Data obfuscation for privacy enhancement

Abstract

Various examples are directed to systems and methods for obfuscating private information in input data. The system can apply an encoder model to an input data unit to generate a latent space representation of the input data unit. The system can apply multi-dimensional noise to the latent space representation of the input data unit, the multi-dimensional noise having a first value in a first latent space dimension and a second value different from the first value in a second latent space dimension. The system can apply a decoder model to the latent space representation of the input data unit to generate an obfuscated data unit.

Description

Technical Field

[0001] This application relates to data obfuscation for privacy enhancement. Background Technology

[0002] The large-scale collection and processing of data has become a major driver of the digital economy. Various enterprises collect and use massive amounts of data for a variety of purposes, including predictive maintenance, business planning, and disease diagnosis. Various data types can be collected and used, including structured data such as images; sequential data such as business figures, time-series data, or continuous streams of sensor data; and unstructured or graph-based data. Summary of the Invention

[0003] According to one aspect of this disclosure, a system for obfuscating privacy information in input data is provided, the system comprising: a computing device including at least one processor and an associated storage device, the at least one processor being programmed to perform operations including: accessing an input data unit; applying an encoder model to the input data unit to generate a latent space representation of the input data unit in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data unit, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data unit to generate an obfuscated data unit.

[0004] According to one aspect of this disclosure, a method for fuzzing privacy information in input data is provided, the method comprising: accessing input data units by a fuzzy system including at least one processor; applying an encoder model to the input data units by the fuzzy system to generate a latent space representation of the input data units in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data units by the fuzzy system, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data units by the fuzzy system to generate fuzzy data units.

[0005] According to one aspect of this disclosure, a machine-readable medium is provided, having instructions thereon that, when executed by at least one processor, cause the at least one processor to perform an operation, the operation comprising: accessing an input data unit; applying an encoder model to the input data unit to generate a latent space representation of the input data unit in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data unit, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data unit to generate an ambiguous data unit. Attached Figure Description

[0006] This disclosure is illustrated by way of example, but is not limited to the following figures.

[0007] Figure 1 This is a diagram illustrating an example of an environment for implementing an encoder-decoder arrangement for obscure input data.

[0008] Figure 2 This is a flowchart illustrating an example of a processing flow that can be performed by a fuzzy system to generate fuzzy data.

[0009] Figure 3 This shows what can be used for training. Figure 1 A flowchart of an example of the processing flow of an encoder-decoder arrangement.

[0010] Figure 4 It shows that it can be generated by Figure 1 A flowchart of an example of the processing flow performed by a fuzzy system.

[0011] Figure 5 It shows that it can be generated by Figure 1 A flowchart illustrating an example of how a fuzzy system performs a process to determine the multidimensional noise to be applied to the input data unit.

[0012] Figure 6 This is a block diagram illustrating an example of the software architecture of a computing device.

[0013] Figure 7 This is a block diagram of a machine in the form of an example computing system in which instructions can be executed to cause the machine to perform any one or more of the methods discussed herein. Detailed Implementation

[0014] The various common uses of large datasets can involve disclosure or disclosure risks. For example, the various uses of collected data involve comparing data with peer groups or using data in ways that involve sharing with partners or data analysts. While some privacy information (such as personal identifiers) may be removed from the dataset or pseudonymous, there may still be characteristic patterns that can reveal privacy or sensitive information. For example, sensor stream data from an accelerometer on a user's mobile device can reveal a user's identity by capturing their unique gait. Furthermore, it may be difficult, for example, to remove identifying information from an image depicting a user without compromising the image's usefulness for further processing. Moreover, even if a data unit does not directly expose privacy information, the data unit and / or its use can potentially reveal privacy information. For example, data describing business processes may reveal privacy information about patterns related to these processes or even strategic decisions.

[0015] The privacy implications of data collection and use affect the operation of computing systems in several ways. First, data owners may be unwilling to share data with various computing systems for use without assurances of privacy. For example, a user may be unlikely to share accelerometer or other mobile device data streams without assurances of user identity protection. Furthermore, a business entity may be unlikely to share its business data for analysis without assurances of privacy protection. The quality of processing can be compromised when data owners are unwilling to share data. Consider an example data processing system programmed to characterize user movement based on data streams from a user's mobile device. In this example, if the user is unwilling to share data, the data processing system may be limited in the amount of data available for, for example, training machine learning models and / or performing other analyses. Using models trained on smaller and / or less representative training datasets, the data processing system may perform less accurately and efficiently. Furthermore, some jurisdictions have enacted laws protecting user privacy by preventing the use of user data that could be used to identify users. This could further limit the data available to the data processing system for model training or other purposes.

[0016] In some examples, datasets may be obfuscated before being exposed to analysts, partners, or other similar entities. Obfuscating a dataset can involve modifying the values ​​of various data units within the dataset to reduce the probability of privacy information being collected from the data units and / or from the models trained with those data units.

[0017] In some examples, encoder-decoder arrangements, such as variational autoencoders (VAEs), can be used to perform data blurring. In an encoder-decoder arrangement, the encoder model receives input data units and transforms them from the feature space to the latent space. This produces a latent space representation of the input data units. This latent space representation is then provided to the decoder model. The decoder model is trained to transform the latent space representation back into the feature space, thereby generating a reconstructed, blurred data unit as the original input data unit.

[0018] Due to the lossy nature of the encoder model, the encoder-decoder arrangement blurs the input data units. The latent space representation of the input data unit generated by the encoder model has a lower dimensionality than the input data unit itself. Consider an example where the input data unit is a sensor data stream from a user's mobile device. In this example, the dimensionality of the sensor data stream is based on the number of quantities measured by the mobile device and the number of time samples in the sequence. The latent space representation generated by the encoder can be or includes state vectors, where the state vectors have a lower dimensionality than the sensor data stream. Therefore, the encoder model acts as a lossy compression function. By reducing the dimensionality of the sensor data stream, the encoder model causes a loss of information in the sensor data stream. The decoder cannot recover the lost information. Therefore, the encoder-decoder system can reduce the specific patterns included in the sensor data stream that may uniquely identify the associated user without compromising the usefulness of the blurred data stream to the data processing system.

[0019] In some examples, as described herein, encoder-decoder arrangements also utilize noise applied in the latent space. For example, noise according to a Gaussian or other suitable noise function is applied to the latent space representation, and can thus be a parameter of the encoder-decoder arrangement (e.g., a parameter of an autoencoder that includes both encoder and decoder models). Applying noise to the latent space representation adds uncertainty or noise to the resulting blurred data stream. This uncertainty or noise can further reduce or obscure any specific patterns included in the input data units that may contain privacy or sensitive information.

[0020] However, in various examples, the blurring resulting from the lossy nature of the encoder-decoder arrangement and / or from the application of latent space noise can be isotropic. That is, on average, all dimensions of the latent space representation of the input data unit may be blurred by the same amount. In some implementations, this can limit the usefulness of the blurring. For example, isotropic blurring sufficient to protect latent space dimensions carrying privacy information may over-blur latent space dimensions carrying utility information used by the data processing system. This may render the resulting blurred data less useful for its intended purpose.

