Privacy-driven data subset size determination

Abstract

Techniques are described for maintaining patient privacy in association with obtaining patient data for machine learning applications. In one example, a method may include accessing, by a system including a processor, a training dataset associated with a machine learning model, the training dataset including data samples each including unique features of an individual. The method also includes determining, by the system, characteristic curve information that associates different data portions extracted from the data samples with respective probabilities that match the different data portions to respective ones of the data samples from which the different data portions are extracted. The method also includes controlling, by the system, collection of a new data portion extracted from a new data sample corresponding to the data sample based on the new data portion complying with criteria defining a target data portion, wherein the criteria include a probability of the respective probabilities that meets an anonymous criterion.

Description

Technical Field

[0001] The present application relates to techniques for maintaining patient privacy in association with obtaining patient data for machine learning applications. Background Art

[0002] Machine learning (ML) models are used in many medical image processing and analysis tasks, such as organ segmentation, anomaly detection, diagnostic classification, risk prediction, temporal analysis, image reconstruction, etc. However, one of the fundamental problems with data-driven machine learning approaches is that the final model inference ability is limited by the scope of the training data used to develop the model. In order to continuously improve these models over time, it is necessary to retrain and update the models to improve their performance based on feedback about model errors or failure modes observed in actual deployment environments (e.g., after initial training and development). Typically, failure modes cannot be understood without access to the input patient imaging data processed and / or generated by the model in the deployment environment. However, obtaining deployment site patient imaging data can be difficult because there are often contractual restrictions and privacy issues that prohibit sharing medical image data between the model development site (i.e., the vendor site) and the model deployment site (e.g., the client site). Summary of the invention

[0003] The following presents a summary of the invention to provide a basic understanding of one or more embodiments of the invention. The summary is not intended to identify key or important elements, nor is it intended to delineate any scope of the different embodiments or any scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to a more detailed description presented later. In one or more embodiments, systems, computer-implemented methods, apparatus, and / or computer program products are described that facilitate maintaining patient privacy in association with obtaining patient data for machine learning applications.

[0004] According to one embodiment, a system is provided, the system comprising a memory and a processor, the memory storing a computer executable component, the processor executing the computer executable component stored in the memory. The computer executable component may include an evaluation component that accesses a training data set associated with a machine learning model, the training data set including data samples, the data samples respectively including physical characteristics of individuals. The evaluation component also determines characteristic curve information, the characteristic curve information associates different data portions extracted from the data sample with corresponding probabilities of matching the different data portions to corresponding data samples in the data sample from which the different data portions were extracted, wherein the different data portions respectively include different portions of physical characteristics. The computer executable component also includes a collection component that controls the collection of new data portions extracted from new data samples corresponding to the data sample based on the association of the new data portions with the probabilities of satisfying anonymity criteria in the corresponding probabilities.

[0005] In one or more embodiments, the computer executable component may further include a selection component that selects the target data portion based on the target data portion among the different data portions being associated with the probability of satisfying the anonymity criterion, and wherein the collection component controls the collection of the new data portion based on the new data portion meeting the criterion defining the target data portion. For example, in various embodiments, the new data sample includes a runtime data sample processed by an external system through a machine learning model.

[0006] In some embodiments, elements described in conjunction with the disclosed systems can be embodied in different forms, such as a computer-implemented method, a computer program product, or another form. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A block diagram of an exemplary system that facilitates maintaining patient privacy in association with obtaining patient data for machine learning (ML) applications in accordance with one or more embodiments of the disclosed subject matter is presented.

[0008] Figure 2 Exemplary characteristic curves associating different data portions with recognition probabilities are shown in accordance with one or more embodiments of the disclosed subject matter.

[0009] Figure 3 A flow chart illustrating an exemplary process for determining characteristic curve information associating different data portions with recognition probabilities in accordance with one or more embodiments of the disclosed subject matter.

[0010] Figure 4 Block diagram illustrating an exemplary non-limiting computer-implemented method that facilitates maintaining individual privacy in association with obtaining data of privacy concern in accordance with one or more embodiments of the disclosed subject matter.

[0011] Figure 5 Block diagram illustrating an exemplary non-limiting computer-implemented method that facilitates maintaining individual privacy associated with obtaining data for ML applications in accordance with one or more embodiments of the disclosed subject matter.

[0012] Figure 6 A block diagram illustrating an exemplary non-limiting operating environment in which one or more embodiments described herein may be facilitated.

[0013] Figure 7 A block diagram is shown of another exemplary non-limiting operating environment in which one or more embodiments described herein may be facilitated. DETAILED DESCRIPTION

[0014] The following specific embodiments are merely exemplary and are not intended to limit the application or use of the embodiments and / or the embodiments. In addition, it is not intended to be bound by any express or implied information set forth in the aforementioned "background technology" section or "content of the invention" section or "specific embodiments" section.

[0015] The subject disclosure provides systems, computer-implemented methods, apparatus, and / or computer program products that facilitate maintaining patient privacy in association with obtaining patient data for machine learning applications.

[0016] As described in the background section, the data-driven nature of ML models brings challenges in the inference stage. Specifically, one of the fundamental problems of data-driven machine learning methods is that the final model inference ability is limited by the scope of the training data used to develop the model. For example, in various fields, AI models are usually trained and developed by specific model development entities, such as suppliers that develop ML models for use by multiple client systems. For example, in the field of healthcare, suppliers usually include software development systems that specialize in developing ML tools for healthcare systems (such as hospitals, medical imaging centers, etc.). According to this example, healthcare systems (e.g., hospitals, medical imaging centers, etc.) correspond to client systems. The terms "supplier", "supplier site", "supplier system" or their variants are generally used to refer to entities or systems that generate, update ML applications (e.g., models) and provide them to one or more client systems for use. The terms "client", "client site", "client system" or their variants are generally used herein to refer to client systems that receive and adopt ML applications provided by supplier systems in this field.

[0017] According to the above vendor-client system architecture for ML model development and deployment, the scope of the models created by the vendor is limited by the training data used by the vendor. Depending on the nature of the model and the data being processed, it can be very difficult, if not impossible, for the vendor training data to fully understand all the variations that the model will encounter when deployed in the field. For example, a model trained on clinical data from one hospital may not perform as well on the same type of data from another hospital. For example, when applied to a medical image inference model that is trained to perform inference tasks on medical images, the model development system cannot access every possible medical image ever taken in the world, and new medical images and features will continue to evolve as patients and acquisition technologies evolve over time. Therefore, techniques for regularly monitoring the performance of models deployed at client sites and updating the models over time based on the specific nuances and variations of the data at the client site are critical to the successful integration of ML models for real-world applications in the medical field (as well as many other fields).

[0018] In order to continuously improve these models over time, it is necessary to retrain and update the models to improve their performance based on feedback about model errors or failure modes observed in actual deployment environments (e.g., after initial training and development). When applied to the medical field, failure modes cannot be understood without access to patient data processed and / or generated by the model in the deployment environment. However, obtaining deployment site patient data can be difficult because there are often contractual restrictions and privacy issues that prohibit data sharing between vendor sites and client sites.

[0019] The disclosed technology solves this problem by using techniques to obtain portions of patient data processed and / or generated by a model in a deployment environment, where the particular portions obtained have been determined to ensure that the probability of uniquely identifying the corresponding patient from which the data was obtained is below a threshold. The particular threshold may be specified by a regulatory body and / or required by legal and compliance functions, and may vary for different use cases. For example, when applied to medical images, the disclosed technology can be used to obtain portions of the medical image, where each of the portions includes a subset of pixels extracted from the original image (e.g., a cropped portion of the original image).

[0020] Of particular importance, the disclosed subject matter provides techniques for determining a particular portion of patient data that can ensure that the probability of uniquely identifying the corresponding patient to whom the data belongs is below a threshold. For example, when applied to medical images, the particular portion can be defined by a particular subset of pixels taken from the original image, where the subset can be defined based on a particular number of pixels included in the subset as well as other criteria (e.g., one or more particular regions of the image as well as other parameters). For example, a subset size of pixels constrained by a single pixel would be completely anonymous, as the ability to identify a particular image and / or the corresponding patient from which the image was captured from a single pixel would be impossible. In this regard, as the number of pixels in a portion of an image increases, the probability of identification of the individual depicted in the original image generally increases. With medical image data, this problem is even more acute, as medical images from various modalities tend to uniquely reflect the physical and anatomical features of an individual.

[0021] In order to facilitate the determination of a particular portion of patient data that can ensure that the probability of uniquely identifying the corresponding patient to which the data belongs is below a threshold, in one or more embodiments, the disclosed technology provides a method for determining a transfer function from different candidate data portions extracted from corresponding training data samples to the recognition probabilities of the corresponding training data samples from which they were extracted. The training data samples can correspond to training data samples used to train an ML model to perform a specific inference task. The transfer function can then be used to select a particular data portion from the different candidate data portions that is associated with a recognition probability that meets a desired threshold. Once the selection is completed, the criteria defining the particular data portion (e.g., a criteria such as a particular pixel subset size) can be used to extract the corresponding data portion from a new patient data sample corresponding to the training data sample, such as a new data sample processed by a training version of the ML in a deployment environment (e.g., a client site).

