Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: Theoretically:
The paper is both conceptually and formally descriptive.  Combined with appendix details, the authors present a very full picture of their work, which is very much appreciated.  To the best of my knowledge, this appears to be a novel approach to the challenge of adversarial model reconstruction.


Experimentally:
Some experiments reside in the appendices that confirm utility of the theoretical basis of information laundering, however, I believe further experimentation would strengthen the paper significantly.

There appear to be multiple works (Tramer / Papernot / etc.) that provide different strategies for reconstructing private learning models.  A high-value experiment would be to test those methods on a model protected with the information laundering framework.

Additionally, there appear to be other techniques for safeguarding against model reconstruction efforts (some papers shared below).  A comparison between those and information laundering would help inform design decisions that practitioners/users are making about their machine-learning-as-a-service systems.  I’m left wanting to know how information laundering compares to other model-privacy protective measures.  A clear answer to that question would make the paper very strong, in my opinion.


Related work:
While submission length is always a limiting factor, I believe it may be worth mentioning a few other efforts.

‘Federated machine learning: concept and applications’ ACM 2019
Data privacy can be related to the topic of ‘Federated Learning’.  Mention in related work would provide an extra connection to the machine learning community for a security related problem setting.
 
There appear to be a few more model extraction techniques in literature than are mentioned in related work:

“Model reconstruction from model explanations” FAT* 2019
Swaps out prediction API for ‘explanation API’

“Membership inference attacks against machine learning models” IEEE 2017.
Under the assumption that the adversary has access to data, infer which samples make up training data, and use this information to reconstruct their own model.


Directly relevant related work:
Philosophically speaking, there are some direct competitors that are not addressed, in the sense that they are methods to safeguard against leakage / maintain model privacy.  I only argue that these should be addressed/discussed by the authors, not that these papers invalidate the authors' novelty claims.

“Model extraction warning in mlaas paradigm” ACM 2018 
“PRADA: protecting against DNN model stealing attacks” IEEE 2019

Both papers monitor queries and raise alarms when query distributions become adversarially-suspect.  Functionally, preventing adversarial queries but allowing benign queries solves the same problem as information laundering but without reducing utility for all users.  The question of interest would be whether these alarms can be sounded before meaningful information is recovered from the model.  I suspect information laundering provides a stronger safeguard against adversarially model reconstruction efforts than these warning systems, but experimental evidence would make the case even stronger.

Overall:
The paper reads very well.  Further experimentation would help relate information laundering to other related efforts, however, I believe the paper can stand on its own as more of a theoretical investigation rather than an empirical one.  For that reason, I believe the paper is strong enough for acceptance as-is.
review_title: A novel approach to a problem of growing interest.  Empirical comparisons to related works would improve the submission.

final_score: rating: 6: Marginally above acceptance threshold
review_content: Paper summary:
This paper aims to tackle the problem of model stealing/extraction, as in stealing a model that is deployed remotely, through API access. The threat model that they are aiming to protect against is not well-defined. The proposed method is information theoretic. They propose adding two modules (kernels) before and after the main deployed model, to "launder" information.  The loss function for achieving the desired modules consists of two main terms, for utility, and privacy of the model. The utility term tries to keep the expected value of the output being accurate high, while the privacy term (which are actually two terms for the two modules) try to decrease the MI between the true output/input and the laundered ones. They then offer an iterative approach for minimizing the loss. 

pros:
+ I like how the approach is model-agnostic, you don't seem to need to change the model, you just add some kernels. And it can be applied to any model.

+ The suggested approach is intuitive and sound. 

cons:
- The paper is not well-situated, given prior work. I am not completely familiar with the model stealing literature either, but with a search I found numerous papers since 2016 that either propose model stealing attacks, or mitigations. The paper does not qualitatively nor quantitatively compare their approach to any other prior protection approaches, such as [1], [2] or [3].   

- The paper does not conduct any ablation studies or experiments into the way their approach affects the model accuracy, and how effective it is to existing attacks, such as the Tramer et al. attack. This makes at really hard to evaluate the claims made about privacy and utility, in action.

- Mutual Information and Expected Value (used in the loss function) are both average notion. I wonder what this means for the provided protection. Would the model perform really badly on some few examples? would there be some sample inputs that could extract a big part of the model? I think a study of this, or at least a discussion would be very helpful.

One final note, it would be nice to have the threat model well-defined, it would really help better communicate what the protection is supposed to do, and what we should be expecting/not expecting of it. 

References
[1] Juuti M, Szyller S, Marchal S, Asokan N. PRADA: protecting against DNN model stealing attacks. In2019 IEEE European Symposium on Security and Privacy (EuroS&P) 2019 Jun 17 (pp. 512-527). IEEE.

[2] Orekondy T, Schiele B, Fritz M. Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks. InInternational Conference on Learning Representations 2019 Sep 25.

[3] Lee T, Edwards B, Molloy I, Su D. Defending against machine learning model stealing attacks using deceptive perturbations. arXiv preprint arXiv:1806.00054. 2018 May 31.


--------- Comments after reading the author response:
I thank the authors for adding the experiments and applying the suggested modifications! I have updated my score based on the changes and the clarifications made on the related work, and also the results of the mounted attacks. 
review_title: Interesting idea, not well-situated in the existing literature

final_score: rating: 7: Good paper, accept
review_content: Summary: This paper studies model privacy and its privacy and utility tradeoff. In particular, the authors proposed information laundered model where the input and output of the true model are perturbed.  The objective is to minimize the KL divergence between the true model and laundered model with mutual information between input and output as constraints. Theoretically, they show the optimal condition of the above optimization problem and provides an iterative algorithm.


Pros: 1. Model privacy is indeed an interesting problem. This paper is well written.


Questions: 1. The authors claim the proposed framework and algorithm can be also applied to continuous space. However, it is not clear to me how algorithm 1 would work in continuous space. 
review_title: This paper provides a new framework for model privacy

Meta-review: This clearly written paper has been constructively evaluated by three expert reviewers who provided at least two very detailed and informative summaries. The authors have addressed the inquiries raised by the reviewers in a comprehensive fashion, and at least one reviewer has updated their score as a result of those detailed rebuttals. In spite of some outstanding limitations, including a somewhat limited view of the relation of the proposed approach to existing alternatives, the reviewers are consistent in suggesting that this work is sufficiently mature to be considered for the inclusion in the program of ICLR 2021. I concur with that and recommend accepting this paper.
Decision: Accept (Spotlight)