Differentially Private Gradient Boosting on Linear Learners for Tabular Data Analysis
Abstract
Gradient boosting takes linear combinations of weak base learners.
Therefore, absent privacy constraints (when we can exactly optimize over the base models) it is not effective when run over base learner classes that are closed under linear combinations (e.g. linear models).
As a result, gradient boosting is typically implemented with tree base learners (e.g., XGBoost), and this has become the state of the art approach in tabular data analysis.
Prior work on private gradient boosting focused on taking the state of the art algorithm in the non-private regime—boosting on trees—and making it differentially private.
Surprisingly, we find that when we use differentially private learners, gradient boosting over trees is not as effective as gradient boosting over linear learners.
In this paper, we propose differentially private gradient-boosted linear models as a private classification method for tabular data.
We empirically demonstrate that, under strict privacy constraints, it yields higher F1 scores than the private versions of gradient-boosted trees on five realworld binary classification problems.
This work adds to the growing picture that the most effective learning methods under differential privacy may be quite different from the most effective learning methods without privacy.
Introduction
Gradient boosting is an approach to learn an additive model such that the sum of many weak base learners approximates the final output [1].
This is achieved by iteratively fitting the next base learner to the gradient of the loss evaluated at the current prediction.
Algorithm 1 outlines gradient boosting in a general form, which can be parameterized by any choice of loss function L and base learner b ( x ) .
Classification and regression trees (CARTs) are one of the most popular choices for the base learner because of its effectiveness on tabular data and deployment-ready tree-based data structures in systems.
Existing packages, including XGBoost [2], LightGBM [3], and CatBoost [4], drastically improved the usability of gradient boosting among tools for tabular data analysis.
Data input covariates labels
Initialize f ( x ) =for t ∈ [ T ] do
Compute θ t = arg min θ (cid:80) ni
=1 L ( y i , f ( x i )
+
b ( x i ; θ ))
Update f
( x ) ← f ( x ) + f t ( x ) , where f t ( x ) =
b ( x ; θ t ) end for return f ( x ) =
(cid:80) Tt =1 f t ( x )
There has been an increasing demand for privacy-preserving machine learning tools, which naturally triggered a wave of efforts to develop a private version of the gradient boosting algorithm.
Differential privacy (DP, Definition 1.1) is one of the most prevalent definitions of privacy, and was adopted to make gradient boosting algorithms private in recent works [5, 6, 7].
DP ensures that, for a randomized algorithm, when two neighboring datasets that differ in one data point are fed into an algorithm, the two outputs are indistinguishable, within some probability margin defined using ϵ and δ ∈ [0 , 1) .
Definition 1.1 (Differential Privacy [8]) . A randomized algorithm M with domain D is ( ϵ, δ ) - differentially private for all S ⊆ Range ( M ) and for all pairs of neighboring databases D, D ′ ∈ D , Pr[ M ( D )
[Equation]
S ]
[Equation]
e ϵ Pr[ M ( D ′ )
[Equation]
S ] + δ, (1) where the probability space is over the randomness of the mechanism M .
As an extension of this idea, a single-parameter family of privacy notion (Gaussian differential privacy,
GDP) was later proposed [9].
We first define the trade-off function T ( P, Q ) and use it to define GDP.
Definition 1.2 (Trade-off function, Definition 2.1 of [9]) .
For any two probability distributions P and Q on the same space, the trade-off function T ( P, Q ) :
[0 , 1] → [0 , 1] is defined as
[Equation]
Definition 1.3 (Gaussian Differential Privacy, Definition 2.6 of [9]) .
A mechanism M is said to satisfy µ -Gaussian Differential Privacy ( µ -GDP) if it is G µ -DP.
That is,
[Equation] for all neighboring datasets D and D ′ , where G µ = T ( N (0 , 1) , N ( µ, 1)) .
µ -GDP means that determining whether an individual’s data is present in the dataset from one draw is at least as difficult as telling apart the two normal distributions N (0 , 1) and N ( µ, 1) .
µ -GDP can be converted to ( ϵ, δ ) -DP and vice versa.
Corollary 1.1 (Conversion between GDP and DP, Corollary 2.13 of [9]) .
A mechanism is µ -GDP if and only if it is ( ϵ, δ ( ϵ ))
-DP for all ϵ ≥ 0 , where
[Equation]
Theorem 1.2 (Gaussian Mechanism, Theorem 2.7 from of [9]) .