[0022] The criteria for defining different data portions may vary based on the type of training data sample and the specific portion of the training data sample of interest. For example, when applied to medical images, the specific portion of the medical image of interest may vary based on the specific ML application for which the training data sample is used (e.g., the specific inference task of the ML model trained on the training data sample). For example, the specific portion of interest may be constrained relative to one or more target anatomical features depicted in the medical image of the relevant ML application. The disclosed technology may also be applied to training data samples including other types of patient data (in addition to medical image data), describing personal information of the patient, such as clinical report data, patient electronic health record data, radiology report data, physiological parameters, etc. In addition, although the disclosed technology is described with respect to patient data and using extracted portions of patient data to ensure the anonymity of the patient, the disclosed technology may be extended to other fields and data sets involving privacy concerns. For example, the disclosed technology may be applied to any type of data set including data samples that respectively include unique features of entities (such as people, companies, organizations, etc.) that are subject to privacy concerns. Unique characteristics may include any type of information that can uniquely identify a corresponding entity, such as, but not limited to, physical characteristics, physiological characteristics, behavioral characteristics, unique identifiers (e.g., name, account number, device identifier, phone number, etc.), unique demographic information (e.g., location / address, age, gender, etc.), business records, transaction records, etc.

[0023] The terms "medical image", "medical image data", and the like are used to refer to image data depicting one or more anatomical regions of a patient. References herein to medical images or medical image data may include any type of medical image associated with various types of medical image acquisition / capture modalities. For example, medical images may include (but are not limited to): radiation therapy (RT) images, X-ray (XR) images, digital radiography (DX) X-ray images, X-ray angiography (XA) images, panoramic X-ray (PX) images, computed tomography (CT) images, mammography (MG) images (including tomosynthesis equipment), magnetic resonance imaging (MRI) images, ultrasound (US) images, color flow Doppler (CD) images, positron emission tomography (PET) images, single photon emission computed tomography (SPECT) images, nuclear medicine (NM) images, and the like. Medical images may also include synthesized versions of native medical images, such as enhanced, modified, or improved versions of native medical images, enhanced versions of native medical images generated using one or more image processing techniques, and the like. In some embodiments, the term "image data" may include raw measurement data (or simulated measurement data) used to generate a medical image (eg, raw measurement data captured via a medical image acquisition process).

[0024] Unless the context warrants a specific distinction between the terms, the terms "algorithm" and "model" are used interchangeably herein. Unless the context warrants a specific distinction between the terms, the terms "artificial intelligence (AI) model" and "machine learning (ML) model" are used interchangeably herein. References to AI models or ML models herein may include any type of AI model or ML model, including (but not limited to): deep learning models, neural network models, deep neural network models (DNNs), convolutional neural network models (CNNs), and generative adversarial neural network models (GANs), etc. AI models or ML models may include supervised learning models, unsupervised learning models, semi-supervised learning models, combinations thereof, and models that employ other types of ML learning techniques. AI models or ML models may include a single model or a group of two or more models (e.g., enabling models, etc.).

[0025] The term "image inference model" is used herein to refer to an AI / ML model suitable for performing image processing or analysis tasks on image data. The image processing or analysis tasks may vary. In various embodiments, the image processing or analysis tasks may include (but are not limited to): segmentation tasks, image reconstruction tasks, object recognition tasks, motion detection tasks, video tracking tasks, optical flow tasks, etc. The image inference model described herein may include a two-dimensional (2D) image processing model and a three-dimensional (3D) image processing model. The image processing model may adopt various types of AI / ML models (e.g., deep learning models, neural network models, deep neural network models, DNN, CNN, GAN, etc.). Unless the context warrants a specific distinction between the terms, the terms "image inference model", "image processing model", "image analysis model", etc. are used interchangeably herein.

[0026] The term "inference output based on an image" is used herein to refer to a determination or prediction that an image processing model is configured to generate. For example, an inference output based on an image may include a segmentation mask, a reconstructed image, an adapted image, an annotated image, a classification, a value, etc. The inference output based on an image will vary based on the type of model and the specific task that the model is configured to perform. The inference output based on an image may include a data object that can be presented (e.g., a visual data object), stored, used as an input for another processing task, etc. The output may be in different formats, such as: Digital Imaging and Communication in Medicine (DICOM) Structured Report (SR), DICOM Secondary Capture, DICOM Parameter Mapping, Image, Text, and / or JavaScript Object Designation (JSON). The terms "inference output based on an image", "inference output", "inference result", "inference", "output", "result", "prediction", etc. are used interchangeably herein unless the context determines that a special distinction is made between these terms.

[0027] As used herein, a "medical imaging inference model" refers to an image inference model that is customized to perform image processing / analysis tasks on medical image data. For example, medical imaging processing / analysis tasks may include (but are not limited to): disease / condition classification, disease region segmentation, organ segmentation, disease quantification, disease / condition staging, risk prediction, temporal analysis, anomaly detection, anatomical feature characterization, medical image reconstruction, etc. Unless the context warrants a specific distinction between the terms, the terms "medical image inference model", "medical image processing model", "medical image analysis model", etc. may be used interchangeably herein.

[0028] One or more embodiments are now described with reference to the accompanying drawings, wherein the same reference numerals are used to represent the same elements throughout. In the following description, for the purpose of illustration, many specific details are set forth in order to provide a more thorough understanding of one or more embodiments. However, it is apparent that in various cases, one or more embodiments may be practiced without these specific details.

[0029] Now turning to the attached figure, Figure 1 A block diagram of an exemplary non-limiting system 100 that facilitates maintaining patient privacy in association with obtaining patient data for ML applications in accordance with one or more embodiments of the disclosed subject matter is presented. The system 100 includes a provider system 101 and one or more client systems 132. The provider system 100 and the one or more client systems 132 may each include or correspond to one or more computing systems including one or more computing devices, machines, virtual machines, computer executable components, data repositories, etc. that may be communicatively coupled to each other directly or via one or more wired or wireless communication frameworks. For example, in various embodiments, the provider system 100 may correspond to a provider system 101 that is configured in accordance with a cloud-based computing architecture, a server-client type architecture, etc. (examples of which are provided in conjunction with FIG. 1 ). Figure 7 1. The system 101 is a system that provides ML applications and associated services to one or more client systems 132 via any suitable wireless communication framework (eg, the Internet, etc.). However, the architecture of the system 101 may vary and is not limited to this configuration.

[0030] In this regard, embodiments of the systems and devices described herein (e.g., system 101, vendor system 100, client system 132, etc.) may include one or more machine-executable (i.e., computer-executable) components or instructions embodied in one or more machines (e.g., embodied in one or more computer-readable storage media associated with one or more machines). Such components, when executed by one or more machines (e.g., processors, computers, computing devices, virtual machines, etc.), may cause one or more machines to perform the described operations. These computer / machine-executable components or instructions may be stored in a memory (e.g., memory 124) associated with one or more machines. The memory may also be operably coupled to at least one processor (e.g., processing unit 126) such that the components may be executed by the at least one processor to perform the described operations. In some embodiments, the memory may include a non-transitory machine-readable medium that includes executable components or instructions that, when executed by a processor, facilitate performing the operations described for the corresponding executable components. Examples of the described and memory and processors and other suitable computer or computing-based elements may refer to Figure 6(e.g., processing unit 604 and system memory 606, respectively), and can be combined to achieve the combination Figure 1 Or one or more of the systems or components shown and described in other figures disclosed herein.

[0031] For example, the supplier system 100 may include (or be operatively coupled to) at least one memory 124 storing computer executable components and at least one processor (e.g., processing unit 126) executing the computer executable components stored in the at least one memory 124. These computer executable components may include (but are not limited to) an evaluation component 102, an extraction component 104, a selection component 106, a machine learning model 108, a reporting component 110, a collection component 112, and a training component 114. The memory 124 may also store data 116 corresponding to data that may be used and / or generated by the supplier system 101. In various embodiments, the data 116 may include, but is not limited to, one or more data sets 118, feature curve data 120, anonymization criteria 122, and runtime extraction criteria 122. In other embodiments, one or more of the computer executable components (e.g., evaluation component 102, extraction component 104, selection component 106, machine learning model 108, reporting component 110, collection component 112, and / or training component 114) and / or elements of data 116 (e.g., data set 118, feature curve data 120, anonymity criteria 122, and / or runtime extraction criteria 122) may be stored and / or executed via one or more other computing systems according to a distributed computing architecture. Various configurations are contemplated.

