EP4599421A1

EP4599421A1 - Collaborative randomized encoding for training machine-learned models with vertically split training data

Info

Publication number: EP4599421A1
Application number: EP24745567.8A
Authority: EP
Inventors: Karn SETH; Mihaela Ion; Benjamin KREUTER; Mariana Petrova RAYKOVA; Marcel M. M. Yung; Sarvar Patel
Original assignee: Google LLC
Current assignee: Google LLC
Priority date: 2023-12-29
Filing date: 2024-06-27
Publication date: 2025-08-13
Also published as: WO2025144460A1

Abstract

Example embodiments of the present disclosure provide for an example method for collaborative randomized encoding for training machine-learned models with vertically split training data. The method can include maintaining a machine-learned model. The method can include generating a first encoded dataset by sealing, using a shared key, a first private dataset into a fixed joint computation. The method can include storing, by the first encoded dataset. The method can include deleting the shared key. The method can include obtaining a second encoded dataset from a second computing system. The second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation. The method can include generating an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input and updating the machine-learned model based on the output.

Description

COLLABORATIVE RANDOMIZED ENCODING FOR TRAINING MACHINE- LEARNED MODELS WITH VERTICALLY SPLIT TRAINING DATA

PRIORITY

[0001] The present application claims the benefit of priority of U.S. Provisional Patent Application No. 63/616,445, filed on December 29, 2023, which is incorporated by reference herein.

FIELD

[0001] The present disclosure relates generally to secure multi-party computation. More particularly, example aspects of the present disclosure relate to allowing for multi-party computation of a joint function while preventing leaking or sharing of any private data.

BACKGROUND

[0002] Multi-party computation provides for computing on private datasets without sharing their input data with each other. Multi-party computation allows for collaboration and computation on private datasets without the parties sharing any of the private data with other parties.

SUMMARY

[0003] Aspects and advantages of embodiments of the present disclosure will be set forth in part in the following description, or can be learned from the description, or can be learned through practice of the embodiments.

[0004] In one example aspect, the present disclosure provides for an example computer- implemented method. The example computer-implemented method includes maintaining, by a first computing system, a machine-learned model; generating a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation; storing, by the first computing system, the first encoded dataset; deleting, by the first computing system, the shared key; obtaining, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation; generating, by the first computing system, an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input; and updating, by the first computing system, the machine- learned model based on the output.

[0005] In one example aspect, the present disclosure provides for an example computer- implemented method. The example computer-implemented method includes maintaining a machine-learned model comprising a plurality of weights; generating, by a first computing system, using input data comprising a batch of a first private dataset and a hash seed derived from a shared secret, a plurality of buckets of data comprising a bucket ID, a hashed identifier, and a hashed feature; generating, by the first computing system, a first set of random encoded data of the batch of the first private dataset by: for each bucket of the plurality of buckets: (i) generating a random vector; (ii) determining an error by performing backpropagation of the machine-learned model using input comprising the hashed feature and the random vector; (iii) computing a garbled circuit; and (iv) storing wire labels of the garbled circuit for the respective bucket; generating, by the first computing system, a first sum of errors by summing the errors of each bucket of the plurality of buckets to determine a noisy sum of errors; storing, by the first computing system: (i) the sum of errors, (ii) public key, and (iii) a plurality of stored buckets comprising: the garbled circuit for each bucket, the wire labels for each bucket; and deleting, by the first computing system, the shared secret; obtaining, by the first computing system and from a second computing system, a second set of random encoded data comprising (i) encrypted masked labels for a plurality of buckets and (ii) wires associated with the encrypted masked labels for a plurality of buckets; for each bucket of the plurality of stored buckets: (i) evaluating the garbled circuit to generate a recovered masked label as output; and (ii) determining an error by performing backpropagation of the machine-learned model using input comprising a feature and the recovered masked label divided by two; computing, by the first computing system, a gradient update for the batch by doubling a sum of the second set of errors minus the first sum of errors; and updating, by the first computing system, the plurality of weights associated with the machine-learned model based on the gradient update.

[0006] In an example aspect, the present disclosure provides for an example system for collaborative randomized encodings, including one or more processors and one or more memory devices storing instructions that are executable to cause the one or more processors to perform operations. In some implementations, the one or more memory devices can include one or more transitory or non-transitory computer-readable media storing instructions that are executable to cause the one or more processors to perform operations. In the example system, the operations can include maintaining, by a first computing system, a machine- learned model; generating a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation; storing, by the first computing system, the first encoded dataset; deleting, by the first computing system, the shared key; obtaining, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation; generating, by the first computing system, an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input; and updating, by the first computing system, the machine-learned model based on the output. [0007] In an example aspect, the present disclosure provides for an example transitory or non-transitory computer readable medium embodied in a computer-readable storage device and storing instructions that, when executed by a processor, cause the processor to perform operations. In the example transitory or non-transitory computer-readable medium, the operations include maintaining, by a first computing system, a machine-learned model; generating a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation; storing, by the first computing system, the first encoded dataset; deleting, by the first computing system, the shared key; obtaining, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation; generating, by the first computing system, an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input; and updating, by the first computing system, the machine-learned model based on the output [0008] These and other features, aspects, and advantages of various embodiments of the present disclosure will become better understood with reference to the following description and appended claims. The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate example embodiments of the present disclosure and, together with the description, serve to explain the related principles.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Detailed discussion of embodiments directed to one of ordinary skill in the art is set forth in the specification, which refers to the appended figures, in which:

[0010] Figure 1 an example system for collaborative randomized encodings according to example aspects of the present disclosure; [0011] Figure 2 depicts a swim lane diagram of an example data flow to perform collaborative randomized encoding according to example aspects of the present disclosure; [0012] Figure 3 depicts a swim lane diagram of an example data flow to perform collaborative randomized encoding according to example aspects of the present disclosure; [0013] Figure 4 depicts a swim lane diagram of an example data flow to perform collaborative randomized encoding according to example aspects of the present disclosure; [0014] Figure 5 depicts a flowchart of example methods for performing collaborative randomized encodings according to example aspects of the present disclosure;

[0015] Figure 6A and Figure 6B depict a flowchart of example methods for performing collaborative randomized encodings according to example aspects of the present disclosure; and

[0016] Figure 7 depicts an example system to perform collaborative randomized encodings according to example aspects of the present disclosure.

[0017] Reference numerals that are repeated across plural figures are intended to identify the same features in various implementations.

DETAILED DESCRIPTION

[0018] Generally, the present disclosure is related to techniques for secure multi-party computation using collaborative randomized encodings. More particularly, collaborative randomized encodings can be used to perform joint computation across multiple parties with vertically split data. In some embodiments, the parties can use a shared secret, such as a cryptographic key, to seal their respective datasets into a fixed computation. The shared secret can be subsequently deleted. After the secret is deleted, the sealed data is cryptographically random, and the parties cannot recover the data but can carry out the computation. After the secret is deleted, the parties can share the randomized data to perform the computation but cannot use the data for anything else or determine anything about the original dataset.

[0019] Standard secure multi-party computation provides for parties retaining their secret keys during computation. If these keys are leaked during computation, the data could be recovered based on the exchanged messages together from the secret keys of the parties. The present disclosure provides for improved methods to delete the keys and secrets used to encrypt or randomize the data and fix the data in the computation before any data-derived values are exchanged between the parties. The parties can still perform the joint computation by combining the two (or more) sets of randomized data to complete the computation. The present disclosure provides for a method for performing secure multi-party computation for any joint function using an application of garbled circuits that provides for protection in settings where both parties’ data is protected after key-deletion or where only one party’s data is protected after key -deletion.

[0020] Implementations of this technology can include training machine-learned models with vertically split training data, determining intersection of sums, or performing other joint computations. More specifically, the present disclosure can provide for an implementation for training machine-learned models with vertically split training data (e.g., vertical federated machine learning). For instance, gradients for machine-learned models can be computed over vertically split data where a first computing party holds identifiers and associated features, and a second computing party holds identifiers and associated training labels. The private datasets can be encrypted in such a way that a party holding the model can perform backpropagation with the first party’s encoded data and the second party’s encoded data and use the outputs to determine a gradient and adjust the weights of the machine-learned model accordingly. Thus, the present disclosure allows for training of a model held by one of the parties without the two parties having to share any private data.

