Paper: Learning from Aggregate responses: Instance Level versus Bag Level Loss Functions (ICLR-2024)

Reviewer comment (Experiments):
Most analyses are restricted to linear models. Thus, the range of applications may be limited. Even for tabular data, gradient boosting machines may perform better than linear models. There's a gap between theory and practice: for the Boston housing dataset, the author used an MLP instead.

Author response:
While it's true that our theoretical analyses primarily focus on linear models, by providing a precise theory for this case we develop non-trivial insights,  which as we see in the experiment carry over to more complex nonlinear setups. 

In particular, we acknowledge that real-world data often exhibits complex patterns that may be better captured by non-linear models such as gradient boosting machines or multi-layer perceptrons (MLPs). To bridge the gap between theory and practice, we conducted experiments on the Boston housing dataset using an MLP, deviating from the linear models typically analyzed in the theoretical context.

Interestingly, our experimental results with the MLP align with the predictions of our theoretical framework. Specifically, our theory suggests that the choice between bag-level and instance-level loss depends on the signal-to-noise ratio (SNR), and our experiment on the Boston housing dataset validates this insight. When the SNR is high (indicating smaller bags with higher SNR), bag-level loss outperforms; conversely, when the SNR is low, instance-level loss is more effective. In the intermediate phase, our results reveal a sweet spot, confirming the practical relevance of our theoretical findings.

Reviewer comment (Experiments):
Why non-overlapping?

Author response:
The significance of employing non-overlapping bags is beyond considerations for our analysis; it is also crucial for maintaining privacy protection. Allowing overlapping bags, where a data example can be included in multiple bags, introduces the risk of inferring individual labels. To illustrate this potential privacy breach, consider an extreme scenario where there are more bags than the number of data examples. In such cases, an adversary could exploit the overlap to infer individual labels by solving a linear equation. Therefore, the choice of non-overlapping bags is not only for our analytical considerations but is also a deliberate measure to safeguard against potential privacy vulnerabilities. We appreciate your attention to this aspect of our methodology.

Reviewer comment (Theory):
"The bag-level loss does not have a unique minimizer": is this proven?

Author response:
To illustrate this point, let's consider a simple example. Suppose we have a bag consisting of two examples and the aggregate response for this bag is 0.5. In this case, we can select any one of the two examples and predict its response y, and the other as 1-y. As a result, the bag-level loss on this bag becomes zero, achieving the minimum. Therefore, it does not admit a unique minimizer. 
We hope this example clarifies the observation that the bag-level loss does not admit a unique minimizer in general.

Reviewer comment (Theory):
Why should we reduce the variance? It seems that the regularization could lead to an over-smoothed solution.

Author response:
The rationale behind reducing variance is rooted in the classical bias-variance decomposition, a standard concept in statistics. According to this decomposition, the total risk of a model can be expressed as the sum of two components: bias and variance. By reducing variance, one can get more stability during test time and avoid overfitting. 

Of course if the regularization is unreasonably strong then it will increase the bias and so results in higher error for the model. That’s why we aim to tune the regularization parameter $\rho$ (see equation 4).

Reviewer comment (Theory):
The motivation behind the definition of instance-level and bag-level losses is not clear.

Author response:
Indeed having a clear understanding of these concepts is essential for comprehending our work. Note that in our setup, the learner has access to individual features vectors $x_i$, while is only given access to the aggregate responses. The instance-level and bag-level losses are two approaches often used in this area to assess the loss of a model. In the instance-level you treat the average response in a bag as a proxy for the *ungiven* individual responses in that bag and measure the loss between your model predictions $f(x_i)$ and the average response. Therefore, for each instance $x_i$ you still have a term in the loss function. In the bag-level loss, for each bag you measure how well your *average predictions* align with the given *average responses*. So for each bag you get a term in the loss function, but not for each instance.   
We hope that this explanation has been helpful. Please let us know if you have any further questions.

Reviewer comment (Experiments):
The authors do not compare their results with the prior results on label DP.

