Apparatus and method for providing privacy-protected user data for recommendation systems

Abstract

A client device (120) is disclosed for using a service provided by a server (140), in particular a recommended service, based on user data (120d) associated with a user of the client device (120). The client device (120) is configured to apply a first local differential privacy (LDP) mechanism and a second LDP mechanism to the user data (120d) to obtain privacy-protected user data, the first LDP mechanism being an LDP mechanism based on random selection, the second LDP mechanism being an LDP mechanism for adding noise to input data of the LDP mechanism. Furthermore, the client device (120) is configured to transmit the privacy-protected user data to the server (140).

Description

Technical Field

[0001] This invention relates to digital security, and in particular to the privacy of user data. More specifically, this invention relates to apparatus and methods for providing said privacy-preserving user data to a server (especially a recommendation server for generating one or more recommendations based on privacy-preserving user data). Background Technology

[0002] A recommender system (also known as a recommender system) is an online information filtering system that typically provides suggestions for items—those most relevant to a particular user. Suggestions generally refer to various decision-making processes, such as what product to buy, what music to listen to, or what online news to read. Recommender systems are particularly useful when an individual needs to choose from a vast array of items that a service may offer. To determine the most suitable recommendation, such as for online ads tailored to a user, recommender systems typically require user data, such as search history, history of previously clicked ads, user location, user age, user gender, etc., which carries a significant risk of this user data being compromised (i.e., leaked at one or more different stages of the recommendation process).

[0003] Typically, recommender systems employ artificial intelligence (AI), or machine learning (ML) models, such as neural networks, to generate the most suitable recommendations based on user data. These models are trained using training datasets of user data. Several recommendations exist for ensuring the privacy of the training dataset (i.e., data from previous users who have been used to train the recommender system, e.g., data collected from users who consented to the processing of their data). Proposed schemes focus on preventing potential attackers from inferring whether a particular user's data was used to train the recommender system, for example, by using differential private training of the ML model. However, fewer schemes have been proposed for ensuring privacy during the inference phase (i.e., when the trained ML model is deployed and served to new users). During the inference phase, each user sends a request, for example, for advertisements to an advertising recommendation server via their client device. This request includes information about the user, i.e., user data. A potential attacker (e.g., the server itself or an external attacker) could then exploit the sent information to leak / infer private information about the user.

[0004] Therefore, privacy protection schemes are needed for recommender systems (especially the inference phase of recommender systems). Summary of the Invention

[0005] The object of the present invention is to provide an improved apparatus and method for providing the privacy-preserving user data to a server (especially a recommendation server for generating one or more recommendations based on privacy-preserving user data).

[0006] The foregoing and other objectives are achieved through the subject matter claimed in the independent claims. Other implementations are apparent from the dependent claims, the specification, and the drawings.

[0007] According to a first aspect, a client device is provided for using services (especially recommendation services) provided by a server (especially a recommendation server) based on user data associated with a user of the client device. In one implementation, the client device may be user equipment (UE). The client device is used to apply a first local differential privacy (LDP) mechanism and a second LDP mechanism to the user data to obtain privacy-preserving user data. The first LDP mechanism is based on a randomly selected LDP mechanism, and the second LDP mechanism is an LDP mechanism for adding noise to the input data of the LDP mechanism. Furthermore, the client device is used to transmit the privacy-preserving user data to the server.

[0008] The client device described in the first aspect and its various implementations below can: (a) prevent the inference of private user data (sometimes also referred to as attributes) based on the privacy-preserving user data provided to the recommendation server; (b) prevent the inference of private user data based on server-side information, such as one or more selected recommendations or recommendation-user matching scores; (c) maintain high efficiency, i.e., provide meaningful responses, especially recommendations based on the user data; and (d) meet hardware and user experience requirements with acceptable speed, bandwidth, and memory usage.

[0009] In another possible implementation, the server is a recommendation server, and the client device is configured to receive one or more recommendations based on the privacy-preserving user data from the recommendation server in response to transmitting the privacy-preserving user data to the recommendation server. Therefore, the client device according to the first aspect can receive recommendations based on its private user data without the risk of that private user data being leaked.