[0021] Advantageously, systems and methods according to example aspects of the present disclosure can enable, for example, training of machine-learned models while maintaining differential privacy for datasets including overlapping samples without requiring exponentially more utilization of computation resources. For instance, the properties of a garbled circuit can be utilized to perform a value-or-default computation to allow for parallelization of training and processing. The present systems and methods provide for improved data security by decreasing potential data leakage and providing for differentially private training using datasets where the features and labels of the training data are split among multiple parties. More particularly, the present method provides for improved data security by requiring a shared key to be destroyed before any encoded data is transferred between parties. This allows for the randomly encoded data to be shared without risk of private data leaking. This can allow for training predictive classification models for a number of useful applications without the need for parties to share private data. For instance, the methods described herein can be used for training a machine-learned model that predicts likely future diagnoses of illness based on features (e.g., risk factors). This can allow for multiple healthcare parties to utilize their data for training the model without sharing the original private data. Additionally, applications can include predicting likely interests or topics for a user based on features associated with a device identifier. Outside of performing vertical federated learning, the methods described herein can help perform aggregate computing operations to determine an intersection sum or to determine other aggregated computations associated between split datasets.

[0022] With reference now to the Figures, example embodiments of the present disclosure will be discussed in further detail. Figure 1 depicts one example system 100 for collaborative randomized encodings according to example aspects of the present disclosure. The example system 100 contains a first computing system 102. The first computing system 102 can be any type of system of one or more computing devices. In some instances, the first computing system can be a features computing system. A computing device can be, for example, a personal computing device (e.g., laptop or desktop), a mobile computing device (e.g., smartphone or tablet), a gaming console or controller, a wearable computing device, an embedded computing device, a server computing device, a node of a distributed computing device, a virtual instance hosted on a shared server, or any other type of computing device. In some embodiments, the first computing system 102 includes a plurality of computing devices interconnected via a network or otherwise distributed in an interoperable manner. For example, the first computing system 102 can include a server for serving content over a network (e.g., network 104). For instance, the first computing system 102 can include data 106.

[0023] Data 106 can include training data 108 or encoded data 114. Training data 108 can include identifiers 110A-N and corresponding attributes 112A-N. For instance, training data 108 can include pairs of {identifier, attribute} for N number of pairs. Attributes 112A-N can include a number of attributes, such as features. Features can include data representations of features associated with the identifiers such as an exposure to a content item, one or more preferences, characteristic data, or any other information. In some instances, the number of parameters can be on the order of millions of parameters associated with thousands of class labels.

[0024] Encoded data 114 can be generated by the first computing system 102 using a shared secret 116 and training data 108 as described herein. For instance, the shared secret 116 can include a cryptographic key or set of cryptographic keys (e.g., a public key and a private key). The shared secret 116 or shared secret 142 can be generated by shared secret generator 152. Shared secret generator 152 can be a part of a server computing system 150. The server computing system 150 can be part of the first computing system 102 or the second computing system 130. The encoded data 114 can be stored for training machine-learned model 118. Using model trainer 122. [0025] Example system 100 can include second computing system 130. In some implementations, second computing system 130 can be a labels computing system. Second computing system 130 can store data training 132. Training data 132 can include identifiers 136A-N and corresponding attributes 138A-N. For instance, training data 132 can include pairs of {identifier, attribute} for N number of pairs. Attributes 138A-N can include a number of attributes, such as labels. For instance, training data 108 and training data 132 can include some overlap in identifiers such that for the subset of identifiers, training data 108 includes features and training data 134 includes labels. Labels can include data representations of labels associated with the identifiers such as conversions actions performed, or other attributes which can be predicted based on the associated feature data. In some implementations, the labels can include thousands of class labels.

[0026] Encoded data 140 can be generated by the second computing system 130 using a shared secret 142 and training data 134 as described herein. For instance, the shared secret 142 can include a cryptographic key or set of cryptographic keys (e.g., a public key and a private key). The encoded data 140 can be encoded such that the training data is sealed into a computation such that after the key is deleted, the initial input training data 134 cannot be determined by the first computing system 102, however the first computing system 102 can perform the joint computation using encoded data 140 and encoded data 114.

[0027] The encoded data 140 can be stored for training machine-learned model 118. Using model trainer 122. Model trainer 122 can use methods described herein to train or update machine-learned model 118. For instance, model trainer 122 can use the methods described herein to determine a gradient for encoded data 114 and encoded data 140, obtained from second computing system 130, to use to update machine-learned weights 120. [0028] Model trainer 122 can use methods described herein to train or update machine- learned model 118. For instance, model trainer 122 can use the methods described herein to determine a gradient for encoded data 114 and encoded data 140, obtained from second computing system 130, to use to update machine-learned weights 120.

[0029] Example system 100 can include a server computing system 150. Server computing system 150 can include shared secret generator 152. Shared secret generator 152 can be located within the first computing system 102, second computing system 130, or independently from the computing systems and communicatively coupled to the computing systems via network 104.

[0030] Figure 2 depicts a swim lane diagram 200 for utilizing collaborative randomized encodings where a single party is transmitting their respective encoded data. The swim lane diagram can include a first computing system 205 and a second computing system 210. The first computing system 205 and second computing system 210 can be associated with the same entity or different entities. For instance, the first computing system 205 and second computing system 310 can be separate divisions of a single corporate entity or can be associated with distinct corporate entities.

[0031] The first computing system 205 can, at operation 215, store a private dataset DI. As described herein, the private dataset DI can include a plurality (e.g., thousands or millions) of data. The data can include, for example, identifiers such as device or account identifiers and features.

[0032] At operation 220, the second computing system 210 can store a private dataset D2. As described herein, the private dataset D2 can include a plurality (e.g., thousands or millions) of data. The data can include, for example, identifiers, such as device or account identifiers, and labels.

[0033] The first private dataset DI and the second private dataset D2 can include a plurality of common identifiers such that computing information relating to the overlap of the sets would provide a benefit to the first and second computing system. Due to privacy concerns, the parties can be prevented from sharing the datasets in their raw form. For instance, a desire to keep each dataset k-anonymous such that it cannot be known whether an identifier is within either the first private dataset DI or the second private dataset D2 (such that nothing can be learned about a single identifier).

[0034] The first computing system 205 and second computing system 210 can generate a shared key at operation 225. In some instances, the shared key can be computed by one of the computing systems and shared with the other computing system. In some instances, the shared key is generated by using a shared key protocol.

[0035] For instance, generating a shared key can include two or more computing systems (e.g., parties) agreeing upon a common secret used for secure communication. This can include key exchange algorithms. Key exchange algorithms can include, for example, each party having a pair of public and private keys. The public keys can be shared openly, and the private keys can be kept secret. In order to establish a shared key, a key exchange protocol is initiated. The key exchange protocol includes one party generating a random symmetric key, encrypting the symmetric key with the other party’s public key, and sending the encrypted key over a secure channel. The receiving party can decrypt the message using the private key to obtain the shared symmetric key. Symmetric cryptography can involve a direct exchange of a secret key between parties. [0036] The shared key can be used by the respective computing systems to encrypt and seal the respective datasets. The encryption methods used at operation 230 and 235 seal the respective datasets into a joint computation such that once the shared key is deleted, nothing can be learned about the initial private datasets, however the joint computation can be performed on the encrypted data to learn some aggregate information about the initial private datasets.

[0037] At operation 230, the first computing system can utilize the shared key to encode the private dataset to generate a first encoded dataset DI’. In some instances, the dataset is encoded using key encryption. For instance, the plain text can be transformed into ciphertext using the shared key. In some implementations, encrypting can include deriving a hash seed from the shared key and performing a hash function on the data. In addition, or alternatively, the hashed data can be sorted into buckets. In some instances, encrypting DI can further include utilization of a garbled circuit as is described further with regard to Figure 3.

[0038] The first encoded dataset DI’ can be stored by the first computing system. The first computing system can delete the shared key which effectively seals the encrypted data into the joint computation. The shared key can be deleted in a number of ways. For instance, the computing systems can utilize secure erasure, key destruction, key management system protocol, or revocation.

[0039] At operation 235, the second computing system can utilize the shared key to encode the private dataset to generate a second encoded dataset D2’. Similar methods to those described at operation 230 can be used by second computing system 210 to generate the second encoded dataset D2’.

[0040] The second encoded dataset D2’ can be stored by the second computing system. At operation 240, the first computing system and the second computing system can delete the shared key which effectively seals the encrypted data into the joint computation.

[0041] At operation 245, the second computing system can transmit the second encoded dataset D2’ to the first computing system. For instance, the first computing system can make a call to the second computing system to request that the second encoded dataset D2’ be transmitted to the first computing system so that the joint computation can be evaluated for the encoded datasets.

