A method, comprising: receiving, at a server device and from a client device, a batch of queries that includes queries to special buckets in each database shard, among multiple database shards, being queried by the batch of queries, wherein the special buckets include server-encrypted secret shares generated by the server device; generating, by the server device, a set of query results responsive to the batch of queries, wherein the set of query results includes the server-encrypted secret shares obtained from the special buckets queried by the batch of queries; transmitting, by the server device and to the client device, the set of query results; receiving, at the server device and from the client device, client-encrypted secret shares, wherein the client-encrypted secret shares are client encrypted versions of the secret shares that were included in the set of query results transmitted to the client device; transmitting, by the server device and to the client device, a full set of server-encrypted secret shares, wherein the full set of server-encrypted secret shares includes more server-encrypted secret shares than the set of query results; receiving, at the server device and from the client device, a full set of client-server-encrypted secret shares, wherein the full set of client-server-encrypted secret shares are client encrypted versions of the full set of server-encrypted secret shares that were transmitted to the client device; determining, by the server device, how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device; and classifying, by the server device, the client device based on how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device. receiving, at a server device and from a client device, a batch of queries that includes queries to special buckets in each database shard, among multiple database shards, being queried by the batch of queries, wherein the special buckets include server-encrypted secret shares generated by the server device; generating, by the server device, a set of query results responsive to the batch of queries, wherein the set of query results includes the server-encrypted secret shares obtained from the special buckets queried by the batch of queries; transmitting, by the server device and to the client device, the set of query results; receiving, at the server device and from the client device, client-encrypted secret shares, wherein the client-encrypted secret shares are client encrypted versions of the secret shares that were included in the set of query results transmitted to the client device; transmitting, by the server device and to the client device, a full set of server-encrypted secret shares, wherein the full set of server-encrypted secret shares includes more server-encrypted secret shares than the set of query results; receiving, at the server device and from the client device, a full set of client-server-encrypted secret shares, wherein the full set of client-server-encrypted secret shares are client encrypted versions of the full set of server-encrypted secret shares that were transmitted to the client device; determining, by the server device, how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device; and classifying, by the server device, the client device based on how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device.