Google Inc.

Yahoo! Inc.

International Business Machines Corporation

Verizon Media Inc.

Shanmugasundaram Ravikumar

Andrew Stephen Tomkins

Bo Pang

Shalini Agarwal

Mark Yinan Li

Prabhakar Raghavan

MyLinh Yang

Dandapani Sivakumar

Deepayan Chakrabarti

Kunal Punera

Jasmine Novak

Badih Ghazi

Pasin Manurangsi

Sridhar Rajagopalan

Cameron A Marlow

Mohammad Mahdian

Anirban Dasgupta

Sergei Vassilvitskii

Ramanathan V Guha

Byron Edward Dom

Erik Nathan Vee

Pavel Berkhin

David Andrew Gibson

Soumen Chakrabarti

Raghu Ramakrishnan

Joshua Ruizhi Wang

Nilesh Dalvi

Manish Deepak Purohit

Zoya Svitkina

Noah Zeger Golowich

Marcus Felipe Fontoura

Vanja Josifovski

Sujith Ravi

Cynthia Dwork

Joseph Andrew Magnani

Benjamin Clay Reed

John Anthony Tomlin

Tristan Harris

Christopher Olston

Can Sar

Angelo DiNardi

Randolph Preston McAfee

Micah Dubinko

Rasmus Pagh

Ameya Avinash Velingker

Amit Sahai

Daniel M Shiffman

Daniel Gruhl

Sreenivas Gollapudi

Andrei Z Broder

Deepak Agarwal

Nachiappan Valliappan

Belle L Tseng

Alexander Fabrikant

Ronald Fagin

Vladimir Ofitserov

Uma Mahadevan

Simeon Naor

R Preston McAfee

Junfeng He

Tamas Sarlos

Dz-Mou Jung

Phokion Kolaitis

Joseph Sean Cahill Goodknight Knightbrook

Usama M Fayyad

Vinay Kakade

Matthew Tran Clegg

Ran Canetti

Kai Jochen Kohlhoff

David Reiley

Sai-Ming Li

Bahman Bahmani

Vidhya Navalpakkam

Amruta Sadanand Joshi

Amer Sinha

Aris Anagnostopoulos

Chiyuan Zhang

Ashton Anderson

Hung-Kuo (James) Chu

Moses Samson Charikar

Rajat Ahuja

Amit Sasturkar

Preston McAfee

Pritish Kamath

Kewen Wu

Jelani Osei Nelson

Mylinh Yang

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for training neural networks with label differential privacy. One of the methods includes, for each training example: processing the network input in the training example using the neural network in accordance with the values of the network parameters as of the beginning of the training iteration to generate a network output, generating a private network output for the training example from the target output in the training example and the network output for the training example, and generating a modified training example that includes the network input in the training example and the private network output for the training example; and training the neural network on at least the modified training examples to update the values of the network parameters.

Training neural networks with label differential privacy

Methods, systems, and apparatus, including medium-encoded computer program products, for adaptive privacy-preserving information retrieval. An information server can accept from a user a request for privacy sensitive information accessible to the information server. The information server can determine a remaining privacy allocation for the user of the information server and can determine a noise parameter for a response to the request, where application of the noise parameter to the response can decrease a privacy loss associated with the response. The information server can determine a privacy modifier for the response. In response to the information server determining that the remaining privacy allocation satisfies the privacy modifier, the information server can: (i) determining the response to the request; (ii) apply the noise parameter to the response to produce a noised response; (iii) provide the noised response to the user; and (iv) adjust the remaining privacy allocation according to the privacy modifier.

Adaptive privacy-preserving information retrieval

Improved methods are provided for generating heatmaps or other summary map data from multiple users' data (e.g., probability distributions) in a manner that preserves the privacy of the users' data while also generating heatmaps that are visually similar to the 'true' heatmap. These methods include decomposing the average of the users' data (the ‘true’ heatmap) into multiple different spatial scales, injecting random noise into the data at the multiple different spatial scales, and then reconstructing the privacy-preserving heatmap based on the noisy multi-scale representations. The magnitude of the noise injected at each spatial scale is selected to ensure preservation of privacy while also resulting in heatmaps that are visually similar to the ‘true’ heatmap.

