reviews: 
Comments: This paper considers the problem of developing ML models while considering all utility, fairness and privacy concurrently.
This paper takes an in-processing approach i.e., occurs during training as opposed to pre-processing or post-processing approaches.  The proposed method consists of a “predictor” and an “adversary” working as follows. The predictor model estimates the target label from non-sensitive features. The adversary model estimates the sensitive attribute based on the predictor's output. This paper propose a loss function that adjusts the predictor model such that it learns the primary task well without dependence on sensitive attributes.
Strengths: 1- Studying an important problem of developing ML models while considering all utility, fairness involving multiple sensitive attributes and privacy concurrently  
2- Experiments using two tabular datasets (Adult and COMPAS) with two sensitive attributes (race and sex) and a natural language dataset  with 4 sensitive attributes (age, gender, ethnicity, and country)
Weaknesses: 1- The contributions of this paper are limited as the proposed method is a straightforward combination of three existing works:
1) Adversarial debiasing  Zhang et al. (2018) that encourages the model to learn domain-invariant features by minimizing the success of an adversarial component that aims to predict sensitive attributes;
2) Fairness algorithms using differential privacy Jagielski et al. (2019) that injects DP into existing fairness algorithms;
3) Kang et al. (2022) that extends adversarial debiasing techniques to multiple sensitive attributes

In particular, this paper combines the above existing methods to i) debias multiple sensitive attributes; and ii) extend the privacy guarantees to all attributes as opposed to only sensitive attributes. I acknowledge and appreciate authors being honest on this front though.

2- Lack of fairness guarantees. It seems that the proposed method does not satisfy any fairness guarantees, it just minimizes the ability of a particular adversary model to predict sensitive attributes. This limitation is inherited from adversarial methods which cannot guarantee protection against other models than the one considered. 

3- Inconsistent and surprising results. After looking at Tables 2-4, the performance of DP and DP+bias is not intuitive to me:
1) Table 2 and Table 3 show that DP + Debias method achieves better performance than than DP method. This is surprising. 
2) However, Table 4 shows that DP + Debias achieves worse performance than DP method. Although this is expected, this is not consistent with the results of other datasets in Table 2 and Table 3. 

4- Shallow discussion of results. I would appreciate it if authors could analyse their results, this could help to shed light on the above #3 concern.

5- Some ambiguity in the algorithm and the proposed method. 
1) Is line 10 and 14 in algorithm 1 are done per-example? If not, how this follow the requirements of satisfying DP guarantees? 
2) The description of the projection part is missing therefore it is hard to understand why this projection does not break DP guarantees.

6- Experimental choices including hyperparameters and privacy budgets are not justified/studied. For example how sensitive the performance of the proposed method is to the value of the hyperparameter introduced by the proposed loss function. 

7- Overclaims. The abstract claims that the proposed method meets various fairness criteria. However, I can see only results of Equality of Odds and I think Section 2.1 confirms my concern as it says "In the current work, we adopt Equality of Odds (Hardt et al., 2016) as a definition of fairness". Section 4.5 also highlights that only Equality of Odds is considered for the evaluation.  

8- High computational costs. I would report computational costs to see the effect of the proposed method on the computational costs. If I understand correctly the proposed method computes per-example gradient for both predictor and adversary model, so I would expect an increase in the computational costs. 

9- Figure 1 is not referred in the text.

10- Lack of empirical comparisons with existing DP+fairness works. 

11- Unclear assumptions. For example, I would highlight/justify that this paper only considers group fairness and not individual fairness and a motivation for it.
Recommendation: 3: reject, not good enough
Reviewer confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness/correctness: 2 fair
Clarity: 2 fair