[RFC] Safety limits by bmcase · Pull Request #309 · w3c/attribution

bmcase · 2025-11-12T02:26:54Z

Creating a PR to add safety limits to the Attribution spec. This is based primarily on the BigBird algorithm from Section 4 of this paper https://arxiv.org/pdf/2506.05290. Algorithm 2 is the main algorithm that encompass both budget deduction and safety limit deduction.

This PR is still WIP but ready for some initial review.

Intended to address this open issue #237

Preview | Diff

This adds the checks that need to happen on user action context, following Alg 2 of BigBird; not that it follows the latest version which has conversion check moved within the for loop over epochs.

in Algo 2 in Big Bird, safety limit deductions occur if and only if privacy budget also happens. Thus going to put the safety limits into the deduct privacy budget function (renamed as deduct privacy and safety budgets).

api.bs

bmcase · 2025-12-05T16:55:23Z

User actions quota counts -- for the spec I think we should stick closely to the paper on the safety limit quotas themselves, but for the user action quota counts I think we could do a simplification.

The paper partitions the quota counts for a single user action by impression and conversion quotas with conversion quotas further partitioned by epoch.

I think it would be simpler to just have one single quota count per user action. If we think that is okay for now I can simplify this PR a bit.

Let me know if you have any thoughts on this @apasel422 @mt @csharrison @andyleiserson.

api.bs

bmcase · 2025-12-11T21:50:21Z

Notes from meeting:

drop user action stores by many dimensions
drop conversion site quota

Follow ups:

set minimum recommended multipliers
clear history
locking for atomic transaction

remove conversion site quota and remove the store of user action contexts, replacing with a global boolean flag attached to the window

create function to calculate deductions for impression sites.

the simpler version was more than lacking optimizations; it would have under deducted in the single epoch but multiple impressions site case.

bmcase · 2026-02-10T18:54:25Z

@martinthomson Thanks for the review and feedback! I incorporated most of the feedback. I have not yet changed anything related to throwing errors for activation based on user activity as I think we should discuss a few things about this first, see this comment.

Also made sure we have issues tracking these remaining items:

locking Add details on atomicity of budget deductions #371
clearing the activation flag Resetting the global attribution API flag #372
clearing the budget state Define how the safety limits interact with clear history #367
setting the budget parameters Setting budget and safety limit parameters #373

api.bs

@apasel422

incorporate @apasel422 's feedback

bmcase · 2026-02-10T21:42:29Z

@apasel422 thanks for the review! I think I incorporated all of you feedback

api.bs

apasel422 · 2026-02-11T16:07:22Z

api.bs

-1.  If |deduction| is greater than |currentValue|,
-    [=map/set|set=] the value of |key| in the [=privacy budget store=] to 0
-    and return false.
+1.  Let |impressionsBySite| be a new [=map=].


IIUC, this can just be a [=set=] (containing impression sites) as the current PR never reads the map's values.

yeah, you're right we are not using that right now are we. Let me double check on this; I was thinking each source impressions would be used for some optimization in compute impression site deductions but not how it is right now. I'll follow up on this.

let me remove this for now; but I will open an issue to track something like this as a future optimization. Discussed this with the big bird authors and there is more we have discussed doing here but haven't worked through fully yet. #377

bmcase · 2026-02-12T05:03:42Z

@martinthomson I updated the user activation check to throw an exception instead of return a boolean, if you want to look anymore at that. Replied on a couple open comment threads.

@apasel422 thanks for the second round of edits; I updated the PR with all of those except one I want to look into more.

api.bs

adding more prose to describe what we are doing with requiring user activation and some limitations with that.

bmcase · 2026-02-13T03:20:57Z

api.bs

+that could be maliciously triggered.
+
+
+### Attribution API Activation ### {#s-api-activation}


@martinthomson I added some more explanation to go with this section and links out to the HTML spec. Can you see if this captures what we want to say here?

martinthomson

I'm not following the whole business of impression quota computation. It might even be wrong. I think that this could be a lot simpler in that area.

martinthomson · 2026-02-13T03:55:41Z

api.bs

+The Attribution API requires user activation to prevent abuse. Examples of user activations
+that could be used to activate the API include
+<a href="https://html.spec.whatwg.org/#user-navigation-involvement">user navigation involvement</a> or clicks on the page.


Suggested change

The Attribution API requires user activation to prevent abuse. Examples of user activations

that could be used to activate the API include

<a href="https://html.spec.whatwg.org/#user-navigation-involvement">user navigation involvement</a> or clicks on the page.

The Attribution API is a [=transient activation-consuming API=].

I just spent a bit of time looking into this and unfortunately, we're going to have a problem with the existing definition, so I don't want to get too deep into this text right now, so don't overdo the text here; we'll need to rewrite it all. More detail in an issue that I'll open.

martinthomson · 2026-02-13T03:57:55Z

api.bs

+1.  Since calling the Attribution API consumes a user activation, the site would no longer have this
+    particular user activation to use for other APIs (e.g., opening popups).


