=Paper=
{{Paper
|id=Vol-3837/paper7
|storemode=property
|title=Training Differentially Private Ad Prediction Models With Semi-Sensitive Features
|pdfUrl=https://ceur-ws.org/Vol-3837/paper_15_ceur_paper.pdf
|volume=Vol-3837
|authors=Lynn Chua,Qiliang Cui,Badih Ghazi,Charlie Harrison,Pritish Kamath,Walid Krichene,Ravi Kumar,Pasin Manurangsi,Nicolas Mayoraz,Hema Venkata Krishna Giri Narra,Steffen Rendle,Amer Sinha,Avinash Varadarajan,Chiyuan Zhang
|dblpUrl=https://dblp.org/rec/conf/adkdd/ChuaCGHKK0MMNRS24
}}
==Training Differentially Private Ad Prediction Models With Semi-Sensitive Features==
https://ceur-ws.org/Vol-3837/paper_15_ceur_paper.pdf
Training Differentially Private Ad Prediction Models With
Semi-Sensitive Features
Lynn Chua1 , Qiliang Cui1 , Badih Ghazi1 , Charlie Harrison1 , Pritish Kamath1 , Walid Krichene1 ,
Ravi Kumar1 , Pasin Manurangsi1 , Nicolas Mayoraz1 , Krishna Giri Narra1 , Steffen Rendle1 ,
Amer Sinha1 , Avinash Varadarajan1 and Chiyuan Zhang1
1
Google
Abstract
Motivated by problems arising in digital advertising, we study the task of training differentially private (DP) machine learning models
with semi-sensitive features. In this setting, a subset of the features is known to the attacker (and thus need not be protected) while the
remaining features as well as the label are unknown to the attacker and should be protected by the DP guarantee. This task interpolates
between training the model with full DP (where the label and all features should be protected) or with label DP (where all the features
are considered known, and only the label should be protected). We present a new algorithm for training DP models with semi-sensitive
features. Through an empirical evaluation on ads datasets, we demonstrate that our algorithm surpasses in utility the baselines of (i) DP
stochastic gradient descent (DP-SGD) run on all features (known and unknown), and (ii) a label DP algorithm run only on the known
features (while discarding the unknown ones).
Keywords
Differential privacy, model training, ad models, semi-sensitive features
1. Introduction (features and label) and has been extensively studied, e.g.,
Abadi et al. [13]. On the other hand, Label DP (e.g., Chaud-
In recent years, large-scale machine learning (ML) algo- huri and Hsu [14], Ghazi et al. [15], Malek Esmaeili et al.
rithms have been adopted and deployed for different ad mod- [16]) is a variant that only protects the label of each training
eling tasks, including the training of predicted click-through example, and is thus suitable in settings where the adversary
rates (a.k.a. pCTR) and predicted conversion rates (a.k.a. already has access to the features.
pCVR) models. Roughly speaking, pCTR models predict the Label DP is a natural fit for the case where the features of
likelihood that an ad shown to a user is clicked, and pCVR the pCVR problem do not depend on cross-site information.
models predict the likelihood that an ad clicked (or viewed) However, a common setting, including that of the Protected
by the user leads to a conversion—which is defined as a de- Audience API on Chrome [17] and Android [18], is where
sirable action by the user on the advertiser site or app, such some features depend on cross-site information whereas the
as the purchase of the advertised product. remaining features do not. An example is the remarketing
Heightened user expectations around privacy have led dif- use case where a feature could indicate whether the same
ferent web browsers (including Apple Safari [1], Mozilla user previously expressed interest in the advertised product
Firefox [2], and Google Chrome [3]) to the deprecation of (e.g., added it to their cart) but did not purchase it. Revealing
third-party cookies (3PC), which are cross-site identifiers that a row of the database that has both contextual features (e.g.,
had hitherto allowed the joining in the clear of the datasets the publisher site, or the time of day the ad was served)
on which the pCTR and pCVR models are trained. More and features derived on the advertiser (e.g., user presence
precisely, 3PCs previously allowed determining the conver- on a particular remarketing list) could allow an attacker to
sion label for pCVR models as well as the construction of track a user across sites. In the Protected Audience API,
features (for pCTR and pCVR models) that depend on the these sensitive features are protected by multiple privacy
user’s behavior on sites other than the publisher where the mechanisms including feature-level randomized response.
ad was shown. The focus of this work is to analyze this setting from the
In order to support essential web functionalities that are DP perspective; we refer to it as DP model training with
affected by the deprecation of 3PCs, different web browsers semi-sensitive features. We formalize this setting, present an
have been building privacy-preserving APIs, including for algorithm for training private ML models with semi-sensitive
ads measurement and modeling such as the Interoperable features, and evaluate it on real ad prediction datasets, show-
Private Attribution (IPA) developed by Mozilla and Meta [4], ing that it compares favorably to natural baselines.1 We
Masked LARK from Microsoft [5, 6], the Attribution Report- report the effect of certain important parameters on utility,
ing API, available on both the Chrome browser [7] and the and also study the trade-offs between the size of the private
Android operating system [8], and the Private Click Measure- model and its quality – this is motivated by practical set-
ment (PCM) [9] and Private Ad Measurement (PAM) APIs tings, in which the private ML model training may happen in
[10] from Apple. The privacy guarantees of several of these Trusted Execution Environments with limited memory.
