Abstract: An access control system is provided to prevent the surreptitious granting of access to privacy related functionality on an electronic device. Software-based events to grant access to device functionality can be validated by confirming that the software event corresponds with a hardware input event. This validation prevents the spoofing of a user interface input that may be used to fraudulently grant access to specific functionality.

Abstract: Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processors to perform operations comprising receiving a machine learning model from a server at a client device, training the machine learning model using local data at the client device, generating an update for the machine learning model, the update including a weight vector that represents a difference between the received machine learning model and the trained machine learning model, privatizing the update for the machine learning model, and transmitting the privatized update for the machine learning model to the server.

Abstract: An access control system is provided to prevent the surreptitious granting of access to privacy related functionality on an electronic device. Software-based events to grant access to device functionality can be validated by confirming that the software event corresponds with a hardware input event. This validation prevents the spoofing of a user interface input that may be used to fraudulently grant access to specific functionality.

Abstract: Private and secure autocomplete suggestions are enabled based on a user contacts database, even when an application has not been granted access to the user contacts database. A keyboard process can receive and display suggestions based on input provided via the keyboard. The suggestions are generated based on a contacts database of a user. The suggestions are generated without exposing the contacts database to the application. Suggestions are then displayed to the user without exposing the suggestions to the application. Once a suggestion is selected by a user, the selected suggestion is provided to the application for insertion into a text field.

Abstract: Embodiments described herein provide a software-based privacy indicator for a camera and microphone that focuses not purely on hardware status (e.g., on or off), but on whether potentially private data is flowing to the system or an application. If based purely on hardware status, the indicator for an electronic device may be shown in scenarios where no data actually flows to the system or applications. The privacy indicator will be enabled if any camera or microphone data is relayed to the operating system or an application that is executed via the operating system. When the device uses the microphone and camera to capture environmental metadata about the surroundings of the device without providing any audio samples, images, or video frames to the system or an application, the privacy indicator will not be enabled.

Abstract: An access control system is provided to prevent the surreptitious granting of access to privacy related functionality on an electronic device. Software-based events to grant access to device functionality can be validated by confirming that the software event corresponds with a hardware input event. This validation prevents the spoofing of a user interface input that may be used to fraudulently grant access to specific functionality.

Abstract: Private and secure autocomplete suggestions are enabled based on a user contacts database, even when an application has not been granted access to the user contacts database. A keyboard process can receive and display suggestions based on input provided via the keyboard. The suggestions are generated based on a contacts database of a user. The suggestions are generated without exposing the contacts database to the application. Suggestions are then displayed to the user without exposing the suggestions to the application. Once a suggestion is selected by a user, the selected suggestion is provided to the application for insertion into a text field.

Abstract: A method and apparatus of a device that generates a re-ranking model used to re-rank a plurality of search results on a client device is described. In an exemplary embodiment, the device receives a crowd-sourced intra-domain model from a server, where the intra-domain model is a search result re-ranking model generated based on at least device interactions of a plurality of users interacting with a plurality of other devices. The device further generates a re-ranking model from the crowd-sourced intra-domain model and a local model, where the local model includes private data representing a device user's interaction with that device and the re-ranking model is used to re-rank a plurality of search results.

Abstract: The current invention provides a system and method for Data Owners to share with Data Seekers extracted insights from the Big Data, instead of raw data or anonymized raw data, thus reducing or eliminating privacy concerns on the data owned by the Data Owners. An Oblivious Pseudo Random Function (OPRF) is used, with operations using OPRFs occur over encrypted data, thus Data Owners learn only the primary object from Data Seeker and nothing else about the remainder of Data Owners' data. Similarly, Data Seeker learns a list of associated secondary objects and nothing else about Data Owners' data. The extent of sharing can be limited using a predefined threshold depending how much private information Data Owner is willing to share or Data Seeker is willing to pay.

Abstract: Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processors to receive, at a client device, a machine learning model from a server, detect a usage pattern for a content item, store an association between the content item and the detected usage pattern in local data, train the machine learning model using local data for the content item with the detected usage pattern to generate a trained machine learning model, generate an update for the machine learning model, privatize the update for the machine learning model, and transmit the privatized update for the machine learning model to the server.

Abstract: Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processors to perform operations comprising receiving a machine learning model from a server at a client device, training the machine learning model using local data at the client device, generating an update for the machine learning model, the update including a weight vector that represents a difference between the received machine learning model and the trained machine learning model, privatizing the update for the machine learning model, and transmitting the privatized update for the machine learning model to the server.

