A Variational Approach to Privacy and Fairness
Borja Rodrı́guez-Gálvez, Ragnar Thobaben, and Mikael Skoglund
Division of Information Science and Engineering (ISE)KTH Royal Institute of Technology{borjarg,ragnart,skoglund}@kth.se

Abstract
In this article, we propose a new variational approach to learn
private and/or fair representations. This approach is based on
the Lagrangians of a new formulation of the privacy and fairness optimization problems that we propose. In this formulation, we aim at generating representations of the data thatkeep a prescribed level of the relevant information that is notshared by the private or sensitive data, while minimizing theremaining information they keep. The proposed approach (i)exhibits the similarities of the privacy and fairness problems,(ii) allows us to control the trade-off between utility and privacy or fairness through the Lagrange multiplier parameter,and (iii) can be comfortably incorporated to common representation learning algorithms such as the VAE, the β-VAE,
the VIB, or the nonlinear IB.

1

Introduction

Currently, many systems rely on machine learning algorithms to make decisions and draw inferences. That is, theyuse previously existing data in order to shape some stageof their decision or inference mechanism. Usually, this datacontains private or sensitive information, e.g., the identity ofthe person from which a datum was collected or their membership to a minority group. Therefore, an important problem occurs when the data used to train such algorithms leaks
this information to the system, thus contributing to unfair decisions or to a privacy breach.
When the content of the private or sensitive informationis arbitrary and the task of the system is not defined, theproblem is reduced to learning private representations of
the data; i.e., representations that are informative of the data(utility), but are not informative of the private or sensitive information. Then, these representations can be employed byany system with a controlled leakage of private information.
If the level of informativeness is measured with the mutual
information, the problem of generating private representations is known as the privacy funnel (PF) (du Pin Calmon
and Fawaz 2012; Makhdoumi et al. 2014).
When the task of the system is known, then the aim
is to design strategies so that the system performs such atask efficiently while obtaining or leaking little information
about the sensitive data. The field of algorithmic fairness
Copyright c 2021, Association for the Advancement of Artificial
Intelligence (www.aaai.org). All rights reserved.

has extensively studied this problem, especially for classification tasks and categorical sensitive data; see, e.g., (Dwork
et al. 2012; Zafar et al. 2017; Chouldechova and Roth 2018;
Corbett-Davies and Goel 2018). An interesting approach isthat of learning fair representations (Zemel et al. 2013; Edwards and Storkey 2016; Zhao et al. 2020), where similarly
to their private counterparts, the representations are informative of the task output, but are not informative of the sensitive
information.
There is a compromise between information leakage andutility when designing private representations (Makhdoumi
et al. 2014). Similarly, in the field of algorithmic fairness, it
has been shown empirically (Calders, Kamiran, and Pechenizkiy 2009) and theoretically (Zhao and Gordon 2019)that there is a trade-off between fairness and utility.
In this work, we investigate the trade-off between utility
and privacy and between utility and fairness in terms of mutual information (details about the choice of mutual information in Appendix F). More specifically, we aim at maintaining a certain level of the information about the data (forprivacy) or the task output (for fairness) that is not sharedby the senstive data, while minimizing all the other information. We name these two optimization problems the conditional privacy funnel (CPF) and the conditional fairness
bottleneck (CFB) due to their similarities with the privacy
funnel (Makhdoumi et al. 2014), the information bottleneck(IB) (Tishby, Pereira, and Bialek 2000), and the recent conditional entropy bottleneck (CEB) (Fischer 2020).
We tackle both optimization problems with a variational
approach based on their Lagrangian. For the privacy problem, we show that the minimization of the Lagrangians of
the CPF and the PF is equivalent (see Appendix A.2), meaning that our variational approach attempts at solving the PF
as well. Moreover, this approach improves over current variational approaches to the PF by respecting the problem’sMarkov chain in the encoder distribution.
Finally, the resulting approaches for privacy and fairness
can be implemented with little modification to common algorithms for representation learning like the variational autoencoder (VAE) (Kingma and Welling 2013), the β-VAE(Higgins et al. 2017), the variational information bottleneck(VIB) (Nan and Tao 2020), or the nonlinear information bottleneck (Kolchinsky, Tracey, and Wolpert 2019). Therefore,
it facilitates the incorporation of private and fair representa-tions in current applications (see Appendix B for a guide on
how to modify these algorithms).
We demonstrate our results both in the Adult dataset,available at the UCI repository (Dua and Graff 2017), whichis commonly employed for benchmarking both tasks, and ahigh-dimensional toy dataset, based on the MNIST handwritten digits dataset (LeCun et al. 1998). Further experiments on the COMPAS dataset (Dieterich, Mendoza, andBrennan 2016) can be found in Appendix D.

2

Methods

In this section we give an overview of our approach. First,
we introduce our proposed model for the privacy and fairness problems. Then, we present a suitable Lagrangian formulation. Finally, we describe a variational approach tosolving both problems.

2.1

Problem formulation

Privacy formulation: the conditional privacy funnel(CPF) Let us consider two random variables X ∈ X andS ∈ S such that I(X; S) > 0. The random variable X represents some data we want to share, and the random variable
S represents some private data. We wish to disclose the dataof interest X; however, we do not want the receiver of thisdata to draw inferences about the private data S. For this reason, we encode the data of interest X into the representation
Y ∈ Y, forming the Markov chain S ↔ X → Y .
This encoding, characterized by the conditional probability distribution PY |X , is designed so that the representation
Y keeps a certain level r of the information about the dataof interest X that is not shared by the private data S (i.e., thelight gray area in Figure 1a), while minimizing the information it keeps about the private data S (i.e., the dark gray areain Figure 1a). That is,
arg inf {I(S; Y )} s.t. I(X; Y |S) ≥ r.
PY |X

Y keeps a certain level r of the information about the task
output T that is not shared by the private data S (i.e., thelight gray area in Figure 1b), while minimizing both the information it keeps about the private data S and the information about X that is not shared with the task output T (i.e.,the dark and darker gray areas in Figure 1b, respectively).
That is,arg inf {I(S; Y ) + I(X; Y |S, T )} s.t. I(T ; Y |S) ≥ r.
PY |X

(2)
This formulation differs from other approaches to fairness
mainly in two points: (i) Similarly to the IB (Tishby, Pereira,and Bialek 2000), the CFB does not only minimize the information the representations Y keep about the sensitive dataS, but also minimizes the information about X that is not
relevant to draw inferences about T . That is, the CFB seeks
representations that are both fair and relevant, thus avoiding
the risk of keeping nuisances (Achille and Soatto 2018) andharming their generalization capability. (ii) Similarly to the
CEB (Fischer 2020), the CFB aims to produce representations Y that keep a certain level r of the information about
the task T that is not shared by S. This differs from formulations that aim at producing representations that maintain acertain level r0 of the information about T , regardless if it isalso shared by the sensitive data S.

(a) Conditional privacy funnel(1)

The main difference with the privacy funnel formulation(Makhdoumi et al. 2014) is that, even though both formulations minimize the information the representation Y keeps
about the private data S, in the PF the encoding is designed
so that Y keeps a certain level r0 of the information about
X, regardless if this information is also shared by S. Hence,even though the minimization of the Lagrangians of bothproblems is equivalent, the Lagrangian optimization of the
CPF does not allow representations Y of X that filter private information arbitrarily (see Appendix A.2).
Fairness formulation: the conditional fairness bottleneck (CFB) Let us consider three random variables X ∈X , S ∈ S, and T ∈ T such that I(X; S) > 0 and I(S; T ) >0. The random variable X represents some data we want to
use to draw inferences about the task T . However, we do notwant our inferences to be influenced by the sensitive data
S. For this reason, we first encode the data X into a representation Y ∈ Y, which is then used to draw inferences
about T . Therefore, the Markov chains S ↔ X → Y andT ↔ X → Y hold.
This encoding, characterized by the conditional probability distribution PY |X , is designed so that the representation(b) Conditional fairness bottleneck

Figure 1: Information Diagrams (Yeung 1991) of (a) the conditional privacy funnel and (b) the conditional fairness bottleneck. In light gray, the relevant information we would likeY to keep. In dark and darker gray, the sensitive and irrelevant information, respectively, we would like Y to discard.