[0021] Various examples utilize anisotropic fuzzing techniques to address these and other challenges. For instance, fuzzy systems can apply multidimensional noise to the latent space representation of data units. This multidimensional noise can have different values ​​in different latent space dimensions. The fuzzy system can determine the interpretable dimensions in the latent space and change the values ​​of the multidimensional noise in different latent space dimensions. For example, the multidimensional noise can have a first value along a first latent space dimension, a second value along a second latent space dimension, and so on. The multidimensional noise can have higher values ​​along latent space dimensions carrying more privacy information and relatively lower values ​​along latent space dimensions carrying more functional information and less privacy information. In this way, the privacy-preserving parts of the input data unit can be more fuzzy, while the non-privacy and / or functionally relevant parts can be less fuzzy. Fuzzy data units that more effectively protect privacy information without unduly obscuring functional information can be obtained.

[0022] Figure 1 This is a diagram illustrating an example of an environment 100 implementing an encoder-decoder arrangement for fuzzing input data 104. Environment 100 includes a fuzzing system 102. The fuzzing system 102 receives input data 104 and generates corresponding fuzzed data 106. The fuzzed data 106 is provided to a data processing system 108. As described herein, the data processing system 108 uses the fuzzed data 106 to perform various tasks. The fuzzed data 106 may omit data or data patterns identifying privacy information relative to the input data 104.

[0023] The fuzzy system 102 receives input data 104 and generates fuzzy data 106. In some examples, the fuzzy system 102 includes one or more computing devices different from mobile computing devices 134, 136, computing systems 128, 130, and / or data processing system 108. In other examples, the fuzzy system 102 is implemented by one or more of the mobile computing devices 134, 136, computing systems 128, 130, and / or data processing system 108. For example, some or all of the fuzzy system 102 may execute at the processor of the mobile computing devices 134, 136 and / or at the processor of the data processing system 108.

[0024] The fuzzy system 102 implements an encoder-decoder arrangement. Encoder model 116 receives input data 104 and generates a corresponding representation of the input data 104 in latent space 118. As described herein, the transformation from input data 104 to the latent space representation can be lossy compression. For example, latent space 118 can have a smaller dimension than input data 104. The encoder-decoder arrangement can be implemented as a VAE. Furthermore, in some examples, encoder model 116 can be implemented as a Generative Adversarial Network (GAN) or a GAN-like generative model, while decoder model 120 is the inverse model of the GAN or GAN-like generative model implementing encoder model 116.

[0025] The fuzzy system 102 can apply multidimensional noise 122 to the latent space representation of the input data 104 in the latent space 118. The multidimensional noise 122 can be, for example, a vector assigned values ​​based on multiple linearly independent vectors corresponding to the dimensions of the latent space, as described herein. The multidimensional noise 122 can be anisotropic. For example, the multidimensional noise 122 may be non-uniform across the dimensions of the latent space 118. For example, the multidimensional noise 122 may have different values ​​corresponding to different latent space dimensions. As described herein, in some examples, the fuzzy system 102 determines the interpretable dimensions of the latent space 118 and generates the multidimensional noise based on these interpretable dimensions.

[0026] 104 input data of various categories can be used Figure 1Environment 100. Furthermore, the data processing system 108 can use different types of input data 104 to perform different tasks. In some examples, the input data 104 includes image data 121. Image data 121 may include one or more images. For example, an input data unit of image data 121 may include a single image or a set of images. The data processing system 108 can use image data 121 to perform various tasks, such as, for example, image classification tasks. Consider an example where image data 121 includes images depicting various objects (such as faces or other things). The data processing system 108 can be programmed to classify images according to the type of object depicted. Image data 121 (e.g., after blurring) can be used as training data for training a classifier model at the data processing system 108 and / or as test data.

[0027] In some examples, input data 104 includes application data 123. Application data 123 includes data generated by one or more applications 129 executed on one or more computing systems 128. The input data units of application data 123 may include, for example, records from a database table, a database table, a database view, or any other suitable arrangement of input data. In examples where input data 104 includes application data 123, data processing system 108 may be programmed to use application data 123 to perform various processing tasks. Consider an example where application 129 is a business application (such as, for example, an accounting application, a process management application, etc.). In this example, data processing system 108 may be programmed to, for example, perform demand planning tasks, detect fraudulent transactions, and / or other suitable tasks. Application data 123 may be used to train machine learning models at data processing system 108 and / or may be used as test data.

[0028] In some examples, input data 104 includes information technology (IT) data 124. IT data 124 may be generated by an IT management application 131 executing at computing system 130. IT data 124 may describe various IT-related events and / or other relevant data. Input data units including IT data 124 may include, for example, log entries describing IT-related events. In examples where input data 104 includes IT data 124, data processing system 108 may be programmed to use IT data 124 to perform various processing tasks. In some examples, IT data 124 includes records of access to the computing system. Data processing system 108 may be programmed to apply classifiers or other suitable machine learning models to detect attacks on the computing system and / or other malicious or potentially malicious access. In another example, IT data 124 includes asset and usage data for the computing system. Data processing system 108 may be programmed to utilize IT data 124 to predict future needs for resource planning within the computing system. IT data 124 may be used to train machine learning models at data processing system 108 and / or may be used as test data.

[0029] In some examples, input data 104 includes, for example, sensor stream data generated by one or more mobile computing devices 134, 136 of user 132. Mobile computing devices 134, 136 can be or include any suitable computing device, including, for example, a desktop computer, laptop computer, tablet computer, wearable computer, etc. Figure 1 In the examples, mobile computing device 134 is depicted as a wearable computing device, while mobile computing device 136 is depicted as a mobile phone. It should be understood that, in addition to or instead of the one or more example devices shown, user 132 may utilize devices not shown in... Figure 1 One or more other mobile computing devices are shown in the figure.

[0030] In some examples, the input data units of sensor stream data 126 may include one or more quantities measured relative to time at the respective mobile computing devices 134, 136. For example, the quantity may indicate a quantity measured by a sensor at the mobile computing device 134, 136, while the time may indicate the time when that quantity (e.g., from the associated sensor at the mobile computing device 134, 136) was sampled. Consider example mobile computing devices 134, 136 including a geolocation system, a heart rate or electrocardiogram (ECG) sensor, a respiration sensor, and a muscle oxygen sensor. Such mobile computing devices 134, 136 may generate sensor stream data 126 that includes a quantity dimension of the output of each of one or more sensors at the mobile computing devices 134, 136.

[0031] In some examples, sensor stream data 126 may include multiple quantity dimensions. For example, if sensor stream data 126 is based on a sensor that generates multidimensional outputs, then sensor stream data 126 may include more than one quantity dimension. Consider an example accelerometer that generates an output indicating the acceleration of the sensor in each of the three spatial dimensions. Such an accelerometer can generate a sensor data stream with three quantities (e.g., acceleration in the x-direction, acceleration in the y-direction, and acceleration in the z-direction) relative to time. Also consider an example gyroscope sensor that generates a sensor data stream that also has three quantities (e.g., roll, pitch, and yaw) relative to time.

[0032] Figure 1 A breakout window 140 is shown representing the operations of encoder model 116 and decoder model 120 acting on example input data unit 142. Input data unit 142 can be any suitable data unit, such as, for example, a unit of image data 121, a unit of application data 123, a unit of IT data 124, sensor stream data, etc. The input data unit is initially a feature space representation that can be described by different input data unit features, which will be described in more detail herein. Encoder model 116 acts on input data unit 142 to generate a latent space representation of input data unit 142 in latent space 118. As described herein, the lossy nature of encoder model 116 may tend to provide isotropic blurring of input data unit 142.