Author response:
To clarify, we do compare our results with the label DP procedure. Note that the pure label DP procedure corresponds to the choice of $k=1$, which results in clusters of size one and essentially no aggregation. In particular, in Figure 2, we discuss that if $\rho$ is small (recall that $\rho=0$ corresponds to the bag-level loss), then $k=1$ is optimal, which means that pure label DP yields better model risk under a fixed privacy budget than aggregation + DP. On the other hand, for large values of $\rho$ (recall that $\rho=1$ corresponds to the instance-level loss), larger $k$ is better, so adding noise to the aggregated responses is better than just label DP. Hence, in summary, in our experiments, we compare with pure label DP ($k=1$) and also different choices of $\rho$ (which cover both the bag-level and instance-level loss as well as any combination of them).

Reviewer comment (Experiments):
In this paper the authors use bag-level loss and then consider the noisy labels; it is unclear if that is the best approach.

Author response:
To clarify, we do compare our results with the label DP procedure. Note that the pure label DP procedure corresponds to the choice of $k=1$, which results in clusters of size one and essentially no aggregation. In particular, in Figure 2, we discuss that if $\rho$ is small (recall that $\rho=0$ corresponds to the bag-level loss), then $k=1$ is optimal, which means that pure label DP yields better model risk under a fixed privacy budget than aggregation + DP. On the other hand, for large values of $\rho$ (recall that $\rho=1$ corresponds to the instance-level loss), larger $k$ is better, so adding noise to the aggregated responses is better than just label DP. Hence, in summary, in our experiments, we compare with pure label DP ($k=1$) and also different choices of $\rho$ (which cover both the bag-level and instance-level loss as well as any combination of them).

Reviewer comment (Experiments):
What are the use-cases of instance-level loss and bag-level loss? Instance-level seems more intuitive, and clarification is needed about the scenarios in which it is preferable to use bag-level loss.

Author response:
Note that bag-level and instance-level are approaches for training models using aggregated responses and once the bag configurations are given to the learner, she can try either loss to train her model. In our response to the weaknesses (above), we provided further intuition about the definition of these losses. The high-level intuition we establish in this paper (through rigorous quantitative statements) is that using bag-level loss results in models with lower bias but higher variance compared to models that are trained by minimizing the instance-level loss. So in cases where there is a lot of heterogeneity in the responses, instance-level would work better. In contrast, for use cases with more homogenous responses, the bag-level would be better because lowering the bias becomes more effective (the variance is low). For the case of linear regression, we explicitly characterize regimes where one approach is better than the other (see Lemma 3.2). In Figure 3, we also plot the risk (derived from our precise theoretical characterization). Note that the leftmost point ($\rho=0$) corresponds to the bag-level loss and the rightmost point ($\rho =1$) corresponds to the instance-level loss. As we see depending on the values of signal-to-noise ratio (SNR), cluster size (k) and overparameterization ($\psi$), one approach can outweigh the other.

Reviewer comment (Theory):
What is the significance of non-overlapping bags? Is it because of the analysis?

Author response:
The significance of employing non-overlapping bags is beyond considerations for our analysis; it is also crucial for maintaining privacy protection. Allowing overlapping bags, where a data example can be included in multiple bags, introduces the risk of inferring individual labels. To illustrate this potential privacy breach, consider an extreme scenario where there are more bags than the number of data examples. In such cases, an adversary could exploit the overlap to infer individual labels by solving a linear equation. Therefore, the choice of non-overlapping bags is not only for our analytical considerations but is also a deliberate measure to safeguard against potential privacy vulnerabilities. We appreciate your attention to this aspect of our methodology.

Reviewer comment (Experiments):
For DP variants, the authors propose first forming the bag-level loss and then applying the Laplace mechanism to the aggregated labels; is that the best approach? What is the comparison of this method with the prior work on label-DP?