Thankfully, this problem can be fixed by doing the hard work of doing our own activation tracking, which I think is going to be necessary.

martinthomson · 2026-02-13T04:01:04Z

api.bs

+<p class=note>This approach allows a single user action to enable multiple
+API invocations within the same session, while still requiring
+an initial user gesture to activate the API.


Suggested change

<p class=note>This approach allows a single user action to enable multiple

API invocations within the same session, while still requiring

an initial user gesture to activate the API.

<p class=note>This approach allows a single user action

to enable multiple API invocations within the same session,

while only making the API available to one site

per [=activation triggering input event|activation=].

martinthomson · 2026-02-13T04:01:37Z

api.bs

+<p class=issue>TODO: Define how long the [=global attribution API flag=] remains true
+and under what conditions it should be reset (e.g., navigation, page lifecycle events).
+


Now that we have the issue, and it's not a high priority one, ...

Suggested change

<p class=issue>TODO: Define how long the [=global attribution API flag=] remains true

and under what conditions it should be reset (e.g., navigation, page lifecycle events).

martinthomson · 2026-02-13T04:02:08Z

api.bs


 </div>

+


Suggested change

martinthomson · 2026-02-13T04:27:06Z

api.bs

+1.  If the [=global privacy budget store=] does not [=map/contain=] |epoch|,
+    [=map/set=] its value to the [=global budget per epoch=].


As above, same here.

martinthomson · 2026-02-13T04:28:32Z

api.bs

+1.  If the [=impression site quota store=] does not [=map/contain=] |impressionQuotaKey|
+    and |siteDeduction| is greater than the [=impression site quota per epoch=], return false.


Fix the indent.

Also, the above comments.

martinthomson · 2026-02-13T04:32:36Z

api.bs

-    in the [=privacy budget store=].
+1.  Let |epoch| be the [=epoch index=] component of |key|.

 1.  Let |sensitivity| be |l1Norm| if |l1Norm| is non-null, 2 * |value| otherwise.


This bit duplicates the computation you have in the impression store bit. I think we can factor out a "compute privacy budget deduction" process for finding the number.

martinthomson · 2026-02-13T04:34:14Z

api.bs

+1.  Let |impressionsBySite| be a new [=map=].
+
+1.  [=set/iterate|For each=] |impression| in |impressions|:
+
+    1.  Let |impressionSite| be |impression|'s [=impression/impression site=].
+
+    1.  If |impressionsBySite| does not [=map/contain=] |impressionSite|,
+        [=map/set=] |impressionsBySite|\[|impressionSite|] to an empty [=set=].
+
+    1.  [=set/Append=] |impression| to |impressionsBySite|\[|impressionSite|].
+
+1. Let |isSingleEpoch| be true if |l1Norm| is non-null, false otherwise.
+
+1.  Let |impressionSiteDeductions| be the result of [=compute impression site deductions|computing impression site deductions=]
+    with |impressionsBySite|, |deduction|, |value|, |maxValue|, |epsilon|, and |isSingleEpoch|.


I'm not convinced about the necessity of this bit.

martinthomson · 2026-02-13T04:37:28Z

api.bs

+1.  Let |budgetAvailable| be the result of [=check for available privacy budget|checking for available privacy budget=]
+    with |key|, |deduction|, and |impressionSiteDeductions|.
+
+1.  If |budgetAvailable| is false, return false.


bmcase added 5 commits November 12, 2025 09:33

Update api.bs

7a4c504

update safety limit draft

3db4368

update safety limit draft

a8c6b8d

add user action checks

f217ef5

This adds the checks that need to happen on user action context, following Alg 2 of BigBird; not that it follows the latest version which has conversion check moved within the for loop over epochs.

have budget and safety checks together

3339298

in Algo 2 in Big Bird, safety limit deductions occur if and only if privacy budget also happens. Thus going to put the safety limits into the deduct privacy budget function (renamed as deduct privacy and safety budgets).

bmcase mentioned this pull request Dec 4, 2025

Overly conservative check and deduct for budget #336

Open

safety limit and privacy deductions iff all can occur.

140ae91

bmcase commented Dec 5, 2025

View reviewed changes

api.bs Show resolved Hide resolved

clean up

5527b8d

bmcase changed the title ~~[WIP] Safety limits~~ [RFC] Safety limits Dec 5, 2025

This comment was marked as spam.