APIs rely on differential privacy (DP) [11, 12], which is a
strong and robust notion of privacy that has in recent years
gained significant popularity for data analytics and modeling 2. Related Work
tasks.
Different DP variants have been studied in the context of Two related notions of private model training with partially
supervised ML, depending on the adjacency definition. The private features were recently proposed, although they differ
standard definition of DP protects the full training example slightly in their adjacency definitions (and hence in what is
AdKDD ’24, August 2024, Barcelona, Spain 1
A preliminary version of this paper was presented at PPAI-24: The 5th
© 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License
Attribution 4.0 International (CC BY 4.0). AAAI Workshop on Privacy-Preserving Artificial Intelligence.
CEUR
ceur-ws.org
Workshop ISSN 1613-0073
Proceedings
considered public information): Krichene et al. [19] propose Randomized Response. Perhaps the simplest mecha-
a stronger notion in which the adversary is only assumed to nism that satisfies DP, even predating its definition, is Ran-
know the set of distinct values that the non-sensitive features domized Response. We state the mechanism in our context as
may take, for example the feature values of all possible ads, releasing the known features along with the corresponding
(while in our notion, we assume the adversary knows which randomized (binary) label.
specific values appeared in the dataset, together with their
counts). And in a concurrent work [20], an algorithm based Definition 4 (Randomized Response; Warner [23]). For 𝜀 >
on AdaBoost was proposed under a privacy notion similar to 0, the mechanism RR𝜀 on dataset 𝐷 = ((𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ))𝑖∈[𝑛]
ours; a key difference is that in their setting, the labels are returns ((𝑥∘𝑖 , 𝑦ˆ𝑖 ))𝑖∈[𝑛] where each 𝑦ˆ𝑖 is set to 𝑦𝑖 with prob.
𝑒𝜀 1
considered public. 1+𝑒𝜀
and to 1 − 𝑦𝑖 with prob. 1+𝑒 𝜀.
Proposition 5. RR𝜀 satisfies (𝜀, 0)-DP.
3. DP Training with Semi-Sensitive
SGD and DP-SGD. Let 𝐹𝑤 be a parameterized model
Features (e.g., a neural network) with trainable weights 𝑤, and
We consider the setting of supervised learning, where we {(𝑥1 , 𝑦1 ), . . . , (𝑥𝐵 , 𝑦𝐵 )} be a random mini-batch of train-
assume an underlying (unknown) distribution 𝒟 over 𝒳 × 𝒴, ing examples. Let 𝐿𝑖 = ℓ(𝐹𝑤 (𝑥𝑖 ), 𝑦𝑖 ) be the loss on the
𝑖th example and let the average loss be 𝐿 ¯ := 1 ∑︀𝐵 𝐿𝑖 .
where 𝒳 denotes the set of possible inputs and 𝒴 denotes 𝐵 𝑖=1
the set of possible labels. In this work, we focus on the Recall that standard training algorithms compute the average
gradient ∇𝑤 𝐿 ¯ and update 𝑤 with an optimizer such as SGD
binary classification setting where 𝒴 = {0, 1}. Our goal
is to learn a predictor 𝐹 : 𝒳 → R that maps the input or Adam. Even though various optimizers could be used, we
space 𝒳 to R with the goal of minimizing the expected loss will refer to this class of (non-private) methods as SGD.
ℒ(𝐹 ; 𝒟) := E(𝑥,𝑦)∼𝒟 ℓ(𝐹 (𝑥), 𝑦), where ℓ(·, ·) is a suitable DP-SGD [13] is widely used for DP training of deep neu-
loss function, e.g., the binary cross entropy loss. ral networks, wherein the per-example gradients ∇𝑤 𝐿𝑖 are
To capture the setting of semi-sensitive features, let 𝒳 = computed, and then re-scaled to have an ℓ2 -norm of at most
𝒳 ∘ ×𝒳 ∙ , where 𝒳 ∘ is the set of possible nonsensitive feature 𝐶, as 𝑔𝑖 := ∇𝑤 𝐿𝑖 · min{1, ‖∇𝑤𝐶𝐿𝑖 ‖2 }. Gaussian noise
∑︀𝐵
values, and 𝒳 ∙ is the set of possible sensitive feature values. 𝒩 (0, 𝐶 2 𝜎 2 𝐼) is then added to the average 𝐵1 𝑖=1 𝑔𝑖 and
We denote a dataset as 𝐷 = ((𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ))𝑖∈[𝑛] , where 𝑥∘𝑖 subsequently passed to the optimizer. As shown by Abadi
denotes the nonsensitive feature value, 𝑥∙𝑖 is the sensitive et al. [13], DP-SGD satisfies (𝜀, 𝛿)-DP where 𝜀, 𝛿 depend
feature value, and 𝑦𝑖 is the corresponding (sensitive) label. on 𝜎, the batch size and number of training steps; this can be
We use 𝑥𝑖 to denote (𝑥∘𝑖 , 𝑥∙𝑖 ) for short. Some problems that computed using the privacy accounting described in [13].