2.2

The Lagrangians of the problems

A common approach to solving optimization problems suchas the CPF or the CFB is to minimize the Lagrangian of
the problem. The Lagrangian is a proxy of the trade-off between the function to optimize and the constraints on the
optimization search space (Boyd, Boyd, and Vandenberghe
2004, Chapter 5). Particularly, the Lagrangians of the CPF

and the CFB are, ommiting the constant term λr in the optimization w.r.t. PY |X , respectively,
LCPF (PY |X , λ) = I(S; Y ) − λI(X; Y |S) and(3)

LCFB (PY |X , λ) = I(S; Y ) + I(X; Y |S, T ) − λI(T ; Y |S),(4)
where λ > 0 ∈ R is the Lagrange multiplier of the Lagrangian. This multiplier controls the trade-off between theinformation the representations Y discard and the information they keep. Note that if λ ≤ 0 the optimization only
seeks for maximally compressed representations Y . Hence,trivial encoding distributions like a degenerate distribution
PY |X with density pY |X = δ(Y ) minimize the Lagrangian.
If we look at the information diagrams (Yeung 1991)
of the CPF and the CFB from Figure 1, we observe how
LCPF (PY |X , λ) and LCFB (PY |X , λ), by means of the multiplier λ, exactly control the trade-off between the information
we want the representations to keep (i.e., the light gray area)
and all the other information (i.e., the dark gray area).
In the following propositions, proved in Appendix A.1,
we present two alternative Lagrangians that can be minimized instead of the original problem Lagrangians in order to obtain the same result. These Lagrangians are more
tractable and exhibit similar properties and structure in theprivacy and fairness problems.
Proposition 1. Minimizing LCPF (PY |X , λ) is equivalent tominimizing JCPF (PY |X , γ), where γ = λ + 1 and
JCPF (PY |X , γ) = I(X; Y ) − γI(X; Y |S).

(5)

Proposition 2. Minimizing LCFB (PY |X , λ) is equivalent tominimizing JCFB (PY |X , β), where β = λ + 1 and
JCFB (PY |X , β) = I(X; Y ) − βI(T ; Y |S).

(6)

The minimization of JCPF (PY |X , γ) and JCFB (PY |X , β),by means of γ and β, trades off the level of compression of
the representations with the information they keep, respectively, about X and T that is not shared by S.

2.3

The variational approach

We consider the minimization of JCPF (PY |X , γ) and
JCFB (PY |X , β) to solve the CPF and the CFB problems.
Furthermore, we assume that the probability density functions (or probability mass function if |Y| is countable) pY |X
that describe the conditional probability distribution PY |X
exist and are parameterized by θ, i.e., pY |X = pY |(X,θ) .
The Markov chains of the CPF and the CFB establish thatthe variables’ joint densities are factored as p(S,X,Y )|θ =p(S,X) pY |(X,θ) and p(S,T,X,Y )|θ = p(S,T,X) pY |(X,θ) , respectively. The densities p(S,X) and p(S,T,X) can be inferredfrom the data and the density pY |(X,θ) is to be designed.
The term I(X; Y ) depends on the density pY |θ , which
is usually intractable. Similarly, the terms I(X; Y |S) andI(T ; Y |S) depend on the densities pX|(S,Y,θ) and pT |(S,Y,θ) ,respectively, which are also usually intractable. Therefore,(a) Variational conditional privacy funnel(b) Variational conditional fairness bottleneck

Figure 2: Graphical models of (a) the variational CPF and (b)the variational CFB. The solid line represents the data density p(S,X) . The dashed lines represent the encoding densitypY |(X,θ) and the variational marginal density of the representations qY |θ . The dotted lines represent (a) the generative
qX|(S,Y,φ) or (b) the inference qT |(S,Y,φ) variational densities. The encoding and the (a) generative or (b) inference
parameters (i.e., θ and φ, respectively) are jointly learned.
an exact optimization of θ would be prohibitively computationally expensive. For this reason, we introduce thevariational density approximations qY |θ , qX|(S,Y,φ) , andqT |(S,Y,φ) , where the generative and inference densities areparametrized by φ. This variational approximation leads to
the graphical models displayed in Figure 2. Then, as previously done in, e.g., (Kingma and Welling 2013; Alemi
et al. 2016; Kolchinsky, Tracey, and Wolpert 2019), weleverage the non-negativity of the Kullback-Leibler divergence (Cover and Thomas 2006, Theorems 2.6.3 and 8.6.1)
to bound JCPF (PY |X , γ) and JCFB (PY |X , β) from above.
More precisely, we find an upper bound on I(X; Y ) and alower bound on both I(X; Y |S) and I(T ; Y |S), i.e.,
I(X; Y ) ≤ EpX DKL pY |(X,θ) ||qY |θ ) ,
(7)

 
qX|(S,Y,φ), and (8)I(X; Y |S) ≥ Ep(S,X,Y )|θ log
pX|S
 

qT |(S,Y,φ)I(T ; Y |S) ≥ Ep(S,T ,Y )|θ log
.
(9)
pT |S
Finally, we can jointly learn θ and φ through gradient descent. First, we note that the terms Ep(S,X) [log pX|S ] andEp(S,T ) [log pT |S ] do not depend on the parametrization,and can therefore be discarded from the optimization. Second, we leverage the reparametrization trick (Kingma andWelling 2013), which allows us to compute an unbiased estimate of the gradients. That is, we let pY |X dY = pE dE,
where E is a random variable and Y = f (X, E; θ) is a deterministic function. Lastly, we estimate p(S,X) and p(S,T,X)

as the data’s empirical densities.
 (i) (i)  N
In practice, if we have a dataset D =x ,si=1
 (i) (i) (i)  N
for the CPF or D = x , s , t
for
the
CFB,
we
i=1
minimize, respectively, the following cost functions:N
1 X
DKL pY |(X=x(i) ,θ) ||qY |θJ˜CPF (θ, φ, γ) =
N i=1
h 
i
− γEpE log qX|(S=s(i) ,Y =f (x(i) ,E),φ) (x(i) )

(10)
N

1 X
DKL pY |(X=x(i) ,θ) ||qY |θJ˜CFB (θ, φ, β) =
N i=1
h 
i
− βEpE log qT |(S=s(i) ,Y =f (x(i) ,E),φ) (t(i) ) ,(11)
where the expectation over E ∈ E is usually estimatedwith a naive Monte Carlo of a single sample; i.e., the expectation of g(E) : E 7→ R is estimated as EpE [g(E)] ≈
PL
1
(l)
(l)
∼ pE and L = 1.
l=1 g( ), where LAn a posteriori interpretation of this approach is that if theencoder compresses the representations Y assuming that the
decoder will use both Y and the private or sensitive data S,
then the encoder will discard the information about S contained in the original data X in order to generate Y .
Remark 1. Note that the resulting cost functions for the
CPF and the CFB ressemble those of the VAE (Kingma andWelling 2013), the β-VAE (Higgins et al. 2017), the VIB(Alemi et al. 2016), or the nonlinear IB (Kolchinsky, Tracey,and Wolpert 2019). Let us consider the (common) case thatthe decoder density is estimated with a neural network. Ifsuch a network is modified so that it receives as input both
the representations and the private or sensitive data insteadof only the representations, then the optimization of these algorithms results in private and/or fair representations (seeAppendix B for the details).

3
3.1

Related Work

Privacy

If the secret information S is the identity of the samples
or their membership to a certain group, the field of differential privacy (DP) provides a theoretical framework fordefining privacy and several mechanisms able to generate
privacy-preserving queries about the data X and explore
such data, see, e.g., (Dwork, Roth et al. 2014). If, on theother hand, the secret information is arbitrary, variants ofDP such as (Dwork et al. 2006, Bounded DP) and (Kiferand Machanavajjhala 2011, Attribute DP) or the theoreticalframework introduced in (du Pin Calmon and Fawaz 2012)
are commonly adopted. The privacy funnel (Makhdoumi
et al. 2014) is a special case of the latter, when the utility
and the privacy are measured with the mutual information.
The original greedy algorithm to compute the PF(Makhdoumi et al. 2014) and other methods that attempt
at learning non-parametric encoding densities pY |X such as(Romanelli, Palamidessi, and Chatzikokolakis 2019) assume
the data is discrete or categorical and do not scale. For thisreason, approaches that take advantage of the scalability of
deep learning emerged. For instance, Edwards and Storkey(2016) and Hamm (2017) learn the representations throughadversarial learning but are limited to S ∈ {0, 1} and do notoffer an information theoretic interpretation. Similar to us, inthe the privacy preserving variational autoencoder (PPVAE)(Nan and Tao 2020) and the unsupervised version of thevariational fair autoencoder (VFAE) (Louizos et al. 2016)
they learn such representations with variational inference.
At their core, the PPVAE and the unsupervised VFAE end
up minimizing the cost functions
JPPVAE (θ, φ, η) = Ep(S,X)|θ [DKL (pY |(S,X,θ) ||qY |θ )]− η −1 Ep(S,X,Y )|θ [log(qX|(S,Y,φ) )](12)

and JVFAE (θ, φ, δ) = JPPVAE (θ, φ, 1)+δJMMD (θ, φ), where
JMMD (θ, φ) is a maximum-mean discrepancy term. Even
though the resulting function to optimize is similar to ours, it
is important to note that the encoding density in these works
is pY |(S,X,θ) , which does not respect the problem’s Markov
chain S ↔ X → Y . Therefore, the optimization search
space includes representations Y that contain information
about the private data S that is not even contained in theoriginal data X. Moreover, the private data S is needed togenerate the representations Y , which is problematic since
it might not be available during inference.

