Training Differentially Private Ad Prediction Models With Semi-Sensitive Features Lynn Chua1 , Qiliang Cui1 , Badih Ghazi1 , Charlie Harrison1 , Pritish Kamath1 , Walid Krichene1 , Ravi Kumar1 , Pasin Manurangsi1 , Nicolas Mayoraz1 , Krishna Giri Narra1 , Steffen Rendle1 , Amer Sinha1 , Avinash Varadarajan1 and Chiyuan Zhang1 1 Google Abstract Motivated by problems arising in digital advertising, we study the task of training differentially private (DP) machine learning models with semi-sensitive features. In this setting, a subset of the features is known to the attacker (and thus need not be protected) while the remaining features as well as the label are unknown to the attacker and should be protected by the DP guarantee. This task interpolates between training the model with full DP (where the label and all features should be protected) or with label DP (where all the features are considered known, and only the label should be protected). We present a new algorithm for training DP models with semi-sensitive features. Through an empirical evaluation on ads datasets, we demonstrate that our algorithm surpasses in utility the baselines of (i) DP stochastic gradient descent (DP-SGD) run on all features (known and unknown), and (ii) a label DP algorithm run only on the known features (while discarding the unknown ones). Keywords Differential privacy, model training, ad models, semi-sensitive features 1. Introduction (features and label) and has been extensively studied, e.g., Abadi et al. [13]. On the other hand, Label DP (e.g., Chaud- In recent years, large-scale machine learning (ML) algo- huri and Hsu [14], Ghazi et al. [15], Malek Esmaeili et al. rithms have been adopted and deployed for different ad mod- [16]) is a variant that only protects the label of each training eling tasks, including the training of predicted click-through example, and is thus suitable in settings where the adversary rates (a.k.a. pCTR) and predicted conversion rates (a.k.a. already has access to the features. pCVR) models. Roughly speaking, pCTR models predict the Label DP is a natural fit for the case where the features of likelihood that an ad shown to a user is clicked, and pCVR the pCVR problem do not depend on cross-site information. models predict the likelihood that an ad clicked (or viewed) However, a common setting, including that of the Protected by the user leads to a conversion—which is defined as a de- Audience API on Chrome [17] and Android [18], is where sirable action by the user on the advertiser site or app, such some features depend on cross-site information whereas the as the purchase of the advertised product. remaining features do not. An example is the remarketing Heightened user expectations around privacy have led dif- use case where a feature could indicate whether the same ferent web browsers (including Apple Safari [1], Mozilla user previously expressed interest in the advertised product Firefox [2], and Google Chrome [3]) to the deprecation of (e.g., added it to their cart) but did not purchase it. Revealing third-party cookies (3PC), which are cross-site identifiers that a row of the database that has both contextual features (e.g., had hitherto allowed the joining in the clear of the datasets the publisher site, or the time of day the ad was served) on which the pCTR and pCVR models are trained. More and features derived on the advertiser (e.g., user presence precisely, 3PCs previously allowed determining the conver- on a particular remarketing list) could allow an attacker to sion label for pCVR models as well as the construction of track a user across sites. In the Protected Audience API, features (for pCTR and pCVR models) that depend on the these sensitive features are protected by multiple privacy user’s behavior on sites other than the publisher where the mechanisms including feature-level randomized response. ad was shown. The focus of this work is to analyze this setting from the In order to support essential web functionalities that are DP perspective; we refer to it as DP model training with affected by the deprecation of 3PCs, different web browsers semi-sensitive features. We formalize this setting, present an have been building privacy-preserving APIs, including for algorithm for training private ML models with semi-sensitive ads measurement and modeling such as the Interoperable features, and evaluate it on real ad prediction datasets, show- Private Attribution (IPA) developed by Mozilla and Meta [4], ing