Title: PRIVACY-PRESERVING REPRESENTATION LEARNING BY DISENTANGLEMENT

Abstract: Deep learning and latest machine learning technology heralded an era of success in data analysis. Accompanied by the ever increasing performance, reaching super-human performance in many areas, is the requirement of amassing more and more data to train these models. Often ignored or underestimated, the big data curation is associated with the risk of privacy leakages. The proposed approach seeks to mitigate these privacy issues. In order to sanitize data from sensitive content, we propose to learn a privacy-preserving data representation by disentangling into public and private part, with the public part being shareable without privacy infringement. The proposed approach deals with the setting where the private features are not explicit, and is estimated though the course of learning. This is particularly appealing, when the notion of sensitive attribute is "fuzzy". We showcase feasibility in terms of classification of facial attributes and identity on the CelebA dataset. The results suggest that private component can be removed in the cases where the the downstream task is known a priori (i.e., "supervised"), and the case where it is not known a priori (i.e., "weakly-supervised").

1. INTRODUCTION:

In recent years, learning with DNNs has brought impressive advances to the state-of-the-art across a wide variety of machine-learning tasks and applications. Yet, these approaches are generally only capable of significant performance leaps when large amounts of training data are provided for training purposes. However, building and curating such large data corpora comes with many strings attached. Firstly, it is cumbersome, expensive as well as time consuming to amass sufficient and foremost clean data. Apart from that, amassing large amounts of data increases the risk of privacy creep, i.e. subtly encoding privacy related information Narayanan & Shmatikov (2006) ; Backstrom et al. (2007) . In this regard, many datasets have been released into the public domain that are unintentionally permeated with private information about individuals, raising serious concerns about data privacy. In Narayanan & Shmatikov (2006) anonymization could be reversed by making use of publicly available data, e.g. movie reviews. In Wachinger et al. (2015) showed, that the surface of magnet resonance images (MRI) of the brain can be used to identify people potentially allow for unintended disease progression. Growing privacy concerns will entails the risk of becoming a major deterrent in the widespread adoption of machine learning and the attainment of their concomitant benefits. Therefore, reliable and accurate privacy-preserving methodologies are needed, which is why the topic lately has enjoyed increased attention in the research community.

Several efforts have been made in machine learning to develop algorithms that preserve user privacy while achieving reasonable predictive power. This is even more challenging in the client-server scenario. Therein, the clients are supposed to send information to the server, which in turn then performs operations such as training for the client. The crucial aspect in this case is about the client's confidential data. As an example, consider a set of clients that aim at collaboratively learning an attribute classifier on face images, while preserving the identities of the individuals. Ideally the trained model, which classifies non-sensitive attributes (e.g., having glasses or not) with high accuracy, at the same time fails in classifying sensitive attributes of them (e.g., gender).

A standard approach to address the privacy issue in the client-server setup is to anonymize the data of clients. This is often achieved by directly obfuscating the private part(s) of the data and/or adding random noise to raw data. Consequently, it is the noise level controlling the trade-off between predictive quality and user privacy (e.g., Differential Privacy Dwork (2006) ; Abadi et al. (2016) ). These approaches, associate a privacy budget with all operations on the dataset. Complex training procedures run the risk of exhausting the budget before convergence.

Another widely adopted solution is rely on encoded data representation. Following this notion, instead of the client's data a feature representation is transferred to the server instead. Unfortunately, the extracted features may still contain rich information, which can breach user privacy Osia et al. (2017; 2018) . Specifically, in the example above, an attacker can exploit the eavesdropped features to reconstruct the raw image, and hence the person on the raw image can be re-identified from the reconstructed image Mahendran & Vedaldi (2015) .In addition, the extracted features can also be exploited by an attacker to infer private attributes Salem et al. (2019) .

A recent solution to such a problem has been federated learning McMahan et al. (2016) ; Geyer et al. (2017) , which allows us to collaboratively train a centralized model while keeping the training data decentralized. The idea behind this strategy is that the clients transfer the training gradients of data to the server instead of the data itself. While such an approach is appealing to train a neural network with data hosted in different clients, it does not allow the use of a centralized model for making a prediction at test time. Furthermore, transferring the models between clients and server entails significant data transmission, which considerably prolongs training. What is more, averaging the gradients across the clients further slows the backpropagation.

