Patent Description:
The present disclosure relates generally to privacy management of user data.

Modern day service providers typically collect a variety of information from users to provide different services. The information that is collected can be used for the specific transaction the user intends to perform with the service provider as well as ancillary services. For example, a user may provide personal information (e.g., sensitive data, including credentials such as credit card numbers, debit card numbers and bank account numbers, and personally identifying information such as social security numbers, names, and addresses) to access a given content delivery service and such information can subsequently be used by the content delivery service to run statistics or provide recommendations to the user. While the collection and analysis of such data can be of great benefit not only to the particular user but to other users of the service provider, it can also be the subject of considerable abuse, such as provision of the information to a third party. Such abuse can prevent many otherwise cooperative users from accessing and providing information to the service providers. For these reasons, as well as privacy regulations or regulatory constraints, when personal information is stored in databases, it is incumbent on service providers that control this data to protect the data from abuse.

Document <NPL>, proposes an alternative noise adding mechanism: the staircase mechanism, which is a geometric mixture of uniform random variables. The staircase mechanism can replace the Laplace mechanism in each instance in the literature and for the same level of differential privacy, the performance in each instance improves; the improvement is particularly stark in medium-low privacy regimes.

<CIT> discloses that the privacy of linear queries on histograms is protected. A database containing private data is queried. Base decomposition is performed to recursively compute an orthonormal basis for the database space. Using correlated (or Gaussian) noise and/or least squares estimation, an answer having differential privacy is generated and provided in response to the query.

The invention is a method, system and machine-readable storage medium as defined in the appended claims.

In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide an understanding of various embodiments. It will be evident, however, to those skilled in the art, that embodiments may be practiced without these specific details.

Typical systems employ a number of mechanisms to protect user data they collect from exposure. Such mechanisms typically are referred to as differential privacy, which introduces randomized data to a set of user data to prevent exposure of sensitive user information. Differential privacy is a statistical technique that aims to provide means to maximize the accuracy of queries from statistical databases while measuring (and, thereby, hopefully minimizing) the privacy impact on individuals whose information is in the database.

Typical systems introduce random data to a set of stored user data to protect the user data from exposure using a Laplace mechanism or a Staircase mechanism. The Laplace mechanism ensures ε-differential privacy (also referred to as differential privacy) by adding noise from a Laplace distribution with mean <NUM> and scale <MAT> where <MAT> for a set of user data x and ε is a privacy parameter less than <NUM>. The noise is added such that: <MAT> where L is a random variable with a probability density function defined as: <MAT>.

The Staircase mechanism samples from a geometric mixture of uniform random variables with the probability density function defined as: <MAT> where <MAT> and <MAT>.

This mechanism works well under several assumptions and is derived to minimize either ℓ<NUM> or ℓ<NUM> (variance) loss functions. It assumes that the domain of the output is the entire real line and that the input has a sensitivity of Δ. The noise distribution of the Staircase mechanism does not change as a function of the input x and this mechanism optimizes for a single functional form using the same distribution regardless of whether noise is added to <MAT> , <NUM> or <MAT>.

While both prior approaches generally work well, they both generate values on the whole real line, which leads to loss of efficiency due to the possibility of extreme outliers. Also, the Staircase mechanism involves complex algebraic operations to compute its parameters, which adds computational complexity and lag to the noise generation.

The disclosed embodiments improve the efficiency of using the electronic device by addressing these shortcomings of the prior approaches in generating noise in user data. Particularly, the disclosed embodiments generate a noise distribution that is based on the user data itself using, for example, a Podium distribution or mechanism that generates noise from a truncated distribution rather than the Laplace mechanism that generates noise on the whole real line. The disclosed approaches increase the accuracy of representing the user data over the prior approaches by providing a smaller variance. The disclosed noise distribution takes samples from a "truncated" distribution, meaning its support is not the entire real line, but matches the sensitivity Δ as closely as possible by focusing noise in an improved manner over the prior approaches. Also, the shape of the distribution changes depending on the input value <MAT> which ensures that the noise is centered at x. Certain parameters of the disclosed noise distribution can be precomputed, which reduces the computational complexities and lag during runtime when noise values are generated using the noise distribution.

In some embodiments, a set of input data is stored and a noise distribution is generated based on a two-step function. A height of the two-step function is determined by a privacy parameter, a width of the two-step function is determined by minimizing a variance of the noise distribution, and a mean of the two-step function is determined by a value of the set of input data to be privatized. The noise distribution is applied to the set of input data to generate privatized noisy output data, and the resulting privatized noisy output data is transmitted in response to a request for a portion of, or a complete set of, the input data.

<FIG> is a block diagram showing an example messaging system <NUM> for exchanging data (e.g., messages and associated content) over a network <NUM>. The messaging system <NUM> includes multiple client devices <NUM>, each of which hosts a number of applications, including a messaging client application <NUM> and a data privacy application <NUM>. Each messaging client application <NUM> is communicatively coupled to other instances of the messaging client application <NUM>, the data privacy application <NUM>, and a messaging server system <NUM> via a network <NUM> (e.g., the Internet).

Accordingly, each messaging client application <NUM> and data privacy application <NUM> is able to communicate and exchange data with another messaging client application <NUM> and data privacy application <NUM> and with the messaging server system <NUM> via the network <NUM>. The data exchanged between messaging client applications <NUM>, data privacy applications <NUM>, and between a messaging client application <NUM> and the messaging server system <NUM> includes functions (e.g., commands to invoke functions) as well as payload data (e.g., text, audio, video, or other multimedia data).