that it compares favorably to natural baselines.1 We Masked LARK from Microsoft [5, 6], the Attribution Report- report the effect of certain important parameters on utility, ing API, available on both the Chrome browser [7] and the and also study the trade-offs between the size of the private Android operating system [8], and the Private Click Measure- model and its quality – this is motivated by practical set- ment (PCM) [9] and Private Ad Measurement (PAM) APIs tings, in which the private ML model training may happen in [10] from Apple. The privacy guarantees of several of these Trusted Execution Environments with limited memory. APIs rely on differential privacy (DP) [11, 12], which is a strong and robust notion of privacy that has in recent years gained significant popularity for data analytics and modeling 2. Related Work tasks. Different DP variants have been studied in the context of Two related notions of private model training with partially supervised ML, depending on the adjacency definition. The private features were recently proposed, although they differ standard definition of DP protects the full training example slightly in their adjacency definitions (and hence in what is AdKDD ’24, August 2024, Barcelona, Spain 1 A preliminary version of this paper was presented at PPAI-24: The 5th © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). AAAI Workshop on Privacy-Preserving Artificial Intelligence. CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings considered public information): Krichene et al. [19] propose Randomized Response. Perhaps the simplest mecha- a stronger notion in which the adversary is only assumed to nism that satisfies DP, even predating its definition, is Ran- know the set of distinct values that the non-sensitive features domized Response. We state the mechanism in our context as may take, for example the feature values of all possible ads, releasing the known features along with the corresponding (while in our notion, we assume the adversary knows which randomized (binary) label. specific values appeared in the dataset, together with their counts). And in a concurrent work [20], an algorithm based Definition 4 (Randomized Response; Warner [23]). For 𝜀 > on AdaBoost was proposed under a privacy notion similar to 0, the mechanism RR𝜀 on dataset 𝐷 = ((𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ))𝑖∈[𝑛] ours; a key difference is that in their setting, the labels are returns ((𝑥∘𝑖 , 𝑦ˆ𝑖 ))𝑖∈[𝑛] where each 𝑦ˆ𝑖 is set to 𝑦𝑖 with prob. 𝑒𝜀 1 considered public. 1+𝑒𝜀 and to 1 − 𝑦𝑖 with prob. 1+𝑒 𝜀. Proposition 5. RR𝜀 satisfies (𝜀, 0)-DP. 3. DP Training with Semi-Sensitive SGD and DP-SGD. Let 𝐹𝑤 be a parameterized model Features (e.g., a neural network) with trainable weights 𝑤, and We consider the setting of supervised learning, where we {(𝑥1 , 𝑦1 ), . . . , (𝑥𝐵 , 𝑦𝐵 )} be a random mini-batch of train- assume an underlying (unknown) distribution 𝒟 over 𝒳 × 𝒴, ing examples. Let 𝐿𝑖 = ℓ(𝐹𝑤 (𝑥𝑖 ), 𝑦𝑖 ) be the loss on the 𝑖th example and let the average loss be 𝐿 ¯ := 1 ∑︀𝐵 𝐿𝑖 . where 𝒳 denotes the set of possible inputs and 𝒴 denotes 𝐵 𝑖=1 the set of possible labels. In this work, we focus on the Recall that standard training algorithms compute the average gradient ∇𝑤 𝐿 ¯ and update 𝑤 with an optimizer such as SGD binary classification setting where 𝒴 = {0, 1}. Our goal is to learn a predictor 𝐹 : 𝒳 → R that maps the input or Adam. Even though various optimizers could be used, we space 𝒳 to R with the goal of minimizing the expected loss will refer to this class of (non-private) methods as SGD. ℒ(𝐹 ; 𝒟) := E(𝑥,𝑦)∼𝒟 ℓ(𝐹 (𝑥), 𝑦), where ℓ(·, ·) is a suitable DP-SGD [13] is widely used for DP training of deep neu- loss function, e.g., the binary cross entropy loss. ral networks, wherein the per-example gradients ∇𝑤 𝐿𝑖 are To capture the setting of semi-sensitive features, let 𝒳 = computed, and then re-scaled to have an ℓ2 -norm of at most 𝒳 ∘ ×𝒳 ∙ , where 𝒳 ∘ is the set of possible nonsensitive feature 𝐶, as 𝑔𝑖 := ∇𝑤 𝐿𝑖 · min{1, ‖∇𝑤𝐶𝐿𝑖 ‖2 }. Gaussian noise ∑︀𝐵 values, and 𝒳 ∙ is the set of possible sensitive feature values. 