Training machine learning model and performing inference operations of machine learning model using secure multi-party calculations

Abstract

The invention relates to a privacy preserving machine learning platform. In one aspect, a method includes identifying a request to process an input feature vector through a machine learning model using a multi-party computing (MPC) cluster including a plurality of (MPC) computing systems. Each feature in the input feature vector is encoded to generate an encoded weight vector. A respective share of the encoded weight vector is generated for each computing system and provided to the corresponding computing system to generate a partial prediction for the respective share. The MPC cluster collects modified partial predictions for the input feature vector from the remaining MPC computing systems of the plurality of MPC computing systems, wherein each of the modified partial predictions is generated by the corresponding MPC computing system based on the partial predictions. The final predictions are generated by the MPC clusters based on the respective partial predictions.

Description

Technical Field

[0001] This specification relates to using secure multi-party computation (MPC) to train machine learning models and perform inference operations on machine learning models. Background Art

[0002] Machine learning is a type of artificial intelligence that seeks to teach computers how to learn and act without having to be explicitly programmed. More specifically, machine learning is a method of data analysis that involves building and adapting models that allow computer executable programs to "learn" through experience. Machine learning involves the design of algorithms that adapt their models to improve the model's ability to make predictions. This is done by first training a machine learning model using historical data (training data) for which the outcomes (labels) are known, which is called supervised learning. The computer can identify rules or relationships during the training period and learn the learning parameters of the machine learning model. Then, using new inputs, the machine learning model can generate predictions based on the identified rules or relationships.

[0003] Some machine learning models are trained based on data collected from multiple sources, such as across multiple websites and / or native applications. However, this data may include private or sensitive data that should not be shared or allowed to leak to other parties. Summary of the invention

[0004] In general, the described techniques relate to training machine models and performing inference operations of machine models for protecting data privacy. Specifically, the training and inference operations are performed by a system using multiple MPC computing systems (e.g., a cluster of MPC computing systems), wherein a specific MPC computing system among the multiple MPC computing systems in the environment accesses a secret share of data determined for the specific computing system. In order to improve the computational efficiency and accuracy of training and performing inference operations using MPC computing systems, the described system implementing the described techniques includes an atypical machine learning model (e.g., a neural network with one hidden layer for embedding input features). In addition, the client in the described system encrypts or encodes the features into multiple weight vectors, generates a secret share for each weight vector, and provides the corresponding secret share to the corresponding MPC computing system, so that different MPC computing systems receive different secret shares for each weight vector, and no weight vector can be accessed in plain text without unauthorized collusion between MPC computing systems. Plain text is text that is not computationally tagged, specially formatted, or written in code or data including binary files, which is in a form that can be viewed or used without the need for a key or other decryption device or other decryption process.

[0005] Each MPC computing system processes its own secret share of the weighted vector to determine an embedding using an embedding lookup table, and deploys a corresponding machine learning model for processing the embedding to generate a partial prediction. Although each MPC computing system uses a corresponding machine learning model with substantially the same structure, the parameters of the lookup table and the machine learning model can be different across the MPC computing systems. Then, a system (e.g., a client for an inference process, a secure processor of the system, or a training subsystem for a training process) combines the partial predictions received from multiple MPC computing systems to generate a final prediction, which can be later used for different downstream operations, such as determining digital content for a client for an inference process, or updating model parameters of a machine learning model, or other suitable operations.

[0006] One aspect of the subject matter described in this specification can be embodied in a method including performing an inference operation of a trained machine learning model within an MPC computing environment. More specifically, the method includes: identifying at a client device a request to process an input feature vector using an MPC cluster including multiple multi-party computing (MPC) computing systems through a machine learning model, the input feature vector having a sequence of M features; for each feature in the input feature vector, encoding the feature according to the characteristics of the input feature vector by the client device to generate an encoded weight vector; generating, by the client device, a corresponding share of the encoded weight vector for each computing system in the multiple MPC computing systems; providing, by the client device, each corresponding share of the encoded weight vector to a corresponding computing system in the multiple MPC computing systems to generate a corresponding partial prediction for the corresponding share; collecting, by the MPC cluster, modified partial predictions for the input feature vector from the multiple MPC computing systems, wherein each of the modified partial predictions is generated by the corresponding MPC computing system based on the corresponding partial prediction; and generating, by the MPC cluster, a final prediction for the input feature vector corresponding to the request based on the corresponding partial prediction. Other implementations of this aspect include corresponding apparatus, systems, and computer programs configured to execute aspects of the method encoded on computer storage devices.

[0007] Another aspect of the subject matter described in this specification can be embodied in a method for training a machine learning model within an MPC computing environment. More specifically, the method includes: receiving a plurality of training feature vectors as training examples, each training feature vector having a sequence of M features; for each of the plurality of training feature vectors, using a machine learning model to generate a final prediction through a plurality of multi-party computing (MPC) computing systems, including: for the training feature vector, generating an encoded weight vector of the training feature vector; each encoded weight vector corresponds to each feature in the training feature vector; generating a share of the encoded weight vector for each computing system in the plurality of MPC computing systems; for each computing system in the plurality of MPC computing systems, providing a corresponding share to the computing system to generate a corresponding partial prediction for the corresponding share using the machine learning model; generating a final prediction based on the corresponding partial predictions from the plurality of MPC computing systems; and for each of the plurality of training feature vectors, updating a model parameter of the machine learning model by reducing a loss determined from a loss function for a final prediction and a reference prediction. Other implementations of this aspect include corresponding devices, systems, and computer programs configured to execute various aspects of the method encoded on a computer storage device.

[0008] The subject matter described in this specification can be implemented in a specific embodiment to achieve one or more of the following advantages. The described technology can reduce computational costs and improve training and inference efficiency. First, the described machine learning model has a much smaller size than other machine learning models. For example, the described machine learning model can include a neural network layer with three layers, such as an input layer, a hidden layer, and an output layer. The hidden layer can process input features to generate an embedding, which converts input features from a higher dimensional space into an embedding of a lower dimensional space. In some cases, the hidden layer can be represented by a trained embedding lookup table. The system also processes the embedding using a specific formula, such as through the output layer, to determine partial predictions from different MPC computing systems. In addition, the machine learning model can be trained and used to perform inference operations on end-to-end encrypted features within the MPC computing system. In this way, by converting features into embeddings with a smaller size, the total computational cost, memory bandwidth requirements for data communication, and memory storage for storing data are reduced. In addition, the MPC computing system can implement a specific protocol so that at least a portion of the multiplication operations originally represented in the machine learning model can be converted to addition operations, which further reduces the use of computing resources, especially for training and using large machine learning models with a large number of model inputs.

[0009] In addition, the techniques described in this document can improve user privacy and data security. More specifically, a system implementing the described techniques can use cryptographic techniques such as secure MPC protocols to train machine models and generate machine learning predictions for input features. This protects user privacy on such platforms and protects the security of data from being compromised during transmission across multiple MPC computing systems, e.g., two different MPC computing systems cannot communicate secret shares to each other without consent or permission.

[0010] In addition, the described techniques can improve user privacy and data security without negatively impacting the accuracy of machine learning predictions compared to those predictions generated by models using completely private user data (also referred to as plaintext in the following description). The machine learning models described below are inherently nonlinear and implement techniques for generating embeddings of input features (or secret shares of features). Given this, the described techniques can generate accurate machine learning predictions even for input features that have no private information or labels.

[0011] In addition, the described techniques are robust so that different feature types and different tasks can be used. For example, the described techniques are compatible with single-valued features and multi-valued features, as well as features in scalar form, vector form, or tensor form. In addition, the described techniques support features with different characteristics, such as numerical features (e.g., features represented in a numerical format), categorical features (e.g., features represented by different categories), and ordinal features (e.g., categorical features and can be labeled by numbers). In addition, the described techniques can perform various tasks as needed for specific applications. Tasks can include, for example, binary classification, multi-class classification, and regression.

[0012] The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a block diagram of an environment for training machine learning models and performing inference operations on machine learning models using multiple MPC computing systems.

[0014] Figure 2 is a swim lane diagram of an example process for performing inference operations on a machine learning model.

[0015] Figure 3 is a flow chart illustrating an example process for performing inference operations of a machine learning model using multiple MPC computing systems to process input features.

[0016] Figure 4is a flow chart illustrating an example process for generating a partial prediction for a secret share assigned to a particular MPC computing system.

[0017] Figure 5 is a flow chart illustrating an example process for training a machine learning model based on training examples using multiple MPC computing systems.

[0018] Figure 6 is a block diagram of an example computer system.

[0019] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0020] In general, this document describes systems and techniques for training machine learning models and performing inference operations of machine learning models for processing feature inputs while protecting user privacy and ensuring data security. Typically, rather than creating and maintaining user profiles at computing systems of other entities such as content platforms, user profiles are maintained at user's client devices. To train machine learning models, the user's client device may optionally send the user's encrypted user profile (e.g., as a secret share of the user profile) to multiple computing systems of a secure MPC cluster along with other data via the content platform. For example, each client device may generate two or more secret shares of the user profile and send the corresponding secret shares to each computing system. The computing systems of the MPC cluster may use secure MPC techniques to train machine learning models and perform inference operations of machine learning models using secret shares of features to prevent any computing system of the MPC cluster (or other parties other than the user itself) from obtaining any private or secure information in plain text, thereby protecting user privacy. For example, the use of secret shares and the MPC techniques described in this document enables the training and use of machine learning models while each user's user profile data is always encrypted when the data is located outside the user's device.