motivate the setting above are in ads modeling tasks, where
the features can include nonsensitive features such as the
browser class, publisher website, category of the mobile app 4. Algorithms
etc., sensitive features such as how long ago and how many
We now describe the family of algorithms we use for DP
times a user showed interest in an advertised product etc.,
training with semi-sensitive features. Consider a model, such
and sensitive labels such as whether the user converted on
as a deep neural network, parameterized by 𝑤. We will use
the ad.
the following high-level architecture:
We say that two datasets 𝐷, 𝐷′ are adjacent, denoted
𝐷 ∼ 𝐷′ if one dataset can be obtained from the other by 𝐹𝑤 (𝑥∘ , 𝑥∙ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ), ℎ𝑤∙ (𝑥∙ )) ,
changing the sensitive features and/or the label for a single
example, namely replacing (𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ) with (𝑥∘𝑖 , 𝑥
˜ ∙𝑖 , 𝑦˜𝑖 ) for where 𝑤 = (𝑤∘ , 𝑤∙ , 𝑤c ), 𝑔𝑤∘ : 𝒳 ∘ → R𝑑∘ is a non-
some (𝑥 ˜ 𝑖 , 𝑦˜𝑖 ) ∈ 𝒳 × 𝒴. Note in particular that 𝑥∘𝑖 are
∙ ∙
sensitive tower (i.e. the part of the model that acts on the
not allowed to change in the adjacent dataset, and should be nonsensitive features), ℎ𝑤∙ : 𝒳 ∙ → R𝑑∙ is a sensitive tower
considered known to the adversary.2 (acting on the sensitive features), and 𝑓𝑤c : R𝑑∘ × R𝑑∙ → R
Definition 1 (DP; Dwork et al. [12]). For 𝜀, 𝛿 ≥ 0, a ran- is a common tower.
domized mechanism ℳ satisfies (𝜀, 𝛿)-DP if for all pairs We also consider a truncated model that uses the same
𝐷, 𝐷′ of adjacent datasets, and for all outcome events 𝐸, it parameters 𝑤∘ and 𝑤c , but does not depend on 𝑤∙ , by
holds that Pr[ℳ(𝐷) ∈ 𝐸] ≤ 𝑒𝜀 · Pr[ℳ(𝐷′ ) ∈ 𝐸] + 𝛿. eliminating the dependence on 𝑥∙ , defined as follows:
For an extensive overview of DP, we refer the reader to the 𝐹𝑤∘ ,𝑤c (𝑥∘ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ), 0) ,
monograph of Dwork and Roth [22]. We use the following
key properties of DP. where 0 ∈ R𝑑∙ . For convenience, we use the following
notation for the losses of each of these models:
Proposition 2 (Composition). If ℳ1 satisfies (𝜀1 , 𝛿1 )-
DP, and ℳ2 satisfies (𝜀2 , 𝛿2 )-DP, then the mechanism 𝐿(𝑤; 𝑥, 𝑦) := ℓ(𝐹𝑤 (𝑥), 𝑦),
ℳ that on dataset 𝐷 returns (ℳ1 (𝐷), ℳ2 (𝐷)) satisfies
𝐿(𝑤∘ , 𝑤c ; 𝑥, 𝑦) := ℓ(𝐹𝑤∘ ,𝑤c (𝑥∘ ), 𝑦).
(𝜀1 + 𝜀2 , 𝛿1 + 𝛿2 )-DP. Furthermore, this holds even in the
adaptive case, when ℳ2 can use the output of ℳ1 . Given a total privacy budget of (𝜀, 𝛿), we consider learning
Proposition 3 (Post-Processing). If ℳ satisfies (𝜀, 𝛿)- algorithms that execute two phases sequentially that satisfy
DP, then for all (randomized) algorithms 𝒜, it holds that (𝜀1 , 0)-DP and (𝜀2 , 𝛿)-DP respectively such that 𝜀1 +𝜀2 = 𝜀
𝒜(ℳ(·)) satisfies (𝜀, 𝛿)-DP. and hence by Proposition 2, the algorithm satisfies (𝜀, 𝛿)-DP.
2 We refer to this algorithm as Hybrid, and these phases are as
Contrast this with the notion of DP with public features of [21], in which
𝑥∘𝑖 is allowed to change, as long as it takes values in the publicly known follows:
𝒳 ∘.