[0010] In another possible implementation, the client device includes a display for showing the user of the client device the one or more recommendations received from the recommendation server. Therefore, the client device according to the first aspect can efficiently notify the user of the one or more recommendations received from the recommendation server.

[0011] In another possible implementation, in order to apply the first LPD mechanism and the second LDP mechanism to the user data, the client device is configured to first apply the first LDP mechanism to the user data, and then apply the second LDP mechanism to the output of the first LDP mechanism to obtain the privacy-preserving user data. In other words, in this implementation, the client device is configured to first apply the first LDP mechanism based on random selection to the private user data, and then apply the second LDP mechanism with added noise to the private user data.

[0012] Alternatively, in another possible implementation, in order to apply the first LPD mechanism and the second LDP mechanism to the user data, the client device is configured to first apply the second LDP mechanism to the user data, and then apply the first LDP mechanism to the output of the second LDP mechanism to obtain the privacy-protected user data. In other words, in this implementation, the client device is configured to first apply the noise-adding second LDP mechanism to the private user data, and then apply the randomly selected first LDP mechanism to the private user data.

[0013] In another possible implementation, the randomly selected LDP mechanism (i.e., the first LDP mechanism) is used to output the user data or randomly sampled general user data with a defined probability. In one implementation, the randomly selected LDP mechanism is a Generalized Randomized Response (GRR) mechanism. Therefore, the client device according to the first aspect can efficiently implement the first randomly selected LDP mechanism in the form of a GRR mechanism.

[0014] In another possible implementation, the second noise-adding LDP mechanism is a Laplace LDP mechanism or a Gaussian LDP mechanism. Therefore, the client device according to the first aspect can efficiently implement the second noise-adding LDP mechanism in the form of a Laplace or Gaussian LDP mechanism.

[0015] In another possible implementation, the client device is used to implement (i.e., operate) a machine learning (ML) model for generating user data as user data embeddings based on raw user data. In one implementation, the ML model for generating (e.g., in vector form) the user data embeddings can be a neural network. Therefore, in one implementation, the randomly selected LDP mechanism (i.e., the first LDP mechanism) is used to output the user data embedding based on the raw user data or a generic user data embedding randomly sampled from a simulated user data embedding distribution with defined probabilities. Thus, the client device according to the first aspect can efficiently implement the second LDP mechanism with added noise in the form of a Laplace or Gaussian LDP mechanism.

[0016] In another possible implementation, the client device is used to implement (i.e., operate) another machine learning (ML) model for generating multiple simulated user data embeddings in the simulated user data embedding distribution. In one implementation, the other ML model for generating the simulated user data embedding distribution may be another neural network. Therefore, the other ML model of the client device according to the first aspect can generate a simulated user data embedding distribution that is indistinguishable from the embeddings of the user data of real users.

[0017] In another possible implementation, the user data or the original user data may include one or more of the following: name; age; address; gender; search history; the user's application usage; browser history; and / or information about online advertisements previously selected (i.e. clicked) by the user.

[0018] According to a second aspect, a method is provided for using services (especially recommendation services) provided by a server (especially a recommendation server) based on user data associated with a user of a client device. The method includes the following steps: The user data is subjected to a first local differential privacy (LDP) mechanism and a second LDP mechanism to obtain privacy-protected user data. The first LDP mechanism is a randomly selected LDP mechanism, and the second LDP mechanism is an LDP mechanism used to add noise to the input data of the LDP mechanism. The privacy-protected user data is transmitted to the server.

[0019] In another possible implementation, the server is a recommendation server, and the method according to the second aspect further includes: receiving one or more recommendations based on the privacy-preserving user data from the recommendation server in response to transmitting the privacy-preserving user data to the recommendation server.

[0020] In another possible implementation, the step of applying the first LPD and the second LDP to the user data includes: first applying the first LDP to the user data, and then applying the second LDP to the output of the first LDP to obtain the privacy-preserving user data. Alternatively, in another possible implementation, the step of applying the first LPD and the second LDP to the user data includes: first applying the second LDP to the user data, and then applying the first LDP to the output of the second LDP to obtain the privacy-preserving user data.