[0042] At operation 250, the first computing system can generate an output by evaluating the fixed joint computation using the first encoded dataset DI’ and the second encoded dataset D2’ as input. The fixed computation can include determining an intersection sum or training a machine-learned model that is held by one of the parties, as depicted in Figure 3. [0043] Figure 3 depicts an example swim lane diagram 300 for training a machine- learned model using vertically split training data according to example embodiment of the present disclosure. In Figure 3, the swim lane diagram includes a first computing system 305 and a second computing system 310. The first computing system 305 can be a features computing system storing identifiers and associated features data. The second computing system 310 can be a labels computing system storing identifiers and associated labels data. [0044] The first computing system 305 can, at operation 315, maintain a machine-learned model and store dataset. The dataset can include a number of identifiers and features represented by {ID, x}. The second computing system 310, can, at operation 320, store a dataset. The dataset can include a number of identifiers and labels represented by {ID, y}. [0045] The first computing system 305 and second computing system 310 can, at operation 325, perform an exchange of public keys for a batch of IDs to generate a key pair. The key pair is used by the respective computing systems to derive a hash seed at operation 330 and 335. For instance, the first computing system 305 can generate a key pair comprising a first private key and a first public key. The second computing system 310 can generate a key pair including a second private key and a second public key. The first computing system 305 can share the first public key with the second computing system 310 and the second computing system 310 can share the second public key with the first computing system 305. The joined key can be computed by the first computing system 305 using the first private key and the second public key. The joined key can be computed by the second computing system 310 using the second private key and the first public key.

[0046] First computing system 305, can at operation 330, derive the hash seed and map the features and IDs to buckets represented by {bucket, ID, x{. In some implementations, the first computing system 305 can perform cuckoo hashing such that each bucket is associated with at most a single feature record.

[0047] Second computing system 310, can at operation 335, derive the hash seed and map the labels to buckets represented by {bucket, (ID, y). . .(ID, y)}. Second computing system 310 can perform simple hashing such that each bucket can be associated with more than one label record. For instance, a single hashed bucket of the second encoded dataset can correspond to a plurality of buckets of the first encoded dataset.

[0048] At operation 340, the first computing system 305 can perform a number of operations for each bucket. At operation 340A, the first computing system 305 can generate a random vector, r. The random vector, r, is generated using the generated key pair such that the random vector generated by the first computing system can be generated by the second computing system (e.g., shared randomness).

[0049] At operation 340B, the first computing system 305 can perform training of the machine-learned model using the random vector. For instance, the first computing system 305 can compute a noisy gradient for each bucket using the random vector. The first computing system 305 can sum the gradient for each bucket to generate the noisy gradient for the batch of IDs. The random vectors are used as masks for the respective buckets.

[0050] In some embodiments, the number of features of the input datasets can be fixed. As such, the gradient update for a set of data can be represented as an affine function of the labels. Thus, the gradient update for a batch of training data is the sum of the gradients in the batch. This can be represented by the function:

Gradient(features, labels + r) = Gradient(features, labels) + Gradient(features, r) - Constant(features)

Such that the gradient can be performed once using the masks (e.g., r), once using the masked labels (e.g., labels plus r), and subtract the results to get the actual gradient (including differentially private noise). The features can be the features associated with private dataset DI, the labels can be the labels associated with private dataset D2, and r can be a random value generated to provide differential privacy.

[0051] The above formula can be determined based on the following observations. For fixed features, the gradient is an affine function of the labels such that:

Gradient(features, labels) = (C*labels) + D

In the equation above, C and D are constants that depend on the models and features. This formula can be used to compute the following:

G1 = Gradient(features, (labels + r)/2) = (C*((labels + r)/2)) + D G2 = Gradient(features, r) = (C*r) + D

Using these observations, the overall Gradient can be calculated using the following: G = 2 * G1 - G2

= 2* (C*((labels + r)/2)) + D) - ((C*r) + D)

= (2*C*labels/2) +(2*C*r/2) +(2*D)-(C*r)-D

= (C * labels) + D =Gradient(features, labels)

[0052] In the above, r is a random mask that is applied to the labels. Standard machine- learned models such as those built on ReLU, SoftMax, sigmoid, Poisson, linear embeddings, have the affine property when using a standard loss function such as Poisson loss, sigmoid loss, cross-entropy, or SoftMax-loss. The first computing system and second computing system can generate random masks, r. The first computing system can generate the Gradient of (feature, r) - noise locally. The first computing system can generate input keys for the randomized encodings corresponding to its IDs.

[0053] At operation 340C, the first computing system 305 can, for each bucket, compute the garbled circuit and preserve wire labels W1 for the features. Thus, the first computing system 305 can generate the input keys for the randomized encodings that correspond to its IDs.

[0054] At operation 350, first computing system 305 can store the summed noisy gradient for the batch of IDs, the garbled circuit, the input wire labels W1 for the batch of IDs, and a first public key. All other intermediate data including the keys can be deleted. Thus, the first computing party will forget the masks r and delete the shared randomness used to set up the randomized encoding. At this stage, the first computing system 305 holds the noisy gradient (Gradr = (Gradient(features, r)-noise) and wire labels corresponding to its keys for the value- or-default randomized encoding.

[0055] At operation 345, second computing system 310 can perform operations for each bucket. For instance, second computing system 310 can generate a random vector. Second computing system 310 can compute input wire labels W2 for the Garbled circuit for each respective bucket. For the set of input wire labels W2, the second computing system can generate output wire keys. And for each bucket, the labels can be masked and encrypted with the garbled circuit to generate Enc(y+r). Enc(y+r) represents a randomized encoding of the labels that can be used by the first computing system 305 to recover the masked labels to be used for training the machine-learned model. As described herein, the second computing system 310 can mask its labels as labels plus r. The second computing system can seal the masked labels into a value-or-default randomized encoding (e.g., as Enc(y+r)) which, when transmitted to the first computing system, after deleting the shared key, will allow the first computing system 305 to retrieve label plus r for matching IDs and default label plus r for non-matching IDs.

[0056] A garbled circuit is a cryptographic construction used in secure multi-party (e.g., two party) computation. With the garbled circuit, each gate of the circuit is garbled, e.g., encrypted, with possible input combinations. The garbled inputs and outputs can be exchanged between parties. A value-or-default circuit involves including additional information in the garbled gates to allow for a party to determine something useful when the party does not know the actual input values for some of the gates. As described herein, only some of the input wires (e.g., input values) for each of the gates of the garbled circuit can be shared between the computing systems. The “value” of the garbled circuit is obtained as output when the gate includes the actual input value (e.g., there is a match between the actual input value and the input value used by the party computing the garbled circuit). The “default” of the garbled circuit is obtained as output when there is not a match (e.g., the gate does not include the input value). Thus, the party computing the garbled circuit that has no input can evaluate the circuit even when missing input values without revealing sensitive information.

[0057] At operation 355, second computing system 310 can store the input wire labels W2 and Enc(y+r). All other intermediate data including the keys can be deleted.

[0058] Thus, the second computing system 310 will forget the masks r and delete the shared randomness used to set up the randomized encoding. At this stage, the second computing system 310 the garbled circuit corresponding to value or default randomized encodings, with keys and masked labels hard coded.

[0059] At operation 360, second computing system 310 can transmit the input wire labels W2 and Enc(y+r) to the first computing system 305. Thus, second computing system 310 transfers its portion of the encoding (e.g., anonymous garbled circuit) to the first computing system 305.

[0060] At operation 365, the first computing system 305 can perform a value-or-default function by evaluating the set of encoded feature data from the first computing system 305 and the encrypted masked label data (Enc(y+r)) and wire labels W2 to recover the masked labels. The first computing system 305 can now evaluate the hard coded garbled circuit using its preserved keys and receive either label plus r or default label plus r for each of the first computing system’s IDS. At this stage, however, the first computing system 305 is unable to distinguish which values are associated with label plus r and which are associated with default label plus r, thus the first computing system 305 cannot determine if any particular ID is within both private datasets. An efficiency obtained by hashing the keys into buckets is that the value-or-default function can be computed bucket-by-bucket opposed to over the entire dataset.

[0061] The output of the value or default garbled circuit can be the labels plus a random noise which can be used to compute the gradient of the labels. The random noise can be added to provide for additional security and prevent the computing party from knowing whether an individual input corresponds to a value or default. The random noise added can be generated such that when the final computation is performed, the random noise sums to zero or some other differentially private amount of noise such that the gradient can be used to update the machine-learned model but does not reveal any information about any single datum (e.g., identifier and feature or label pair).

[0062] The first computing system 305 can compute the gradient for the machine-learned model using the recovered masked labels. In some implementations, the gradient for the masked label of each respective bucket can be determined based on performing a backpropagation of the machine-learned model using the features and masked labels divided by two. For instance, the first computing system 305 can compute Gradient(features, (labels + r)/2) using the retrieved values and subtract the previously computed Gradient(features, r) - noise to determine Gradient(features, labels) + noise.