Label-DP Phase. In this phase, we first apply RR𝜀1 to Factorization Machine A factorization machine
generate ((𝑥∘𝑖 , 𝑦ˆ𝑖 ))𝑖∈[𝑛] , i.e., a dataset where the sensitive (FM) [27] embeds each feature into a 𝑑 = 𝑑∘ = 𝑑∙
𝑥∙𝑖 ’s are removed and the labels are randomized. Then, we dimensional embedding and builds all pairwise dot products
train the truncated model 𝐹𝑤∘ ,𝑤c (·) on this data for one between all features. We shortly summarize how FM can
or more epochs of mini-batch SGD. By Proposition 5 and be cast into our notation of 𝐹𝑤 . The parameters of the
Proposition 3, this phase satisfies (𝜀1 , 0)-DP. FM model consist of (i) embeddings
∘
for the sensitive
∙
and
To remove the bias introduced by the noisy labels, we define nonsensitive features 𝑤∘ ∈ R𝒳 ×𝑑 and 𝑤∙ ∈ R𝒳 ×𝑑 , and
𝑝 := 1/(1 + 𝑒−𝜀1 ) and modify the training loss as follows: (ii) a bias 𝑤c ∈ R. The combination function 𝑓𝑤c consists
of a sum of three different terms: the global bias 𝑤c , linear
˜ (𝑤∘ , 𝑤c ; 𝑥∘𝑖 , 𝑦ˆ ) =
𝐿 effects that are encoded in the first dimension of 𝑔 and ℎ,
𝑖
and pairwise interactions of the remaining dimensions:
𝐿(𝑤∘ , 𝑤c ; 𝑥∘𝑖 , 1 − 𝑦ˆ𝑖 ) − 𝑝 ∘
, 𝑤c ; 𝑥∘𝑖 , 𝑦 ′ )
∑︀
𝑦 ′ ∈{0,1} 𝐿(𝑤
1 − 2𝑝 𝑓𝑤c (𝑔, ℎ) = 𝑤1c + 𝑔1 + ℎ1 + ⟨𝑔2...𝑑 , ℎ2...𝑑 ⟩ .
Unlike an MLP, FM does not have parameters (besides a
DP-SGD Phase. In this phase, we train the entire model bias) in the combiner function and does not need to learn
𝐹𝑤 (·), by warm-starting it from the 𝐹𝑤∘ ,𝑤c model of the how to combine embeddings. The towers are computed by:
first phase, then training for one or more epochs of DP-SGD.
We propose two variants: in the first, we freeze the sensitive 𝑔𝑤∘ (𝑥∘ )1 = ⟨𝑥∘ , 𝑤·,1
∘
⟩
tower 𝑔𝑤∘ , and in the second, we fine-tune it. The noise pa- +
∑︁ ∑︁ ∘ ∘ ⟨︀ ∘ ∘
𝑥𝑗 𝑥𝑘 𝑤𝑗,2...𝑑 , 𝑤𝑘,2...𝑑
⟩︀
.
rameter 𝜎 is chosen appropriately so that this phase satisfies 𝑗 𝑘>𝑗
(𝜀2 , 𝛿)-DP; in our work, we do this accounting using Rényi ∑︁
∘
DP [13, 24], though other accounting techniques could be 𝑔𝑤∘ (𝑥 )2...𝑑 = 𝑥∘𝑗 𝑤𝑗,2...𝑑
∘
.
used, such as privacy loss distributions (PLD) [25, 26]. 𝑗
The sensitive tower is computed analogously.
See Appendix A for further details about the experimental
5. Experimental Results setup.
We consider two natural baselines: DP-SGD (where all fea-
tures are treated as sensitive) and RR on the truncated model 5.2. Criteo Display Ads pCTR Dataset
𝐹𝑤∘ ,𝑤c (where the sensitive features are discarded and only
The first benchmark we consider is a pCTR prediction task
the labels are protected). Note that both can be viewed as
on the Criteo Display Ads Dataset [28], which contains
special cases of Hybrid, where we use all the privacy budget
around 40 million examples. The dataset has a labeled train-
in one of the two phases: DP-SGD corresponds to setting
ing set and an unlabeled test set. We only use the labeled
𝜀1 = 0 and 𝜀2 = 𝜀; and RR corresponds to setting 𝜀1 = 𝜀
training set and split it chronologically into a 80%/10%/10%
and 𝜀2 = 0.
partition of train/validation/test sets. Each example consists
The Hybrid algorithm allows using a different split be-
of 13 integer features int-feature-[1-13] and 26 cat-
tween the two phases. A total privacy budget (𝜀, 𝛿) will be
egorical features categorical-feature-[14-39].
split into (𝜀1 , 0) and (𝜀2 , 𝛿). Since this budget allocation
Since the precise interpretation of these features is not avail-
may have an impact on model quality, we will vary it in our
able, we arbitrarily consider all even-numbered features as
experiments as follows:
sensitive and all odd-numbered features as nonsensitive.
𝜀1 := 𝑘 · 𝜀 , 𝜀2 := (1 − 𝑘) · 𝜀 , For this dataset, the AUC loss of the non-privately trained
baselines is 0.1941 for the MLP model and 0.1930 for the
where 𝑘 ∈ {0, 0.25, 0.5, 0.75, 1}, and the cases 𝑘 = 0, FM model.
𝑘 = 1 correspond to DP-SGD and RR, respectively.
We train binary classification models with binary cross- 5.3. Criteo Spons. Search Conversion
entropy loss and report it together with the AUC loss (defined
Log Dataset
as 1 − AUC). We study the trade-offs between privacy and
utility, as well as model size and utility. The second benchmark we consider is a pCVR predic-
tion task on the Criteo Spons. Search Conversion Log
Dataset [29], which contains 16 millions examples. We
5.1. Models
used a random 80%/20% partition of train/test sets and the
We evaluate two model classes for 𝐹𝑤 : multilayer percep- reported metrics are on the test set. The task considered in
trons (MLP) and factorization machines (FM). this work is a conversion prediction task, predicting the bi-
nary feature Sale (which has 10.8% positive occurrences).
