# On the Privacy-Utility Trade-Off in Differentially Private Hierarchical Text Classification
## 3 Related Work  
This work is related to HTC, DP in NLP and MI attacks for evaluating the privacy of DP ML models. Therefore, in this section, we briefly introduce the most relevant publications in the respective research fields. Figure 1: White-box MI with attack features. DP perturbation is applied on the target model training (dashed). The data that were used by the data owner during target-model training is colored: training (violet) and validation (green). [PERSON] et al. [27] analyze the performance of different hierarchical text classifiers on the Reuters (RCV1) dataset that we also use for the experiments in our work. The authors find that a fastText-based classifier works better than a CNN-based classifier initialized with the same embeddings. For evaluation, all possible types of metrics are used in the paper, namely flat, hierarchical, and LCA metrics. Interestingly, the authors do not consider any Transformer-based HTC model, even though Transformer architectures represent state-of-the-art for text classification. [PERSON] et al. [12] formulate an implementation of the DP stochastic gradient descent, which uses the Gaussian mechanism to perturb gradient descent optimizers for ANNs. As ANNs are widely used in modern NLP and natural language data in many cases contain sensitive data, there are various publications regarding DP in NLP. While [PERSON] et al. [28] learn DP word embeddings for user-generated content, so that the resulting word embeddings can be shared safely, we focus on the safe sharing of whole ML models. Other works use DP for authorfuscation in text classification [29; 30]. In contrast, our work addresses the privacy-utility trade-off for perturbation of the gradient descent optimizer. [PERSON] et al. [10] successfully apply DP to prevent information leakage in a generative model, specifically an ANN generating text. They introduce the _exposure_ metric to measure the risk of unintentionally memorizing rare or unique training-data sequences in generative models. Our work does not consider generative models, but solely classification models. Empirical MI attacks against machine learning models such as the attack used in this work were first formulated by [PERSON] et al. [7] in the form of black-box MI. The authors compare MI attacks with model inversion attacks, which abuse access to an ML model to infer certain features of the training data. In contrast to model inversion attacks, MI attacks target a specific training example instead of targeting all training examples for a specific class. Therefore, the authors argue that successful MI attacks indicate unintended information leakage. [PERSON] [31] uses black-box MI attacks to assess the information leakage of generative models. [PERSON] et al. [8] showed that white-box MI attacks, that take the target model's internal parameters into account, are more effective than black-box MI attacks. Additionally, the authors assume that the adversary owns a fraction of the data owner's sensitive data. This stronger assumption about the adversary's knowledge increases the overall strength of the MI attack compared with black-box MI attacks. While [PERSON] et al. [15] analyze the effect of different values for \(\epsilon\) on the effectiveness of only black-box MI attacks, [PERSON] et al. [17] take both black-box and white-box attacks into account. However, both publications mostly consider specifically crafted non-textual MI datasets. We consider real-world textual training data. [PERSON] et al. [32] introduce a membership advantage to measure the success of an MI attack. Furthermore, they formulate a theoretical upper bound for the membership advantage that depends on the DP guarantees of the target model. [PERSON] et al. [33] derive a bound for membership advantage that is tighter than the bound derived by [PERSON] et al. by analyzing the impact of giving up the i.i.d. assumption.