[0063] This method provides for safe randomized encoding using Gradr, wires, and garbled circuit. This is because if we assume that Gradr does not exist, GC and W together allow computing the masked labels in the intersection and nothing more. Since the labels are masked with random values that have been deleted and the value-or-default circuit hides whether there is a key (e.g., ID) in common between the two initial private datasets, the only data that can be revealed is something appears to be uniformly random (or statistically close to uniformly random). Thus, Gradr reveals nothing more than could be learned using Gradient(features, labels) plus noise and the masked labels.

[0064] At operation 370, the first computing system 305 can compute a gradient update based on the noisy gradient determined at operation 340B and stored at operation 350 and the masked labels gradient determined at operation 370. In some instances, the gradient update for the batch of IDs can be computed by taking two times the sum of the gradient for the masked labels minus the noisy gradient.

[0065] The machine-learned model can have weights associated with parameters which can be adjusted during training to improve the output of the machine-learned model. The machine-learned model can include a number of layers. For instance, layers can include a number of layers including an embedding layer (e.g., sparse linear embedding layer), functions applied to output layers (e.g., ReLU layers), output layers (e.g., SoftMax layers), or other types of layers.

[0066] An update of the machine-learned model can be performed by adjusting the weights of machine-learned model. The training can be performed with a regular cadence, such as once a day, once a week, or some other frequency. In some implementations, the training can be performed on demand. The trained machine-learned model can then be used to predict labels (e.g., some sort of classification) based on input data including features. As the model is used to make predictions, the private datasets of the respective computing systems can be updated such that training can continue on real-time data.

[0067] Figure 4 depicts a swim lane diagram 400 for utilizing collaborative randomized encodings where both parties are transmitting their respective encoded data to compute a joint computation. Figure 4 presents a similar approach to that described in Figure 2 but further elaborates on an implementation using a garbled circuit to seal the data as well as depicting an example embodiment involving the encoded data being shared by both computing systems. The methods and embodiments described can be adjusted, combined, or altered such that a sub step described in one figure can be integrated with or replaced by sub steps in another feature. As such, the figures are for explanatory purposes only and are not meant to be limiting.

[0068] The swim lane diagram can include a first computing system 405 and a second computing system 410. The first computing system 405 and second computing system 410 can be associated with the same entity or different entities.

[0069] The first computing system 405 can, at operation 415, store a private dataset DI. As described herein, the private dataset DI can include a plurality (e.g., thousands, millions, or billions) of data. The data can include, for example, identifiers such as device or account identifiers and features.

[0070] At operation 420, the second computing system 410 can store a private dataset D2. As described herein, the private dataset D2 can include a plurality (e.g., thousands or millions) of data. The data can include, for example, identifiers, such as device or account identifiers, and labels.

[0071] The first private dataset DI and the second private dataset D2 can include a plurality of common identifiers such that computing information relating to the overlap of the sets would provide a benefit to the first and second computing system. However, due to privacy concerns, the parties can be prevented from sharing the datasets in their raw form. For instance, a desire to keep each dataset k-anonymous such that it cannot be known whether an identifier is within either the first private dataset DI or the second private dataset D4.

[0072] The first computing system 405 and second computing system 410 can generate a shared key at operation 425. In some instances, the shared key can be computed by one of the computing systems and shared with the other computing system. The shared key can be generated as described herein. [0073] The shared key can be used by the respective computing systems to encrypt and seal the respective datasets. The encryption methods used at operation 430 and 435 seal the respective datasets into a joint computation such that once the shared key is deleted, nothing can be learned about the initial private datasets, however the joint computation can be performed on the encrypted data to learn some aggregate information about the initial private datasets.

[0074] At operation 430, the first computing system can utilize the shared key to encode the private dataset to generate a first randomly encoded dataset. For instance, a garbled circuit for the joint computation can be generated. For instance, a garbled circuit can be generated to represent the joint computation. A garbled circuit is a cryptographic protocol that allows for secure multi-party computation to allow for computing a function on private inputs without revealing the inputs to one another. The garbled circuit consists of a circuit representation of the function to be computed. Each gate of the circuit is encrypted with the possible input combinations. The party with the function to be computed sends the garbled circuit to the other party. The party sending the garbled circuit (e.g., transmitting party) can provide its inputs by transmitting the corresponding encrypted values. The receiving party that is computing the function can evaluate the garbled circuit gate by gate without learning the actual inputs from the transmitting party. Thus, the function can be computed while preserving the privacy of the input data.

[0075] The garbled circuit can be utilized to generate a randomized encoding of the input data. For instance, for each gate of the garbled circuit, the computing system can retain only 1 out of the 2 wire keys for any input wire and forget if the input wire key corresponds to a 1 or 0. The semantic meaning of the output wire key (e.g., which corresponds to 0 or 1) can be retained. Thus, only one path through the circuit can be decrypted and everything but the output (e.g., computation) appears random. This effectively fuses the input data into the computation and allows the input data to be forgotten. Thus, the only semantically useful thing that can be performed with the information shared (e.g., gates and input wires) is compute the final output.

[0076] The stored private dataset DI can be input into the garbled circuit. The input wires associated with private dataset DI being processed by the garbled circuit can be stored as input wires W 1 along with the gates of the garbled circuit. Thus, the first computing system 405 can store the input wires W 1 and the garbled gates. After the input wires W 1 and the garbled gates are stored, the first computing system 405 can delete the shared key. Thus, at operation 440, the first private dataset has been sealed into the fixed computation represented by the gate. The input wires W 1 can be a set of input wires associated with the respective pairs of data of the private dataset DI.

[0077] At operation 435, the second computing system can utilize the shared key to encode the private dataset to generate a second randomly encoded dataset. For instance, a garbled circuit for the joint computation can be generated (e.g., as described with regard to operation 430).

[0078] In some instances, the joint computation can be a value-or-default circuit as described herein. Value-or-default can be computed efficiently using hash-to-buckets for the input data. For instance, the keys of the key-value pairs can be hashed into buckets. The system can pad the buckets such that each bucket is equal in size. The value-or-default function can be performed bucket-by-bucket. By hashing the values, the buckets can be relatively small which allows the value-or-default circuit to be relatively small and allow for faster computation of the value-or-default between the encoded datasets.

[0079] In order to provide additional privacy and hide whether individual keys match, the values associated with the keys can be randomized. The randomization of the values must be compatible with the aggregated functionality (e.g., joint computation) such that the output of the joint computation is useful (e.g., for updating the weights of the machine-learned model or performing an intersection sum).

[0080] The stored private dataset D2 can be input into the garbled circuit. The input wires associated with private dataset D2 being processed by the garbled circuit can be stored as input wires W2 along with the gates of the garbled circuit. Thus, the second computing system 410 can store the input wires W2 and the garbled gates. After the input wires W2 and the garbled gates are stored, the second computing system 410 can delete the shared key. Thus, at operation 440, the first private dataset has been sealed into the fixed computation represented by the gate. The input wires W2 can be a set of input wires associated with the respective pairs of data of the private dataset D2.

[0081] At operation 440, the first computing system and the second computing system can delete the shared key and seal the encoded data into the joint computation.

[0082] At operations 445, the first computing system can transmit the first encoded dataset comprising the W1 input wires to the second computing system. For instance, the second computing system can make a call to the first computing system to request that the first encoded dataset be transmitted to the second computing system so that the joint computation can be evaluated for the encoded datasets. [0083] At operation 450, the second computing system can transmit the second encoded dataset comprising the W2 input wires to the first computing system. For instance, the first computing system can make a call to the second computing system to request that the second encoded dataset be transmitted to the first computing system so that the joint computation can be evaluated for the encoded datasets.

[0084] At operation 455, the first computing system can generate an output by evaluating the garbled circuit over W1 and W2. For instance, the parties can perform a join and compute based on W1 and W2. For instance, each party holds key -value pairs. The garbled circuit can be evaluated to compute the aggregated function of the values for keys that match. Thus, the final noisy output is revealed without the ability for either system to determine whether any particular key matched. This can be performed using a garbled circuit representing a value or default function.

[0085] Similarly, at operations 460, the second computing system can generate an output by evaluating the garbled circuit over W1 and W2. The output can be used to perform an intersection of sums, determine a gradient (e.g., as described in Figure 3), or otherwise utilized to perform the joint computation associated with the garbled circuit.

[0086] Figure 5 depicts a flow diagram of an example method 500 to perform secure multi-party computation in accordance with some embodiments of the present disclosure. The method 500 can be performed by processing logic that can include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, method 500 is performed by a server computing system (e.g., server computing system 704) or a client computing system (e.g., first computing system 702 or second computing system 708). Although shown in a particular sequence or order, unless otherwise specified, the order of the processes can be modified. Thus, the illustrated embodiments should be understood only as examples, and the illustrated processes can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processors can be omitted in various embodiments. Thus, not all processes are required in every embodiment. Other process flows are possible.