[0021] The method according to the second aspect of the invention can be executed by the client device according to the first aspect of the invention. Therefore, other features of the method according to the second aspect of the invention are directly implemented through the functionality of the client device according to the first aspect of the invention and its various implementations described above and below.

[0022] According to a third aspect, a computer program product is provided, comprising a computer-readable storage medium for storing program code that, when executed by a computer or processor, causes the computer or processor to perform the method according to the third aspect.

[0023] The following drawings and description illustrate one or more embodiments in detail. Other features, objects, and advantages will be apparent from the description, drawings, and claims. Attached Figure Description

[0024] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings, in which: Figure 1 A schematic diagram is shown of a recommendation system including multiple client devices and a recommendation server providing recommendation services to the multiple client devices, according to an embodiment. Figure 2 A more detailed schematic diagram illustrating the interaction between a traditional client device and a recommendation server for using the recommendation service is shown. Figure 3 A more detailed schematic diagram illustrating the interaction between a client device and a recommendation server for using a recommendation service, as provided in one embodiment, is shown. Figure 4A flowchart of the processing steps of a method for operating a client device according to an embodiment is shown.

[0025] In the following text, the same reference numerals refer to the same or at least functionally equivalent features. Detailed Implementation

[0026] In the following description, reference is made to the accompanying drawings, which form part of this invention, and which illustrate by way of description specific aspects of embodiments of the invention or aspects in which embodiments of the invention may be used. It should be understood that embodiments of the invention can be used in other aspects and include structural or logical variations not depicted in the drawings. Therefore, the following detailed description should not be construed in a limiting sense, and the scope of the invention is defined by the appended claims.

[0027] For example, it should be understood that the disclosure relating to the described method also applies to the corresponding device or system for performing the method, and vice versa. For example, if one or more specific method steps are described, the corresponding device may include one or more units (e.g., functional units) to perform the described one or more method steps (e.g., one unit performs one or more steps, or multiple units perform one or more of a plurality of steps respectively), even if such one or more units are not explicitly described or shown in the drawings. On the other hand, for example, if a specific apparatus is described based on one or more units (e.g., functional units), the corresponding method may include a step to perform the function of one or more units (e.g., one step performs the function of one or more units, or multiple steps perform the function of one or more of a plurality of units respectively), even if such one or more steps are not explicitly described or shown in the drawings. Furthermore, it should be understood that, unless otherwise expressly stated, features of the various exemplary embodiments and / or aspects described herein may be combined with each other.

[0028] Figure 1 A schematic diagram of a recommendation system 100 is shown, which includes a recommendation server 140 (also called a recommender server 140) and multiple client devices 120 that use recommendation services provided by the recommendation server 140. For example, the recommendation server 140 may be implemented as a cloud server 140 that communicates with the multiple client devices 120 via a communication network (e.g., the Internet). The multiple client devices 120 may include smartphones, tablets, laptops, notebook computers, desktop computers, smart cars, smart TVs, or other communication devices capable of using online recommendation services. In one embodiment, the recommendation system 100 can be used to recommend online advertisements, online products, music, videos / movies, video games, online news, search results from online searches, etc.

[0029] like Figure 1As shown, each client device 120 may include processing circuitry 121, such as one or more processors 121, a communication interface 123, and / or memory 125. The processing circuitry 121 may be implemented in hardware and / or software and may include digital circuitry, or both analog and digital circuitry. The digital circuitry may include components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The communication interface 123 may be used to communicate with the recommendation server 140 via a wired and / or wireless communication network (e.g., the Internet) through a wired and / or wireless connection. The memory 125 of the client device 120 may be used to store executable program code that, when executed by the processing circuitry 121, causes the client device 120 to perform the functions and methods described herein. Figure 1 As shown and will be described in more detail below, in one embodiment, the memory 125 of the client device 120 may store user data 120d, i.e., user-private data. In one embodiment, private user data may include, for example, the user's name; the user's age; the user's address; the user's gender; the user's online search history; the user's application usage; the user's browser history; and / or information about online advertisements previously selected by the user.

