Privacy safe protocol in clean room environment
Systems and methods are described relating to performing various operations on third party data, including sensitive information, in a secure computing environment and enforcing privacy controls on the resulting data and metrics thereof prior to outputting that data. In some aspects, an isolated computing/execution environment may obtain execution logic from a client device for generating result data based on input data and input data. The execution logic may be executed in the isolated execution environment using the input data to generate result data and performance metrics data relating to the execution logic. A set of privacy constraints may be enforced on the result data and the performance metrics data prior to causing the result data and the performance metrics data to be accessible by the client device.
1 . A computer implemented method comprising:
obtaining, by a clean room execution environment instance provided by a data privacy integration service, an identifier of a container image from a client device, the container image comprising at least one machine learning model that generates inference data for multi-touch attribution data, wherein code defining the container image is not accessible by or through the data privacy integration service;
obtaining an output data schema from the client device, the output data schema defining a set of fields of the inference data;
obtaining, by the clean room execution environment instance, sensitive data from a data storage service, at least a portion of the sensitive data not associated with or accessible by the client device;
executing the at least one machine learning model in the clean room execution environment instance using the sensitive data to generate the inference data including the set of fields of the output data schema and performance metrics data; and
enforcing a set of privacy constraints on the inference data and the performance metrics data prior to causing the inference data and the performance metrics data to be accessible to the client device via an interface provided by the data privacy integration service, wherein enforcing the set of privacy constrains comprises verifying that the inference data in the set of fields defined in the output data schema satisfy the set of privacy constraints.
2 . The computer-implemented method of claim 1 , wherein enforcing a set of privacy constraints on the inference data prior to causing the inference data to be accessible by the client device further comprises aggregating multiple sets of the inference data within the clean room execution environment instance to satisfy at least one sensitivity threshold for at least one field of the inference data.
3 . The computer-implemented method of claim 1 , wherein enforcing the set of privacy constraints on the performance metrics data prior to causing the performance metrics data to be accessible by the client device further comprises obfuscating the performance metrics data by modifying at least one of the performance metrics.
4 . The computer-implemented method of claim 1 , further comprising: removing at least one field containing sensitive information from the sensitive data prior to inputting the sensitive data into the at least one machine learning model.
5 . The computer-implemented method of claim 1 , further comprising: selecting a set of privacy controls from a plurality of sets of privacy controls
based on at least one of a first geographical location associated with the sensitive data or a second geographical location associated with where the inference data and the performance metrics data is made accessible to the client device.
6 . A system, comprising:
one or more processors;
memory that stores computer-executable instructions that, if executed, cause the one or more processors to:
obtain, by an isolated execution environment provided by a data privacy integration service, execution logic from a client device for generating result data based on input data, wherein the execution logic is not accessible by or through the data privacy integration service;
obtain, by the isolated execution environment, the input data comprising data not accessible by the client device;
execute the execution logic in the isolated execution environment using the input data to generate the result data and performance metrics data relating to the execution logic; and
enforce a set of privacy constraints on the result data and the performance metrics data prior to causing the result data and the performance metrics data to be accessible by the client device.
7 . The system of claim 6 , wherein the computer-executable instructions that, if executed, further cause the one or more processors to:
obtain an output data schema from the client device, the output data schema defining a set of data fields in the result data, and wherein enforcing the set of privacy constraints on the result data further comprises determining that the set of fields do not include any high sensitivity data fields.
8 . The system of claim 6 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the result data, further cause the one or more processors to:
aggregate the result data to satisfy at least one aggregation threshold.
9 . The system of claim 8 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the performance metrics data, further cause the one or more processors to:
obfuscate or truncate the performance metrics data.
10 . The system of claim 8 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the performance metrics data, further cause the one or more processors to:
apply at least one layer of processing on the performance metrics data to generate modified performance metrics data prior to causing the modified performance metrics data to be accessible to the client device.
11 . The system of claim 8 , wherein a first data privacy control is applied to the result data and a second privacy control is applied to the performance metrics data.
12 . The system of claim 6 , wherein the execution logic comprises at least one machine learning model, and wherein the result data comprises inference data generated using the at least one machine learning model.
13 . The system of claim 12 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the result data, further cause the one or more processors to:
determine a generalization error and a loss value of the result data; and
based on comparing the generalization error and the loss value to a differential privacy threshold, determine whether to make the result data available to the client device.
14 . The system of claim 12 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the result data, further cause the one or more processors to:
determine at least one correlation coefficient between an output data field in the result data and an input data field containing sensitive data in the input data; and
based on comparing the at least one correlation coefficient to at least one correlation threshold, determine whether to make the result data available to the client device.
15 . The system of claim 12 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the result data, further cause the one or more processors to:
inject noise into at least one of the input data or the result data to meet at least one differential privacy constraint.
16 . The system of claim 12 , wherein the computer-executable instructions that, if executed, cause the one or more processors to enforce a set of privacy constraints on the result data, further cause the one or more processors to:
determine at least one performance gain of a binary classifier based on the execution logic and the input data; and
based on comparing the at least one performance gain to at least one performance threshold, determine whether to make the result data available to the client device.
17 . One or more non-transitory computer-readable storage media storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
obtain, by an isolated execution environment provided by a data privacy integration service, execution logic from a client device for generating result data based on input data, wherein the execution logic is isolated from the data privacy integration service;
obtain, by the isolated execution environment instance, the input data comprising data isolated from the client device;
execute the execution logic in the isolated execution environment using the input data to generate the result data and performance metrics data relating to the execution logic; and
enforce a set of privacy constraints on the result data and the performance metrics data prior to causing the result data and the performance metrics data to be accessible by the client device through an interface provided by the data privacy integration service.
18 . The one or more non-transitory computer-readable storage media of claim 17 , wherein at least one first data privacy control is applied to the result data and at least one second privacy control is applied to the performance metrics data.
19 . The one or more non-transitory computer-readable storage media of claim 17 , wherein the instructions further include instructions that cause the computer system to: anonymize the result data prior to making the result data accessible to the client device via the interface.
20 . The one or more non-transitory computer-readable storage media of claim 17 , wherein the instructions further include instructions that cause the computer system to: inject noise into at least one of the input data or the result data to meet at least one differential privacy constraint.