# US 12,602,616 B2 · Secure machine learning model training using encryption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,616 B2 - Document ID: US12602616B2 - Status: Granted - Kind: B2 - Application number: 18/056,722 - Filed: 2022-11-18 - Published: 2024-05-23 - Granted: 2026-04-14 - Earliest claimed: 2022-11-18 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Xinwei Gong; Abelino E. Jimenez Gajardo; Kinjal Basu - Web page: https://patentgrep.com/patent/US12602616B2 ## CPC - G06N 3/047: Probabilistic or stochastic networks - G06N 20/00: Machine learning - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/09: Supervised learning - G06N 3/0985: Hyperparameter optimisation; Meta-learning; Learning-to-learn - H04L 9/008: {involving homomorphic encryption} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the disclosed technologies include, at a data processor, extracting a subset of messages, creating a set of training samples, creating an encrypted training set, and sending the encrypted training set to a model training system, and, at the model training system, labeling the encrypted training set, training the machine learning model, and decrypting the trained machine learning model. ## Claims ### Claim 1 A method for securely training a machine learning model to classify messages, the method comprising: at a model training system, (i) creating a pre-training set comprising unencrypted negative training samples, and (ii) pre-training the machine learning model on the pre-training set of negative samples to produce a pre-trained machine learning model; at a data processor, (i) encrypting the pre-trained machine learning model by applying a homomorphic encryption mechanism to the pre-trained machine learning model using a public key, (ii) extracting a subset of messages from a set of messages stored at a storage associated with a location identifier, the messages in the set of messages each comprising a source identifier, a destination identifier, and message content, and the messages in the subset of messages each comprising the message content, (iii) creating a set of training samples by applying at least one irreversible content processing mechanism to the subset of messages, (iv) creating an encrypted training set by applying the homomorphic encryption mechanism to each sample of the set of training samples using the public key, and (v) sending the encrypted training set to a model training system; and at the model training system, (i) based on the location identifier, labeling each sample of the encrypted training set with a label used for downstream routing to produce a labeled encrypted training set, (ii) based on the labeled encrypted training set, further training the pre-trained machine learning model to classify input messages with the label, wherein training the pre-trained machine learning model to classify the input messages with the label occurs after the data processor encrypts the pre- trained machine learning model, and (iii) decrypting the trained machine learning model using a private key associated with the public key, the private key accessible to the model training system but not the data processor. ### Claim 2 (depends on 1) The method of claim 1, wherein: the message content comprises at least one of text, audio, or video; and training the pre-trained machine learning model on the labeled encrypted training set comprises adapting the pre-trained machine learning model to a task comprising at least one of a speech recognition task, an image recognition task, or a text recognition task. ### Claim 3 (depends on 2) The method of claim 2, wherein the task comprises detecting abusive messages and the label indicates the messages as abusive or not abusive and wherein the pre-training set of negative samples are labeled not abusive. ### Claim 4 (depends on 1) The method of claim 1, wherein applying at least one content processing mechanism to the subset of messages comprises: transforming the message content to a numerical representation; and applying an embedding mechanism to the numerical representation to produce an embedded representation of the numerical representation. ### Claim 5 (depends on 4) The method of claim 4, wherein applying the homomorphic encryption mechanism to the set of training samples comprises: encoding the embedded representation to produce an encoded representation; and encrypting the encoded representation to produce ciphertext. ### Claim 6 (depends on 5) The method of claim 5, wherein encrypting the encoded representation comprises: applying a Cheon, Kim, Kim and Song (CKKS) homomorphic encryption scheme to the encoded representation to produce the ciphertext, wherein the ciphertext comprises a homomorphically encrypted training sample. ### Claim 7 (depends on 1) The method of claim 1, further comprising: at the data processor, (i) obtaining the public key and (ii) creating the encrypted training set using the public key. ### Claim 8 (depends on 1) The method of claim 1, wherein training the pre-trained machine learning model on the encrypted training set comprises: at the model training system, (i) obtaining the private key from a key management system, and (ii) decrypting the pre-trained trained machine learning model using the private key. ### Claim 9 (depends on 1) The method of claim 1, wherein training the pre-trained machine learning model based on the encrypted training set comprises: calculating a validation loss associated with at least one training step; and decrypting the validation loss. ### Claim 10 (depends on 9) The method of claim 9, further comprising: determining that the decrypted validation loss satisfies a validation loss threshold; and providing the trained machine learning model to a model serving system. ### Claim 11 (depends on 1) The method of claim 1, further comprising: configuring at least one hyperparameter