Author response:
(Please see our response to the weaknesses above): As discussed, the case of $k=1$ (clusters of size 1) corresponds to no aggregation and just pure label DP. As we show theoretically and also in Figure 4, there is a phase transition on the tuning parameter $rho$, below which $k=1$ is optimal (i.e., do not aggregation and ensure label DP by adding noise directly to individual response), and above this threshold largest allowable bag size is the best (i.e., first aggregate and then add noise to aggregated responses to ensure label DP). As we explain in the paper, the intuition is that while larger bag size results in higher model risk, they also lower the sensitivity of aggregated responses to each individual response and hence smaller noise is needed to ensure privacy. Depending on which way this trade-off goes it may be better to aggregate+DP instead of direct label DP.

Reviewer comment (Theory):
Randomness in placing the samples in bags may help in privacy amplification.

Author response:
What matters in the analysis is that the bags are constructed independently of data. Note that under the setup discussed in the paper, the bag configurations are shared with the learner (so she knows which samples belong to which bag and forms the bag-level or instance-level loss that requires this information). Now if the bag configuration were dependent on the responses, that would already be a leak on privacy. In addition, such dependence would have introduced more bias to the model learning process.

Reviewer comment (Writing):
This is a minor comment on terminology: regularizers in the ML context, to the best of this reviewer's knowledge, only depend on model parameters and not on the data (which includes the feature vectors). Shrinkage and variance-reduction are related but not identical, and regularization in ML refers to the former. If indeed this term is used more broadly it may be helpful to include a few clarifying sentences and/or references.

Author response:
Yes, we agree that regularization is often used to refer to techniques that only depend on model parameters. However, there is indeed a growing body of work on data-dependent regularization. Following your comments, we will add the following clarification to the paper:
"In addition to traditional regularization techniques that only depend on model parameters, there is also a growing body of work on data-dependent regularization. This type of regularization explicitly takes into account the training data during the regularization process, which can lead to improved generalization performance in certain settings."
We will also add references to the following papers, which provide examples of data-dependent regularization techniques:
- Shivaswamy, P. K., & Jebara, T. (2010). Maximum Relative Margin and Data-Dependent Regularization. Journal of Machine Learning Research, 11(2).
- Zhao, H., Tsai, Y. H. H., Salakhutdinov, R. R., & Gordon, G. J. (2019). Learning neural networks with adaptive regularization. Advances in Neural Information Processing Systems, 32.
- Mou, W., Zhou, Y., Gao, J., & Wang, L. (2018, July). Dropout training, data-dependent regularization, and generalization bounds. In International conference on machine learning (pp. 3645-3653). PMLR.
We hope that these additions will clarify the distinction between traditional regularization and data-dependent regularization.

Reviewer comment (Theory):
The theoretical results are proved under the following assumptions:  
a. Random Bags  
b. Equal Sized Bags  
c. Non-Overlapping Bags

Author response:
Thank you for your insightful comment. The Google Privacy Sandbox and Apple APIs are discussed in the introduction mainly to motivate the general problem of learning from aggregated data, why it is of interest in practice and the privacy protections benefits of it.  We acknowledge that the configurability of aggregation keys introduces a level of specificity that may not align perfectly with our assumption of random aggregations. However, we contend that even in scenarios where bags are specified based on certain criteria (e.g., location, content, time of day), there remains an element of randomness in the aggregation process, especially when multiple users meet the specified conditions. In this sense, our theoretical framework, while idealized, can still serve as a valuable baseline for practical considerations.

Furthermore, note that constructing bags by aggregating records with specific attributes in general outperforms random bags (see Chen et al. (2023)). Therefore, our study of random bags provides a conservative estimate of performance in practical settings, acting as a benchmark for the worst-case scenario. Additionally, it's noteworthy that random bags are commonly employed in the literature on learning from aggregate labels, further emphasizing their relevance in theoretical analyses (e.g., Busa-Fekete et al. (2023), Yu et al. (2013), Quadrianto et al. (2008)).

