Motivated by problems arising in digital advertising, we study the task of training differentially private (DP) machine learning models with semi-sensitive features. In this setting, a subset of the features is known to the attacker (and thus need not be protected) while the remaining features as well as the label are unknown to the attacker and should be protected by the DP guarantee. This task interpolates between training the model with full DP (where the label and all features should be protected) or with label DP (where all the features are considered known, and only the label should be protected). We present a new algorithm for training DP models with semi-sensitive features. Through an empirical evaluation on ads datasets, we demonstrate that our algorithm surpasses in utility the baselines of (i) DP stochastic gradient descent (DP-SGD) run on all features (known and unknown), and (ii) a label DP algorithm run only on the known features (while discarding the unknown ones).
In recent years, large-scale machine learning (ML) algorithms have been adopted and deployed for different ad modeling tasks, including the training of predicted click-through rates (a.k.a. pCTR) and predicted conversion rates (a.k.a. pCVR) models. Roughly speaking, pCTR models predict the likelihood that an ad shown to a user is clicked, and pCVR models predict the likelihood that an ad clicked (or viewed) by the user leads to a conversion—which is defined as a desirable action by the user on the advertiser site or app, such as the purchase of the advertised product.
Heightened user expectations around privacy have led
different web browsers (including Apple Safari [
In order to support essential web functionalities that are
affected by the deprecation of 3PCs, different web browsers
have been building privacy-preserving APIs, including for
ads measurement and modeling such as the Interoperable
Private Attribution (IPA) developed by Mozilla and Meta [
Different DP variants have been studied in the context of
supervised ML, depending on the adjacency definition. The
standard definition of DP protects the full training example
(features and label) and has been extensively studied, e.g.,
Abadi et al. [
Label DP is a natural fit for the case where the features of
the pCVR problem do not depend on cross-site information.
However, a common setting, including that of the Protected
Audience API on Chrome [
The focus of this work is to analyze this setting from the
DP perspective; we refer to it as DP model training with
semi-sensitive features. We formalize this setting, present an
algorithm for training private ML models with semi-sensitive
features, and evaluate it on real ad prediction datasets,
showing that it compares favorably to natural baselines.1 We
report the effect of certain important parameters on utility,
and also study the trade-offs between the size of the private
model and its quality – this is motivated by practical
settings, in which the private ML model training may happen in
Trusted Execution Environments with limited memory.
Two related notions of private model training with partially
private features were recently proposed, although they differ
slightly in their adjacency definitions (and hence in what is
AdKDD ’24, August 2024, Barcelona, Spain
© 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License
Attribution 4.0 International (CC BY 4.0).
1A preliminary version of this paper was presented at PPAI-24: The 5th
AAAI Workshop on Privacy-Preserving Artificial Intelligence.
considered public information): Krichene et al. [
We consider the setting of supervised learning, where we assume an underlying (unknown) distribution over × , where denotes the set of possible inputs and denotes the set of possible labels. In this work, we focus on the binary classification setting where = {0, 1}. Our goal is to learn a predictor : → R that maps the input space to R with the goal of minimizing the expected loss ℒ( ; ) := E(,)∼ ℓ( (), ), where ℓ(· , · ) is a suitable loss function, e.g., the binary cross entropy loss.
To capture the setting of semi-sensitive features, let = ∘ × ∙ , where ∘ is the set of possible nonsensitive feature values, and ∙ is the set of possible sensitive feature values. We denote a dataset as = ((∘ , ∙ , ))∈[], where ∘ denotes the nonsensitive feature value, ∙ is the sensitive feature value, and is the corresponding (sensitive) label. We use to denote (∘ , ∙ ) for short. Some problems that motivate the setting above are in ads modeling tasks, where the features can include nonsensitive features such as the browser class, publisher website, category of the mobile app etc., sensitive features such as how long ago and how many times a user showed interest in an advertised product etc., and sensitive labels such as whether the user converted on the ad.
We say that two datasets , ′ are adjacent, denoted
∼ ′ if one dataset can be obtained from the other by
changing the sensitive features and/or the label for a single
example, namely replacing (∘ , ∙ , ) with (∘ , ˜∙ , ˜) for
some (˜∙ , ˜) ∈ ∙ × . Note in particular that ∘ are
not allowed to change in the adjacent dataset, and should be
considered known to the adversary.2
Definition 1 (DP; Dwork et al. [
Proposition 2 (Composition). If ℳ1 satisfies (1,
1)DP, and ℳ2 satisfies (2, 2)-DP, then the mechanism
ℳ that on dataset returns (ℳ1(), ℳ2()) satisfies
(1 + 2, 1 + 2)-DP. Furthermore, this holds even in the
adaptive case, when ℳ2 can use the output of ℳ1.
