least one value of R^ is equal to zero, the individual provider is unaware of the list of individuals with whom they have not interacted (i.e., with a frequency of zero) due to privacy considerations. Pairwise overlap where one of the two frequency values ​​is zero can be calculated as:

[0167] R(f u =0,f v =j v )=R(f v =j v )-R(f u ≥1,f v =j v )

[0168] When (j1,j2,…,j) s ) used for calculation When multiple values ​​of j are equal to zero, the providers in the linear tree can be rearranged such that all providers with a value of j equal to zero are moved to the beginning of the linear tree. Assume that after rearranging the linear tree, the first q providers all have frequency values ​​(f1, f2, ..., f...). q =0), such that the remaining providers in the tree are all equal to (f q+1 ,f q+2 ,…,f s It has a non-zero value. The derivation of the Chow-Liu model shows that:

[0169] P(f1=j1,f2=j2,…,f s =j s )

[0170] =P(f1=…=f q =0)*P(f q+1 =j q+1 |f q =0)*…*P(f s =j s |f s-1 =j s-1 )

[0171] =P(f1=…=f q =0,f q+1 =j q+1 )*…*P(f s =j s |f s-1 =j s-1 )

[0172] =[P(f q+1 =j q+1 )-P(f1+…+f q ≥1,f q+1 =j q+1 )]*…*P(f s =j s |f s-1 =j s-1 )

[0173] This can then be used to calculate using the following formula.

[0174] P(f1=j1,f2=j2,…,f s =j s )

[0175] =[R(f q+1 =j q+1 )-R(f1+…+f q ≥1,f q+1 =j q+1 )]*R(f q+2 =j q+2 |f q+1 =j q+1 )*…*R(f s =j s |f s-1 =j s-1 )

[0176] Accordingly, the analysis system can deduplicate private sketches from a set of s providers in order to use the algorithm described above to estimate the total reachability distribution across the entire set.

[0177] refer to Figure 9A This paper presents an example histogram for comparing the estimated distribution of the first test set generated using the pairwise overlap algorithm with the actual (true) distribution of the first test set. Here, the first test set represents a total size of 200,000 identifiers, a vector consisting of 2^14 buckets, five providers generated using an independent Poisson model for deduplication, and a maximum frequency of 5 (where the fifth frequency interval is represented as "5+").

[0178] Figure 9B Another example histogram comparing the estimated distribution of a second test set generated using the pairwise overlap algorithm with the actual (true) distribution of the second test set is shown. Here, the second test set represents a total size of 200,000 identifiers, a vector comprising 2^14 buckets, five deduplicated providers generated using the back-correlation dataset, and a maximum frequency of 5 (where the fifth frequency interval is denoted as "5+"). The second test set is designed to stress-test the pairwise overlap algorithm.

[0179] Used to estimate the frequency reachable range R k The third approach is based on the independence assumption. The independence assumption requires a value for the size of the entire set (U) that can be estimated by the worker or analyst.

[0180] Further decomposition by frequency reachable range R k The formula for the independence model can be used to calculate the following:

[0181]

[0182] The use of the independence assumption will The calculation is as follows:

[0183]

[0184] In other words, the frequency counts provided by each provider can be estimated from the individual sketches and directly input into the above formula to estimate the frequency distribution across that group of providers. Therefore, the analysis system can be configured with logic that implements the above equations to combine the frequency reachability data from each provider and generate an estimated distribution of the deduplicated dataset.

[0185] Figure 10 A description of a computer system 1000 is shown. The computer system 1000 can be used, for example, to implement an illustrative data processing system 105, an illustrative deduplication server 115, an illustrative analyst device 120, an illustrative client device 135, and / or various other illustrative systems described in this disclosure. The computing system 1000 includes a bus 1005 or other communication components for transmitting information and a processor 1010 coupled to the bus 1005 for processing information. The computing system 1000 also includes a main memory 1015, such as random access memory (RAM) or other dynamic storage device, coupled to the bus 1005 for storing information and instructions to be executed by the processor 1010. The main memory 1015 can also be used to store location information, temporary variables, or other intermediate information during instruction execution by the processor 1010. The computing system 1000 may also include a read-only memory (ROM) 1020 or other static storage device coupled to the bus 1005 for storing static information and instructions of the processor 1010. Storage device 1025 (such as a solid-state device, disk or optical disk) is coupled to bus 1005 for permanent storage of information and instructions.