[0033] Consider an example input data unit from image data 121. The input data unit can have various features, including background pixel values, foreground pixel values, etc. Consider another example input data unit including data records from application data 123 and / or from IT data. The input data unit can have various features, including field values ​​of various fields of the data record, for example. Consider another example input data unit from sensor stream data 126. Sensor stream data can have input data unit features, including values ​​generated by one or more sensors over time.

[0034] In the example shown in local window 140, the fuzzy system 102 applies multidimensional noise 122 with different values ​​to two example latent space dimensions 150 and 152. However, in various examples, the multidimensional noise 122 can be applied with different values ​​in more than two latent space dimensions. As shown, the multidimensional noise 122 has a higher value in latent space dimension 152 than in latent space dimension 150. In this way, the fuzziness applied by the multidimensional noise 122 can be anisotropic. The information carried in the input data unit by the latent space representation in latent space dimension 152 may be more fuzzy than the information carried in latent space dimension 150.

[0035] After multidimensional noise 122 is applied to the latent space representation in latent space 118, the latent space representation is provided to decoder model 120. Decoder model 120 generates fuzzy data units 146, which are mapped back to the feature domain. Fuzzy data units 146 can be more fuzzy relative to the information carried in latent space dimension 152, but less fuzzy relative to the information carried in latent space dimension 150.

[0036] The fuzzy system 102 can be programmed to select multidimensional noise 122 to correspond to privacy or sensitive information in the input data 104 and information in the input data 104 that is utilized by the data processing system 108. For example, the fuzzy system 102 can identify interpretable dimensions of the latent space 118. An interpretable dimension of the latent space 118 is a dimension in the latent space where a change in the latent value z results in a predictable and / or interpretable change in the fuzzy data 106.

[0037] The fuzzy system 102 can map features of input data units to latent space dimensions of the latent space representation of the input data units. This can be done in various ways, including, for example, using the utility classifier and privacy classifier described herein. Because the dimension of the latent space is smaller than the dimension of the feature space, there may not be a one-to-one correlation between various input features and latent space dimensions. For example, the fuzzy system 102 can assign utility attribute labels and privacy attribute labels to each associated latent space dimension. The value of the multidimensional noise 122 in each latent space dimension can be correlated with the utility attribute label and the privacy attribute label of that dimension. For example, the multidimensional noise 122 can have a relatively high value for latent space dimensions with higher privacy attribute labels than utility attribute labels. Similarly, the multidimensional noise 122 can have a relatively low value for latent space dimensions with higher utility attribute labels than privacy attribute labels. In this way, the fuzzed data 106 can be more fuzzy relative to privacy task features and less fuzzy relative to utility task features.

[0038] Consider an example input data unit from image data 121. In this example, data processing system 108 can implement a machine learning model to classify the objects depicted in the image. A first latent space component can be derived from input data features that include pixel values ​​comprising the background of the image. A second latent space component can be derived from input data features that include pixel values ​​corresponding to objects. The former can be classified as a privacy feature. For example, the background of the image may not be used to classify objects and may depict private people and / or things in the background.

[0039] In this example, the fuzzy system 102 can map the first input feature and the second input feature to the latent space dimension at latent space 118. The fuzzy system 102 can select that the multidimensional noise 122 has a higher value in the latent space dimension of the background pixel values, which are more representative of the first input data features, and a lower value in the latent space dimension of the object pixel values, which are more representative of the second input data features.

[0040] The fuzzy data 106 generated by the fuzzy system 102 can be provided to the data processing system 108. The data processing system 108 can use the fuzzy data 106 to perform various processing tasks. In some examples, the data processing system 108 is configured to use the fuzzy data 106 to generate a machine learning model. For example, the fuzzy data 106 can be used as training data for training a machine learning model. The trained machine learning model can be applied by the data processing system 108 and / or can be provided to one or more mobile computing devices 134, 136 or computing systems 128, 130 to be directly applied to the input data 104.

[0041] Figure 2 This is a flowchart illustrating an example of a processing flow 200 that can be performed by fuzzy system 102 to generate fuzzy data 106. In optional operation 202, fuzzy system 102 trains encoder model 116 and decoder model 120. Optional operation 202 can be performed when models 116, 120 are or include trained machine learning models (such as deep neural networks). For example, models 116, 120 can be trained together as a VAE. Fuzzy system 102 can use training data to train model 116, where the training data includes training input data. The training input data stream can be input data 104 or another suitable sensor data stream.

[0042] The fuzzy system 102 provides training input data to the encoder model 116 to generate a training latent space representation. For example, the training latent space representation is provided to the decoder model 120 without applying multidimensional noise. The output of the decoder model 120 is compared with the training input data. The deviation between the output of the decoder model 120 and the training input data is backpropagated to the weights of the encoder model 116 and the decoder model 120 to reduce the measured bias. This process can be iterated multiple times, with each iteration optimizing the parameters of models 116 and 120. Training is complete when the deviation between the training input data and the output of the decoder model 120 is less than a threshold amount. (See reference here.) Figure 3Additional examples for training encoder model 116 and decoder model 120 are provided. Furthermore, it should be understood that in some examples, processing flow 200 can be executed once encoder model 116 and decoder model 120 have been trained. If encoder model 116 and decoder model 120 have already been trained, operation 202 can be omitted.

[0043] In operation 204, the fuzzy system 102 accesses the input data units of the input data 104. In an example where the fuzzy system 102 is implemented as a stand-alone system and / or by the data processing system 108, the input data units may be received from mobile computing devices 134, 136 and / or from computing systems 128, 130. In an example where the fuzzy system 102 is implemented by mobile computing devices 134, 136 and / or computing systems 128, 130, the input data units may be received (e.g., via an operating system, memory, or other components) from a sensor, data storage, or other suitable location.

[0044] In operation 206, fuzzy system 102 applies encoder model 116 to input data 104 to generate a latent space representation of input data 104 in latent space 118. In operation 208, fuzzy system 102 applies multidimensional noise 122 to the latent space representation. As described herein, multidimensional noise 122 can be selected to more heavily fuzz the latent space dimensions carrying privacy or sensitive information, and less heavily fuzz the latent space dimensions carrying information relevant to the functional task. In operation 210, fuzzy system 102 applies decoder model 120 to the latent space representation to generate fuzzy data 106.

[0045] Figure 3 This shows what can be used for training. Figure 1 A flowchart of an example of the encoder-decoder arrangement processing flow 300 is provided. In operation 302, the value of the multidimensional noise 122 is set to a fixed value. For example, the value of the noise scaling parameter 314 is set to a fixed value, such as one unit or one. In operation 304, training data is provided to the encoder model 116. The training data may include one or more sensor data streams.

[0046] In operation 306, encoder model 116 and decoder model 120 are used to generate training output data units. For example, encoder model 116 generates a latent space representation of the training data in latent space 118. Fixed multidimensional noise 122 can be applied to the latent space representation, and the result can be mapped back to the feature space by decoder model 120 to generate training output data units.