Proposition 3 (Post-Processing). If ℳ satisfies (,
)DP, then for all (randomized) algorithms , it holds that
(ℳ(· )) satisfies (, )-DP.
2Contrast this with the notion of DP with public features of [
Randomized Response. Perhaps the simplest mechanism that satisfies DP, even predating its definition, is Randomized Response. We state the mechanism in our context as releasing the known features along with the corresponding randomized (binary) label.
Definition 4 (Randomized Response; Warner [
Proposition 5. RR satisfies (, 0)-DP.
SGD and DP-SGD. Let be a parameterized model (e.g., a neural network) with trainable weights , and {(1, 1), . . . , ( , )} be a random mini-batch of training examples. Let = ℓ((), ) be the loss on the th example and let the average loss be ¯ := =1 . 1 ∑︀ Recall that standard training algorithms compute the average gradient ∇ ¯ and update with an optimizer such as SGD or Adam. Even though various optimizers could be used, we will refer to this class of (non-private) methods as SGD.
DP-SGD [
We now describe the family of algorithms we use for DP training with semi-sensitive features. Consider a model, such as a deep neural network, parameterized by . We will use the following high-level architecture:
(∘ , ∙ ) := c (∘ (∘ ), ℎ∙ (∙ )) , where = (∘ , ∙ , c), ∘ : ∘ → R∘ is a nonsensitive tower (i.e. the part of the model that acts on the nonsensitive features), ℎ∙ : ∙ → R∙ is a sensitive tower (acting on the sensitive features), and c : R∘ × R∙ → R is a common tower.
We also consider a truncated model that uses the same parameters ∘ and c, but does not depend on ∙ , by eliminating the dependence on ∙ , defined as follows: ∘ ,c (∘ ) := c (∘ (∘ ), 0) , where 0 ∈ R∙ . For convenience, we use the following notation for the losses of each of these models:
(; , ) := ℓ((), ), (∘ , c; , ) := ℓ(∘ ,c (∘ ), ).
Given a total privacy budget of (, ), we consider learning algorithms that execute two phases sequentially that satisfy (1, 0)-DP and (2, )-DP respectively such that 1+2 = and hence by Proposition 2, the algorithm satisfies (, )-DP. We refer to this algorithm as Hybrid, and these phases are as follows: Label-DP Phase. In this phase, we first apply RR1 to generate ((∘ , ˆ))∈[], i.e., a dataset where the sensitive ∙ ’s are removed and the labels are randomized. Then, we train the truncated model ∘ ,c (· ) on this data for one or more epochs of mini-batch SGD. By Proposition 5 and Proposition 3, this phase satisfies (1, 0)-DP.
To remove the bias introduced by the noisy labels, we define
:= 1/(1 + − 1 ) and modify the training loss as follows:
˜(∘ , c; ∘ , ˆ) =
(∘ , c; ∘ , 1 − ˆ) − ∑︀′∈{0,1} (∘ , c; ∘ , ′)
1 − 2
DP-SGD Phase. In this phase, we train the entire model
(· ), by warm-starting it from the ∘ ,c model of the
ifrst phase, then training for one or more epochs of DP-SGD.
We propose two variants: in the first, we freeze the sensitive
tower ∘ , and in the second, we fine-tune it. The noise
parameter is chosen appropriately so that this phase satisfies
(2, )-DP; in our work, we do this accounting using Rényi
DP [
We consider two natural baselines: DP-SGD (where all features are treated as sensitive) and RR on the truncated model ∘ ,c (where the sensitive features are discarded and only the labels are protected). Note that both can be viewed as special cases of Hybrid, where we use all the privacy budget in one of the two phases: DP-SGD corresponds to setting 1 = 0 and 2 = ; and RR corresponds to setting 1 = and 2 = 0.
The Hybrid algorithm allows using a different split between the two phases. A total privacy budget (, ) will be split into (1, 0) and (2, ). Since this budget allocation may have an impact on model quality, we will vary it in our experiments as follows: 1 := · ,
2 := (1 − ) · , where ∈ {0, 0.25, 0.5, 0.75, 1}, and the cases = 0, = 1 correspond to DP-SGD and RR, respectively.
We train binary classification models with binary crossentropy loss and report it together with the AUC loss (defined as 1 − AUC). We study the trade-offs between privacy and utility, as well as model size and utility.
We evaluate two model classes for : multilayer perceptrons (MLP) and factorization machines (FM).
Multilayer perceptron In the MLP models, we concatenate the outputs of the sensitive and nonsensitive towers before feeding them into joint fully connected layers: (∘ , ∙ ) := c (∘ (∘ ) ∘ ℎ∙ (∙ )) , where ∘ : ∘ → R∘ , ℎ∙ : ∙ → R∙ , c : R∘ +∙ → R and ∘ denotes concatenation of the vectors and .