Multilayer perceptron In the MLP models, we concate- The sensitive features are device_type, audience_id,
nate the outputs of the sensitive and nonsensitive towers and user_id. We consider all other features to be nonsen-
before feeding them into joint fully connected layers: sitive, except for features denoted Outcome/Labels in [29],
and product_price, all of which are omitted from the
𝐹𝑤 (𝑥∘ , 𝑥∙ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ) ∘ ℎ𝑤∙ (𝑥∙ )) , model3 .
For this dataset, the AUC loss of the non-privately trained
where 𝑔𝑤∘ : 𝒳 ∘ → R𝑑∘ , ℎ𝑤∙ : 𝒳 ∙ → R𝑑∙ , 𝑓𝑤c : baselines is 0.2099 for the MLP model, and 0.2154 for the
R𝑑∘ +𝑑∙ → R and 𝑢 ∘ 𝑣 denotes concatenation of the vectors FM model.
𝑢 and 𝑣. 3
Although product_price is not explicitly marked as a label, it has
a very high correlation with the label and the prediction task would
become significantly easier if we were to include it.
0.220 0.480 0.220 0.480
Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (frozen)
Hybrid (fine-tuned) 0.475 Hybrid (fine-tuned) Hybrid (fine-tuned) 0.475 Hybrid (fine-tuned)
0.215 DP-SGD DP-SGD 0.215 DP-SGD DP-SGD
RR 0.470 RR RR 0.470 RR
0.210 0.465 0.210 0.465
log loss
1 - AUC
log loss
1 - AUC
0.205 0.460 0.205 0.460
0.455 0.455
0.200 0.200
0.450 0.450
0.195 0.445 0.195 0.445
1 2 4 8 12 1 2 4 8 12 1 2 4 8 12 1 2 4 8 12
(i) MLP model (ii) FM model
Figure 1: AUC loss and log loss of (i) MLP model and (ii) FM model trained under various privacy budgets 𝜀 on the
Criteo Display Ads pCTR dataset.
0.280 0.312 0.280 0.312
Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (frozen)
Hybrid (fine-tuned) 0.310 Hybrid (fine-tuned) 0.275 Hybrid (fine-tuned) 0.310 Hybrid (fine-tuned)
0.275
DP-SGD DP-SGD 0.270 DP-SGD 0.308 DP-SGD
0.270 RR 0.308 RR RR RR
0.265 0.306
0.306 0.304
0.265 0.260
log loss
log loss
1 - AUC
1 - AUC
0.230 0.235 0.296
0.294
0.230 0.294
0.225 0.292
0.225 0.292
0.220 0.290 0.220 0.290
0.215 0.288 0.215 0.288
0 2 4 6 8 10 12 0 2 4 6 8 10 12 0 2 4 6 8 10 12 0 2 4 6 8 10 12
(i) MLP model (ii) FM model
Figure 2: AUC loss and log loss of (i) MLP model and (ii) FM model trained under various privacy budgets 𝜀 on the
Criteo Sponsored Search Conversion Log dataset.
0.208 0.232
=1 =1
5.4. Results 0.206
=2
=4
0.230 =2
=4
=8 0.228 =8
0.204 = 12 = 12
0.226
5.4.1. Improved privacy-utility trade-off
1 - AUC
1 - AUC
0.202 0.224
0.200 0.222
Privacy-utility trade-offs on Criteo Display Ads and Criteo 0.198 0.220
0.218
Spons. Search are reported in Figures 1 and 2 respectively. 0.196
0.216
0.00 0.25 0.50 0.75 0.00 0.25 0.50 0.75
On both benchmarks, we find that Hybrid improves over RR k= 1
k= 1
and DP-SGD across a range of privacy budgets. Specifically, (i) Criteo Display Ads (ii) Criteo Spons. Search
we see an improvement in utility for both the MLP and FM
models when 𝜀 ≥ 4. In this regime, there are substantial Figure 3: Effect of the budget split 𝑘 = 𝜀1 /𝜀 on AUC loss
improvements: for instance, Hybrid achieves a better utility for the FM model, with 𝜀 = 12, on (i) Criteo Display Ads
at 𝜀 = 8 than DP-SGD at 𝜀 = 12 (this is the case for both pCTR dataset and (ii) Criteo Spons. Search Conversion Log
dataset.
datasets and both models).
This significantly narrows the gap between the private
model and the non-private baselines on Criteo Display Ads.
For example, at 𝜀 = 12, the relative increase in AUC loss Ads in the high 𝜀 regime, see Figure 1), freezing can achieve
1−AUC comparable quality to fine-tuning. In all other cases, fine-
(defined as 1−AUC non-private
− 1) goes from 6.3% for MLP-
DPSGD to 3.2% for MLP-Hybrid; and it goes from 3.0% for tuning generally achieves better utility. In particular, for
FM-DPSGD to 1.2% for FM-Hybrid. In both cases, the gap the Criteo Spons. Search dataset (see Figure 2), freezing
to the non-private model is approximately halved. leads to a significant degradation across all values of 𝜀. This
However, in the higher privacy regime (for 𝜀 = 1), the indicates that freezing, while computationally advantageous,
quality of the Hybrid-trained models appears to deteriorate, may come at a high utility cost in practice.
