[Paper Review] PrivateFetch: Scalable Catalog Delivery in Privacy-Preserving Advertising

Muhammad Haris Mughees, Gonçalo Pestana+2 more|arXiv (Cornell University)|Sep 16, 2021

Privacy-Preserving Technologies in Data4 citations

TL;DR

PrivateFetch proposes a privacy-preserving ad delivery system using client-side preference computation and efficient single-server private information retrieval (PIR) to retrieve targeted ads without exposing user preferences to the server. It achieves sub-40-second delivery of 30 ads from a database of over 1 million entries with 192 KB communication cost and under 1% of average ad revenue in operational costs.

ABSTRACT

In order to preserve the possibility of an Internet that is free at the point of use, attention is turning to new solutions that would allow targeted advertisement delivery based on behavioral information such as user preferences, without compromising user privacy. Recently, explorations in devising such systems either take approaches that rely on semantic guarantees like $k$-anonymity -- which can be easily subverted when combining with alternative information, and do not take into account the possibility that even knowledge of such clusters is privacy-invasive in themselves. Other approaches provide full privacy by moving all data and processing logic to clients -- but which is prohibitively expensive for both clients and servers. In this work, we devise a new framework called PrivateFetch for building practical ad-delivery pipelines that rely on cryptographic hardness and best-case privacy, rather than syntactic privacy guarantees or reliance on real-world anonymization tools. PrivateFetch utilizes local computation of preferences followed by high-performance single-server private information retrieval (PIR) to ensure that clients can pre-fetch ad content from servers, without revealing any of their inherent characteristics to the content provider. When considering an database of $>1,000,000$ ads, we show that we can deliver $30$ ads to a client in 40 seconds, with total communication costs of 192KB. We also demonstrate the feasibility of PrivateFetch by showing that the monetary cost of running it is less than 1% of average ad revenue. As such, our system is capable of pre-fetching ads for clients based on behavioral and contextual user information, before displaying them during a typical browsing session. In addition, while we test PrivateFetch as a private ad-delivery, the generality of our approach means that it could also be used for other content types.

Motivation & Objective

• To address the privacy-utility trade-off in behavioral advertising by eliminating client-side data leakage to ad servers.
• To design a system that enables private, high-performance ad retrieval without relying on third-party anonymity networks like Tor.
• To reduce the cost and bandwidth of delivering targeted ads compared to sending entire databases to clients.
• To provide strong privacy guarantees using cryptographic hardness rather than syntactic or heuristic privacy models like k-anonymity.
• To build a practical, deployable framework for private content delivery applicable beyond advertising.

Proposed method

• Clients locally compute user preferences using locality-sensitive hashing on behavioral and contextual data.
• The system uses a single-server, stateless PIR protocol to privately retrieve selected ads from an untrusted server.
• Cryptographic optimizations are applied to minimize client-side state and improve PIR efficiency.
• The PIR protocol ensures that the server learns nothing about the client’s query or preferences.
• The system is designed to be modular, allowing replacement of the underlying PIR scheme with more efficient variants in the future.
• Communication overhead is minimized through configurable PIR parameters, achieving low bandwidth usage.

Experimental results

Research questions

• RQ1 Can a practical, scalable system be built to deliver targeted ads without leaking user preferences to the ad provider?
• RQ2 How can private information retrieval be efficiently integrated into real-world ad delivery pipelines?
• RQ3 What is the performance and cost overhead of using PIR for ad retrieval compared to naive database transfer?
• RQ4 Can PIR-based systems achieve both strong privacy and acceptable performance in real-world deployment scenarios?
• RQ5 To what extent can PIR be used to replace reliance on anonymity networks like Tor in private content retrieval?

Key findings

• PrivateFetch delivers 30 targeted ads from a database of over 1 million entries in 40 seconds with only 192 KB of communication.
• The system reduces operational costs to less than 1% of average ad revenue, achieving a 10× financial saving over sending the entire database to clients.
• Performance is comparable to non-private ad targeting systems, demonstrating practicality without sacrificing privacy.
• The system avoids reliance on external anonymity networks like Tor, improving usability and compatibility.
• The approach is generalizable and could be adapted for private asynchronous fetching of other content types with minimal protocol changes.
• Cryptographic optimizations enable minimal client state, enhancing deployability and efficiency in real-world settings.