# US 12,762,280 B2 · Interpretability framework for differentially private deep learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,762,280 B2
- Document ID: US12762280B2
- Status: Granted
- Kind: B2
- Application number: 18/904,462
- Filed: 2024-10-02
- Published: 2025-01-30
- Granted: 2026-10-13
- Earliest claimed: 2020-10-30
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Daniel Bernau; Philip-William Grassal; Hannah Keller; Martin Haerterich
- Web page: https://patentgrep.com/patent/US12762280B2

## CPC

- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)}
- G06F 18/2148: {characterised by the process organisation or structure, e.g. boosting cascade}
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Data is received that specifies a bound for an adversarial posterior belief ρc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private function output. Privacy parameters ε, δ are then calculated based on the received data that govern a differential privacy (DP) algorithm to be applied to a function to be evaluated over a dataset. The calculating is based on a ratio of probabilities distributions of different observations, which are bound by the posterior belief ρc as applied to a dataset. The calculated privacy parameters are then used to apply the DP algorithm to the function over the dataset. Related apparatus, systems, techniques and articles are also described.

## Claims

### Claim 1

A system for training a machine learning model comprising:
at least one data processor;
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
receiving a dataset;
receiving at least one first user-generated privacy parameter which governs a differential privacy (DP) algorithm to be applied to a function evaluated over the received dataset;
calculating, based on the received at least one first user-generated privacy parameter, at least one second privacy parameter based on a ratio or overlap of probabilities of distributions of different observations;
applying, using the at least one second privacy parameter, the DP algorithm to the function over the received dataset to result in an anonymized function output, the DP algorithm using the at least one second privacy parameter during execution of one or more steps involved in converting the received dataset into the anonymized function output; and
anonymously training at least one machine learning model using the dataset after application of the DP algorithm to the function over the received dataset which, when deployed, is configured to classify input data.

### Claim 2 (depends on 1)

The system of claim 1, wherein the operations further comprise:
deploying the trained at least one machine learning model;
receiving, by the deployed trained at least one machine learning model, input data.

### Claim 3 (depends on 2)

The system of claim 2, wherein the operations further comprise:
providing, by the deployed trained at least one machine learning model based on the input data, a classification.

### Claim 4 (depends on 1)

The system of claim 1, wherein:
the at least one first user-generated privacy parameter comprises a bound for an adversarial posterior belief pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private function output; and
the calculated at least one second privacy parameter comprises privacy parameters ε, δ; and
the calculating is based on a conditional probability of distributions of different datasets given a differential private function output which are bound by the posterior belief pc as applied to the dataset.

### Claim 5 (depends on 1)

The system of claim 1, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an expected membership advantage pα that corresponds to a probability of an adversary successfully identifying a member in the dataset; and
the calculating is based on a conditional probability of different possible datasets.

### Claim 6 (depends on 1)

The system of claim 1, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an adversarial posterior belief bound pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private output.

### Claim 7 (depends on 6)

The system of claim 6, wherein the calculating is based on a conditional probability of different possible datasets.

### Claim 8

A method comprising:
receiving a dataset;
receiving at least one first user-generated privacy parameter which governs a differential privacy (DP) algorithm to be applied to a function evaluated over the received dataset;
calculating, based on the received at least one first user-generated privacy parameter, at least one second privacy parameter based on a ratio or overlap of probabilities of distributions of different observations;
applying, using the at least one second privacy parameter, the DP algorithm to the function over the received dataset to result in an anonymized function output, the DP algorithm using the at least one second privacy parameter during execution of one or more steps involved in converting the received dataset into the anonymized function output; and
anonymously training at least one machine learning model using the dataset after application of the DP algorithm to the function over the received dataset which, when deployed, is configured to classify input data.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
deploying the trained at least one machine learning model;
receiving, by the deployed trained at least one machine learning model, input data.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
providing, by the deployed trained at least one machine learning model based on the input data, a classification.

### Claim 11 (depends on 8)

The method of claim 8, wherein:
the at least one first user-generated privacy parameter comprises a bound for an adversarial posterior belief pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private function output; and
the calculated at least one second privacy parameter comprises privacy parameters ε, δ; and
the calculating is based on a conditional probability of distributions of different datasets given a differential private function output which are bound by the posterior belief pc as applied to the dataset.

### Claim 12 (depends on 8)

The method of claim 8, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an expected membership advantage pα that corresponds to a probability of an adversary successfully identifying a member in the dataset; and
the calculating is based on a conditional probability of different possible datasets.

### Claim 13 (depends on 8)

The method of claim 8, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an adversarial posterior belief bound pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private output.

### Claim 14 (depends on 13)

The method of claim 13, wherein the calculating is based on a conditional probability of different possible datasets.

### Claim 15

A non-transitory machine-readable storage medium having embodied thereon instructions executable by one or more machines to perform operations comprising:
receiving a dataset;
receiving at least one first user-generated privacy parameter which governs a differential privacy (DP) algorithm to be applied to a function evaluated over the received dataset;
calculating, based on the received at least one first user-generated privacy parameter, at least one second privacy parameter based on a ratio or overlap of probabilities of distributions of different observations;
applying, using the at least one second privacy parameter, the DP algorithm to the function over the received dataset to result in an anonymized function output, the DP algorithm using the at least one second privacy parameter during execution of one or more steps involved in converting the received dataset into the anonymized function output; and
anonymously training at least one machine learning model using the dataset after application of the DP algorithm to the function over the received dataset which, when deployed, is configured to classify input data.

### Claim 16 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the operations further comprise:
deploying the trained at least one machine learning model;
receiving, by the deployed trained at least one machine learning model, input data.

### Claim 17 (depends on 16)

The non-transitory machine-readable storage medium of claim 16, wherein the operations further comprise:
providing, by the deployed trained at least one machine learning model based on the input data, a classification.

### Claim 18 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein:
the at least one first user-generated privacy parameter comprises a bound for an adversarial posterior belief pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private function output; and
the calculated at least one second privacy parameter comprises privacy parameters ε, δ; and
the calculating is based on a conditional probability of distributions of different datasets given a differential private function output which are bound by the posterior belief pc as applied to the dataset.

### Claim 19 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an expected membership advantage pα that corresponds to a probability of an adversary successfully identifying a member in the dataset; and
the calculating is based on a conditional probability of different possible datasets.

### Claim 20 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein
the at least one first user-generated privacy parameter comprises privacy parameters ε, δ;
the calculated at least one second privacy parameter comprises an adversarial posterior belief bound pc that corresponds to a likelihood to re-identify data points from the dataset based on a differentially private output.