and in most cases it no longer improves upon DP-SGD. We
believe this may be because the utility of the RR algorithm 5.4.3. Effect of budget split
significantly deteriorates for small 𝜀, and there may no longer
To further understand the effect of the budget split, we report,
be a benefit to the Label-DP phase in this regime.
in Figure 3, the AUC loss of the Hybrid FM models, as
It is also worth observing that the loss of the RR model
we vary the budget allocation ratio 𝑘 = 𝜀𝜀1 . First, observe
plateaus at a value that is much higher than other methods –
that for 𝜀 = 1, the best utility is achieved when 𝑘 = 0
recall that the RR model is only trained on the non-sensitive
(which corresponds to the special case of DP-SGD); this is
features, hence its quality is limited by the best model one
consistent with the results of Section 5.4.1. As 𝜀 increases
can train on these features alone.
(4 ≤ 𝜀 ≤ 8), we observe that the optimal 𝑘 increases, and
the best utility is typically achieved when 𝑘 ≥ 0.5, i.e. one
5.4.2. Freezing vs fine-tuning benefits from spending a significant part of the budget on
Freezing the sensitive tower during the second phase may the RR phase. Finally, in the high 𝜀 regime (𝜀 = 12), the
offer a computational advantage, as one no longer needs to optimal 𝑘 decreases again, and is equal to 𝑘 = 0.25 in both
compute/clip gradients of this tower. datasets. This may be explained by the fact that the utility of
To understand the impact this may have on quality, we the RR-trained model plateaus when 𝜀 grows (see Figure 1-
compare the two Hybrid variants (frozen and fine-tuned). We (ii) and Figure 2-(ii)), so one may not benefit from spending
observe that in some settings (specifically on Criteo Display a higher budget on the RR phase.
Given the large impact the budget ratio 𝑘 has on quality,
one should generally treat it as an important parameter to References
tune when using the Hybrid method, and it should be tuned
separately for different values of 𝜀. [1] J. Wilander, Full Third-Party Cookie Blocking and
More, 2020. https://webkit.org/blog/10218/full-third-p
0.4485
0.1960
arty-cookie-blocking-and-more/.
0.4483
0.1958 0.4480 [2] M. Wood, Today’s Firefox Blocks Third-Party Track-
0.4477 ing Cookies and Cryptomining by Default, 2019. https:
log loss
1 - AUC
0.1956
0.4475
0.4473
//blog.mozilla.org/en/products/firefox/todays-firefox
0.1954
Hybrid (frozen), = 12 Hybrid (frozen), = 12 -blocks-third-party-tracking-cookies-and-cryptomin
Hybrid (fine-tuned), = 12 0.4470 Hybrid (fine-tuned), = 12
0.1952 Hybrid (frozen), = 8 Hybrid (frozen), = 8
0.4467 ing-by-default/.
Hybrid (fine-tuned), = 8 Hybrid (fine-tuned), = 8
0.1950 0.4465
105 106 105 106 [3] J. Schuh, Building a more private web: A path towards
Sensitive vocabulary size Sensitive vocabulary size
making third party cookies obsolete, 2020. https://blog
Figure 4: AUC loss and log loss of FM model trained under .chromium.org/2020/01/building-more-private-web
various private model sizes at 𝜀 = 12 on the Criteo Display -path-towards.html.
Ads pCTR dataset. The 𝑥-axis denotes the vocabulary size
[4] M. Thomson, Privacy Preserving Attribution for Ad-
of the sensitive tower.
vertising, 2022. https://blog.mozilla.org/en/mozilla/pr
ivacy-preserving-attribution-for-advertising/.
[5] J. J. Pfeiffer III, D. Charles, D. Gilton, Y. H.
5.4.4. Model-size utility trade-off Jung, M. Parsana, E. Anderson, Masked lark:
Masked learning, aggregation and reporting workflow,
In situations in which the DP-SGD phase of training happens arXiv:2110.14794 (2021).
in Trusted Executions Environments, one may be faced with [6] Microsoft, MaskedLARk, 2021. https://github.com/m
stringent memory and compute constraints. In such scenarios, icrosoft/maskedlark.
it is important to understand the trade-offs between utility [7] M. Nalpas, A. White, Attribution Reporting, 2021. ht
and the size of the private model. tps://developer.chrome.com/en/docs/privacy-sandbox
We vary the private model size on the Criteo Display Ads /attribution-reporting/.
pCTR dataset, by varying the vocabulary size of the sensitive [8] Android, Attribution reporting, 2023. https://developer.
tower (this is done by computing privatized counts of the android.com/design-for-safety/privacy-sandbox/attri
sensitive feature values, and keeping only features above a bution.
threshold. Varying the threshold leads to different model [9] J. Wilander, Introducing Private Click Measurement,
sizes). We report the results in Figure 4, for 𝜀 = 12. Here PCM, 2021. https://webkit.org/blog/11529/introducin
the largest model size corresponds to the results reported in g-private-click-measurement-pcm/.