Most importantly, all of the aforementioned methods are mainly applicable when the private attributes are known a priori. That his, these approaches typically fail to prevent privacy attacks when the private information contained in the dataset is not explicitly identified. Some scenarios also defy simple annotation of private content, e.g. imagery of military and civilian commodities. In such scenarios, it is highly desirable to automatically remove content that may be subject to sensitive information. This situation is further aggravated in domains such as low-shot learning with scarcity of training examples and associated privacy labels, entailing ambiguity w.r.t. sensitive features (i.e., sensitive features are the ones reveal privacy).

In this paper, we focus on the following fundamental questions: how can we learn representations of a dataset in order to minimize the amount of information which could be revealed about the identity of each client? The main goal is to enable an analyst to learn relevant properties (e.g. regular labels non-privacy infringing) of a dataset as a whole, while protecting the privacy of the individual contributors (private labels, which can identify a client). This assumes the database is held by a trusted server that can learn a privacy-preserving representations, i.e. by sanitizing the identityrelated information from the latent representation. Specifically, we postulate the decomposition of the latent representation into two latent factors: style and content. In this regard, style captures the private aspects of the data, whereas content encodes the public part. Thus, it is the public part that should be used for training downstream tasks as it can be transferred without compromising privacy. Following this notion, style encodes patterns that are shared among the samples of each client. In contrast to that, the content encodes information about concepts, which is shared across clients. Ultimately, this implies a disentanglement in the feature space in. private features and public features.

Our proposed method is built on top of the popular Variational Autoencoders (VAE) Kingma & Welling (2013) , where it used as core representation learning paradigm. VAE consists of two networks, namely an encoder and a decoder. The former maps a data sample to a latent representation, while the latter maps this representation back to data space. VAE networks are trained by minimizing a cost function that encourages learning a latent representation, which leads to realistic data synthesis while simultaneously ensuring sufficient diversity in the synthesized data. This is achieved by minimizing the distance between input and reconstruction subject to distributional regularization on the latent space. In addition, to the VAE entailed cost functions, we augment the loss space with additional terms namely "content classification loss" and "style confusion loss". In context of a supervised setup, the former is utilized to enforce for target predictability for a downstream task, while the latter encourage preserving the privacy. We show that, this two additional terms can enforce disentanglement of the private and public parts of the representation, as well utilization in context of weakly supervised scenario, where the downstream attributes are not known a priori.

In summary, the main contributions of this paper are the three-fold. First, we pose the privacypreserving representation learning problem as learning disentangled representations in a client- server setup. Second, we propose to learn disentangled representations from the client-level supervision by adding two novel loss terms to VAE. Third, we demonstrate experimentally that our proposed method learns a semantically meaningful privacy-preserving disentangled representation of client data. 2019) considered a formulation based on adversarial optimization between the encoding function and estimators for the private tasks. In our work, however, a completely different perspective on representation sharing is selected. We specifically propose a representation learning method, which facilitates disentanglement of private and public features at minimal additional training cost. This leads to a more privacy-preserving representation, while maintaining the method complexity at manageable level.

2. RELATED WORKS:

Most related to our paper is the work by Feutry et al. (2018) , which aims at learning representations that preserve the relevant part of the information while dismissing information about the private labels corresponding to the clients' identity. A key difference compared to this method is that they require labels for the downstream task during representation learning. In contrast to that, our setting allows for testing on unseen downstream tasks -see Sec. 

3. PROPOSED METHOD:

We want to learn representations that, beyond being private for a variety of sensitive attributes, can be adapted simply and compositionally for predicting many test-time task labels. We consider a twostage client-server learning, where in the first stage we learn a private representation of the data, and in the second stage, the actual downstream task is performed. Our approach to this problem involves learning a disentangled representation that allows for easy sensitization of latent representation in terms of privacy. Specifically, we isolate information about sensitive and non-sensitive attribute to separate subspaces, while ensuring that the latent space factorizes these subspaces independently. Naturally, depending on the assumptions related to the downstream task condition (if it is known a priori or not), we propose multiple variants. We consider the cases where the the downstream task is known a priori (i.e., supervised disentanglement), and the case where it is not know a priori (i.e., weakly-supervised disentanglement).