[0186] The computing system 1000 can be coupled to a display 1035 (such as a liquid crystal display or an active matrix display) via a bus 1005 for displaying information to a user. An input device 1030 (such as a keyboard including alphanumeric keys and other keys) can be coupled to the bus 1005 for transmitting information and command selections to the processor 1010. In another embodiment, the input device 1030 has a touchscreen display 1035. The input device 1030 may include cursor controls (such as a mouse, trackball, or arrow keys) for transmitting directional information and command selections to the processor 1010 and for controlling cursor movement on the display 1035.

[0187] In some embodiments, computing system 1000 may include a communication adapter 1040, such as a network adapter. Communication adapter 1040 may be coupled to bus 1005 and may be configured to enable communication with computing or communication network 1045 and / or other computing systems. In various illustrative embodiments, communication adapter 1040 may be used to implement any type of networking configuration, such as wired (e.g., via...). ), wireless (e.g., via (etc.), pre-configured, self-organizing, LAN, WAN, etc.

[0188] According to various embodiments, the process of implementing the illustrative embodiments described herein can be implemented by computing system 1000 in response to processor 1010 executing an instruction arrangement contained in main memory 1015. Such instructions may be read into main memory 1015 from another computer-readable medium (such as storage device 1025). Execution of the instruction arrangement contained in main memory 1015 causes computing system 1000 to perform the illustrative process described herein. One or more processors in a multiprocessor arrangement may also be used to execute the instructions contained in main memory 1015. In alternative embodiments, hardwired circuitry may be used instead of or in combination with software instructions to implement the illustrative embodiments. Therefore, the embodiments are not limited to any specific combination of hardware circuitry and software.

[0189] The systems and methods described in this disclosure can be implemented for any type of third-party content project (i.e., any type of content project to be displayed on a resource). In one implementation, the content project may include an advertisement. In one implementation, the content project may include any text, image, video, story (e.g., a news story), social media content, link, or any other type of content provided by a third party for display on a resource provided by a first-party content provider. The type of content project used with the content visibility methods described herein is not limiting.

[0190] Despite Figure 10 An example processing system is described herein, but the implementation of the subject matter and functional operations described herein may be implemented using other types of digital electronic circuitry, or in computer software, firmware, or hardware (including the structures disclosed herein and their equivalents), or in a combination of one or more of them.

[0191] The embodiments of the subject matter and operations described in this specification can be implemented in digital electronic circuits, or in computer software, firmware, or hardware embodied on a tangible medium (including the structures disclosed in this specification and their structural equivalents), or in a combination of one or more of these. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more components of computer program instructions encoded on a computer storage medium for execution by or control of the operation of a data processing apparatus. The program instructions can be encoded on artificially generated propagation signals (e.g., machine-generated electrical, optical, or electromagnetic signals) that are generated to encode information for transmission to a suitable receiver device for execution by the data processing apparatus. The computer storage medium can be or is included in a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or any combination thereof. Furthermore, although the computer storage medium is not a propagation signal, it can include a source or destination of computer program instructions encoded in artificially generated propagation signals. The computer storage medium can also be or be included in one or more separate physical components or media (e.g., multiple CDs, disks, flash memory, solid-state memory, or other storage devices).

[0192] The features disclosed herein can be implemented on laptop computers or other personal computers, smartphones, other mobile phones, handheld computers, tablet PCs or other computing devices.

[0193] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0194] The terms “data processing apparatus,” “data processing system,” “user equipment,” “client equipment,” “worker equipment,” “worker computing device,” “publisher,” or “computing device” encompass all kinds of apparatus, devices, and machines for processing data, including, for example, programmable processors, computers, systems-on-a-chip, or multiple or combinations of the foregoing. Apparatus may include special-purpose logic circuitry, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). In addition to hardware, apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or any combination thereof. Apparatus and execution environments can implement a variety of different computing model infrastructures, such as network services, distributed computing, and grid computing infrastructures.

[0195] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any programming language (including compiled or interpreted languages, declarative, functional, or procedural languages) and can be deployed in any form (including as standalone programs or as modules, components, subroutines, objects, or other units suitable for a computing environment). A computer program may, but does not need to, correspond to a file in a file system. A program may be stored as part of a file containing other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file storing one or more modules, subroutines, or code sections). A computer program can be deployed to execute on a single computer, or on multiple computers located in one location or distributed across multiple locations and interconnected by a communication network.

