Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 5: Marginally below acceptance threshold
review_content: The paper is well organized with sufficient background discussion and the related works. The annotation and methodology introduction is clear and mostly without error. This paper lies in an interesting setting of client-server, by sending the shared representation z while decoding the public and private feature at the server side. 

The private information is not necessarily to be orthogonal to the public information. Thus, by the proposed method, without the semantic labels of the private attribute, it is not clear why the orthogonal to public feature would necessarily to be private feature. Yet, public feature would contain private feature, and private feature would contain public feature.

From Figure 1, the authors actually claims to utilize adversary training to predict the secrete attribute, which mostly will utilize the private labels. While in the conclusion, the authors mentioned they do not require the knowledge of private attributes, which is a contradictory. Meanwhile, there is no discussion relating to M3 in Section 3 “proposed method”.

The datasets in the experiment are mostly towards face related data. It would be more convincing with a more general purpose dataset, such as DomainNet, which is aiming at object categories from different resources, sketch, photos, arts, where public information could be the categories, and the private information is the resource type.

From the experimental settings, those public information and private information, by the datasets’ setting, are naturally independent, i.e. gender and race in UTKFace, these two are naturally orthogonal. If the public and private information are with some correlation, would the proposed framework still work under this situation?

review_title: This paper proposes a matrix decomposition method to model the public information and the private information. It tries to compare to noise injection, information bottleneck and adversarial training methods to obfuscate the private information. Extensive experiments show the effectiveness of the proposed approach.

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper tackles a timely problem of privacy leakage on the edge devices when applying deep neural networks. Instead of mitigating the leakage of a set of private attributes, the proposed method tries to remove the information irrelevant to the primary task. The proposed method does not need to identify the private attributes. The main contribution of this paper is the two proposed approaches for removing “null content” and “signal content.” The evaluations of the proposed approach are conducted on four image datasets.

Pros:
1. The idea of removing irrelevant information instead of private attributes is an interesting idea.
2. The paper is well organized and well written.
3. The experimental evaluation is comprehensive. Feature pruning and adversarial training are included in the evaluation.

Cons:
1. The key concern about the paper is the feasibility of the proposed methods in deep neural networks. Both proposed feature-removing methods are derived from a single linear layer. However, in many cases and even shown in the evaluation, the device side may process more than one layer of neural networks. In addition, the convolution layer is often deployed as the first layer in neural networks. It would be great if the proposed methods can be extended to multiple layers and multiple types of neural networks.
2. The adversary uses the same architecture in the paper. However, the adversary can choose to use a more complex model to extract the privacy attributes in the evaluation. The different architecture may cause the failure of the proposed methods. It would be nice if more adversarial models can be evaluated in the paper.
3. In Figure 4, the proposed methods do not perform well in balancing the utilities and privacy achieved. It is hard to tell if the better tradeoffs are due to the deeper layers or fully connected layers. From Figure 4, it seems the proposed methods do not perform well on the convolutional layers.
4. The experiments only evaluate on a six-layer neural network, which is not a “deep network” claimed in the title. It would be great if the paper can evaluate the performance on other architectures and deeper models.
5. The algorithms in Figure 2 are hard to understand.


Minor comments:
1. In Equation 2 it should be “M2 * M1” instead of “M1 * M2”
2. Page 6 Figure 4 shows that the information leakage can be controlled using the following factors “factors”

review_title: feasibility of the proposed method in deep neural networks

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper proposes model splitting as a method to perform private inference from an edge device to a cloud provider. The idea being that an edge device owns layers 0 -> i of a model, M, and the cloud device owns layers i+1 -> N. Then, when an edge device wants to perform inference on a private input, x, they send M_i(x) instead of x to the cloud device, who then completes the prediction task. The claim is that if M_i(x) is learned representation that only retains features that are predictive of the public label, there should be no private information leaked about the input to an eavesdropping adversary who can also observe M_i(x). The authors achieve this by finding representations that are approximately equivalent in the following layer (i+1), but have much smaller norms than the original feature vectors. At inference time, the client either directly constructs the signal content part of the feature or randomises over the nuisance components. Experiments on four datasets point to the effectiveness of this idea, and that simple baselines such as adversarial training or pruning perform worse. I thought the core experiments were sound, but I am not totally convinced by the motivation of the approach.

1. I don't understand why cryptographic solutions are not viable for this kind of problem? If I understand correctly, the server is trusted, the only assumed vulnerable step is the transmission of data between the edge device and cloud provider. If this is correct, then would a simple PKE scheme really be prohibitively expensive? Even a homomorphic set-up seems somewhat tolerable (depending on your threat model) given the experiment datasets used in this work. For example, message sizes of CryptoNet for EMNIST size data is ~91KB [1]. 


2. Following on from (1), I found it hard to reason about trade-offs between public accuracy, private accuracy, computational expense of the defense, bandwidth overheads etc. For example, if I sacrifice 1% of public accuracy for 5% private accuracy, is that a good trade-off? Who makes that decision? The edge device or the cloud provider? The paper would have been much improved if these kinds of questions were captured by a formal threat model.


3. Most the experiments concentrated on public / privacy accuracy trade-offs on problems with a balanced distributions over private attributes. How does this scheme cope with more realistic problems where the distributions are highly skewed?


4. How weak is the approximation to eq. (8)? I couldn't find any ablation studies to justify that this approximation is reasonable. Additionally, what are the computational overheads of extracting z_S?


5. In Figure 4, why is there a large drop at the final Conv layer?


Minor: '..do not contribute to the public attributed." -> "..do not contribute to the public accuracy."?


[1] Gilad-Bachrach, Ran, et al. "Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy." International Conference on Machine Learning. 2016.

review_title: Interesting idea but needs better positioning

Meta-review: While reviewers believe that the motivation of the paper is strong and the idea is interesting the ultimate execution of the paper is not up to the standards of ICLR. I believe the biggest concern is the precise privacy guarantee of the method. As pointed out, it is an extremely strong assumption that the model structure of the adversary is known (or even approximately known). Standard privacy guarantees are either information theoretic or based in computational hardness. This work does not provide such guarantees. While there has been recent work on using adversarial learning to learn models that are robust to such adversaries, they have been heavily criticized within privacy and security communities due to the lack of such guarantees. I was not convinced by the authors response to such questions: there are plenty of cryptographic/privacy-preserving schemes that work in the honest-but-curious setting, and techniques that use the standard guarantee of differential privacy do not suffer from large slow downs.

Thus, I would urge the authors to modify this work so that it can leverage the guarantees of well-known cryptographic/privacy-preserving schemes. If done so, these arguments about privacy will go away and the paper will have a much better shot at acceptance.
Decision: Reject