A well-known algorithm in privacy-preserving ML is diferentially private stochastic gradient descent (DP-SGD). While this algorithm has been evaluated on text and image data, it has not been previously applied to ads data, which are notorious for their high class imbalance and sparse gradient updates. In this work we apply DP-SGD to several ad modeling tasks including predicting click-through rates, conversion rates, and number of conversion events, and evaluate their privacy-utility trade-of on real-world ads datasets. Our work is the first to empirically demonstrate that DP-SGD can provide both privacy and utility for ad modeling tasks.
We will discuss the ideas that make these results pos- Table 1
sible, such as large batch training, eficient per-example DP-SGD results (average over five runs) on three diferent
gradient norm bounding, and improved privacy account- ads prediction datasets. Each row show the results under
ing. We also provide a comparison of DP-SGD to La- a specific privacy budget . It is common [
a model given a labeled training set. We call two training sets neighboring if they difer on a single labeled example.
A randomized training algorithm is (, )-diferentially private ((, )-DP) if for all ⊆ Range() and all neighboring training sets , ′, it holds that • pConvs: predict the expected number of conversions after an ad click; this is a regression problem against integer count labels.
Pr[() ∈ ] ≤ · Pr[(′) ∈ ] + . pCVR, pConvs on a proprietary dataset. We train the
DP-SGD [
• pCTR: predict the click-through rate for an ad. • pCVR: predict the conversion rate for an ad click; here, only whether a conversion takes place matters, regardless of the number of conversions.
unable to report the absolute non-private baseline losses for pCVR and pConvs on the proprietary datasets due to confidentiality.
world deep learning pipelines is the potential deterioration of the model performance. Norm-rescaling and Gaussian noise introduce, respectively, bias and variance to gradient estimation. As a result, the trained models have lower performance. In this section, we study these challenges in detail by using the training setup from the non-private baseline as the starting point, and describe various improvements that lead to our main results. We state our results for Criteo pCTR, but the key points also hold on other prediction tasks. With fixed noise multiplier (and other hyperparameters like the training steps), the norm bound for each perexample gradient allows a bias-variance trade-of in the gradient estimation for a fixed . Specifically, increasing reduces bias but increases the variance in gradient estimation due to the addition of more noise. A proper choice of improves the quality of trained model. For example, Table 2 shows that in a low privacy regime (where the noise multiplier is smaller), increasing leads to better model performance because the added noise is already small. On the other hand, a large can hurt performance in the high privacy regime by requiring large amounts of noise. Adaptively choosing the norm bound has been studied in the literature [22, 23]. 4.3. Large Batch Training
diferent aspects of DP training. Specifically, increasing the batch size leads to a larger subsampling ratio, which implies larger noise multiplier for the same . On the 4.1. Hyperparameter Tuning other hand, increasing the batch size also reduces the efective noise that is added to the average gradient beThe hyperparameters for training the non-private base- cause the noised sum of gradients are divided by the line models in real-world applications are typically ex- batch size [7, Algorithm 1]. Moreover, when fixing the tensively tuned. However, those hyperparameters are number of training epochs, varying the batch size also not necessarily the best for training with DP. Figure 1 changes the number of training steps, which afects both plots the AUC of DP trained models under diferent op- the privacy accounting and model utility. timizer and learning rate configurations. Specifically, In Figure 2, we plot the relationship between the Gausthe blue line shows that directly reusing the optimal sian noise standard deviation (std) required to guarantee hyperparameters for the non-private baseline leads to a certain , when the batch size changes. In Figure 2(a), significant utility gap comparing to the best hyperparam- we fix the total number of passes (epochs) over the data; eters re-tuned under DP training. Note that the optimal the noise std continues to decrease as the batch size inhyperparameters also depend on : SGD with learning creases beyond 106. However, this is not very realistic, rate 0.1 performs better than with learning rate 0.01 in because with fixed training epochs, increased batch sizes the low privacy (large ) regime but worse in the high lead to decreased number of training steps. Modern neuprivacy (small ) regime. For simplicity, we choose a ral networks trained with stochastic optimizers usually single configuration (SGD-0.01) for the rest of the study; require a minimum number of steps to fit the data well. this already improves the AUC significantly compared In Figure 2(b), we plot the relation under the condition to using the non-private hyperparameters2. of fixed number of training steps. In this case, the benefit of large batch sizes plateaus. 2Ideally, hyperparameter tuning should be performed with DP, e.g., Since SGD optimization is itself stochastic, reducing using [21]. However, following most prior work on DP training, the noise std might not improve the model ad infiniwe ignore the DP cost for hyperparameter tuning.