Ultimately, the goal is to learn

a representation z ∈ R m of data x ∈ R k with z = f (x) and m << k, which decomposes into two parts (z ∈ R m , z • ∈ R n ) = z,

where without loss of generality we assume m = n, representing the public and private information, respectively. Thereby, the public component should reveal as little as possible about sensitive information. That is we want to learn a function f that learns the representation s.t. z ⊥z • . Ideally, this representation has strong utility for a multitude of downstream tasks. To this end, we employ a Variational Auto-Encoder (VAE) Kingma & Welling (2013) in combination with regularization terms. The VAE serves the purpose that the input is compressed in a meaningful fashion. However, VAE alone does not consider learning a representation that is useful for downstream tasks or puts restrictions in terms of privacy of attributes or latent factors. Attaching additional constraints on the latent representation is non-trivial. This becomes even more challenging, if the downstream task is not known a priori Locatello et al. (2019) .

The proposed approach makes use of a vanilla VAE architecture that assumes isotropic Gaussian as latent prior p (z) = N (0, I) . Optimization of VAE entails maximization of the Evidence Lower Bound (ELBO) criterion,

EQUATION

where the first time is the reconstruction loss, and the second one the Kullback-Leibler divergence w.r.t. the prior distribution. Typically, the associated encoder q (z|x) and decoder q (x|z) functions are realized with Gaussians, whose parameters θ p , θ q are estimated using neural networks.

In order to facilitate disentanglement of the private and public component we utilize different multiple classification tasks. To this end we define a mapping based on a deep feed-forward architecture that takes as input the latent representation z and predicts a label y ∈ Y , defined as y = g (z, θ), which is parameterized by θ. Specifically, we distinguish between public and private attributes Y , Y • , respectively. The first objective is to predict the public and private labels based on their section of the latent representation. That is,

EQUATION

with the associated loss terms L θ (y , ỹ ), L θ• (y • , ỹ• ), which are typically realized with crossentropy.

An obvious solution is to just optimize the functional comprising the VAE together the classification terms, pushing for classification based on each latent sub-vector, yielding:

EQUATION

where λ . ∈ R represents a scaling parameter. However, following this notions leads to a presentation that does not fulfill z ⊥z • . That is, there is information leakage between the terms, particularly when the attributes to be classified are not strictly semantically disentangled. Generally speaking, the disentangled latent code should capture no more than one semantically meaningful factors of variation in the data w.r.t. private and public attributes, respectively. This is in particular problematic, when there is excess information capacity in the bottleneck layer generating the latent representation.

Thus, in order to push for disentanglement, we employ adding label confusion terms. This entails adding, additional classification terms. The underlying notion is that sensitive attributes should not be predictable from public ones. The follow-up step, depends on the boundary conditions for learning the downstream tasks. Therefore, we decompose the into two variants. The first variant, assumes that the downstream task is a priori know. This allows, for an optimal disentanglement of public and private information, such that sensitive content is not compromised. The specifics of this scenario are discussed in Sec. 3.1. On the other hand, if the downstream task is not a priori know, the objective is to learn a representation that does not contain sensitive information in the public part, and yet is rich in terms of expressive power for a multitude of tasks. This is discussed in Sec. 3.2.

3.1. SUPERVISED DISENTANGLEMENT: LEARNING WITH TASK AND CLIENT INFORMATION:

Consequently, we define the domain confusion classifiers according to,

EQUATION

which essentially assesses how well the private attribute can be derived from public latent part z and vice versa. As we, want to punish classifiability in the confused sense, we backpropagate in the negative gradient direction w.r.t.θ ¬ and θ ¬• . This yields the following,

EQUATION

where we simplified the terms for the sake of economy in notation. The first sum captures from Eq. 2, whereas the second one incorporates the confusion classifiers from Eq. 5. In case the information between public and private label are not perfectly uncorrelated, optimization of the Eq. 6 allows for trading-off privacy vs. performance by adjusting λ . parameters, accordingly.

