Bounded device contribution differential privacy

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for using differential privacy device bounded contributions. One of the methods includes maintaining, for each time period from a set of time periods, action data for a device; determining whether a current time period satisfies a time period criterion; selecting, using a result of the determination whether the time period criteria is satisfied and from a set of two or more bound generation processes, a bound generation process for the device; computing, using the bound generation process, a bound on an amount of data from the action data and for the device to transmit to a downstream system; selecting, using the action data for the device, a responsive data set with a size defined by the bound; and transmitting, to the downstream system, the responsive data set with the size defined by the bound.