[0032] The vendor system 101 may also include one or more input / output devices 128 to facilitate receiving user input and presenting data to the user in association with performing various operations described with respect to the machine-executable components (e.g., determining data portion criteria, determining characteristic curve information (i.e., a transfer function that associates different candidate data portions of a data sample with respective probabilities of matching the different data candidate portions to respective data samples in the data sample from which they were extracted), selecting anonymity thresholds, training / refining one or more machine learning models 108, etc.). In this regard, any information received, generated, and / or accessible by the vendor system 101 may be presented or reproduced to the user via an appropriate output device such as a display, speaker, etc., in accordance with a data format. Reference Figure 6 Suitable examples of input / output devices 128 are depicted (eg, input device 628 and output device 636). Vendor system 101 may also include a system bus 130 that couples memory 124, processing unit 126, and input / output devices 128 to one another.

[0033] The one or more client systems 132 may similarly include (or be operatively coupled to) at least one memory storing computer executable components and at least one processor executing the computer executable components stored in the at least one memory, input / output devices, and reference devices. Figure 6 Other suitable computers or computing-based elements described herein may be used in conjunction with implementing the features and functions of one or more client systems 132 described herein. For the sake of brevity, these computers or computing-based elements (e.g., memory, processing units, input / output devices, etc.) are not shown for use in the following descriptions. Figure 1 One or more client systems 132 are shown. In various embodiments, one or more client systems 132 may include or be operatively coupled to runtime data 134 and computer executable components, including (but not limited to) a model execution component 136 and an extraction component 138.

[0034] Referring to the supplier system 101, in one or more embodiments, the evaluation component 102 can access and evaluate a data set 118 that includes a plurality of data samples, respectively, the plurality of data samples respectively including information (e.g., characteristic curve data 120) that uniquely represents a corresponding individual (e.g., a patient, a person, a company, etc.), and determine characteristic curve information of the corresponding data set 118, the characteristic curve information associating different data portions extracted from the data samples with corresponding probabilities of matching the different data portions to corresponding data samples in the data samples from which they were extracted. In this regard, each of the different data portions can include a different portion or subset of the unique characteristics of the individual. To this end, the corresponding probabilities correspond to the corresponding probabilities of being able to determine the identity of the corresponding individual (e.g., a patient, a person, a company, etc.) to which the different data portions are associated.

[0035] For example, in some embodiments applied to people, the information uniquely representing the corresponding entity may include unique physical features of the corresponding individual, such as the unique physical features of the corresponding individual depicted in the captured image (e.g., medical image and / or non-medical image) of the individual. When applied to medical images, the unique features are not limited to image features included in the image itself, but may additionally or alternatively include unique information associated with the medical image (e.g., as metadata, etc.), such as but not limited to, information describing acquisition parameters (e.g., including both physical and operator behavior), patient information (e.g., describing clinical and non-clinical attributes), findings about the clinical interpretation of the medical image (e.g., extracted from a radiology report, associated with the medical image as metadata, etc.), and measurement data describing or indicating the relative size and / or position of the depicted anatomical features. In another example applied to people, the unique features may include biometric features. In another example applied to people, the unique features may include features of the corresponding individual related to their physiological state, mental state, voice, gait, behavior, demographics (e.g., location, age, gender, occupation, etc.), medical history, web browsing activity, preferences, and any other type of information that may be collected about an individual that is subject to privacy concerns.

[0036] In this regard, the specific type of unique and / or privacy-constrained information included in the data set 118 evaluated by the evaluation component 102 may vary, as long as each data sample included in the same data set includes the same or similar type of content, where the difference between the data samples is based on the specific individual (e.g., person, patient, company) to which it belongs. The disclosed technology also assumes that the data samples included in the same data set represent different individuals (e.g., different people, different patients, different companies, etc.). For example, each data sample can represent a different individual. In other embodiments, some of the data samples may represent the same individual (e.g., different medical images taken from the same patient). An exemplary data set that meets these standards includes a set of medical images having the same capture modality and depicting the same anatomical region but captured from different patients. Another exemplary data set that meets these standards includes a data set having data samples representing different individuals, each of which includes the same set of parameters (e.g., physical parameters, physiological parameters, medical history parameters, behavioral parameters, etc.), and the values ​​of the parameters of each data sample vary based on the corresponding individuals they represent.

[0037] Figure 2 An exemplary characteristic curve graph 200 is shown associating different data portions with different recognition probabilities according to one or more embodiments of the disclosed subject matter. Figure 1 and Figure 2 ,like Figure 2As shown, the characteristic curve graph 200 plots different data portions 1-k extracted from the data set 118 evaluated by the evaluation component 102 relative to different recognition probabilities, which in this example range from 0% (e.g., corresponding to a recognition probability of 0%) to 100% (e.g., corresponding to a recognition probability of 100%). The different recognition probabilities correspond to the respective probabilities of matching the different data portions 1-k to the respective data samples in the data samples from which they were extracted. It should be understood that the characteristics of the characteristic curve graph 200 applied to the evaluation component 102 are shown in FIG. Figure 2 The probability scale in is merely exemplary, and various other scales may be used (eg, including any number of values ​​between 0 and 1, for example).

[0038] In this regard, the different data portions 1-k correspond to different portions of data extracted (e.g., via the extraction component 104) from the corresponding data samples included in the data set 118 being evaluated. The number of different data portions "k" evaluated can vary. The different data portions 1-k can be defined by different criteria that control the amount and type of data content included in the different data portions, which can vary according to the type and content of the corresponding data samples. For example, in some embodiments, when applied to medical images, the criteria for defining the different data portions can be different subsets of pixels corresponding to different amounts of pixels extracted from each of the medical images. For example, the different data portions 1-k can include a first subset size defined by a first number of pixels (e.g., corresponding to data portion 1), a second subset size defined by a second number of pixels greater than the first number (e.g., corresponding to data portion 2), a third subset size defined by a third number of pixels greater than the second number (e.g., corresponding to data portion 3), and so on. According to this example, the feature curve 202 plots the recognition probability determined for each subset size. For example, the recognition probability associated with data portion 1 corresponding to the lowest pixel subset size (i.e., the first pixel subset size) as shown in graph 200 is 10%. This means that, for any medical image included in the evaluated data set (and for any additional medical images corresponding to the medical image, such as new medical images of the same modality depicting the same anatomical region), when the extracted portion of the medical image is equal to the lowest pixel subset size, the recognition probability of the patient from which the medical image was captured is 10%.

[0039] In this regard, the information represented by the graph 200 corresponds to characteristic curve information (e.g., corresponding to characteristic curve data 120) that can be determined by the evaluation component 102 for the data set 118. For example, the characteristic curve data 120 can include characteristic curve information determined by the evaluation component for each data set 118 evaluated. The information can identify the specific data set and include parameters that define each of the different data portions 1-k, such as a specific amount of pixels that define each data portion according to the medical image example described above. The information also includes a corresponding recognition probability determined for each data portion.

[0040] Figure 3 A flow chart illustrating an exemplary process 300 for determining characteristic curve information (eg, corresponding to the characteristic curve information represented by exemplary characteristic curve 202) that associates different data portions with recognition probabilities in accordance with one or more embodiments of the disclosed subject matter. Figures 1 to 3 , process 300 is shown in association with evaluating data samples 302 that form data set 118. The total number of data samples 302 is represented as N, which can vary. As described above, data set 118 can include substantially any data set that includes multiple data samples 302 that each include unique information (e.g., personal information, patient information, etc.) for different individuals (e.g., patients, people, companies, etc.) and associated with privacy constraints, wherein each of the data samples 302 includes the same type and amount of content, but corresponds to different individuals (e.g., medical images with the same modality and depicting the same anatomical region captured for different patients, text data samples that each include the same physiological input parameters for different patients, etc.).

[0041] According to the process 300, at 304, the evaluation component 102 may define different data portions (i.e., data portions 1-k) of the data sample 302 to be extracted. For example, to facilitate the above example in which the data sample includes a medical image and the different data portions correspond to different pixel subset sizes, at 304, the evaluation component 102 may define different pixel subset sizes. In some embodiments, specific criteria for defining different data portions of the data set being evaluated may be predefined (and stored in the memory 124, etc.). In other embodiments, specific criteria for defining different data portions may be provided via user input. In other embodiments, specific criteria for defining different data portions may be determined by the evaluation component 102 based on an analysis of the type and content of the data sample 302, the purpose for which the data sample and / or the extracted portion will be used, and various other factors. The following describes in more detail the techniques for determining and / or defining the criteria for defining different data portions. As an example, the process 300 is described as being applied to a data sample including a medical image, wherein the criteria for defining different data portions 1-k are different pixel amounts.