Define a randomized algorithm GM that operates on a statistic θ as GM ( x, µ )
= θ ( x ) + η , where η ∼ N (0 , sens ( θ ) 2 /µ 2 ) and sens is the l 2 -sensitivity of the statistics θ .
Then, GM is µ -GDP.
Most attempts focused on making gradient boosting private on tree base learners.
For example, [5] proposed DPBoost, privatizing gradient-boosted regression trees by finding splits using the exponential mechanism and computing numeric values at leaves using the Laplace mechanism.
In a similar fashion, DP-XGBoost was suggested by additionally privatizing the quantile sketching step of
XGBoost [6].
DPBoost and DP-XGBoost suffered from low accuracy under strict privacy constraints, as they had to consume privacy budget not only in leaf value computation but also in split finding step (quantile sketching in DP-XGBoost).
DP-EBM overcame this by restricting each tree to use only one feature and randomly selecting split points (hence no privacy budget is consumed in split finding)
It showed improved performance compared to DPBoost.
However, DP-EBM takes a much longer time to learn a model since it requires learning many more trees.
Absent privacy, gradient boosting on linear models does not improve performance, since linear models are closed under linear combinations, and the base learner can already exactly optimize over this class.
But with differential privacy, it is no longer possible to exactly optimize over the base class, so gradient boosting has the potential to give improvements.
Moreover, there are private linear learners that make very efficient use of the privacy budget.
We adopt a state of the art approach to privately learn linear models, AdaSSP [10], which adds noise to the sufficient statistics for a linear model.
Differentially Private Gradient Boosting with Linear Models
The flexibility of gradient boosting arises from two choices that we make: (i) a loss function and (ii) a class of base learners.
We experiment on three types of loss functions (squared, logistic, and hinge) and fix the base learner class to a private ridge regressor (via AdaSSP).
In this section, we describe the loss functions and its gradients (subsection 2.1) and the private base learner class (subsection 2.2).
2.1 Loss Functions and Gradients
For binary classification problems, we have a dataset D of n data points, composed of covariates x i ∈ R p and labels y i ∈ {− 1 , 1 } (or y i ∈ { 0 , 1 } for logistic loss), ∀ i ∈ [ n ] .
The final model f ( x ) takes the covariates x i as an input and outputs the score s i , which can be translated later to output binary prediction
ˆ y =
( s i > 0) ∗ 2 − 1 (or ˆ y =
( s i > 0) for y i ∈ { 0 , 1 } case).
Let L be the loss function, T be the number of boosting rounds, f t be the model learned at iteration t ∈ [ T ] .
At t -th round of boosting iteration, the goal of Algorithm 1 is to obtain
[Equation]
The f t ( x ) =
b ( x ; θ t ) can be approximated by steepest gradient descent, where the gradient is taken with respect to the score prediction s i and evaluated at current score
s i := (cid:80) t − 1 k =
f k ( x i ) .
The components of the negative gradient at t can be written as
[Equation]
Table.
1 lists the three loss functions we experiment in this paper, and their negative gradients.
Note that the squared loss is unbounded, hence we clip the gradient to fall between ( − z, z ) for some z ∈ R (further explained in the next section).
[Table]
[Equation]
[Table]
[Equation]
[Table]
2.2 Private Ridge Regressor as a Base Learner
With the negative gradients g i,t computed as in eq.
(3), we fit the next base learner f t ( x ) to those gradients by minimizing empirical risk with a ridge regularizer.
As we fixed the base learner class to linear models, we may express f t ( x ) =
θ ⊤ t x , and the new model is obtained by
[Equation]
[Equation] where λ ∈ R is a hyperparameter for ridge regularizer.
Note that the objective to be minimized in this step is different from the loss function we chose when computing gradients.
Let X ∈ R n × p be the matrix with x i ’s in each row and g t ∈ R n be a vector containing all sample’s gradient at t (i.e., g i,t ).
Absent privacy, the above minimization yields
[Equation]
Using the squared loss function, we can analytically show that θ t = 0 ∀ t > 1 when λ = 0 , and they are close to zero with small λ values.
This affirms why gradient boosting was not applied on linear base learners under no privacy constraints.
To meet the privacy constraints, we adopt AdaSSP to privately learn this ridge regressor θ t (Algorithm 2 of [10]).
Let X
and Y be the domain of our data covariates and labels, respectively.
We define the bound on data domain ||X|| = sup x ∈X || x || and ||Y|| = sup y ∈Y | y | .
