Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper utilizes a method called Adversarial Representation Learning (ARL) as a base. ARL 
learns a privacy-preserving encoding of sensitive user data before it is shared, but lacks formal guarantees. The authors link the local Lipschitz constant of a neural network in ARL (obfuscation layer) with its local sensitivity. Local sensitivity was used by the Propose-Test-
Release (PTR) framework to provide privacy guarantee, which the authors modify to work with the Lipschitz constant.
Experimentally on datasets verify the role of ARL in improving the privacy-utility tradeoff.
strength_and_weaknesses: Overall, I think this is a good paper with decent results, though the core of paper is a rather simple idea of relating Lipschitz constant to local sensitivity, other techniques are mostly borrowed from other papers.
There are terms used in Alg 1, which are defined after the algorithm, as as N. I feel the part after the algorithm can be stated first and then the algorithm.
Fig. 2 could have better legend for the colors for R.
I do not understand what the epsilon values are on the very first heading in Table 1
What is the encoder row?
clarity,_quality,_novelty_and_reproducibility: The writing in the experiments part is not good, the Tables and Figures are not explained enough.
The method seems novel, though simple.
summary_of_the_review: Good work, though simple extension. The writing can be better.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper presents a formal way to capture obfuscation of an image using adversarial representation. The paper does so by using a metric-based differential privacy notion. Since the metric is difficult to compute, the paper proposes a way to estimate Lipschitz constant using an estimation technique from DP. The paper then evaluates several obfuscation techniques on their utility.
strength_and_weaknesses: Strength:
- formalising privacy guarantees of obfuscators is an important research problem to avoid erroneous methods
- metric DP and PTR framework build on existing work

Weaknesses:
- adversarial model is not given
- the method relies on knowledge of the classifier which seems at odds with the usefulness of the approach (i.e., why call the classifier)
- metric-DP may not capture all privacy vulnerabilities (i.e., the privacy guarantee is as good as the metric that is used)
clarity,_quality,_novelty_and_reproducibility: The contribution and the method is well explained and the choices behind the approach are justified.
The adversarial model is not stated which makes it difficult to understand on who the paper is trying to protect against and at what stage. Who are the parties involved?
It seems that to compute the sensitivity, the obfuscator (i.e., the user) needs to know the classifier. However if it knows it, why would it then send its data for classification to the server in the first place?

It is not clear that hamming, l1 or l2 distance will guarantee privacy. Reconstruction of an image is not the only goal of an attacker.
summary_of_the_review: Given that there were unsuccessful attempts before on adhoc techniques to obtain image privacy by changing/randomizing the enbedding, this paper makes an attempt to provide formal guarantees to capture it. However, the method may not protect against all attacks and seems to rely on the knowledge of the classifier defeating the purpose of sending data for classification.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper presents a novel framework for providing post-hoc privacy for queries on models trained using Adversarial Representation Learning (or representation learning in general). The authors draw inspiration on traditional differential privacy (DP) based approaches and are able to provide formal post-hoc privacy guarantees under certain very strong assumptions. 
strength_and_weaknesses: Strengths: 
1) The paper presents a novel theoretically motivated approach to provide a privacy guarantee for queries on pre-trained representation learning models. 
2) The proposed framework is very similar to DP based approaches and has some properties similar to DP. 
3) The mathematical claims of the paper seem correct (based on my reading). 

Weakness: 
1) Definition of privacy: In Definition 1, semantic neighborhood privacy is also a function of $\theta$. So, it should be included in the definition. This unfortunately significantly weakens this notion of privacy. 
2) Identifying appropriate value of R: The authors state "To assess the level of indistinguishability, we look at Fig 3 where
we project the original images into embedding space and sample points from the boundary of
neighborhoods of different R. ". This simply isn't a reasonable approach to select a privacy parameter especially since it relies on humans perception of similarity. 
3) The authors don't really propose a practical way to select $\Delta_{LS}^p$. 
4) The authors state that the runtime exponentially increases as a function of embedding dimension, which is problematic. 
5) Related to weakness 4, the authors evaluate their runtimes on relatively small embedding dimensions. However, there are many use cases when the embedding dimensions are much higher (>1000). What is the feasibility of this approach for such embedding dimensions? I also have significant concerns about how meaningful the privacy guarantees are in the case of high dimensional embeddings. 
6) I would be interested in a privacy/utility comparison with DP based model training. 
clarity,_quality,_novelty_and_reproducibility: The paper is quite easy to read and the proposed approach is original. 
summary_of_the_review: While the proposed approach is somewhat well motivated, I think there are many potential issues with the proposed framework that significantly limit the utility of the framework to some very specific situations (low dimensional embeddings where the embedding space is sufficiently smooth). To their credit, the authors are quite upfront about the limitations of their framework but they overstate the utility in my opinion.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This paper proposes a narrow privacy definition, geared towards single-user responses. It leverages recent adversarial techniques and proposes a post-hoc analysis based on local sensitivity and propose test release. Although one reviewer was very negative about the paper, it seems that this partially stemmed from a misunderstanding.

Nevertheless, subsequent discussion showed that there are still some things that need to be clarified or made more precise, and in particular the threat model: It seems that the privacy guarantees do rely on the adversary not having access to the obfuscation mechanism, but this should be made clear in the paper, at the very least. The privacy implications of those assumptions are unclear, but they could make the construction weak overall.


justification_for_why_not_higher_score: The theoretical setting and privacy definition is rather narrow. The privacy definition is not clear enough.
Decision: Reject