Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: ########################################################################## Summary: The paper studies how to learn private representations that only captures the non-sensitive attributes of the dataset. They propose an adversarial representation learning method that employs VAEs. Specifically, the architecture in the VAE contains 6 players with 2 as adversarial classifiers. They introduce focal entropy as the objective function instead of entropy for adversarial classifiers to achieve deep sanitization. They empirically evaluate the method by reporting the target task accuracy and attribute inference accuracy on two datasets.

########################################################################## Reasons for score: I like the paper largely. It provides a nice practical method for sanitization, although it is hard to give theoretical privacy guarantees of VAEs. The method has shown to be a good defense for individual attribute inference attacks. My main concern is the experimental results are only on two datasets with one task/sensitive attribute setting. As an empirical/methodology paper, I would expect more empirical results. 

Also, I have a question regarding the sanitization section. It's not clear if focal entropy should be used in both $\tilde{T}$ and $\tilde{S}$. The paper mentioned "training of $\tilde{T}$ leverages a modification of entropy ..." However, I think it should be $\tilde{S}$ or both. It seems that Equation (6) should be negative KL divergence since we want to force the distribution to be close to the uniform distribution. 

########################################################################## Minor Comments:

1. In Equation (6), the bracket should be after $\theta$.

2. I don't think $\pi$ is clearly mentioned before Equation (9). The notation should be more precise.

 3. I'm guessing it can also protect the dataset-level (proprietary) attribute inference. I'm interested in seeing the results, but it is not required for this submission.
review_title: Review

final_score: rating: 6: Marginally above acceptance threshold
review_content: ## Summary
- The paper tackles the problem of adversarial representation learning i.e., to learn a low-dimensional representation of the image that encodes target-relevant non-sensitive information, but not (often correlated) sensitive information.
- The approach follows a VAE-based adversarial framework, with the core novelty being the use of maximizing focal entropy  (i.e., entropy among a set of similar attributes) over sensitive attributes in the representation.
- Evaluation performed on CIFAR100 and CelebA indicates that the approach outperforms similar baselines under certain conditions.

---

## Strengths

**1. Focal entropy**
- I appreciate the insight exploited by the authors -- to encourage representations with high entropy over a small set of correlated sensitive attributes

**2. Evaluation**
- I found the evaluation quite thorough. The paper compares with many recent baselines, demonstrates performances curves and additional analysis to explain the model's behaviour.

---

## Concerns

### Major Concerns

**1. Objective**
- There are a few things unclear to me in the objective (Eq. 1-6) and would appreciate if the authors clarified them.
- (a) I don't get the motivation for the two pairs of the classifiers $(T, S)$ and adversarial $(\tilde{T}, \tilde{S})$ that tries to simultaneously minimize/maximize both the target $p(a|z)$ and sensitive attributes $p(y|z)$.
- (b) Especially, I don't understand the reasoning behind having an adversarial loss on the target attribute -- shouldn't this be maximized in all cases?
- (c) I am also confused with the sanitization term (Eq. 6). In particular of why the sensitive attribute classifier $\tilde{S}$ is a function of the target attribute classifier $\tilde{\theta}_{tar}$?
- (d) The term $\phi_{\tilde{T}}$ appears to be undefined to complement Eq. 6.
- (e) It would also be nice if the authors extended Eq. 6 (which maximizes standard entropy) with the final objective to maximize focal entropy.
- (f) Is the VAE term (Eq. 5) necessary (esp. reconstruction)? After all, this appears as a secondary objective opposed to the primary objective of learning a representation $z$ which minimizes information leakage.

