# US 12,008,125 B2 · Privacy filters and odometers for deep learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,008,125 B2
- Document ID: US12008125B2
- Status: Granted
- Kind: B2
- Application number: 17/328,785
- Filed: 2021-05-24
- Published: 2022-10-13
- Granted: 2024-06-11
- Earliest claimed: 2021-04-05
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Mathias François Roger Lécuyer
- Web page: https://patentgrep.com/patent/US12008125B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06N 3/04: Architecture, e.g. interconnection topology
- G06N 3/045: Combinations of networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/08: Learning methods
- G06N 3/084: Backpropagation, e.g. using gradient descent
- G06N 3/09: Supervised learning
- G06F 2221/2119: Authenticating web pages, e.g. with suspicious links
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Generally discussed herein are devices, systems, and methods for improving phishing webpage content detection. A method can include instantiating an odometer with a nested privacy filter architecture, the nested privacy filter including privacy filters of different, increasing sizes, training a DL model, maintaining, during training and by a privacy odometer that operates using the nested privacy filter, a running total of privacy loss budget consumed by the training, and responsive to a query for the total privacy loss budget consumed, returning, by the odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.

## Claims

### Claim 1

A compute device comprising:
processing circuitry;
a memory coupled to the processing circuitry, the memory including instructions that, when executed by the processing circuitry, cause the processing circuitry to perform operations for differential privacy (DP) deep learning (DL) model generation, the operations comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
training a DL model;
maintaining, during the training and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training; and
responsive to a query for the running total of the privacy loss budget consumed, returning, by the privacy odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.

### Claim 2 (depends on 1)

The compute device of claim 1, wherein the operations further comprise, after a specified number of iterations of training the DL model, determining a DL model characteristic of the DL model and accounting for a privacy loss budget consumed in determining the DL model characteristic.

### Claim 3 (depends on 2)

The compute device of claim 2, wherein the DL model characteristic includes an overall training set accuracy of the DL model or a difference in training set accuracy between a current epoch and an immediately prior epoch.

### Claim 4 (depends on 3)

The compute device of claim 3, wherein:
the DL model characteristic is the difference in training set accuracy; and
the operations further comprise, responsive to determining the difference in training set accuracy satisfies a first criterion, decreasing an amount of privacy budget consumed in an immediately subsequent epoch.

### Claim 5 (depends on 4)

The compute device of claim 4, wherein decreasing the amount of privacy budget consumed includes increasing an amount of noise applied to a gradient computation for updating the DL model.

### Claim 6 (depends on 4)

The compute device of claim 4, wherein decreasing the amount of privacy budget consumed includes decreasing a batch size of training data for a next epoch.

### Claim 7 (depends on 4)

The compute device of claim 4, wherein the operations further comprise, responsive to determining the difference in training set accuracy satisfies a different, second criterion, increasing an amount of privacy budget consumed in an immediately subsequent epoch.

### Claim 8 (depends on 3)

The compute device of claim 3, wherein:
the DL model characteristic includes the overall training set accuracy of the DL model; and
the operations further comprise, responsive to determining the overall training set accuracy satisfies a third criterion, terminating the training.

### Claim 9 (depends on 1)

The compute device of claim 1, wherein the operations further comprise, responsive to determining the running total of the privacy loss budget consumed is such that a next iteration of training will make the running total of the privacy loss budget consumed exceed a total allowable privacy loss, terminating the training.

### Claim 10 (depends on 9)

The compute device of claim 9, wherein the operations further comprise receiving, from a user and by a user interface, the total allowable privacy loss.

### Claim 11

A method for differentially private (DP) deep learning (DL) model generation, the method comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
training a DL model;
maintaining, during the training and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training; and
responsive to a query for the running total of the privacy loss budget consumed, returning, by the privacy odometer, a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget.

### Claim 12 (depends on 11)

The method of claim 11, further comprising, after a specified number of iterations of training the DL model, determining a DL model characteristic of the DL model and accounting for a privacy loss budget consumed in determining the DL model characteristic.

### Claim 13 (depends on 12)

The method of claim 12, wherein the DL model characteristic includes an overall training set accuracy of the DL model or a difference in training set accuracy between a current epoch and an immediately prior epoch.

### Claim 14 (depends on 13)

The method of claim 13, wherein:
the DL model characteristic is the difference in training set accuracy; and
the method further comprises, responsive to determining the difference in training set accuracy satisfies a first criterion, decreasing an amount of privacy budget consumed in an immediately subsequent epoch.

### Claim 15 (depends on 14)

The method of claim 14, wherein decreasing the amount of privacy budget consumed includes increasing an amount of noise applied to a gradient computation for updating the DL model.

### Claim 16 (depends on 14)

The method of claim 14, wherein decreasing the amount of privacy budget consumed includes decreasing a batch size of training data for a next epoch.

### Claim 17 (depends on 14)

The method of claim 14, further comprising, responsive to determining the difference in training set accuracy satisfies a different, second criterion, increasing an amount of privacy budget consumed in an immediately subsequent epoch.

### Claim 18 (depends on 13)

The method of claim 13, wherein:
the DL model characteristic includes the overall training set accuracy of the DL model; and
the method further comprises, responsive to determining the overall training set accuracy satisfies a second criterion, terminating the training.

### Claim 19

A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for differentially private (DP) deep learning (DL) model generation, the operations comprising:
instantiating a privacy odometer with a nested privacy filter architecture, the nested privacy filter architecture including nested privacy filters of different, increasing sizes;
maintaining, during training of a DL model and by the privacy odometer that operates using the nested privacy filters, a running total of privacy loss budget consumed by the training;
responsive to a query, returning (i) a size of a smallest privacy filter of the nested privacy filters that is bigger than the running total of the privacy loss budget and (ii) an overall training set accuracy of the DL model; and
responsive to receiving data indicating to halt the training of the DL model, terminating the training of the DL model.

### Claim 20 (depends on 19)

The non-transitory, machine-readable medium of claim 19, wherein the operations further comprise, responsive to determining the running total of the privacy loss budget consumed is such that a next iteration of training will make the running total of the privacy loss budget consumed exceed a total allowable privacy loss, terminating the training of the DL model.