[0047] In Operation 308, a loss function is applied to measure the bias between the training input data units and the training output data units. Any suitable loss function or combination of loss functions can be used. Examples of suitable loss functions include Euclidean error loss, mean squared error, Kullback-Leibler divergence, etc. In some examples, the total loss used for training can be a combination of more than one loss measure. For example, in some examples, the total loss is equal to the reconstruction of the loss between the input and output time series plus the Kullback-Leibler divergence between the standard normal distribution and the normal distribution modeled by the mean and variance represented by the latent space.

[0048] In operation 310, it is determined whether the error determined in operation 308 is small enough, for example, minimum. If the error is minimum, training is complete in operation 314. If the error is not minimum, in operation 312, the changes to the weights of encoder model 116 and decoder model 120 are backpropagated, and in operation 304, training data is provided again.

[0049] In some examples, the maximum-mean discrepancy (MMD) between the actual latent distribution and the expected latent distribution, indicated by the mean and variance, is used to determine the loss function used in operation 308.

[0050] In some examples, the desired latent distribution can be or includes a multidimensional symmetric standard, such as a Gaussian distribution with zero mean and variance of 1. Furthermore, in some examples, the desired latent distribution can be a bounded probability distribution with constant density.

[0051] Figure 4 This is a flowchart illustrating an example of a processing flow 400 that can be performed by the fuzzy system 102. For example, the processing flow 400 may include preprocessing performed by the fuzzy system 102 to prepare for generating multidimensional noise 122 for the input data 104.

[0052] In optional operation 402, the fuzzy system trains encoder model 116 and decoder model 120, for example, as described herein. In this example, encoder model 116 can be represented by E, where E(x) is the encoder model 116 applied to the input data unit feature x. Similarly, decoder model 120 can be represented by D, where D(z) is the decoder model 120 applied to the latent space dimension value z. In some examples, processing flow 400 can be performed when encoder model 116 and decoder model 120 have been trained. If this is the case, optional operation 402 can be omitted.

[0053] In operation 404, the fuzzy system determines multiple linearly independent vectors in latent space 118, which may also be referred to as L. For example, the multiple interpretable vectors may include n linearly independent vectors, where n is the dimension in latent space L, as given by the following equation [1]:

[0054] n = dim L [1]

[0055] In some examples, multiple linearly independent vectors can be represented as a basis B of the latent space L, as given by the following equation [2]:

[0056] R = {v1, ..., v} n} [2]

[0057] In equation [2], the latent space dimension of the latent space L is given by v i Representation. Consider the latent space dimension value z corresponding to the feature x of the input data unit, as given in the following equation [3]:

[0058] z = E(x) [3]

[0059] The multiple linear independent vectors constituting the basis B can correspond to interpretable dimensions in the latent space L. As expressed by equations [1]-[3], an interpretable dimension can be a dimension in the latent space L in which a change in the latent space dimension value z = E(x) results in a change in the interpretability of the decoded output D, as given by the following equation [4]:

[0060] D(z+λv i )=D(E(x)+λv i [4]

[0061] In equation [4], λv i It is related to vector v i The corresponding change in the direction of the latent space dimension (λ), the vector v i The dimension i corresponds to the latent space L. A basis B comprising multiple vectors corresponding to the latent space dimension can be found in any suitable manner. In some examples, a machine learning model, such as a reconstructor model, is trained using training data comprising the input data and modified input data. The machine learning model is trained to, for a given set of input data and modified input data, generate a change in the latent space representation of the input data that results in a change in the output of the decoder model 120 corresponding to the modified input data. The determined change may correspond to the latent space dimension.

[0062] In operation 406, fuzzy system 102 accesses training input data. The training input data may include a set of input data units with labeled input data unit features x. For example, each input data unit feature x in the training input data can be represented by a triplet (x, y). util y util To describe it. In this example, the label y util This describes some (discrete-valued) functional information (e.g., motion type) contained in the features of input data units that can be shared. (Label: y) priv It describes some privacy information (such as user ID) contained in the feature x of the input data unit.

[0063] In operation 408, the fuzzy system 102 uses encoder model 116 and training input data to generate a functional classifier. The functional classifier is trained to map various latent space dimension values ​​z to (as indicated by the training input data) y. util The model corresponds to the value. Similarly, in operation 410, the fuzzy system uses encoder model 116 and training input data to generate a privacy classifier. The privacy classifier is trained to map various latent space dimension values ​​z to y as indicated by the training input data. priv The model corresponds to the value. The function classifier and the training classifier can be trained in any suitable way.

[0064] Figure 5 This is a flowchart illustrating an example of a processing flow 500 that can be performed by the fuzzy system 102 to determine the multidimensional noise 122 to be applied to the input data unit. For example, the processing flow 500 can be performed using the dimensions of the utility classifier, privacy classifier, and latent space 118 determined by the processing flow 400.

[0065] In operation 502, fuzzy system 102 accesses the input data units. In operation 504, fuzzy system 102 uses a utility classifier to determine an explainability map of the input data units. The explainability map can be, for example, a saliency map, layer-wise relevance propagation (LRP), a class activation map (CAM), GradCAM, and / or a map generated using a smoothing stretching algorithm.

[0066] For each latent space dimension v i Interpretability diagrams can include functional attribute labels. util (i). Latent space dimension v i Functional attribute tags s util (i) is the latent space dimension vi This indicates how relevant the functional task is to the input data unit. For example, the latent space dimension v i Functional attribute tags s util (i) describes the latent space dimension v in latent space L. i The degree of feature x that carries the functional label of the input data unit.

[0067] In operation 506, fuzzy system 102 can similarly use a privacy classifier to construct an interpretability graph of the input data units. For each latent space dimension v i Interpretability graphs can include privacy attribute labels. priv (i). Latent space dimension v i Privacy attribute tags priv (i) is the latent space dimension v i Indicators of how relevant the privacy aspects of the input data unit are. For example, the latent space dimension v i Privacy attribute tags priv (i) describes the latent space dimension v in latent space L. i The degree to which the privacy feature x carries the input data unit.

[0068] In operation 508, fuzzy system 102 can use the interpretability graph determined in operations 504 and 506 to scale multidimensional noise. For example, fuzzy system 102 can scale some or all of the latent space dimensions v. i The ratio of privacy to functionality generated (R) i In some examples, the ratio R i It can be given by the following equation [5]:

[0069] R i =s priv (i) / s uti l(i) [5]

[0070] Fuzzy system 102 can generate in various latent space dimensions v i The ratio R in the middle i The value corresponds to the multidimensional noise of the value. In this way, relatively more fuzziness can be applied to the latent space dimension v, which carries relatively more privacy information corresponding to the input data unit feature x with privacy label. i Relatively less fuzziness can be applied to the latent space dimension v, which carries relatively more functional information corresponding to the input unit data features x with functional labels. i .

[0071] In operation 510, the fuzzy system 102 applies the multidimensional noise determined in operation 508 to the input data unit. This can include noise targeting various latent space dimensions v. i According to Ri Alternatively, another suitable privacy indicator could be used to apply a noise function (such as a Gaussian noise function) to various latent space dimensions v. i In the example where a Gaussian noise function is used, the Gaussian noise function is present in various latent space dimensions v. i The variance σ i It can be given by the following expression [6]:

[0072] σ i =(s priv (i) / S util (i))σ0 [6]

[0073] In expression [6], σ0 is the (benchmark) variance of the Gaussian noise function used. The value σ i It is applied to each latent space dimension v i The variance of the latent space dimension. For example, multidimensional noise with a given latent space dimension v. i The value in can be determined by the ratio R. i The specific variance σ of the latent space dimension in this latent space dimension i Considering the specific variance σ of the latent space dimension i The value of the Gaussian noise function or any other suitable value can be used to describe it. In some examples, the multidimensional noise is pruned before being added to the latent space representation of the input data cells. Pruning can include, for example, reducing the attribute labels. util (i), s priv The value of (i), reducing variance σ i The value of σ is reduced by using variance. i The value of the Gaussian noise or any other suitable clipping technique can be determined. For example, if the blur level provided without clipping is too high, clipping can be applied. This may occur, for example, when the blurred data 106 is too blurry to be used at the data processing system 108.