𝒩 (0, 𝐶 2 𝜎 2 𝐼) is then added to the average 𝐵1 𝑖=1 𝑔𝑖 and We denote a dataset as 𝐷 = ((𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ))𝑖∈[𝑛] , where 𝑥∘𝑖 subsequently passed to the optimizer. As shown by Abadi denotes the nonsensitive feature value, 𝑥∙𝑖 is the sensitive et al. [13], DP-SGD satisfies (𝜀, 𝛿)-DP where 𝜀, 𝛿 depend feature value, and 𝑦𝑖 is the corresponding (sensitive) label. on 𝜎, the batch size and number of training steps; this can be We use 𝑥𝑖 to denote (𝑥∘𝑖 , 𝑥∙𝑖 ) for short. Some problems that computed using the privacy accounting described in [13]. motivate the setting above are in ads modeling tasks, where the features can include nonsensitive features such as the browser class, publisher website, category of the mobile app 4. Algorithms etc., sensitive features such as how long ago and how many We now describe the family of algorithms we use for DP times a user showed interest in an advertised product etc., training with semi-sensitive features. Consider a model, such and sensitive labels such as whether the user converted on as a deep neural network, parameterized by 𝑤. We will use the ad. the following high-level architecture: We say that two datasets 𝐷, 𝐷′ are adjacent, denoted 𝐷 ∼ 𝐷′ if one dataset can be obtained from the other by 𝐹𝑤 (𝑥∘ , 𝑥∙ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ), ℎ𝑤∙ (𝑥∙ )) , changing the sensitive features and/or the label for a single example, namely replacing (𝑥∘𝑖 , 𝑥∙𝑖 , 𝑦𝑖 ) with (𝑥∘𝑖 , 𝑥 ˜ ∙𝑖 , 𝑦˜𝑖 ) for where 𝑤 = (𝑤∘ , 𝑤∙ , 𝑤c ), 𝑔𝑤∘ : 𝒳 ∘ → R𝑑∘ is a non- some (𝑥 ˜ 𝑖 , 𝑦˜𝑖 ) ∈ 𝒳 × 𝒴. Note in particular that 𝑥∘𝑖 are ∙ ∙ sensitive tower (i.e. the part of the model that acts on the not allowed to change in the adjacent dataset, and should be nonsensitive features), ℎ𝑤∙ : 𝒳 ∙ → R𝑑∙ is a sensitive tower considered known to the adversary.2 (acting on the sensitive features), and 𝑓𝑤c : R𝑑∘ × R𝑑∙ → R Definition 1 (DP; Dwork et al. [12]). For 𝜀, 𝛿 ≥ 0, a ran- is a common tower. domized mechanism ℳ satisfies (𝜀, 𝛿)-DP if for all pairs We also consider a truncated model that uses the same 𝐷, 𝐷′ of adjacent datasets, and for all outcome events 𝐸, it parameters 𝑤∘ and 𝑤c , but does not depend on 𝑤∙ , by holds that Pr[ℳ(𝐷) ∈ 𝐸] ≤ 𝑒𝜀 · Pr[ℳ(𝐷′ ) ∈ 𝐸] + 𝛿. eliminating the dependence on 𝑥∙ , defined as follows: For an extensive overview of DP, we refer the reader to the 𝐹𝑤∘ ,𝑤c (𝑥∘ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ), 0) , monograph of Dwork and Roth [22]. We use the following key properties of DP. where 0 ∈ R𝑑∙ . For convenience, we use the following notation for the losses of each of these models: Proposition 2 (Composition). If ℳ1 satisfies (𝜀1 , 𝛿1 )- DP, and ℳ2 satisfies (𝜀2 , 𝛿2 )-DP, then the mechanism 𝐿(𝑤; 𝑥, 𝑦) := ℓ(𝐹𝑤 (𝑥), 𝑦), ℳ that on dataset 𝐷 returns (ℳ1 (𝐷), ℳ2 (𝐷)) satisfies 𝐿(𝑤∘ , 𝑤c ; 𝑥, 𝑦) := ℓ(𝐹𝑤∘ ,𝑤c (𝑥∘ ), 𝑦). (𝜀1 + 𝜀2 , 𝛿1 + 𝛿2 )-DP. Furthermore, this holds even in the adaptive case, when ℳ2 can use the output of ℳ1 . Given a total privacy budget of (𝜀, 𝛿), we consider learning Proposition 3 (Post-Processing). If ℳ satisfies (𝜀, 𝛿)- algorithms that execute two phases sequentially that satisfy DP, then for all (randomized) algorithms 𝒜, it holds that (𝜀1 , 0)-DP and (𝜀2 , 𝛿)-DP respectively such that 𝜀1 +𝜀2 = 𝜀 𝒜(ℳ(·)) satisfies (𝜀, 𝛿)-DP. and hence by Proposition 2, the algorithm satisfies (𝜀, 𝛿)-DP. 2 We refer to this algorithm as Hybrid, and these phases are as Contrast this with the notion of DP with public features of [21], in which 𝑥∘𝑖 is allowed to change, as long as it takes values in the publicly known follows: 𝒳 ∘. Label-DP Phase. In this phase, we first apply RR𝜀1 to Factorization Machine A factorization machine generate ((𝑥∘𝑖 , 𝑦ˆ𝑖 ))𝑖∈[𝑛] , i.e., a dataset where the sensitive (FM) [27] embeds each feature into a 𝑑 = 𝑑∘ = 𝑑∙ 𝑥∙𝑖 ’s are removed and the labels are randomized. Then, we dimensional embedding and builds all pairwise dot products train the truncated model 𝐹𝑤∘ ,𝑤c (·) on this data for one between all features. We shortly summarize how FM can or more epochs of mini-batch SGD. By Proposition 5 and be cast into our notation of 𝐹𝑤 . The parameters of the Proposition 3, this phase satisfies (𝜀1 , 0)-DP. FM model consist of (i) embeddings ∘ for the sensitive ∙ and To remove the bias introduced by the noisy labels, we define nonsensitive features 𝑤∘ ∈ R𝒳 ×𝑑 and 𝑤∙ ∈ R𝒳 ×𝑑 , and 𝑝 := 1/(1 + 𝑒−𝜀1 ) and modify the training loss as follows: (ii) a bias 𝑤c ∈ R. The combination function 𝑓𝑤c consists of a sum of three different terms: the global bias 𝑤c , linear ˜ (𝑤∘ , 𝑤c ; 𝑥∘𝑖 , 𝑦ˆ ) = 𝐿 effects that are encoded in the first dimension of 𝑔 and ℎ, 𝑖 and pairwise interactions of the remaining dimensions: 𝐿(𝑤∘ , 𝑤c ; 𝑥∘𝑖 , 1 − 𝑦ˆ𝑖 ) − 𝑝 ∘ , 𝑤c ; 𝑥∘𝑖 , 𝑦 ′ ) ∑︀ 𝑦 ′ ∈{0,1} 𝐿(𝑤 1 − 2𝑝 𝑓𝑤c (𝑔, ℎ) = 𝑤1c + 𝑔1 + ℎ1 + ⟨𝑔2...𝑑 , ℎ2...