Factorization Machine A factorization machine
(FM) [
Unlike an MLP, FM does not have parameters (besides a bias) in the combiner function and does not need to learn how to combine embeddings. The towers are computed by: ∘ (∘ )1 = ⟨∘ , ·∘ ,1⟩ + ∑︁ ∑︁ ∘ ∘ ⟨︀ ∘,2..., ∘,2...︀⟩ .
> ∘ (∘ )2... = ∑︁ ∘ ∘,2....
The sensitive tower is computed analogously.
See Appendix A for further details about the experimental setup.
The first benchmark we consider is a pCTR prediction task
on the Criteo Display Ads Dataset [
For this dataset, the AUC loss of the non-privately trained baselines is 0.1941 for the MLP model and 0.1930 for the FM model. 5.3.
The second benchmark we consider is a pCVR
prediction task on the Criteo Spons. Search Conversion Log
Dataset [
For this dataset, the AUC loss of the non-privately trained baselines is 0.2099 for the MLP model, and 0.2154 for the FM model. 3Although product_price is not explicitly marked as a label, it has a very high correlation with the label and the prediction task would become significantly easier if we were to include it. 0.195 1 2 4 8 4 8 12 4
8 Hybrid (frozen) Hybrid (fine-tuned) DP-SGD RR Hybrid (frozen) Hybrid (fine-tuned) DP-SGD RR (i) MLP model RHHDRyyPbb-SrrGiiddD((ffirnoeze-tnu)ned) 000...333011802 s0.306 so llog0.294 0.292 0.290 8 10 12 0.288 0
(i) MLP model
Privacy-utility trade-offs on Criteo Display Ads and Criteo Spons. Search are reported in Figures 1 and 2 respectively. On both benchmarks, we find that Hybrid improves over RR and DP-SGD across a range of privacy budgets. Specifically, we see an improvement in utility for both the MLP and FM models when ≥ 4. In this regime, there are substantial improvements: for instance, Hybrid achieves a better utility at = 8 than DP-SGD at = 12 (this is the case for both datasets and both models).
This significantly narrows the gap between the private model and the non-private baselines on Criteo Display Ads. For example, at = 12, the relative increase in AUC loss (defined as 1− A1U−CAnoUn-Cprivate − 1) goes from 6.3% for MLPDPSGD to 3.2% for MLP-Hybrid; and it goes from 3.0% for FM-DPSGD to 1.2% for FM-Hybrid. In both cases, the gap to the non-private model is approximately halved.
However, in the higher privacy regime (for = 1), the quality of the Hybrid-trained models appears to deteriorate, and in most cases it no longer improves upon DP-SGD. We believe this may be because the utility of the RR algorithm significantly deteriorates for small , and there may no longer be a benefit to the Label-DP phase in this regime.
It is also worth observing that the loss of the RR model plateaus at a value that is much higher than other methods – recall that the RR model is only trained on the non-sensitive features, hence its quality is limited by the best model one can train on these features alone.
Freezing the sensitive tower during the second phase may offer a computational advantage, as one no longer needs to compute/clip gradients of this tower.
To understand the impact this may have on quality, we compare the two Hybrid variants (frozen and fine-tuned). We observe that in some settings (specifically on Criteo Display (ii) FM model HHyybbrriidd ((ffirnoez-etnu)ned) 00..331120 RDRP-SGD 00..330068 s0.304 so llg00..229964 o 0.292 0.290 8 10 12 0.288 0
(ii) FM model =1 =2 =4 =8 =12 0.00 To further understand the effect of the budget split, we report, in Figure 3, the AUC loss of the Hybrid FM models, as we vary the budget allocation ratio = 1 . First, observe that for = 1, the best utility is achieved when = 0 (which corresponds to the special case of DP-SGD); this is consistent with the results of Section 5.4.1. As increases (4 ≤ ≤ 8), we observe that the optimal increases, and the best utility is typically achieved when ≥ 0.5, i.e. one benefits from spending a significant part of the budget on the RR phase. Finally, in the high regime ( = 12), the optimal decreases again, and is equal to = 0.25 in both datasets. This may be explained by the fact that the utility of the RR-trained model plateaus when grows (see Figure 1(ii) and Figure 2-(ii)), so one may not benefit from spending a higher budget on the RR phase.
Given the large impact the budget ratio has on quality, one should generally treat it as an important parameter to tune when using the Hybrid method, and it should be tuned separately for different values of .
0.1960 0.1958 CU0.1956 A 10.1954 0.1952 0.1950
In situations in which the DP-SGD phase of training happens in Trusted Executions Environments, one may be faced with stringent memory and compute constraints. In such scenarios, it is important to understand the trade-offs between utility and the size of the private model.