[0042] At 306, for each of the different data portions 1-k, the extraction component 104 may extract a data portion from each of the data samples 302. For example, when applied to the data samples 302 as medical images and the different data portions 1-k as different pixel subset sizes, at 406, for the data portion 1 of the graph 200 corresponding to the first pixel subset size, the extraction component 104 may extract a pixel subset of the first pixel subset size from each of the medical images. This results in a first set of extracted image portions, each having the first pixel subset size. In some embodiments, depending on the number N of data samples 302, the extraction component 104 may evaluate a representative subset of data samples including a reduced number of data samples, thereby reducing computational processing time. By these embodiments, the data samples included in the representative subset may be randomly selected. In some embodiments, the extracted data portions may be stored in the memory 124 (e.g., together with their corresponding data sets 118) along with the corresponding criteria defining each data portion and the corresponding data samples from which they were extracted.

[0043] At 308, the evaluation component 102 may determine the number M of data samples 302 that can be matched to the corresponding extracted portion of the data sample (or vice versa). To facilitate this purpose, the evaluation component 102 may employ one or more suitable matching algorithms modulated for the type of data sample. For example, when applied to images, in some embodiments, the evaluation component 102 may use standard image similarity metrics (such as structural similarity index (SSIM), entropy metrics, mean square error (MSE) metrics, mean absolute error (MAE), etc.) to determine whether the extracted image portions can be matched to the corresponding images in the image from which they are extracted. Through these embodiments, the evaluation component 102 may compare the extracted image portion with the original image from which the extracted image portion is extracted, and calculate a similarity metric (e.g., SSIM metric, MSE metric, etc.) representing the level of similarity between the extracted image portion (Ii) and the original image (Iq). The evaluation component 102 may also apply a predefined threshold similarity metric to determine whether the calculated similarity metric is associated with a match. For example, the evaluation component 102 can apply a binary match value (m) of 1 to the image portion / original image pair when the extracted image portion (Ii) and the original image (Iq) are considered to match / similar (e.g., as a function of a similarity metric relative to a threshold), and apply a binary match value (m) of 0 to the image portion / original image pair when the extracted image portion (Ii) and the original image (Iq) are considered to not match.

[0044] The evaluation component 102 may similarly compare the extracted data portions with corresponding data samples from which they were extracted when applied to data samples including non-image data (e.g., text data, signal data, etc.), which respectively include sets of parameters corresponding to unique characteristics (e.g., physiological characteristics, physical characteristics, health record parameters, demographic parameters, etc.) of individuals (e.g., patients, people, businesses, etc.). For example, the non-image parameters of such data samples may be evaluated as an array or sequence of values ​​in a particular order, such as a sequence corresponding to {age, BMI, height, weight, gender, race, region, etc.}. There are several mathematical ways to determine the similarity between two such sequences of values ​​(e.g., one value corresponding to the original sequence and the other value corresponding to the extracted portion of the original sequence), such as using vector norms, such as the sum of squares, the absolute sum, the maximum difference, etc. Similarly, image data may be considered as specific information data, where the sequence is related to the location of pixels.

[0045] At 310, the evaluation component 102 may determine the recognition probability of the data portion based on the number M divided by the total number of data samples N (or the number of representative subsets Ns, if applicable). For example, in some embodiments, the evaluation component 102 may determine the recognition probability of each data portion evaluated according to the following recognition probability formula:

[0046]

[0047] Identify the probability formula.

[0048] According to the recognition probability formula, C(p) is the recognition probability determined for a specific data part p among different data parts, Np is the total number of data samples evaluated for a given data part (for example, it can correspond to all data samples N or a representative subset of data samples), and M(Ii, Iq) represents the amount of matching the data part to the corresponding data sample pair (Ii, Iq).

[0049] The evaluation component 102 and the extraction component 104 may also repeat steps 306, 308, and 310 for each of the different data portions 1-k to determine the corresponding recognition probability for each of the different data portions 1-k. At 312, the evaluation component 102 may generate characteristic curve information that associates the corresponding recognition probability determined for each of the different data portions 1-k with the corresponding data portion. In this regard, the evaluation component 102 may aggregate and index the corresponding recognition probabilities determined for each of the different data portions 1-k generated according to steps 306, 308, and 310. In some embodiments, at 312, the evaluation component 102 may generate a characteristic curve graph corresponding to the graph 200, which provides a visual representation of the characteristic curve information determined for the data set being evaluated. The characteristic curve graph may be included in the corresponding characteristic curve information (e.g., characteristic curve data 120) for the corresponding data set.

[0050] Given that Figure 2 and Figure 3 refer to Figure 1 In various embodiments, the data set 118 evaluated by the evaluation component 102 may include or correspond to a training data set associated with one or more machine learning (ML) models 108, respectively. For example, the training data set may include a corresponding training data set including training data samples that are used to train a corresponding ML model in the ML models 108 and / or can be used to train the corresponding ML model. In this regard, the training data samples may correspond to input data samples that are processed by the corresponding ML models to generate specific inference outputs, such as inference outputs regarding an evaluation of a medical condition reflected in a medical image, as applied to an example in which the training data samples include a medical image.

[0051] The specific inference tasks of the machine learning model 108 and the types of training data samples included in the corresponding training data set can vary. For example, when applied to the medical field, the machine learning model 108 may include one or more models suitable for performing the following: disease / condition classification, disease region segmentation, organ segmentation, disease quantification, disease / condition staging, risk prediction, time analysis, abnormality detection, anatomical feature characterization, medical image reconstruction, etc. related to the inference task. Through these embodiments, the corresponding training data set processed (e.g., as input) by the corresponding machine learning model 108 may include data samples, which respectively include unique features of the corresponding patients, such as but not limited to physical features (e.g., physical / anatomical features, physiological features), behavioral features, mental health features, demographic features (e.g., age, location, gender, race), etc. For example, the data samples may include substantially any type of relevant information associated with the patient that may be subject to privacy concerns, such as but not limited to: medical imaging data, laboratory data, medical history information (e.g., electronic health record information), drug data, clinical report data (e.g., radiology reports, laboratory reports, clinical assessment reports, etc.), clinician record data, appointment scheduling data, treatment plan / pathway data, etc.

[0052] In various exemplary implementations of these embodiments, the input data processed by the ML model 108 in the medical field includes medical image data (i.e., one or more machine learning models 108 may include or correspond to a medical image inference model). With these implementations, the corresponding training data set processed by the corresponding ML model 108 may include medical images. In some implementations, each data sample may correspond to a single medical image. In other implementations, each data sample may correspond to a set of medical images captured from the same patient, such as a set of images acquired during a single imaging study (e.g., a set of XR, a series of CT or MRI images, etc.).

[0053] However, the disclosed technology is not limited to medical images (or non-medical images applied to non-medical fields). In this regard, in other embodiments, the corresponding training data samples included in the training data set evaluated by the evaluation component 102 (e.g., data set 118) can additionally or alternatively include text data, signal data, audio data, and other data format types including unique characteristics of the corresponding patient (e.g., physical / anatomical characteristics, physiological, behavioral characteristics, mental health characteristics, demographic characteristics, medical history characteristics, etc.).

[0054] According to some embodiments in which the data set 118 includes a training data set associated with the ML model 108, the characteristic curve data 120 determined by the evaluation component 102 for the corresponding training data set can be used to determine target data portions of different data portions that meet a desired or preferred anonymity criterion (i.e., a threshold identification probability). For example, using the process 300, the evaluation component 102 and the extraction component 104 can determine the characteristic curve data 120 for the training data set associated with the ML model 108 (e.g., a training data set used or available for training the ML model 108). With these embodiments, the characteristic curve information associates different data portions extracted from the training data samples with respective probabilities of matching the different data portions to respective data samples in the data samples from which they were extracted, wherein the respective probabilities correspond to respective identification probabilities capable of determining the identity of the corresponding individual (e.g., patient, person, company, etc.) associated with the different data portions.

[0055] To this end, the target data portion may correspond to a specific data portion among the different data portions, which may be extracted from the corresponding training data sample and / or an additional data sample corresponding to the training data sample and shared with an external entity (e.g., one or more client systems 132 or another suitable entity) while ensuring that the identification probability of the corresponding individual represented in the extracted data portion meets a required or preferred threshold probability. The required or preferred threshold probability is referred to herein as the "anonymity standard" for the particular data set. The anonymity standard (i.e., threshold probability) may be imposed by a regulatory body or required by legal and compliance functions.

[0056] In various embodiments, the target data portion determined for a particular training data set may be applied to collect portions of new data samples corresponding to training data samples based on the new data portion meeting the criteria defining the target data portion (e.g., having a particular pixel subset size, etc.). For example, in some embodiments, when applied to a training data set used to train the ML model 108, the new data samples may include runtime data samples (e.g., included in runtime data 134) processed by an external system (such as one or more client systems 132) through a trained version of the ML model. Through these embodiments, portions of new data samples collected from a deployment environment may be used to retrain and update the ML model 108 after deployment. In this regard, the new data samples may include data samples provided by various different systems and / or entities that may not be authorized or willing to share their data samples with other systems (e.g., vendor system 101, other machine learning systems, etc.) due to privacy concerns related to the content of the data samples (e.g., patient information, etc.). Such privacy concerns are a significant barrier to sharing patient data. However, by collecting only a portion of the corresponding data sample that is determined to be guaranteed to meet anonymity criteria accepted by the corresponding system (e.g., which may vary for different systems and be tailored to the preferences of such systems), such privacy concerns are substantially eliminated. As a result, sharing of data between different systems for continuous ML refinement and other ML applications will not be hindered by privacy concerns, which provides substantial benefits for ML models and other ML applications in the medical field.