Differentially private heatmaps

An encoding method for enabling privacy-preserving aggregation of private data can include obtaining private data including a private value, determining a probabilistic status defining one of a first condition and a second condition, producing a multiset including a plurality of multiset values, and providing the multiset for aggregation with a plurality of additional multisets respectively generated for a plurality of additional private values. In response to the probabilistic status having the first condition, the plurality of multiset values is based at least in part on the private value, and in response to the probabilistic status having the second condition, the plurality of multiset values is a noise message. The noise message is produced based at least in part on a noise distribution that comprises a discretization of a continuous unimodal distribution supported on a range from zero to a number of multiset values included in the plurality of multiset values.

Pure differentially private algorithms for summation in the shuffled model

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for scheduling operations represented on a computation graph. One of the methods receiving, by a computation graph system, a request to generate a schedule for processing a computation graph, obtaining data representing the computation graph generating a separator of the computation graph; and generating the schedule to perform the operations represented in the computation graph, wherein generating the schedule comprises: initializing the schedule with zero nodes; for each node in the separator: determining whether the node has any predecessor nodes in the computation graph, when the node has any predecessor nodes, adding the predecessor nodes to the schedule, and adding the node in the schedule, and adding to the schedule each node in each subgraph that is not a predecessor to any node in the separator on the computation graph.

Scheduling operations on a computation graph

The present disclosure provides practical communication-efficient and low-error algorithms for aggregation of private data. For example, the proposed algorithms can be implemented in the shuffled DP model. Specific example operations that can be performed using the proposed algorithms include summation (e.g., binary summation, integer summation) and histograms over a moderate number of buckets. The proposed algorithms achieve accuracy that is arbitrarily close to that of central DP algorithms with an expected communication per user essentially matching what is needed without any privacy constraints.

Private counting from anonymous messages: near-optimal accuracy with vanishing communication overhead

Example techniques are provided for the task of differentially private clustering. For several basic clustering problems, including Euclidean DensestBall, 1-Cluster, k-means, and k-median, the present disclosure provides efficient differentially private algorithms that achieve essentially the same approximation ratios as those that can be obtained by any non-private algorithm, while incurring only small additive errors. This improves upon existing efficient algorithms that only achieve some large constant approximation factors.

Systems and methods for clustering with list-decodable covers

Methods and apparatus related to identifying one or more messages sent by a user, identifying two or more contacts that are associated with one or more of the messages, determining a strength of relationship score between identified contacts, and utilizing the strength of relationship scores to provide additional information related to the contacts. A strength of relationship score between a contact and one or more other contacts may be determined based on one or more properties of one or more of the messages. In some implementations, contacts groups may be determined based on the strength of relationship scores. In some implementations, contacts groups may be utilized to disambiguate references to contacts in messages. In some implementations, contacts group may be utilized to provide suggestions to the user of additional contacts of a contacts group that includes the indicated recipient contact of a message.

Determining strength of association between user contacts

Methods and apparatus related to determining an effect on dissemination of information related to an event based on a dynamic confidence level associated with the event. For example, an event and an event confidence level of the event may be determined based on a message of a user. An effect on dissemination of information related to the event may be determined based on the confidence level. A new confidence level may be determined based on additional data associated with the event and the effect on dissemination of information may be adjusted based on the new confidence level. In some implementations, the additional data may be based on a new message that is related to the message, such as a reply to the message.

Determining an effect on dissemination of information related to an event based on a dynamic confidence level associated with the event

A social environment is provided by creating an object in response to recognition of an entity in a portion of web content, wherein the object represents the entity, the object is associated with a type selected from a set of types, and the type is associated with a schema selected from a set of schemas, where the social environment includes a set of objects including the object, wherein the objects are instances of corresponding types in a rich system of predefined types, the schemas are associated with the types, metadata is associated with the objects, and there is at least one relationship between at least two objects selected from the set of objects, where the set of objects and the metadata are extensible, such that extensions provided by a first user are available for use by a second user. In one example, metadata provided by a first user is only available to a second user having a relationship with the first user.

Creating secure social applications with extensible types

Growing community of inventors

Berkeley, CA, United States of America

Shanmugasundaram Ravikumar