[0021] The described machine learning model is computationally efficient and accurate. Each MPC computing system can have the same model structure, but with different model parameters trained by secret shares of training examples. An example machine learning model deployed on an MPC computing system can include a hidden layer configured to generate an embedding of a secret share of a feature, the secret share being assigned to the MPC computing system. The node operation can be an exponential function , where e is the Euler number and x is the node input. The hidden layer can be represented by an embedding lookup table that takes, for example, a secret share of the encoded weight vector as input to determine the corresponding embedding based on the feature characteristics using one-hot encoding, three-hot encoding, four-hot encoding, or other appropriate techniques.

[0022] After training the machine learning model, the system may store the trained machine learning model in one or more memory units. In addition, the system may deploy the trained machine learning model in multiple MPC computing systems for generating model predictions based on input features. In some implementations, the system may deploy the trained machine learning model to an MPC computing system that is different from the MPC computing system used to train the model. The input features are encoded or encrypted into multiple secret shares before being provided to the corresponding MPC computing system, so that the MPC computing systems do not communicate their own shares to each other, and each MPC computing system does not have plaintext access to the input features, for example, no access to private or secure features. For example, if the MPC cluster includes two MPC computing systems, the client device may generate a first secret share of the input feature for one of the MPC computing systems, and generate a second secret share of the input feature for the other MPC computing system.

[0023] Model predictions may include classification or regression data, or both. For example, model predictions may include one or more topics, content, interests, or activities predicted for a user account associated with the input features. In some implementations, model predictions may also classify or group multiple user profiles into specific user groups, or identify multiple user groups. The system may also provide content to different user groups given their common interests in a privacy-preserving and secure manner.

[0024] Example system for training and performing inference operations on machine learning models

[0025] Figure 1 is a block diagram of an environment 100 for using multiple MPC computing systems to train machine learning models and perform inference operations on machine learning models. For example, multiple MPC computing systems may form Figure 1 The secure MPC cluster 130 shown may be included in the secure MPC cluster. The example environment 100 includes a data communication network 105, such as a local area network (LAN), a wide area network (WAN), the Internet, a mobile network, or a combination thereof. The network 105 connects client devices 110, secure MPC clusters 130, and other components 150. In some implementations, other components 150 may include publishers, websites, and content platforms. The example environment 100 may include many different client devices 110, secure MPC clusters 130, and different other components 150.

[0026] The client device 110 is an electronic device capable of communicating over the network 105. Example client devices 110 include personal computers, mobile communication devices such as smart phones, and other devices that can send and receive data over the network 105. The client device may also include a digital assistant device that accepts audio input through a microphone and outputs audio output through a speaker. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant can be placed in a listening mode (e.g., ready to accept audio input). The digital assistant device may also include a camera and / or a display to capture images and present information visually. The digital assistant may be implemented in different forms of hardware devices, including wearable devices (e.g., watches or glasses), smart phones, speaker devices, tablet devices, or other hardware devices. The client device may also include a digital media device, for example, a streaming device inserted into a television or other display to stream video to the television, or a gaming device or console.

[0027] The client device 110 typically includes an application 112, such as a web browser and / or a native application, to facilitate the sending and receiving of data over the network 105. A native application is an application developed for a specific platform or a specific device (e.g., a mobile device with a specific operating system). The application 112 can cause the client device 110 to send a query request for content over the network 105. The content can be provided by one or more remote content providers. In addition, as Figure 1 As shown, the application 112 may also request that the client device use one or more machine learning models to process input features to better retrieve content, such as content that may be of interest to a user of the client device.

[0028] Some resources, application pages or other application content may include a digital component slot for presenting a digital component together with the resource content or application page. As used throughout this document, the phrase "digital component" refers to a discrete unit of digital content or digital information (e.g., a video clip, an audio clip, a multimedia clip, an image, a text, or another content unit). A digital component may be electronically stored in a physical memory device as a single file or in a collection of files, or transmitted from a content provider via network 105. A digital component may take the form of a video file, an audio file, a multimedia file, an image file, or a text file, and include advertising information so that advertising is a type of digital component. For example, a digital component may be content intended to supplement the content of a web page or other resource presented by application 112. More specifically, a digital component may include digital content related to resource content, for example, a digital component may relate to the same subject as web page content, or relate to a related subject. Therefore, the provision of a digital component may supplement and substantially enhance a web page or application content.

[0029] When application 112 loads a resource or application content that includes one or more digital component slots, application 112 may request a digital component for each slot. In some implementations, a digital component slot may include code (e.g., a script) that causes application 112 to request a digital component from a digital component distribution system that selects the digital component and provides the digital component to application 112 for presentation to a user of client device 110.

[0030] In some cases, it is beneficial for users to receive digital components related to web pages, application pages or other electronic resources that users have previously visited and / or interacted with. In some cases, it is beneficial for users to receive digital components of topics that users are interested in. However, the prior art may need to include data on user historical activities on one or more applications and across one or more applications, which may cause user private data to leak to different third parties. In view of this, it is beneficial to protect private and secure user information, and only the secret share of information can be accessed by a third party. As described below in the document, one way to achieve it is to encode or encrypt user features, and then split the encoded features into different shares to assign to different MPC computing systems in the secure MPC cluster 130. Each MPC computing system, such as MPC1 and MPC2, corresponds to a computing system held by a third party or associated with a third party and configured to generate model predictions for secret shares using a machine learning model. In this way, the system can provide better customized digital content to different users and user groups, while still protecting user privacy and data security.

[0031] In some implementations, the final prediction for the input features may involve a prediction of whether a user will interact with a particular digital component if the digital component is presented to the user in a particular context. For example, the particular context for presenting the digital component to the user may include the geographic location of the client device 110 at the time (if permission is granted by the user), a signal describing the content of the electronic resource with which the digital component is presented, and a signal describing the digital component, such as the content of the digital component, the type of the digital component, the location on the electronic resource where the digital component is presented, etc. In another example, a dimension may represent whether the digital component presented to the user is of a particular type. In this example, the value may be 1 for travel, 2 for dishes, 3 for movies, and so on. Other values ​​and types may also be used.

[0032] The secure MPC cluster 130 may train a machine learning model to generate predictions for input features, or may be used to perform inference operations of a trained machine learning model to generate predictions for input features, such as features collected and stored by the application 112. Figure 1 As shown, the secure MPC cluster 130 may include a secure processor 140, and two computing systems MPC1 and MPC2. The secure processor 140 and MPC1 and MPC2 cooperatively perform secure MPC techniques to train a machine learning model and perform inference operations of the machine learning model.

[0033] In short, MPC1 and MPC2 use respectively deployed machine learning models to process respectively assigned secret shares of the encoded input features to generate partial predictions. MPC computing systems, such as MPC1 and MPC2, can use corresponding coefficient values ​​(e.g., ) to modify the corresponding partial prediction. Combined with Figure 2 Details of modifying the corresponding partial predictions are described. After modifying the corresponding partial predictions, one of the MPC computing systems may receive the modified partial predictions from the remaining MPC computing systems in the plurality of MPC computing systems to generate a final prediction for the input feature. Since the partial predictions are modified by coefficient values ​​in the other MPC computing systems, the MPC receiving the modified partial predictions does not have access to the original partial predictions, which ensures data security when generating the final output.

[0034] In some implementations, the system 100 may include a secure processor 140 for collecting partial predictions to generate a final prediction for an input feature. The secure processor 140 may also include one or more cores or clusters for performing inference operations, or one or more cores or clusters for performing training operations, or both. In some implementations, the secure MPC cluster 130 provides the partial predictions generated by the corresponding MPC computing system (e.g., MPC1 and MPC2) to the client device 110. The application 112 of the client device 110 may process the partial predictions to generate a final output for the input feature. For example, the client device 110 may combine the partial predictions based on a secure MPC protocol for generating partial predictions. In a specific example, in the case of using additive secret sharing, the client device 110 may add the partial predictions to obtain the final output. The application 112 may also use the final output to request digital content, such as a video clip, an audio clip, a multimedia clip, an image, text, or another content unit as described above, by transmitting a request with data representing the final output to the server via the network 105.

[0035] During the training process, the security processor 140 is configured to determine a final prediction or obtain a final prediction from one of the MPC computing systems. After obtaining the final prediction for the input feature, the security processor 140 adjusts the model parameters of the machine learning models of MPC1 and MPC2 by optimizing the loss function. The loss function is a function that quantifies the difference or error between the final prediction and the reference prediction for the input feature. The model parameter update occurs during back propagation using, for example, a gradient descent technique. In some training situations, one or more of the MPC computing systems in the security MPC cluster 130 can be used to generate a final prediction based on partial predictions received from other MPC computing systems.