𝑑 ⟩ . Unlike an MLP, FM does not have parameters (besides a DP-SGD Phase. In this phase, we train the entire model bias) in the combiner function and does not need to learn 𝐹𝑤 (·), by warm-starting it from the 𝐹𝑤∘ ,𝑤c model of the how to combine embeddings. The towers are computed by: first phase, then training for one or more epochs of DP-SGD. We propose two variants: in the first, we freeze the sensitive 𝑔𝑤∘ (𝑥∘ )1 = ⟨𝑥∘ , 𝑤·,1 ∘ ⟩ tower 𝑔𝑤∘ , and in the second, we fine-tune it. The noise pa- + ∑︁ ∑︁ ∘ ∘ ⟨︀ ∘ ∘ 𝑥𝑗 𝑥𝑘 𝑤𝑗,2...𝑑 , 𝑤𝑘,2...𝑑 ⟩︀ . rameter 𝜎 is chosen appropriately so that this phase satisfies 𝑗 𝑘>𝑗 (𝜀2 , 𝛿)-DP; in our work, we do this accounting using Rényi ∑︁ ∘ DP [13, 24], though other accounting techniques could be 𝑔𝑤∘ (𝑥 )2...𝑑 = 𝑥∘𝑗 𝑤𝑗,2...𝑑 ∘ . used, such as privacy loss distributions (PLD) [25, 26]. 𝑗 The sensitive tower is computed analogously. See Appendix A for further details about the experimental 5. Experimental Results setup. We consider two natural baselines: DP-SGD (where all fea- tures are treated as sensitive) and RR on the truncated model 5.2. Criteo Display Ads pCTR Dataset 𝐹𝑤∘ ,𝑤c (where the sensitive features are discarded and only The first benchmark we consider is a pCTR prediction task the labels are protected). Note that both can be viewed as on the Criteo Display Ads Dataset [28], which contains special cases of Hybrid, where we use all the privacy budget around 40 million examples. The dataset has a labeled train- in one of the two phases: DP-SGD corresponds to setting ing set and an unlabeled test set. We only use the labeled 𝜀1 = 0 and 𝜀2 = 𝜀; and RR corresponds to setting 𝜀1 = 𝜀 training set and split it chronologically into a 80%/10%/10% and 𝜀2 = 0. partition of train/validation/test sets. Each example consists The Hybrid algorithm allows using a different split be- of 13 integer features int-feature-[1-13] and 26 cat- tween the two phases. A total privacy budget (𝜀, 𝛿) will be egorical features categorical-feature-[14-39]. split into (𝜀1 , 0) and (𝜀2 , 𝛿). Since this budget allocation Since the precise interpretation of these features is not avail- may have an impact on model quality, we will vary it in our able, we arbitrarily consider all even-numbered features as experiments as follows: sensitive and all odd-numbered features as nonsensitive. 𝜀1 := 𝑘 · 𝜀 , 𝜀2 := (1 − 𝑘) · 𝜀 , For this dataset, the AUC loss of the non-privately trained baselines is 0.1941 for the MLP model and 0.1930 for the where 𝑘 ∈ {0, 0.25, 0.5, 0.75, 1}, and the cases 𝑘 = 0, FM model. 𝑘 = 1 correspond to DP-SGD and RR, respectively. We train binary classification models with binary cross- 5.3. Criteo Spons. Search Conversion entropy loss and report it together with the AUC loss (defined Log Dataset as 1 − AUC). We study the trade-offs between privacy and utility, as well as model size and utility. The second benchmark we consider is a pCVR predic- tion task on the Criteo Spons. Search Conversion Log Dataset [29], which contains 16 millions examples. We 5.1. Models used a random 80%/20% partition of train/test sets and the We evaluate two model classes for 𝐹𝑤 : multilayer percep- reported metrics are on the test set. The task considered in trons (MLP) and factorization machines (FM). this work is a conversion prediction task, predicting the bi- nary feature Sale (which has 10.8% positive occurrences). Multilayer perceptron In the MLP models, we concate- The sensitive features are device_type, audience_id, nate the outputs of the sensitive and nonsensitive towers and user_id. We consider all other features to be nonsen- before feeding them into joint fully connected layers: sitive, except for features denoted Outcome/Labels in [29], and product_price, all of which are omitted from the 𝐹𝑤 (𝑥∘ , 𝑥∙ ) := 𝑓𝑤c (𝑔𝑤∘ (𝑥∘ ) ∘ ℎ𝑤∙ (𝑥∙ )) , model3 . For this dataset, the AUC loss of the non-privately trained where 𝑔𝑤∘ : 𝒳 ∘ → R𝑑∘ , ℎ𝑤∙ : 𝒳 ∙ → R𝑑∙ , 𝑓𝑤c : baselines is 0.2099 for the MLP model, and 0.2154 for the R𝑑∘ +𝑑∙ → R and 𝑢 ∘ 𝑣 denotes concatenation of the vectors FM model. 𝑢 and 𝑣. 3 Although product_price is not explicitly marked as a label, it has a very high correlation with the label and the prediction task would become significantly easier if we were to include it. 0.220 0.480 0.220 0.480 Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (fine-tuned) 0.475 Hybrid (fine-tuned) Hybrid (fine-tuned) 0.475 Hybrid (fine-tuned) 0.215 DP-SGD DP-SGD 0.215 DP-SGD DP-SGD RR 0.470 RR RR 0.470 RR 0.210 0.465 0.210 0.465 log loss 1 - AUC log loss 1 - AUC 0.205 0.460 0.205 0.460 0.455 0.455 0.200 0.200 0.450 0.450 0.195 0.445 0.195 0.445 1 2 4 8 12 1 2 4 8 12 1 2 4 8 12 1 2 4 8 12 (i) MLP model (ii) FM model Figure 1: AUC loss and log loss of (i) MLP model and (ii) FM model trained under various privacy budgets 𝜀 on the Criteo Display Ads pCTR dataset. 