3.2. WEAKLY-SUPERVISED DISENTANGLEMENT: LEARNING WITH CLIENT INFORMATION:

In this scenario, the downstream task is not known a priori. Only, the client level information is given. Therefore, we propose to perform a counter-directional optimization. That is, while promoting the classifiability of the private content in the private latent variable, we penalize for the classifiability in the public latent variable. This boils down, to adding a loss term w.r.t. following classification objective,

EQUATION

to the VAE loss of Eq. 1. Taken together, we yield following functional

EQUATION

which maximizes the information w.r.t. the sensitive label in the private latent part, and minimizes the information in the public latent part. This constraint is considerably weaker compared to Eq. 5.

However, it provides a general representation in absence of knowledge about future tasks. Furthermore, it assumes that the private and public are perfectly disentangled.

3.3. OPTIMIZATION:

Optimization of the joint cost function Eq. 6 and Eq. 8 is non-trivial. On the one hand, the confusion terms have a strong destructiveness. Giving too much emphasis on confusion bears the risk of eliminating all information and maximizing entropy. On the hand, too much suppression of confusion undermines the privacy aspects and reduces to the naive solution e.g. to Eq. 3. To this end, we propose to employ an annealing scheme. Specifically, in order to align the objectives, we perform pre-training without confusion. This allows, to learn a stable representation that allows for gentle modification, i.e. channeling of the information flow. Subsequently, we lower the scale factors λ , λ • , while at the same time increasing λ ¬ , λ ¬• . Tapering off the classification objective scales w.r.t. the confusion avoids oscillations and facilitates stable learning behaviour.

4. EXPERIMENTS:

We experimentally validate the proposed method using the MS-Celeb-1M dataset of celebrity face images Guo et al. (2016) . This dataset contains a large number of identities (people) with multiple observations of each. The "in-the-wild" nature of the celebrity face images offers a richer testbed for our method as both identities and contingent factors are significant sources of variation.

MS-Celeb-1M dataset. From the aligned face images in the MS-Celeb-1M dataset, we select all celebrities that are represented by at least 8 images. Individual images are resized to 128 × 128 pixels. We split the celebrities into subsets of 80% (training), 10% (validation) and 10% (test).

The split is created in such a way that all celebrities are present in all sets. This leads to dataset containing images from 8732 different actors and 40 facial attributes. We scale the pixel values to [1, 1], performing no additional pre-processing or data augmentation.

Implementation details. In order to learn the architecture, we employ Stochastic Gradient Descent (SGD) with momentum 0.9 and weight-decay of 1e-4 and a batch size of 96. The learning rate ranges between [0.0001, 0.1].

4.1. EVALUATION OF PRIVACY AND DOWNSTREAM TASKS:

We validate two variations of our proposed method:

Supervised Disentanglement. In this experiments, we perform learning of the private representation and the downstream task jointly, assuming the downsteam task is known a priori. To do so, the model is at first trained without confusion loss term enabled. Upon convergence, the confusion loss is enabled, pushing for disentanglement between public and private attributes, respectively.

Weakly-Supervised Disentanglement. In this experiments, we first learn of the private representation only using the client-level supervision, and later employ a classifier the downstream task, simulating the case where the downsteam task is unknown a priori. Similarly, to the supervised case, the model is initially trained without confusion loss. Upon convergence, the confusion loss is enabled to push the disentanglement w.r.t. the private attribute only.

In this regard, two aspects are evaluated. On the one hand, the classification accuracy of public and private attributes on their associated public and private section of the learned latent representation.

On the other hand, the domain confusion classifier accuracy is assessed as a degree of disentanglement. Lower accuracy in terms of domain confusion accuracy that is predictability of private labels from public latent space and vice versa, is an indicator for disentanglement.

As can be seen in Tab. 

4.2. ABLATION STUDY ON COMPONENTS OF THE METHOD:

In order to assess the contribution of each component, we assessed the performance of each module separately, gradually adding components for both supervised (see Tab. 4.2) and weakly supervised scenario (see Tab. 4.2), respectively.