[0196] The processes and logic flows described in this specification can be executed by one or more programmable processors that execute one or more computer programs to perform actions by manipulating input data and generating outputs. The processes and logic flows can also be executed by special-purpose logic circuitry, and the apparatus can be implemented as special-purpose logic circuitry, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0197] For example, processors suitable for executing computer programs include general-purpose microprocessors and special-purpose microprocessors, as well as any one or more processors in any kind of digital computer. Typically, a processor receives instructions and data from read-only memory or random access memory, or both. The components of a computer include a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices (e.g., hard disks, magneto-optical disks, flash memory, solid-state drives, or optical disks) for storing data, to receive data from, or to transfer data to, or both. However, a computer does not need to have such devices. Furthermore, a computer may be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive). Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as: semiconductor memory devices, like EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented or incorporated into them by dedicated logic circuitry.

[0198] To provide interaction with the user, embodiments of the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube), plasma, or LCD (liquid crystal display) monitor) and a keyboard and pointing device (e.g., a mouse or trackball) that the user can use to provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can include any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0199] The embodiments of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., as a data server), or middleware components (e.g., an application server), or front-end components (e.g., a client computer with a graphical user interface or web browser through which a user can interact with the embodiments of the subject matter described in this specification), or any combination of one or more such back-end components, middleware components, or front-end components. The components of the system can be interconnected via digital data communication (e.g., a communication network) of any form or medium. Examples of communication networks include local area networks (“LANs”) and wide area networks (“WANs”), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., self-organizing peer-to-peer networks).

[0200] Computing systems (such as data processing system 105) may include clients and servers. For example, data processing system 105 may include one or more servers in one or more data centers or server clusters. Clients and servers are typically geographically separated and typically interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and having a client-server relationship with each other. In some implementations, the server transmits data (e.g., HTML pages) to client devices (e.g., to display data to a user interacting with the client device and to receive user input from it). Data generated at the client device (e.g., the result of user interaction) may be received from the client device at the server.

[0201] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any implementation or what may be claimed, but rather as descriptions of features specific to particular implementations of the systems and methods described herein. Certain features described in the context of individual implementations may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually in multiple implementations or in any suitable sub-combination. Furthermore, although features may be described above as functioning in certain combinations, and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination, and the claimed combination may be for sub-combinations or variations thereof.

[0202] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order or sequence shown, or requiring all illustrated operations to be performed to obtain the desired result. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to obtain the desired result.

[0203] In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can typically be integrated together in a single software product or packaged into multiple software products. For example, data processing system 105 may be a single module, a logical device with one or more processing modules, one or more servers, or part of a cloud computing environment.

[0204] Some illustrative implementations and methods have now been described. It is obvious that the foregoing is illustrative and not limiting, and has been presented by way of example. Specifically, although many of the examples presented herein involve specific combinations of method actions or system elements, those actions and elements can be combined in other ways to achieve the same objective. Actions, elements, and features discussed in connection with only one implementation are not intended to exclude similar effects in other implementations.

[0205] The wording and terminology used herein are for descriptive purposes and should not be considered limiting. The terms “comprising,” “including,” “having,” “containing,” “involving,” “characterized as,” “featured as,” and variations thereof are intended to cover the items listed thereafter, their equivalents and additional items, and alternative implementations comprised of items specifically listed thereafter. In one implementation, the systems and methods described herein comprise one, more than one, each combination, or all of the described elements, actions, or components.

[0206] References to embodiments, elements, or actions of systems and methods made herein in the singular may include embodiments that include multiple such elements, and any references herein in the plural form to any embodiment, element, or action may include embodiments that include only a single element. The singular or plural references are not intended to limit the currently disclosed systems or methods, their components, actions, or elements to a single or multiple configuration. References to any action or element based on any information, action, or element may include embodiments in which such action or element is at least partially based on any information, action, or element.

[0207] Any implementation disclosed herein may be combined with any other implementation, and references to “implementation,” “some implementations,” “alternative implementations,” “various implementations,” “one implementation,” etc., are not necessarily mutually exclusive, but are intended to indicate that a particular feature, structure, or characteristic described in connection with that implementation may be included in at least one implementation. These terms used herein do not necessarily refer to the same implementation. Any implementation may be combined with any other implementation (inclusively or exclusively) in any manner consistent with the aspects and implementations disclosed herein.