The data privacy application <NUM> is an application that includes a set of functions that allow the client device <NUM> to access the data privacy system <NUM>. In some implementations, the data privacy application <NUM> is a component or a feature that is part of the messaging client application <NUM>. Data privacy application <NUM> allows a given user to request access or a statistical analysis of a collection of user data. For example, the user data may represent ages of a set of users and the data privacy application <NUM> may request the average age of the set of users. The data privacy application <NUM> communicates with the data privacy system <NUM>, which applies a noise distribution to the set of data (e.g., using the Podium mechanism) to add random data and generate a result corresponding to the request. For example, the result may represent the average ages of the users that takes into account the added random data. By adding the random data, particular user's data is not exposed in response to the request.

The messaging server system <NUM> provides server-side functionality via the network <NUM> to a particular messaging client application <NUM>. While certain functions of the messaging system <NUM> are described herein as being performed by either a messaging client application <NUM> or by the messaging server system <NUM>, it will be appreciated that the location of certain functionality either within the messaging client application <NUM> or the messaging server system <NUM> is a design choice. For example, it may be technically preferable to initially deploy certain technology and functionality within the messaging server system <NUM>, but to later migrate this technology and functionality to the messaging client application <NUM> where a client device <NUM> has a sufficient processing capacity.

The messaging server system <NUM> supports various services and operations that are provided to the messaging client application <NUM>. Such operations include transmitting data to, receiving data from, and processing data generated by the messaging client application <NUM>. This data may include message content, client device information, geolocation information, media annotation and overlays, virtual objects, message content persistence conditions, social network information, and live event information, as examples. Data exchanges within the messaging system <NUM> are invoked and controlled through functions available via user interfaces (UIs) of the messaging client application <NUM>.

Turning now specifically to the messaging server system <NUM>, an Application Program Interface (API) server <NUM> is coupled to, and provides a programmatic interface to, an application server <NUM>. The application server <NUM> is communicatively coupled to a database server <NUM>, which facilitates access to a database <NUM> in which is stored data associated with messages processed by the application server <NUM>.

Dealing specifically with the API server <NUM>, this server <NUM> receives and transmits message data (e.g., commands and message payloads) between the client device <NUM> and the application server <NUM>. Specifically, the API server <NUM> provides a set of interfaces (e.g., routines and protocols) that can be called or queried by the messaging client application <NUM> in order to invoke functionality of the application server <NUM>. The API server <NUM> exposes various functions supported by the application server <NUM>, including account registration; login functionality; the sending of messages, via the application server <NUM>, from a particular messaging client application <NUM> to another messaging client application <NUM>; the sending of media files (e.g., images or video) from a messaging client application <NUM> to the messaging server application <NUM>, and for possible access by another messaging client application <NUM>; the setting of a collection of media data (e.g., story); the retrieval of such collections; the retrieval of a list of friends of a user of a client device <NUM>; the retrieval of messages and content; the adding and deleting of friends to a social graph; the location of friends within a social graph; access to user conversation data; access to avatar information stored on messaging server system <NUM>; and opening an application event (e.g., relating to the messaging client application <NUM>).

The application server <NUM> hosts a number of applications and subsystems, including a messaging server application <NUM>, an image processing system <NUM>, a social network system <NUM>, and the data privacy system <NUM>. The messaging server application <NUM> implements a number of message processing technologies and functions, particularly related to the aggregation and other processing of content (e.g., textual and multimedia content) included in messages received from multiple instances of the messaging client application <NUM>. As will be described in further detail, the text and media content from multiple sources may be aggregated into collections of content (e.g., called stories or galleries). These collections are then made available, by the messaging server application <NUM>, to the messaging client application <NUM>. Other processor- and memory-intensive processing of data may also be performed server-side by the messaging server application <NUM>, in view of the hardware requirements for such processing.

The application server <NUM> also includes an image processing system <NUM> that is dedicated to performing various image processing operations, typically with respect to images or video received within the payload of a message at the messaging server application <NUM>. A portion of the image processing system <NUM> may also be implemented by the data privacy system <NUM>.

The social network system <NUM> supports various social networking functions and services and makes these functions and services available to the messaging server application <NUM>. To this end, the social network system <NUM> maintains and accesses an entity graph within the database <NUM>. Examples of functions and services supported by the social network system <NUM> include the identification of other users of the messaging system <NUM> with which a particular user has relationships or is "following" and also the identification of other entities and interests of a particular user. Such other users may be referred to as the user's friends. Social network system <NUM> may access location information associated with each of the user's friends to determine where they live or are currently located geographically. Social network system <NUM> may maintain a location profile for each of the user's friends indicating the geographical location where the user's friends live.

The application server <NUM> is communicatively coupled to a database server <NUM>, which facilitates access to a database <NUM> in which is stored data associated with messages processed by the messaging server application <NUM>. Database <NUM> may be a third-party database. For example, the application server <NUM> may be associated with a first entity and the database <NUM> or a portion of the database <NUM> may be associated and hosted by a second different entity. In some implementations, database <NUM> stores user data that the first entity collects about various each of the users of a service provided by the first entity. For example, the user data includes user names, passwords, addresses, friends, activity information, preferences, videos or content consumed by the user, and so forth. The data may be provided by the users voluntarily or may be collected automatically by the first entity and stored in database <NUM>. In some implementations, the data is provided by the user for using a particular function of the service provided by the first entity. In some cases, this same data can be used by another new function or feature or service provided by the first entity. The user may or may not be interested in the new function or feature or service provided by the first entity and accordingly there may be restrictions on the way in which the user's data can be used without express permission by the user. These uses are typically controlled and regulated according to privacy regulations.

<FIG> is a schematic diagram <NUM> illustrating data, which may be stored in the database <NUM> of the messaging server system <NUM>, according to certain example embodiments. While the content of the database <NUM> is shown to comprise a number of tables, it will be appreciated that the data could be stored in other types of data structures (e.g., as an object-oriented database).

The database <NUM> includes message data stored within a message table <NUM>. An entity table <NUM> stores entity data, including an entity graph <NUM>. Entities for which records are maintained within the entity table <NUM> may include individuals, corporate entities, organizations, objects, places, events, and so forth. Regardless of type, any entity regarding which the messaging server system <NUM> stores data may be a recognized entity. Each entity is provided with a unique identifier, as well as an entity type identifier (not shown).