Given the privacy budget ϵ, δ to guarantee ( ϵ, δ ) -DP, and bounds on the data ||X|| and ||Y|| for x i and g i,t , respectively, AdaSSP calibrates ( ϵ, δ )-DP to µ -GDP with an appropriate µ , and adds calibrated Gaussian noise to three sufficient statistics: 1) X ⊤ X , 2) X ⊤ g t , and 3) λ .
The detailed description of AdaSSP algorithm for learning one ridge regressor is deferred to Appendix A.2.
Let (cid:92) X
⊤ X = GM ( X ⊤ X, µ 1 ) , (cid:92) X ⊤ g t = GM ( X ⊤ g t , µ 2 ) , (cid:98) λ
= GM ( λ, µ 3 ) be the private release of sufficient statistics from a single instantiation of AdaSSP to learn θ t and GM is defined in Theorem 1.2.
The final model (cid:98) θ ∗ can be expressed as
[Equation]
where the initial g i, 1 = y i .
Notice that, for a boosted model, we may call GM ( X ⊤ X, µ 1 ) and
GM ( λ, µ 3 ) just once and only repeat the second part GM ( X ⊤ g t , µ 2 ) for T rounds, instead of straightforwardly repeating Algorithm 3 for T rounds.
Finally, we suggest BoostedAdaSSP (Algorithm 2), a differentially private gradient boosting algorithm with linear base learners.
Algorithm 2 assumes binary classification tasks, and can be generalized to any choice of loss function L .
In the second line inside the for loop, we clip the computed gradient to enforce g i,t ∈ [ −||Y|| , ||Y|| ] , if it is not naturally satisfied.
The final output θ defines the score predictor f ( x ) =
θ ⊤ x , where the score above 0 means a positive label( +1 ) and below 0 means a negative label ( − 1 or 0 ).
Algorithm 2 BoostedAdaSSP (Data X, y , Privacy parameter ϵ, δ , Split ratio a, b, c , Bound on ||X|| , ||Y|| )
Initialize θ =
Find µ such that µ -GDP satisfies ( ϵ, δ ) -DP.
# Corollary 1.
Calibrate µ 1 , µ 2 , µ 3 such that µ 1 : µ 2 : µ 3 = a : b : c and µ = (cid:112) µ 21 + µ 22 + µ 23 .
(cid:92)
X ⊤ X = GM ( X ⊤ X, µ 1 ) and (cid:98)
λ
= GM ( λ, µ 3 ) # instantiate AdaSSP (part 1 & 3) Γ =
( (cid:92) X ⊤ X + (cid:98) λI ) −for t ∈
[ T ] do s =
Xθ # current score prediction g [Equation] =
[Equation]
L ( y, s ) # compute gradient, clip as needed θ t =
Γ (cid:92) X ⊤ g t , where (cid:92) X ⊤ g t = GM ( X ⊤ g t , µ 2 √ T )
# instantiate AdaSSP (part 2) θ =
+ θ t # update model return
Corollary 2.1 (Composition of GDP, Corollary 3.3 of [9]) .
The n -fold composition of µ i -GDP mechanisms is (cid:112) µ 21 + · · · + µ 2 n -GDP.
Theorem 2.2.
When ||X|| = sup x ∈X || x || and ||Y|| = sup y ∈Y
||
y || , Algorithm 2 satisfies µ -GDP and ( ϵ, δ ) -DP.
Proof.
From Corollary 2.1, (cid:114) µ 21 + T (cid:16) µ 2 / √ T (cid:17) 2 + µ 23 = (cid:112) µ 21 + µ 22 + µ 23 = µ .
The conversion of
GDP to DP follows from Corollary 1.1.
Experiments
Algorithm 2 was experimented on five real-world datasets from Kaggle and LIBSVM (details can be found in Appendix A.1) with three choices of loss functions (squared, logistic and hinge), varying number of iterations, and varying choices of epsilon from 0.01 to 10.
The privacy parameter δ = 10 −for all experiments.
Lastly, a non-private version was also computed for comparison.
The performance of a model is measured by F1 score and AUROC.
Note that AUROC may report a good value (close to 1 ) even when most of the minority class is misclassified.
See Appendix A.1 to check how imbalanced each dataset is.
To compare the performance of BoostedAdaSSP against a tree-based private gradient boosting algorithm, we choose DP-EBM [7] which reported the best performance among others[5, 6], and DP-XGBoost [6].
