Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper proposes a novel way to outsource a part of the information processing in a deep learning model to an untrusted remote location while revealing only little information about the input or final output of the computation. To this end the result of an on-chip encoder (e.g. the first N layers of a ConvNet) is encoded in a complex number with a random phase, which is then shipped to a remote location and gets processed (the next M layers of a ConvNet) in a way that is phase-equivariant. This result is shipped back to the device which extracts the desired information by inverting the phase randomisation. Additional distractor signals are encoded through a GAN-type approach.

Overall the paper is well written although it experiences a few rough edges (e.g. the conclusions, font size in images, typos). The way the problem or threat scenario is phrased in the introduction, however, should emphasise much more the point that none of the actors, be it an adversary intercepting the communication or the cloud operator itself, have to be trusted. In other words, if I have an Alexa device at home which uses this technique I would not have to trust Amazon to keep my processed data private. Instead, even Amazon itself would not be able to really recover the true speech signals or their meaning. In my opinion, this should be a centrepiece of motivation for this work (unless I have overlooked something).

Right now the manuscript focuses on a large set of experiments to empirically demonstrate the effectiveness of the method. What is missing is a more theoretically founded notion of privacy that can yield trustable guarantees. Nonetheless, the novelty of the ideas would still warrant acceptance.
review_title: Official Blind Review #3

final_score: rating: 6: Weak Accept
review_content: Abstract:
In this paper, the authors propose to hide information in phase of the input features. They proposed that if each layer of processing layer, sitting outside of the local unit, is phase preserving, then they can recover the phase back. They propose a modification to the most popular layers in DNN to satisfy that property.

I think the general idea of the paper is interesting, but overall, the paper is very poorly written. It appears that it is written in a rush. 

*The abstract and introduction are poorly written. There are poorly written sentences in the text. Here are some examples:
    + "... We propose a generic method to revise a conventional neural network to boost the challenge of adversarially inferring about the input but still yields useful outputs. ...."
    + "... given a transformed feature, an adversary can at best recover a number of features which contain at least another k − 1 features which are different but cannot be distinguished from the real feature.  ..." -- This is so central to the whole paper and it is not well-written. Personally, didn't understand this attack.
Please proofread your paper.

*Why do you need both theta and b ?  It seems to me if \| b \| is comparable to \| a \|, it can destroy the information in original the a arbitrary bad, so it makes sense to keep the norm of b small. However, in the paper, it is suggested to use a random sample (I') and set b = g(I'). I don't see any ablation study in the paper. There is no free lunch, if you provide stronger identity preservation, there should be a compromise in the accuracy, and it seems to be the magnitude of the b is that compromise. 

* The whole idea of the GAN encoder is not well justified. What does it mean that the fake feature should contain information "beyond" a ? This very vague.

* "Inference attack 1 " and "Inference attack 4" are the same; only the inference models used in each attack are different. I don't know why the author has separated them.   

review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: After rebuttal,

I really appreciate the authors' effort during the rebuttal, and most of my concerns are addressed well. 

===

Summary:

This paper proposed a complex-valued neural network to protect the input data from hidden features of DNNs. Specifically, the authors introduce (1) encoder: producing a complex-valued feature, (2) processing module:  extracting useful features for a decoder and (3) decoder: making a final decision from processed features. Using various deep architectures and datasets, the authors showed that the proposed method can hide the input data from hidden features while maintaining the performance of DNNs.

Detailed comments:

The research topic and main idea of this paper (i.e. introducing a complex-valued neural network for hiding sensitive input data) are interesting and the authors showed that the proposed idea indeed works well using various neural architectures and datasets. It would be more interesting if the authors can consider NLP datasets or other tasks instead of classification. Overall, the paper is well-written and the ideas are novel. 
review_title: Official Blind Review #2

Meta-review: The reviewers are unanimous in their opinion that this paper offers a novel approach to secure edge learning.  I concur.  Reviewers mention clarity, but I find the latest paper clear enough.
Decision: Accept (Poster)