[0036] Although the example MPC cluster 130 includes two computing systems, more computing systems may be used as long as the MPC cluster 130 includes more than one computing system. For example, the MPC cluster 130 may include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 may provide more security and fault tolerance, but may also increase the complexity of the MPC cluster 130 and / or the secure MPC protocol executed by the MPC computing systems in the MPC cluster 130.

[0037] The MPC computing systems MPC1 and MPC2 may be operated by different entities. In this way, each entity may not have access to the complete input features of the user (e.g., features that represent the user profile in plain text). For example, one of the computing systems MPC1 or MPC2 may be operated by a trusted party different from the user. For example, an industry group, a government group, or a browser developer may maintain and operate one of the computing systems MPC1 and MPC2. The other computing system may be operated by a different group of these groups, so that different trusted parties operate each computing system MPC1 and MPC2. Preferably, the different parties operating the different computing systems MPC1 and MPC2 have no motivation to collude to risk the privacy and / or security of the data represented by the secret shares received and / or generated by the computing systems MPC1 and MPC2. In some implementations, the MPC computing systems MPC1 and MPC2 are architecturally separated and monitored so as not to communicate with each other outside of executing the secure MPC process described in this document. In some cases where consent or permission has been obtained from a user or entity to access specific data or derivatives of specific data, different MPC computing systems may communicate encoded data to each other using a specific MPC protocol without risking the privacy and / or security of the data.

[0038] In addition to the description throughout this document, controls (e.g., user interface elements with which the user can interact) may be provided to the user to allow the user to make choices about whether and when the systems, programs, or features described herein may collect user information (e.g., information about the user's social network, social actions or activities, occupation, the user's preferences, or the user's current location) and whether to send content or communications from a server to the user. In addition, before certain data is stored or used, it may be processed in one or more ways so that personally identifiable information is removed. For example, the user's identity may be processed so that personally identifiable information of the user cannot be determined, or the user's geographic location may be generalized (such as to a city, zip code, or state level) if location information is obtained so that the user's specific location cannot be determined. Thus, the user can control what information is collected about the user, how the information is used, and what information is provided to the user.

[0039] Example procedure for performing inference operations on a machine learning model

[0040] Figure 2 is a swim lane diagram of an example process 200 for performing inference operations of a machine learning model. The operations of process 200 may be implemented, for example, by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and security processor 140. The operations of process 200 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices may cause one or more data processing devices to perform the operations of process 200. Although process 200 and other processes below are described in terms of a dual computing system MPC cluster 130, an MPC cluster having more than two computing systems may also be used to perform similar processes. Although only one security processor 140 is shown, the security processor 140 itself may include one or more computing cores or clusters.

[0041] The client device 110 may receive a request to perform an inference operation of a trained machine learning model for processing input features (202). The request may be initiated or issued by one or more applications 112 deployed on the client device 110. In some implementations, the request may be initiated by other components in the system 100, such as a content platform. The request includes data that specifies, for example, Figure 1 Two or more of the plurality of MPC computing systems of the secure MPC cluster 130 process secret shares of the encoded or encrypted input features. In some implementations, the secret shares are additive secret shares that can be combined by adding the secret shares together to obtain the plaintext input features.

[0042] In some implementations, input features may include data representing a user profile. For example, a feature may be an individual measurable property or characteristic of an observed phenomenon or action that is associated with a user. More specifically, a user profile of a user may include data related to events initiated by the user regarding an electronic resource, such as a web page or application content, and / or events that the user may have initiated regarding the electronic resource. Events may include viewing of an electronic resource, viewing of a digital component, user interaction with an electronic resource or digital component (e.g., selection of an electronic resource or digital component) or lack of user interaction with an electronic resource or digital component, conversions that occur after user interaction with an electronic resource, and / or other appropriate events related to the user and the electronic resource. A user profile of a user may also include data indicating user attributes of the user, such as demographic information, location information, etc.

[0043] Input features may include numerical features (features represented by numeric values), categorical features (features represented by groups of categories), and optionally ordinal features (categorical data that has an order or scale placed on it).

[0044] The input features may be presented in different forms or data structures. For example, the input features may be scalars, vectors, or tensors. For the case where the input features are vectors (also referred to as input feature vectors), the input feature vectors may include a feature sequence, each feature having multiple possible values ​​(also referred to as the cardinality of the features). The total number of features in the feature sequence (e.g., a total of M features, where M includes 7, 13, 17, 20, or other suitable numbers) and the cardinality of each feature may affect the overall computational cost of training and using a machine learning model.

[0045] When generated, each application 112 may store data associated with the user profile in a memory local or remote to the client device. In some cases, the application 112 may process input data (e.g., user profile data) to generate encoded input features. The application 112 may provide the input features to the client device 110. The application 112 or the device 110 may issue a request to the secure MPC cluster 130 to process the generated input features. In some other cases, the application 112 provides the raw user profile data to the client device 110, and it is the client device 110 that processes the raw user profile data to generate the input features. For simplicity, the description below is generally based on using a client device to generate input features from raw user profile data.

[0046] After receiving the request to process the input features and the input features from the application 112, the client device 110 may encode each input feature in the input feature vector into an encoded weight vector according to the characteristics of the input feature vector (204). Each encoded weight vector may have a size of K. For example, the size K may be 10, 30, 50, 100, 1000, or other suitable values.

[0047] As described above, the characteristics of the input feature generally refer to whether the feature is a numerical feature or a categorical feature. For categorical features, the client device 110 may use a one-hot encoding technique to determine the encoded weight vector of the categorical feature. For numerical features, the client device 110 may use a three-hot encoding technique or a four-hot encoding technique to determine the encoded weight vector of the numerical feature.

[0048] More specifically, for categorical features with low cardinality (e.g., one or a few possible values ​​for each categorical feature), the client device 110 may encode the categorical values ​​into an array using one-hot encoding. The length or size of the array is the cardinality of the categorical feature, and each element of the array may have a value of 1 if the element position corresponds to the value of the categorical feature, or a value of 0 if the element position does not correspond to the value of the categorical feature. Other suitable values ​​may also be used.

[0049] For categorical features with high cardinality (e.g., tens, hundreds, or more possible values ​​for each categorical feature), the client device 110 can first reduce the cardinality. One way to reduce the cardinality is to split the categorical features with high cardinality (e.g., F) into n categorical features ({F1, F2, ..., Fn}), each of which has a medium to low cardinality. Based on the model size and computational requirements, the size n can be, for example, 2, 3, 5, or more. In this way, the combined cardinality of all split categorical features is much smaller than the cardinality of the original categorical feature F. In addition to reducing the cardinality, the client device 110 can also implement a distributed point function (DPF), which is usually an encryption primitive that allows two distributed processes to share a piece of information and calculate a function of their shared information without revealing the information itself to either process. The client device 110 can encode each categorical value into a pair of DPFs, which can be transmitted using less bandwidth than the unique hot encoding technique.

[0050] With reference to the digital features, the client device 110 (or one or more applications 112 installed on the client device 110) may implement an interpolation technique to convert the digital features into two or more categorical features. For example, the interpolation technique may be spline interpolation, which is a function composed of piecewise polynomials each having a specific interval. The points where two piecewise polynomials meet in the piecewise polynomials are called control points or nodes. More specifically, assuming a two-dimensional space, given n+1 fixed nodes ,in The term x refers to the observed feature value of a numerical feature, and the term y can refer to any measurable value associated with x. For example, the term y can be the embedding of feature x in K-dimensional space. Cubic spline interpolation with a cubic piecewise polynomial can be used to interpolate between two adjacent nodes. and The resulting spline is continuous and has continuous first-order derivatives.

[0051] To determine the location of each of the plurality of nodes, the client device 110 (or one or more applications 112 installed on the client device 110) may determine the quantiles of the digital values ​​so that the digital feature values ​​are evenly assigned to n buckets, each bucket having approximately a similar number of digital values. For example, for n+1 fixed nodes { } and for a total of N input features, each bucket can be assigned approximately The quantile process is effective for machine learning computations because it can avoid unnecessary computational costs of preprocessing digital features. In some implementations, the system (e.g., secure MPC cluster 130) can further update or refine the quantile process during training of the machine learning model. Figure 5 ) describes example details of the process of updating quantiles (the locations of nodes).

[0052] After the client device 110 obtains the node sequence, the client device 110 (or the corresponding application 112) converts the digital value into an embedded weight sum or weighted average. , where , fall into the bucket , where k represents the kth node in the node sequence in the quantile process, and term t represents a positive value. If a particular numerical feature does not belong to either end of the bucket sequence, it can be obtained by The weighted average of is used to determine the corresponding embedding interpolated for a particular numerical feature. The weighted average can be expressed as:

[0053]

[0054] item Represents the interpolation weights for cubic spline interpolation according to the standard cubic spline rule. These weights are expressed as follows:

[0055] ,

[0056] ,

[0057] ,as well as

[0058] .

[0059] Here, item is the standard coefficient function for the cubic interpolating polynomial function.