[0087] At operation 502, processing logic can maintain, by the first computing system, a machine-learned model. In some implementations, the machine-learned model is built on at least one of ReLU layers, SoftMax layers, sigmoid layers, Poisson layers, or linear embeddings. For instance, the machine-learned model can be a classification model. [0088] At operation 504, processing logic can generate a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation.

[0089] As described herein, the first private dataset can include a plurality of identifiers and associated features and the second private dataset comprises a plurality of identifiers and associated labels and the first private dataset and second private dataset can include a plurality of common identifiers.

[0090] As described herein, sealing the first private dataset into a fixed joint computation can include generating a garbled circuit using the shared secret. Generating the garbled circuit using the shared secret can include receiving data indicative of a plurality of input wires and garbled gates. The first computing system can determine data including a first set of input wires corresponding to the first dataset. For instance, the first set of input wires can be determined for each respective set of data of the input data. The processing logic can delete input wires not corresponding to the first dataset. The processing logic can store the first set of input wires.

[0091] The joint computation can include a garbled circuit representing a value-or-default function. Generating the encoded dataset can include one path through the garbled circuit that can be decrypted by, for each input wire, retaining one wire key and forgetting if the wire key corresponds to 1 or 0; and retaining a semantic meaning of an output wire for a respective gate. In some implementations, the fixed joint computation can include an intersection sum. [0092] The first encoded dataset can be generated by hashing the first private dataset into buckets. For instance, the processing logic can generate a plurality of buckets using a hash seed derived from the shared secret, wherein the buckets comprise a bucket identifier, a hashed identifier, and a hashed feature, wherein the buckets are generated using cuckoo hashing such that each bucket identifier is associated with at most one identifier of the first private dataset.

[0093] For each bucket of the plurality of buckets, the processing logic can perform operations. For instance, the processing logic can generate a random vector. The processing logic can determine an error by performing backpropagation of the machine-learned model using the input comprising the hashed feature and the random vector. The processing logic can compute a garbled circuit. The processing logic can store wire labels of the garbled circuit for the respective bucket. In some instances, the sum of the random vectors can equal zero. In some implementations, the sum of the random vectors can equal a randomly generated number (e.g., an amount of differentially private noise). [0094] The shared key can be generated by the first computing system performing a public key exchange with the second computing system. The shared key can be generated by the first computing system and shared with the second computing system.

[0095] At operation 506, processing logic can store, by the first computing system, the first encoded dataset.

[0096] At operation 508, processing logic can delete the shared key.

[0097] At operation 510, processing logic can obtain, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation.

[0098] The second encoded dataset can be generated by hashing the second private dataset into buckets. For instance, the processing logic can generate buckets using the hash seed derived from the shared secret, wherein the buckets comprise a bucket identifier, hashed identifiers, and one or more masked labels, wherein the buckets are generated using standard hashing such that each bucket identifier can be associated with one or more masked labels, wherein the labels are masked by adding a random vector to the label. The processing logic can seal the masked labels into the garbled circuit comprising a value-or-default randomized encoding such that the first computing system can evaluate the value-or-default randomized encoding to retrieve (i) a masked label for matching hashed identifiers or (ii) a default masked label for non-matching hashed identifiers.

[0099] In some instances, second encoded dataset is generated by generating a garbled circuit using the shared key. For example, the processing logic can receive data indicative of a plurality of input wires and garbled gates. The processing logic can determine data including a second set of input wires corresponding to the second dataset. The processing logic can delete output wires not corresponding to the second dataset. The processing logic can store the second set of input wires.

[0100] In some instances, obtaining the second encoded dataset from the second computing system includes transmitting, by the first computing system, a message to the second computing system indicative of the shared key being deleted by the first computing system and a request for the second computing system to transmit the second encoded dataset to the first computing system. The first computing system can receive data including the second encoded dataset.

[0101] At operation 512, processing logic can generate an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input. [0102] At operation 514, processing logic can update the machine-learned model based on the output. For instance, the machine-learned model can include a number of layers with weighted parameters. Updating the machine-learned model can include updating the parameters based on a gradient associated with the training data. In some implementations, the machine-learned model is built on at least one of ReLU layers, SoftMax layers, sigmoid layers, Poisson layers, or linear embeddings.

[0103] The updated machine-learned model can be used to make predictions based on obtained input data. For instance, the processing logic can obtain a new dataset including a number of identifier-feature sets. The identifier-feature sets can include an identifier and one or more features associated with the identifier. The processing logic can input the new dataset into the updated machine-learned model. The processing logic can obtain output including a prediction for a label for each identifier-feature set of the plurality of identifier-feature sets. [0104] Figure 6 A and Figure 6B depict a flow diagram of an example method 600 to perform content load and placement in accordance with some embodiments of the present disclosure. The method 600 can be performed by processing logic that can include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, method 600 is performed by a server computing system (e.g., server computing system 704) or a client computing system (e.g., first computing system 702 or second computing system 708). Although shown in a particular sequence or order, unless otherwise specified, the order of the processes can be modified. Thus, the illustrated embodiments should be understood only as examples, and the illustrated processes can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processors can be omitted in various embodiments. Thus, not all processes are required in every embodiment. Other process flows are possible.

[0105] At operation 602, processing logic can maintain a machine-learned model comprising a plurality of weights. In some implementations, the machine-learned model is built on at least one of ReLU layers, SoftMax layers, sigmoid layers, Poisson layers, or linear embeddings. For instance, the machine-learned model can be a classification model.

[0106] At operation 604, processing logic can generate, by a first computing system, using input data comprising a batch of a first private dataset and a hash seed derived from a shared secret, a plurality of buckets of data comprising a bucket ID, a hashed identifier, and a hashed feature. For instance, a batch of a first private dataset can be selected based on a batch identifier and batch size determined for use for training the machine-learned model. The batch identifier can be used to determine a set of training data that includes common identifiers between a first private dataset and a second private dataset.

[0107] The computing systems can generate a shared secret. For instance, the shared secret can be a cryptographic key as described herein. The shared secret can be utilized to derive a hash seed which can be used to generate buckets. Bucketing the datasets can allow for faster processing in later steps performed by the processing logic.

[0108] At operation 606, processing logic can generate, by the first computing system, a first set of random encoded data of the batch of the first private dataset by for each bucket of the plurality of buckets: generating a random vector; determining an error by performing backpropagation of the machine-learned model using input comprising the hashed feature and the random vector; and computing a garbled circuit. The random vector can be a number of values generated using the shared secret. For instance, the processing logic can determine a noisy gradient for the machine-learned model using the random vector as described with regard to Figure 3.

[0109] At operation 608, processing logic can generate, by the first computing system, a first sum of errors by summing the errors of each bucket of the plurality of buckets to determine a noisy sum of errors. For instance, the sum of errors can be a noisy gradient for the machine-learned model. The noisy gradient can be determined for each bucket of the plurality of buckets. The overall noisy gradient can be determined by summing the noisy gradient determined for each bucket.

[0110] At operation 610, processing logic can store, by the first computing system: (i) the sum of errors, (ii) public key, and (iii) a plurality of stored buckets comprising: the garbled circuit for each bucket, the wire labels for each bucket. As described herein, the first computing system can store the data needed to compute the joint function once the second encoded dataset is received from the second computing system.

[0111] At operation 612, processing logic can delete the shared secret. For instance, any number of cryptographic deletion techniques can be used. In some instances, the secret can be located and be written over with random data to make the key incapable of being recovered. Any existing techniques can be used to delete the shared secret.

[0112] At operation 614, processing logic can obtain a second set of random encoded data comprising (i) encrypted masked labels for a plurality of buckets and (ii) wires associated with the encrypted masked labels for a plurality of buckets. The encrypted masked labels for the plurality of buckets include a label plus random vector which is then input into a garbled circuit. The input wires associated with the encrypted masked labels are stored by the second computing system and the shared secret is deleted. Following the deletion of the shared secret, the second set of random encoded data is transmitted from the second computing system to the first computing system.

[0113] At operation 616, processing logic can, for each bucket of the plurality of stored buckets: evaluate the garbled circuit to generate a recovered masked label as output; and determine an error by performing backpropagation of the machine-learned model using input comprising a feature and the recovered masked label. In some implementations, determining the error by performing backpropagation of the machine-learned model is performed using input comprising a feature and the recovered masked label divided by two. In some implementations the masked label can be divided by a factor. In some instances, the optimal factor can be two. For instance, the garbled circuit can be a representation of a value-or- default function such that if a key is in common between the first encoded dataset and the second encoded dataset, the masked label will be returned and if there is no match, the default label value plus the random vector will be returned. The error determined can be a gradient of the masked labels such that the gradient of the features and labels can be calculated as described herein. Backpropagation can be performed using a standard loss function. The standard loss function can include at least one of Poisson loss, sigmoid loss, cross-entropy, or SoftMax-loss.