3.2

Fairness

The field of algorithmic fairness is mainly dominated by
the notions of individual fairness, where the sensitive data
S is the identity of the data samples, and group fairness,where S is a binary variable that represents the membership of the data samples to a certain group. There are several approaches that aim at producing classifiers that ensure either of these notions of fairness; e.g., discriminationfree naive Bayes (Calders, Kamiran, and Pechenizkiy 2009),
constrained logistic regression, hinge loss, and support vector machines (Zafar et al. 2017), or regularized logistic regression through the Wasserstein distance (Jiang et al. 2019).
Other lines of work on algorithmic fairness are basedon causal inference (Kilbertus et al. 2017; Kusner et al.
2017; Madras et al. 2019) and data massaging (Kamiran and
Calders 2010), where the values of the labels of the training
data are changed so that the training data is fair.
The notion of fair representations, introduced by Zemel
et al. (2013), boosted the advances on algorithmic fairness
due to the expressiveness of deep learning. These advances
are mainly dominated by adversarial learning (Zemel et al.
2013; Edwards and Storkey 2016; Zhao et al. 2020), eventhough there are recent variational approaches, too (Louizos
et al. 2016; Creager et al. 2019).
The main differences with the variational approach from
Creager et al. (2019) are our simple cost function (which
does not require to train an additional adversary discriminator) and that we discard the information that is not necessary to draw inferences about T . They generate two representations, Ysens and Ynon-sens , that contain the information

shown in Figures 4a and 4b, it also controls the amount of
information the representations keep about the private data,
I(S; Y ), which was estimated with MINE (Belghazi et al.
2018).

20

210

H(X|S, Y)

H(X|S, Y)

about the sensitive data and the original data, respectively,
without taking into account the task at hand. At inferencetime, the sensitive representations Ysens are corrupted withnoise or discarded, and thus the non-sensitive representations Ynon-sens from (Creager et al. 2019) serve a similar purpose to the representations Y obtained with our approach.
Compared to the variational fair autoencoder (Louizos et al.
2016), our encoding density does not require the sensitive information S, which might not be available during inference,thus not breaking the Markov chain S ↔ X → Y .

22

Adult dataset The Adult dataset (available at the UCI machine learning repository (Dua and Graff 2017)) contains
45, 222 samples from the 1994 U.S. Census. Each sample
comprises 15 features such as, e.g., gender, age, income
level (binary variable stating if the income level is higher orlower than $50, 000), or education level. For both tasks, wefollowed the experimental set-up from Zemel et al. (2013),
where S is the gender and X is the rest of the features. For
the fairness task, we considered T to be the income level.
Toy dataset: Colored MNIST The MNIST dataset (LeCun et al. 1998) is a collection of 70, 000 grayscale 28 × 28
images of hand-written digits from 0 to 9. The Colored
MNIST is a modification of the former dataset where each
digit is randomly colored in either red, green, or blue. We
considered X to be the 3 × 28 × 28 digit images, S to be thecolor of the digit, and T to be digit’s number.

4.1

230

Results

PrivacyIn the privacy task, the proposed approach is able to control the trade-off between private and informative representations for both the Adult and the Colored MNIST datasets.
We minimized (10) for different values of γ ∈ [1, 50],thus controlling the trade-off between the compression levelI(X; Y ) and the informativeness of the representations independent of the private data I(X; Y |S) , as shown in Figures 3a and 3b. Therefore, as suggested by Proposition 1 and

0

20

40

60

I(X; Y)

50

(a)

100

150

I(X; Y)

200

250

(b)
3

0.25
0.20
0.15

I(T; Y|S)

I(T; Y|S)

In this section, we present experiments on two datasets toshowcase the performance of the presented variational approach to the privacy and fairness problems. First, we show
the performance in a dataset commonly used for benchmarking both tasks. Second, we show the performance on highdimensional data on a toy dataset designed for this purpose.
The encoder density is modeled with an isotropic Gaussian distribution, i.e., pY |(X,θ) = N (Y ; µenc (X; θ), σθ2 Id ),so that Y = µenc (X; θ) + σθ E, where E ∼ N (0, Id ), µenc
is a neural network, and d is the dimensionality of the representations. The marginal density of the representations is
also modeled as an isotropic Gaussian qY |θ = N (Y ; 0, Id ).
Finally, the decoder density, qX|(S,Y,φ) or qT |(S,Y,φ) , is modeled with a product of categorical (for discrete data) and/or
isotropic Gaussians (for continuous data), e.g., qX|(S,Y,φ) =Cat(X1 ; ρdec (Y, S; φ))N (X2 ; µdec (S, Y ; φ), σφ2 ) if X consists of a discrete variable X1 and a continuous variable X2 .
The experiments are detailed in Appendix D.

220
225

24

4

215

0.10

2

1

0.05
0.00

0
0.0

0.5

1.0

1.5

I(X; Y)

(c)

2.0

2.5

0

5

10

I(X; Y)

15

20

(d)

Figure 3: Trade-off between the representations’ compression I(X; Y ) and the non-private information retainedI(X; Y |S) for the (a) Adult and the (b) colored MNIST
datasets with γ ∈ [1, 50]. Since I(X; Y |S) = H(X|S) −H(X|S, Y ) and H(X|S) does not depend on Y , the reported quantity is −H(X|S, Y ). Moreover, trade-off between the compression of the representations I(X; Y )and the non-sensitive information retained about the task
I(T ; Y |S) for the (c) Adult and the (d) colored MNIST
datasets with β ∈ [1, 50]. The dots are the computed empirical values and the lines are the moving average of the 1D
linear interpolations of such points.
As an illustrative example, we constructed a representation of the same dimensionality, i.e., 3 × 28 × 28, of thehand-written digits by minimizing (10) and setting γ = 1.
This representation is both informative and private, as shownin Figures 5b and 5d. In Figure 5d, the 2-dimensional UMAP
(McInnes et al. 2018) vectors of the representations are mingled with respect to their color, as opposed to the UMAP
vectors of the original images, where the vectors are clustered by the color of their images (see Figure 5c).
Compared to the variational approaches to the PF (Nanand Tao 2020, PPVAE) and (Louizos et al. 2016, VFAE), theproposed approach performed better in terms of information
leakage I(S; Y ) and accuracy of non-linear attackers (seeTable 1). More specifically, the leaked mutual information isabout an order of magnitude lower than the obtained in theother methods and the accuracy of a random forest attacker
is below the prior probability (0.67), while the other methods
allow successful attacks of 0.8 – 0.9 accuracy. A possible
explanation for this phenomenon is that some information
about S is leaked to Y via the encoding density pY |(S,X,θ) ,which does not respect the Markov chain S ↔ X → Y .

Table 1: Random forest attacker’s accuracy and mutual information between the sensitive S and representation Y variables on the Adult dataset. The PPVAE and VFAE parameter
ranges are η −1 ∈ [1, 50] and δ ∈ [Nbatch , 1000Nbatch ].
Methods

Attacker’s accuracy (S)I(S; Y )

Ours
PPVAE
VFAE

0.60 – 0.64
0.79 – 0.93
0.81 – 0.95

0.01 – 0.08
0.29 – 0.63
0.28 – 0.44

I(S; Y)

0.04

2

1

1

0.10

0

0

0.05

0.02

(c)

0.00
0

1

2

ln( )

3

4

0

1

(a)

2

ln( )

3

Figure 5: Random samples of Colored MNIST (a) original
data and (b) private representations and their UMAP dimensionality reduction (c and d, respectively). In the UMAP dimensionality reduction, each vector point is colored with thesame color the digit was. Results obtained for γ = 1.