[0208] A reference to "or" can be interpreted as inclusive, such that any term described using "or" can refer to any one of the single, multiple, or all described terms.

[0209] When reference numerals follow technical features in the drawings, detailed descriptions, or any claims, the sole purpose of including these reference numerals is to enhance the comprehensibility of the drawings, detailed descriptions, and claims. Accordingly, the presence or absence of reference numerals does not limit the scope of any claim element.

[0210] The systems and methods described herein may be embodied in other specific forms without departing from their characteristics. Although the examples provided herein relate to the display of content of information resources, the systems and methods described herein can be applied to other environments. The foregoing embodiments are illustrative and not intended to limit the systems and methods described. Therefore, the scope of the systems and methods described herein is indicated by the appended claims rather than the foregoing description, and variations in the meaning and scope of equivalents of the claims are included therein.

[0211] It should be understood that the above-described systems and methods can be provided as instructions in one or more computer programs recorded on or within one or more articles of art (e.g., computer-readable media). The articles of art can be floppy disks, hard disks, CD-ROMs, flash memory cards, PROMs, RAM, ROMs, or magnetic tapes. Generally, computer programs can be implemented in any programming language (such as LISP, Perl, Python, C, C++, C#, PROLOG) or any bytecode language (such as JAVA). Software programs can be stored as object code on or within one or more articles of art.

[0212] Some embodiments of the methods and systems have been described, and it will now be apparent to those skilled in the art that other embodiments incorporating the concepts of this disclosure may be used. Therefore, this disclosure should not be limited to certain embodiments, but should be limited only by the spirit and scope of the appended claims.

Claims

1. A method for generating a data structure for deduplicating data sets across multiple providers, the method comprising: A data processing system comprising one or more processors and memory maintains a set of record data in a database, each record identifying interactions between multiple users and providers among multiple providers; The data processing system initializes multiple vector data structures, wherein each of the multiple vector data structures corresponds to a specific frequency among multiple frequencies; The data processing system determines the frequency data of the interaction between each of the plurality of users and the provider based on the recorded data set. The frequency data of the user represents the number of interactions with the target interaction type between the user and the provider. The data processing system updates the plurality of vector data structures based on the frequency data of each of the plurality of users, wherein a first vector data structure in the plurality of vector data structures corresponds to a first frequency value in the plurality of frequencies, and is updated to encode the identifier of the user among the plurality of users who has frequency data indicating the number of interactions matching the first frequency value, such that the plurality of vector data structures are differentially private. as well as The data processing system sends the plurality of vector data structures to the analysis server for deduplication of the record data set across the plurality of providers.

2. The method according to claim 1, wherein, The analysis server combines the plurality of vector data structures with a second plurality of vector data structures from a second provider to generate a deduplication distribution.

3. The method according to claim 1, wherein, Each of the plurality of vector data structures defines the coordinates of a plurality of counters, wherein updating the plurality of vector data structures includes updating at least one counter in the plurality of vector data structures to encode the user's identifier.

4. The method according to claim 3, wherein, Updating the plurality of vector data structures also includes determining the first coordinates of the plurality of vector data structures based on a hash function of the user's identifier.

5. The method according to claim 1, wherein, Each of the multiple vector data structures corresponds to a specific frequency between a defined frequency threshold and a given frequency.

6. The method according to claim 5, wherein, The identities of the multiple users are encoded into no more than one of the multiple vector data structures.

7. A method for deduplicating a dataset corresponding to the frequency of user interactions with multiple providers, the method comprising: A data processing system comprising one or more processors and one or more memories receives a first set of two or more vector data structures from a first provider among the plurality of providers, each of the first set of two or more vector data structures encoding a user identifier associated with the number of interactions with the first provider having a target interaction type using differential privacy, the number of interactions with the first provider being matched with the corresponding frequency of each of the first set of two or more vector data structures. The data processing system receives a second set of two or more vector data structures from a second provider among the plurality of providers. Each vector data structure in the second set of two or more vector data structures encodes a user identifier associated with the number of interactions with the second provider that have the target interaction type using differential privacy. The number of interactions with the second provider matches the corresponding frequency of each vector data structure in the second set of two or more vector data structures. as well as The data processing system combines the first group of two or more vector data structures and the second group of two or more vector data structures into a deduplication frequency distribution. The deduplication frequency distribution defines the total frequency of user interactions of the target interaction type among the first provider and the second provider for each of the multiple frequencies.