At each boosting round, DP-EBM learns separate trees on individual features, and split points are chosen completely at random (this allows more efficient privacy budgeting).
We experimented DP-EBM with four choices of the maximum number of leaves { 1 , 10 , 100 , 1000 } .
Setting this value to either 100 or 1000 led to similar performance in terms of F1 score, but having fewer splits ran faster, , hence we report results with the number of leaves as 100 in the main paper and defer other results to Appendix A.3.
Privacy Accounting this DP-EBM is also through Gaussian DP, which makes it a valuable competitor to ours.
DP-XGBoost [6] learns a differentially private tree each round, and it directly add calibrated noises to aggregate statistics in the XGBoost to make it differentially private.
The algorithm uses subsampling to increase the privacy budget per boosting round, and it uses the Approximate DP for privacy accounting.
DP-XGBoost may not be a direct comparison to our approach since it doesn’t use the same privacy accounting approach as ours, but it is an attempt to make gradient boosting algorithms with trees differentially privacy, so we include their results here.
In our experiments, only the sampling ratio is tuned using a pre-defined set of values { 20% , 50% , 80% } , and setting the subsampling ratio to 80% yielded the best performance.
3.1 Boosted Linear Models Under Non-Private Regime
Figure 1 shows the training loss of non private gradient boosting, each line corresponding to the choice of loss functions (squared, logistic, and hinge).
For the squared loss(green line), we see virtually no improvement over boosting rounds, as mentioned previously in Section 2.2.
On the other hand, we observe a decrease in training loss for logistic and hinge losses, when additional boosting rounds are introduced.
This is because the gradient of these loss functions are non-linear with respect to the score predictions (whereas it is linear for squared loss)
3.2 BoostedAdaSSP (linear base learner) vs. DP-EBM (tree base learner)
Figure 2a and Figure 2b show the performance of private gradient boosting measured by F1 score and AUROC score, respectively.
Each line corresponds to BoostedAdaSSP with three choices of loss [Figure] functions and DP-EBM with 100 leaves per tree (red).
We observe the improved performance as ϵ increases ( δ = 10 − 6 is fixed for all experiments) for most cases.
This aligns with our expectation that larger privacy budget ϵ allows less noise to be introduced, leading to a better performance.
However,
F1 score of DP-EBM in less than or equal to 100 rounds of boosting behaves counter-intuitively.
Since the AUROC score follows our expectation, we may construe this as DP-EBM with small rounds of boosting results in a model that misclassifies majority of the minority class, to the point that the privacy noise sometimes helps correctly classifying the minority labels.
There was no loss functions that outperformed others in all cases—rather, the best-performing loss function (for BoostedAdaSSP) depends on the dataset (detailed results on individual datasets are deferred to Appendix A.5.)
Overall, BoostedAdaSSP provides higher F1 scores at most values of total boosting rounds, however, DP-EBM provides slightly better AUROC scores.
(Note that the datasets we experiment are mostly imbalanced.)
3.3 Effect of Boosting Under Privacy Constraints
Figure 3a and Figure 3b show the performance(y-axis) over boosting rounds(x-axis) at four different privacy levels.
The F1 score of BoostedAdaSSP and DP-EBM both improve as the number of boosting rounds increases.
DP-EBM requires significantly more number of boosting rounds to yield comparable F1 score to BoostedAdaSSP.
To run 1000 rounds of boosting, DP-EBM takes about 60 .seconds to finish, and BoostedAdaSSP takes only about 4 . 5 seconds.
Overall, we conclude that, restricting the number of boosting rounds to be small (i.e., when we want to limit the time budget), there exists a BoostedAdaSSP with some loss function that is preferrable to DP-EBM for all epsilon values, when we evaluate the performance based on F1 scores.
Additionally for BoostedAdaSSP with squared loss, we compare the ratio between the test set F score of a non-boosted model (i.e., with 1 iteration) versus with some rounds of iterations (10, 100, 1000 are plotted).
Figure 4 shows that the effect of boosting (measured by the ratio) diminishes as ϵ goes to infinity as well as when ϵ goes to zero.
This can be explained by conjecturing ϵ = ∞ and ϵ = 0 cases.
As the privacy budget ϵ goes to infinity, our BoostedAdaSSP gradually reduces the amount of noise added to the output, and it eventually becomes similar to the non-private regime.
Therefore, we may expect no effect of boosting, the same as in non-private case (see Figure 1).