Fixed Epochs =0.5 =3.0 =10.0 10 3 d ts isoe10 4 n 103 104 105 batch size
106 (a) Fixed epochs 103 104 105 batch size (b) Fixed steps
106 epsilon=1.0 Clip Norm
Microbatch Size 0 5 10Scali1n5g Fa2c0tor 25 30 (a) = 1.0 0.5 1.0
B=8,C=32
B=8,C=16B=8,C=16 B=8,C=16 B=8,C=16 3.0 5.0 10.0 epsilon (log scale) (b) Tuning for each
30.0 50.0
Table 3 generally leads to worse model utility.
AUC with large batch size and training epochs on Criteo In our case, with an eficient implementation
(SecpCTR. The results can be compared with Table 2 (batch size tion 5), we do not need to use microbatching. However,
1024, 8 epochs). we empirically found that small could improve the
batch size epochs AUC model utility. One potential reason is that this allows a
diferent kind of bias-variance trade-of from changing
0.5 16,384 64 30 0.7740 ± 0.0003 the norm bound (Section 4.2). The increased noise
0.5 8,192 32 30 0.7689 ± 0.0003 leads to higher variance in gradient estimation. On the
3.0 16,384 64 30 0.7810 ± 0.0003 other hand, averaging the gradients within the
micro3.0 8,192 32 30 0.7782 ± 0.0003 batch before clipping could potentially reduce the bias
8.0 16,384 64 30 0.7818 ± 0.0003 when there are cancellations. For example, averaging
8.0 8,192 32 30 0.7799 ± 0.0004 i.i.d. Gaussian vectors reduces the expected norm by a
factor of 1/√︀ . The cancellation of gradient vectors
is hard to characterize theoretically, but as shown in
Figtum. However, larger batches reduce noise, which allows ure 3(a), increasing moderately indeed improve the
the norm bound to be increased while keeping the utility for Criteo pCTR. Similar to , the maximum
toltotal added noise and privacy level fixed. Increasing erable value before it starts hurting the utility increases
can yield performance gains. Specifically, Table 3 shows with . On the other hand, and seem to be helping
the model performances on Criteo pCTR with increased with bias reduction in diferent ways, because increasing
batch sizes, training epochs, and norm bound . Com- each of them by the same scaling factor leads to
diferparing with Table 2, large batch sizes lead to significant ent AUC, even though the Gaussian noise scale (i.e., the
performance boost. Note that for = 0.5, the model can- variance) would be increased by the same amount. As a
not properly train (AUC = 0.5) for = 30, but reaches result, we could combine the two factors to further boost
AUC = 0.77 when the batch size increases 16× . We note the utility, as verified in Figure 3(b).
that large batches have previously been used to improve
DP-SGD for vision and language models [
4.4. Microbatching a DP-SGD trained model according to the specific
hyMicrobatching was originally used to mitigate the com- perparameters such as the noise std, the norm bound
putation and memory overhead of vanilla DP-SGD imple- , the number of training steps, etc. Rényi Diferential
mentations [
Figure 4(a) compares RDP accounting to the improved inputs, Goodfellow’s observation can be used in DP-SGD.
PLD accounting. Because the PLD estimation is tighter, Based on these observations, we implement a two-pass
a given requires smaller noise than implied by RDP ac- algorithm that computes per-example gradient norms in
counting. We observe consistent improvements of model the first pass and the norm-bounded average gradient
utility across all privacy regimes, with a larger gap for in the second pass. Since most of the computation and
smaller ’s. memory overhead comes from materializing per-example
gradient vectors, our implementation is able to reduce
these significantly. This technique is usually called “ghost
5. Computation & Memory clipping”, and is also efective in private training for
comOverhead puter vision [37] and natural language processing [
We implement this algorithm in JAX [38], and compare
Another obstacle to using DP-SGD in real-world deep to a baseline implementation using JAX just-in-time (JIT)
learning systems is the potential computation and mem- compilation, which is already faster than a vanilla
impleory overhead. A naive implementation of DP-SGD that mentation as reported in Subramani et al. [35], as well as
explicitly computes each per-example gradient can lead the non-private baseline (called Baseline).