[0060] In this way, the client device 110 (or corresponding application 112) can process numerical features in the same manner as categorical features having n+1 distinct values, except that when determining the embedding using the embedding lookup table, if the numerical feature value falls into bucket , the client device 110 determines the embedding of the digital feature as the weighted average of the four adjacent nodes. The corresponding weights of the four embeddings are The system may construct the weight values ​​into an encoded weight vector before providing the weight values ​​to the MPC computing system, and may determine the corresponding embedding of the digital value using the encoded weight vector and the embedding values ​​stored in the lookup table at the corresponding MPC computing system. This encoding technique for digital feature values ​​that fall into buckets (other than the leftmost and rightmost buckets) is also known as four-hot encoding.

[0061] In addition, for the numeric feature value that falls into the leftmost bucket in the bucket sequence, that is, Or k=1, the above equation (1) still holds for three adjacent embedding values, that is, . Corresponding weight value It can be expressed as follows:

[0062] ,

[0063] ,as well as

[0064] .

[0065] Furthermore, for the numeric feature values ​​that fall into the rightmost bucket in the bucket sequence, that is, Or k=n-2, the above equation (1) still holds for three adjacent embedding values, that is, . Corresponding weight value It can be expressed as follows:

[0066] ,

[0067] ,as well as

[0068] .

[0069] For the purpose of this document, the encoding technique used for numeric features that fall in the leftmost and rightmost buckets is also called three-hot encoding.

[0070] In some implementations, the client device 110 generates an encoded weight vector for a categorical feature using one-hot encoding, or generates an encoded weight vector for a numeric feature using four-hot encoding or three-hot encoding. The encoded weight vector is split into secret shares for the corresponding MPC computing systems. Each corresponding MPC computing system processes a corresponding share using a corresponding embedded lookup table stored in the corresponding MPC computing system.

[0071] More specifically, client device 110 generates a respective secret share of the encoded input features for each MPC computing system in the secure MPC cluster (206). The respective secret shares may be additive, such that the secret shares may be combined to form the encoded input features generated from the input feature vector, e.g., by adding the secret shares if additive secret sharing is used. In some cases, the encoded input features may be encoded weight vectors formed from the weights described above using one-hot encoding, three-hot encoding, or four-hot encoding.

[0072] like Figure 1 As shown, the secure MPC cluster 130 may include two MPC computing systems (e.g., MPC1 or MPC2). In view of this, the client device 110 may split the encoded weight vector of the input feature into two secret shares. Each of the two secret shares is provided to the corresponding MPC computing system (MPC1 or MPC2), and the two secret shares do not have shared information from the input feature. Any of the corresponding secret shares does not reveal private user data or security data. In this way, data privacy and security are guaranteed. The system can implement standard techniques to split the encoded weight vector into corresponding secret shares. The secret share can have the same data structure as the encoded weight vector.

[0073] Although the client device 110 described in this document generally divides the encoded weight vector into different secret shares for different MPC computing systems, in some implementations, the client device 110 can directly split the feature vector into secret shares of the feature vector before encoding, and provide the secret shares of the feature vector to the corresponding MPC computing system (e.g., MPC1 or MPC2). Next, each MPC computing system is configured to convert the shares of the digital features (if any) into shares of the categorical features, and encode the shares (e.g., generate embeddings) by processing the shares of the categorical features using the corresponding embedding lookup table. The conversion process is similar to those described above.

[0074] The client device 110 transmits the secret share of the encoded input feature (eg, the encoded weight vector) to the corresponding MPC computing system. Figure 2 As shown, client device 110 transmits the first secret share of the encoded weight vector to computing system MPC1 (208), and transmits the second secret share of the encoded weight to computing system MPC2 (210). In some implementations, client device 110 may also transmit a request to process the secret share to secure MPC cluster 130. Alternatively, the MPC computing system in cluster 130 automatically initiates the process of determining the embedding of the share of the feature after receiving the secret share.

[0075] After receiving the first share of the encoded feature, computing system MPC1 can generate a first partial embedding of the first share of the encoded feature (212). Similarly, after receiving the second share of the encoded feature, computing system MPC2 can generate a second partial embedding of the second share of the encoded feature (214). In order to determine the partial embedding of the share of the encoded feature, the computing systems in the secure MPC cluster 130 can use an embedding lookup table. The embedding lookup table can include rows of embedding values ​​determined using training examples during the training process. Each row of the embedding lookup table can represent an M-size vector in a K-dimensional embedding space. The size K can be, for example, 20, 40, 60, 100, or other suitable numbers, and the size M can be, for example, 3, 8, 12, 14, or other suitable numbers. Each MPC computing system has a different embedding lookup table with different parameters for processing its share of the encoded feature.

[0076] For example, one example process for determining a partial embedding using an MPC computing system may include a multiplication between the secret share of the encoded weight vector and an embedding lookup table deployed in the MPC computing system. More specifically, for the jth feature in the input feature vector x, ,in , it can be assumed is an embedding table that maps each possible value of the jth feature to a K-dimensional embedding. We can further assume that the lookup table have entries, each of which is represented by ,in represents the cardinality, and .item is a K-dimensional vector, where K can be 30, 40, 50, 100 or other suitable numbers. Therefore, for a categorical feature with an M cardinality (for example, M can include 5, 10, 15, 20 or other suitable numbers) , a first MPC computing system (eg, MPC1) may have a first embedded lookup table , and the second MPC computing system (e.g., MPC2) may have a second embedded lookup table For the purposes of this document, secret shares, weights, or lookup table parameters for encoded features are generally represented by brackets with a subscript indicating which MPC computing system is assigned the secret share.

[0077] The first MPC computing system may integrate the first embedding lookup table with the first share of the encoded weight vector Multiply, that is, Similarly, the second MPC computing system may embed the second lookup table with the second share of the encoded weight vector Multiply, that is, The result of the two multiplications is two secret shares of the K-dimensional embedding held by MPC1 and MPC2 respectively. and The MPC computation system collaboratively obtains an embedding of the feature vector. The combination of embeddings is described in more detail below.

[0078] The MPC computing system (e.g., MPC1 and MPC2) can compute partial predictions (216 and 218) based on the embedded secret shares. For the machine learning models described in this document, the system can use the following analytical formula to determine the model prediction:

[0079]

[0080] in is the i-th feature The generated embedding, and is for the i-th feature Model predictions. The formula is comparable for a feedforward neural network with the following properties. First, the neural network has three layers, e.g., an input layer for processing input features, a hidden layer for generating hidden states (embeddings) of the input features, and an output layer for generating model predictions for the embeddings. Additionally, the neural network may include an embedding lookup table that is trainable using training examples. Furthermore, the hidden layer may have fixed weight values ​​(all 1s) for all nodes in the hidden layer. These fixed weight values ​​are constant during the training process. The node activation function of the hidden layer may be an exponential function, e.g., natural exponentiation. Additionally, the output layer of the neural network has learnable weights and .

[0081] In view of this, the first MPC computing system MPC1 generates the share for embedding using equation (2): The first part of the model predicts Similarly, the second MPC computing system MPC1 generates the shares for the embedding using equation (2) The second part of the model predicts .

[0082] The secure MPC cluster 130 may obtain partial predictions from different MPC computing systems (MPC1 and MPC2) to generate a final prediction for the i-th feature (220). To combine the partial predictions, due to the property of the exponential function, i.e., , the system can convert multiplication operations into addition operations. By using the described system to convert multiplication operations into addition operations, a lot of computing power and time can be saved for processing inputs using the corresponding machine learning model, especially for huge models with a lot of input data. An example algorithm for combining partial predictions into a final prediction is described as follows:

[0083] Assume that MPC1 holds the conversion factor , and MPC1 maintains the conversion factor ,in These coefficients can be calculated offline before training and using the machine learning model within the MPC computing environment.

[0084] Although MPC computing systems do not typically communicate secret shares of the encoded features to each other, MPC1 and MPC2 can transmit embedded functions (or partial predictions) to each other to determine the final prediction. In other words, in some cases, MPCs can communicate "encoded" partial predictions. For example, MPC1 can sent to MPC2, and MPC2 can Based on the data communicated, MPC1 calculates , and MPC2 calculates In this case, each MPC computing system can obtain the final output based on the modified partial predictions from other MPC computing systems. Modifying partial predictions so that no MPC computing system knows the exact partial predictions from other MPCs protects data security. In some implementations, the secure MPC cluster 130 can be implemented by using a secure processor (e.g., Figure 1 The security processor 140 of the MPC cluster combines the partial predictions from MPC1 and MPC2 to obtain the final prediction. In some implementations, one or more MPC computing systems of the MPC cluster can generate the final prediction by combining the "encoded" specific predictions received from other MPC computing systems. An example algorithm for combining partial predictions is represented as follows:

[0085]

[0086] Additionally, for MPC computing systems that natively support integer arithmetic but not fractional (non-integer) values, the system (e.g. Figure 1 The system 100 or the MPC computing system or secure MPC cluster 130 in the system 100 may implement fixed-point arithmetic to convert fractional values ​​to integers. For example, given the fractional number 0.125, the system may amplify it by 16384 times and represent the fractional number as 2048. In this example, the system may convert the fixed-point value (e.g., 2048) back to its actual value (e.g., 0.125) by dividing the fixed-point value (e.g., 2048) by 16384.

[0087] In some implementations, client device 110 may transmit a request for content to content provider 280 (224). For example, application 112 may transmit a request for a digital component to content platform 150 in response to loading an electronic resource having a digital component slot. The request may be sent to the system over the network along with or after a request to process the encoded user input feature.