The entity graph <NUM> furthermore stores information regarding relationships and associations between entities. Such relationships may be social, professional (e.g., work at a common corporation or organization), interest-based, or activity-based, merely for example.

Message table <NUM> may store a collection of conversations between a user and one or more friends or entities. Message table <NUM> may include various attributes of each conversation, such as the list of participants, the size of the conversation (e.g., number of users and/or number of messages), the chat color of the conversation, a unique identifier for the conversation, and any other conversation-related feature(s).

The database <NUM> also stores annotation data, in the example form of filters, in an annotation table <NUM>. Database <NUM> also stores annotated content received in the annotation table <NUM>. Filters for which data is stored within the annotation table <NUM> are associated with and applied to videos (for which data is stored in a video table <NUM>) and/or images (for which data is stored in an image table <NUM>). Filters, in one example, are overlays that are displayed as overlaid on an image or video during presentation to a recipient user. Filters may be of various types, including user-selected filters from a gallery of filters presented to a sending user by the messaging client application <NUM> when the sending user is composing a message. Other types of filters include geolocation filters (also known as geo-filters), which may be presented to a sending user based on geographic location. For example, geolocation filters specific to a neighborhood or special location may be presented within a UI by the messaging client application <NUM>, based on geolocation information determined by a Global Positioning System (GPS) unit of the client device <NUM>. Another type of filter is a data filter, which may be selectively presented to a sending user by the messaging client application <NUM>, based on other inputs or information gathered by the client device <NUM> during the message creation process. Examples of data filters include current temperature at a specific location, a current speed at which a sending user is traveling, battery life for a client device <NUM>, or the current time.

Other annotation data that may be stored within the image table <NUM> is so-called "lens" data. A "lens" may be a real-time special effect and sound that may be added to an image or a video.

As mentioned above, the video table <NUM> stores video data which, in one embodiment, is associated with messages for which records are maintained within the message table <NUM>. Similarly, the image table <NUM> stores image data associated with messages for which message data is stored in the entity table <NUM>. The entity table <NUM> may associate various annotations from the annotation table <NUM> with various images and videos stored in the image table <NUM> and the video table <NUM>.

User data collection(s) <NUM> stores previously collected data about a plurality of users of the application server <NUM>. Such data includes any personal information supplied by the plurality of users and interaction data about the users. For example, the data represents which videos or content each of the users has watched or consumed and for how long the content was consumed. The data represents any one of avatar characteristics of each user, a current location of each user, demographic information about each user, a list of each user's friends on a social network system <NUM>, each user's date of birth, credit card numbers, social security numbers, how often each user accesses the messaging client application <NUM>, pictures and videos captured by one or more user devices of each user, and/or any combination thereof.

Noise distribution parameter(s) <NUM> stores a database that includes parameters and/or random data used by the data privacy system <NUM>. For example, the noise distribution parameter(s) <NUM> stores a table shown in <FIG> that includes previously computed parameters of the noise distribution function (e.g., the Podium mechanism). Specifically, noise distribution parameter(s) <NUM> may store a table with a list of values corresponding to different privacy parameters ∈, distribution parameter d, spread Δ of the set of input data, width w of the two-step function, multiplicative margin m, and unconstrained parameter s. By storing these parameters that are pre-computed, the efficiency and speed at which random variables are generated by the noise distribution is enhanced.

A story table <NUM> stores data regarding collections of messages and associated image, video, or audio data, which are compiled into a collection (e.g., a story or a gallery). The creation of a particular collection may be initiated by a particular user (e.g., each user for which a record is maintained in the entity table <NUM>). A user may create a "personal story" in the form of a collection of content that has been created and sent/broadcast by that user. To this end, the UI of the messaging client application <NUM> may include an icon that is user-selectable to enable a sending user to add specific content to his or her personal story.

A collection may also constitute a "live story," which is a collection of content from multiple users that is created manually, automatically, or using a combination of manual and automatic techniques. For example, a "live story" may constitute a curated stream of user-submitted content from various locations and events. Users whose client devices have location services enabled and are at a common location event at a particular time may, for example, be presented with an option, via a UI of the messaging client application <NUM>, to contribute content to a particular live story. The live story may be identified to the user by the messaging client application <NUM> based on his or her location. The end result is a "live story" told from a community perspective.

A further type of content collection is known as a "location story," which enables a user whose client device <NUM> is located within a specific geographic location (e.g., on a college or university campus) to contribute to a particular collection. In some embodiments, a contribution to a location story may require a second degree of authentication to verify that the end user belongs to a specific organization or other entity (e.g., is a student on the university campus).

<FIG> is a schematic diagram illustrating a structure of a message <NUM>, according to some embodiments, generated by a messaging client application <NUM> for communication to a further messaging client application <NUM> or the messaging server application <NUM>. The content of a particular message <NUM> is used to populate the message table <NUM> stored within the database <NUM>, accessible by the messaging server application <NUM>. Similarly, the content of a message <NUM> is stored in memory as "in-transit" or "inflight" data of the client device <NUM> or the application server <NUM>. The message <NUM> is shown to include the following components:.

The contents (e.g., values) of the various components of message <NUM> may be pointers to locations in tables within which content data values are stored. For example, an image value in the message image payload <NUM> may be a pointer to (or address of) a location within an image table <NUM>. Similarly, values within the message video payload <NUM> may point to data stored within a video table <NUM>, values stored within the message annotations <NUM> may point to data stored in an annotation table <NUM>, values stored within the message story identifier <NUM> may point to data stored in a story table <NUM>, and values stored within the message sender identifier <NUM> and the message receiver identifier <NUM> may point to user records stored within an entity table <NUM>.

