tree bff1edec0cd1f2ecd4fe27bcb68275c1a91a787f
parent bd625ca7fa779f404949e951c63f9e6c8e306d72
author Laura Peskin <pesk@google.com> 1616695161 +0000
committer CQ Bot <commit-bot@chromium.org> 1616695161 +0000

[Cobalt 1.1 privacy] Clip CountMin sketch cell counts to max_count

Previously, when encoding observations for StringCounts reports,
we clipped the count for each individual string to the report's
max_count before incrementing the CountMin sketch. However, when
two different strings hashed to the same sketch cell, this could
result in a cell count greater than max_count. This broke an
assumption of the method used to encode the CountMin sketch,
and could in some cases allow a device to contribute > max_count
for a single string.

After this change, the PrivacyEncoder clips each sketch cell
count to max_count after the sketch is fully formed rather than
incrementally.

Change-Id: I54c1a8a482de39d4f8b994ce8ffe87837ae1ff18
Reviewed-on: https://fuchsia-review.googlesource.com/c/cobalt/+/507059
Fuchsia-Auto-Submit: Laura Peskin <pesk@google.com>
Reviewed-by: Alexandre Zani <azani@google.com>
Commit-Queue: Laura Peskin <pesk@google.com>