[0088] Content provider 280 may determine content that the user may be interested in. For example, content platform 280 may select a digital component based on the final prediction and provide the digital component to application 112 (226). In some implementations, content platform 150 cooperates with application 112 to select the digital component based on the final prediction.

[0089] In some cases, the client device 110 may receive a partial prediction from the MPC computing system and generate a final prediction based on the partial prediction for the input features. The client device 110 may use the final prediction to request digital content from the content provider 280. In some implementations, the final prediction may include the digital content. In this case, the partial prediction may include a share of data identifying the digital content or a secret share of the digital content.

[0090] The client device may display the content on a display (228). For example, application 112 may display the received digital component in a digital component slot of the electronic resource. In some cases, the system may provide the final prediction to application 112 on client device 110 for use in one or more downstream streaming operations (e.g., face unlocking, image processing, or other suitable tasks).

[0091] Example procedure for performing inference operations on a machine learning model

[0092] Figure 3 is a flow chart illustrating an example process 300 for performing inference operations of a machine learning model to process input features using multiple MPC computing systems. The operations of process 300 may be implemented by a client device and a secure MPC cluster, for example, by Figure 1 The client device 110 is implemented, for example, by one or more processors on the client device 110, and by Figure 1 The operations of process 300 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 300.

[0093] A client device of the system identifies a request for a feature to be processed by a machine learning model within an MPC environment (302). The client device may receive a request issued from an application 112 installed on the client device. In some cases, the client device may issue a request. The input features may include features of events or data associated with a user when the user uses an application. The features may be at least a subset of all features associated with the client device or a user using or owning the device, and the features may include raw log data or data derived from the raw log data. As described above, the features may be in a variety of forms, such as scalar, vector, or tensor form. For example, a feature may be constructed as an input feature vector having a sequence of M features. M is a positive integer, which may be 5, 10, 15, 20, or other suitable number. Features may include numerical features, categorical features, or ordinal features. The MPC environment may include multiple MPC computing systems (e.g., Figure 1MPC1 and MPC2). The MPC environment can be implemented as a secure MPC cluster with multiple MPC computing systems.

[0094] The client device encodes each feature of the input feature vector (304). Generally, the client device uses different encoding techniques to generate an encoded weight vector according to different characteristics of the input feature vector. For example, the client device may use a one-hot encoding technique to encode the categorical features to generate a weight vector, and each position of the weight vector corresponds to a possible value of the categorical feature. As another example, the client device may use three-hot encoding or four-hot encoding to encode the digital features to generate the weight vector.

[0095] In order to encode the feature into a weight vector, the client device first determines the fixed node sequence of the input feature vector through a quantile process. The number of fixed nodes is K+1, and each node includes a pair of a fixed digital feature and a fixed embedding of the digital feature. Two adjacent fixed nodes form a bucket, so that the fixed nodes can form a sequence of K buckets.

[0096] The client device allocates the digital features of the input feature vector into corresponding buckets based on the digital feature values ​​and the positions of the bucket sequences.

[0097] The client device uses an interpolation technique (e.g., cubic interpolation) to represent the digital features as a weighted sum of three or four fixed embeddings associated with the corresponding bucket. More specifically, for the digital features that fall into the leftmost or rightmost bucket in the bucket sequence, the client device will use three-hot encoding. For the digital features that fall into other buckets far from the two end buckets of the bucket sequence, the client device will use four-hot encoding.

[0098] The client device generates an encoded weight vector of the digital feature based on a plurality of weight values ​​in the weighted sum. The weight vector may include a corresponding weight value in each of three or four consecutive positions of the weight vector. These weight values ​​correspond to embedded nodes of the embedded node sequence for interpolating the digital feature. Figure 2 Example details for encoding features at a client device are described.

[0099] While the quantile process can be learned when training a machine learning model in an MPC environment, the system (e.g., a client device) can refine the quantiles when performing inference operations of the machine learning model. Figure 5 Example details of the process of refining quantiles are described.

[0100] The client device generates a corresponding secret share of the encoded weight vector for each MPC computing system in the plurality of MPC computing systems (306). The corresponding secret shares may form an encoded weight vector. For example, the client device may split an encoded weight vector in the plurality of encoded weight vectors into two secret shares. The first secret share may be assigned to the first MPC computing system, and the second secret share may be assigned to the second MPC computing system. The two secret shares are additive so that when the two secret shares are combined in a particular manner, the original encoded weight vector is reconstructed. The process of generating secret shares for different MPC computing systems may be performed using a standard MPC protocol.

[0101] The client device provides each of the corresponding secret shares of the encoded weight vector to a corresponding computing system in the plurality of MPC computing systems to generate a corresponding partial prediction for the corresponding secret share (308). To generate the corresponding partial prediction, the corresponding MPC computing system may process the secret share of the encoded feature (e.g., weight vector) using a corresponding embedded lookup table. Figure 2 Describes the details of the process and combines Figure 4 Again outline the details of the process.

[0102] The particular MPC computing system may receive modified partial predictions from the remaining MPC computing systems in the plurality of MPC computing systems (310). As described above, each MPC computing system may modify or encode its own partial predictions using corresponding coefficients (e.g., a), and the particular MPC computing system (e.g., MPC1) may receive modified partial predictions from other MPC computing systems to generate a final prediction. The use of modified or encoded partial predictions may prevent leakage of secure data across different MPC computing systems. In some cases, a secure MPC cluster (or more precisely, a secure processor in a secure MPC cluster) may collect modified partial predictions from different MPC computing systems. The secure processor includes a particular privacy mechanism so that no data leakage will occur when collecting partial predictions from the MPC computing systems. In some implementations, a client device may collect partial predictions from multiple MPC computing systems to obtain a final prediction more quickly.

[0103] The particular MPC computing system may generate a final prediction for the input based on the modified partial predictions from the other MPC computing systems (312). In some cases, the safety processor in the safety MPC cluster is configured to determine the final prediction for the partial predictions during the inference operation. The safety processor may combine the partial predictions in an additive manner. Figure 2 Example details of the combination are described.

[0104] Figure 4 4 is a flow chart illustrating an example process 400 for generating a partial prediction for a secret share assigned to a particular MPC computing system. The operations of process 400 may be implemented by an MPC computing system in a secure MPC cluster, for example, by Figure 1 The operations of process 400 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of process 400.

[0105] The MPC computing system receives data representing a trained lookup table (402). For example, Figure 1 The MPC1 can receive data representing a trained lookup table. The data representing the trained lookup table can be stored in a memory within the system or external to the system or both. During training of a machine learning model using the MPC computing system, a trained lookup table is created and trained for an embedding layer of the machine learning model. The trained lookup table includes data representing shares of embeddings corresponding to shares of encoded features assigned to the MPC computing system. The embedding lookup table is trained using training examples within the MPC environment. Each row or column of the embedding lookup table includes a sequence of values ​​representing an embedding of a node in a sequence of nodes for a quantile process. In combination Figure 2 The details of the fractional digit process are described. Figure 5 Updating or refining the quantile process to determine knot locations is described.

[0106] The MPC computing system also receives the corresponding secret share of the encoded feature and processes the received secret share using the trained lookup table to generate a partial embedding vector (404). An example process of processing the encoded feature may be a multiplication of the trained lookup table with the secret share of the weight vector. Figure 2 An example detailed process for performing multiplication is described.

[0107] The MPC computing system also processes the partial embedding vector using the trained machine learning model to generate a partial prediction (406). As described above, the MPC computing system can use an analytical formula to generate a partial prediction for the embedded share. The formula corresponds to a specific feedforward neural network, for example, all data flows in the same direction. The specific neural network may include an input layer for processing input features, a hidden layer for processing the input data to generate an embedding (or hidden state) of the input data, and an output layer for generating a prediction for the embedding. The node weights of all nodes in the hidden layer are set to a value of 1 and remain unchanged during training. The node activation function of each node in the hidden layer is an exponential function, for example, a natural exponential function , or other suitable exponential functions. However, for exponential functions different from the natural exponential function , the analytical formula is enlarged or reduced by the factors of the logarithmic function based on the exponential function base a and the Euler number e. Combined with Figure 2 The analytical formula and the corresponding neural network structure are described in more details.

[0108] Example procedure for training a machine learning model

[0109] Figure 5 is a flow chart illustrating an example process 500 for training a machine learning model based on training examples using multiple MPC computing systems. The operations of process 500 may be performed, for example, by Figure 1 The process 500 may be implemented by the MPC cluster 130, or more specifically, by the security processor 140 in the cluster 130. The operations of the process 500 may also be implemented as instructions stored on one or more computer-readable media that may be non-transitory, and the execution of the instructions by one or more data processing devices may cause the one or more data processing devices to perform the operations of the process 500.

[0110] The security processor receives a plurality of training feature vectors as training examples (502). Each training feature vector has a sequence of M features, where M can be 5, 10, 14, 19, or other suitable numbers. The features can include numerical features and categorical features. The security processor can convert the numerical features into categorical features, such as by combining Figure 2 As described.