(b)
0.10
0.08

I(S; Y)

0.04
0.02

0.06
0.04

0.00

0.02
0

1

2

ln( )

(c)

3

4

(d)

4

0.06

I(S; Y)

2

0.15

0.06

0

1

2

ln( )

3

4

(d)

Figure 4: Behavior of the private information I(S; Y ) kept
by the private representations in the (a) Adult and (b) the
Colored MNIST datasets with γ ∈ [1, 50]; and by the fair
representations in the (c) Adult and (d) the Colored MNIST
datasets with β ∈ [1, 50]. The dots are the computed empirical values and the lines are the moving average of the 1D
linear interpolations of such points.

4.2

(b)

0.20

0.08

I(S; Y)(a)

Fairness

In the fairness task, our proposed variational approach isalso able to control the trade-off between fair and accurate
representations. We minimized (11) for different values ofβ ∈ [1, 50], thus controlling the trade-off between the compression level I(X; Y ) and the predictability without thesensitive variable I(T ; Y |S), as shown in Figures 3c and 3d.
Moreover, as suggested by Proposition 2 and shown in Figures 4c and 4d, we also control amount of information thatthe representations retain about the sensitive data I(S; Y ),which was estimated with MINE (Belghazi et al. 2018).
Furthermore, in the Adult dataset, the Lagrange multiplier
β allows us to control the behavior of different utility andgroup fairness indicators (defined in Appendix E), namely
the accuracy, the error gap, and the discrimination (or demographic parity gap). That is, the higher the value of β, thehigher the accuracy and the discrimination, and the lower
the error gap (Figures 6a, 6b, and 6d). The behavior of thediscrimination is enforced by the minimization of I(S; Y ),as discussed in Remark 4 from Appendix E. However, there
is no clear indication of the effect of β on the accuracy ofadversarial predictors on the sensitive data (which is still below the prior probability of the biased training dataset) andon the equalized odds (Figures 6e and 6c). The equalized
odds are not optimized in this scenario since the resulting
representations Y are such that I(S; Y ; T ) < 0 as discussed
in Remark 5 from Appendix E. An example when the equalized odds gap is minimized is presented in Appendix D.
The representations generated from the proposed method
are more robust to non-linear adversaries (as shown in Table 2 by the smaller accuracy on S and smaller discrimination when the adversary employs a random forest) than thestandard baseline from Zemel et al. (2013, LFR). Comparedwith other state-of-the-art methods, either those which employ variational inference (Creager et al. 2019, FFVAE) or
adversarial training (Zhao et al. 2020, CFAIR), the proposed
method for generating fair representations achieves similar
results (as shown in Table 2), albeit having an easier costfunction and requiring to train less networks, respectively.

5

Discussion

In this article, we studied the problem of mitigating the leakage of private or sensitive information S into data-driven
systems through the training data X. We formalized thetrade-off between the relevant information for the systemthat is not shared by the private or sensitive data S and theremaining information as a constrained optimization problem. When the task of the system is known, the problem isreferred to as learning fair representations and the formalization is the conditional fairness bottleneck (CFB); and when
the task is unknown, the problem is referred to as learning
private representations and the formalization is the condi-

Table 2: Fairness metrics with different methods on Adult dataset. Displayed as: Logistic regression / Random forest. The best
hyperparameters for the other methods have been selected (see Appendix D). These models and compared to our model withthe hyperparameters that reaches the most similar performance.
Methods

Accuracy (T)Accuracy (S)Discrimination

Error gap

EO gap

LFR (Zemel et al. 2013)
Ours (β = 17.0)

0.84 / 0.84
0.82 / 0.80

0.66 / 0.98
0.66 / 0.62

0.07 / 0.16
0.08 / 0.08

0.10 / 0.12
0.12 / 0.13

0.18 / 0.07
0.09 / 0.09

FFVAE (Creager et al. 2019, α = 200)
CFAIR (Zhao et al. 2020, λ = 1000)
Ours (β = 1.96)

0.77 / 0.75
0.77 / 0.71
0.76 / 0.72

0.67 / 0.61
0.69 / 0.65
0.67 / 0.61

0.00 / 0.01
0.02 / 0.01
0.00 / 0.00

0.17 / 0.12
0.17 / 0.12
0.19 / 0.15

0.04 / 0.04
0.02 / 0.04
0.00 / 0.00

0.15
Discrimination

Accuracy (T)

0.850
0.825
0.800
0.775
0.750
0.725

0.10
0.05
0.00

0

1

2

3

ln( )

4

0

1

4

5.1

0.20

0.20

Limitations and future directions

0.18

0.15
0.10
0.05

0.16
0.14
0.12

0.00
0

1

2

3

ln( )

0.10

4

(c)

Accuracy (S)3(b)

Error Gap

Equalized Odds Gap

(a)

2

ln( )

mentation of common algorithms such as the VAE (Kingma
and Welling 2013), the β-VAE (Higgins et al. 2017), the VIB(Alemi et al. 2016), or the nonlinear IB (Kolchinsky, Tracey,and Wolpert 2019). Namely, modifying the decoder neuralnetwork so it receives both the representation Y and the private or sensitive data S as an input. Then, the learned representations can be fed to any algorithm of choice. For thisreason, the efforts for reducing unfair decisions and privacy
breaches will be small for many practitioners.

0

1

2

3

ln( )

4

(d)

LR on
RF on
LR on
RF on
Prior

0.80
0.75
0.70
0.65

Y
Y
X
X

0.60
0

1

2

ln( )

3

4

(e)

Figure 6: Behavior of (a) the accuracy on T , (b) the discrimination, (c) the equalized odds gap, (d) the error gap, and (e)the accuracy on S of a logistic regression (LR, in black) anda random forest (RF, in gray) of the fair representations (dotsand dotted line) and the original data (dashed line) learned
with β ∈ [1, 50] on the Adult dataset. The dashed line in red
is the accuracy of a prior-based classifier.

tional privacy funnel (CPF).
We proposed a variational approach, based on the Lagrangians of the CPF and the CFB, to solve the problem.
This approach leads to a simple structure where the tasksof learning private and/or fair representations can be easily
identified. Moreover, in practice, private and fair representations can be learned with little modification to the imple-

Problem formulation The CPF and the CFB as definedin (1) and (2) are non-convex optimization problems withrespect to PY |X . More specifically, they are a minimizationof a convex function with non-convex constraints (see Appendix C). Therefore, (i) the optimal conditional distribution
PY? |X that minimizes the Lagrangian might not be achieved
through gradient descent, and (ii) even if PY? |X is achieved,
it could be a sub-optimal value for (1) or (2), since the problems are not strongly dual (Boyd, Boyd, and Vandenberghe
2004, Section 5.2.3). A possible solution could be the application of a monotonically increasing concave function u toI(X; Y |S) or I(T ; Y |S) in the CPF or CFB Lagrangians,
respectively, so that u(I(X; Y |S)) or u(I(T ; Y |S)) is concave (and hence the Lagrangian is convex) in the domain ofinterest. For some u, this approach might allow to attain thedesired r in (1) or (2) with a specific value of the Lagrange
multiplier; see (Rodrı́guez Gálvez, Thobaben, and Skoglund2020) for an example of this approach for the IB.
Proposed approach The proposed approach entails two
limitations that are common in variational attempts at solving an optimization problem. Namely: (i) it approximates the
decoding and the marginal distributions and (ii) it considers parametrized densities. The first issue restricts the search
space of the possible encoding distributions PY |X to those
distributions with a decoding and marginal distributions that
follow the restrictions of the variational approximation. The
second issue further limits the search space to the obtainable encoding distributions with densities pY |(X,θ) with aparametrization θ. For this reason, richer encoding distributions and marginals, e.g., by means of normalizing flows(Rezende and Mohamed 2015; Kingma et al. 2016), are apossible direction to mitigate these issues.