Abstract: A method and apparatus of a device that re-rank a plurality of search results is described. In an exemplary embodiment, the device receives a search query from a user and generates the plurality of search results over a plurality of search domains, wherein the plurality of search results is ranked according to a first ranking. The device additionally generates a re-ranking model, where the re-ranking model includes a plurality of intra-domain models that are generated based on at least based on-device interactions of a plurality of users interacting with a plurality of other devices and each of the plurality of search domains corresponds to one of the plurality of intra-domain models. The device further re-ranks the plurality of search results using the re-ranking model and presents the plurality of search results using the second ranking.

Abstract: Systems and methods are disclosed for a server learning new words generated by user client devices in a crowdsourced manner while maintaining local differential privacy of client devices. A client device can determine that a word typed on the client device is a new word that is not contained in a dictionary or asset catalog on the client device. New words can be grouped in classifications such as entertainment, health, finance, etc. A differential privacy system on the client device can comprise a privacy budget for each classification of new words. If there is privacy budget available for the classification, then one or more new terms in a classification can be sent to new term learning server, and the privacy budget for the classification reduced. The privacy budget can be periodically replenished.

Abstract: A computer-implemented system and method for analyzing data quality is provided. Attributes each associated with one or more elements are maintained. A request from a user is received for determining data quality of at least one attribute based on an interest vector having a listing of the elements of that attribute and a selection of elements of interest. Each element is encrypted. A condensed vector having the same listing of elements as the interest vector is populated with occurrence frequencies for each of the listed elements. The elements of the condensed vector are encrypted by computing an encrypted product of each element in the condensed vector and the corresponding element of the interest vector. An aggregate is determined based on the encrypted products of each element of the interest vector and the corresponding element of the condensed vector. The aggregate is provided as results of the data quality.

Abstract: Systems and methods are disclosed for generating term frequencies of known terms based on crowdsourced differentially private sketches of the known terms. An asset catalog can be updated with new frequency counts for known terms based on the crowdsourced differentially private sketches. Known terms can have a classification. A client device can maintain a privacy budget for each classification of known terms. Classifications can include emojis, deep links, locations, finance terms, and health terms, etc. A privacy budget ensures that a client does not transmit too much information to a term frequency server, thereby compromising the privacy of the client device.

Abstract: Systems and methods are disclosed for a server learning new words generated by user client devices in a crowdsourced manner while maintaining local differential privacy of client devices. A client device can determine that a word typed on the client device is a new word that is not contained in a dictionary or asset catalog on the client device. New words can be grouped in classifications such as entertainment, health, finance, etc. A differential privacy system on the client device can comprise a privacy budget for each classification of new words. If there is privacy budget available for the classification, then one or more new terms in a classification can be sent to new term learning server, and the privacy budget for the classification reduced. The privacy budget can be periodically replenished.

Abstract: Systems and methods are disclosed for generating term frequencies of known terms based on crowdsourced differentially private sketches of the known terms. An asset catalog can be updated with new frequency counts for known terms based on the crowdsourced differentially private sketches. Known terms can have a classification. A client device can maintain a privacy budget for each classification of known terms. Classifications can include emojis, deep links, locations, finance terms, and health terms, etc. A privacy budget ensures that a client does not transmit too much information to a term frequency server, thereby compromising the privacy of the client device.

Abstract: Systems and methods are disclosed for a server learning new words generated by user client devices in a crowdsourced manner while maintaining local differential privacy of client devices. A client device can determine that a word typed on the client device is a new word that is not contained in a dictionary or asset catalog on the client device. New words can be grouped in classifications such as entertainment, health, finance, etc. A differential privacy system on the client device can comprise a privacy budget for each classification of new words. If there is privacy budget available for the classification, then one or more new terms in a classification can be sent to new term learning server, and the privacy budget for the classification reduced. The privacy budget can be periodically replenished.

Abstract: A method and apparatus of a device that generates a re-ranking model used to re-rank a plurality of search results on a client device is described. In an exemplary embodiment, the device receives a crowd-sourced intra-domain model from a server, where the intra-domain model is a search result re-ranking model generated based on at least device interactions of a plurality of users interacting with a plurality of other devices. The device further generates a re-ranking model from the crowd-sourced intra-domain model and a local model, where the local model includes private data representing a device user's interaction with that device and the re-ranking model is used to re-rank a plurality of search results.

Abstract: A method and apparatus of a device that re-rank a plurality of search results is described. In an exemplary embodiment, the device receives a search query from a user and generates the plurality of search results over a plurality of search domains, wherein the plurality of search results is ranked according to a first ranking. The device additionally generates a re-ranking model, where the re-ranking model includes a plurality of intra-domain models that are generated based on at least based on-device interactions of a plurality of users interacting with a plurality of other devices and each of the plurality of search domains corresponds to one of the plurality of intra-domain models. The device further re-ranks the plurality of search results using the re-ranking model and presents the plurality of search results using the second ranking.