<FIG> is a block diagram showing an example data privacy system <NUM>, according to example embodiments. Data privacy system <NUM> includes a user data input module <NUM>, a noise distribution module <NUM>, a noise distribution mode selection module <NUM>, and a result generation module <NUM>.

User data input module <NUM> communicates with user data collection(s) <NUM> and/or data privacy application <NUM>. The user data input module <NUM> provides a set of input data to the noise distribution module <NUM> to add noise or random values to the set of input data. The user data input module <NUM> also provides a request for access or statistical analysis of the set of input data as received from the data privacy application <NUM>. Rather than responding to the request with the actual real information using only the set of input data, the result generation module <NUM> responds to requests from the data privacy application <NUM> using additional data that is generated using the noise distribution module <NUM>.

Noise distribution module <NUM> implements a Podium mechanism to generate random values based on the set of input data received from the user data input module <NUM>. Let X be a continuous random variable to be collected from a local privacy model given a privacy budget or parameter ∈. Let M be a randomized mechanism (e.g., the Podium mechanism) that adds zero-mean noise with variance σ<NUM> to each raw data point x. Let x' = M(x) be the observed, noisy data points satisfying the differential privacy property. In such cases, the randomized mechanism M satisfies differential privacy if for all inputs xi and xj and all outputs x', P(M(xi) = x') ≤ eεP(M(xj) = x'.

Sensitivity of the data collection (or the spread of the data), Δ can be defined a priori to the data collection as <MAT>.

The Podium mechanism is implemented as a two-step function where the height of the step is determined by the privacy parameter, the width of the step is determined by minimizing the variance of the distribution and its location is dictated by the input value x or its mean. <FIG> shows four illustrative distributions for different values ofx. Specifically, <FIG> shows the Podium mechanism for Δ = <NUM> and E = log(<NUM>) for different input values x (different means). The step shifts from left (Δm/<NUM>) to right (Δm/<NUM>) taking on different shapes for values in between. The shaded region highlights the range of input values. The support of the distribution is defined by the margin m and sensitivity A. In this case m = <NUM> and the width w = <NUM>. The horizontal lines <NUM> and <NUM> represent the probability of random values that are generated by the noise distribution and the vertical line <NUM> represents a mean of the values corresponding to the horizontal lines <NUM> and <NUM>.

Besides the privacy parameter and the sensitivity of the data collection, the Podium distribution includes three additional parameters, m, w, and t. The first one, m, is a multiplicative margin on Δ describing the support of the distribution. In some embodiments, this parameter is generated to have the smallest possible m (i.e. m = <NUM>) to allow the noise distribution to match the range of input and output values. For example, if the input data includes age, spread from <NUM> to <NUM> (Δ = <NUM>), the noise distribution is designed to output the corresponding noisy values in the same range. This parameter depends only on the privacy parameter and is determined by minimizing the variance of the Podium distribution.

The second parameter w describes the width of the step. Its value also comes from the variance optimization. It depends on privacy parameter and Δ and can be pre-computed once. The third parameter t describes the location of the step under the constraint that the mean (µ) of the Podium distribution is equal the input value x. This parameter t ranges between Δm/<NUM> and Δm/<NUM>. Since it changes depending on x, it is computed every time during the collection process (e.g., whenever a request for data is received from a client device <NUM>). In an implementation, to avoid a constrained optimization, t is parameterized using another unconstrained parameter s in accordance with the following equation: <MAT> which translates a real value s into an interval [-Δm/<NUM>, Δm/<NUM>].

In some embodiments, to derive the shape of the noise distribution of the Podium distribution, the noise distribution module <NUM> minimizes its variance. The noise distribution module <NUM> changes the shape and variance of the distribution, depending on its mean. The noise distribution module <NUM> performs such minimization under the constraint that its mean is equal to Δ/<NUM> or at its most extreme shape. The noise distribution module <NUM> allocates a margin m to balance the distribution. The noise distribution is a shape where the second parameter w becomes a function of t, as the distribution becomes a mixture of two uniform variables instead of three. This distribution is shown schematically in <FIG>. The density shown in <FIG> represents a likelihood of a value being generated from the corresponding horizontal lines. The ratio of the two horizontal lines is set to be a function of the privacy parameter (e.g., eε).

The noise distribution module <NUM> performs variance optimization calculations at the extreme right shape of the Podium distribution and has two unknowns (m and s) and two constraints. The first constraint is that µ = Δ/<NUM> and the second constraint is that the area under the Podium function adds up to one to be a proper distribution. Because it is a two-component mixture distribution with mean µ, its variance can be computed in accordance with: <MAT> where p is the proportion of the first component, µ1 and µ2 are the means of each component and σ2 and σ2 are their corresponding variances.

First, noise distribution module <NUM> computes the probability of the first component p which turns out to be a function of the differential parameter ε and s only. Let d be the density (height) of the first component. To guarantee ε-differential privacy, the second component must be equal deε. In such circumstances, p can be computed in accordance with: <MAT>.

The noise distribution module <NUM> can reduce this equation to determine that: <MAT>.

Further, because these must add up to <NUM> to produce a proper density function, the noise distribution module <NUM> solves for d in accordance with: <MAT>.

Plugging d into the first component probability results in the equation: <MAT>, which does not depend on m or the range of the input data. Since each component is simply a uniform random variable on an interval [a, b], its mean is given by (a+b)/<NUM> and variance by (b-a)^<NUM>/<NUM>. Thus, the mean of the first component is given by: <MAT> and the mean of the second component is given by: <MAT>.

Their variances can be computed in accordance with: <MAT> <MAT>.

The second constraint can be considered to be that the mean of this distribution is equal to equal to Δ/<NUM> which implies that: <MAT> and noise distribution module <NUM> computes m in accordance with: <MAT>.

Plugging individual pieces into the total variance formula above, after combining and rearranging terms results in: <MAT> and taking the first derivative results in: <MAT> which is a quartic function (<NUM>th degree polynomial) in s. Setting <MAT> equal to <NUM> and solving for s allows s to be computed in accordance with Equation <NUM>: <MAT> where and <MAT> and <MAT>.