[0114] At operation 618, processing logic can compute, by the first computing system, a gradient update for the batch. In some implementations, the gradient update for the batch is computed by doubling the sum of the second set of errors minus the first sum of errors. In some implementations, the gradient update is computed based on a factor of the sum of the second set of errors. In some implementations, an optimal factor can be two. The gradient update can be generated by combining the first sum of errors and the second sum of errors. The first sum of errors can be indicative of the noisy gradient. The second sum of errors can be indicative of the masked labels gradient. As described herein, e.g., with regard to Figure 3, the calculated gradients can be used to determine the gradient update which can in turn be used to update the machine-learned model.

[0115] At operation 620, processing logic can update, by the first computing system, the plurality of weights associated with the machine-learned model based on the gradient update. The machine-learned model can be continually trained by repeating the process for multiple batches of training data which can be gathered in a single time or can be gathered over a number of days. For instance, gradient updates can be performed using parallel processing allowing for training with multiple datasets to be performed simultaneously. Additionally, or alternatively, the machine-learned model can be trained and updated on a regular cadence such that trends in data can be taken into account for future predictions made by the model. Thus, the machine-learned model can be updated in near-real time.

[0116] Figure 7 depicts a block diagram of an example computing system 700 that performs collaborative randomized encodings according to example embodiments of the present disclosure. The computing system 700 includes a first computing system 702, a server computing system 704, a training computing system 706, and a second computing system 708 that are communicatively coupled over a network 730.

[0117] The first computing system 702 can be any type of computing device, such as, for example, a personal computing device (e.g., laptop or desktop), a mobile computing device (e.g., smartphone or tablet), a gaming console or controller, a wearable computing device, an embedded computing device, or any other type of computing device.

[0118] The first computing system 702 includes one or more processors 712 and a memory 714. The one or more processors 712 can be any suitable processing device (e.g., a processor core, a microprocessor, an ASIC, an FPGA, a controller, a microcontroller, etc.) and can be one processor or a plurality of processors that are operatively connected. The memory 714 can include one or more non-transitory computer-readable storage media, such as RAM, ROM, EEPROM, EPROM, flash memory devices, magnetic disks, etc., and combinations thereof. The memory 714 can store data 716 and instructions 718 which are executed by the processor 712 to cause the first computing system 702 to perform operations.

[0119] In some implementations, the client computing system can include a user interface. The user interface can include a graphical user interface, audio user interface, touch user interface, or any other user interface. The client computing system can include a user input component. The user input component can be associated with user interface and can be capable of obtaining user input. For instance, user input can include touch, audio, or other user input. In some instances, user input components can be capable of obtaining user input and translating the user input into a computer readable form.

[0120] First computing system 702 can include database 722. Database 722 can store private data 724 and encoded data 726. Private data 724 can be stored by first computing system 702. Encoded data 726 can be stored by first computing system 702 and transmitting to second computing system 708 after a shared key has been destroyed by second computing system 708. [0121] As described above, the first computing system 702 can store or otherwise include one or more models 720. For example, the models 720 can be or can otherwise include various statistical or machine-learned models. Example machine-learned models include neural networks or other multi-layer non-linear models. Example neural networks include feed forward neural networks, deep neural networks, recurrent neural networks, and convolutional neural networks. Some example machine-learned models can leverage an attention mechanism such as self-attention. For example, some example machine-learned models can include multi-headed self-attention models (e.g., transformer models).

[0122] The first computing system 702, second computing system 708, or the server computing system 704 can train the models 720, 740, 790 via interaction with the training computing system 706 that is communicatively coupled over the network 730. The training computing system 706 can be separate from the first computing system 702, second computing system 708, or server computing system 704 or can be a portion of the first computing system 702, second computing system 708, or server computing system 704. [0123] The server computing system 704 includes one or more processors 732 and a memory 734. The one or more processors 732 can be any suitable processing device (e.g., a processor core, a microprocessor, an ASIC, an FPGA, a controller, a microcontroller, etc.) and can be one processor or a plurality of processors that are operatively connected. The memory 634 can include one or more non-transitory computer-readable storage media, such as RAM, ROM, EEPROM, EPROM, flash memory devices, magnetic disks, etc., and combinations thereof. The memory 734 can store data 736 and instructions 738 which are executed by the processor 732 to cause the server computing system 704 to perform operations.

[0124] In some implementations, the server computing system 704 includes or is otherwise implemented by one or more server computing devices. In instances in which the server computing system 704 includes plural server computing devices, such server computing devices can operate according to sequential computing architectures, parallel computing architectures, or some combination thereof.

[0125] Server computing system 704 can be configured to obtain data from first computing system 702 (e.g., via an application) or second computing system 708. For instance, server computing system 704 can utilize the obtained user input data to update or train one or more models 720, 740, or 790.

[0126] As described above, the server computing system 704 can store or otherwise include one or more models 740. For example, the models 740 can be or can otherwise include various statistical or machine-learned models. Example machine-learned models include neural networks or other multi-layer non-linear models. Example neural networks include feed forward neural networks, deep neural networks, recurrent neural networks, and convolutional neural networks. Some example machine-learned models can leverage an attention mechanism such as self-attention. For example, some example machine-learned models can include multi-headed self-attention models (e.g., transformer models).

[0127] The second computing system 708 includes one or more processors 772 and a memory 774. The one or more processors 772 can be any suitable processing device (e.g., a processor core, a microprocessor, an ASIC, an FPGA, a controller, a microcontroller, etc.) and can be one processor or a plurality of processors that are operatively connected. The memory 774 can include one or more non-transitory computer-readable storage media, such as RAM, ROM, EEPROM, EPROM, flash memory devices, magnetic disks, etc., and combinations thereof. The memory 774 can store data 776 and instructions 778 which are executed by the processor 772 to cause the second computing system 708 to perform operations.

[0128] In some implementations, the second computing system 708 includes or is otherwise implemented by one or more server computing devices. In instances in which the second computing system 708 includes plural server computing devices, such server computing devices can operate according to sequential computing architectures, parallel computing architectures, or some combination thereof.

[0129] Second computing system 708 can include database 780. Database 780 can store private data 781 and encoded data 782. Private data 781 can be stored by second computing system 708. Encoded data 782 can be stored by second computing system 708 and transmitting to first computing system 702 after a shared key has been destroyed by first computing system 702.

[0130] Second computing system 708 can be communicatively connected over network 730 to server computing system 704. In some instances, second computing system 708 can be a computing system associated with the server computing system 704 or first computing system 702. In some instances, second computing system 708 can be associated with a third- party, for instance, a content provider (e.g., advertiser). There can be more than one second computing system 708.

[0131] The training computing system 706 includes one or more processors 752 and a memory 754. The one or more processors 752 can be any suitable processing device (e.g., a processor core, a microprocessor, an ASIC, an FPGA, a controller, a microcontroller, etc.) and can be one processor or a plurality of processors that are operatively connected. The memory 754 can include one or more non -transitory computer-readable storage media, such as RAM, ROM, EEPROM, EPROM, flash memory devices, magnetic disks, etc., and combinations thereof. The memory 754 can store data 756 and instructions 758 which are executed by the processor 752 to cause the training computing system 706 to perform operations. In some implementations, the training computing system 706 includes or is otherwise implemented by one or more server computing devices.

[0132] The training computing system 706 can include a model trainer 760 that trains the machine-learned models 720, 740, or 790 stored at the first computing system 702, the server computing system 704, or the second computing system 708 using various training or learning techniques, such as, for example, backwards propagation of errors. For example, a loss function can be backpropagated through the model(s) to update one or more parameters of the model(s) (e.g., based on a gradient of the loss function). Various loss functions can be used such as mean squared error, likelihood loss, cross entropy loss, hinge loss, or various other loss functions. Gradient descent techniques can be used to iteratively update the parameters over a number of training iterations. Gradient descent techniques are discussed in further detail with regard to Figure 3, Figure 5, and Figure 6.

[0133] In some implementations, performing backwards propagation of errors can include performing truncated backpropagation through time. The model trainer 760 can perform a number of generalization techniques (e.g., weight decays, dropouts, etc.) to improve the generalization capability of the models being trained.

[0134] In particular, the model trainer 760 can train the models 720, 740, or 790 based on a set of training data. The training data can include, for example, encoded data 782, encoded data 726, historic signal data, publisher-rendered native content item data, user input data, conversion data, user device location data, click data, or any other relevant data (e.g., data stored in database 780 or database 722, and the like).