Potential Ethical Impact
Privacy breaches and unfairness are concerning problems
that often arise in (learning) algorithms. Moreover, aside
from the realm of algorithms, these are problems that humans, as a society, aim to mitigate in our objective to reachsustainability (United Nations 2016, Goal 10). With thepresent paper, we contribute towards the development ofprivacy-preserving and fair systems, thus contributing to asustainable development. For example, privacy-preserving
and fair decision-making algorithms could directly contribute to the UN’s targets 10.2 and 10.3 (United Nations
2016, Targets 10.2 and 10.3), namely, “empower and promote the social, economic, and political inclusion of all, irrespective of age, sex, disability, race, ethnicity, origin, religion, or economic or other status” and “ensure equal opportunity and reduce inequalities of outcome, including by
eliminating discriminatory laws, policies, and practices andpromoting appropriate legislation, policies, and action in thisregard”, respectively.
Even though our contribution will not help to directlylevel out social, political, and economic inequalities, the results and algorithms provided in this paper will help to avoid
that inequalities will be amplified and prolonged throughdata-driven services and decision mechanisms (e.g., for insurances, administration, banking, or loans). By treating thedata entered into such services and systems fairly and confidentially, as enforced by the proposed approach of this paper, our contribution has the potential to empower and promote social and economical inclusion (United Nations 2016,
Target 10.2) and ensure equal opportunity (United Nations
2016, Target 10.3) in this specific domain of people’s everyday life. Furthermore, we believe that our results are likely
to be adopted by algorithm designers and practitioners, as
our solutions can easily be integrated into existing standard
representation learning algorithms as noted in Remark 1 anddetailed in Appendix B.

References
Achille, A.; and Soatto, S. 2018. Emergence of invarianceand disentanglement in deep representations. The Journal of
Machine Learning Research 19(1): 1947–1980.
Alemi, A. A.; Fischer, I.; Dillon, J. V.; and Murphy, K. 2016.
Deep variational information bottleneck. International Conference on Learning Representations (ICLR) .

Conference on Tools and Algorithms for the Construction
and Analysis of Systems, 390–404. Springer.
Chen, T. Q.; Li, X.; Grosse, R. B.; and Duvenaud, D. K.
2018. Isolating sources of disentanglement in variational autoencoders. In Advances in Neural Information Processing
Systems (NeurIPS), 2610–2620.
Chouldechova, A.; and Roth, A. 2018. The frontiers of fairness in machine learning. arXiv preprint arXiv:1810.08810.
Corbett-Davies, S.; and Goel, S. 2018. The measure andmismeasure of fairness: A critical review of fair machinelearning. arXiv preprint arXiv:1808.00023 .
Cover, T. M.; and Thomas, J. A. 2006. Elements of information theory. John Wiley & Sons, second edition edition.
Creager, E.; Madras, D.; Jacobsen, J.-H.; Weis, M.; Swersky, K.; Pitassi, T.; and Zemel, R. 2019. Flexibly Fair Representation Learning by Disentanglement. In International
Conference on Machine Learning (ICML), 1436–1445.
Dieterich, W.; Mendoza, C.; and Brennan, T. 2016. COMPAS risk scales: Demonstrating accuracy equity and predictive parity. Northpointe Inc .
du Pin Calmon, F.; and Fawaz, N. 2012. Privacy against statistical inference. In Allerton Conference on Communication, Control, and Computing (Allerton), 1401–1408. IEEE.
Dua, D.; and Graff, C. 2017. UCI Machine Learning Repository. URL http://archive.ics.uci.edu/ml.
Dwork, C.; Hardt, M.; Pitassi, T.; Reingold, O.; and Zemel,
R. 2012. Fairness through awareness. In Proceedings ofthe 3rd Innovations in Theoretical Computer Science conference, 214–226.
Dwork, C.; McSherry, F.; Nissim, K.; and Smith, A. 2006.
Calibrating noise to sensitivity in private data analysis. In
Theory of cryptography conference, 265–284. Springer.
Dwork, C.; Roth, A.; et al. 2014. The algorithmic foundations of differential privacy. Foundations and Trends R in
Theoretical Computer Science 9(3–4): 211–407.
Edwards, H.; and Storkey, A. 2016. Censoring representations with an adversary. International Conference on Learning Representations (ICLR) .
Fischer, I. 2020. The Conditional Entropy Bottleneck. arXiv
preprint arXiv:2002.05379 .

Belghazi, M. I.; Baratin, A.; Rajeshwar, S.; Ozair, S.; Bengio, Y.; Courville, A.; and Hjelm, D. 2018. Mutual information neural estimation. In International Conference on
Machine Learning (ICML), 531–540.

Ganin, Y.; Ustinova, E.; Ajakan, H.; Germain, P.; Larochelle,
H.; Laviolette, F.; Marchand, M.; and Lempitsky, V. 2016.
Domain-adversarial training of neural networks. The Journal of Machine Learning Research 17(1): 2096–2030.

Boyd, S.; Boyd, S. P.; and Vandenberghe, L. 2004. Convex
optimization. Cambridge university press.

Hamm, J. 2017. Minimax filter: learning to preserve privacy
from inference attacks. The Journal of Machine Learning
Research 18(1): 4704–4734.

Calders, T.; Kamiran, F.; and Pechenizkiy, M. 2009. Building classifiers with independency constraints. In 2009 IEEE
International Conference on Data Mining Workshops, 13–
18. IEEE.
Chatzikokolakis, K.; Chothia, T.; and Guha, A. 2010. Statistical measurement of information leakage. In International

Hardt, M.; Price, E.; and Srebro, N. 2016. Equality of opportunity in supervised learning. In Advances in Neural Information Processing Systems (NeurIPS), 3315–3323.
Harris, C. R.; Millman, K. J.; van der Walt, S. J.; Gommers, R.; Virtanen, P.; Cournapeau, D.; Wieser, E.; Taylor,J.; Berg, S.; Smith, N. J.; et al. 2020. Array programmingwith NumPy. Nature 585(7825): 357–362.
Higgins, I.; Matthey, L.; Pal, A.; Burgess, C.; Glorot, X.;
Botvinick, M.; Mohamed, S.; and Lerchner, A. 2017. BetaVAE: Learning Basic Visual Concepts with a Constrained
Variational Framework. International Conference on Learning Representations (ICLR) .
Hjelm, R. D.; Fedorov, A.; Lavoie-Marchildon, S.; Grewal,
K.; Bachman, P.; Trischler, A.; and Bengio, Y. 2018. Learning deep representations by mutual information estimationand maximization. In International Conference on Learning
Representations (ICLR).

Madras, D.; Creager, E.; Pitassi, T.; and Zemel, R. 2019.
Fairness through causal awareness: Learning causal latentvariable models for biased data. In Proceedings of theConference on Fairness, Accountability, and Transparency,
349–358.
Makhdoumi, A.; Salamatian, S.; Fawaz, N.; and Médard, M.
2014. From the information bottleneck to the privacy funnel. In IEEE Information Theory Workshop (ITW), 501–505.
IEEE.
McInnes, L.; Healy, J.; Saul, N.; and Großberger, L. 2018.
UMAP: Uniform Manifold Approximation and Projection.
Journal of Open Source Software 3(29).

Issa, I.; Wagner, A. B.; and Kamath, S. 2019. An operational approach to information leakage. IEEE Transactions
on Information Theory 66(3): 1625–1657.

Nan, L.; and Tao, D. 2020. Variational approach for privacy
funnel optimization on continuous data. Journal of Paralleland Distributed Computing 137: 17–25.

Jiang, R.; Pacchiano, A.; Stepleton, T.; Jiang, H.; and Chiappa, S. 2019. Wasserstein fair classification. Conference
on Uncertainty in Artificial Intelligence (UAI) .

Paszke, A.; Gross, S.; Massa, F.; Lerer, A.; Bradbury, J.;
Chanan, G.; Killeen, T.; Lin, Z.; Gimelshein, N.; Antiga, L.;et al. 2019. Pytorch: An imperative style, high-performance
deep learning library. In Advances in neural information
processing systems, 8026–8037.

Kamiran, F.; and Calders, T. 2010. Classification with nodiscrimination by preferential sampling. In Proceedings ofthe 19th Machine Learning Conference of Belgium and The
Netherlands, 1–6. Citeseer.
Kifer, D.; and Machanavajjhala, A. 2011. No free lunch indata privacy. In Proceedings of the 2011 ACM SIGMODInternational Conference on Management of data, 193–204.

Pedregosa, F.; Varoquaux, G.; Gramfort, A.; Michel, V.;
Thirion, B.; Grisel, O.; Blondel, M.; Prettenhofer, P.; Weiss,
R.; Dubourg, V.; Vanderplas, J.; Passos, A.; Cournapeau, D.;
Brucher, M.; Perrot, M.; and Duchesnay, E. 2011. Scikitlearn: Machine Learning in Python. Journal of Machine
Learning Research 12: 2825–2830.