[0030] like Figure 1 As further shown, the recommendation server 140 may also include processing circuitry 141, such as one or more processors 141, a communication interface 143, and / or memory 145. The processing circuitry 141 may be implemented in hardware and / or software and may include digital circuitry, or both analog and digital circuitry. The digital circuitry may include components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The communication interface 143 may be used to communicate with multiple client devices 120 via wired and / or wireless communication networks (e.g., the Internet) through wired and / or wireless connections. The memory 145 of the recommendation server 140 may be used to store executable program code that, when executed by the processing circuitry 141, causes the recommendation server 140 to perform the functions and methods described herein.

[0031] The following text will be Figure 3 In a more detailed description within the context of [the previous sentence], the recommender system 100 processes user data to generate one or more recommendations in a privacy-preserving and computationally inefficient manner. Before describing embodiments of the client device 110 and the recommender server 140 in more detail, the following will... Figure 2 In this context, one or more of the following abbreviations are used to introduce some technical background and terminology: LDP Local Differential Privacy ML machine learning GRR Generalized Random Response CTR (Click-Through Rate) Figure 2 A more detailed schematic diagram illustrates the interaction between a conventional client device 20 and a recommendation server 40 (particularly an advertising recommendation server 40 for implementing a conventional recommendation system 10, particularly an advertising recommendation system 10). The client device 20 includes an ML model 21 configured and trained to generate a user data embedding 30 (e.g., a user data feature vector 30) based on user data 20d and provides the user data embedding 30 to the recommendation server 40. The user data embedding 30 may be, for example, part of a request for a recommendation (particularly an advertising recommendation from the recommendation server 40) and may be sent to the recommendation server 40, for example, via the Internet. A first attacker device 50 may attempt to intercept the user data embedding 30 and retrieve the original user data 20d based on an attribute interference model 51, thereby leaking private user data, such as the user's age, gender, search history, and previously clicked advertisements on the client device 20.

[0032] The CTR prediction ML model 44 of the recommendation server 40 takes the user data embedding 30 (e.g., user data feature vector 30) provided by the client device 20 and the ad embedding ML model 42 of the recommendation server 40, which generates ad embeddings 43 based on ad data 41 (e.g., ad category, product price, etc.), as input data. Based on this input data, the CTR prediction ML model 44 of the recommendation server 40 generates one or more ad recommendations 45 and corresponding matching scores, and returns the ad recommendations to the client device 20. The second attacker device 60 may attempt to retrieve the ad embeddings 43 and / or ad recommendations 45, and generate raw user data 20d based on this data, thereby leaking private user data, such as the age, gender, search history, and previously clicked ads of the user of the client device 20.

[0033] It should be understood that Figure 2 Traditional recommender systems10 have three potential weaknesses that attackers might attempt to exploit to access private user data. Specifically, attackers could exploit these weaknesses by using (a) user data embeddings30 (see...). Figure 2 (a) attacker device 50), (b) ad embedding 43 and corresponding matching score 45 (see [reference]). Figure 2 The attacker device 60) and the combination of (c) (a) and (b) (i.e., user data and ad embeddings 30, 43 and matching scores 45) are used to infer private user data.

[0034] In order to solve Figure 2 The traditional recommender system 10 shown here has security, especially privacy risks. Figure 1 The embodiment of the recommendation system 100 shown satisfies the following requirements for protecting private user data, which will be described in more detail below: (a) preventing the inference of private user data (sometimes also called attributes) based on user information provided to the recommendation server; (b) preventing the inference of private user data based on server-side information, such as one or more selected recommendations or recommendation-user matching scores; (c) maintaining high efficiency, i.e., the recommendations determined by the recommendation server 140 based on user data are meaningful and of high quality to the user; and (d) meeting hardware and user experience requirements, i.e., the scheme speed, bandwidth, and memory footprint are acceptable.