to several orders of magnitude more memory consump- Figure 4(b) plots the number of examples per second
tion and computational cost. Therefore, eficient imple- using diferent training algorithms and batch sizes. We
mentations of DP-SGD have been studied from various observe that Fast-DP-SGD scales similarly to the
nonangles, including micro-batching [
Here we demonstrate that when implemented with but also incapable of handling batch sizes larger than 64 care, DP-SGD can be run with small computation and because its memory overhead grows linearly with the memory overheads for ads prediction models. This is batch size. The maximum batch size that each algorithm enabled by the following observations: 1. To bound sen- can handle on a single GPU is documented in Table 4. We sitivity, we only need per-example gradient norms, not can see that the batch size cap is the same for Fast-DPper-example gradient vectors. 2. Once per-example gra- SGD and the non-private baseline, demonstrating that dient norms are computed, the norm-bounded average the memory overhead is negligible. gradients can be computed using standard backpropaga- The experiments above were done on a single GPU. tion with reweighted loss. 3. Most ads prediction models The batch size can be easily scaled beyond the maximum
0.1 0.25 0.5 1.0 3.0 5.0 10.0 30.0 50.0
Privacy Budget (epsilon) value in Table 4 by using multi-device data parallelism, and gradient accumulation across multiple backpropagation steps.
the features are public and only the labels need privacy
protection. It has been recently studied in deep
learning [
From Figure 5, we observe that LabelDP generally provides higher utility in low privacy (large ) regimes, while DP-SGD outperforms it in high privacy (small ) regimes. The behavior in high privacy regimes is counter-intuitive because DP-SGD has stronger privacy guarantees yet provides better utility.
In this work we showed that it is possible to privately train ad models using DP-SGD, while neither significantly sacrificing utility nor incurring computational cost. An interesting research direction is to develop new private training algorithms for “hybrid DP”—an interpolation between vanilla DP and Label DP in which some but not all of the features are public. Another line of work would be to study if the low-rank nature / sparsity of the gradients can be exploited to reduce the noise needed for private training.
Acknowledgments
[15] J. He, X. Li, D. Yu, H. Zhang, J. Kulkarni, Y. T. Lee, [33] I. Goodfellow, Eficient per-example gradient comA. Backurs, N. Yu, J. Bian, Exploring the limits of putations, arXiv preprint arXiv:1510.01799 (2015). diferentially private deep learning with group-wise [34] J. Lee, D. Kifer, Scaling up diferentially private deep clipping, in: ICLR, 2022. learning with fast per-example gradient clipping, [16] Criteo-Labs, Display advertising challenge: Predict PoPETS (2021) 128–144.
click-through rates on display ads, 2014. URL: https: [35] P. Subramani, N. Vadivelu, G. Kamath, Enabling //www.kaggle.com/c/criteo-display-ad-challenge. fast diferentially private SGD via just-in-time com[17] M. Zaheer, S. Reddi, D. Sachan, S. Kale, S. Kumar, pilation and vectorization, in: NeurIPS, 2021, pp.
Adaptive methods for nonconvex optimization, in: 26409–26421.
NIPS, 2018. [36] Z. Bu, S. Gopi, J. Kulkarni, Y. T. Lee, H. Shen, U. Tan[18] J. Duchi, E. Hazan, Y. Singer, Adaptive subgradient tipongpipat, Fast and memory eficient diferenmethods for online learning and stochastic opti- tially private-SGD via JL projections, in: NeurIPS, mization., JMLR 12 (2011). 2021, pp. 19680–19691. [19] D. P. Kingma, J. Ba, Adam: A method for stochastic [37] Z. Bu, J. Mao, S. Xu, Scalable and eficient trainoptimization, in: ICLR, 2015. ing of large convolutional neural networks with [20] I. Loshchilov, F. Hutter, Decoupled weight decay diferential privacy, in: NeurIPS, 2022.
regularization, in: ICLR, 2019. [38] J. Bradbury, R. Frostig, P. Hawkins, M. J. Johnson, [21] A. Gupta, K. Ligett, F. McSherry, A. Roth, K. Talwar, C. Leary, D. Maclaurin, G. Necula, A. Paszke, J. VanDiferentially private combinatorial optimization, derPlas, S. Wanderman-Milne, Q. Zhang, JAX: comin: SODA, 2010, pp. 1106–1125. posable transformations of Python+NumPy pro[22] O. Thakkar, G. Andrew, H. B. McMahan, Diferen- grams, 2018. URL: http://github.com/google/jax. tially private learning with adaptive clipping, in: [39] K. Chaudhuri, D. Hsu, Sample complexity bounds NeurIPS, 2021, pp. 17455–17466. for diferentially private learning, in: COLT, 2011, [23] V. Pichapati, A. T. Suresh, F. X. Yu, S. J. Reddi, S. Ku- pp. 155–186.