Kilbertus, N.; Carulla, M. R.; Parascandolo, G.; Hardt, M.;
Janzing, D.; and Schölkopf, B. 2017. Avoiding discrimination through causal reasoning. In Advances in Neural Information Processing Systems (NeurIPS), 656–666.

Rahimi, A.; and Recht, B. 2009. Weighted sums of random
kitchen sinks: Replacing minimization with randomizationin learning. In Advances in neural information processing
systems (NeurIPS), 1313–1320.

Kim, H.; and Mnih, A. 2018. Disentangling by Factorising.
In International Conference on Machine Learning (ICML),
2649–2658.

Rezende, D. J.; and Mohamed, S. 2015.
Variational inference with normalizing flows. arXiv preprint
arXiv:1505.05770 .

Kingma, D. P.; and Ba, J. 2014. Adam: A method forstochastic optimization. arXiv preprint arXiv:1412.6980 .

Rodrı́guez Gálvez, B.; Thobaben, R.; and Skoglund, M.
2020. The Convex Information Bottleneck Lagrangian. Entropy 22(1): 98.

Kingma, D. P.; Salimans, T.; Jozefowicz, R.; Chen, X.;
Sutskever, I.; and Welling, M. 2016. Improved variational
inference with inverse autoregressive flow. In Advances in
Neural Information Processing Systems (NeurIPS), 4743–
4751.

Romanelli, M.; Palamidessi, C.; and Chatzikokolakis, K.
2019. Generating optimal privacy-protection mechanisms
via machine learning. arXiv preprint arXiv:1904.01059 .

Kingma, D. P.; and Welling, M. 2013. Auto-encoding variational Bayes. arXiv preprint arXiv:1312.6114 .

Tishby, N.; Pereira, F. C.; and Bialek, W. 2000. The information bottleneck method. arXiv preprint physics/0004057.

Kolchinsky, A.; Tracey, B. D.; and Wolpert, D. H. 2019.
Nonlinear information bottleneck. Entropy 21(12): 1181.

United Nations. 2016. Transforming our world: The 2030
agenda for sustainable development .

Kusner, M. J.; Loftus, J.; Russell, C.; and Silva, R. 2017.
Counterfactual fairness. In Advances in Neural Information
Processing Systems (NeurIPS), 4066–4076.

Wainwright, M. 2019. High-Dimensional Statistics. Cambridge University Press.

LeCun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P. 1998.
Gradient-based learning applied to document recognition.
Proceedings of the IEEE 86(11): 2278–2324.
Louizos, C.; Swersky, K.; Li, Y.; Welling, M.; and Zemel,
R. 2016. The variational fair autoencoder. International
Conference on Learning Representations (ICLR) .

Yeung, R. W. 1991. A new outlook on Shannon’s information measures. IEEE Transactions on Information Theory
37(3): 466–474.
Zafar, M. B.; Valera, I.; Rodriguez Gomez, M.; and Gummadi, K. P. 2017. Fairness constraints: Mechanisms for fairclassification. International Conference on Artificial Intelligence and Statistics (AISTATS) .

Zemel, R.; Wu, Y.; Swersky, K.; Pitassi, T.; and Dwork, C.
2013. Learning fair representations. In International Conference on Machine Learning (ICML), 325–333.
Zhao, H.; Coston, A.; Adel, T.; and Gordon, G. J. 2020. Conditional learning of fair representations. International Conference on Learning Representations (ICLR) .
Zhao, H.; and Gordon, G. 2019. Inherent tradeoffs in learning fair representations. In Advances in Neural Information
Processing Systems (NeurIPS), 15649–15659.
Zhao, S.; Song, J.; and Ermon, S. 2019. Infovae: Balancing
learning and inference in variational autoencoders. In Proceedings of the Thirty-Third AAAI Conference on Artificial
Intelligence, volume 33, 5885–5892.
Zhu, Y.; and Bettati, R. 2005. Anonymity vs. information
leakage in anonymity systems. In 25th IEEE International
Conference on Distributed Computing Systems (ICDCS’05),
514–524. IEEE.

Technical Appendix
A

Equivalences of the Lagrangians

In this section of the appendix, we show how minimizing the
Lagrangians of the CPF and the CFB problems is equivalent
to minimizing other Lagrangians. First, in A.1 we show it
is equivalent to minimizing the Lagrangians that are used in
the variational approach we propose in this paper. Then, in
A.2 we show that minimizing the Lagrangian of the CPF isequivalent to minimizing the Lagrangian of the PF, meaningthat the conditional probability distributions PY |X obtainedusing the Lagrangian of the CPF could have been obtained
through the Lagrangian of the PF, too.

More specifically,
arg inf
LCFB (PY |X , λ)PY |X ∈P

= arg

Equivalence of the Lagrangians used for theminimization

Proposition 1. Minimizing LCPF (PY |X , λ) is equivalent tominimizing JCPF (PY |X , γ), where γ = λ + 1 and
JCPF (PY |X , γ) = I(X; Y ) − γI(X; Y |S).

(5)

Proof. If we manipulate the expression of the CPF Lagrangian we can see how minimizing LCPF (PY |X , λ) is
equivalent to minimizing JCPF (PY |X , γ), where γ = λ + 1.
More specifically,
arg

inf



PY |X ∈P

= arg
= arg

LCPF (PY |X , λ){I(S; Y ) + I(X; Y |S, T ) − λI(T ; Y |S)}
(17)

= arg

inf

PY |X ∈P

{I(X; Y ) − I(T ; Y |S) − λI(T ; Y |S)}
(18)

= arg
= arg

A.1

inf

PY |X ∈P

inf

PY |X ∈P

inf

PY |X ∈P

{I(X; Y ) − (λ + 1)I(T ; Y |S)}JCFB (PY |X , λ + 1) ,A.2

Equivalence of the Lagrangians of theprivacy funnel and the CPF

The privacy funnel is defined in a similar way to the CPF. It
is an optimization problem that tries to design an encoding
probability distribution PY |X such that the representation Y
keeps a certain level r0 of information about the data of interest X, while minimizing the information it keeps about
the private data S (Makhdoumi et al. 2014). That is,
arg inf {I(S; Y )} s.t. I(X; Y ) ≥ r0 .

inf

{I(S; Y ) − λI(X; Y |S)}

inf

{I(X; Y ) − I(X; Y |S) − λI(X; Y |S)}PY |X ∈P

(20)

where P is the set of probability distributions over Y suchthat if PY |X=x ∈ P for all x ∈ X , then the Markov chains
S ↔ X → Y and T ↔ X → Y hold.

PY |X

PY |X ∈P

(19)

(21)

(13)
Therefore, the Lagrangian of the privacy funnel problem is(14)

LPF (PY |X , α) = I(S; Y ) − αI(X; Y ),(22)

{I(X; Y ) − (λ + 1)I(X; Y |S)} (15)
JCPF (PY |X , λ + 1) ,(16)

where α ∈ [0, 1] is the Lagrange multiplier of
LPF (PY |X , α).1 This multiplier controls the trade-off between the information the representations keep about the private and the original data.

where P is the set of probability distributions over Y suchthat if PY |X=x ∈ P for all x ∈ X , then the Markov chain
S ↔ X → Y holds.

Proposition 3. Minimizing LCPF (PY |X , λ) is equivalent tominimizing LPF (PY |X , α), where α = λ/(λ + 1).

= arg
= arg

inf

PY |X ∈P

inf

PY |X ∈P

Proposition 2. Minimizing LCFB (PY |X , λ) is equivalent tominimizing JCFB (PY |X , β), where β = λ + 1 and
JCFB (PY |X , β) = I(X; Y ) − βI(T ; Y |S).

(6)

Proof. If we manipulate the expression of the CFB Lagrangian we can see how minimizing LCFB (PY |X , λ) is
equivalent to minimizing JCFB (PY |X , β), where β = λ + 1.