[0057] In some embodiments, once the evaluation component 102 has determined the characteristic curve data for a particular training data set used to train the ML model 108, the reporting component 110 can provide the characteristic curve data to any external system (e.g., one or more client systems 132, etc.) that uses the trained version of the ML model to process its corresponding data samples and generate corresponding inference outputs. With these embodiments, the external system can examine the characteristic curve data and select a target data portion from among the different data portions based on the probability of the target data portion being associated with the corresponding recognition probability that satisfies an anonymity criterion desired or required by the external system.

[0058] Additionally or alternatively, once the evaluation component 102 has determined the feature curve data for a particular training data set used to train the ML model 108, the selection component 106 can select a target data portion from among the different data portions based on associating the target data portion with a probability of satisfying an anonymity criterion applicable to the training data set (e.g., as predefined and provided in the anonymity criteria 122, provided via user input, etc.). As described above, the anonymity criterion can correspond to a threshold probability representing a desired or required (low) probability that a target data portion extracted from any data sample corresponding to the training data sample can be matched to the original data sample from which the target data portion was extracted, the threshold probability corresponding to a probability that the identity of an individual can be determined from the target data portion in a scenario where the identity of the individual can be linked to the original image.

[0059] In some implementations of these embodiments, the collection component 112 may control the collection of new data portions extracted from new data samples corresponding to the training data samples based on the new data portions meeting criteria defining the target data portions. For example, in some embodiments, the collection component 112 (or the reporting component 110) may provide runtime extraction control data 140 to a client system (e.g., one or more client systems 132), the runtime extraction control data defining criteria (e.g., a particular pixel subset size, etc.) for a target data portion determined for a particular input data set applicable for processing by a training version of the ML model. To this end, the applicable data set includes a data set that includes data samples corresponding to the training data samples of the training data set. For example, when applied to a training data set including medical images, the applicable data set includes medical images having the same parameters as the training data set (e.g., the same capture modality and anatomical region depicted, etc.). The runtime extraction control data 140 may also include information defining the parameters of the applicable data set.

[0060] In some implementations, the runtime extraction control data 140 may further direct (e.g., request) the client system 132 to extract and provide (e.g., to the vendor system 101) data portions that meet the criteria defining the target data portions from the corresponding data samples included in the runtime data 134 corresponding to the applicable data set. These extracted data portions are represented in the system 100 as extracted target data portions of the runtime data 142. By these embodiments, based on receipt of the runtime extraction control data 140, the client system 132 may be configured to apply the criteria defining the target data portions to extract (e.g., via the extraction component 138) the extracted target data portions of the runtime data 142 and provide them to the vendor system 101. In some implementations, the training component 114 may further employ the extracted target portions of the runtime data 142 to retrain (e.g., update, refine, and improve) the ML model 108, thereby obtaining an optimized version of the ML model 108.

[0061] The techniques for controlling the extraction and provision of the extracted target data portion 142 from the runtime data samples associated with one or more client systems 132 may vary and are not limited to the above techniques. For example, in some embodiments, one or more client systems 132 may include a model execution component 136 that controls the application and execution of a trained version of the ML model 108 to a corresponding data sample provided in the runtime data 134. The trained version of the ML model may be stored at the vendor system 101 and accessed as software as a service (Saas), or stored locally at the one or more client systems 132 and executed locally. In any of these embodiments, the model execution component 136 may be configured to extract the target data portion from the runtime data sample according to the runtime extraction control data 140 and provide the extracted target data portion of the runtime data 142 back to the vendor system 101. In other embodiments, the extraction component 138 and / or the extraction component 104 may include or correspond to a configurable plug-in software application controlled and / or executed by the vendor system 101. With these embodiments, extraction component 138 and / or extraction component 104 may be configured to extract target data portions from runtime data samples according to runtime extraction control data 140, and provide the extracted target data portions of runtime data 142 back to vendor system 101. Still in other embodiments, a trained version of ML model 108 may be configured to extract target data portions from runtime data samples according to runtime extraction control data 140, and provide the extracted data portions of runtime data 142 back to vendor system 101. Various control strategies are contemplated.

[0062] As described above, different data parts (corresponding to Figure 2The criteria or parameters for defining the different data portions (data portions 1-k) control the amount and content of the data portions. For example, when applied to images, the criteria may include pixel quantity, where different data portions are defined by different pixel quantities extracted from the respective images. To this end, the extracted data portions from each image correspond to crops of the image that include different pixel quantities, respectively. In various embodiments, when applied to images, in addition to pixel quantity, the criteria defining the different data portions may also control the location or area of ​​the image from which the subset of pixels is extracted and the geometry of the cropped portion. To this end, the content of the cropped portion of the image that is only constrained by pixel quantity will vary depending on the location or area of ​​the image from which the cropped portion is obtained and the geometry of the cropped portion. Since the disclosed technology is directed to extracting portions of a data sample of a data set 118 for the purpose of using the extracted portions for ML model training and other applications, the criteria for defining the different data portions should consider specific portions of the data sample that include the most relevant content for the purpose of use (e.g., ML model training or another application). For example, when applied to a training dataset for training a medical image inference model, where the data samples include medical images and where the extracted target data portion of the medical images (e.g., corresponding to the extracted target portion of the runtime data 142) will be used to retrain / update the model (e.g., via the training component 114), the extracted target data portion should include the portion of the medical image that is most relevant to the task of the medical image inference model (e.g., disease / condition classification, disease region segmentation, organ segmentation, disease quantification, disease / condition staging, risk prediction, temporal analysis, anomaly detection, anatomical feature characterization, medical image reconstruction, etc.).

[0063] In this regard, in various embodiments, the evaluation component 102 may define criteria for different portions based on target content information that identifies or indicates a specific portion of a data sample that includes the most relevant content for a specific purpose of use (e.g., ML model training or another application). In some embodiments, the target content information may be predefined and associated with the dataset 118 and / or the ML model 108, which is associated with the dataset in embodiments in which the dataset is used or will be used to train the ML model. In other embodiments, the target content information may be provided to the evaluation component 102 via user input (e.g., a user may request a target portion of a dataset and define or indicate target content information associated with the request). For example, when applied to medical images, the user input may include labeling data applied to one or more sample medical images representing the dataset. The labeling data may include a graphical mark (e.g., a bounding box, a caliper, etc.) that indicates one or more relevant anatomical regions of the medical image to be included in the target data portion.

[0064] In other embodiments, the evaluation component 102 may use artificial intelligence (AI) to predict target content information and / or define criteria for different data portions. For example, in some embodiments, the evaluation component 102 may predict target content information and / or define corresponding criteria for different data portions based on analysis of information describing a specific purpose of use of the target data portion (e.g., ML model updates and specific inference tasks of the model). In this regard, the evaluation component 102 may infer the most relevant portions of the data sample to be extracted and define criteria for different data portions accordingly.

[0065] In many embodiments, the most relevant portion of a medical image to a medical image inference task will be based on one or more defined target anatomical features of interest (e.g., organs, lesions, bones, soft tissue, etc.) depicted in the medical image. However, it should be understood that the most relevant portion of an input medical image to a medical image inference model may vary depending on the task. In some embodiments, when applied to a dataset of medical images, the evaluation component 102 may define criteria for different image portions based on target content information defining one or more target anatomical features depicted in the medical image.

[0066] For example, in some embodiments, the evaluation component 102 may determine (root) the extraction position of different data portions relative to one or more target anatomical features. The evaluation component 102 may further constrain different data portions to include different amounts of pixels extracted relative to the extraction position. For example, the extraction position may correspond to a center point, and different data portions may include different cropped portions of an image of different sizes (e.g., amount of pixels) relative to the same center point. In another example, the extraction position may be defined relative to two or more anatomical features depicted in a medical image. For example, the extraction position may include an area of ​​the medical image positioned between two or more anatomical features of interest. In another example, the extraction position may include two or more different areas of the medical image (e.g., a first sub-area relative to a first anatomical feature, a second sub-area relative to a second anatomical feature, etc.). The evaluation component 102 may also define different data portions to be constrained by a specific geometry (e.g., a rectangular geometry, a rectangular geometry of a specific aspect ratio, a circular geometry, a three-dimensional geometry such as applied to a three-dimensional image, etc.). In some embodiments, the specific geometry may be based on and / or correspond to the geometry of the target anatomical feature (e.g., the geometry / contour of a specific organ, etc.).