0.280 0.312 0.280 0.312 Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (frozen) Hybrid (fine-tuned) 0.310 Hybrid (fine-tuned) 0.275 Hybrid (fine-tuned) 0.310 Hybrid (fine-tuned) 0.275 DP-SGD DP-SGD 0.270 DP-SGD 0.308 DP-SGD 0.270 RR 0.308 RR RR RR 0.265 0.306 0.306 0.304 0.265 0.260 log loss log loss 1 - AUC 1 - AUC 0.230 0.235 0.296 0.294 0.230 0.294 0.225 0.292 0.225 0.292 0.220 0.290 0.220 0.290 0.215 0.288 0.215 0.288 0 2 4 6 8 10 12 0 2 4 6 8 10 12 0 2 4 6 8 10 12 0 2 4 6 8 10 12 (i) MLP model (ii) FM model Figure 2: AUC loss and log loss of (i) MLP model and (ii) FM model trained under various privacy budgets 𝜀 on the Criteo Sponsored Search Conversion Log dataset. 0.208 0.232 =1 =1 5.4. Results 0.206 =2 =4 0.230 =2 =4 =8 0.228 =8 0.204 = 12 = 12 0.226 5.4.1. Improved privacy-utility trade-off 1 - AUC 1 - AUC 0.202 0.224 0.200 0.222 Privacy-utility trade-offs on Criteo Display Ads and Criteo 0.198 0.220 0.218 Spons. Search are reported in Figures 1 and 2 respectively. 0.196 0.216 0.00 0.25 0.50 0.75 0.00 0.25 0.50 0.75 On both benchmarks, we find that Hybrid improves over RR k= 1 k= 1 and DP-SGD across a range of privacy budgets. Specifically, (i) Criteo Display Ads (ii) Criteo Spons. Search we see an improvement in utility for both the MLP and FM models when 𝜀 ≥ 4. In this regime, there are substantial Figure 3: Effect of the budget split 𝑘 = 𝜀1 /𝜀 on AUC loss improvements: for instance, Hybrid achieves a better utility for the FM model, with 𝜀 = 12, on (i) Criteo Display Ads at 𝜀 = 8 than DP-SGD at 𝜀 = 12 (this is the case for both pCTR dataset and (ii) Criteo Spons. Search Conversion Log dataset. datasets and both models). This significantly narrows the gap between the private model and the non-private baselines on Criteo Display Ads. For example, at 𝜀 = 12, the relative increase in AUC loss Ads in the high 𝜀 regime, see Figure 1), freezing can achieve 1−AUC comparable quality to fine-tuning. In all other cases, fine- (defined as 1−AUC non-private − 1) goes from 6.3% for MLP- DPSGD to 3.2% for MLP-Hybrid; and it goes from 3.0% for tuning generally achieves better utility. In particular, for FM-DPSGD to 1.2% for FM-Hybrid. In both cases, the gap the Criteo Spons. Search dataset (see Figure 2), freezing to the non-private model is approximately halved. leads to a significant degradation across all values of 𝜀. This However, in the higher privacy regime (for 𝜀 = 1), the indicates that freezing, while computationally advantageous, quality of the Hybrid-trained models appears to deteriorate, may come at a high utility cost in practice. and in most cases it no longer improves upon DP-SGD. We believe this may be because the utility of the RR algorithm 5.4.3. Effect of budget split significantly deteriorates for small 𝜀, and there may no longer To further understand the effect of the budget split, we report, be a benefit to the Label-DP phase in this regime. in Figure 3, the AUC loss of the Hybrid FM models, as It is also worth observing that the loss of the RR model we vary the budget allocation ratio 𝑘 = 𝜀𝜀1 . First, observe plateaus at a value that is much higher than other methods – that for 𝜀 = 1, the best utility is achieved when 𝑘 = 0 recall that the RR model is only trained on the non-sensitive (which corresponds to the special case of DP-SGD); this is features, hence its quality is limited by the best model one consistent with the results of Section 5.4.1. As 𝜀 increases can train on these features alone. (4 ≤ 𝜀 ≤ 8), we observe that the optimal 𝑘 increases, and the best utility is typically achieved when 𝑘 ≥ 0.5, i.e. one 5.4.2. Freezing vs fine-tuning benefits from spending a significant part of the budget on Freezing the sensitive tower during the second phase may the RR phase. Finally, in the high 𝜀 regime (𝜀 = 12), the offer a computational advantage, as one no longer needs to optimal 𝑘 decreases again, and is equal to 𝑘 = 0.25 in both compute/clip gradients of this tower. datasets. This may be explained by the fact that the utility of To understand the impact this may have on quality, we the RR-trained model plateaus when 𝜀 grows (see Figure 1- compare the two Hybrid variants (frozen and fine-tuned). We (ii) and Figure 2-(ii)), so one may not benefit from spending observe that in some settings (specifically on Criteo Display a higher budget on the RR phase. Given the large impact the budget ratio 𝑘 has on quality, one should generally treat it as an important parameter to References tune when using the Hybrid method, and it should be tuned separately for different values of 𝜀. [1] J. Wilander, Full Third-Party Cookie Blocking and More, 2020. https://webkit.org/blog/10218/full-third-p 0.4485 0.1960 arty-cookie-blocking-and-more/. 