Microsoft Files Patent for AI Training Data That Guards Riskiest Personal Details Hardest
Most privacy tools treat every row of data the same. Microsoft's patent scores each record for risk and spends more protection on the ones most likely to give someone away.
What Microsoft's risk-scored fake data does
A hospital sits on years of patient records that could help train a medical AI. The catch is that those records hold names, ages, incomes and diagnoses, and sharing them as-is could expose real people. A common workaround is to build stand-in data that matches the real data's overall patterns but doesn't point to any actual person.
The trouble, according to Microsoft's filing, is that most systems protect everything the same amount. Too much protection and the stand-in data stops being useful for spotting real patterns. Too little and someone might still work out who is who. Microsoft's patent instead gives every record a risk score, then applies the heaviest disguise to the riskiest records and a lighter touch to the safer ones.
The system then checks its own work. If the result is still too revealing, or no longer matches the original patterns, it tries again until it passes.
… dynamically allocate, for each data entry of the plurality of data entries, a privacy budget based on the risk score for the data entry and the privacy budget constraints …
Translation: The system assigns a different level of privacy protection to each piece of data based on its individual risk level.
How each record gets its own privacy budget
The system starts with two inputs: the dataset and a set of adaptive controls. The controls hold compliance rules (for example GDPR or HIPAA, which are privacy laws) plus a total privacy budget, a cap on how much real information the output is allowed to reveal.
For every record, the system computes a risk score. The filing's formula is a weighted mix of three things:
- Uniqueness: how rare the values are (a Social Security number scores high).
- Inference risk: how easily a hidden detail can be guessed (a ZIP code can hint at income).
- Data type risk: how sensitive the kind of data is, such as names or birth dates.
A machine-learning model or a large language model can help do the scoring.
The total budget is then split across records based on those scores, using an optimization method that tries to lose as little usefulness as possible. Each record is disguised in two ways. Adaptive aggregation blends records into groups: coarse groups for high-risk entries, fine ones for low-risk. Adaptive noise injection adds random fuzz (a math-based approach called differential privacy), scaled to each record's risk score and budget.
Finally, the output is compared against the original's statistics and re-scored. If it fails either check, the loop repeats until it meets the compliance rules. Then the data goes to a training module for a machine-learning model.
… performing adaptive remediation on the input dataset to generate a synthetic dataset, wherein adaptive remediation comprises adaptive aggregation and/or adaptive differential noise injection …
Translation: It fixes the original data by grouping items or adding random noise to create a safe fake version for training.
What this means for AI built on private data
If you've handed a hospital, bank or employer your details, you probably want any AI trained on that data to learn patterns without learning about you. A system that tunes protection record by record aims to avoid the two failures the filing describes: data disguised so heavily it's useless, or so lightly that people can still be picked out.
For Microsoft, the idea fits a business of selling cloud and AI tools to companies that handle regulated data. The compliance rules sit inside the process itself, so a company could set the rules it must follow and have the system work to meet them. Keep in mind this is a patent application, and it describes no product or launch.
With this 15th filing we've tracked since August in our on-device AI privacy watchlist, Microsoft continues building on earlier work like scrubbing voices of identity and shielding data during AI runs.
Nothing in Microsoft's filing needs new hardware. It is all software that sits between a pile of sensitive records and the AI that wants to learn from them, so the engineering distance to a working feature looks short. The building blocks it names, such as scoring formulas, added randomness and similarity checks, are standard tools described in the filing itself.
The harder part is setup. Someone has to write down the privacy rules, decide how much total protection to spend, and trust the risk scores, which might come from a language model that can misjudge a record. Those choices decide whether the output is actually safe, and the filing leaves them to the user.
The shortest route to a product is a tool inside a data service that a company runs on its own records. For you, the payoff would show up indirectly: AI built on health or banking data that was trained without your real row in it. Routine in spirit, useful in practice.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
7 drawing sheets from US 2026/0310819 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in