[0035] Figure 3 A more detailed schematic diagram illustrates the interaction between one of a plurality of client devices 120 provided in one embodiment and a recommendation server 140 (particularly an advertising recommendation server 140 for implementing a recommendation system 100 provided in one embodiment, particularly an advertising recommendation system 100 provided in one embodiment). This will be described in more detail below, and as... Figure 3 As shown, typically, client device 120 is used, for example, to apply a first local differential privacy (LDP) mechanism to user data 120d via its processing circuitry 120a (in... Figure 3 The LDP mechanism is referred to as LDP 1) 122 and the second LDP mechanism (in Figure 3 This is referred to as LDP 2)126, to obtain privacy-preserving user data 130 (in Figure 3 The first LDP mechanism 122 is based on a randomly selected LDP mechanism 122, and the second LDP mechanism 126 is an LDP mechanism 126 for adding noise to the input data of the LDP mechanism 126. The client device 120 is also used to transmit privacy-preserving user data 130 to the recommendation server 140, for example, as part of a request for recommended advertisements to be displayed on the display of the client device 120. As described above, the user data 120d may include one or more of the following, such as: name; age; address; gender; search history; user's application usage; browser history; and / or information about online advertisements previously selected by the user.

[0036] It should be understood that, Figure 3 In the illustrated embodiment, the client device 120 is configured to first apply a first LDP mechanism 122 to user data 120d, and then apply a second LDP mechanism 126 to the output of the first LDP mechanism 122 to obtain privacy-preserving user data 130. In another embodiment, the client device 120 may be configured to first apply the second LDP mechanism 126 to user data 120d, and then apply the first LDP mechanism 122 to the output of the second LDP mechanism 126 to obtain privacy-preserving user data 130.

[0037] exist Figure 3 In the illustrated embodiment, client device 120 includes an ML model 121 configured and trained to generate user data embeddings 124 (e.g., user data feature vectors 124) based on raw user data 120d, wherein a first LDP mechanism 122 and a second LDP mechanism 126 are applied sequentially to the user data embeddings 124 (e.g., user data feature vectors 124). In another embodiment, client device 120 can be used to directly apply the first LDP mechanism 122 and the second LDP mechanism 126 sequentially to user data 120d (i.e., without an intermediate ML model 121). As described above, the first LDP mechanism 122 is based on a randomly selected LDP mechanism 122. Figure 3 As shown, a first LDP mechanism 122 based on random selection is used to output user data embedding 124 (or, if user embedding ML model 121 is not used, user data 120d) or randomly sampled user data with defined probabilities, such as general user data. Figure 3 The synthetic user data embedding 125 shown is randomly sampled from a simulated user data embedding distribution. In one embodiment, the first LDP mechanism 122 based on random selection is a Generalized Randomized Response (GRR) mechanism 122. It should be understood that for the first LDP mechanism 122 of the GRR mechanism form, the real user data embedding 124 is output with a fixed probability.

[0038] To generate multiple simulated user data embeddings from the simulated user data embedding distribution selected by the first LDP mechanism 122, the client device 120 can implement another ML model 123 (in... Figure 3This is referred to as the synthetic embedding generator 123. Since the user of client device 120 cannot access the embeddings of other users, another ML model 123 generates a synthetic user embedding 125 to act as a randomly sampled embedding. In one embodiment, the synthetic user embedding 125 follows the distribution of the real user embedding 124, and therefore cannot be distinguished from the real user embedding (from the perspective of attacker 150, 160, or server 140).

[0039] The output of the randomly selected first LDP mechanism 122 (i.e., user data embedding 124 (or, if user embedding ML model 121 is not used, user data 120d) or a synthetic user data embedding 125 randomly sampled from a simulated user data embedding distribution) is the input of the second LDP mechanism. As described above, the second LDP mechanism 126 is used to add noise to its input data, i.e., to user data embedding 124 (or, if user embedding ML model 121 is not used, user data 120d) or the synthetic user data embedding 125 randomly sampled from a simulated user data embedding distribution, thereby generating privacy-preserving user data 130 (in... Figure 3 The privacy-protected user data (referred to as protected user embedding 130) is provided to the recommendation server 140. In one embodiment, the second LDP mechanism 126 for adding noise is a Laplace LDP mechanism or a Gaussian LDP mechanism. The privacy-protected user data 130 may be, for example, part of a request for recommendations (especially advertising recommendations from the recommendation server 140) and may be sent to the recommendation server 140, for example, via the Internet. The first attacker device 150 may intercept the privacy-protected user data 130, but due to the sequential application of the first LDP mechanism 122 and the second LDP mechanism 126 used by the client device 120 to generate the privacy-protected user data 130, the original user data 120d cannot be retrieved based on the attribute interference model 151. More specifically, due to the additional noise provided by the second LDP mechanism 126, the attacker device 150 (or server 140) cannot infer the user's private user data with high accuracy.