mar, AdaCliP: adaptive clipping for private SGD, [40] B. Ghazi, P. Kamath, R. Kumar, E. Leeman, P. ManuarXiv preprint arXiv:1908.07643 (2019). rangsi, A. Varadarajan, C. Zhang, Regression with [24] S. Meiser, E. Mohammadi, Tight on budget? Tight label diferential privacy, in: ICLR, 2023. bounds for -fold approximate diferential privacy, [41] I. Loshchilov, F. Hutter, SGDR: stochastic gradient in: CCS, 2018, pp. 247–264. descent with warm restarts, in: ICLR, 2017. [25] D. M. Sommer, S. Meiser, E. Mohammadi, Privacy loss classes: The central limit theorem in diferential privacy, PoPETS (2019) 245–269. A. Training Details [26] A. Koskela, J. Jälkö, A. Honkela, Computing tight diferential privacy guarantees using FFT, in: AIS- The Criteo pCTR dataset [16] contains around 40 milTATS, 2020, pp. 2560–2569. lion examples. The raw dataset comes with a labeled [27] S. Gopi, Y. T. Lee, L. Wutschitz, Numerical compo- training set and an unlabeled test set. We split the raw sition of diferential privacy, in: NeurIPS, 2021, pp. training set chronologically into a 80/10/10 partition of 11631–11642. train/validation/test sets. The reported metrics are on [28] B. Ghazi, P. Kamath, R. Kumar, P. Manurangsi, this labeled test split. Each example consists of 13 integer Faster privacy accounting via evolving discretiza- features, 26 categorical features, and one binary label. tion, in: ICML, 2022, pp. 7470–7483. We preprocess each integer feature with a log transfor[29] L. Prediger, A. Koskela, Code for computing tight mation.
guarantees for diferential privacy., https://github. The neural network consists of six layers. In the first com/DPBayes/PLD-Accountant, 2020. layer, each categorical feature is mapped into a dense [30] Google’s DP Library., DP Accounting Library, feature vector via an embedding layer. The embedding https://github.com/google/diferential-privacy/ dimension is decided via a heuristic rule as int[2 0.25], tree/main/python/dp_accounting, 2020. where is the number of unique tokens in each categor[31] Microsoft., A fast algorithm to optimally compose ical feature. The dense features are then concatenated privacy guarantees of diferentially private (DP) with the log-transformed integer features to form the mechanisms to arbitrary accuracy., https://github. first layer representation. This representation are fed com/microsoft/prv_accountant, 2021. into four fully connected layers, each with an output di[32] V. Doroshenko, B. Ghazi, P. Kamath, R. Kumar, mension of 598 and a ReLU activation function. Finally, P. Manurangsi, Connect the dots: Tighter dis- a fully connected layer is used to compute the scalar crete approximations of privacy loss distributions, prediction (the logit). There are around 78M trainable PoPETS (2022) 552–570. parameters in this neural network model.
The network is trained with binary cross entropy loss.
Unless otherwise specified, we train the network for five epochs, and we scale the base learning rate with a cosine decay [41]. In the non-private baseline, we use the Yogi optimizer [17] with a base learning rate of 0.01, and a batch size of 1024.
Directly reusing the same hyperparameters for private training leads to suboptimal results. We discuss how to achieve better privacy-utility trade-of by adjusting different hyperparameters in Section 4. Even though the analysis shows that optimal hyperparameters could be diferent for diferent range of privacy budget ’s, for simplicity, we use a fixed value for most of hyperparameters in the final results of Criteo pCTR in Table 1: SGD optimizer with base learning rate 0.01, momentum 0.9, batch size 65,536, and training for 150 epochs. We only tune the norm bound ∈ {1.0, 10.0, 50.0, 100.0} and microbatch size ∈ {1, 4, 8} for each separately.
The model and training setup for the pCVR and pConvs are similar, except that the pConvs come with integer labels, thus are trained and evaluated with a Poisson log loss (PLL). Specifically, let () be the scalar prediction from the final layer of the neural network, interpreting exp( ()) as predicting the mean of a Poisson distribution, then the log-likelihood of the integer label is
() − exp( ()) − log(!).
ℓ( , (, )) = exp( ()) − (). (1)
of the trainable parameters . Therefore this is an unnormalized PLL.