A method, comprising: receiving, at a server device and from a client device , a batch of queries that includes queries to special buckets in each database shard, among multiple database shards, being queried by the batch of queries, wherein the special buckets include server-encrypted secret shares generated by the server device ; generating, by the server device , a set of query results responsive to the batch of queries, wherein the set of query results includes the server-encrypted secret shares obtained from the special buckets queried by the batch of queries; transmitting, by the server device and to the client device , the set of query results; receiving, at the server device and from the client device , client-encrypted secret shares, wherein the client-encrypted secret shares are client encrypted versions of the secret shares that were included in the set of query results transmitted to the client device ; transmitting, by the server device and to the client device , a full set of server-encrypted secret shares, wherein the full set of server-encrypted secret shares includes more server-encrypted secret shares than the set of query results; receiving, at the server device and from the client device , a full set of client-server-encrypted secret shares, wherein the full set of client-server-encrypted secret shares are client encrypted versions of the full set of server-encrypted secret shares that were transmitted to the client device ; determining, by the server device , how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device ; and classifying, by the server device , the client device based on how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device . receiving, at a server device and from a client device , a batch of queries that includes queries to special buckets in each database shard, among multiple database shards, being queried by the batch of queries, wherein the special buckets include server-encrypted secret shares generated by the server device ; generating, by the server device , a set of query results responsive to the batch of queries, wherein the set of query results includes the server-encrypted secret shares obtained from the special buckets queried by the batch of queries; transmitting, by the server device and to the client device , the set of query results; receiving, at the server device and from the client device , client-encrypted secret shares, wherein the client-encrypted secret shares are client encrypted versions of the secret shares that were included in the set of query results transmitted to the client device ; transmitting, by the server device and to the client device , a full set of server-encrypted secret shares, wherein the full set of server-encrypted secret shares includes more server-encrypted secret shares than the set of query results; receiving, at the server device and from the client device , a full set of client-server-encrypted secret shares, wherein the full set of client-server-encrypted secret shares are client encrypted versions of the full set of server-encrypted secret shares that were transmitted to the client device ; determining, by the server device , how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device ; and classifying, by the server device , the client device based on how many of the secret shares are included in both of the client-encrypted secret shares received from the client device and the full set of client-server-encrypted secret shares received from the client device . <EOS>