Proof. If we manipulate the expression of the CPF Lagrangian we can see how the minimizing LCPF (PY |X , λ) is
equivalent to minimizing LPF (PY |X , α), where α = λ/(λ +1). More specifically,1
If α = 1, then LPF (PY |X , 1) = −I(X; Y |S), for which optimal values of the encoding distribution PY |X can filter private
information arbitrarily. If α > 1 this problem is even more pronounced. For α ≤ 0 trivial encoding distributions like a degenerate
distribution PY |X with density pY |X = δ(Y ) are minimizers of
the Lagrangian.

arg

inf

PY |X ∈P

= arg
= arg


LCPF (PY |X , λ)inf

{I(S; Y ) − λI(X; Y |S)}

inf

{I(S; Y ) − λ (I(X; Y ) − I(S; Y ))}PY |X ∈P
PY |X ∈P

(23)

X depends both on the representations Y and on the private data S, while in (28) it only depends on the representations Y . Therefore, the cost function Funs (θ, φ, η) is recovered from the cost function of the CPF in the case that
qX|(S,Y,φ) = qX|(Y,φ) . However, this is not desirable, since
it means that the representations Y contain all the information from the private data S necessary to reconstruct X.

(24){(λ + 1)I(S; Y ) − λI(X; Y )}
(25)



λ
(λ + 1) I(S; Y ) −= arg inf
I(X; Y )PY |X ∈P
λ+1
(26)



λ
= arg inf
LPF PY |X ,,(27)
PY |X ∈P
λ+1
= arg

inf

PY |X ∈P

where P is the set of probability distributions over Y suchthat if PY |X=x ∈ P for all x ∈ X , then the Markov chain
S ↔ X → Y holds.
We note how the relationship α = λ/(λ + 1) maintains
α ∈ [0, 1) for λ ≥ 0. This showcases how the CPF posesa more restrictive problem, in the sense that as long as λ <∞ there are no solutions of the problem that filter private
information arbitrarily.

B

Modification of common algorithms to
obtain private and/or fair representations

In this section of the appendix, we discuss the simple
changes needed to common representation learning algorithms to implement our proposed variational approach.
First, we show how common unsupervised learning algorithms can be modified to the variational approach to the
CPF, thus generating private representations. Then, we show
how common supervised learning algorithms can be modified to the variational approach to the CFB, thus generating
fair representations.
Common unsupervised learning algorithms. The costfunction of the β-VAE (Higgins et al. 2017) and the VIB(Alemi et al. 2016) (when the target variable is the identityof the samples) isN
1 X
Funs (θ, φ, η) =DKL pY |(X=x(i) ,θ) ||qY |θ
N i=1
h 
i
− η −1 EpE log qX|(Y =f (x(i) ,E),φ) (x(i) ) , (28)where η is a parameter that controls the trade-off between
the compression of the representations Y and their ability toreconstruct the original data X. Similarly, the VAE (Kingma
and Welling 2013) cost function is Funs (θ, φ, 1).
Comparison with the CPF. If we compare (28) with thecost function of the CPF J˜CPF (θ, φ, γ), we observe that the
only difference (provided that η −1 = γ) is the decoding density. In the CPF the decoding density of the original data

Modifications to obtain private representations. In
these usupervised learning algorithms (Kingma and Welling2013; Higgins et al. 2017; Alemi et al. 2016) the decoding (or generative) density is parametrized with neural networks, e.g., qX|(Y,φ) = Cat(X; ρdec (Y ; φ)) if X is discrete and qX|(Y,φ) = N (X; µdec (Y ; φ), σdec (Y ; φ)2 Iddec ) if
X is continuous, where ρdec , µdec , and σdec are neural networks and ddec is the dimensionality of X. In this work,
the decoding density can also be parametrized with neuralnetworks, e.g., Cat(X; ρ0dec (S, Y ; φ)) if X is discrete and0
qX|(Y,φ) = N (X; µ0dec (S, Y ; φ), σdec
(S, Y ; φ)2 Iddec ) if X is000continuous, where ρdec , µdec , and σdec are neural networks.
Therefore, if the decoding density neural networks from(Kingma and Welling 2013; Higgins et al. 2017; Alemi et al.
2016) are modified so that they take the private data S as an
input, then the resulting algorithm is the one proposed in thispaper.
Common supervised learning algorithms. The costfunction of the VIB (Alemi et al. 2016) and the nonlinear
IB (Kolchinsky, Tracey, and Wolpert 2019) isN

1 X
DKL pY |(X=x(i) ,θ) ||qY |θ
N i=1
h 
i
− η −1 EpE log qT |(Y =f (x(i) ,E),φ) (t(i) ) , (29)

Fsup (θ, φ, η) =where η is a parameter that controls the trade-off between
the compression of the representations Y and their ability todraw inferences about the task T .
Comparison with the CFB. Similarly to the comparison of the unsupervised learning algorithms and the CPF,
we observe that (29) only differs with the cost function
J˜CFB (θ, φ, β) in the decoding density, i.e., the cost function
Fsup (θ, φ, η) can be recovered from J˜CFB (θ, φ, β) by settingqT |(S,Y,φ) = qT |(Y,φ) . The inference density of the task T
only depends on the representations Y in (Alemi et al. 2016;
Kolchinsky, Tracey, and Wolpert 2019), while in our work
it depends both on the representations Y and the sensitive
data S. Hence, in these works the representations contain all
the information from the sensitive data S necessary to draw
inferences about the task T .
Modifications to obtain fair representations. The argument is analogous to the one for the modifications of unsupervised learning algorithms to obtain private representations. The only modification required in these supervised
learning algorithms (Alemi et al. 2016; Kolchinsky, Tracey,and Wolpert 2019) is to modify the decoding density neuralnetworks to receive the sensitive data S as an input as wellas the representations Y .
Invariants of the algorithms. In all these works (Kingma
and Welling 2013; Higgins et al. 2017; Alemi et al. 2016;
Kolchinsky, Tracey, and Wolpert 2019) and ours, the first(or the compression) term is usually calculated assumingthat the encoder density is parametrized with neural networks, e.g., pY |(X,θ) = N (Y ; µenc (X; θ), σenc (X; θ)2 Id ),which allows the representations to be constructed using thereparametrization trick, e.g., Y = µenc (X; θ)+σenc (X; θ)E,
where E ∼ N (0, Id ), d is the dimensionality of therepresentations, and Id is the d-dimensional identity matrix. Then, the marginal density of the representations is
set so that the Kullback-Leibler divergence has either aclosed expression, a simple way to estimate it, or a simple upper bound, e.g., qY |θ = N (Y ; 0, Id ) or qY |θ =PN
1(i)
are the input data sami=1 pY |(X=x(i) ,θ) , where xNples. Moreover, the loss function applied to the output ofthe decoding density and the optimization algorithm, e.g.,stochastic gradient descent or Adam (Kingma and Ba 2014),
can remain the same in these works and ours, too.
Remark 2. The aforementioned modifications can also be
introduced in other algorithms with cost functions with additional terms to Funs and Fsup . For example, adding amaximum-mean discrepancy (MMD) term on the represenation priors to avoid the information preference problem likein the InfoVAE (Zhao, Song, and Ermon 2019); adding an
MMD term on the encoder densities to enforce privacy orfairness like in the VFAE (Louizos et al. 2016); or adding a
total correlation penalty to the representation’s marginal toenforce disentangled represenations like in the Factor-VAE,
the β-TCVAE, or the FFVAE (Kim and Mnih 2018; Chenet al. 2018; Creager et al. 2019).

C

Non-convexity of the CPF and the CFB

In this section of the appendix, we show how both the CPF
and the CFB as defined in (1) and (2) are non-convex optimization problems.
Lemma 1. Let X ∈ X , S ∈ S, Y ∈ Y, and T ∈ T be
random variables. Then,
1. If the Markov chain S ↔ X → Y holds and the distributions of X and S are fixed, then I(X; Y ), I(S; Y ),and I(X; Y |S) are convex functions with respect to thedensity pY |X .
2. If, additionally, the Markov chain T ↔ X → Y holds
and the distributions of X, S, and T are fixed, thenI(X; Y |S, T ) and I(T ; Y |S) are also convex functions
with respect to the density pY |X .
Proof. We start the proof leveraging (Cover and Thomas
2006, Theorem 2.7.4), which, in our setting, tells us that:• I(X; Y ) is a convex function of pY |X if pX is fixed.
• I(S; Y ) is a convex function of pY |S if pS is fixed.