[0111] For each of the plurality of training feature vectors, a secure processor in the secure MPC cluster generates a final prediction using a machine learning model through a plurality of multi-party computation (MPC) computing systems. The process for generating the final prediction for the training feature vector includes the following steps.

[0112] For the training feature vector, the security processor generates a plurality of encoded weight vectors for the training feature vector (504). Each of the plurality of encoded weight vectors corresponds to a feature in the training feature vector. Figure 2 The encoding techniques described are similar. However, in the training step, the quantile process is also under training, so the position of the fixed node sequence is changeable during the training process, which also affects the interpolation results under the encoding process. The details of updating or refining the quantile are described below.

[0113] The security processor generates a secret share of the encoded weight vector for each computing system in the plurality of MPC computing systems (506). For example, the security processor may generate a secret share of the encoded weight vector for a first MPC computing system (e.g., Figure 1MPC1) generates a first secret share of the encoded weight vector, and a second MPC computing system (e.g., Figure 1 MPC2) generates the second secret share of the encoded weight vector. It can be followed by combining Figure 2 The splitting process is performed using secure MPC protocols similar to those described.

[0114] The security processor provides a corresponding secret share to each corresponding MPC computing system in a plurality of MPC computing systems (508). The corresponding computing system uses a machine learning model deployed in the MPC computing system to generate a corresponding partial prediction for the corresponding secret share. The partial prediction is generated using the current model parameters of the machine learning model. The current model parameters are under update during the training process. The general process for processing the corresponding secret share using the embedding lookup table is similar to the inference step described above, for example, the multiplication process between the share of the embedding lookup table and the secret share of the encoded feature. However, the embedding lookup table is also under training, so the parameters in the lookup table (e.g., the embedding value) are inaccurate and are under joint update during the training process. After obtaining the embedding, the system can use an analytical formula to determine the partial prediction. However, the coefficients and is changeable during the training process. Although each MPC computing system may have a different model instance (e.g., different embedding values ​​for the embedding lookup table, and different coefficients for the formula used in each MPC computing system), the model structure is essentially the same. Therefore, for the purpose of simplicity and ease of illustration, the training process described in this document is based on a single machine learning model.

[0115] The security processor receives partial predictions from multiple MPC computing systems (510) and then generates a final prediction based on the corresponding partial predictions received from the multiple MPC computing systems (512). The process of combining the partial predictions into a final prediction is the same as the inference application (see equation (3)). The coefficient a used for the combination is predetermined offline and is not updated during the training process.

[0116] The security processor updates model parameters of the machine learning model by optimizing a loss function for a final prediction and a reference prediction for each of the plurality of training feature vectors (514). A general loss function measures the cumulative error or difference between the model prediction and the reference prediction for the training input. An example loss function may be expressed as , where the term is determined according to equation (3) , and the item Represents a reference forecast.

[0117] To update the model parameters, the secure processor can perform a stochastic gradient descent technique during back-propagation. Therefore, it is important to compute the gradient correctly.

[0118] For regression tasks, the loss function can be the mean square error function, which can be expressed as follows:

[0119]

[0120] Among them is a function of the ith feature vector for the N training examples, and the term represents the reference of the i-th eigenvector. The gradient can be calculated as follows:

[0121]

[0122]

[0123] The gradient of each embedding can be calculated using the chain rule, i.e.,

[0124]

[0125] For binary classification, the loss function can be the sigmoid cross entropy function, which can be expressed as follows:

[0126]

[0127] in is the sigmoid function, and the term is the logit or the i-th eigenvector. Given the derivative of the sigmoid function with respect to logit, returns The training process on the MPC computing system can be implemented through the following two stages.

[0128] At the first stage, the system performs forward propagation during training, and each of the multiple MPC computing systems caches the result of the sigmoid function for the feature vector x.

[0129] At the second stage, the system starts to perform back propagation. Multiple MPC computing systems use Beaver's triplet algorithm to calculate the derivative of the sigmoid function, that is, Each MPC computing system can calculate the coefficients and gradient.

[0130] Typically, the safety processor repeatedly updates the model parameters until a stopping point is reached. The stopping point may include the model parameters satisfying a convergence criterion, reaching a predetermined number of iterations, reaching a predetermined time limit, or other suitable stopping points.

[0131] Model parameters can include multiple weights, such as coefficients, for the output layer of a machine learning model. and The model parameters may also include a dimension K of the embedding vector, and parameters of a corresponding lookup table in each of the plurality of MPC computing systems.

[0132] To update or refine the quantiles, the security processor may first determine an initial set of buckets based on the initial data histogram. The initial set of buckets may be determined via transfer learning (e.g., the trained bucket parameters of a pre-trained model). In such cases, the security processor may calculate a high-resolution histogram of the digital features of the agreed user data, and generate an initial set of buckets for users who disagree with the use of specific data based on the high-resolution histogram. In some implementations, the security processor may estimate a high-resolution histogram via common sense (e.g., human age is typically between 0 and 120 years old) and domain knowledge (e.g., local temperature is typically between -20°C and 40°C).

[0133] Based on the initial bucket set, the system generates corresponding secret shares of multiple encoded weight vectors of multiple training feature vectors, and provides the corresponding secret shares to corresponding computing systems in multiple MPC computing systems to generate corresponding partial predictions. The security processor then generates a final prediction based on the corresponding partial predictions received from the multiple MPC computing systems. These steps are substantially similar to the training steps described above.

[0134] After obtaining the final prediction, the security processor generates an updated data histogram based on the final prediction. More specifically, the security processor can generate an updated high-resolution histogram and infer appropriate quantiles from the updated histogram. In some cases where the high-resolution histogram is not privacy or security sensitive (e.g., age distribution at annual granularity for a large enough population), the MPC computing system can reconstruct the updated histogram in plain text and infer appropriate quantiles from the plain text.

[0135] The safety processor updates the fixed node sequence based on the updated data histogram. The safety processor may repeatedly perform the above steps to update or refine the quantile process until a stopping point is reached. The stopping point may include a condition where the model parameters meet a convergence criterion, a predetermined number of iterations is reached, a predetermined time limit is reached, or other suitable conditions.

[0136] Figure 66 is a block diagram of an example computer system 600 that can be used to perform the operations described above. System 600 includes a processor 610, a memory 620, a storage device 630, and an input / output device 640. Each of components 610, 620, 630, and 640 can be interconnected, for example, using a system bus 650. Processor 610 is capable of processing instructions for execution within system 600. In some implementations, processor 610 is a single-threaded processor. In another implementation, processor 610 is a multi-threaded processor. Processor 610 is capable of processing instructions stored in memory 620 or on storage device 630.

[0137] The memory 620 stores information within the system 600. In one implementation, the memory 620 is a computer-readable medium. In some implementations, the memory 620 is a volatile memory unit. In another implementation, the memory 620 is a non-volatile memory unit.

[0138] The storage device 630 can provide mass storage for the system 600. In some implementations, the storage device 630 is a computer-readable medium. In various implementations, the storage device 630 may include, for example, a hard disk device, an optical disk device, a storage device shared by multiple computing devices over a network (e.g., a cloud storage device), or some other mass storage device.

[0139] The input / output device 640 provides input / output operations for the system 400. In one implementation, the input / output device 640 may include one or more of the following: a network interface device, such as an Ethernet card; a serial communication device, such as an RS-232 port; and / or a wireless interface device, such as an 802.11 card. In another implementation, the input / output device may include a driver device configured to receive input data and send output data to other devices, such as a keyboard, a printer, a display, and other peripheral devices 660. However, other implementations may also be used, such as a mobile computing device, a mobile communication device, a set-top TV client device, etc.

[0140] Although already Figure 6 An example processing system is described in the specification, but the subject matter and implementation of the functional operations described in this specification may be implemented in other types of digital electronic circuit systems, or in computer software, firmware or hardware including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of them.

[0141] The subject matter and the embodiments of the operation described in this specification can be implemented in a digital electronic circuit system, or in a computer software, firmware or hardware including the structure disclosed in this specification and its structural equivalent, or in a combination of one or more of them. The embodiments of the subject matter described in this specification can be implemented as one or more computer programs, that is, one or more modules of computer program instructions, which are encoded on multiple computer storage media (or one computer storage medium) for data processing equipment to execute or control the operation of data processing equipment. Alternatively or additionally, the program instructions can be encoded on an artificially generated propagation signal, for example, a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device for data processing equipment to execute. The computer storage medium can be the following or included in the following: a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. In addition, although the computer storage medium is not a propagation signal, the computer storage medium can be the source or destination of the computer program instructions encoded in the artificially generated propagation signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (eg, multiple CDs, disks, or other storage devices).