[0074] After applying multidimensional noise to the latent space representation, the decoder model 120 can transform the latent space representation back to the feature space to generate blurred data 106, for example, as described herein.

[0075] In view of the above disclosure, various examples are described below. It should be noted that one or more features of the examples, whether in isolation or in combination, should be considered within the scope of the disclosure of this application.

[0076] Example :

[0077] Example 1 is a system for obfuscating privacy information in input data. The system includes: a computing device comprising at least one processor and an associated storage device, the at least one processor being programmed to perform operations including: accessing an input data unit; applying an encoder model to the input data unit to generate a latent space representation of the input data unit in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data unit, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data unit to generate an obfuscated data unit.

[0078] In Example 2, the subject of Example 1 may optionally include operations that further include: accessing a plurality of labeled input data units, wherein the first labeled input data unit of the plurality of labeled input data units includes a first input data unit feature, a first utility parameter describing the first input data unit feature, and a first privacy parameter describing the first input data unit feature; using the plurality of labeled input data units to generate a utility classifier for mapping from latent space to corresponding utility; and using the plurality of labeled input data units to generate a privacy classifier for mapping from latent space to corresponding privacy.

[0079] In Example 3, any one or more of the topics in Examples 1-2 may optionally include an operation that further includes: using a function classifier to determine a function label for a first latent space dimension; using a privacy classifier to determine a privacy label for a first latent space dimension; and using the function attribute label and the privacy attribute label for the first latent space dimension to determine a first value of the multidimensional noise.

[0080] In Example 4, the subject of Example 3 may optionally include an operation that further includes: generating a privacy interpretability map using input data units and a privacy classifier, the privacy interpretability map including multiple latent space dimension privacy attribute labels, the multiple latent space dimension privacy attribute labels including a first latent space dimension utility attribute label; and generating a utility interpretability map using input data units and a utility classifier, the utility interpretability map including multiple latent space dimension utility attribute labels, the multiple latent space dimension utility attribute labels including a first latent space dimension utility attribute label.

[0081] In Example 5, any one or more of the topics in Examples 3-4 may optionally include an operation that further includes: determining a ratio using a first latent space dimension utility attribute label and a first latent space dimension privacy attribute label; and applying the ratio to a noise distribution, wherein a first value of the multidimensional noise is based at least in part on the application of the ratio to the noise distribution.

[0082] In Example 6, the subject of Example 5 may optionally include: applying the ratio to the noise distribution includes applying the ratio to the variance of the Gaussian distribution.

[0083] In Example 7, one or more of the topics in Examples 5-6 may optionally include: cropping the result of applying the ratio to the noise distribution to determine a first value of the multidimensional noise.

[0084] In Example 8, any one or more of the topics in Examples 1-7 may optionally include an operation that further includes: determining a plurality of vectors, the plurality of vectors including a first vector corresponding to a first latent space dimension and a second vector corresponding to a second latent space dimension.

[0085] Example 9 is a method for fuzzing privacy information in input data, the method comprising: accessing input data units by a fuzzy system including at least one processor; applying an encoder model to the input data units by the fuzzy system to generate a latent space representation of the input data units in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data units by the fuzzy system, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data units by the fuzzy system to generate fuzzy data units.

[0086] In Example 10, the subject matter of Example 9 may optionally include: accessing a plurality of labeled input data units by a fuzzy system, wherein the first labeled input data unit of the plurality of labeled input data units includes a first input data unit feature, a first utility parameter describing the first input data unit feature, and a first privacy parameter describing the first input data unit feature; generating a utility classifier by the fuzzy system using the plurality of labeled input data units, the utility classifier being used for mapping from latent space to corresponding utility; and generating a privacy classifier by the fuzzy system using the plurality of labeled input data units, the privacy classifier being used for mapping from latent space to corresponding privacy.

[0087] In Example 11, the topics of any one or more of Examples 9-10 may optionally include: using a function classifier to determine a function label for the first latent space dimension; using a privacy classifier to determine a privacy label for the first latent space dimension; and using the function attribute label and the privacy attribute label for the first latent space dimension to determine a first value of the multidimensional noise.

[0088] In Example 12, the subject matter of Example 11 may optionally include: generating a privacy interpretability graph by a fuzzy system using input data units and a privacy classifier, the privacy interpretability graph including multiple latent space dimension privacy attribute labels, the multiple latent space dimension privacy attribute labels including a first latent space dimension utility attribute label; and generating a utility interpretability graph by a fuzzy system using input data units and a utility classifier, the utility interpretability graph including multiple latent space dimension utility attribute labels, the multiple latent space dimension utility attribute labels including a first latent space dimension utility attribute label.

[0089] In Example 13, the subject matter of any one or more of Examples 11-12 may optionally include: determining a ratio by the fuzzy system using a first latent space dimension utility attribute label and a first latent space dimension privacy attribute label; and applying the ratio to a noise distribution by the fuzzy system, wherein a first value of the multidimensional noise is based at least in part on the application of the ratio to the noise distribution.

[0090] In Example 14, the subject of Example 13 may optionally include: applying the ratio to the noise distribution includes applying the ratio to the variance of the Gaussian distribution.

[0091] In Example 15, one or more of the topics in Examples 13-14 may optionally include: cropping the result of applying the ratio to the noise distribution to determine a first value of the multidimensional noise.

[0092] In Example 16, the subject matter of any one or more of Examples 9-15 may optionally include: determining multiple vectors by a fuzzy system, the multiple vectors including a first vector corresponding to a first latent space dimension and a second vector corresponding to a second latent space dimension.

[0093] Example 17 is a machine-readable medium having instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations including: accessing an input data unit; applying an encoder model to the input data unit to generate a latent space representation of the input data unit in a latent space having a first latent space dimension and a second latent space dimension; applying multidimensional noise to the latent space representation of the input data unit, the multidimensional noise having a first value in the first latent space dimension and a second value different from the first value in the second latent space dimension; and applying a decoder model to the latent space representation of the input data unit to generate an ambiguous data unit.

[0094] In Example 18, the subject of Example 17 may optionally include operations that further include: accessing a plurality of labeled input data units, the first labeled input data unit of the plurality of labeled input data units including first input data unit features, a first utility parameter describing the first input data unit features, and a first privacy parameter describing the first input data unit features; using the plurality of labeled input data units to generate a utility classifier for mapping from latent space to corresponding utility; and using the plurality of labeled input data units to generate a privacy classifier for mapping from latent space to corresponding privacy.

[0095] In Example 19, the subject matter of any one or more of Examples 17-18 may optionally include an operation that further includes: using a function classifier to determine a function attribute label for a first latent space dimension; using a privacy classifier to determine a privacy attribute label for a first latent space dimension; and using the function attribute label and the privacy attribute label for the first latent space dimension to determine a first value of the multidimensional noise.