First, the results indicate that learning a classifier directly on the VAE representation works to a certain degree on ID, and well on public attributes. Next, adding the classification term for both supervised and weakly-supervised scenario boosts the attribute and ID accuracy as expected. Simultaneously, high confusion accuracies in this configuration give clearly rise to missing disentanglement between the components. Subsequent adding the confusion team leads to a significant and desirable drop in accuracy w.r.t. confused classifier. However, whereas this significant drop appears to both public and private attributes in the supervised case, it only applies to the private attribute in the weakly-supervised case as expected. At the same time, classification accuracy on public attributes is barely affected by the confusion terms. What is more, although the classification accuracy drops on the the public (a priori unknown) attributes, it still performs at reasonable accuracy. See Fig. 2 for an illustration of the change behaviour in accuracy w.r.t. confused classifier. 

Method:



5. CONCLUSION:

The approach presented in this paper proposes an algorithm that yields a data representation that facilitates disentanglement into public and private components. The underlying notion is to make the public part shareable without privacy limitations. Subsequent, classification experiments confirm particularly strong performance in the fully-supervised scenario, where public attributes are known beforehand. What is more, classification utility of public shareable representation is also demonstrated in the challenging privacy aware scenario, when the downstream task is not known a priori. At the same time, results suggest that disentanglement is successful between the components. Future work will entail to further close the performance gap between the these the fully supervised and the privacy aware scenarios.

:



Figures and Tables:

Figure1: Our proposed method: (a) Schematic illustration of the general idea: Here we have two private information attributes (red and blue) and two public information attributes (circle and cross). The dashed line is a classifier trained in public information only. Our method, in solid line, both learns to classify the public information and preserve private information. (b) Our proposed architecture: the architecture is based on three sub-networks: one going from input to representation, one from representation to predicted regular labels, and one from representation to predicted private labels.

Figure 2: Confusion accuracy of different approaches. Blue indicates supervised approach, red semisupervised. Solid line is the accuracy on ID classification, dashed average accuracy on attributes.

clickstream event data, captured as they watch lecture videos in massive open online courses. InLi et al. (2019), the authors proposed an obfuscator that is designed to hide privacy related sensitive information from the features using adversarial training. Similarly, Kim et al. (2019) is based on adversarial learning, which encodes images to obfuscate the patient identity while preserving enough information for a medical segmentation task.Pittaluga et al. (

Table content: <table/>

At last, we note that our model is different from the federated learning methodology inMcMahan  et al. (2016);Geyer et al. (2017), which focuses on learning a decentralized private model by sharing gradient updates instead of representations. While we do not consider their framework here, our method could also be extended to those settings, leading to interesting future research directions. Other related works includeBouchacourt et al. (2018);Ganin & Lempitsky (2014);Creager et al.

Table content: <table><tr><td>(2019)</td></tr></table>

4.1, in the supervised setup explain in Sec. 3.1 demonstrates best performance in almost all categories, that is high classification accuracy and low accuracy for domain confusion. Performance assessment for different methods on CelebA on the test split.

Table content: <table><tr><td>Method</td><td>ID</td><td>Att.</td><td>¬ID</td><td>¬Att.</td></tr><tr><td>VAE (Kingma &amp; Welling (2013))</td><td>0.25</td><td colspan="2">0.881 -</td><td>-</td></tr><tr><td colspan="5">ML-VAE (Bouchacourt et al. (2018)) 0.155 0.884 0.153 0.882</td></tr><tr><td>Our Method (Weakly-Supervised)</td><td colspan="3">0.756 0.521 0.0</td><td>0.909</td></tr><tr><td>Our Method (Supervised)</td><td colspan="4">0.770 0.913 0.001 0.202</td></tr></table>

. loss + cls. loss + confusion loss) 0.770 0.913 0.001 0.202 Ablation analysis for our methods on CelebA on the test split in the supervised scenario.