[0142] The operations described in this specification may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0143] The term "data processing equipment" encompasses all types of equipment, devices and machines for processing data, including, for example, a programmable processor, a computer, a system on a chip, or a plurality of the foregoing or a combination of the foregoing. The equipment may include a dedicated logic circuit system, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the equipment may also include code for creating an execution environment for the computer program involved, for example, code constituting a processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more of them. The equipment and execution environment may implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

[0144] A computer program (also referred to as a program, software, software application, script, or code) may be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages; and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or portions of code). A computer program may be deployed to execute on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0145] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by special-purpose logic circuit systems, and the device can also be implemented as a special-purpose logic circuit system, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0146] Processors suitable for executing computer programs include, for example, both general-purpose microprocessors and special-purpose microprocessors. In general, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Typically, the computer will also include one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or will be operatively coupled to receive data from the one or more mass storage devices or transfer data to the one or more mass storage devices, or both. However, the computer does not have to have such devices. In addition, the computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name a few. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0147] To provide interaction with a user, embodiments of the subject matter described in this specification may be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, and a keyboard and a pointing device such as a mouse or trackball through which the user can provide input to the computer. Other kinds of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including sound, voice, or tactile input. In addition, the computer may interact with the user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0148] Embodiments of the subject matter described in this specification may be implemented in a computing system that includes a back-end component, such as a data server, or includes a middleware component, such as an application server, or includes a front-end component, such as a client computer with a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication, such as a communication network. Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), interconnected networks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0149] A computing system may include a client and a server. The client and server are usually remote from each other and typically interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML web page) to a client device (e.g., for the purpose of displaying data to a user interacting with the client device and receiving user input from the user). Data generated at the client device (e.g., the result of a user interaction) may be received at the server from the client device.

[0150] Although this specification contains many specific implementation details, these details should not be interpreted as limitations on the scope of any invention or the scope that may be claimed, but should be interpreted as descriptions of features that are peculiar to a particular embodiment of a particular invention. Certain features described in the context of a separate embodiment in this specification may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. In addition, although features may be described above as working in certain combinations and even initially claimed as such, one or more features from the claimed combination may be deleted from the combination in some cases, and the claimed combination may involve a sub-combination or a change in the sub-combination.

[0151] In addition to the embodiments described above, the following embodiments are also innovative:

[0152] Embodiment 1 is a method performed by one or more computers, the method comprising: identifying at a client device a request to process an input feature vector using a multi-party computing (MPC) cluster including multiple MPC computing systems through a machine learning model, the input feature vector having a sequence of M features; for each feature in the input feature vector, encoding the feature according to characteristics of the input feature vector by the client device to generate an encoded weight vector; generating, by the client device, a corresponding share of the encoded weight vector for each computing system in the multiple MPC computing systems; providing, by the client device, each corresponding share of the encoded weight vector to a corresponding computing system in the multiple MPC computing systems to generate a corresponding partial prediction for the corresponding share; collecting, by the MPC cluster, modified partial predictions for the input feature vector from the multiple MPC computing systems, wherein each of the modified partial predictions is generated by a corresponding MPC computing system based on the corresponding partial prediction; and generating, by the MPC cluster, a final prediction for the input feature vector corresponding to the request based on the corresponding partial predictions.

[0153] Embodiment 2 is a method according to embodiment 1, wherein the respective shares of the encoded weight vector are additive and the respective shares form the encoded weight vector encoded from the input feature vector.

[0154] Embodiment 3 is a method according to embodiment 1 or 2, wherein generating a corresponding partial prediction for the corresponding share includes: receiving data representing a trained lookup table at a first computing system among the multiple MPC computing systems, wherein the trained lookup table includes a first share of an embedding of a corresponding encoded weight vector; using the trained lookup table to process the corresponding share provided to the first computing system to generate a partial embedding vector, the partial embedding vector having a sequence of K features; and using a trained machine learning model to process the partial embedding vector to generate a partial prediction for the input feature vector.

[0155] Embodiment 4 is a method according to any one of embodiments 1 to 3, wherein the characteristics of the input feature vector include characteristics of each feature in the input feature vector, and wherein each feature in the input feature vector is a numerical feature or a categorical feature.

[0156] Embodiment 5 is a method according to embodiment 3, wherein generating an encoded weight vector according to the characteristics of the input feature vector includes: if the input feature vector includes a categorical feature sequence, for each categorical feature in the categorical feature sequence, encoding the categorical feature using a one-hot vector or a distributed point function to generate the encoded weight vector; and if the input feature vector includes a digital feature sequence, for each digital feature in the digital feature sequence, encoding the digital feature using four-hot encoding or three-hot encoding.

[0157] Embodiment 6 is a method according to embodiment 5, wherein for each digital feature located at both ends of the digital feature sequence included in the input feature vector, three-hot encoding is used to encode the digital feature.

[0158] Embodiment 7 is a method according to embodiment 5 or 6, wherein for each digital feature located away from both ends of the digital feature sequence included in the input feature vector, four-hot encoding is used to encode the digital feature.

[0159] Embodiment 8 is a method according to any one of embodiments 1 to 7, wherein the input feature vector includes a sequence of digital features, wherein generating an encoded weight vector according to the characteristics of the input feature vector includes: determining a fixed node sequence of the input feature vector through a quantile process, wherein the number of fixed nodes is K+1, and each node includes a pair of a fixed digital feature and a fixed embedding of the fixed digital feature, wherein two adjacent fixed nodes form a bucket; assigning the digital features of the input feature vector to corresponding buckets; representing the digital features as a weighted sum of three or four fixed embeddings associated with the corresponding bucket; and generating the encoded weight vector based on multiple weight values ​​in the weighted sum.

[0160] Embodiment 9 is a method according to embodiment 8, further comprising updating the fixed node sequence, including: determining an initial bucket set based on an initial data histogram; determining corresponding shares of multiple encoded weight vectors of multiple input feature vectors; providing the corresponding shares to corresponding computing systems among the multiple MPC computing systems to generate corresponding partial predictions; generating the final prediction based on the corresponding partial predictions; generating an updated data histogram based on the final prediction; and updating the fixed node sequence based on the updated data histogram.

[0161] Embodiment 10 is a method according to any one of embodiments 1 to 9, wherein generating the final prediction for the input feature vector by the MPC cluster includes: adding the modified partial predictions from the multiple MPC computing systems by a processor of a particular MPC computing system or MPC cluster.

[0162] Embodiment 11 is a method according to embodiment 3, wherein the trained machine learning model comprises: an input layer, the input layer being used to receive input data; a hidden layer, the hidden layer being used to process the input data to generate an embedding of the input data; and an output layer, the output layer being used to generate predictions for the embedding.

[0163] Embodiment 12 is a method according to embodiment 11, wherein the node weights of all nodes in the hidden layer are set to 1 and remain unchanged during training.

[0164] Embodiment 13 is a method according to embodiment 11 or 12, wherein the node activation function of each node in the hidden layer is an exponential function.

[0165] Embodiment 14 is a system comprising: one or more processors; and one or more storage devices storing instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform a method according to any of the foregoing embodiments.

[0166] Embodiment 15 is a computer-readable storage medium carrying instructions, which, when executed by one or more processors, cause the one or more processors to perform a method according to any one of embodiments 1 to 13.

[0167] Embodiment 16 is a computer program product, which includes instructions, which, when executed by a computer, cause the computer to perform the steps of the method according to any one of embodiments 1 to 13.

[0168] Embodiment 17 is a computer-implemented method, the method comprising: receiving a plurality of training feature vectors as training examples, each training feature vector having a sequence of M features; for each of the plurality of training feature vectors, using a machine learning model to generate a final prediction through a plurality of multi-party computing (MPC) computing systems, comprising: for the training feature vector, generating an encoded weight vector of the training feature vector; each encoded weight vector corresponds to each feature in the training feature vector; generating a share of the encoded weight vector for each computing system in the plurality of MPC computing systems; for each computing system in the plurality of MPC computing systems, providing a corresponding share to the computing system to use the machine learning model to generate a corresponding partial prediction for the corresponding share; generating the final prediction based on the corresponding partial predictions from the plurality of MPC computing systems; and for each of the plurality of training feature vectors, updating the model parameters of the machine learning model by reducing the loss determined from the loss function used for the final prediction and the reference prediction.

[0169] Embodiment 18 is a method according to embodiment 17, wherein the loss function is mean square error (MSE) or sigmoid cross entropy function.

[0170] Embodiment 19 is a method according to embodiment 17 or 18, wherein generating a corresponding partial prediction for the corresponding share includes: receiving data representing a corresponding lookup table at a first computing system among the multiple MPC computing systems, wherein the lookup table includes a first share of an embedding of a corresponding encoded weight vector; using the lookup table to process the corresponding share provided to the first computing system to generate a partial embedding vector, the partial embedding vector having a sequence of K features; and using the machine learning model to process the partial embedding vector to generate a partial prediction for the training feature vector.

[0171] Embodiment 20 is a method according to embodiment 19, wherein the model parameters include multiple weights for the output layer of the machine learning model, the dimension K for the embedding vector, and the parameters of the corresponding lookup table in each of the multiple MPC computing systems.

[0172] Embodiment 21 is a method according to any one of embodiments 17 to 20, wherein the training feature vector comprises a sequence of digital features, wherein generating the encoded weight vector comprises: determining a fixed node sequence of the training feature vector by a quantile process, wherein the number of fixed nodes is K+1, and each node comprises a pair of a fixed digital feature and a fixed embedding of the fixed digital feature, wherein two adjacent fixed nodes form a bucket; assigning the digital features of the training feature vector to corresponding buckets; representing the digital features as a weighted sum of three or four fixed embeddings associated with the corresponding bucket; and generating the encoded weight vector based on multiple weight values ​​in the weighted sum.