[0096] In Example 20, the subject of Example 19 may optionally include operations that further include: generating a privacy interpretability graph using input data units and a privacy classifier, the privacy interpretability graph including multiple latent space dimension privacy attribute labels, the multiple latent space dimension privacy attribute labels including a first latent space dimension utility attribute label; and generating a utility interpretability graph using input data units and a utility classifier, the utility interpretability graph including multiple latent space dimension utility attribute labels, the multiple latent space dimension utility attribute labels including a first latent space dimension utility attribute label.

[0097] Figure 6 This is a block diagram 600 illustrating an example of a software architecture 602 for a computing device. Software architecture 602 can be used in conjunction with various hardware architectures, such as those described herein. Figure 6 This is merely a non-limiting example of a software architecture, and many other architectures can be implemented to facilitate the functionality described herein. An example hardware layer 604 is shown, and this hardware layer 604 can represent, for example, any of the aforementioned computing devices. In some examples, hardware layer 604 can be configured according to… Figure 6 It is implemented through the architecture of computer systems.

[0098] Hardware layer 604 includes one or more processing units 606 having associated executable instructions 608. The executable instructions 608 represent executable instructions of software architecture 602, including implementations of the methods, modules, subsystems, and components described herein, and may also include memory and / or storage modules 610 that also have executable instructions 608. Hardware layer 604 may also include other hardware indicated by other hardware 612, which represents any other hardware of hardware layer 604, such as other hardware shown as part of software architecture 602.

[0099] exist Figure 6 In the example architecture, software architecture 602 can be conceptualized as a stack of layers, where each layer provides specific functionality. For example, software architecture 602 may include layers such as operating system 614, library 616, middleware 618, application 620, and presentation layer 644. Operationally, application 620 and / or other components within a layer can invoke application programming interface (API) calls 624 through the software stack and, in response to API call 624, access responses, return values, etc., indicated as message 626. The layers shown are representative in nature, and not all software architectures have all layers. For example, some mobile or dedicated operating systems may not provide middleware 618, while other operating systems may provide such a layer. Other software architectures may include additional or different layers.

[0100] Operating system 614 can manage hardware resources and provide public services. Operating system 614 may include, for example, kernel 628, services 630, and drivers 632. Kernel 628 can act as an abstraction layer between hardware and other software layers. For example, kernel 628 can be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, etc. Services 630 can provide other public services to other software layers. In some examples, service 630 includes interrupt services. Interrupt services can detect the receipt of interrupts and, in response, cause software architecture 602 to suspend its current processing and execute an interrupt service routine (ISR) when an interrupt is accessed.

[0101] Driver 632 can be responsible for controlling or interfacing with the underlying hardware. For example, depending on the hardware configuration, driver 632 may include a display driver, a camera driver, etc. Drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Wi-Fi drivers Drivers, Near Field Communication (NFC) drivers, audio drivers, power management drivers, etc.

[0102] Library 616 can provide common infrastructure that can be utilized by application 620 and / or other components and / or layers. Library 616 typically provides functionality that allows other software modules to perform tasks in a way that is easier than directly interfaced with the functions of operating system 614 (e.g., kernel 628, service 630, and / or driver 632). Library 616 may include system libraries 634 (e.g., the C standard library), which can provide functions such as memory allocation, string manipulation, and mathematical functions. Furthermore, library 616 may include API libraries 636, such as media libraries (e.g., libraries supporting the rendering and manipulation of various media formats such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.), graphics libraries (e.g., OpenGL frameworks that can be used to render 2D and 3D content on a display), database libraries (e.g., SQLite that provides various relational database functions), network libraries (e.g., WebKit that provides web browsing functionality), and so on. Library 616 may also include a wide variety of other libraries 638, such as machine learning libraries, for providing multiple other APIs to application 620 and other software components / modules.

[0103] Middleware 618 (sometimes referred to as the framework layer) provides higher-level common infrastructure that can be utilized by application 620 and / or other software components / modules. For example, middleware 618 can provide various graphical user interface (GUI) functionalities, advanced resource management, advanced location services, etc. Middleware 618 can provide various other APIs that can be utilized by application 620 and / or other software components / modules, some of which may be specific to a particular operating system or platform.

[0104] Application 620 includes built-in application 640 and / or third-party application 642. Examples of representative built-in applications 640 may include, but are not limited to, contact applications, browser applications, book reader applications, location applications, media applications, messaging applications, and / or game applications. Third-party applications 642 may include any built-in application as well as a wide variety of other applications. In a specific example, third-party application 642 (e.g., an entity using Android other than a platform-specific vendor) TM Or iOS TM Applications developed using a Software Development Kit (SDK) can run on platforms such as iOS. TM Android TM , Mobile software running on a mobile operating system of a mobile phone or other mobile computing device. In this example, a third-party application 642 may invoke API calls 624 provided by the mobile operating system, such as operating system 614, to facilitate the functionality described herein.

[0105] Application 620 can utilize built-in operating system functions (e.g., kernel 628, services 630, and / or drivers 632), libraries (e.g., system library 634, API library 636, and other libraries 638), and middleware 618 to create a user interface for interacting with the system's user. Alternatively or additionally, in some systems, interaction with the user can occur through a presentation layer (such as presentation layer 644). In these systems, the application / module "logic" can be separated from the aspects of the application / module that interact with the user.

[0106] Some software architectures utilize virtual machines. Figure 6 In the example, this is illustrated by virtual machine 648. The virtual machine creates a software environment in which applications / modules can execute as if they were running on a hardware computing device. The virtual machine is hosted by a host operating system (operating system 614) and typically (though not always) has a virtual machine monitor 646 that manages the operation of the virtual machine and its interface with the host operating system (i.e., operating system 614). The software architecture executes within virtual machine 648 (such as operating system 650, libraries 652, frameworks / middleware 654, applications 656, and / or presentation layers 658). These layers of the software architecture executing within virtual machine 648 may be the same as or different from the corresponding layers previously described.

[0107] Modules, components and logic

[0108] Certain embodiments herein are described as including logic or multiple components, modules, or mechanisms. A module may constitute a software module (e.g., code contained on (1) a non-transitory machine-readable medium or (2) in a transmitted signal) or a hardware-implemented module. A hardware-implemented module is a tangible unit capable of performing a particular operation and may be configured or arranged in a particular manner. In example embodiments, one or more computer systems (e.g., a standalone computer system, a client computer system, or a server computer system) or one or more hardware processors may be hardware-implemented modules configured by software (e.g., an application or application portion) to operate to perform the particular operations described herein.

[0109] In various embodiments, the hardware-implemented module can be implemented mechanically or electronically. For example, a hardware-implemented module may include dedicated circuitry or logic permanently configured (e.g., as a dedicated processor, such as a field-programmable gate array (FPGA) or application-specific integrated circuit (ASIC)) to perform certain operations. A hardware-implemented module may also include programmable logic or circuitry temporarily configured by software to perform certain operations (e.g., as contained within a general-purpose processor or another programmable processor). It should be understood that the decision to implement a hardware-implemented module mechanically, in dedicated and permanently configured circuitry, or in temporarily configured (e.g., software-configured) circuitry may be driven by cost and time considerations.