The second derivative is given by <MAT> (cosh(<NUM> - ε) + cosh(s) and is always positive as the domain of cosh(x) is >=<NUM>. This means that the solution is a true global minimum. The value for s can be closely approximated by s = ε/<NUM> which does not affect the privacy of the Podium mechanism and only affects its relative efficiency.

The noise distribution module <NUM> computes the width parameter w in accordance with: <MAT> where both m and s are agnostic to the sensitivity or the input data spread while w is linearly proportional to the spread.

The noise distribution module <NUM> can be configured in one of a plurality of modes to generate a noise distribution. The modes include an exact mode in which the value of s is exactly computed and an approximation mode in which the value of s is approximated. The mode is selected by the noise distribution mode selection module <NUM>.

To generate a random variable from the noise distribution module <NUM> given the collection parameters ε and Δ, noise distribution module <NUM> can pre-compute m, w and d. This can be done once prior to the start of the collection process. For example, if the noise distribution mode selection module <NUM> selects the exact mode, the value of s can be computed in accordance with Equation <NUM> or may be retrieved from a previously stored table of values shown in <FIG>.

If the noise distribution mode selection module <NUM> selects the approximation mode, the value of s is computed by noise distribution module <NUM> to be s = ε/<NUM>. In both modes the noise distribution module <NUM> computes the remaining parameters as follows and stores them in noise distribution parameter(s) <NUM>: <MAT> <MAT> <MAT>.

Result generation module <NUM> uses the noise distribution generated by noise distribution module <NUM> to add noise (e.g., Podium noise) to a set of requested data. In some embodiments, result generation module <NUM> performs a process (described below) on every noise addition since the shape of the distribution depends on the input value x. The only shape parameter that changes is t, the location of the step. After computing t, the result generation module <NUM> selects a random one of the three mixture components by generating a standard uniform random variable and then selects randomly from the selected component with the help of another uniform random variable.

In some embodiments, the result generation module <NUM> receives as input the privacy parameter ε, the range of the set of data Δ, the parameters m, w, d and x. X may be a value provided by a client device <NUM> using the data privacy application <NUM>. The result generation module <NUM> computes t in accordance with: <MAT>.

The result generation module <NUM> computes a probability of a first component p<NUM> and probability of a second component p<NUM> in accordance with: <MAT> <MAT>.

The result generation module <NUM> generates a uniform random variable Y in [<NUM>, <NUM>]. The result generation module <NUM> determines whether Y is less than the probability of the first component p<NUM>. If so, the result generation module <NUM> returns to the privacy application <NUM> a uniform random variable X<NUM> in <MAT>. If Y is not less than the probability of a first component p<NUM>, the result generation module <NUM> determines whether Y is less than the sum of the probability of the first component p<NUM> and the probability of the second component p<NUM>. If so, the result generation module <NUM> returns to the privacy application <NUM> a uniform random variable X<NUM> in [t, t + w). If the result generation module <NUM> determines that Y is not less than the sum of the probability of the first component p<NUM> and the probability of the second component p<NUM>, the result generation module <NUM> returns to the privacy application <NUM> a uniform random variable X<NUM> in <MAT>.

The noise distribution provided by the noise distribution module <NUM> provides a differential privacy in accordance with:
<MAT>. The variance when µ = <NUM> of the noise distribution is computed in accordance with: <MAT>.

The distribution takes on the largest variance in case of the most off-center location of the step (e.g., when a large portion of the mass is in one of the tails its mean is equal to <MAT> or <MAT>) and in such cases the variance is computed in accordance with: <MAT>.

In a high-privacy regime (e.g., (ε → <NUM>)), the step width w is equal to Δm (e.g., the Podium distribution becomes equivalent to the uniform distribution on the interval <MAT>. In such cases, the variance is equal to <MAT> <MAT> which represents perfect privacy. In low-privacy regime (ε → ∞), the Podium mechanism has a variance that is in the extreme right shape equal to: <MAT>. This makes the Podium mechanism exponentially more efficient than the prior technique using the Laplace mechanism in the low-privacy regime.

<FIG> is a flowchart illustrating example operations of the data privacy system <NUM> in performing process <NUM>, according to example embodiments. The process <NUM> may be embodied in computer-readable instructions for execution by one or more processors such that the operations of the process <NUM> may be performed in part or in whole by the functional components of the messaging server system <NUM> and/or data privacy application <NUM>; accordingly, the process <NUM> is described below by way of example with reference thereto. However, in other embodiments, at least some of the operations of the process <NUM> may be deployed on various other hardware configurations. The process <NUM> is therefore not intended to be limited to the messaging server system <NUM> and can be implemented in whole, or in part, by any other component. Some or all of the operations of process <NUM> can be in parallel, out of order, or entirely omitted.

At operation <NUM>, the data privacy system <NUM> stores a set of input data.

At operation <NUM>, the data privacy system <NUM> generates a noise distribution based on a two-step function, wherein a height of the two-step function is determined by a privacy parameter, a width of the two-step function is determined by minimizing a variance of the noise distribution, and wherein a mean of the two-step function is determined by a value of the set of input data to be privatized.

At operation <NUM>, the data privacy system <NUM> applies the noise distribution to the set of input data to generate privatized noisy output data.

At operation <NUM>, the data privacy system <NUM> transmits the resulting privatized noisy output data in response to a request for a portion of, or a complete set of, the input data.

