# US 12,591,708 B2 · Personal data anonymization with model verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,591,708 B2 - Document ID: US12591708B2 - Status: Granted - Kind: B2 - Application number: 17/095,185 - Filed: 2020-11-11 - Published: 2022-05-12 - Granted: 2026-03-31 - Earliest claimed: 2020-11-11 - Assignees: Twilio Inc. - Applicants: Twilio Inc. - Inventors: Aaron Beach; Liyuan Zhang; Tiffany Callahan; Mengda Liu; Shruti Vempati - Web page: https://patentgrep.com/patent/US12591708B2 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Anonymization is the process to remove personal information from the data. Once the data is anonymized, the data may be used for creating machine-learning models without the risk of invading anyone's privacy. One of the keys to data anonymization is to make sure that the data is really anonymized so nobody could use the anonymized data to obtain private information. Different techniques for data anonymization are presented. Further, the data anonymization techniques are tested for true anonymization by comparing the results from these techniques to a random method of guessing. If the difference in the results is below a predetermined threshold margin, the data anonymization techniques are safe and ready for use. ## Claims ### Claim 1 A computer-implemented method comprising: generating training data associated with electronic messages to be transmitted by a plurality of users, wherein the training data correlates anonymized communications data created by anonymizing the electronic messages to be transmitted by the plurality of users to personally identifiable information (PII) extracted from the electronic messages to be transmitted by the plurality of users, wherein the electronic messages comprise one or more of email messages or short message service (SMS) messages, and wherein anonymizing the electronic messages comprises redacting text of a communication to delete one or more PII values and embedding the redacted text into a vector; training, by one or more processors and based on the training data associated with the electronic messages to be transmitted by the plurality of users, a machine-learning program to generate a PII detection model that extracts PII values from input electronic messages; extracting, by the PII detection model executing on the one or more processors, PII values from anonymized testing electronic messages; determining differences between the extracted PII values obtained from the PII detection model and randomly generated PII values obtained from a random value model that randomly generates PII values using a list of PII values found in the anonymized testing electronic messages based on frequencies of appearance; and responsive to the determined differences between the extracted PII values and the randomly generated PII values being below a predetermined confidence level, determining that anonymization of the electronic messages is valid based on the PII detection model; and causing spam detection to be performed using the electronic messages anonymized based on the PII detection model. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the training data comprises a matrix, each row of the matrix including PII extracted from a corresponding communication and including a vector that anonymizes the corresponding communication. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein the extracted PII values include a PII value extracted from a text of an email message. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the random value model is trained to randomly generate a PII value based on the list of PII values found in the anonymized testing electronic messages based on the frequencies of appearance. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the determining of the differences between the extracted PII values and the randomly generated PII values is based on a difference between a first accuracy in first standard deviations of the PII detection model and a second accuracy in second standard deviations of the random value model. ### Claim 6 (depends on 1) The method as recited in claim 1, further comprising: responsive to the determined differences between the extracted PII values and the randomly generated PII values transgressing the predetermined confidence level, determining that the anonymized testing electronic messages were insufficiently anonymized based on the PII detection model, wherein the determining that the anonymized testing electronic messages were insufficiently anonymized comprises: determining a difference between a first performance of the PII detection model and a second performance of the random value model; and determining that the first and second performances are equivalent when the difference is below a predetermined level. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the extracted PII values include a first name and a last name. ### Claim 8 A system comprising: a memory comprising instructions; and one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising: generating training data associated with electronic messages to be transmitted by a plurality of users, wherein the training data correlates anonymized communications data created by anonymizing the electronic messages to be transmitted by the plurality of users to personally identifiable information (PII) extracted from the electronic messages to be transmitted by the plurality of users, wherein the electronic messages comprise one or more of email messages or short message service (SMS) messages, and wherein anonymizing the electronic messages comprises redacting text of a communication to delete one or more PII values and embedding the redacted text into a vector; training, based on the training data associated with the electronic messages to be transmitted by the plurality of users, a machine-learning program to generate a PII detection model that extracts PII values from input electronic messages; extracting, by the PII detection model executing on the one or more computer