[0040] Figure 3The CTR prediction ML model 144 of the recommendation server 140 shown takes the privacy-preserving user data 130 30 (e.g., protected user embedding 130) provided by the client device 120 and the ad embedding ML model 142 of the recommendation server 140, which generates ad embeddings 143 based on ad data 141 (e.g., ad category, product price, etc.), as input data. Based on this input data, the CTR prediction ML model 144 of the recommendation server 140, together with the corresponding matching score, generates one or more ad recommendations 145 and returns the ad recommendations to the client device 120. The second attacker device 160 can retrieve the ad embeddings 143 and / or ad recommendations 145, but due to the sequential application of the first LPM mechanism 122 and the second LPM mechanism 126 used by the client device 120 to generate the privacy-preserving user data 130 (and the recommendation server 140 to generate the ad recommendations 145), it will be unable to retrieve the original user data 120d based on the attribute interference model 161.

[0041] It should be understood that, due to the sequential combination of the first LDP mechanism 122 and the second LDP mechanism 126, the client device 120 ensures strong privacy of the private user data 120. Additional privacy (split inference) can be achieved by generating privacy-preserving user data 130 based on user data embedding 124 instead of the "raw" user data 120d. The client device 120 prevents attribute inference based on privacy-preserving user data 130 (which may be intercepted by the attacker device 150) by using a second LDP mechanism 126 that adds noise, such as a Laplace or Gaussian LDP mechanism, thereby satisfying the above requirement (a). Furthermore, due to the use of the first randomized response LDP mechanism 122, the client device 120 prevents attribute inference based on advertising information 143, 145 (which may be obtained by the attacker device 160), thereby satisfying the above requirement (b). This is because the server 140 (or the attacker device 160) cannot infer the user's private user data with high confidence, since the received privacy-preserving user data 130 may, with a certain probability, be a synthetically generated user embedding 125. It should be further understood that the sequential application of the first LDP mechanism 122 and the second LDP mechanism 126 still enables the recommendation server 140 to provide meaningful recommendations, especially advertisements based on privacy-preserving user data 130 (thus satisfying the above requirement (c)), and can be implemented in a computationally efficient (low computational overhead) and low memory footprint flexible manner, thus also satisfying the above requirement (d).

[0042] In one embodiment, the client device 120 can be used to adjust a first privacy parameter of the first LDP mechanism 122 to adjust the level of privacy generated by the first LDP mechanism 122 and / or a second privacy parameter of the second LDP mechanism to adjust the level of privacy generated by the second LDP mechanism 126. In other words, in one embodiment, each LDP mechanism 122, 126 has a privacy budget parameter (also called an ε parameter), which can be adjusted such that setting a higher value for the corresponding parameter results in lower privacy. It should be understood that this allows the client device 120 to control how much performance / utility might be lost due to the LDP mechanisms 122, 126 by changing the value of this parameter, for example, to achieve desired performance. Mathematically, the sequential application of the two LDP mechanisms 122, 126 results in a composite LDP mechanism whose privacy budget parameter is a combination of the privacy budget parameters of the two LDP mechanisms 122, 126, i.e., a combination of the first privacy parameter and the second privacy parameter.

[0043] It can be further demonstrated mathematically that the sequential application of two LDP mechanisms 122 and 126 as part of the same query yields higher privacy protection (mathematically corresponding to a lower composite ε) compared to applying only one of the LDP mechanisms 122 and 126. It should be understood that the sequential application of the first and second LDP mechanisms implemented by the client device 120 differs from the case where two different LDP mechanisms are applied as part of two separate queries (in which case, privacy protection is lower than applying a single LDP mechanism as part of a single query).