[0135] The model trainer 760 includes computer logic utilized to provide desired functionality. The model trainer 760 can be implemented in hardware, firmware, or software controlling a general -purpose processor. For example, in some implementations, the model trainer 760 includes program files stored on a storage device, loaded into a memory, and executed by one or more processors. In other implementations, the model trainer 760 includes one or more sets of computer-executable instructions that are stored in a tangible computer- readable storage medium such as RAM, hard disk, or optical or magnetic media.

[0136] The network 730 can be any type of communications network, such as a local area network (e.g., intranet), wide area network (e.g., Internet), or some combination thereof and can include any number of wired or wireless links. In general, communication over the network 730 can be carried via any type of wired or wireless connection, using a wide variety of communication protocols (e.g., TCP/IP, HTTP, SMTP, FTP), encodings or formats (e.g., HTML, XML), or protection schemes (e.g., VPN, secure HTTP, SSL).

[0137] The machine-learned models described in this specification may be used in a variety of tasks, applications, or use cases.

[0138] In some implementations, the input to the machine-learned model(s) of the present disclosure can be image data. The machine-learned model(s) can process the image data to generate an output. As an example, the machine-learned model(s) can process the image data to generate an image recognition output (e.g., a recognition of the image data, a latent embedding of the image data, an encoded representation of the image data, a hash of the image data, etc.). As another example, the machine-learned model(s) can process the image data to generate an image segmentation output. As another example, the machine-learned model(s) can process the image data to generate an image classification output. As another example, the machine-learned model(s) can process the image data to generate an image data modification output (e.g., an alteration of the image data, etc.). As another example, the machine-learned model(s) can process the image data to generate an encoded image data output (e.g., an encoded and/or compressed representation of the image data, etc.). As another example, the machine-learned model(s) can process the image data to generate an upscaled image data output. As another example, the machine-learned model(s) can process the image data to generate a prediction output.

[0139] In some implementations, the input to the machine-learned model(s) of the present disclosure can be text or natural language data. The machine-learned model(s) can process the text or natural language data to generate an output. As an example, the machine-learned model(s) can process the natural language data to generate a language encoding output. As another example, the machine-learned model(s) can process the text or natural language data to generate a latent text embedding output. As another example, the machine-learned model(s) can process the text or natural language data to generate a translation output. As another example, the machine-learned model(s) can process the text or natural language data to generate a classification output. As another example, the machine-learned model(s) can process the text or natural language data to generate a textual segmentation output. As another example, the machine-learned model(s) can process the text or natural language data to generate a semantic intent output. As another example, the machine-learned model(s) can process the text or natural language data to generate an upscaled text or natural language output (e.g., text or natural language data that is higher quality than the input text or natural language, etc.). As another example, the machine-learned model(s) can process the text or natural language data to generate a prediction output.

[0140] In some implementations, the input to the machine-learned model(s) of the present disclosure can be speech data. The machine-learned model(s) can process the speech data to generate an output. As an example, the machine-learned model(s) can process the speech data to generate a speech recognition output. As another example, the machine-learned model(s) can process the speech data to generate a speech translation output. As another example, the machine-learned model(s) can process the speech data to generate a latent embedding output. As another example, the machine-learned model(s) can process the speech data to generate an encoded speech output (e.g., an encoded or compressed representation of the speech data, etc.). As another example, the machine-learned model(s) can process the speech data to generate an upscaled speech output (e.g., speech data that is higher quality than the input speech data, etc.). As another example, the machine-learned model(s) can process the speech data to generate a textual representation output (e.g., a textual representation of the input speech data, etc.). As another example, the machine-learned model(s) can process the speech data to generate a prediction output.

[0141] In some implementations, the input to the machine-learned model(s) of the present disclosure can be latent encoding data (e.g., a latent space representation of an input, etc.). The machine-learned model(s) can process the latent encoding data to generate an output. As an example, the machine-learned model(s) can process the latent encoding data to generate a recognition output. As another example, the machine-learned model(s) can process the latent encoding data to generate a reconstruction output. As another example, the machine-learned model(s) can process the latent encoding data to generate a search output. As another example, the machine-learned model(s) can process the latent encoding data to generate a reclustering output. As another example, the machine-learned model(s) can process the latent encoding data to generate a prediction output.

[0142] In some implementations, the input to the machine-learned model(s) of the present disclosure can be statistical data. Statistical data can be, represent, or otherwise include data computed or calculated from some other data source. The machine-learned model(s) can process the statistical data to generate an output. As an example, the machine-learned model(s) can process the statistical data to generate a recognition output. As another example, the machine-learned model(s) can process the statistical data to generate a prediction output. As another example, the machine-learned model(s) can process the statistical data to generate a classification output. As another example, the machine-learned model(s) can process the statistical data to generate a segmentation output. As another example, the machine-learned model(s) can process the statistical data to generate a visualization output. As another example, the machine-learned model(s) can process the statistical data to generate a diagnostic output.

[0143] In some cases, the input includes visual data, and the task is a computer vision task. In some cases, the input includes pixel data for one or more images and the task is an image processing task. For example, the image processing task can be image classification, where the output is a set of scores, each score corresponding to a different object class and representing the likelihood that the one or more images depict an object belonging to the object class. The image processing task may be object detection, where the image processing output identifies one or more regions in the one or more images and, for each region, a likelihood that region depicts an object of interest. As another example, the image processing task can be image segmentation, where the image processing output defines, for each pixel in the one or more images, a respective likelihood for each category in a predetermined set of categories. For example, the set of categories can be foreground and background. As another example, the set of categories can be object classes. As another example, the image processing task can be depth estimation, where the image processing output defines, for each pixel in the one or more images, a respective depth value. As another example, the image processing task can be motion estimation, where the network input includes multiple images, and the image processing output defines, for each pixel of one of the input images, a motion of the scene depicted at the pixel between the images in the network input.

[0144] In some cases, the input includes audio data representing a spoken utterance and the task is a speech recognition task. The output may comprise a text output which is mapped to the spoken utterance. In some cases, the task comprises encrypting or decrypting input data. In some cases, the task comprises a microprocessor performance task, such as branch prediction or memory address translation.

[0145] Figure 7 illustrates one example computing system that can be used to implement the present disclosure. Other computing systems can be used as well. For example, in some implementations, the first computing system 702 or second computing system 708 can include the model trainer 760 and the training data. In such implementations, the models 720, 740, or 790 can be both trained and used locally at the first computing system 702 or second computing system 708. [0146] The technology discussed herein makes reference to servers, databases, software applications, and other computer-based systems, as well as actions taken, and information sent to and from such systems. The inherent flexibility of computer-based systems allows for a great variety of possible configurations, combinations, and divisions of tasks and functionality between and among components. For instance, processes discussed herein can be implemented using a single device or component or multiple devices or components working in combination. Databases and applications can be implemented on a single system or distributed across multiple systems. Distributed components can operate sequentially or in parallel.

[0147] While the present subject matter has been described in detail with respect to various specific example embodiments thereof, each example is provided by way of explanation, not limitation of the disclosure. Those skilled in the art, upon attaining an understanding of the foregoing, can readily produce alterations to, variations of, and equivalents to such embodiments. Accordingly, the subject disclosure does not preclude inclusion of such modifications, variations or additions to the present subject matter as would be readily apparent to one of ordinary skill in the art. For instance, features illustrated or described as part of one embodiment can be used with another embodiment to yield a still further embodiment. Thus, it is intended that the present disclosure covers such alterations, variations, and equivalents.

[0148] The depicted or described steps are merely illustrative and can be omitted, combined, or performed in an order other than that depicted or described; the numbering of depicted steps is merely for ease of reference and does not imply any particular ordering is necessary or preferred.

[0149] The functions or steps described herein can be embodied in computer-usable data or computer-executable instructions, executed by one or more computers or other devices to perform one or more functions described herein. Generally, such data or instructions include routines, programs, objects, components, data structures, or the like that perform particular tasks or implement particular data types when executed by one or more processors in a computer or other data-processing device. The computer-executable instructions can be stored on a computer-readable medium such as a hard disk, optical disk, removable storage media, solid-state memory, read-only memory (ROM), random-access memory (RAM), or the like. As will be appreciated, the functionality of such instructions can be combined or distributed as desired. In addition, the functionality can be embodied in whole or in part in firmware or hardware equivalents, such as integrated circuits, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or the like. Particular data structures can be used to implement one or more aspects of the disclosure more effectively, and such data structures are contemplated to be within the scope of computer-executable instructions or computer-usable data described herein.

[0150] Although not required, one of ordinary skill in the art will appreciate that various aspects described herein can be embodied as a method, system, apparatus, or one or more computer-readable media storing computer-executable instructions. Accordingly, aspects can take the form of an entirely hardware embodiment, an entirely software embodiment, an entirely firmware embodiment, or an embodiment combining software, hardware, or firmware aspects in any combination.