[0110] Therefore, the term "hardware-implemented module" should be understood to include tangible entities, i.e., physically constructed, permanently configured (e.g., hardwired) or temporarily or provisionally configured (e.g., programmed) entities, that operate in a particular manner and / or perform the specific operations described herein. Consider embodiments in which the hardware-implemented modules are provisionally configured (e.g., programmed), and each of the hardware-implemented modules does not need to be configured or instantiated at any given time. For example, in cases where the hardware-implemented modules include a general-purpose processor configured using software, the general-purpose processor can be configured as various different hardware-implemented modules at different times. The software can accordingly configure the processor, for example, constituting a particular hardware-implemented module at one time and different hardware-implemented modules at different times.

[0111] Hardware-implemented modules can provide and receive information from other hardware-implemented modules. Therefore, the described hardware-implemented modules can be considered communication-coupled. In the presence of multiple such hardware-implemented modules simultaneously, communication can be achieved through signal transmission (e.g., through appropriate circuitry and buses connecting the hardware-implemented modules). In embodiments where multiple hardware-implemented modules are configured or instantiated at different times, communication between such modules can be achieved, for example, by storing and retrieving information in a memory structure accessible to the multiple hardware-implemented modules. For example, one hardware-implemented module can perform an operation and store the output of that operation in a memory device to which it is communication-coupled. Another hardware-implemented module can then access that memory device at a later time to retrieve and process the stored output. Hardware-implemented modules can also initiate communication with input or output devices and can operate on resources (e.g., collections of information).

[0112] The various operations of the example methods described herein can be performed at least in part by one or more processors (e.g., by software) that are temporarily or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, these processors can constitute processor-implemented modules that operate to perform one or more operations or functions. In some example embodiments, the modules mentioned herein may include processor-implemented modules.

[0113] Similarly, the methods described herein can be implemented, at least in part, by a processor. For example, at least some operations of the methods can be performed by one or more processors or processor-implemented modules. Execution of certain operations can be distributed across one or more processors, residing not only on a single machine but also deployed across multiple machines. In some example embodiments, one or more processors may reside in a single location (e.g., in a home environment, office environment, or server cluster), while in other embodiments, the processors may be distributed across multiple locations.

[0114] One or more processors may also support the execution of related operations in a “cloud computing” environment or as “Software as a Service” (SaaS). For example, at least some operations may be performed by a set of computers (as an example of a machine that includes processors), and these operations may be accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs).

[0115] Electronic devices and systems

[0116] The example embodiments may be implemented in digital electronic circuits, computer hardware, firmware or software, or a combination thereof. The example embodiments may be implemented using a computer program product (e.g., a computer program tangibly contained in an information carrier, such as a machine-readable medium) to be executed by or to control the operation of a data processing apparatus (e.g., a programmable processor, a computer, or a plurality of computers).

[0117] Computer programs can be written in any programming language (including compiled or interpreted languages) and can be deployed in any form (including as standalone programs or modules, subroutines, or other units suitable for a computing environment). Computer programs can be deployed to execute on a single computer or on multiple computers located in one place or distributed across multiple locations and interconnected through a communication network.

[0118] In the example embodiments, the operations may be performed by one or more programmable processors that execute computer programs to perform functions by manipulating input data and generating output. The method operations may also be performed by dedicated logic circuitry (e.g., an FPGA or ASIC), and the apparatus of the example embodiments may be implemented as dedicated logic circuitry.

[0119] Computing systems may include clients and servers. Clients and servers are generally geographically isolated and typically interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and involves a client-server relationship. In embodiments where a programmable computing system is deployed, it should be understood that both hardware and software architectures are worth considering. Specifically, it should be understood that the choice of implementing a particular function in permanently configured hardware (e.g., ASIC), temporarily configured hardware (e.g., a combination of software and a programmable processor), or a combination of permanently and temporarily configured hardware can be a design choice. The following are hardware (e.g., machines) and software architectures that can be deployed in various example embodiments.

[0120] Example machine architecture and machine-readable media

[0121] Figure 7 This is a block diagram of a machine in the form of an example of a computer system 700 capable of executing instructions 724 to cause the machine to perform any or more methods discussed herein. In alternative embodiments, the machine operates as a standalone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine can operate as a server or client machine in a server-client network environment or as a peer machine in a peer-to-peer (or distributed) network environment. The machine can be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), cellular phone, network device, network router, switch, or bridge, or any machine capable of executing instructions (in sequence or otherwise) specifying the actions to be taken by the machine. Furthermore, although only a single machine is shown, the term "machine" should also be understood to include any collection of machines that individually or jointly execute a set (or more) of instructions to perform any or more methods discussed herein.

[0122] Example computer system 700 includes a processor 702 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), main memory 704, and static memory 706, which communicate with each other via a bus 708. Computer system 700 may also include a video display unit 710 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). Computer system 700 also includes an alphanumeric input device 712 (e.g., a keyboard or touch-sensitive display), a user interface (UI) navigation (or cursor control) device 714 (e.g., a mouse), a disk drive unit 716, a signal generation device 718 (e.g., a speaker), and a network interface device 720.

[0123] Machine-readable media

[0124] The disk drive unit 716 includes a machine-readable medium 722 on which one or more sets of data structures and instructions 724 (e.g., software) are stored, embodying or utilized by any one or more methods or functions described herein. During the execution of instructions 724 by the computer system 700, instructions 724 may also reside wholly or at least partially within main memory 704 and / or processor 702, which also constitute the machine-readable medium 722.

[0125] Although machine-readable medium 722 is shown as a single medium in the example embodiment, the term "machine-readable medium" can include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) storing one or more instructions 724 or data structures. The term "machine-readable medium" should also be understood to include any tangible medium capable of storing, encoding, or carrying machine-executable instructions 724 and enabling the machine to perform any one or more methods of this disclosure, or any tangible medium capable of storing, encoding, or carrying data structures utilized by or associated with such instructions 724. Therefore, the term "machine-readable medium" should include, but is not limited to, solid-state memory, optical and magnetic media. Specific examples of machine-readable medium 722 include non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. Machine-readable medium is not a transmission medium.

[0126] transmission medium

[0127] Instructions 724 can be further sent or received via a transmission medium and a communication network 726. Instructions 724 can be transmitted using a network interface device 720 and any of a variety of well-known transmission protocols (e.g., HTTP). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, mobile phone networks, conventional telephone (POTS) networks, and wireless data networks (e.g., WiFi and WiMax networks). The term "transmission medium" should be understood to include any intangible medium capable of storing, encoding, or carrying instructions 724 executed by the machine, and includes digital or analog communication signals or other intangible media used to facilitate communication of such software.

[0128] Although embodiments have been described with reference to specific example examples, it will be apparent that various modifications and changes can be made to these embodiments without departing from the broader spirit and scope of this disclosure. Therefore, the specification and drawings are to be considered illustrative rather than restrictive. The drawings, which form part of this specification, illustrate specific embodiments in which the subject matter can be practiced by way of illustration rather than limitation. The illustrated embodiments have been described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments can be utilized and derived therefrom, allowing for structural and logical substitutions and changes without departing from the scope of this disclosure. Therefore, the detailed description should not be construed as restrictive, and the scope of the various embodiments is defined only by the appended claims and the full scope of their equivalents.