processors, PII values from anonymized testing electronic messages; determining differences between the extracted PII values obtained from the PII detection model and randomly generated PII values obtained from a random value model that randomly generates PII values using a list of PII values found in the anonymized testing electronic messages based on frequencies of appearance; and responsive to the determined differences between the extracted PII values and the randomly generated PII values being below a predetermined confidence level, determining that anonymization of the electronic messages is valid based on the PII detection model; and causing spam detection to be performed using the electronic messages anonymized based on the PII detection model. ### Claim 9 (depends on 8) The system as recited in claim 8, wherein the training data comprises a matrix, each row of the matrix including PII extracted from a corresponding communication and including a vector that anonymizes the corresponding communication. ### Claim 10 (depends on 8) The system as recited in claim 8, wherein the random value model is trained to randomly generate a PII value based on the list of PII values found in the anonymized testing electronic messages based on the frequencies of appearance. ### Claim 11 (depends on 8) The system as recited in claim 8, wherein the determining of the differences between the extracted PII values and the randomly generated PII values is based on a difference between a first accuracy in first standard deviations of the PII detection model and a second accuracy in second standard deviations of the random value model. ### Claim 12 A non-transitory machine-readable storage medium including instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising: generating training data associated with electronic messages to be transmitted by a plurality of users, wherein the training data correlates anonymized communications data created by anonymizing the electronic messages to be transmitted by the plurality of users to personally identifiable information (PII) extracted from the electronic messages to be transmitted by the plurality of users, wherein the electronic messages comprise one or more of email messages or short message service (SMS) messages, and wherein anonymizing the electronic messages comprises redacting text of a communication to delete one or more PII values and embedding the redacted text into a vector; training, based on the training data associated with the electronic messages to be transmitted by the plurality of users, a machine-learning program to generate a PII detection model that extracts PII values from input electronic messages; extracting, by the PII detection model executing on the one or more processors, PII values from anonymized testing electronic messages; determining differences between the extracted PII values obtained from the PII detection model and randomly generated PII values obtained from a random value model that randomly generates PII values using a list of PII values found in the anonymized testing electronic messages based on frequencies of appearance; and responsive to the determined differences between the extracted PII values and the randomly generated PII values being below a predetermined confidence level, determining that anonymization of the electronic messages is valid based on the PII detection model; and causing spam detection to be performed using the electronic messages anonymized based on the PII detection model. ### Claim 13 (depends on 12) The non-transitory machine-readable storage medium as recited in claim 12, wherein the training data comprises a matrix, each row of the matrix including PII extracted from a corresponding communication and including a vector that anonymizes the corresponding communication. ### Claim 14 (depends on 12) The non-transitory machine-readable storage medium as recited in claim 12, wherein the random value model is trained to randomly generate a PII value based on the list of PII values found in the anonymized testing electronic messages based on the frequencies of appearance. ### Claim 15 (depends on 12) The non-transitory machine-readable storage medium as recited in claim 12, wherein the determining of the differences between the extracted PII values and the randomly generated PII values is based on a difference between a first accuracy in first standard deviations of the PII detection model and a second accuracy in second standard deviations of the random value model. ### Claim 16 (depends on 8) The system as recited in claim 8, the operations further comprising: responsive to the determined differences between the extracted PII values and the randomly generated PII values transgressing the predetermined confidence level, determining that the anonymized testing electronic messages were insufficiently anonymized based on the PII detection model, wherein the determining that the anonymized testing electronic messages were insufficiently anonymized comprises: determining a difference between a first performance of the PII detection model and a second performance of the random value model; and determining that the first and second performances are equivalent when the difference is below a predetermined level. ### Claim 17 (depends on 12) The non-transitory machine-readable storage medium as recited in claim 12, the operations further comprising: responsive to the determined differences between the extracted PII values and the randomly generated PII values transgressing the predetermined confidence level, determining that the anonymized testing electronic messages were insufficiently anonymized based on the PII detection model, wherein the determining that the anonymized testing electronic messages were insufficiently anonymized comprises: determining a difference between a first performance of the PII detection model and a second performance of the random value model; and determining that the first and second performances are equivalent when the difference is below a predetermined level.