We vary the private model size on the Criteo Display Ads pCTR dataset, by varying the vocabulary size of the sensitive tower (this is done by computing privatized counts of the sensitive feature values, and keeping only features above a threshold. Varying the threshold leads to different model sizes). We report the results in Figure 4, for = 12. Here the largest model size corresponds to the results reported in Figure 1.
We observe that for a large range of model sizes, the deterioration in quality is surprisingly low. For example, focusing on the fine-tuned variant, when decreasing the model size ten-fold, the log loss of the FM model increases by 0.027%, and its AUC loss increases by 0.025%. When decreasing the model size fifty-fold, the log loss increases by 0.059% and the AUC loss by 0.078%. The loss remains well below that of the full-sized model at = 8 (denoted by the dashed lines on the figure). This indicates that for these two benchmarks, one may train significantly smaller models under DP constraints without largely sacrificing quality.
In this work, we studied training DP models with semisensitive features, and presented an algorithm that improves over two natural baselines on real ad modeling datasets.
Our experiments indicate that in the high privacy regime,
it is difficult to improve upon DPSGD. This invites further
investigation into this regime, either theoretically (by studying
utility bounds), or experimentally. An interesting direction
to explore is the use of label DP primitives beyond RR, e.g.,
[
Another open question is the precise characterization of
the differences (both in terms of privacy guarantees and
potential utility gap) between the notion of “DP with
semisensitive features” studied in this work, and “DP with public
features” from [
In both Criteo datasets used in this work, the sensitive features (resp. nonsensitive features) are fed into a single embedding layer: each value of a sensitive (resp. nonsensitive) feature is concatenated to its feature name to form a unique string. These string values are then either hashed with a ifxed number of hash bins, or a vocabulary of all sensitive (nonsensitive) strings is created, where only frequent values are kept while the remaining values are mapped to a single out-of-vocabulary token. In all our experiments reported here we use an embedding dimension of 32. The model size is therefore controlled either by the number of hash bins for the sensitive and nonsensitive features, or by frequency thresholds defining the the sensitive and nonsensitive vocabularies. In the latter case, we compute the frequency counts of the nonsensitive feature values exactly, while the counts of the sensitive features are computed privately, consuming a portion of the total privacy budget. We report the privacy parameters assuming that the vocabulary is known and only the counts are private; without this assumption the privacy increases by at most 0.007 compared to the reported numbers.
We compare these two strategies (hashing vs vocabulary thresholding) on the Criteo Display Ads pCTR dataset, and report the results in Figure 5. We find that the two approaches yield similar quality at the same model size (with a slight advantage to the vocab thresholding approach).
When using thresholding in Criteo Display Ads, we used a vocab threshold of 16 for non-sensitive features, and a threshold in {16, 64, 256, 1024, 4096} for sensitive features (this controls the sensitive tower size). On the Criteo Sponsored Search Conversion Log dataset, we opt for the simpler hashing approach, with 50k (resp. 100k) hash bins for the sensitive (resp. non-sensitive) features.
All features in both datasets being univalent, each example is transformed into a fixed number of embeddings, 19 sensitive and 20 nonsensitive embeddings for the Criteo Display Ads pCTR dataset, and 3 sensitive and 17 nonsensitive4 embeddings for the Criteo Sponsored Search Conversion Log dataset.
Multilayer Perceptron For the Criteo Display Ads
pCTR dataset, the 20 nonsensitive features are concatenated
and fed into a single fully connected layer with 598 hidden
units and using a ReLU activation function. The output of
this layer is concatenated with the 19 embeddings of the
sensitive features, and these are fed into two fully connected
layers, each also containing 598 hidden units and using a
ReLU activation function. The final output is a linear
combination of the last layer which produces a scalar logit
prediction. We use the Yogi optimizer [
For the Criteo Sponsored Search Conversion Log dataset
dataset, the 17 nonsensitive features are concatenated and fed
into a single fully connected layer with 256 hidden units and
using a ReLU activation function. The output of this layer is
concatenated with the 3 embeddings of the sensitive features,
and these are fed into two fully connected layers, each also
containing 256 hidden units and using a ReLU activation
function. The final output is a linear combination of the last
layer which produces a scalar logit prediction. We use the
Adam optimizer with batch size of 1024 for the RR phase of
training, and a batch size of 16384 for the DP-SGD phase
of training. We train with 16 RR epochs and 64 DP-SGD
epochs, and we tune the clipping norm ∈ [
Finally, we note that the optimal hyper-parameters tend to differ when optimizing for AUC loss vs log loss. In particular, we found that good models in terms of log loss tend to require much larger clipping norms than models optimizing AUC.