[0173] Embodiment 22 is a method according to embodiment 21, further comprising updating the fixed node sequence, including: determining an initial bucket set based on an initial data histogram; determining corresponding shares of multiple encoded weight vectors of multiple training feature vectors; providing the corresponding shares to corresponding computing systems among the multiple MPC computing systems to generate corresponding partial predictions; generating the final prediction based on the corresponding partial predictions; generating an updated data histogram based on the final prediction; and updating the fixed node sequence based on the updated data histogram.

[0174] Embodiment 23 is a method according to any one of embodiments 17 to 22, wherein the machine learning model comprises: an input layer, the input layer being used to receive input data; a hidden layer, the hidden layer being used to process the input data to generate an embedding of the input data; and an output layer, the output layer being used to generate predictions for the embedding.

[0175] Embodiment 24 is a system comprising: one or more processors; and one or more storage devices storing instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform a method according to any one of embodiments 17 to 23.

[0176] Embodiment 25 is a computer-readable storage medium that carries instructions that, when executed by one or more processors, cause the one or more processors to perform a method according to any one of Embodiments 17 to 23.

[0177] Embodiment 26 is a computer program product, which includes instructions, which when executed by a computer cause the computer to perform the steps of the method according to any one of embodiments 17 to 23.

[0178] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a sequential order, or that all illustrated operations be performed to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous. In addition, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0179] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions set forth in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous.

Claims

1. A computer-implemented method comprising: identifying, at a client device, a request to process an input feature vector having a sequence of M features with a machine learning model using a multi-party computation (MPC) cluster comprising a plurality of MPC computing systems; For each feature of the input feature vector, the client device encodes the feature according to a characteristic of the input feature vector to generate an encoded weight vector; generating, by the client device, a respective share of the encoded weight vector for each computing system in the plurality of MPC computing systems; providing, by the client device, each respective share of the encoded weight vector to a corresponding computing system of the plurality of MPC computing systems to generate a respective partial prediction for the respective share; collecting, by the MPC cluster, modified partial predictions for the input feature vector from the plurality of MPC computing systems, wherein each of the modified partial predictions is generated by a corresponding MPC computing system based on the respective partial prediction; as well as A final prediction for the input feature vector corresponding to the request is generated by the MPC cluster based on the corresponding partial predictions.

2. The method of claim 1, wherein the respective shares of the encoded weight vector are additive and the respective shares form the encoded weight vector encoded from the input feature vector.

3. The method according to claim 1 or 2, wherein generating the respective partial forecast for the respective share comprises: receiving, at a first computing system of the plurality of MPC computing systems, data representing a trained lookup table, wherein the trained lookup table includes a first share of an embedding of a corresponding encoded weight vector; Processing the corresponding share provided to the first computing system using the trained lookup table to generate a partial embedding vector having a sequence of K features; as well as The partial embedding vector is processed using a trained machine learning model to generate a partial prediction for the input feature vector.

4. A method according to any preceding claim, wherein the characteristics of the input feature vector comprise characteristics of each feature in the input feature vector, and wherein each feature in the input feature vector is a numerical feature or a categorical feature.

5. The method of claim 3, wherein generating an encoded weight vector according to the characteristics of the input feature vector comprises: If the input feature vector includes a categorical feature sequence, for each categorical feature in the categorical feature sequence, encoding the categorical feature using a one-hot vector or a distributed point function to generate the encoded weight vector; and If the input feature vector includes a sequence of digital features, for each digital feature in the sequence of digital features, four-hot encoding or three-hot encoding is used to encode the digital feature. 6 . The method according to claim 5 , wherein for each digital feature located at both ends of the digital feature sequence included in the input feature vector, the digital feature is encoded using three-hot encoding. 7 . The method according to claim 5 , wherein for each digital feature located away from both ends of the digital feature sequence included in the input feature vector, four-hot encoding is used to encode the digital feature.

8. A method according to any preceding claim, wherein the input feature vector comprises a sequence of digital features, wherein generating an encoded weight vector according to the characteristics of the input feature vector comprises: Determining a fixed node sequence of the input feature vector by a quantile process, wherein the number of fixed nodes is K+1, and each node includes a pair of a fixed digital feature and a fixed embedding of the fixed digital feature, wherein two adjacent fixed nodes form a bucket; Assigning the digital features of the input feature vector to corresponding buckets; representing the digital feature as a weighted sum of three or four fixed embeddings associated with the corresponding bucket; and The encoded weight vector is generated based on a plurality of weight values ​​in the weighted sum.

9. The method according to claim 8, further comprising updating the fixed node sequence, comprising: Determine an initial set of buckets based on an initial data histogram; determining respective shares of a plurality of encoded weight vectors for a plurality of input feature vectors; providing the respective shares to corresponding computing systems of the plurality of MPC computing systems to generate respective partial predictions; generating the final prediction based on the corresponding partial predictions; generating an updated data histogram based on the final prediction; as well as The fixed node sequence is updated based on the updated data histogram.

10. The method of any preceding claim, wherein generating, by the MPC cluster, the final prediction for the input feature vector comprises: The modified partial predictions are added from the plurality of MPC computing systems using a particular MPC computing system or processor of the MPC cluster.

11. A method according to any preceding claim, wherein the trained machine learning model comprises: An input layer, the input layer is used to receive input data; a hidden layer, the hidden layer being used to process the input data to generate an embedding of the input data; as well as An output layer for generating predictions for the embeddings.

12. The method of claim 11, wherein the node weights of all nodes in the hidden layer are set to 1 and remain unchanged during training.

13. The method of claim 11, wherein the node activation function of each node in the hidden layer is an exponential function.

14. A system comprising: one or more processors; as well as One or more storage devices storing instructions which, when executed by the one or more processors, cause the one or more processors to perform a method according to any preceding claim.

15. A computer-readable storage medium carrying instructions which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 13.

16. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 13.

17. A computer-implemented method comprising: Receiving a plurality of training feature vectors as training examples, each training feature vector having a sequence of M features; For each of the plurality of training feature vectors, generating a final prediction using a machine learning model through a plurality of multi-party computation (MPC) computing systems, including: for the training feature vector, Generating encoded weight vectors for the training feature vectors; each encoded weight vector corresponds to each feature in the training feature vector; generating a share of the encoded weight vector for each computing system in the plurality of MPC computing systems; for each computing system in the plurality of MPC computing systems, providing a corresponding share to the computing system to generate a respective partial prediction for the corresponding share using the machine learning model; generating the final prediction based on the respective partial predictions from the plurality of MPC computing systems; and For each training feature vector in the plurality of training feature vectors, a model parameter of the machine learning model is updated by reducing a loss determined from a loss function for the final prediction and a reference prediction.

18. The method according to claim 17, wherein the loss function is a mean square error (MSE) or a sigmoid cross entropy function.

19. The method of claim 17 or 18, wherein generating a respective partial forecast for the corresponding share comprises: receiving, at a first computing system of the plurality of MPC computing systems, data representing a respective lookup table, wherein the lookup table includes a first share of an embedding of a corresponding encoded weight vector; processing the corresponding share provided to the first computing system using the lookup table to generate a partial embedding vector, the partial embedding vector having a sequence of K features; as well as The partial embedding vector is processed using the machine learning model to generate a partial prediction for the training feature vector.

20. The method of claim 19, wherein the model parameters include a plurality of weights for an output layer of the machine learning model, a dimension K for an embedding vector, and parameters of the corresponding lookup table in each of the plurality of MPC computing systems.

21. The method of any one of claims 17 to 20, wherein the training feature vector comprises a sequence of digital features, wherein generating an encoded weight vector comprises: Determining a fixed node sequence of the training feature vector by a quantile process, wherein the number of fixed nodes is K+1, and each node includes a pair of a fixed digital feature and a fixed embedding of the fixed digital feature, wherein two adjacent fixed nodes form a bucket; Allocating the digital features of the training feature vector into corresponding buckets; representing the digital feature as a weighted sum of three or four fixed embeddings associated with the corresponding bucket; and The encoded weight vector is generated based on a plurality of weight values ​​in the weighted sum.

22. The method according to claim 21, further comprising updating the fixed node sequence, comprising: Determine an initial set of buckets based on an initial data histogram; determining respective shares of a plurality of encoded weight vectors for a plurality of training feature vectors; providing the respective shares to corresponding computing systems of the plurality of MPC computing systems to generate respective partial predictions; generating the final prediction based on the corresponding partial predictions; generating an updated data histogram based on the final prediction; as well as The fixed node sequence is updated based on the updated data histogram.

23. The method of any one of claims 17 to 22, wherein the machine learning model comprises: An input layer, the input layer is used to receive input data; a hidden layer, the hidden layer being used to process the input data to generate an embedding of the input data; as well as An output layer for generating predictions for the embeddings.

24. A system comprising: one or more processors; as well as One or more storage devices storing instructions which, when executed by the one or more processors, cause the one or more processors to perform a method according to any one of claims 17 to 23.

25. A computer-readable storage medium carrying instructions which, when executed by one or more processors, cause the one or more processors to perform the method of any one of claims 17 to 23.

26. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 17 to 23.

Images