Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 1: Reject
review_content: This paper investigates the use of variational auto-encoders (VAEs) and disentanglement to create high quality data representations that hide sensitive attributes. The authors consider two settings: (1) a supervised setting where both the sensitive labels and the downstream machine learning task labels are available to the data holder, and (2) a weakly supervised setting where only sensitive attributes are available. For both settings, the authors propose creating data representations that have 2 components: component 1 captures any information in the data bout the sensitive attributes, and component 2 captures everything else (especially the information useful for a downstream machine learning task). The goal is to ensure that these two components are disentangled.  This is done by training classifiers on each component: 2 classifiers that try to reconstruct the sensitive attributes from each component separately (and in the supervised setting, 2 other classifiers that guess the downstream ML task from each component separately). The overall loss captures all components and ensures that one cannot reconstruct the sensitive attributes from component 2. 

Overall, the paper addresses an interesting and timely problem that is of great relevance to this community. However, despite being generally clear, the paper has many grammatical errors and typos. In its current shape, the paper cannot be published. 

More importantly, the paper has a number of issues that need to be improved:

1. The introduction makes a number of claims that are incorrect. For instance, the introduction claims that under differential privacy (and refers to Abadi et al.), machine learning models are learned from anonymized data and that complex training procedures run the risk of exhausting the budget before convergence. This is not true because under the classical setting of differential privacy, the models are trained on clean data BUT the process of learning is anonymized (see DP-SGD from Abadi et al.). More importantly, recent research and results in this space indicate that one can train high quality machine learning models with strong differential privacy guarantees (check McMahan et al. ICLR18: Learning Differentially Private Recurrent Language Models). Further, the authors claim that Federated Learning does not allow for the use of the trained model in a central setting. This is also not true because federated learning is an approach to train models on massively decentralized data -- in a way that is orchestrated by a service provider. The learned model can be used in a centralized or decentralized service. Moreover, the communication cost of training models under federated learning may be lower than communicating the data (several hundreds if not thousands of high resolution images) to a central service provider, so the claims about communication are not always correct. Finally, the authors claim that federated learning and differential privacy are useful when the private attributes are known a priori and these approaches fail to provide privacy protections when the private information contained in the dataset isn't identified. This is wrong. Both approaches do not require the knowledge of private information. They, however, require the knowledge of the downstream machine learning task -- something that may not always defined a priori.

2. The privacy guarantees provided by the authors' approach are rather weak and unclear. (1) They assume that a trusted data holder already access to the dataset and wants to release private representations. In the supervised setting, why not just revealing the learned model? In the weakly supervised setting, where will the downstream machine labels come from? Are these representations released only for unsupervised learning tasks? This should be clarified -- and the experiments at the end should reflect this. (2) The privacy guarantees are with respect to (a) a computationally and statistically bounded adversary (i.e. there may very well be stronger adversaries with access to side information that can perfectly reconstruct the sensitive attributes),  and (b) pre-defined sensitive attributes (i.e. there may be other sensitive attributes that one can learn from the published representations that are not captured by this framework). 

3. The paper makes no attempt to properly survey the literature on learning representations under censorship and fairness constraints. For example, they do not reference and compare against: (a) Censoring Representations with an Adversary (https://arxiv.org/abs/1511.05897), (b) Learning Adversarially Fair and Transferable Representations (https://arxiv.org/abs/1802.06309), (c) Context-Aware Generative Adversarial Privacy (https://arxiv.org/abs/1710.09549), (d) Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints (https://arxiv.org/abs/1910.00411), and many others. Without a clear (empirical) comparison to these works, the benefits of the proposed approach are unclear.

4. The proposed method for disentanglement does not scale to non-binary sensitive attributes (because of the blowup in the number of classifier pairs that would need to be trained to ensure disentanglement). Thus, this approach may be limited to cases with a few sensitive attributes. 

5. The authors are encouraged to show the learned representations (so that one could verify with the naked eye that the representations are indeed disentangling the sensitive attributes).

review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: This paper brings to our attention the problem of privacy-preserving representation learning.
The assumption in this work is that the data feature can be split into two parts: private and non private.

The authors propose to use VAE with additional regularizer terms to learn hidden representations that would encode both private and non-private part as independent as possible.
There are two scenarios considered:
1) supervised disentanglement, total of 4 terms (two for public part, two for private part) are added to the VAE loss.
2) weakly-supervised disentanglement: in this setting, downstream task is unknown and only two terms are added tot he VAE loss: one to penalize the classifiability using private information in the public z space, and other to promote the classifiably using private information in the private z space.

Overall, I think it is a well-stated problem and this work seems to get some positive results on CelebA dataset. However, a few questions must be clearly addressed:
1. Eqn 6 is derived from Eqn 2 and Eqn 5. please clean up the notation on L terms. Currently they are not consistent and L_i and L_j are not defined.

2. In section 3.3, the authors mention the optimization is nontrivial. Can you expand on that? current section 3.3 is too short for the readers to appreciate that non-triviality.

Other comments:
On Page 1, 
growing privacy concerns will entails —> entail
the "Glass / gender" example doesn’t make sense to me. why glass is considered non-private while gender is private? maybe we should use another example here.

On Page 2,
 penultimate paragraph, where it used as —> where it is used as …
While the latter encourage preserving —> encourages
This two additional terms —> these two additional terms

Page 7, Figure 2 caption needs rewriting.



review_title: Official Blind Review #3

final_score: rating: 1: Reject
review_content: PRIVACY-PRESERVING REPRESENTATION LEARNING BY DISENTANGLEMENT

Summary
This paper introduces a method to disentanglement the private and public attribute information in representation learning.

Strength:
1. The idea of introducing the confusion term to disentanglement private and public information seems novel. 
2. The problem studied in this paper is very important.

Comments:
1. The existing results are not sufficient to validate the effectiveness of the method to prevent privacy leakage. More comparison with other previous methods should be conducted. For example, the previous work [1] has both theoretically and experimentally validated the effectiveness of DP based methods for preventing attribute attack. Recent work[2] also tries to reduce information leakage in representation learning.
2. Some important related works are missing. The difference between the proposed method and previous works with the same purpose should be made more clearly. See comment1 for some concrete examples of previous works. 
3. The notation of $z$ is confusing. The author denotes $z=(z_{*}, z_{.})$, however, these three vectors' dimensions are the same, which really confuses me.
4. Some details of $L_{VAE}$ are missing. According to Equation~1., the author uses $z$ to build the reconstruct loss. However, based on previous notations, $z$ comprises of both private and public representations. So, what's the strategy to combine these two representations (concat?)?
5. Typos. For example, blue-> read in the caption of Figure 1. 
6. The threat model in this paper needs to be made more clearly. The method proposed in this paper can only be used in the context where the private attribute is well-defined. There are many other threat models in secure machine learning research, such as membership attack and adversarial attack, which are not covered by this paper (My suggestion is adding a specific sub-section of threat model and do not use  "privacy-preserving" in the original title ). 
[1] Privacy Risk in Machine Learning: Analyzing the Connection to Overﬁtting
[2] Mitigating Information Leakage in Image Representations: A Maximum Entropy Approach
review_title: Official Blind Review #2

Meta-review: The paper leverages variational auto-encoders (VAEs) and disentanglement to generate data representations that hide sensitive attributes. The reviewers have identified several issues with the paper, including its false claims or statements about differential privacy, unclear privacy guarantee, and lack of related work discussion. The authors have not directly addressed these issues.
Decision: Reject