[0044] In another embodiment, the simulated user embeddings can be determined by different entities and stored on the client device 120, specifically in its memory 120c (instead of using the synthetic data generator model 123). In this embodiment, whenever the result of the first LDP mechanism 122 is the sending of simulated user embeddings to the recommendation server 140, the client device 120 can retrieve samples from the stored simulated user embeddings. It should be understood that, also in this embodiment, from the perspective of the recommendation server 140, the simulated user embeddings should be indistinguishable from the real embeddings.

[0045] Figure 4A flowchart illustrating the processing steps of a method 400 for using services provided by server 140 based on user data 120d or user data embedding 124 associated with a user of client device 120 is shown. Method 400 includes step 401, which involves applying a first LDP mechanism 122 and a second LDP mechanism 126 to the user data 120d of user data embedding 124 to obtain privacy-preserving user data 130. As described above, the first LDP mechanism 122 is based on a randomly selected LDP mechanism, and the second LDP mechanism 126 is an LDP mechanism used to add noise to the input data of the LDP mechanism. Furthermore, method 400 includes step 403, which involves transmitting the privacy-preserving user data to the server.

[0046] In one embodiment, server 140 is a recommendation server 140, and method 400 further includes: receiving one or more recommendations based on privacy-preserving user data 130 from recommendation server 140 in response to step 403 of transmitting privacy-preserving user data 130 to recommendation server 140 145.

[0047] In one embodiment, step 401 of applying the first LPD mechanism 122 and the second LDP mechanism 126 to user data 120d or user data embedding 124 includes: first applying the first LDP mechanism 122 to user data 120d or user data embedding 124, and then applying the second LDP mechanism 126 to the output of the first LDP mechanism 122 to obtain privacy-preserving user data 130. Alternatively, step 401 of applying the first LPD mechanism 122 and the second LDP mechanism 126 to user data 120d or user data embedding 124 includes: first applying the second LDP mechanism 126 to user data 120d or user data embedding 124, and then applying the first LDP mechanism 122 to the output of the second LDP mechanism 126 to obtain privacy-preserving user data 130.

[0048] According to the different embodiments described above, Figure 4 The method 400 shown can be executed by the client device 120. Therefore, other features of method 400 are implemented directly by the client device 120 and the functions of the different embodiments described above and below.

[0049] Those skilled in the art will understand that “blocks” (“units”) in the various drawings (methods and apparatuses) represent or describe the functionality of embodiments of the invention (and are not necessarily independent “units” in hardware or software), thereby equally describing the functionality or features (unit = step) of apparatus embodiments and method embodiments.

[0050] In the various embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The described embodiments of the apparatus are merely exemplary. For example, the unit division is only a logical functional division, and other division methods may be used in actual implementation. For example, multiple units or components may be merged or integrated into another system, or some features may be ignored or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be implemented through some interface. Indirect coupling or communication connection between devices or units may be implemented electronically, mechanically, or otherwise.

[0051] The units described as individual components may or may not be physically separate; the components shown as units may or may not be physical units, and may be located in the same position or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0052] Furthermore, the functional units in the embodiments disclosed herein may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit.

Claims

1. A client device (120), characterized in that, The client device (120) is used to use the services provided by the server (140) based on user data (120d; 124) associated with the user of the client device (120), and the client device (120) is used to: A first local differential privacy LDP mechanism (122) and a second LDP mechanism (126) are applied to the user data (120d; 124) to obtain privacy-protected user data (130). The first LDP mechanism (122) is a randomly selected LDP mechanism (122), and the second LDP mechanism (126) is an LDP mechanism (126) for adding noise to the input data of the LDP mechanism (126). The privacy-protected user data (130) is transmitted to the server (140).

2. The client device (120) according to claim 1, characterized in that, The server (140) is a recommendation server (140), and the client device (120) is configured to receive one or more recommendations (145) based on the privacy-preserving user data (130) from the recommendation server (140) in response to transmitting the privacy-preserving user data (130) to the recommendation server (140).

