Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 1: strong reject
review_content: summary_of_the_paper: The paper evaluates the connection between out of distribution (OOD) accuracy of a learning model and its privacy protection. They use Membership inference (MI) success rate as a metric to evaluate how much privacy some model provides. 

The setting they evaluate is when a model is train data and test data are drawn from different distributions. The main idea is that models trained on data from some distribution should be robust to distribution shift. The key insight from the literature is that models that generalize to out-of-distribution data are able to learn stable features of the data (features that are invariant to modest distribution shifts). The paper empirically evaluates the connection between the generalization ability of a model and its privacy (using the MI metric). 

main_review: The paper targets  an interesting question about the connection between generalization and privacy. However, there are some 
Issues:

My main issue with the paper is the idea of using MI-attack-accuracy as a the definition of privacy risk. The membership attack metric only captures one type of adversary that is trying to learn the data. Depending on the implementation of the MI attack you might get very different accuracy and thus I don’t think it is a good metric for privacy in general. In my view differential privacy is a more principled privacy definition because it protects privacy agains the worst case adversary.  

Also I was confused about the key results: I don’t find it surprising that achieving generalization does not provide more privacy and showing that there is not connection between generalization and privacy does not seem difficult to do. As for stable features, I don’t see a clear connection between stable features and differential privacy. For example  I would be interested in seeing is Mean-Rank vs Epsilon , to see if more differentiable privacy methods learn better stable features. 
Other than that, I find the presentation of key results not very clear. For example in Figure 1 it’s not easy to see the correlated between OOD accuracy and MI attack accuracy. Would it make more sense to have a plot with OOD accuracy in the y-axis and MI-loss in the x-axis?

summary_of_the_review: The paper uses a questionable notion of privacy. Also, key results and presentation of experiments is not clear.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This works studies the relationship between membership privacy and out-of-distribution (OOD) generalization/stable features. Through extensive experiments, the author shows that the ability to capture stable features lead to robustness against membership inference attacks, while it is not necessarily the case for OOD generalization.
main_review: Strength:
This work studies an important relationship between OOD generalization, stable features, and privacy. The authors performed extensive experiments to study their connections. The empirical results also shows that robustness to MI attacks can be a good indicator of whether the learned features are stable. 

Weakness:
The conclusions are drawn mainly by comparing different models/domain generalization algorithms. Therefore, there might be other unknown hidden factors that lead to different performance for these algorithms. I think the results would be more convincing if you can include experiments where you fix an algorithm and somehow change the OOD performance/stable features. Not sure if such control experiment is possible, but my very naïve guess is that if you corrupt part of the training dataset, the resulting feature might not be stable across different domains? If such control experiment cannot be done, please explain the main difficulties in designing such experiments.
summary_of_the_review: This work studies the connection between OOD generalization, stable features and privacy (particularly robustness against membership attacks) through extensive experiments. It is mainly an empirical study, so technical contribution is limited. However, it provides evidence on the relationship between the three factors. A particularly interesting insight is that robustness against MI attacks can be an indicator of stable features. The main concern is that the experiments do not control the factor of the algorithms being used.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper presents an extensive empirical study to show the connection between out-of-distribution (OOD) generalization, privacy and stable features using SOTA domain generalization methods. They propose to use MI attack metric, which requires no labeled data Pr(Y, X) but only the test data Pr(X), to evaluate quality of the learnt features, because they find out that it measures stable features better than OOD accuracy. The results shows that there is no direct relationship between better OOD generalization and privacy. They empirically prove that a higher generalization gap is not necessary to perform membership inference (MI) attacks in OOD deployment scenarios. They also show that for the same added noise for DP, an algorithm with stable features provides better utility.
main_review: The paper addresses an important problem for the community since it is not easy to measure without labeled data from out-domain distribution. To my understanding, membership inference attacks depend on the availability of unlabeled data from all domains. The authors evaluated SOTA methods on various datasets and found some patterns in the correlation between MI attack accuracy and OOD accuracy.

However on some datasets, the correlation is not very clear. Given that no theoretical analysis are provided, it is difficult to come to a conclusion in these cases. The explanations only depends on empirical evaluation, but at least some theoretical support is also required for these explanations. In addition to that, it is difficult to follow the paper, it requires restructuring. For example, Section3 is divided for datasets and I'd expect to see the same subtitles for 3.1 and 3.2 but they are different. Another example is why 4.3 is part of section 4 and not a separate section like section 5? 

summary_of_the_review: This paper makes an extensive evaluation to show the connection between out-of-distribution (OOD) generalization and privacy. It is important for privacy community, but I'm not sure if it is complete without any theoretical claim. Can the authors provide a theoretical analysis to show the connection and support their claims?
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes to use the metric called "membership inference (MI) attack accuracy" as an indicator to determine the OOD generalization accuracy. The benefit of using such a metric is that no labeled data Pr(Y, X) is needed from the test data but only the test data Pr(X). The paper studies the correlation between MI attack accuracy and OOD accuracy on synthetic and real-world datasets. There is no theoretical treatment of the relationship but prior work Yeom et al. (2018) and Tople et al. (2020) was cited as the motivation.
main_review: Strengths:
+ OOD generalization is important and hard to measure without labeled data from out-domain distribution. The MI membership attack depends on the availability of unlabeled data from all domains and the prediction loss of the model in distinguishing different domains is used as the indicator.
+ State-of-the-art OOD methods are evaluated and there are some consistent patterns in the correlation between MI attack accuracy and OOD accuracy. This is done on multiple datasets.
+ Include many scenarios, such as the attribute inference attack and stable feature learning.

Weaknesses:
- In some cases, the correlation is not very clear or significant. For example, Figure 3 shows that MatchDG and Hybrid have similar MI attack accuracy (right panel), but their OOD accuracies are very different (left panel). In the same figure, it is not clear what the right panel is showing (is "Train-test accuracy gap" the same as the OOD gap?)
- The paper is overly an empirical paper. There is no theory. What's more, there is no explanation why the correlations hold true in some cases. The "explanations" are mostly about the observation but not conjectures about why the observations are so. This weakness leads to limited insight from the paper.
- The authors try to contrast the OOD method and privacy-preservation method (DP). There is unfair comparison, however. For example, the in-domain generalization accuracy is not shown. Will DP with a reasonable $\epsilon$ have both high in-domain generalization accuracy and low MI attack accuracy?
- The correlation between OOD generalization and MI attack accuracy is less obvious on the real-world datasets in Figure 3. This is important since there can be other factors that determine OOD accuracy beyond the MI attack accuracy. The authors should consider explaining some of such possible factors.
- paper organization: sections 4.2 and 4.3 seem different but overlapping section 3. Section 4 contains more empirical results to explain the empirical results in section 3. However, as mentioned above, some in-depth insight or theory will better explain the results in Section 3. If the findings are different from the prior work Yeom et al. (2018) and Tople et al. (2020), then what are the possible reasons?
summary_of_the_review: The paper is well motivated. However, the empirical studies have mixed results (especially on the real-world datasets) while the explanations of the observerations are neither not in-depth or comprehensive.
review_title: null

Meta-review: Motivated by the connections between privacy and generalization, this paper studies the correlation between MI attack accuracy and OOD accuracy on synthetic and real-world datasets. It shows that the measurements are not always correlated. I found the connection between the motivation and actual measurements performed in the experiments to be rather tenuous. Therefore it is hard to draw any insightful conclusions from the empirical results. It should also be noted that somewhat related disconnect between accuracy of MIA and generalization has already been observed in prior work.
Decision: Reject