Figure 1. [10] L. Winstrom, A proposal for privacy preserving ad
We observe that for a large range of model sizes, the deteri- attribution measurement using prio-like architecture,
oration in quality is surprisingly low. For example, focusing 2023. https://github.com/patcg/proposals/issues/17.
on the fine-tuned variant, when decreasing the model size [11] C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov,
ten-fold, the log loss of the FM model increases by 0.027%, M. Naor, Our data, ourselves: Privacy via distributed
and its AUC loss increases by 0.025%. When decreasing noise generation, in: EUROCRYPT, 2006, pp. 486–
the model size fifty-fold, the log loss increases by 0.059% 503.
and the AUC loss by 0.078%. The loss remains well below [12] C. Dwork, F. McSherry, K. Nissim, A. D. Smith, Cali-
that of the full-sized model at 𝜀 = 8 (denoted by the dashed brating noise to sensitivity in private data analysis, in:
lines on the figure). This indicates that for these two bench- TCC, 2006, pp. 265–284.
marks, one may train significantly smaller models under DP [13] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan,
constraints without largely sacrificing quality. I. Mironov, K. Talwar, L. Zhang, Deep learning with
differential privacy, in: CCS, 2016, pp. 308–318.
6. Conclusion and Future [14] K. Chaudhuri, D. Hsu, Sample complexity bounds for
differentially private learning, in: COLT, 2011, pp.
Directions 155–186.
[15] B. Ghazi, N. Golowich, R. Kumar, P. Manurangsi,
In this work, we studied training DP models with semi- C. Zhang, Deep learning with label differential pri-
sensitive features, and presented an algorithm that improves vacy, in: NeurIPS, 2021, pp. 27131–27145.
over two natural baselines on real ad modeling datasets. [16] M. Malek Esmaeili, I. Mironov, K. Prasad, I. Shilov,
Our experiments indicate that in the high privacy regime, F. Tramer, Antipodes of label differential privacy:
it is difficult to improve upon DPSGD. This invites further in- PATE and ALIBI, in: NeurIPS, volume 34, 2021,
vestigation into this regime, either theoretically (by studying pp. 6934–6945.
utility bounds), or experimentally. An interesting direction [17] S. Dutton, K. K. Lee, Protected Audience API: On-
to explore is the use of label DP primitives beyond RR, e.g., device ad auctions to serve remarketing and custom au-
[15, 16], particularly ones that perform better for smaller 𝜀. diences, without cross-site third-party tracking., 2022.
Another open question is the precise characterization of https://developer.chrome.com/docs/privacy-sandbox
the differences (both in terms of privacy guarantees and /protected-audience.
potential utility gap) between the notion of “DP with semi- [18] Android, Protected Audience API
sensitive features” studied in this work, and “DP with public on Android developer guide., 2023.
features” from [19]. Https://developer.android.com/design-for-
safety/privacy-sandbox/guides/protected-audience.
[19] W. Krichene, N. E Mayoraz, S. Rendle, S. Song,
A. Thakurta, L. Zhang, Private learning with public report the results in Figure 5. We find that the two approaches
features, in: AISTATS, 2024, pp. 4150–4158. yield similar quality at the same model size (with a slight
[20] Z. Shen, A. Krishnaswamy, J. Kulkarni, K. Muna- advantage to the vocab thresholding approach).
gala, Classification with partially private features,
0.210 0.460
arXiv:2312.07583 (2023). 0.208
Vocab thresholding
Hashing 0.458
Vocab thresholding
Hashing
[21] W. Krichene, N. Mayoraz, S. Rendle, S. Song, 0.206 0.456
A. Thakurta, L. Zhang, Private learning with public 0.204 0.454
log loss
1 - AUC
0.202 0.452
features, arXiv:2310.15454 (2023).
0.200 0.450
[22] C. Dwork, A. Roth, The algorithmic foundations of 0.198 0.448
differential privacy, Foundations and Trends® in Theo- 0.196 0.446
2 4 6 8 10 12 2 4 6 8 10 12
retical Computer Science 9 (2014) 211–407.
[23] S. L. Warner, Randomized response: a survey tech-
nique for eliminating evasive answer bias., JASA 60 Figure 5: Privacy-utility trade-off of the fine-tuned Hybrid
FM model on Criteo Display Ads, under hashing vs vocab
309 (1965) 63–69.
thresholding.
[24] I. Mironov, Rényi differential privacy, in: CSF, 2017,
pp. 263–275.
[25] S. Meiser, E. Mohammadi, Tight on budget? Tight When using thresholding in Criteo Display Ads, we used
bounds for 𝑟-fold approximate differential privacy, in: a vocab threshold of 16 for non-sensitive features, and a
CCS, 2018, pp. 247–264. threshold in {16, 64, 256, 1024, 4096} for sensitive features
[26] D. M. Sommer, S. Meiser, E. Mohammadi, Privacy (this controls the sensitive tower size). On the Criteo Spon-
loss classes: The central limit theorem in differential sored Search Conversion Log dataset, we opt for the simpler
privacy, Proc. Priv. Enhancing Technol. 2019 (2019) hashing approach, with 50k (resp. 100k) hash bins for the
245–269. URL: https://doi.org/10.2478/popets-2019-0 sensitive (resp. non-sensitive) features.