Reviewer comment (Theory):
The introduction cites the Google (Privacy Sandbox) and Apple (SKAd) APIs as motivations for the problem but the assumptions (a), (b), (c) do not hold in these regimes. In fact, a critical feature of both (a) Google's Private Aggregation API and (b) Apple's SKAd Network is that the aggregation keys are configurable (e.g., aggregate behavior of traffic from California, visiting sports content at a certain time of day), i.e., the bags are specified by the consumer of the API, not by random aggregations. This enables ML algorithms to effectively use these aggregates for prediction.

Author response:
Thank you for your insightful comment. The Google Privacy Sandbox and Apple APIs are discussed in the introduction mainly to motivate the general problem of learning from aggregated data, why it is of interest in practice and the privacy protections benefits of it.  We acknowledge that the configurability of aggregation keys introduces a level of specificity that may not align perfectly with our assumption of random aggregations. However, we contend that even in scenarios where bags are specified based on certain criteria (e.g., location, content, time of day), there remains an element of randomness in the aggregation process, especially when multiple users meet the specified conditions. In this sense, our theoretical framework, while idealized, can still serve as a valuable baseline for practical considerations.

Furthermore, note that constructing bags by aggregating records with specific attributes in general outperforms random bags (see Chen et al. (2023)). Therefore, our study of random bags provides a conservative estimate of performance in practical settings, acting as a benchmark for the worst-case scenario. Additionally, it's noteworthy that random bags are commonly employed in the literature on learning from aggregate labels, further emphasizing their relevance in theoretical analyses (e.g., Busa-Fekete et al. (2023), Yu et al. (2013), Quadrianto et al. (2008)).

Reviewer comment (Experiments):
This distinction regarding how bags are formed is an essential part of the problem. For example, a quasi-technical report published by Google illustrates relevant aspects: [link](https://github.com/google/ads-privacy/blob/master/Combining%20the%20Event%20and%20Aggregate%20Summary%20Reports%20from%20the%20Privacy%20Sandbox%20Attribution%20Reporting%20API.pdf).

Author response:
Thank you for your insightful comment. The Google Privacy Sandbox and Apple APIs are discussed in the introduction mainly to motivate the general problem of learning from aggregated data, why it is of interest in practice and the privacy protections benefits of it.  We acknowledge that the configurability of aggregation keys introduces a level of specificity that may not align perfectly with our assumption of random aggregations. However, we contend that even in scenarios where bags are specified based on certain criteria (e.g., location, content, time of day), there remains an element of randomness in the aggregation process, especially when multiple users meet the specified conditions. In this sense, our theoretical framework, while idealized, can still serve as a valuable baseline for practical considerations.

Furthermore, note that constructing bags by aggregating records with specific attributes in general outperforms random bags (see Chen et al. (2023)). Therefore, our study of random bags provides a conservative estimate of performance in practical settings, acting as a benchmark for the worst-case scenario. Additionally, it's noteworthy that random bags are commonly employed in the literature on learning from aggregate labels, further emphasizing their relevance in theoretical analyses (e.g., Busa-Fekete et al. (2023), Yu et al. (2013), Quadrianto et al. (2008)).

Reviewer comment (Evaluation):
If there is indeed a connection or insight in the paper that this reviewer has missed regarding the above points, please respond to the following question: Are there explicit connections/insights to be gleaned from the results in the paper and the Google/Apple approaches for aggregated-feedback?

Author response:
Our paper aims to shed light on the trade-offs between instance-level and bag-level losses in aggregated feedback settings. While we understand that the specifics of the Google Privacy Sandbox and Apple SKAd APIs may not align directly with our theoretical framework, our findings suggest a broader principle — the potential regularization effect of instance-level loss leading to improved generalization performance. This principle may inform the design of algorithms for APIs with configurable aggregation keys, guiding the search for an optimal balance between instance-level and bag-level losses.

In conclusion, we value your input and recognize the need for future work that bridges the gap between theoretical models and real-world applications. Our ongoing research will focus on extending our theoretical framework to incorporate more realistic assumptions, specifically addressing the nuances of APIs like the Google Privacy Sandbox and Apple SKAd. We are committed to exploring how our theoretical insights can be practically applied in these settings and welcome further discussion on this important intersection of theory and application.