[0067] In some embodiments, the evaluation component 102 can also evaluate the data set 118 according to different criteria defining different data portions and generate separate characteristic curve information for each of the different criteria. For example, the evaluation component 102 can generate first characteristic curve information for the medical image data set that evaluates a first different data portion as defined relative to a first anatomical feature, and generate second characteristic curve information that evaluates a second different data portion relative to a second anatomical feature.

[0068] In addition, although exemplary embodiments of the disclosed technology are described with respect to patient data and using extracted portions of the patient data to ensure the anonymity of the patient, the disclosed technology can be extended to other fields and data sets involving privacy concerns. For example, the disclosed technology can be applied to any type of data set including data samples that respectively include unique characteristics of entities (such as people, companies, organizations, etc.) that are subject to privacy concerns. The unique characteristics may include any type of information that can uniquely identify the corresponding entity, such as but not limited to physical characteristics, physiological characteristics, behavioral characteristics, unique identifiers (e.g., name, account number, device identifier, phone number, etc.), unique demographic information (e.g., location / address, age, gender, etc.), business records, transaction records, etc. In this regard, the criteria for defining the different data portions on which different subsets are based and / or the most relevant content of the different data portions can vary and be customized for different usage scenarios.

[0069] In addition, the data set evaluated by the evaluation component 102 is not limited to the training data set bound to the machine learning model. In this regard, the data set evaluated by the evaluation component 102 may include data sets that can be used for various applications other than machine learning applications (e.g., research applications, statistical analysis applications, information tracking applications, etc.). For example, the characteristic curve information determined by the evaluation component 102 for any data set can be used to determine the target data portion of the corresponding data sample included in the data set that meets the anonymity standard (i.e., the standard that defines the amount and / or content of the target data portion), and the anonymity standard is an acceptable low probability of identification of the corresponding individual represented in the target data portion extracted from the corresponding data sample. To this end, in some embodiments, the supplier system 101 can be applied to control and regulate the sharing of data sets between entities by extracting and sharing only the portions of the data set that meet the required or preferred anonymity standards. For example, in some embodiments, the extraction component 104 can extract a portion of the corresponding data sample included in the evaluation data set associated with the first entity, wherein the extracted portion corresponds to the target portion (e.g., according to the standard that defines the amount and / or content of the target data portion). The extraction component 104 can also aggregate the extracted portions into a new data set that can be provided (e.g., transmitted, sent, accessible via a network, etc.) by the supplier system 101 to one or more second entities for use (e.g., according to a defined protocol for use), wherein the new data set meets the required or preferred anonymity criteria. In addition, as discussed in more detail below, the data-driven techniques employed by the evaluation component 102 for determining the respective probabilities of identifying the corresponding individuals represented in the extracted data portions do not utilize the actual unique identifiers for the corresponding individuals (e.g., individual names, individual identification numbers, etc.). To this end, the supplier system 101 can process data sets that have been anonymized, thereby enhancing protection of private or sensitive information.

[0070] Figure 4A block diagram of an exemplary non-limiting computer-implemented method 400 is shown that facilitates maintaining individual privacy in association with obtaining data subject to privacy concerns in accordance with one or more embodiments of the disclosed subject matter. The method 400 includes accessing, at 402, by a system (e.g., system 100, vendor system 101, etc.) comprising a processor, a data set (e.g., of data set 118), the data set comprising data samples that respectively comprise unique characteristics of an individual. At 404, the method 400 includes determining, by the system (e.g., via evaluation component 102 and extraction component 104), characteristic curve information that associates different data portions extracted from the data sample with respective probabilities of matching the different data portions to respective data samples in the data sample from which the different data portions were extracted, wherein the different data portions respectively comprise different portions of the unique characteristic. At 406, method 400 also includes controlling, by the system (e.g., via collection component 112 or via another suitable control mechanism disclosed herein), collection of new data portions extracted from the new data sample corresponding to the data sample based on the new data portions meeting criteria defining a target data portion of different data, wherein the criteria include a probability in a corresponding probability of satisfying anonymity criteria. It should be appreciated that the criteria defining the target data portion may also define specific parameters of the target data portion, such as, but not limited to, an amount of pixels, one or more extraction locations of an image, a specific subset of data parameters, and the like.

[0071] Figure 5A block diagram of another exemplary non-limiting computer-implemented method 500 is shown that facilitates maintaining individual privacy associated with obtaining patient data for ML applications in accordance with one or more embodiments of the disclosed subject matter. The method 500 includes accessing, at 502, by a system (e.g., system 100, vendor system 101, etc.) including a processor, a training data set (e.g., of data set 118), the training data set including data samples that respectively include physical characteristics of individuals (e.g., physical / anatomical characteristics of a patient, etc.). At 504, the method 500 includes determining, by the system (e.g., via evaluation component 102 and extraction component 104), characteristic curve information that associates different data portions extracted from the data samples with respective probabilities of matching the different data portions to respective data samples in the data samples from which the different data portions were extracted, wherein the different data portions respectively include different portions of the physical characteristics. At 506, method 500 includes selecting, by the system (e.g., via selection component 106), a target data portion from among the different data portions based on the target data portion being associated with a probability of satisfying an anonymity criterion (e.g., an acceptably low identification probability threshold) in the corresponding probabilities. At 508, method 500 further includes controlling, by the system (e.g., via collection component 112 or via another suitable control mechanism disclosed herein), based on the selection, collection of new data portions extracted from a new data sample corresponding to the data sample based on the new data portions meeting the criteria defining the target data portions.

[0072] Exemplary Operating Environment

[0073] One or more embodiments may be systems, methods and / or computer program products at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0074] A computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes the following items: a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device (such as a punch card or a raised structure in a groove on which instructions are recorded) and any suitable combination of the foregoing items. As used herein, a computer readable storage medium should not be understood to be a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0075] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network, and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing / processing device.

[0076] The computer-readable program instructions for implementing the operation of the present invention can be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuit systems, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming language or similar programming languages). Computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network (including local area network (LAN) or wide area network (WAN)), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In some embodiments, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform aspects of the present invention.

[0077] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It is understood that each frame of the flowchart illustration and / or block diagram and the combination of frames in the flowchart illustration and / or block diagram can be implemented by computer-readable program instructions.

[0078] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flow chart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to function in a particular manner, so that the computer-readable storage medium with instructions stored therein includes a product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flow chart and / or block diagram.

[0079] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, such that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0080] The flow chart and block diagram in the accompanying drawings illustrate the architecture, function and operation of the possible implementation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each frame in the flow chart or block diagram can represent a module, a fragment or a part of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the function indicated in the frame may not occur in the order indicated in the figure. For example, depending on the function involved, two frames of continuous display can actually be performed substantially simultaneously, or the frames can be performed in reverse order sometimes. It will also be noted that each frame of the block diagram and / or flow chart illustration and the combination of the frames in the block diagram and / or flow chart illustration can be implemented by a system based on dedicated hardware that performs a specified function or action or implements a combination of dedicated hardware and computer instructions.

[0081] Combination Figure 6 , the systems and processes described below may be embodied in hardware, such as a single integrated circuit (IC) chip, multiple ICs, application specific integrated circuits (ASICs), etc. In addition, the order in which some or all of the program blocks appear in each program should not be considered limiting. On the contrary, it should be understood that some program blocks can be executed in various orders, not all of which can be explicitly shown in this document.

[0082] refer to Figure 6 , an illustrative example environment 600 for implementing various aspects of the claimed subject matter includes a computer 602. The computer 602 includes a processing unit 604, a system memory 606, a codec 635, and a system bus 608. The system bus 608 couples system components including, but not limited to, the system memory 606 to the processing unit 604. The processing unit 604 can be any of a variety of available processors. Dual microprocessors and other multi-processor architectures can also be used as the processing unit 604.

[0083] The system bus 608 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus or external bus, or a native bus using any of a variety of available bus architectures including, but not limited to, Industry Standard Architecture (ISA), Micro Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Native Bus (VLB), Peripheral Component Interconnect (PCI), card bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), Personal Computer Memory Card International Association (PCMCIA), FireWire (IEEE 1364), and Small Computer System Interface (SCSI).

