Privacy-preserving system for predicting the click-through rate of advertisements with device-internal behavioral embeddings and federated calibration

Abstract

Privacy-preserving system for predicting the click-through rate of advertisements (100), comprising a multitude of user devices (101) and a federated coordination server (200), wherein each user device (101) comprises: an on-device behavioral data collection module (102) configured to collect user interaction data locally within the user device (101); an on-device behavioral embedding generation unit (103) configured to generate behavioral embeddings from the locally collected user interaction data; a feature fusion and interaction representation unit (104) configured to combine the behavioral embeddings with ad features and context features and to generate a candidate-specific interaction representation for each candidate ad; an on-device click-through rate prediction unit (105) configured toto calculate a click probability for each candidate ad from the candidate-specific interaction representation using a globally aggregated prediction model, a local personalization component, a reliability calibration transformation, and an ad fatigue state; an ad fatigue control module (106) configured to maintain the ad fatigue state locally within the user device (101); a local adaptive personalization and calibration module (107) configured to personalize a distributed calibrated global prediction model and a reliability calibration transformation based on locally generated behavioral embeddings and locally observed results; a privacy firewall module (108) configured toto block the serialization of behavioral raw data into any outgoing network payload of the user device (101); a privacy-preserving federated refresh module (109) configured to generate limited protected refresh data, including model refresh data and aggregate-safe calibration statistics, without including behavioral raw data; a resource-aware synchronization control (110) configured to allow the transmission of the protected refresh data only when a resource-aware synchronization condition is met; and a local ad delivery unit (112) configured to order and select ads locally based on calculated click probabilities, wherein the federated coordination server (200) comprises: a secure aggregation unit (201) configured to,to aggregate the protected update data received from a threshold cohort of the multitude of user devices (101) in such a way that only cohort aggregates are disclosed; an anomaly-resistant aggregation unit (203) configured to exclude, downweight, or isolate anomalous protected update data before aggregation into a global model; a federated reliability calibration unit (202) configured to update the globally aggregated predictive model and the reliability calibration transformation from the securely aggregated update data; and a global model update and distribution unit (204) configured to distribute the updated global predictive model and the reliability calibration transformation to the multitude of user devices (101), with raw user behavior information remaining on the respective user device (101).while the collaborative model optimization is performed through secure aggregation and federated reliability calibration, and wherein the reliability calibration transformation applied by the device-internal click-rate prediction unit (105) is the reliability calibration transformation that is updated by the federated reliability calibration unit (202) exclusively from cohort aggregate statistics, so that the probability calibration of the multitude of user devices (101) is corrected without the federated coordination server (200) receiving an individual click record,and wherein the updated global prediction model distributed by the global model update and distribution unit (204) and the updated reliability calibration transformation modify both a subsequent calculation of the click probability by the device's internal click rate prediction unit (105) and a subsequent formation of the protected update data by the privacy-preserving federated update module (109), such that the display fatigue state, the reliability calibration transformation, the formation of the protected update data, the secure aggregation, and the resource-aware synchronization condition interact as a single closed-loop control system rather than as independent modules.