# US 12,001,588 B2 · Interpretability framework for differentially private deep learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,588 B2
- Document ID: US12001588B2
- Status: Granted
- Kind: B2
- Application number: 17/086,244
- Filed: 2020-10-30
- Published: 2022-05-05
- Granted: 2024-06-04
- Earliest claimed: 2020-10-30
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Daniel Bernau; Philip-William Grassal; Hannah Keller; Martin Haerterich
- Web page: https://patentgrep.com/patent/US12001588B2

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)}
- G06F 18/2148: {characterised by the process organisation or structure, e.g. boosting cascade}
- G06F 18/2413: based on distances to training or reference patterns
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Data is received that specifies a bound for an adversarial posterior belief ρc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private function output. Privacy parameters ε, δ are then calculated based on the received data that govern a differential privacy (DP) algorithm to be applied to a function to be evaluated over a dataset. The calculating is based on a ratio of probabilities distributions of different observations, which are bound by the posterior belief ρc as applied to a dataset. The calculated privacy parameters are then used to apply the DP algorithm to the function over the dataset. Related apparatus, systems, techniques and articles are also described.

## Claims

### Claim 1

A computer-implemented method for anonymized analysis of datasets comprising:
receiving data specifying a bound for an adversarial posterior belief ρc that corresponds to a likelihood to re-identify data points from a dataset based on a differentially private function output;
calculating, based on the received data, privacy parameters ε, δ which govern a differential privacy (DP) algorithm to be applied to a function to be evaluated over a dataset, the calculating being based on a ratio of probabilities distributions of different observations which are bound by the posterior belief ρc as applied to the dataset; and
applying, using the calculated privacy parameters ε, δ, the DP algorithm to the function over the dataset.

### Claim 2 (depends on 1)

The method of claim 1, wherein the probability distributions are generated using a Gaussian mechanism with an (ε, δ) guarantee that perturbs a result of the function evaluated over the dataset, preventing a posterior belief greater than ρc on the dataset.

### Claim 3 (depends on 1)

The method of claim 1, wherein the probability distributions are generated using a Laplacian mechanism with an F guarantee that perturbs a result of the function evaluated over the dataset, preventing a posterior belief greater than ρc on the dataset.

### Claim 4 (depends on 1)

The method of claim 1 further comprising:
anonymously training at least one machine learning model using the dataset after application of the DP algorithm to the function over the dataset.

### Claim 5 (depends on 4)

The method of claim 4 further comprising:
deploying the trained at least one machine learning model to classify further data input into the at least one machine learning model.

### Claim 6 (depends on 1)

The method of claim 1, wherein ε=log (ρc/(1−ρc) for a series of (ε, δ) or ε anonymized function evaluations with multidimensional data.

### Claim 7 (depends on 4)

The method of claim 4 further comprising:
calculating a resulting total posterior belief ρc using a sequential composition or Rényi differential privacy (RDP) composition; and
updating the at least one machine learning model using the calculated resulting total posterior belief ρc.