Table content: <table><tr><td>ID</td><td>Att.</td><td>¬ID</td><td>¬Att.</td></tr></table>

Ablation analysis for our methods on CelebA on the test split in the weakly-supervised scenario.

Table content: <table/>

Peer review (iclr2020):
This paper investigates the use of variational auto-encoders (VAEs) and disentanglement to create high quality data representations that hide sensitive attributes. The authors consider two settings: (1) a supervised setting where both the sensitive labels and the downstream machine learning task labels are available to the data holder, and (2) a weakly supervised setting where only sensitive attributes are available. For both settings, the authors propose creating data representations that have 2 components: component 1 captures any information in the data bout the sensitive attributes, and component 2 captures everything else (especially the information useful for a downstream machine learning task). The goal is to ensure that these two components are disentangled. This is done by training classifiers on each component: 2 classifiers that try to reconstruct the sensitive attributes from each component separately (and in the supervised setting, 2 other classifiers that guess the downstream ML task from each component separately). The overall loss captures all components and ensures that one cannot reconstruct the sensitive attributes from component 2. Overall, the paper addresses an interesting and timely problem that is of great relevance to this community. However, despite being generally clear, the paper has many grammatical errors and typos. In its current shape, the paper cannot be published. More importantly, the paper has a number of issues that need to be improved: 1. The introduction makes a number of claims that are incorrect. For instance, the introduction claims that under differential privacy (and refers to Abadi et al.), machine learning models are learned from anonymized data and that complex training procedures run the risk of exhausting the budget before convergence. This is not true because under the classical setting of differential privacy, the models are trained on clean data BUT the process of learning is anonymized (see DP-SGD from Abadi et al.). More importantly, recent research and results in this space indicate that one can train high quality machine learning models with strong differential privacy guarantees (check McMahan et al. ICLR18: Learning Differentially Private Recurrent Language Models). Further, the authors claim that Federated Learning does not allow for the use of the trained model in a central setting. This is also not true because federated learning is an approach to train models on massively decentralized data -- in a way that is orchestrated by a service provider. The learned model can be used in a centralized or decentralized service. Moreover, the communication cost of training models under federated learning may be lower than communicating the data (several hundreds if not thousands of high resolution images) to a central service provider, so the claims about communication are not always correct. Finally, the authors claim that federated learning and differential privacy are useful when the private attributes are known a priori and these approaches fail to provide privacy protections when the private information contained in the dataset isn*t identified. This is wrong. Both approaches do not require the knowledge of private information. They, however, require the knowledge of the downstream machine learning task -- something that may not always defined a priori. 2. The privacy guarantees provided by the authors* approach are rather weak and unclear. (1) They assume that a trusted data holder already access to the dataset and wants to release private representations. In the supervised setting, why not just revealing the learned model? In the weakly supervised setting, where will the downstream machine labels come from? Are these representations released only for unsupervised learning tasks? This should be clarified -- and the experiments at the end should reflect this. (2) The privacy guarantees are with respect to (a) a computationally and statistically bounded adversary (i.e. there may very well be stronger adversaries with access to side information that can perfectly reconstruct the sensitive attributes), and (b) pre-defined sensitive attributes (i.e. there may be other sensitive attributes that one can learn from the published representations that are not captured by this framework). 3. The paper makes no attempt to properly survey the literature on learning representations under censorship and fairness constraints. For example, they do not reference and compare against: (a) Censoring Representations with an Adversary (https://arxiv.org/abs/1511.05897), (b) Learning Adversarially Fair and Transferable Representations (https://arxiv.org/abs/1802.06309), (c) Context-Aware Generative Adversarial Privacy (https://arxiv.org/abs/1710.09549), (d) Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints (https://arxiv.org/abs/1910.00411), and many others. Without a clear (empirical) comparison to these works, the benefits of the proposed approach are unclear. 4. The proposed method for disentanglement does not scale to non-binary sensitive attributes (because of the blowup in the number of classifier pairs that would need to be trained to ensure disentanglement). Thus, this approach may be limited to cases with a few sensitive attributes. 5. The authors are encouraged to show the learned representations (so that one could verify with the naked eye that the representations are indeed disentangling the sensitive attributes).