0.4483 0.1958 0.4480 [2] M. Wood, Today’s Firefox Blocks Third-Party Track- 0.4477 ing Cookies and Cryptomining by Default, 2019. https: log loss 1 - AUC 0.1956 0.4475 0.4473 //blog.mozilla.org/en/products/firefox/todays-firefox 0.1954 Hybrid (frozen), = 12 Hybrid (frozen), = 12 -blocks-third-party-tracking-cookies-and-cryptomin Hybrid (fine-tuned), = 12 0.4470 Hybrid (fine-tuned), = 12 0.1952 Hybrid (frozen), = 8 Hybrid (frozen), = 8 0.4467 ing-by-default/. Hybrid (fine-tuned), = 8 Hybrid (fine-tuned), = 8 0.1950 0.4465 105 106 105 106 [3] J. Schuh, Building a more private web: A path towards Sensitive vocabulary size Sensitive vocabulary size making third party cookies obsolete, 2020. https://blog Figure 4: AUC loss and log loss of FM model trained under .chromium.org/2020/01/building-more-private-web various private model sizes at 𝜀 = 12 on the Criteo Display -path-towards.html. Ads pCTR dataset. The 𝑥-axis denotes the vocabulary size [4] M. Thomson, Privacy Preserving Attribution for Ad- of the sensitive tower. vertising, 2022. https://blog.mozilla.org/en/mozilla/pr ivacy-preserving-attribution-for-advertising/. [5] J. J. Pfeiffer III, D. Charles, D. Gilton, Y. H. 5.4.4. Model-size utility trade-off Jung, M. Parsana, E. Anderson, Masked lark: Masked learning, aggregation and reporting workflow, In situations in which the DP-SGD phase of training happens arXiv:2110.14794 (2021). in Trusted Executions Environments, one may be faced with [6] Microsoft, MaskedLARk, 2021. https://github.com/m stringent memory and compute constraints. In such scenarios, icrosoft/maskedlark. it is important to understand the trade-offs between utility [7] M. Nalpas, A. White, Attribution Reporting, 2021. ht and the size of the private model. tps://developer.chrome.com/en/docs/privacy-sandbox We vary the private model size on the Criteo Display Ads /attribution-reporting/. pCTR dataset, by varying the vocabulary size of the sensitive [8] Android, Attribution reporting, 2023. https://developer. tower (this is done by computing privatized counts of the android.com/design-for-safety/privacy-sandbox/attri sensitive feature values, and keeping only features above a bution. threshold. Varying the threshold leads to different model [9] J. Wilander, Introducing Private Click Measurement, sizes). We report the results in Figure 4, for 𝜀 = 12. Here PCM, 2021. https://webkit.org/blog/11529/introducin the largest model size corresponds to the results reported in g-private-click-measurement-pcm/. Figure 1. [10] L. Winstrom, A proposal for privacy preserving ad We observe that for a large range of model sizes, the deteri- attribution measurement using prio-like architecture, oration in quality is surprisingly low. For example, focusing 2023. https://github.com/patcg/proposals/issues/17. on the fine-tuned variant, when decreasing the model size [11] C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, ten-fold, the log loss of the FM model increases by 0.027%, M. Naor, Our data, ourselves: Privacy via distributed and its AUC loss increases by 0.025%. When decreasing noise generation, in: EUROCRYPT, 2006, pp. 486– the model size fifty-fold, the log loss increases by 0.059% 503. and the AUC loss by 0.078%. The loss remains well below [12] C. Dwork, F. McSherry, K. Nissim, A. D. Smith, Cali- that of the full-sized model at 𝜀 = 8 (denoted by the dashed brating noise to sensitivity in private data analysis, in: lines on the figure). This indicates that for these two bench- TCC, 2006, pp. 265–284. marks, one may train significantly smaller models under DP [13] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, constraints without largely sacrificing quality. I. Mironov, K. Talwar, L. Zhang, Deep learning with differential privacy, in: CCS, 2016, pp. 308–318. 