3. The client device (120) according to claim 2, characterized in that, The client device (120) includes a display for displaying one or more recommendations (145) received from the recommendation server (140).

4. The client device (120) according to any one of the preceding claims, characterized in that, In order to apply the first LPD mechanism (122) and the second LDP mechanism (126) to the user data (120d; 124), the client device (120) first applies the first LDP mechanism (122) to the user data (120d; 124), and then applies the second LDP mechanism (126) to the output of the first LDP mechanism (122) to obtain the privacy-protected user data (130).

5. The client device (120) according to any one of claims 1 to 3, characterized in that, In order to apply the first LPD mechanism (122) and the second LDP mechanism (126) to the user data (120d), the client device (120) first applies the second LDP mechanism (126) to the user data (120d; 124), and then applies the first LDP mechanism (122) to the output of the second LDP mechanism (126) to obtain the privacy-protected user data (130).

6. The client device (120) according to any one of the preceding claims, characterized in that, The LDP mechanism (122) based on random selection is used to output the user data (120d) or randomly sampled general user data with a defined probability.

7. The client device (120) according to claim 6, characterized in that, The LDP mechanism (122) based on random selection is a generalized random response (GRR) mechanism (122).

8. The client device (120) according to any one of the preceding claims, characterized in that, The second LDP mechanism (126) used to add noise is either a Laplace LDP mechanism (126) or a Gaussian LDP mechanism (126).

9. The client device (120) according to any one of the preceding claims, characterized in that, The client device (120) is used to implement a machine learning ML model (121), which is used to generate the user data as a user data embedding (124) based on the original user data (120d).

10. The client device (120) according to claim 9, characterized in that, The LDP mechanism (122) based on random selection is used to output the user data embedding (124) based on the original user data (120d) or a general user data embedding (125) randomly sampled from the simulated user data embedding distribution with a defined probability.

11. The client device (120) according to claim 10, characterized in that, The client device (120) is used to implement another ML model (123), which is used to generate multiple simulated user data embeddings in the simulated user data embedding distribution.

12. The client device (120) according to any one of the preceding claims, characterized in that, The client device (120) is a user equipment (UE) (120).

13. The client device (120) according to any one of the preceding claims, characterized in that, The user data (120d) or the original user data (120d) includes one or more of the following: name; age; address; gender; search history; the user's application usage; browser history; and / or information about online advertisements previously selected by the user.

14. A method (400), characterized in that, The method (400) is used to utilize services provided by the server (140) based on user data (120d; 124) associated with a user of the client device (120), and the method (400) is used to: The user data (120d; 124) is applied to a first local differential privacy LDP mechanism (122) and a second LDP mechanism (126) to obtain privacy-preserving user data (130). The first LDP mechanism (122) is a randomly selected LDP mechanism (122), and the second LDP mechanism (126) is an LDP mechanism (126) used to add noise to the input data of the LDP mechanism (126). The privacy-protected user data (130) is transmitted (403) to the server (140).

15. The method (400) according to claim 14, characterized in that, The server (140) is a recommendation server (140), and the method (400) further includes: receiving one or more recommendations (145) from the recommendation server (140) based on the privacy-preserving user data (130) in response to transmitting (403) the privacy-preserving user data (130) to the recommendation server (140).

16. The method (400) according to claim 14 or 15, characterized in that, Applying (401) the first LPD mechanism (122) and the second LDP mechanism (126) to the user data (120d; 124) includes: first applying the first LDP mechanism (122) to the user data (120d; 124), and then applying the second LDP mechanism (126) to the output of the first LDP mechanism (122) to obtain the privacy-protected user data (130).

17. The method (400) according to claim 14 or 15, characterized in that, Applying (401) the first LPD mechanism (122) and the second LDP mechanism (126) to the user data (120d; 124) includes: first applying the second LDP mechanism (126) to the user data (120d; 124), and then applying the first LDP mechanism (122) to the output of the second LDP mechanism (126) to obtain the privacy-protected user data (130).

18. A computer program product including a computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a computer or processor, causes the computer or processor to perform the method (400) according to any one of claims 14 to 17.

Images