**2. Writing - Sec. 3**
- My issues in understanding can be partly attributed to the writing in Sec. 3, which I found difficult to follow for a few reasons.
- (a) Some terms seem to be overloaded e.g., two notations for encoder $q(x; \theta_E)$ and $E(x; \theta_E)$. I was also thrown off by many ways the components of the model/objective are conveyed: Losses $\phi_T$, parameters $\theta_T$, player $T$, adv. player $\hat{T}$, etc. I recommend finetuning the second paragraph on page 4.
- (b) While the architecture in Fig. 1 is designed to accompany the text, I find it somewhat incomplete and unclear. For one, there are six players/blocks in the proposed architecture. However, only the encoder and decoder are shown in the figure. Furthermore, while there are five loss terms, only four of them are shown in the figure. I am also not sure if the blue/red backgrounds in the residual and target streams code something in particular. Perhaps one solution is to split the figure into two: one for the architecture and another for information flow?

**3. Results**
- While the focal entropy makes sense to me (i.e., by increasing entropy over a small set of similar classes), I wonder if the results confidently back up that is it indeed better than related baselines.
- (a) The improvements seem somewhat marginal e.g., an improvement of 2% accuracy (Table 1) over prior work on both CIFAR100 and CelebA.
- (b) But what I find more revealing of the performance is the trade-off curve in Fig. 3b (thanks for the presenting this!). It appears that the proposed focal entropy approach (blue curve) outperforms Kernel-SARL (red curve) only for in a small operating range of high target accuracy. Overall it appears that MaxEnt-ARL and Kernel-SRL offers better trade-offs.


### Minor Concerns

**4. Decoder/Reconstruction**
- Since the task is to partly perform reconstruction as well, I find missing evaluation on how good the reconstructed samples are.

**5. Same equilibrium issues as before?**
- The introduction (second paragraph, p2) remarks that the adversarial min-max formulation of the problem has an issue that there is significant leakage if the optimization does not reach equilibrium.
- Wouldn't this be an issue in the proposed work as well?

### Nitpicks

**6. Some nitpicks**
- Please label the axes in Fig. 2.
- Not sure what this sentence means "increases the uncertainty in a more organic fashion" - please rephrase
- Typo in citation "Radovanovi263 et al. (2010)"
review_title: Blind Review

final_score: rating: 4: Ok but not good enough - rejection
review_content: Summary: This paper gives a method in the class of learning representations which have some information censored. In particular, the authors propose a setup where there are many “private” classes, and some classes are more similar than others – this maps (I think) onto the privacy setting, where each class is like one individual. They give a modification of an entropy loss, focal entropy, which is conducive to this type of learning, and show in experiments that this method can be successful.

I recommend reject due to a lack of clarity in the formulation, motivation, and writing of this paper. I think the idea has promise, the experiments are fine, and if correctly communicated can be a successful paper, but as it stands I found the paper pretty confusing and I’m not really sure what the method is for.

Strong points: 
-	The problem as I understand it is interesting and the work is well-situated in the privacy literature. 
-	Focal entropy seems like a good idea and as far as I know is novel as a loss. 
-	Experiments on CIFAR and CelebA demonstrate some good behaviours from this method, mostly beating baselines
-	Experiments are mostly good, decently thorough

Weak points and Clarifications:
-	The main weak point of this paper is the exposition and clarity – I find that the problem setup is not explained particularly well. Especially as someone who is more familiar with the fair representation learning literature, I get confused when the authors refer to a sensitive attribute, or private part of the data, in this setting – it seems to be a different notion than I am used to and it is never clearly defined. If I squint I can see how it maps onto privacy nicely but I would prefer if the authors make that clear.
-	The introduction could use a rewrite – it doesn’t set up the main points of the paper particularly clearly and leaves the reader a little confused. Consider stating more clearly off the top what the problem statement is, and move much of the content of p1 to related work
-	The motivation of “highly overlapping information” is pretty imprecise. Having read the paper I can kind of see what you’re getting at but it’s not clear – I think you mean instead information hierarchy? Sub and super classes
-	As far as I can tell the exact equation for focal entropy is never actually given? Let me know if I’m wrong
-	Figure 3b – you mentioned the better tradeoff in the high accuracy domain, but not what appears to be the worse tradeoff in the low accuracy domain. Is there anything I’m missing about understanding this figure?