<FIG> is a block diagram illustrating an example software architecture <NUM>, which may be used in conjunction with various hardware architectures herein described. <FIG> is a non-limiting example of a software architecture and it will be appreciated that many other architectures may be implemented to facilitate the functionality described herein. The software architecture <NUM> may execute on hardware such as machine <NUM> of <FIG> that includes, among other things, processors <NUM>, memory <NUM>, and input/output (I/O) components <NUM>. A representative hardware layer <NUM> is illustrated and can represent, for example, the machine <NUM> of <FIG>. The representative hardware layer <NUM> includes a processing unit <NUM> having associated executable instructions <NUM>. Executable instructions <NUM> represent the executable instructions of the software architecture <NUM>, including implementation of the methods, components, and so forth described herein. The hardware layer <NUM> also includes memory and/or storage modules memory/storage <NUM>, which also have executable instructions <NUM>. The hardware layer <NUM> may also comprise other hardware <NUM>.

In the example architecture of <FIG>, the software architecture <NUM> may be conceptualized as a stack of layers where each layer provides particular functionality. For example, the software architecture <NUM> may include layers such as an operating system <NUM>, libraries <NUM>, frameworks/middleware <NUM>, applications <NUM>, and a presentation layer <NUM>. Operationally, the applications <NUM> and/or other components within the layers may invoke API calls <NUM> through the software stack and receive messages <NUM> in response to the API calls <NUM>. The layers illustrated are representative in nature and not all software architectures have all layers. For example, some mobile or special purpose operating systems may not provide a frameworks/middleware <NUM>, while others may provide such a layer. Other software architectures may include additional or different layers.

The operating system <NUM> may manage hardware resources and provide common services. The operating system <NUM> may include, for example, a kernel <NUM>, services <NUM>, and drivers <NUM>. The kernel <NUM> may act as an abstraction layer between the hardware and the other software layers. For example, the kernel <NUM> may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, and so on. The drivers <NUM> are responsible for controlling or interfacing with the underlying hardware. For instance, the drivers <NUM> include display drivers, camera drivers, Bluetooth® drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Wi-Fi® drivers, audio drivers, power management drivers, and so forth depending on the hardware configuration.

The libraries <NUM> provide a common infrastructure that is used by the applications <NUM> and/or other components and/or layers. The libraries <NUM> provide functionality that allows other software components to perform tasks in an easier fashion than to interface directly with the underlying operating system <NUM> functionality (e.g., kernel <NUM>, services <NUM> and/or drivers <NUM>). The libraries <NUM> may include system libraries <NUM> (e.g., C standard library) that may provide functions such as memory allocation functions, string manipulation functions, mathematical functions, and the like. In addition, the libraries <NUM> may include API libraries <NUM> such as media libraries (e.g., libraries to support presentation and manipulation of various media format such as MPREG4, H. <NUM>, MP3, AAC, AMR, JPG, PNG), graphics libraries (e.g., an OpenGL framework that may be used to render two-dimensional and three-dimensional in a graphic content on a display), database libraries (e.g., SQLite that may provide various relational database functions), web libraries (e.g., WebKit that may provide web browsing functionality), and the like. The libraries <NUM> may also include a wide variety of other libraries <NUM> to provide many other APIs to the applications <NUM> and other software components/modules.

The frameworks/middleware <NUM> (also sometimes referred to as middleware) provide a higher-level common infrastructure that may be used by the applications <NUM> and/or other software components/modules. For example, the frameworks/middleware <NUM> may provide various graphic UI (GUI) functions, high-level resource management, high-level location services, and so forth. The frameworks/middleware <NUM> may provide a broad spectrum of other APIs that may be utilized by the applications <NUM> and/or other software components/modules, some of which may be specific to a particular operating system <NUM> or platform.

The applications <NUM> include built-in applications <NUM> and/or third-party applications <NUM>. Examples of representative built-in applications <NUM> may include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and/or a game application. Third-party applications <NUM> may include an application developed using the ANDROID™ or IOS™ software development kit (SDK) by an entity other than the vendor of the particular platform, and may be mobile software running on a mobile operating system such as IOS™, ANDROID™, WINDOWS® Phone, or other mobile operating systems. The third-party applications <NUM> may invoke the API calls <NUM> provided by the mobile operating system (such as operating system <NUM>) to facilitate functionality described herein.

The applications <NUM> may use built-in operating system functions (e.g., kernel <NUM>, services <NUM>, and/or drivers <NUM>), libraries <NUM>, and frameworks/middleware <NUM> to create UIs to interact with users of the system. Alternatively, or additionally, in some systems, interactions with a user may occur through a presentation layer, such as presentation layer <NUM>. In these systems, the application/component "logic" can be separated from the aspects of the application/component that interact with a user.

<FIG> is a block diagram illustrating components of a machine <NUM>, according to some example embodiments, able to read instructions from a machine-readable medium (e.g., a machine-readable storage medium) and perform any one or more of the methodologies discussed herein. Specifically, <FIG> shows a diagrammatic representation of the machine <NUM> in the example form of a computer system, within which instructions <NUM> (e.g., software, a program, an application, an applet, an app, or other executable code) for causing the machine <NUM> to perform any one or more of the methodologies discussed herein may be executed. As such, the instructions <NUM> may be used to implement modules or components described herein. The instructions <NUM> transform the general, non-programmed machine <NUM> into a particular machine <NUM> programmed to carry out the described and illustrated functions in the manner described. In alternative embodiments, the machine <NUM> operates as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine <NUM> may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine <NUM> may comprise, but not be limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular telephone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing the instructions <NUM>, sequentially or otherwise, that specify actions to be taken by machine <NUM>. Further, while only a single machine <NUM> is illustrated, the term "machine" shall also be taken to include a collection of machines that individually or jointly execute the instructions <NUM> to perform any one or more of the methodologies discussed herein.