[0129] Such embodiments of the subject matter of this invention may be referred to herein, individually and / or collectively, by the term "invention" for convenience only, and if more than one invention or inventive concept is disclosed, it is not intended to voluntarily limit the scope of this application to any single invention or inventive concept. Therefore, although specific embodiments have been shown and described herein, it should be understood that any arrangement intended to achieve the same purpose may substitute for the specific embodiments shown. This disclosure is intended to cover any and all modifications or variations of the various embodiments. Combinations of the above embodiments, as well as other embodiments not specifically described herein, will be clear to those skilled in the art upon reading the above description.

Claims

1. A system for obfuscating privacy information in input data, the system comprising: A computing device, comprising at least one processor and an associated storage device, wherein the at least one processor is programmed to perform operations including: Access the input data unit; The encoder model is applied to the input data unit to generate a latent space representation of the input data unit in the latent space, the latent space having a first latent space dimension and a second latent space dimension; Multidimensional noise is applied to the latent space representation of the input data unit, wherein the multidimensional noise has a first value in a first latent space dimension and a second value different from the first value in a second latent space dimension; and The decoder model is applied to the latent space representation of the input data unit to generate the fuzzy data unit.

2. The system according to claim 1, wherein the operation further includes: Accessing multiple labeled input data units, wherein the first labeled input data unit of the multiple labeled input data units includes a first input data unit feature, a first functional parameter describing the first input data unit feature, and a first privacy parameter describing the first input data unit feature; A function classifier is generated using multiple labeled input data units, which is used for mapping from the latent space to the corresponding function. as well as A privacy classifier is generated using multiple labeled input data units, which is used for mapping from the latent space to the corresponding privacy.

3. The system according to claim 1, wherein the operation further includes: Use a function classifier to determine the function attribute labels for the first latent space dimension; Use a privacy classifier to determine the privacy attribute labels for the first hidden space dimension; as well as The first value of the multidimensional noise is determined using the first latent space dimension function attribute label and the first latent space dimension privacy attribute label.

4. The system according to claim 3, wherein the operation further includes: An input data unit and a privacy classifier are used to generate a privacy interpretability graph, which includes multiple latent space dimension privacy attribute labels, including a first latent space dimension privacy attribute label. as well as A functional interpretability graph is generated using input data units and a functional classifier. The functional interpretability graph includes multiple latent space dimension functional attribute labels, including a first latent space dimension functional attribute label.

5. The system according to claim 3, wherein the operation further includes: The ratio is determined using the first hidden space dimension functional attribute label and the first hidden space dimension privacy attribute label; as well as The ratio is applied to the noise distribution, and the first value of the multidimensional noise is based at least in part on the application of the ratio to the noise distribution.

6. The system of claim 5, wherein applying the ratio to the noise distribution comprises: Apply the ratio to the variance of the Gaussian distribution.

7. The system according to claim 5, further comprising: The cropping process applies the ratio to the noise distribution to determine a first value for the multidimensional noise.

8. The system according to claim 1, wherein the operation further comprises: A plurality of vectors are determined, the plurality of vectors including a first vector corresponding to a first latent space dimension and a second vector corresponding to a second latent space dimension.

9. A method for obfuscating privacy information in input data, the method comprising: The input data unit is accessed by a fuzzy system including at least one processor; The encoder model is applied to the input data unit by the fuzzy system to generate the latent space representation of the input data unit in the latent space, wherein the latent space has a first latent space dimension and a second latent space dimension; A fuzzy system applies multidimensional noise to the latent space representation of the input data unit, wherein the multidimensional noise has a first value in a first latent space dimension and a second value different from the first value in a second latent space dimension; as well as The fuzzy system applies the decoder model to the latent space representation of the input data unit to generate the fuzzy data unit.

10. The method of claim 9, further comprising: The fuzzy system accesses multiple labeled input data units, wherein the first labeled input data unit of the multiple labeled input data units includes a first input data unit feature, a first functional parameter describing the first input data unit feature, and a first privacy parameter describing the first input data unit feature; A function classifier is generated by a fuzzy system using multiple labeled input data units, the function classifier being used for mapping from the latent space to the corresponding function; as well as A privacy classifier is generated by a fuzzy system using multiple labeled input data units, the privacy classifier being used for mapping from the latent space to the corresponding privacy.

11. The method of claim 9, further comprising: Use a function classifier to determine the function attribute labels for the first latent space dimension; Use a privacy classifier to determine the privacy attribute labels for the first hidden space dimension; as well as The first value of the multidimensional noise is determined using the first latent space dimension function attribute label and the first latent space dimension privacy attribute label.

12. The method of claim 11, further comprising: A privacy interpretability graph is generated by a fuzzy system using input data units and a privacy classifier. The privacy interpretability graph includes multiple latent space dimension privacy attribute labels, including a first latent space dimension privacy attribute label. as well as A functional interpretability graph is generated by a fuzzy system using input data units and a functional classifier. The functional interpretability graph includes multiple latent space dimension functional attribute labels, including a first latent space dimension functional attribute label.

13. The method of claim 11, further comprising: The ratio is determined by the fuzzy system using the first latent space dimension functional attribute label and the first latent space dimension privacy attribute label; as well as The ratio is applied to the noise distribution by a fuzzy system, and the first value of the multidimensional noise is based at least in part on the application of the ratio to the noise distribution.

14. The method of claim 13, wherein applying the ratio to the noise distribution comprises: Apply the ratio to the variance of the Gaussian distribution.

15. The method of claim 13, further comprising: The cropping process applies the ratio to the noise distribution to determine a first value for the multidimensional noise.

16. The method of claim 9, further comprising: Multiple vectors are determined by a fuzzy system, including a first vector corresponding to a first latent space dimension and a second vector corresponding to a second latent space dimension.

17. A machine-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform an operation, the operation comprising: Access the input data unit; The encoder model is applied to the input data unit to generate a latent space representation of the input data unit in the latent space, the latent space having a first latent space dimension and a second latent space dimension; Multidimensional noise is applied to the latent space representation of the input data unit, wherein the multidimensional noise has a first value in a first latent space dimension and a second value different from the first value in a second latent space dimension; and The decoder model is applied to the latent space representation of the input data unit to generate the fuzzy data unit.

18. The machine-readable medium of claim 17, further comprising: Accessing multiple labeled input data units, wherein the first labeled input data unit of the multiple labeled input data units includes a first input data unit feature, a first functional parameter describing the first input data unit feature, and a first privacy parameter describing the first input data unit feature; A function classifier is generated using multiple labeled input data units, which is used for mapping from the latent space to the corresponding function. as well as A privacy classifier is generated using multiple labeled input data units, which is used for mapping from the latent space to the corresponding privacy.

19. The machine-readable medium of claim 17, further comprising: Use a function classifier to determine the function attribute labels for the first latent space dimension; Use a privacy classifier to determine the privacy attribute labels for the first hidden space dimension; as well as The first value of the multidimensional noise is determined using the first latent space dimension function attribute label and the first latent space dimension privacy attribute label.

20. The machine-readable medium of claim 19, wherein the operation further comprises: An input data unit and a privacy classifier are used to generate a privacy interpretability graph, which includes multiple latent space dimension privacy attribute labels, including a first latent space dimension privacy attribute label. as well as A functional interpretability graph is generated using input data units and a functional classifier. The functional interpretability graph includes multiple latent space dimension functional attribute labels, including a first latent space dimension functional attribute label.

Images