6. Conclusion and Future [14] K. Chaudhuri, D. Hsu, Sample complexity bounds for differentially private learning, in: COLT, 2011, pp. Directions 155–186. [15] B. Ghazi, N. Golowich, R. Kumar, P. Manurangsi, In this work, we studied training DP models with semi- C. Zhang, Deep learning with label differential pri- sensitive features, and presented an algorithm that improves vacy, in: NeurIPS, 2021, pp. 27131–27145. over two natural baselines on real ad modeling datasets. [16] M. Malek Esmaeili, I. Mironov, K. Prasad, I. Shilov, Our experiments indicate that in the high privacy regime, F. Tramer, Antipodes of label differential privacy: it is difficult to improve upon DPSGD. This invites further in- PATE and ALIBI, in: NeurIPS, volume 34, 2021, vestigation into this regime, either theoretically (by studying pp. 6934–6945. utility bounds), or experimentally. An interesting direction [17] S. Dutton, K. K. Lee, Protected Audience API: On- to explore is the use of label DP primitives beyond RR, e.g., device ad auctions to serve remarketing and custom au- [15, 16], particularly ones that perform better for smaller 𝜀. diences, without cross-site third-party tracking., 2022. Another open question is the precise characterization of https://developer.chrome.com/docs/privacy-sandbox the differences (both in terms of privacy guarantees and /protected-audience. potential utility gap) between the notion of “DP with semi- [18] Android, Protected Audience API sensitive features” studied in this work, and “DP with public on Android developer guide., 2023. features” from [19]. Https://developer.android.com/design-for- safety/privacy-sandbox/guides/protected-audience. [19] W. Krichene, N. E Mayoraz, S. Rendle, S. Song, A. Thakurta, L. Zhang, Private learning with public report the results in Figure 5. We find that the two approaches features, in: AISTATS, 2024, pp. 4150–4158. yield similar quality at the same model size (with a slight [20] Z. Shen, A. Krishnaswamy, J. Kulkarni, K. Muna- advantage to the vocab thresholding approach). gala, Classification with partially private features, 0.210 0.460 arXiv:2312.07583 (2023). 0.208 Vocab thresholding Hashing 0.458 Vocab thresholding Hashing [21] W. Krichene, N. Mayoraz, S. Rendle, S. Song, 0.206 0.456 A. Thakurta, L. Zhang, Private learning with public 0.204 0.454 log loss 1 - AUC 0.202 0.452 features, arXiv:2310.15454 (2023). 0.200 0.450 [22] C. Dwork, A. Roth, The algorithmic foundations of 0.198 0.448 differential privacy, Foundations and Trends® in Theo- 0.196 0.446 2 4 6 8 10 12 2 4 6 8 10 12 retical Computer Science 9 (2014) 211–407. [23] S. L. Warner, Randomized response: a survey tech- nique for eliminating evasive answer bias., JASA 60 Figure 5: Privacy-utility trade-off of the fine-tuned Hybrid FM model on Criteo Display Ads, under hashing vs vocab 309 (1965) 63–69. thresholding. [24] I. Mironov, Rényi differential privacy, in: CSF, 2017, pp. 263–275. [25] S. Meiser, E. Mohammadi, Tight on budget? Tight When using thresholding in Criteo Display Ads, we used bounds for 𝑟-fold approximate differential privacy, in: a vocab threshold of 16 for non-sensitive features, and a CCS, 2018, pp. 247–264. threshold in {16, 64, 256, 1024, 4096} for sensitive features [26] D. M. Sommer, S. Meiser, E. Mohammadi, Privacy (this controls the sensitive tower size). On the Criteo Spon- loss classes: The central limit theorem in differential sored Search Conversion Log dataset, we opt for the simpler privacy, Proc. Priv. Enhancing Technol. 2019 (2019) hashing approach, with 50k (resp. 100k) hash bins for the 245–269. URL: https://doi.org/10.2478/popets-2019-0 sensitive (resp. non-sensitive) features. 029. doi:10.2478/POPETS-2019-0029. All features in both datasets being univalent, each example [27] S. Rendle, Factorization machines, in: ICDM, 2010, is transformed into a fixed number of embeddings, 19 sensi- pp. 995–1000. tive and 20 nonsensitive embeddings for the Criteo Display [28] O. C. Jean-Baptiste Tien, joycenv, Display advertising Ads pCTR dataset, and 3 sensitive and 17 nonsensitive4 em- challenge, 2014. URL: https://kaggle.com/competition beddings for the Criteo Sponsored Search Conversion Log s/criteo-display-ad-challenge. dataset. [29] M. Tallis, P. Yadav, Reacting to variations in product demand: An application for conversion rate (cr) predic- Multilayer Perceptron For the Criteo Display Ads tion in sponsored search, arXiv:1806.08211 (2018). pCTR dataset, the 20 nonsensitive features are concatenated [30] M. Zaheer, S. Reddi, D. Sachan, S. Kale, S. Kumar, and fed into a single fully connected layer with 598 hidden Adaptive methods for nonconvex optimization, in: units and using a ReLU activation function. The output of NIPS, 2018. this