The machine <NUM> may include processors <NUM>, memory/storage <NUM>, and I/O components <NUM>, which may be configured to communicate with each other such as via a bus <NUM>. In an example embodiment, the processors <NUM> (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio-frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor <NUM> and a processor <NUM> that may execute the instructions <NUM>. The term "processor" is intended to include multi-core processors <NUM> that may comprise two or more independent processors (sometimes referred to as "cores") that may execute instructions contemporaneously. Although <FIG> shows multiple processors <NUM>, the machine <NUM> may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

The memory/storage <NUM> may include a memory <NUM>, such as a main memory, or other memory storage, and a storage unit <NUM>, both accessible to the processors <NUM> such as via the bus <NUM>. The storage unit <NUM> and memory <NUM> store the instructions <NUM> embodying any one or more of the methodologies or functions described herein. The instructions <NUM> may also reside, completely or partially, within the memory <NUM>, within the storage unit <NUM>, within at least one of the processors <NUM> (e.g., within the processor's cache memory), or any suitable combination thereof, during execution thereof by the machine <NUM>. Accordingly, the memory <NUM>, the storage unit <NUM>, and the memory of processors <NUM> are examples of machine-readable media.

The I/O components <NUM> may include a wide variety of components to receive input, provide output, produce output, transmit information, exchange information, capture measurements, and so on. The specific I/O components <NUM> that are included in a particular machine <NUM> will depend on the type of machine. For example, portable machines such as mobile phones will likely include a touch input device or other such input mechanisms, while a headless server machine will likely not include such a touch input device. It will be appreciated that the I/O components <NUM> may include many other components that are not shown in <FIG>. The I/O components <NUM> are grouped according to functionality merely for simplifying the following discussion and the grouping is in no way limiting. In various example embodiments, the I/O components <NUM> may include output components <NUM> and input components <NUM>. The output components <NUM> may include visual components (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), acoustic components (e.g., speakers), haptic components (e.g., a vibratory motor, resistance mechanisms), other signal generators, and so forth. The input components <NUM> may include alphanumeric input components (e.g., a keyboard, a touch screen configured to receive alphanumeric input, a photo-optical keyboard, or other alphanumeric input components), point-based input components (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, or other pointing instrument), tactile input components (e.g., a physical button, a touch screen that provides location and/or force of touches or touch gestures, or other tactile input components), audio input components (e.g., a microphone), and the like.

In further example embodiments, the I/O components <NUM> may include biometric components <NUM>, motion components <NUM>, environmental components <NUM>, or position components <NUM> among a wide array of other components. For example, the biometric components <NUM> may include components to detect expressions (e.g., hand expressions, facial expressions, vocal expressions, body gestures, or eye tracking), measure biosignals (e.g., blood pressure, heart rate, body temperature, perspiration, or brain waves), identify a person (e.g., voice identification, retinal identification, facial identification, fingerprint identification, or electroencephalogram based identification), and the like. The motion components <NUM> may include acceleration sensor components (e.g., accelerometer), gravitation sensor components, rotation sensor components (e.g., gyroscope), and so forth. The environmental components <NUM> may include, for example, illumination sensor components (e.g., photometer), temperature sensor components (e.g., one or more thermometer that detect ambient temperature), humidity sensor components, pressure sensor components (e.g., barometer), acoustic sensor components (e.g., one or more microphones that detect background noise), proximity sensor components (e.g., infrared sensors that detect nearby objects), gas sensors (e.g., gas detection sensors to detection concentrations of hazardous gases for safety or to measure pollutants in the atmosphere), or other components that may provide indications, measurements, or signals corresponding to a surrounding physical environment. The position components <NUM> may include location sensor components (e.g., a GPS receiver component), altitude sensor components (e.g., altimeters or barometers that detect air pressure from which altitude may be derived), orientation sensor components (e.g., magnetometers), and the like.

Communication may be implemented using a wide variety of technologies. The I/O components <NUM> may include communication components <NUM> operable to couple the machine <NUM> to a network <NUM> or devices <NUM> via coupling <NUM> and coupling <NUM>, respectively. For example, the communication components <NUM> may include a network interface component or other suitable device to interface with the network <NUM>. In further examples, communication components <NUM> may include wired communication components, wireless communication components, cellular communication components, Near Field Communication (NFC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components to provide communication via other modalities. The devices <NUM> may be another machine or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a USB).

In addition, a variety of information may be derived via the communication components <NUM>, such as location via Internet Protocol (IP) geo-location, location via Wi-Fi® signal triangulation, location via detecting a NFC beacon signal that may indicate a particular location, and so forth.

"CARRIER SIGNAL" in this context refers to any intangible medium that is capable of storing, encoding, or carrying transitory or non-transitory instructions for execution by the machine, and includes digital or analog communications signals or other intangible medium to facilitate communication of such instructions. Instructions may be transmitted or received over the network using a transitory or non-transitory transmission medium via a network interface device and using any one of a number of well-known transfer protocols.

"CLIENT DEVICE" in this context refers to any machine that interfaces to a communications network to obtain resources from one or more server systems or other client devices. A client device may be, but is not limited to, a mobile phone, desktop computer, laptop, PDAs, smart phones, tablets, ultra books, netbooks, laptops, multi-processor systems, microprocessor-based or programmable consumer electronics, game consoles, set-top boxes, or any other communication device that a user may use to access a network.

"COMMUNICATIONS NETWORK" in this context refers to one or more portions of a network that may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a plain old telephone service (POTS) network, a cellular telephone network, a wireless network, a Wi-Fi® network, another type of network, or a combination of two or more such networks. For example, a network or a portion of a network may include a wireless or cellular network and the coupling may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile communications (GSM) connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of a variety of types of data transfer technology, such as Single Carrier Radio Transmission Technology (1xRTT), Evolution-Data Optimized (EVDO) technology, General Packet Radio Service (GPRS) technology, Enhanced Data rates for GSM Evolution (EDGE) technology, third Generation Partnership Project (3GPP) including <NUM>, fourth generation wireless (<NUM>) networks, Universal Mobile Telecommunications System (UMTS), High Speed Packet Access (HSPA), Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE) standard, others defined by various standard setting organizations, other long range protocols, or other data transfer technology.