Other feedback:
-	P2 “the solutions mentioned earlier can only meet its practical promises …” – need a citation for this or explanation
-	P2: explain these suboptimalities more, I’m not sure exactly what you’re referring to
-	P2: you bring up a “vast number of dissimilar classes” without explaining why that’s relevant – in much work we deal with binary attributes/classes
-	Eq 4: looks a lot like standard fair representation learning, so need to explain more clearly in motivation why it’s different
-	“Although maximization of entropy is sufficient for nonprivate attributes to minimize information leakage across representation partitions, we postulate that proper sanitization must be conducted w.r.t to focus classes in a similarity-aware fashion” – this sentence is very important to the paper, and I don’t quite understand any of it. If you work hard on this sentence (why do you postulate that? What is a focus class? Why would we ever consider similarity-awareness and what is that?) you’ll go a long way to clarifying your intro
-	Top of 3.2 – need to clarify what s is
-	Eq 7 – this makes it look like Y_similar is a set of tuples but I think you mean set of elements of Y?
-	“would like the entropy peak shifted such that uniformity wrt similar classes gets dominant” – this is another idea which is not being clearly communicated right now and seems central to this work
-	The “reweighting vector” is not introduced – not clear what we will do with it. You never actually show how this is included in the entropy calculation
-	Would like to see some sort of statistic on hubs, along with these pictures

review_title: I found the paper confusing, obscuring what might be a nice idea & experiments

final_score: rating: 5: Marginally below acceptance threshold
review_content: 
### Summary
This paper presented a method for learning private representations. This method is based on adversarial representation learning and the main technique contribution comes from focal entropy. The experimental results show that focal entropy can improve the accuracy of the target predictor without increasing adversarial accuracy.

### Pros
1. Focal entropy is effective in reducing the information leakage of the learned representation while improves the target accuracy over the state-of-the-art.
2. This paper covers a wide range of experiments.

### Cons
1. Some technique details are not presented clearly. I have listed some of them here:
   a. How to divide the representation $z$ encoded by the encoder into two sub-representations, namely, target and residual representations.
   b. There is a high-level description of focal entropy instead of equations.
2. Some notations are very confusing. For example, in the optimization goal (Equation (2)), the adversarial loss $\phi_{tilde{S}}$ is related to the parameter $\theta_{res}$. However, in the following description, this loss is related to $\theta_{tar}$(Equation (6))

### Comments
1. The optimization objective involves many individual terms. The experiments should further provide results to show how the trade-off parameters $\beta$ controls privacy leakage and target accuracy.
2. This work is done in an adversarial training manner, can leakage reduction be achieved in a differentially private training manner, i.e., training the encoder using dp-sgd?
review_title: Review 

Meta-review: This paper focuses on a notion of privacy in learning representations. 

One of the primary concerns of the reviewers was clarity of the writing and results. Numerous concerns are mentioned in the reviews, and also more engagement with the fairness literature was desired. One reviewer felt that some of the claims in the paper were unsubstantiated, for example: understanding the sanitization process in a human-understandable visual way", "integration of a notion of interpretability". It was felt that the changes required were more than could be expected for a camera ready version. The authors are recommended to revise the paper with a particular eye for clarity to a new reader.

The notion and measurement of privacy was also considered to be somewhat shaky. It is understood that the nature of privacy considered in this paper is different from differential privacy. That said, the latter is a rigorous definition, and the one in this paper seems to be rather empirical in nature. There are no formal guarantees in terms of privacy preservation, and it is not clear whether the representations could leak information when evaluated with a different network. As privacy is a mission-critical property, some justification of why the heuristic measurement of privacy is acceptable.

As a side note, the authors should consider using the \citep command for parenthetical citations in the text.
Decision: Reject