[0151] As described herein, the various methods and acts can be operative across one or more computing devices or networks. The functionality can be distributed in any manner or can be located in a single computing device (e.g., server, client computer, user device, or the like).

[0152] Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, or variations within the scope and spirit of the appended claims can occur to persons of ordinary skill in the art from a review of this disclosure. For example, one or ordinary skill in the art can appreciate that the steps depicted or described can be performed in other than the recited order or that one or more illustrated steps can be optional or combined. Any and all features in the following claims can be combined or rearranged in any way possible.

[0153] Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, or variations within the scope and spirit of the appended claims can occur to persons of ordinary skill in the art from a review of this disclosure. Any and all features in the following claims can be combined or rearranged in any way possible. Accordingly, the scope of the present disclosure is by way of example rather than by way of limitation, and the subject disclosure does not preclude inclusion of such modifications, variations or additions to the present subject matter as would be readily apparent to one of ordinary skill in the art. Moreover, terms are described herein using lists of example elements joined by conjunctions such as “and,” “or,” “but,” etc. It should be understood that such conjunctions are provided for explanatory purposes only. Lists joined by a particular conjunction such as “or,” for example, can refer to “at least one of’ or “any combination of’ example elements listed therein, with “or” being understood as “and/or” unless otherwise indicated. Also, terms such as “based on” should be understood as “based at least in part on.”

[0154] While the present subject matter has been described in detail with respect to various specific example embodiments thereof, each example is provided by way of explanation, not limitation of the disclosure. Those skilled in the art, upon attaining an understanding of the foregoing, can readily produce alterations to, variations of, or equivalents to such embodiments. Accordingly, the subject disclosure does not preclude inclusion of such modifications, variations, or additions to the present subject matter as would be readily apparent to one of ordinary skill in the art. For instance, features illustrated or described as part of one embodiment can be used with another embodiment to yield a still further embodiment. Thus, it is intended that the present disclosure covers such alterations, variations, or equivalents.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: maintaining, by a first computing system, a machine-learned model; generating a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation; storing, by the first computing system, the first encoded dataset; deleting, by the first computing system, the shared key; obtaining, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation; generating, by the first computing system, an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input; and updating, by the first computing system, the machine-learned model based on the output.

2. The method of claim 1, wherein sealing the first private dataset into a fixed joint computation comprises: generating a garbled circuit using the shared key by: receiving data indicative of a plurality of input wires and garbled gates; determining, by the first computing system, data comprising a first set of input wires corresponding to the first encoded dataset; deleting, by the first computing system, input wires not corresponding to the first encoded dataset; and storing, by the first computing system, the first set of input wires.

3. The method of any preceding claim, wherein the shared key is generated by the first computing system performing a public key exchange with the second computing system.

4. The method of any preceding claim, wherein the shared key is generated by the first computing system and shared with the second computing system.

5. The method of any preceding claim, wherein the fixed joint computation comprises a garbled circuit representing a value-or-default function.

6. The method of claim 5, wherein generating the first encoded dataset comprises one path through the garbled circuit that can be decrypted by, for each input wire: retaining one wire key and forgetting if the wire key corresponds to 1 or 0; and retaining a semantic meaning of an output wire for a respective gate.

7. The method of any preceding claim, wherein the first private dataset comprises a plurality of identifiers and associated features and the second private dataset comprises a plurality of identifiers and associated labels and the first private dataset and the second private dataset comprise a plurality of common identifiers.

8. The method of any preceding claim, wherein the first encoded dataset is generated by: generating a plurality of buckets using a hash seed derived from the shared key, wherein the buckets comprise a bucket identifier, a hashed identifier, and a hashed feature, wherein the buckets are generated using cuckoo hashing such that each bucket identifier is associated with at most one identifier of the first private dataset; for each bucket of the plurality of buckets: generating a random vector; determining an error by performing backpropagation of the machine-learned model using the input comprising the hashed feature and the random vector; computing a garbled circuit; and storing wire labels of the garbled circuit for the respective bucket.

9. The method of claim 8, wherein the second encoded dataset is generated by: generating buckets using the hash seed derived from the shared key, wherein the buckets comprise a bucket identifier, hashed identifiers, and one or more masked labels, wherein the buckets are generated using standard hashing such that each bucket identifier can be associated with one or more masked labels, wherein the labels are masked by adding a random vector to the label; and sealing the masked labels into the garbled circuit comprising a value-or-default randomized encoding such that the first computing system can evaluate the value-or-default randomized encoding to retrieve (i) a masked label for matching hashed identifiers or (ii) a default masked label for non-matching hashed identifiers.

10. The method of claim 8, comprising: obtaining, by the first computing system, a new dataset comprising a plurality of identifier-feature sets, wherein the identifier-features sets comprise an identifier and one or more features associated with the identifier; inputting, by the first computing system, the new dataset into the updated machine- learned model; and obtaining, by the first computing system, output comprising a prediction for a label for each identifier-feature set of the plurality of identifier-features sets.

11. The method of any preceding claim, wherein the fixed joint computation comprises an intersection sum.

12. The method of claim 10, wherein a sum of the random vectors equals zero.

13. The method of claim 10 or claim 12, wherein a sum of the random vectors equals a randomly generated number.

14. The method of any of claim 10 or claim 12-13, wherein the second encoded dataset is generated by generating a garbled circuit using the shared key by: receiving data indicative of a plurality of input wires and garbled gates; determining data comprising a second set of input wires corresponding to the second dataset; deleting input wires not corresponding to the second dataset; and storing the second set of input wires.

15. The method of any of claim 10 or claim 12-14, wherein obtaining, by the first computing system, the second encoded dataset from a second computing system comprises: transmitting, by the first computing system, a message to the second computing system indicative of the shared key being deleted by the first computing system and a request for the second computing system to transmit the second encoded dataset to the first computing system; and receiving, by the first computing system, data comprising the seconded encoded dataset.

16. The method of any of claim 10 or claim 12-15, wherein the machine-learned model is built on at least one of ReLU layers, SoftMax layers, sigmoid layers, Poisson layers, or linear embeddings.

17. A computing system, comprising: one or more processors; and one or more memory devices storing computer-readable instructions that, when implemented, cause the one or more processors to perform operations, the operations comprising: maintaining a machine-learned model comprising a plurality of weights; generating, by a first computing system, using input data comprising a batch of a first private dataset and a hash seed derived from a shared secret, a plurality of buckets of data comprising a bucket ID, a hashed identifier, and a hashed feature; generating, by the first computing system, a first set of random encoded data of the batch of the first private dataset by: for each bucket of the plurality of buckets: generating a random vector; determining an error by performing backpropagation of the machine- learned model using input comprising the hashed feature and the random vector; computing a garbled circuit; and storing wire labels of the garbled circuit for the respective bucket; generating, by the first computing system, a first sum of errors by summing the errors of each bucket of the plurality of buckets to determine a noisy sum of errors; storing, by the first computing system: (i) the sum of errors, (ii) public key, and (iii) a plurality of stored buckets comprising: the garbled circuit for each bucket, the wire labels for each bucket; and deleting, by the first computing system, the shared secret; obtaining, by the first computing system and from a second computing system, a second set of random encoded data comprising (i) encrypted masked labels for a plurality of buckets and (ii) wires associated with the encrypted masked labels for a plurality of buckets; for each bucket of the plurality of stored buckets: evaluating the garbled circuit to generate a recovered masked label as output; determining an error by performing backpropagation of the machine-learned model using input comprising a feature and the recovered masked label; computing, by the first computing system, a gradient update for the batch; and updating, by the first computing system, the plurality of weights associated with the machine-learned model based on the gradient update.

18. The computing system of claim 17, wherein backpropagation is performed using a standard loss function, wherein the standard loss function comprises at least one of Poisson loss, sigmoid loss, cross-entropy, or SoftMax-loss.

19. The computing system of claim 17 or 18, wherein determining the error by performing backpropagation of the machine-learned model is performed using input comprising a feature and the recovered masked label divided by two; and wherein the gradient update for the batch is computed by doubling the sum of the second set of errors minus the first sum of errors.

20. A computer-readable medium storing computer-readable instructions that, when implemented, cause the one or more processors to perform operations, the operations comprising: maintaining, by a first computing system, a machine-learned model; generating a first encoded dataset by sealing, by the first computing system using a shared key, a first private dataset into a fixed joint computation; storing, by the first computing system, the first encoded dataset; deleting, by the first computing system, the shared key; obtaining, by the first computing system, a second encoded dataset from a second computing system, wherein the second encoded dataset was generated by the second computing system using the shared key to seal a second private dataset into the fixed joint computation; generating, by the first computing system, an output by evaluating the fixed joint computation using the first encoded dataset and the second encoded dataset as input; and updating, by the first computing system, the machine-learned model based on the output.