"EPHEMERAL MESSAGE" in this context refers to a message that is accessible for a time-limited duration. An ephemeral message may be a text, an image, a video, and the like. The access time for the ephemeral message may be set by the message sender. Alternatively, the access time may be a default setting or a setting specified by the recipient. Regardless of the setting technique, the message is transitory.

"MACHINE-READABLE MEDIUM" in this context refers to a component, device, or other tangible media able to store instructions and data temporarily or permanently and may include, but is not limited to, random-access memory (RAM), read-only memory (ROM), buffer memory, flash memory, optical media, magnetic media, cache memory, other types of storage (e.g., Erasable Programmable Read-Only Memory (EEPROM)) and/or any suitable combination thereof. The term "machine-readable medium" should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, or associated caches and servers) able to store instructions. The term "machine-readable medium" shall also be taken to include any medium, or combination of multiple media, that is capable of storing instructions (e.g., code) for execution by a machine, such that the instructions, when executed by one or more processors of the machine, cause the machine to perform any one or more of the methodologies described herein. Accordingly, a "machine-readable medium" refers to a single storage apparatus or device, as well as "cloud-based" storage systems or storage networks that include multiple storage apparatus or devices. The term "machine-readable medium" excludes signals per se.

"COMPONENT" in this context refers to a device, physical entity, or logic having boundaries defined by function or subroutine calls, branch points, APIs, or other technologies that provide for the partitioning or modularization of particular processing or control functions. Components may be combined via their interfaces with other components to carry out a machine process. A component may be a packaged functional hardware unit designed for use with other components and a part of a program that usually performs a particular function of related functions. Components may constitute either software components (e.g., code embodied on a machine-readable medium) or hardware components. A "hardware component" is a tangible unit capable of performing certain operations and may be configured or arranged in a certain physical manner. In various example embodiments, one or more computer systems (e.g., a standalone computer system, a client computer system, or a server computer system) or one or more hardware components of a computer system (e.g., a processor or a group of processors) may be configured by software (e.g., an application or application portion) as a hardware component that operates to perform certain operations as described herein.

A hardware component may also be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware component may include dedicated circuitry or logic that is permanently configured to perform certain operations. A hardware component may be a special-purpose processor, such as a Field-Programmable Gate Array (FPGA) or an ASIC. A hardware component may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, hardware components become specific machines (or specific components of a machine) uniquely tailored to perform the configured functions and are no longer general-purpose processors. It will be appreciated that the decision to implement a hardware component mechanically, in dedicated and permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations. Accordingly, the phrase "hardware component"(or "hardware-implemented component") should be understood to encompass a tangible entity, be that an entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner or to perform certain operations described herein. Considering embodiments in which hardware components are temporarily configured (e.g., programmed), each of the hardware components need not be configured or instantiated at any one instance in time. For example, where a hardware component comprises a general-purpose processor configured by software to become a special-purpose processor, the general-purpose processor may be configured as respectively different special-purpose processors (e.g., comprising different hardware components) at different times. Software accordingly configures a particular processor or processors, for example, to constitute a particular hardware component at one instance of time and to constitute a different hardware component at a different instance of time.

Hardware components can provide information to, and receive information from, other hardware components. Accordingly, the described hardware components may be regarded as being communicatively coupled. Where multiple hardware components exist contemporaneously, communications may be achieved through signal transmission (e.g., over appropriate circuits and buses) between or among two or more of the hardware components. In embodiments in which multiple hardware components are configured or instantiated at different times, communications between such hardware components may be achieved, for example, through the storage and retrieval of information in memory structures to which the multiple hardware components have access. For example, one hardware component may perform an operation and store the output of that operation in a memory device to which it is communicatively coupled. A further hardware component may then, at a later time, access the memory device to retrieve and process the stored output.

Hardware components may also initiate communications with input or output devices, and can operate on a resource (e.g., a collection of information). Whether temporarily or permanently configured, such processors may constitute processor-implemented components that operate to perform one or more operations or functions described herein. As used herein, "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the methods described herein may be at least partially processor-implemented, with a particular processor or processors being an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented components. For example, at least some of the operations may be performed by a group of computers (as examples of machines including processors), with these operations being accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., an API). The performance of certain of the operations may be distributed among the processors, not only residing within a single machine, but deployed across a number of machines. In some example embodiments, the processors or processor-implemented components may be located in a single geographic location (e.g., within a home environment, an office environment, or a server farm). In other example embodiments, the processors or processor-implemented components may be distributed across a number of geographic locations.

"PROCESSOR" in this context refers to any circuit or virtual circuit (a physical circuit emulated by logic executing on an actual processor) that manipulates data values according to control signals (e.g., "commands," "op codes," "machine code,", etc.) and which produces corresponding output signals that are applied to operate a machine. A processor may, for example, be a Central Processing Unit (CPU), a Reduced Instruction Set Computing (RISC) processor, a Complex Instruction Set Computing (CISC) processor, a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an ASIC, a Radio-Frequency Integrated Circuit (RFIC) or any combination thereof. A processor may further be a multi-core processor having two or more independent processors (sometimes referred to as "cores") that may execute instructions contemporaneously.

"TIMESTAMP" in this context refers to a sequence of characters or encoded information identifying when a certain event occurred, for example giving date and time of day, sometimes accurate to a small fraction of a second.

Claim 1:
A method comprising:
storing (<NUM>), by one or more processors, a set of input data;
generating (<NUM>), by the one or more processors, a noise distribution based on a two-step function, a height of the two-step function being determined by a privacy parameter, a width of the two-step function being determined by minimizing a variance of the noise distribution, and a mean of the two-step function being determined by a value of the set of input data to be privatized, a location of the two-step function being dictated by the mean of the two-step function or by the value;
applying (<NUM>), by the one or more processors, the noise distribution to the set of input data to generate privatized noisy output data; and
transmitting (<NUM>), by the one or more processors, the privatized noisy output data in response to a request for a portion of, or a complete set of, the input data.