[0084] In various embodiments, the system memory 606 includes a volatile memory 610 and a non-volatile memory 612, which may adopt one or more memory architectures in the disclosed memory architecture. A basic input / output system (BIOS) (including basic routines such as transferring information between elements within the computer 602 during startup) is stored in the non-volatile memory 612. In addition, according to the present invention, the codec 635 may include at least one of an encoder or a decoder, wherein at least one of the encoder or the decoder may be composed of hardware, software, or a combination of hardware and software. Although the codec 635 is depicted as a separate component, the codec 635 may be included in the non-volatile memory 612. By way of illustration and not limitation, the non-volatile memory 612 may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, a 3D flash memory, or a resistive memory, such as a resistive random access memory (RRAM). In at least some embodiments, the non-volatile memory 612 may adopt one or more memory devices in the disclosed memory devices. In addition, non-volatile memory 612 can be computer memory (e.g., physically integrated with computer 602 or its motherboard) or removable memory. Examples of suitable removable memory that can be used to implement the disclosed embodiments can include secure digital (SD) cards, compact flash (CF) cards, universal serial bus (USB) memory sticks, etc. Volatile memory 610 includes random access memory (RAM) that acts as external cache memory, and one or more disclosed memory devices can also be used in various embodiments. By way of illustration and not limitation, RAM can be provided in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), and enhanced SDRAM (ESDRAM), etc.

[0085] Computer 602 may also include removable / non-removable, volatile / non-volatile computer storage media. Figure 6For example, a disk storage device 614 is shown. The disk storage device 614 includes, but is not limited to, devices such as disk drives, solid-state disks (SSDs), flash memory cards, or memory sticks. In addition, the disk storage device 614 may include a separate storage medium or a storage medium combined with other storage media, including but not limited to an optical drive, such as a CD-ROM device (CD-ROM), a CD recordable drive (CD-R drive), a CD rewritable drive (CD-RW drive), or a digital universal magneto-optical disk ROM drive (DVD-ROM). In order to facilitate the connection of the disk storage device 614 to the system bus 608, a removable or non-removable interface, such as an interface 616, is generally used. It should be understood that the disk storage device 614 can store information related to the user. Such information can be stored at a server or provided to an application running on a server or user device. In one embodiment, the user can be notified (for example, by an output device 636) of the type of information stored in the disk storage device 614 or transmitted to a server or application. The user can be provided with the opportunity to select to join or opt out of collecting or sharing such information through a server or application (for example, by input from an input device 628).

[0086] It should be understood that Figure 6 Software is described that acts as an intermediary between a user and the basic computer resources described in the appropriate operating environment 600. Such software includes an operating system 610. The operating system 610, which may be stored on a disk storage device 614, is used to control and allocate the resources of the computer 602. Application programs 620 utilize the management of resources by the operating system 610 through program modules 624, and program data 626 stored in the system memory 606 or on the disk storage device 614, such as a startup / shutdown transaction table. It should be appreciated that the claimed subject matter may be implemented with various operating systems or combinations of operating systems.

[0087] The user enters commands or information into the computer 602 through input devices 628. Input devices 628 include, but are not limited to, pointing devices such as mice, trackballs, styluses, touchpads, keyboards, microphones, joysticks, gamepads, satellite dishes, scanners, TV tuner cards, digital cameras, digital video cameras, webcams, and the like. These and other input devices are connected to the processing unit 604 through the system bus 608 via interface ports 630. Interface ports 630 include, for example, serial ports, parallel ports, game ports, and universal serial buses (USB). Output devices 636 use some of the same types of ports as input devices 628. Thus, for example, a USB port can be used to provide input to the computer 602 and output information from the computer 602 to output devices 636. Output adapters 634 are provided to illustrate that there are some output devices 636 such as monitors, speakers, and printers, as well as other output devices 636 that require special adapters. By way of illustration and not limitation, output adapters 634 include video cards and sound cards that provide a means of connection between output devices 636 and the system bus 608. It should be noted that other devices or systems of devices provide input and output capabilities, such as remote computer 638 .

[0088] The computer 602 can work in a networked environment using a logical connection to one or more remote computers, such as a remote computer 638. The remote computer 638 can be a personal computer, a server, a router, a network PC, a workstation, a microprocessor-based device, a peer device, a smart phone, a tablet computer, or other network node, and typically includes many of the elements described relative to the computer 602. For the purpose of simplicity, only a memory storage device 640 is shown for the remote computer 638. The remote computer 638 is logically connected to the computer 602 through a network interface 642, and then connected via a communication connection 644. The network interface 642 covers a wired communication network or a wireless communication network, such as a local area network (LAN) and a wide area network (WAN) and a cellular network. LAN technologies include fiber distributed data interface (FDDI), copper distributed data interface (CDDI), Ethernet, token ring, etc. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks such as integrated services digital networks (ISDN) and variations thereon, packet switching networks, and digital subscriber lines (DSL).

[0089] The communication connection 644 refers to the hardware / software used to connect the network interface 642 to the bus 608. Although the communication connection 644 is shown internal to the computer 602 for clarity of illustration, the communication connection can also be external to the computer 602. For exemplary purposes only, the hardware / software required to connect to the network interface 642 includes internal technology and external technology, such as modems, including conventional telephone grade modems, cable modems and DSL modems, ISDN adapters, as well as wired and wireless Ethernet cards, hubs and routers.

[0090] Figure 7 700 is a schematic block diagram of a sample computing environment 700 with which the subject matter of the present disclosure can interact. System 700 includes one or more clients 702. Client 702 (e.g., corresponding to client system 700 in some embodiments) can be hardware and / or software (e.g., threads, processes, computing devices). System 700 also includes one or more servers 704 (e.g., corresponding to supplier system 600 in some embodiments). Therefore, in addition to other models, system 700 can correspond to a two-tier client server model or a multi-tier model (e.g., client, middle-tier server, data server). Server 704 can also be hardware and / or software (e.g., threads, processes, computing devices). For example, server 704 can accommodate threads to perform conversions by adopting the present disclosure. A possible communication between client 702 and server 704 can be in the form of data packets transmitted between two or more computer processes (e.g., including feedback information 132).

[0091] The system 700 includes a communication framework 706 that can be used to facilitate communication between the client 702 and the server 704. The client 702 is operatively connected to one or more client data repositories 708, which can be used to store information local to the client 702. Similarly, the server 704 is operatively connected to one or more server data repositories 712, which can be used to store information local to the server 704.

[0092] It should be noted that various aspects or features of the present disclosure can be utilized in substantially any wireless telecommunication or radio technology, for example, Wi-Fi; Bluetooth; Worldwide Interoperability for Microwave Access (WiMAX); Enhanced General Packet Radio Service (Enhanced GPRS); 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE); 3rd Generation Partnership Project 2 (3GPP2) Ultra Mobile Broadband (UMB); 3GPP Universal Mobile Telecommunications System (UMTS); High Speed ​​Packet Access (HSPA); High Speed ​​Downlink Packet Access (HSDPA); High Speed ​​Uplink Packet Access (HSUPA); GSM (Global System for Mobile Communications) EDGE (Enhanced Data Rates for GSM Evolution) Radio Access Network (GERAN); UMTS Terrestrial Radio Access Network (UTRAN); LTE Advanced (LTE-A); etc. In addition, some or all aspects described herein can be utilized in traditional telecommunication technologies (e.g., GSM). In addition, mobile as well as non-mobile networks (e.g., the Internet, data service networks such as Internet Protocol Television (IPTV), etc.) can utilize aspects or features described herein.

[0093] Although the subject matter has been described above in the general context of computer executable instructions of a computer program running on one and / or multiple computers, it will be appreciated by those skilled in the art that the present disclosure may also or may be implemented in combination with other program modules. In general, program modules include routines, programs, components, data structures, etc. that perform specific tasks and / or implement specific abstract data types. In addition, it will be appreciated by those skilled in the art that the method of the present invention may be practiced with other computer system configurations, including single-processor or multi-processor computer systems, small computing devices, large computers, and personal computers, handheld computing devices (e.g., PDAs, phones), microprocessor-based or programmable consumer or industrial electronics, etc. The illustrated aspects may also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices linked by a communication network. However, some (if not all) aspects of the present disclosure may be practiced on stand-alone computers. In a distributed computing environment, program modules may be located in local and remote memory storage devices.

[0094] As used in this application, the terms "component", "system", "platform", "interface", etc. may refer to and / or may include computer-related entities or entities associated with an operating machine having one or more specific functionalities. The entities disclosed herein may be hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or a computer. By way of illustration, both an application running on a server and a server may be a component. One or more components may reside within a process and / or a thread of execution, and a component may be located on one computer and / or distributed between two or more computers.

[0095] As another example, the corresponding components can be executed according to various computer-readable media having various data structures stored thereon. The components can communicate via local and / or remote processes, such as according to signals having one or more data packets (e.g., data from a component that interacts with another component in a local system, a distributed system, and / or interacts with other systems across a network (such as the Internet) via a signal). As another example, a component can be a device having a specific function provided by a mechanical part operated by an electrical or electronic circuit system, which is operated by a software or firmware application executed by a processor. In such cases, the processor can be inside or outside the device and can execute at least a portion of the software or firmware application. As another example, a component can be a device that provides specific functionality through electronic components rather than mechanical parts, wherein the electronic components may include a processor or other devices for executing software or firmware that at least partially imparts functionality to the electronic components. On the one hand, the component can simulate the electronic component via a virtual machine, for example, in a cloud computing system.