of the pre-trained machine learning model based on a selected homomorphic encryption scheme, wherein configuring the at least one hyperparameter is based on at least one of: a number of mathematical operations computed at a node of an artificial neural network; a number of mathematical operations computed at a layer of the artificial neural network; a total number of mathematical operations computed during a training step of the artificial neural network; or a number of layers of the artificial neural network. ### Claim 12 (depends on 1) The method of claim 1, further comprising: applying the trained machine learning model to at least one input message; by the trained machine learning model, labeling each of the at least one input message with a label; and based on the label, initiating a downstream operation to process the at least one labeled input message differently than messages to which the label is not applied. ### Claim 13 (depends on 1) The method of claim 1, wherein creating the pre-training set comprising the unencrypted negative training samples further comprises: at the model training system, (i) creating the unencrypted negative training samples based on a set of message proxies that are not actual messages, and (ii) labeling each of the unencrypted negative training samples in as a negative sample. ### Claim 14 (depends on 1) The method of claim 1, further comprising: at the model training system, (i) extracting a set of positive training samples comprising actual messages of the set of messages stored at the storage, the set of positive training samples each comprising the message content and labeled positive and (ii) creating the pre-training set using the unencrypted negative training samples and the set of positive training samples. ### Claim 15 A system for securely training a machine learning model to classify messages as abusive or not abusive, the system comprising: a data processor; and a model training system coupled to the data processor; wherein the model training system is to (i) create a pre-training set comprising unencrypted negative training samples, wherein the unencrypted negative training samples are labeled not abusive and (ii) pre-train the machine learning model on the pre-training set of negative samples to produce a pre-trained machine learning model; wherein the data processor is to (i) encrypt the pre-trained machine learning model by applying a homomorphic encryption mechanism to the pre-trained machine learning model using a public key, (ii) extract a subset of messages from a set of messages stored at a storage associated with a location identifier, the messages in the set of messages each comprising a source identifier, a destination identifier, and message content, and the messages in the subset of messages each comprising the message content, (iii) create a set of training samples by applying at least one irreversible content processing mechanism to the subset of messages, (iv) create an encrypted training set by applying the homomorphic encryption mechanism to each sample of the set of training samples using the public key, and (iv) send the encrypted training set to the model training system; and wherein the model training system is further to (i) based on the location identifier, label each sample of the encrypted training set as abusive or not abusive to produce a labeled encrypted training set, (ii) based on the labeled encrypted training set, further train the pre-trained machine learning model to classify input messages as abusive or not abusive, for downstream routing, wherein training the pre-trained machine learning model to classify the input messages as abusive or not abusive occurs after the data processor encrypts the pre-trained machine learning model, and (iii) decrypt the trained machine learning model using a private key associated with the public key, the private key accessible to the model training system but not the data processor. ### Claim 16 (depends on 15) The system of claim 15, wherein: the data processor is further to create the pre-training set comprising the unencrypted negative training samples by (i) obtaining a set of message proxies that are not actual messages, (ii) creating the pre-training set comprising the unencrypted negative training samples using a subset of the set of message proxies, (iii) extracting a set of positive training samples comprising actual messages of the set of messages stored at the storage, the set of positive training samples each comprising the message content and labeled abusive, and (iv) creating the pre-training set comprising the unencrypted negative training samples and the set of positive training samples. ### Claim 17 (depends on 15) The system of claim 15, wherein applying at least one content processing mechanism to the subset of messages comprises: transforming the subset of messages to a numerical representation; and applying an embedding mechanism to the numerical representation to produce an embedded representation of the numerical representation. ### Claim 18 (depends on 17) The system of claim 17, wherein applying the homomorphic encryption mechanism to the set of training samples comprises: encoding the embedded representation to produce an encoded representation; and encrypting the encoded representation to produce ciphertext. ### Claim 19 (depends on 18) The system of claim 18, wherein encrypting the encoded representation comprises: applying a Cheon, Kim, Kim and Song (CKKS) homomorphic encryption scheme to the encoded representation to produce the ciphertext, wherein the ciphertext comprises a homomorphically encrypted training sample. ### Claim 20 (depends on 15) The system of claim 15, wherein training the pre-trained machine learning model comprises: calculating a validation loss associated with at least one training step; and decrypting the validation loss.