8. The method according to claim 7, further comprising generating graphical user interface data by the data processing system, the graphical user interface data including a representation of the deduplication frequency distribution.

9. The method of claim 7, further comprising sending a threshold frequency by the data processing system to the plurality of providers, wherein, The plurality of frequencies are defined by the threshold frequency.

10. The method according to claim 9, wherein, The first group of two or more vector data structures and the second group of two or more vector data structures each correspond to a specific frequency between the threshold frequency.

11. The method according to claim 10, wherein, The identifier is encoded into no more than one vector data structure in the first group of two or more vector data structures and no more than one vector data structure in the second group of two or more vector data structures.

12. The method according to claim 7, wherein, The first group of two or more vector data structures and the second group of two or more vector data structures are counting vectors (VOCs).

13. The method according to claim 7, wherein, The first group of two or more vector data structures and the second group of two or more vector data structures are any distributed Bloom filter (ADBF).

14. The method according to claim 7, wherein, Combining the first group of two or more vector data structures and the second group of two or more vector data structures to form the deduplication frequency distribution includes: The data processing system combines the first group of two or more vector data structures and the second group of two or more vector data structures into the first group of two or more combined vector data structures. The data processing system receives a third set of two or more vector data structures from a third provider among the plurality of providers; and In response to combining the first group of two or more vector data structures and the second group of two or more vector data structures into the first group of two or more vector data structures, the data processing system combines the first group of two or more vector data structures with the third group of two or more vector data structures from the third provider into the second group of two or more vector data structures.

15. The method according to claim 7, wherein, Combining the first group of two or more vector data structures and the second group of two or more vector data structures to form the deduplication frequency distribution includes: Determine the intersection between the first vector data structure in the first group of two or more vector data structures and the second vector data structure in the second group of two or more vector data structures; Determine the number of users encoded in the intersection of the first vector data structure and the second vector data structure; and The deduplication frequency distribution is updated based on the determined number of users.

16. A system for reducing the set of data received from multiple providers, the system comprising: The network interface is configured to communicate with multiple servers associated with the multiple providers; as well as One or more processors are coupled to the network interface and a memory, the memory including instructions stored thereon, which, when executed by the one or more processors, cause the one or more processors to: A first set of differential privacy sketches is received from a first provider among the plurality of providers via the network interface. Each differential privacy sketch in the first set of differential privacy sketches encodes a user identifier associated with the number of interactions with the first provider that have a target interaction type using differential privacy. The number of interactions with the first provider matches the corresponding frequency of each differential privacy sketch in the first set of differential privacy sketches. A second set of differential privacy sketches is received from a second provider among the plurality of providers via the network interface. Each differential privacy sketch in the second set of differential privacy sketches encodes a user identifier associated with the number of interactions with the second provider that have the target interaction type using differential privacy. The number of interactions with the second provider matches the corresponding frequency of each differential privacy sketch in the second set of differential privacy sketches. A combined distribution is generated using the first set of differential privacy sketches and the second set of differential privacy sketches. The combined distribution deduplicates the data sets represented by the first set of differential privacy sketches and the second set of differential privacy sketches, and defines the total frequency of user interactions of the target interaction type between the first provider and the second provider for each of a plurality of frequencies. as well as The combined distribution is stored in the database.

17. The system according to claim 16, wherein, The one or more processors are further configured to: Combine the first set of differential private sketches and the second set of differential private sketches into a merged differential private sketch; and The combined differential private sketch is stored in the database.

18. The system according to claim 17, wherein, The one or more processors are further configured to: Receive a third set of differential private sketches from a third provider among the plurality of providers; The merged differential privacy sketch and the third set of differential privacy sketches are combined to generate a new set of merged differential privacy sketches. as well as The newly merged set of differential private sketches is stored in the database.

19. The system according to claim 16, wherein, The first set of differential private sketches and the second set of differential private sketches are counting vectors (VOCs).

20. The system according to claim 16, wherein, The first set of differential private sketches and the second set of differential private sketches are any distributed Bloom filters (ADBF).

Images