[0096] In addition, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or". That is, unless specified otherwise or clear from the context, "X employs A or B" is intended to mean any of the natural inclusive permutations. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied in any of the foregoing cases. Furthermore, the articles "a" and "an" used in the specification and the drawings should generally be construed to mean "one or more" unless specified otherwise or clear from the context to be directed to the singular.

[0097] As used herein, the terms "example" and / or "exemplary" are used to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited to such examples. In addition, any aspect or design described herein as "example" and / or "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it intended to exclude equivalent exemplary structures and techniques known to those of ordinary skill in the art.

[0098] Standard programming or engineering techniques can be used to implement various aspects or features described herein as methods, devices, systems, or products. In addition, various aspects or features disclosed in the present disclosure can be implemented by implementing at least one or more of the program modules disclosed herein, and the program modules are stored in a memory and executed at least by a processor. Other combinations of hardware and software or hardware and firmware can implement or implement the aspects described herein, including the disclosed methods. As used herein, the term "product" can cover a computer program that can be accessed from any computer-readable device, carrier, or storage medium. For example, a computer-readable storage medium can include, but is not limited to, a magnetic storage device (e.g., a hard disk, a floppy disk, a magnetic stripe ...), an optical disk (e.g., a compact disk (CD), a digital versatile disk (DVD), a blue optical disk (BD) ...), a smart card, and a flash memory device (e.g., a card, a stick, a key drive ...), etc.

[0099] As used in this specification, the term "processor" may refer to substantially any computational processing unit or device, including but not limited to a single-core processor; a single processor with software multithreaded execution capability; a multi-core processor; a multi-core processor with software multithreaded execution capability; a multi-core processor with hardware multithreading technology; a parallel platform; and a parallel platform with distributed shared memory. In addition, a processor may refer to an integrated circuit, an application specific integrated circuit (ASIC), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic controller (PLC), a complex programmable logic device (CPLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. In addition, the processor may utilize nanoscale architectures (such as, but not limited to, transistors, switches, and gates based on molecules and quantum dots) in order to optimize space usage or enhance the performance of user equipment. The processor may also be implemented as a combination of computational processing units.

[0100] In this disclosure, terms such as "repository," "storage," "data repository," "data storage," "data storage," "database," and substantially any other information storage component related to the operation and functionality of the component are used to refer to a "memory component," an entity embodied in a "memory," or a component that includes a memory. It should be understood that the memory and / or memory components described herein may be volatile memory or non-volatile memory, or may include both volatile memory and non-volatile memory.

[0101] By way of illustration and not limitation, non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), flash memory, or non-volatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM)). For example, volatile memory may include RAM that may act as external cache memory. By way of illustration and not limitation, RAM may be provided in a variety of forms, such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM). In addition, the disclosed memory components of the systems or methods herein are intended to include, but are not limited to, including these and any other suitable types of memory.

[0102] It should be recognized and appreciated that components described with respect to a particular system or method may include the same or similar functionality as corresponding components described with respect to other systems or methods disclosed herein (eg, separately named components or similarly named components).

[0103] What has been described above includes examples of systems and methods that provide the advantages of the present disclosure. Of course, it is not possible to describe every conceivable combination of components or methods for the purpose of describing the present disclosure, but one of ordinary skill in the art will recognize that many additional combinations and permutations of the present disclosure are possible. In addition, to the extent that the terms "including," "having," "having," and the like are used in the detailed description, claims, appendices, and drawings, such terms are intended to be inclusive in a manner similar to the term "comprising," as interpreted when "including" is used as a transitional word in a claim.

Claims

1. A system comprising: a memory storing computer executable components; and a processor that executes the computer executable components stored in the memory, wherein the computer executable components include: An evaluation component, the evaluation component: accessing a training data set associated with a machine learning model, the training data set comprising data samples, the data samples each comprising a unique feature of an individual, and determining characteristic curve information associating different data portions extracted from the data sample with respective probabilities of matching the different data portions to respective ones of the data samples from which the different data portions were extracted, wherein the different data portions respectively include different portions of the unique characteristic; and A collecting component controls the collection of the new data portion extracted from the new data sample corresponding to the data sample based on associating the new data portion with the probability of satisfying the anonymity criterion among the corresponding probabilities. 2 . The system of claim 1 , wherein the respective probabilities correspond to identification probabilities of determining respective identities of the individuals respectively associated with the different data portions.

3. The system of claim 1 , wherein the computer executable components include: A selection component, wherein the selection component selects the target data portion based on the probability that the target data portion among the different data portions is associated with the probability of satisfying the anonymity criterion, and wherein the collection component controls the collection of the new data portion based on the new data portion complying with the criteria defining the target data portion, thereby ensuring that the new data portion satisfies the anonymity criterion.

4. The system of claim 3, wherein the new data sample comprises a runtime data sample processed by the machine learning model by an external system.

5. The system of claim 4, wherein the collection component receives the new data portion from the external system based on the new data portion meeting the criteria defining the target data portion, and wherein the computer executable component further comprises: A training component, wherein the training component employs the new data portion to retrain the machine learning model, thereby generating an optimized version of the machine learning model.

6. The system of claim 1 , wherein the data sample comprises a medical image, and wherein the unique features comprise physical features of the individual, and wherein the corresponding probabilities correspond to probabilities of determining a corresponding identity of the individual from which the medical image was captured. The system of claim 6 , wherein the different data portions correspond to different pixel quantities.

8. The system of claim 7, wherein the different amount of pixels is constrained relative to a defined anatomical feature depicted in the medical image.

9. The system of claim 7, wherein the evaluation component determines the corresponding probability by performing the following operations for each of the different pixel quantities: extracting the image portion of the number of pixels from a corresponding one of the medical images; determining a number of the medical images that can be matched to a corresponding extracted image portion of the medical image in the image portion; and A probability for the amount of pixels in the corresponding probabilities is determined based on the amount relative to a total number of the medical image.

10. A method comprising: Accessing, by a system including a processor, a training data set associated with a machine learning model, the training data set including data samples, the data samples each including a unique characteristic of an individual; determining, by the system, signature curve information associating different data portions extracted from the data sample with respective probabilities of matching the different data portions to respective ones of the data samples from which the different data portions were extracted, wherein the different data portions respectively include different portions of the unique characteristic; as well as Collection of new data portions extracted from a new data sample corresponding to the data sample is controlled by the system based on associating the new data portions with probabilities of satisfying anonymity criteria among the corresponding probabilities.

11. The method of claim 10, wherein the respective probabilities correspond to identification probabilities of determining respective identities of the individuals respectively associated with the different data portions.

12. The method according to claim 11, further comprising: selecting, by the system, the target data portion among the different data portions based on an association of the target data portion with the probability of satisfying the anonymity criterion, and wherein the controlling comprises: The collection of new data is controlled by the system based on the selection based on the new data portion conforming to the criteria defining the target data portion, thereby ensuring that the new data portion meets the anonymity criteria.

13. The method of claim 12, wherein the new data sample comprises a runtime data sample processed by the machine learning model by an external system.

14. The method according to claim 13, further comprising: receiving, by the system based on the control, the new data portion from the external system; as well as The new data portion is employed by the system to retrain the machine learning model.

15. The method of claim 10, wherein the data sample comprises a medical image, and wherein the unique characteristic comprises a physical characteristic of the individual. The method of claim 15 , wherein the different data portions correspond to different pixel quantities.

17. The method of claim 16, wherein the different amount of pixels is constrained relative to a defined anatomical feature depicted in the medical image.

18. The method of claim 16, wherein the determining comprises, for each of the different pixel quantities: extracting, by the system, an image portion of the number of pixels from a corresponding one of the medical images; determining, by the system, a number of the medical images that can be matched to a corresponding extracted image portion of the medical image in the image portion; as well as A probability for the amount of pixels in the corresponding probabilities is determined by the system based on the amount relative to a total number of the medical image.

19. A non-transitory machine-readable storage medium comprising executable instructions that, when executed by a processor, facilitate performance of operations comprising: Accessing a training data set associated with a machine learning model, the training data set comprising data samples, the data samples each comprising a unique feature of an individual; as well as determining characteristic curve information associating different data portions extracted from the data sample with respective probabilities of matching the different data portions to respective ones of the data samples from which the different data portions were extracted, wherein the different data portions respectively include different portions of the unique characteristic; as well as Collection of new data portions extracted from a new data sample corresponding to the data sample is controlled based on the new data portions being associated with probabilities of satisfying an anonymity criterion among the corresponding probabilities.

20. The non-transitory machine-readable storage medium of claim 19, wherein the operations further comprise: selecting the target data portion based on associating the target data portion among the different data portions with the probability of satisfying an anonymity criterion; as well as The collection of the new data portion is controlled based on the new data portion meeting criteria defining the target data portion.

Images