layer is concatenated with the 19 embeddings of the [31] I. Loshchilov, F. Hutter, SGDR: stochastic gradient sensitive features, and these are fed into two fully connected descent with warm restarts, in: ICLR, 2017. layers, each also containing 598 hidden units and using a ReLU activation function. The final output is a linear com- bination of the last layer which produces a scalar logit pre- A. Training Details diction. We use the Yogi optimizer [30] with a base learning rate of 0.01 and a batch size of 1024 for our baseline and In both Criteo datasets used in this work, the sensitive fea- for the RR phase of training. We use SGD with a base learn- tures (resp. nonsensitive features) are fed into a single em- ing rate of 0.1, momentum 0.9, and batch size of 16384 for bedding layer: each value of a sensitive (resp. nonsensitive) the DP-SGD phase of training. For both, we scale the base feature is concatenated to its feature name to form a unique learning rate with a cosine decay [31]. We train with 10 string. These string values are then either hashed with a RR epochs and 50 or 100 DP-SGD epochs, and we tune the fixed number of hash bins, or a vocabulary of all sensitive norm bound 𝐶 ∈ [10, 50]. (nonsensitive) strings is created, where only frequent values For the Criteo Sponsored Search Conversion Log dataset are kept while the remaining values are mapped to a single dataset, the 17 nonsensitive features are concatenated and fed out-of-vocabulary token. In all our experiments reported into a single fully connected layer with 256 hidden units and here we use an embedding dimension of 32. The model size using a ReLU activation function. The output of this layer is is therefore controlled either by the number of hash bins concatenated with the 3 embeddings of the sensitive features, for the sensitive and nonsensitive features, or by frequency and these are fed into two fully connected layers, each also thresholds defining the the sensitive and nonsensitive vocab- containing 256 hidden units and using a ReLU activation ularies. In the latter case, we compute the frequency counts function. The final output is a linear combination of the last of the nonsensitive feature values exactly, while the counts layer which produces a scalar logit prediction. We use the of the sensitive features are computed privately, consuming Adam optimizer with batch size of 1024 for the RR phase of a portion of the total privacy budget. We report the privacy training, and a batch size of 16384 for the DP-SGD phase parameters assuming that the vocabulary is known and only of training. We train with 16 RR epochs and 64 DP-SGD the counts are private; without this assumption the privacy epochs, and we tune the clipping norm 𝐶 ∈ [10, 30]. 𝜀 increases by at most 0.007 compared to the reported num- bers. 4 We compare these two strategies (hashing vs vocabulary click_timestamp is replaced by two features: thresholding) on the Criteo Display Ads pCTR dataset, and click_hour_of_day and click_day_of_week, and nbr_clicks_1week is replaced by its log2 transformed value. Factorization Machine A linear model composed of a bias term and 20+19 (resp. 17+3) linear coefficients comple- ments the above mentioned embeddings for the Criteo Dis- play Ads pCTR dataset (resp. the Criteo Sponsored Search Conversion Log dataset). The scalar logit prediction is the sum of this linear model and all the pairwise dot-products of the 39 (resp. 20) embeddings. We use the Adam optimizer with a batch size of 16384 for all our experiments. In an initial hyper-parameter search we also tuned the standard de- viation of the random initialization 𝜎 of all model parameters, as well as the regularization 𝜇 of the embeddings and we settled on 𝜎 = 10−2 and 𝜇 ∈ {10−2 , 10−3 , 10−4 , 10−5 } for all experiments. In practice, the regularization parameter had little impact. The most important parameters to tune are the learning rate (tuned in the range [10−5 , 10−3 ]) and the clipping norm (tuned in the range [10, 30]. Note that we did not distinguish the dataset used for hyper-parameter tuning from the one used to report the final metrics as our ex- periments on the Criteo Display Ads pCTR dataset showed virtually no difference between metrics measured on either sets. Finally, we note that the optimal hyper-parameters tend to differ when optimizing for AUC loss vs log loss. In particular, we found that good models in terms of log loss tend to require much larger clipping norms than models optimizing AUC.