As the privacy budget ϵ approaches to 0 , we eventually enter the high-privacy regime where the privacy noise dominates the signal.
In this case, it is difficult to expect any learning algorithms, let alone additional boosting rounds, to learn anything.
As a result, we observe a bell curve shape in the Figure 4, which implies that there exists a sweet spot in terms of the privacy budget ϵ where the boosting has the maximum impact.
However, the sweet spot observed here doesn’t necessarily indicates the best F1 score.
Same observations are shown in
Figure 9 for logistic loss and Figure 10 for hinge loss. [Figure]
of is maximized at a certain privacy level, and the maximum point differs on individual tasks.
Thus, it implies that, at the high privacy regime, it might worth running gradient boosting with more rounds for higher performance, but it is not the case in the low privacy regime since the base is still linear
Conclusion and Future Work
We proposed a differentially private gradient boosting algorithm using linear base learners by adopting
AdaSSP to privately train linear models.
In each boosting round, the linear model is privately trained to approximate the gradient of loss function at the current score prediction.
Without privacy, gradient boosting of a linear model is expected to be the same (OLS) or similar to (ERM with small regularization) a single linear model learned in one-shot.
Hence, in practice, gradient boosting is primarily focused on learning with tree base models.
However, in the high-privacy regime,
BoostedAdaSSP provides a higher F1 score than the state of the art tree-based differentially private gradient boosting algorithm (DP-EBM).
BoostedAdaSSP also converges to good performance level with fewer boosting rounds than DP-EBM at a fixed privacy level
Although the results presented in this paper already seem promising, there are a few ways to further improve the algorithm.
One direction could be introducing more hyperparameters to the algorithm.
For example, we may introduce a step size η to the last step inside the for loop of Algorithm 2.
When a weak base learner θ t is added to the final model θ , we may multiply θ t by η , as we do in gradient descent algorithms (that being said, Algorithm 2 can be seen as using η = 1 ).
Also, we may attempt to clip the gradients more aggressively for squared loss and logistic loss as we iterate over boosting rounds, so that we can add less noise when instantiating the second part of AdaSSP.
A Appendix A.1 Datasets
We describe the five datasets used in our evaluation.
[Table]
[Table]
A.2 AdaSSP algorithm to learn a single ridge regressor
Let (cid:98) .
denote private versions of the corresponding statistics.
Then, AdaSSP privately releases the sufficient statistics of ridge regressor as follows.
Algorithm 3 Private Ridge regression via AdaSSP(data X, y , calibration ratio a, b, c , Privacy parameter ϵ, δ , Bound on ||X|| , ||Y|| )
Find µ such that µ -GDP satisfies ( ϵ, δ ) -DP.
# Corollary 1.
Calibrate µ 1 , µ 2 , µ 3 such that µ 1 : µ 2 : µ 3 = a : b : c and µ = (cid:112) µ 21 + µ 22 + µ 23 .
(cid:92)
[Equation]
GM (
Algorithm 3 instantiates three Gaussian mechanisms with µ 1 , µ 2 , and µ 3 to privately release each sufficient statistic.
Hence the composition
[Equation]
is ( ϵ, δ ) -DP.
Detailed proof is available in Theorem 3 of [10].
Each line corresponds to DP-EBM with 1 , 10 , 100 and 1000 maximum number of leaves per tree. It is easy to see that the performance of DP-EBM plateaus when the maximum number of leaves is 100, and the performance doesn’t improve after that. We would also like to point out that, the reason that there are missing dots in these plots is due to the fact that the privacy budget allocation in DP-EBM fails to find a solution, and it usually occurs in the high privacy regime.
[Figure]
A.4 non-private F1, AUROC
In terms of the performance of these non-private boosted linear models on the test set, Fig.
6a and
Fig.
6b show F1 scores and AUROC scores, respectively.
Apart from the Cardiovascular dataset, increasing the number of rounds improves the F1 score on the test set for logistic and hinge losses only.
[Figure]
A.5 F1 scores and AUROC scores on the test set of individual datasets
Our main paper presented the averaged F1 score and AUROC score on the test set, and here we present details results on individual datasets.
Specifically, the progress of the performance on each dataset is plotted against the privacy level ( ϵ value).
[Figure]
A.6 Effect of Boosting
Here, the progress of the performance on each dataset is plotted against the number of boosting rounds at certain privacy levels ( ϵ values).
[Figure]