029. doi:10.2478/POPETS-2019-0029. All features in both datasets being univalent, each example
[27] S. Rendle, Factorization machines, in: ICDM, 2010, is transformed into a fixed number of embeddings, 19 sensi-
pp. 995–1000. tive and 20 nonsensitive embeddings for the Criteo Display
[28] O. C. Jean-Baptiste Tien, joycenv, Display advertising Ads pCTR dataset, and 3 sensitive and 17 nonsensitive4 em-
challenge, 2014. URL: https://kaggle.com/competition beddings for the Criteo Sponsored Search Conversion Log
s/criteo-display-ad-challenge. dataset.
[29] M. Tallis, P. Yadav, Reacting to variations in product
demand: An application for conversion rate (cr) predic- Multilayer Perceptron For the Criteo Display Ads
tion in sponsored search, arXiv:1806.08211 (2018). pCTR dataset, the 20 nonsensitive features are concatenated
[30] M. Zaheer, S. Reddi, D. Sachan, S. Kale, S. Kumar, and fed into a single fully connected layer with 598 hidden
Adaptive methods for nonconvex optimization, in: units and using a ReLU activation function. The output of
NIPS, 2018. this layer is concatenated with the 19 embeddings of the
[31] I. Loshchilov, F. Hutter, SGDR: stochastic gradient sensitive features, and these are fed into two fully connected
descent with warm restarts, in: ICLR, 2017. layers, each also containing 598 hidden units and using a
ReLU activation function. The final output is a linear com-
bination of the last layer which produces a scalar logit pre-
A. Training Details diction. We use the Yogi optimizer [30] with a base learning
rate of 0.01 and a batch size of 1024 for our baseline and
In both Criteo datasets used in this work, the sensitive fea- for the RR phase of training. We use SGD with a base learn-
tures (resp. nonsensitive features) are fed into a single em- ing rate of 0.1, momentum 0.9, and batch size of 16384 for
bedding layer: each value of a sensitive (resp. nonsensitive) the DP-SGD phase of training. For both, we scale the base
feature is concatenated to its feature name to form a unique learning rate with a cosine decay [31]. We train with 10
string. These string values are then either hashed with a RR epochs and 50 or 100 DP-SGD epochs, and we tune the
fixed number of hash bins, or a vocabulary of all sensitive norm bound 𝐶 ∈ [10, 50].
(nonsensitive) strings is created, where only frequent values For the Criteo Sponsored Search Conversion Log dataset
are kept while the remaining values are mapped to a single dataset, the 17 nonsensitive features are concatenated and fed
out-of-vocabulary token. In all our experiments reported into a single fully connected layer with 256 hidden units and
here we use an embedding dimension of 32. The model size using a ReLU activation function. The output of this layer is
is therefore controlled either by the number of hash bins concatenated with the 3 embeddings of the sensitive features,
for the sensitive and nonsensitive features, or by frequency and these are fed into two fully connected layers, each also
thresholds defining the the sensitive and nonsensitive vocab- containing 256 hidden units and using a ReLU activation
ularies. In the latter case, we compute the frequency counts function. The final output is a linear combination of the last
of the nonsensitive feature values exactly, while the counts layer which produces a scalar logit prediction. We use the
of the sensitive features are computed privately, consuming Adam optimizer with batch size of 1024 for the RR phase of
a portion of the total privacy budget. We report the privacy training, and a batch size of 16384 for the DP-SGD phase
parameters assuming that the vocabulary is known and only of training. We train with 16 RR epochs and 64 DP-SGD
the counts are private; without this assumption the privacy epochs, and we tune the clipping norm 𝐶 ∈ [10, 30].
𝜀 increases by at most 0.007 compared to the reported num-
bers.
4
We compare these two strategies (hashing vs vocabulary click_timestamp is replaced by two features:
thresholding) on the Criteo Display Ads pCTR dataset, and click_hour_of_day and click_day_of_week, and
nbr_clicks_1week is replaced by its log2 transformed value.
Factorization Machine A linear model composed of a
bias term and 20+19 (resp. 17+3) linear coefficients comple-
ments the above mentioned embeddings for the Criteo Dis-
play Ads pCTR dataset (resp. the Criteo Sponsored Search
Conversion Log dataset). The scalar logit prediction is the
sum of this linear model and all the pairwise dot-products of
the 39 (resp. 20) embeddings. We use the Adam optimizer
with a batch size of 16384 for all our experiments. In an
initial hyper-parameter search we also tuned the standard de-
viation of the random initialization 𝜎 of all model parameters,
as well as the regularization 𝜇 of the embeddings and we
settled on 𝜎 = 10−2 and 𝜇 ∈ {10−2 , 10−3 , 10−4 , 10−5 }
for all experiments. In practice, the regularization parameter
had little impact. The most important parameters to tune
are the learning rate (tuned in the range [10−5 , 10−3 ]) and
the clipping norm (tuned in the range [10, 30]. Note that
we did not distinguish the dataset used for hyper-parameter
tuning from the one used to report the final metrics as our ex-
periments on the Criteo Display Ads pCTR dataset showed
virtually no difference between metrics measured on either
sets.
Finally, we note that the optimal hyper-parameters tend to
differ when optimizing for AUC loss vs log loss. In particular,
we found that good models in terms of log loss tend to require
much larger clipping norms than models optimizing AUC.