Sign in to view

martinthomson reviewed Dec 11, 2025

View reviewed changes

api.bs Outdated Show resolved Hide resolved

martinthomson reviewed Dec 11, 2025

View reviewed changes

api.bs Outdated Show resolved Hide resolved

martinthomson reviewed Dec 11, 2025

View reviewed changes

api.bs Outdated Show resolved Hide resolved

bmcase added 10 commits February 6, 2026 10:06

Merge branch 'main' into safety_limits

b4b0575

remove conversion site quota and store for user actions

7dd5ecd

remove conversion site quota and remove the store of user action contexts, replacing with a global boolean flag attached to the window

deductions for impression sites

c42e70c

create function to calculate deductions for impression sites.

move safety configuration into implementation defined values

ec0f4c9

handle cases in compute impression site deductions

d0395ed

the simpler version was more than lacking optimizations; it would have under deducted in the single epoch but multiple impressions site case.

pass parameters

84fce81

update function signature

55634d3

fix some bikeshed links

61ff7e7

fix link

1721e6d

update user activation checks on measure conversion

a95b7b1

bmcase mentioned this pull request Feb 9, 2026

add user activation check on save impression #369

Closed

bmcase added 2 commits February 9, 2026 15:12

clean up errors and user activation

0997b83

clean up warnings

737e81c

bmcase mentioned this pull request Feb 10, 2026

Resetting the global attribution API flag #372

Open

bmcase added 2 commits February 10, 2026 12:59

address PR feedback

9970c90

fix bikeshed warnings

3a0f73c

apasel422 requested a review from csharrison February 10, 2026 19:23

apasel422 reviewed Feb 10, 2026

View reviewed changes

api.bs Outdated Show resolved Hide resolved

api.bs Outdated Show resolved Hide resolved

api.bs Outdated Show resolved Hide resolved

apasel422 reviewed Feb 10, 2026

View reviewed changes

api.bs Outdated Show resolved Hide resolved

api.bs Outdated Show resolved Hide resolved

apasel422 reviewed Feb 10, 2026

View reviewed changes

api.bs Outdated Show resolved Hide resolved

incorporate feedback

cc0f86a

incorporate @apasel422 's feedback

apasel422 requested changes Feb 10, 2026

View reviewed changes

apasel422 requested changes Feb 11, 2026

View reviewed changes

api.bs Outdated Show resolved Hide resolved

api.bs Outdated Show resolved Hide resolved

apasel422 reviewed Feb 11, 2026

View reviewed changes

api.bs Show resolved Hide resolved

apasel422 mentioned this pull request Feb 11, 2026

Add safety limits to simulator #376

Draft

apasel422 reviewed Feb 11, 2026

View reviewed changes

bmcase added 3 commits February 11, 2026 22:55

change check attribution API activation to throw

51f2d25

address Andrew's feedback on PR

2892064

fix checks

2ca92de

apasel422 requested changes Feb 12, 2026

View reviewed changes

api.bs Outdated Show resolved Hide resolved

api.bs Outdated Show resolved Hide resolved

description of user activation for the API

7b1cf1a

adding more prose to describe what we are doing with requiring user activation and some limitations with that.

bmcase commented Feb 13, 2026

View reviewed changes

bmcase added 5 commits February 12, 2026 22:53

remove impressionsBySite map

36b54e8

address PR feedback

f2daa48

fix link

d164cf7

fix errors

f740ef9

use set of impressionSites

580473a

martinthomson requested changes Feb 13, 2026

View reviewed changes

martinthomson linked an issue Feb 13, 2026 that may be closed by this pull request

Add global privacy budget and per-impression-site quotas #237

Open

martinthomson mentioned this pull request Feb 13, 2026

HTML's user activation modes don't work for us #378

Open

		that could be maliciously triggered.


		### Attribution API Activation ### {#s-api-activation}

		1. Since calling the Attribution API consumes a user activation, the site would no longer have this
		particular user activation to use for other APIs (e.g., opening popups).

		<p class=issue>TODO: Define how long the [=global attribution API flag=] remains true
		and under what conditions it should be reset (e.g., navigation, page lifecycle events).

		1. If the [=global privacy budget store=] does not [=map/contain=] \|epoch\|,
		[=map/set=] its value to the [=global budget per epoch=].

		1. If the [=impression site quota store=] does not [=map/contain=] \|impressionQuotaKey\|
		and \|siteDeduction\| is greater than the [=impression site quota per epoch=], return false.

Conversation

bmcase commented Nov 12, 2025 • edited by pr-preview bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

bmcase commented Dec 5, 2025

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

Uh oh!

Uh oh!

bmcase commented Dec 11, 2025

Uh oh!

bmcase commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bmcase commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmcase Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmcase Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmcase commented Feb 12, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

martinthomson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

bmcase commented Nov 12, 2025 •

edited by pr-preview bot

Loading

bmcase commented Feb 10, 2026 •

edited

Loading

bmcase Feb 12, 2026 •

edited

Loading

bmcase Feb 13, 2026 •

edited

Loading