• I(X; Y |S) is a convex function of pY |(X,S) if pX|S is
fixed.
• I(X; Y |S, T ) is a convex function of pY |(X,S,T ) if
pX|(S,T ) is fixed.
• I(T ; Y |S) is a convex function of pY |(S,T ) if pT |S is
fixed.
Then, since pY |S
=


pX|S
pY |X , pY |(X,S,T )pX

EpX|S [pY |X ], pY |(X,S)=
pX|(S,T )=pY |X , andpX

pY |(S,T ) = EpX|(S,T ) [pY |X ] are non-negative weighted
sums as defined in (Boyd, Boyd, and Vandenberghe 2004,
2.2.1), they preserve convexity. Hence, I(S; Y ), I(X; Y |S),
I(X; Y |S, T ), and I(T ; Y |S) are convex functions of pY |X ,if pS , pX|S , pX|(S,T ) , and pT |S are fixed, respectively.
Proposition 4. Let us consider that the distributions of S
and X are fixed and that the conditional distribution PY |X
has a density pY |X . Then, the CPF optimization problem is
not convex.
Proof. From Lemma 1 we know that I(S; Y ) andI(X; Y |S) are convex functions with respect to pY |X for
fixed pS and pX|S . Hence, the constraint I(X; Y |S) ≥ r isconcave.
Proposition 5. Let us consider that the distributions of S, T ,and X are fixed and that the conditional distribution PY |X
has a density pY |X . Then, the CFB optimization problem is
not convex.
Proof. From Lemma 1 we know that I(S; Y ),I(X; Y |S, T ), and I(T ; Y |S) are convex functions
with respect to pY |X for fixed pS , pX|(S,T ) , and pT |S .
Hence, the constraint I(T ; Y |S) ≥ r is concave.

D

Details of the experiments

In this section of the appendix, we include an additional experiment on the COMPAS dataset (Dieterich,Mendoza, and Brennan 2016) and describe the details of the experiments performed to validate theapproach proposed in this paper. The code is athttps://github.com/burklight/VariationalPrivacyFairness.

D.1

Results on the COMPAS dataset

COMPAS dataset. The ProPublica COMPAS dataset (Dieterich, Mendoza, and Brennan 2016)2 contains 6, 172 samples of different attributes of criminal defendants in orderto classify if they will recidivate within two years or not.
These attributes include gender, age, or race. In both tasks,
we followed the experimental set-up from Zhao et al. (2020)and considered S to be a binary variable stating if the defendant is African American and X to be the rest of attributes.
For the fairness task, we considered T to be the binary variable stating if the defendant recidivated or not. Since thisdataset was not previously divided between training and test
set, we randomly splitted the dataset with 70% of the samples (4, 320) for training and the rest (1, 852) for testing.
2

Available in the Kaggle website.

Table 3: Fairness metrics with different methods on the COMPAS dataset. Displayed as: Logistic regression / Random forest.
The best hyperparameters for the other methods have been selected, as shown in the following section. These models arecompared to our model with most similar results.
Methods

Accuracy (T)Accuracy (S)Discrimination

Error gap

EO gap

LFR (Zemel et al. 2013)
Ours (β = 34.8)

0.64 / 0.67
0.63 / 0.58

0.51 / 0.99
0.59 / 0.52

0.14 / 0.21
0.16 / 0.10

0.07 / 0.03
0.06 / 0.04

0.11 / 0.19
0.13 / 0.08

FFVAE (Creager et al. 2019, α = 200)
CFAIR (Zhao et al. 2020, λ = 10)3
Ours (β = 7.76)

0.54 / 0.51
0.54 / 0.52

0.50 / 0.50
0.52 / 0.49

0.00 / 0.01
0.04
0.00 / 0.02

0.12 / 0.05
0.00
0.14 / 0.04

0.00 / 0.04
0.02
0.00 / 0.03

Similarly to the previous experiments, the proposed approach controls the trade-off between private and informative representations and between fair and accurate representations. In Figure 7 we see how the trade-off between thecompression level I(X; Y ) and the informativeness of therepresentations independent of the private data I(X; Y |S)and between the compression level I(X; Y ) and the predictability of the representations without the sensitive data
I(X; Y |S) is controlled by the private and the fair representations, respectively. Moreover, we can also see how theamount of information the representations keep about theprivate or the sensitive data is commanded by the Lagrange
multipliers γ and β.
Compared with other variational approaches to the PF(Nan and Tao 2020, PPVAE) and (Louizos et al. 2016,
VFAE), as happened with the Adult dataset, the proposed
approach controlled better the information the representations Y contained about the sensitive attribute S. In particular, the PPVAE contained between 0.63 and 1 bit of information about S for η −1 ∈ [1, 50], and the VFAE contained
between 0.68 and 1 bit for δ ∈ [Nbatch , 1000Nbatch ]. Notethat 1 bit is the maximum information that Y can contain
about S, since H(S) = 1 in this scenario. With respect
to membership attacks, our method was a slightly weaker
to linear attackers than the PPVAE and the VFAE, allowing
an accuracy in the range [0.54, 0.60], compared to their respective ranges of [0.46, 0.62] and [0.45, 0.59]. That is, considering the prior probability of 0.51, the best parameter ofour method conceded the attacker a 3% accuracy that theother methods did not allow. However, once the attacker employed more sophisticated attacks, such as a random forest,
our method maintained a range of [0.52, 0.56], while the PPVAE and the VFAE allowed almost a perfect recovery of thegroup membership, with respective accuracy ranges between
0.96 and 0.99 and between 0.96 and 1.0, as was suggestedby the amount of bits of information their representations
contained about S. As before, this behavior can be explained
due to the Markov chain violation of the encoder densities
pY |(S,X,θ) of these approaches.
Furthermore, the Lagrange multiplier β also allows us
to control the behavior of the accuracy, the error gap, andthe discrimination for the COMPAS dataset (Figures 8a, 8d,
3Results extracted from the original paper’s Figure 2. The fairness metrics were computed on the output of the discriminator network, not on an independent logistic regression or random forest.

and 8b). Moreover, in this scenario, as shown in Figures 8c
and 8e, an increase of β also increased the equalized odds
level and the accuracy on S of adversarial classifiers (eventhough they remained below their values obtained with theoriginal data X for all the β tested). These results on theequalized odds, even though not generalizable since we havethe counter-example of the Adult dataset, indicate that insome situations this quanitty can be controlled with our approach. More specifically, we believe this happens when we
can guarantee that I(S; Y ; T ) is non-negative as explainedin Remark 5.
Finally, we also observe, as for the Adult dataset, how the
proposed method’s representations are more robust against
non-linear adversaries than the representations obtainedwith the baseline from Zemel et al. (2013, LFR) (see Table 3). Moreover, the method performs similarly as stateof-the-art methods based on adversarial learning (Zhao et al.
2020, CFAIR) and variational inference (Creager et al. 2019,
FFVAE), as shown in Table 3.

D.2

Experimental details

Encoders. In all the experiments performed, we modeled the encoding density as an isotropic Gaussian distribution, i.e., pY |(X,θ) = N (Y ; µenc (X; θ), σθ2 I2 ), so thatY = µenc (X; θ) + σθ E, where E ∼ N (0, I2 ), µenc is aneural network, σθ is also optimized via gradient descentbut is not calculated with X as an input, and where the representations have 2 dimensions. The neural networks in eachexperiment were:• For the Adult dataset, µenc was a multi-layer perceptron
with a single hidden layer with 100 units and ReLU activations.
• For the Colored MNIST dataset, µenc was the convolutional neural network CNN-enc-1 for both the privacy
and fairness experiments, and the convolutional neuralnetwork CNN-enc-2 for the example from Figure 5.
Both architectures are described in Table 4.
• For the COMPAS dataset, µenc was a multi-layer perceptron with a single hidden layer with 100 units and ReLU
activations.
Moreover, the marginal density of the representations wasmodeled as an isotropic Gaussian of unit variance and zeromean; i.e., qY |θ = N (Y ; 0, I2 ).

Table 4: Convolutional neural network architectures employed for the Colored MNIST dataset.
The
network
modulesarethefollowing:
Conv2D(cin,cout,ksize,stride,pin,pout)
andConvTrans2D(cin,cout,ksize,stride,pin,pout) represent, respectively, a 2D convolution and transposed
convolution, where cin is the number of input channels, cout is the number of output channels, ksize is the size of thefilters, stride is the stride of the convolution, pin is the input padding of the convolution, and pout is the ouptut padding of
the convolution; MaxPool2D(ksize,stride,pin) represents a max-pooling layer, where the variables mean the samethan for the convolutional layers; Linear(nu) represents a linear layer, where nu are the output units; and BatchNorm,
ReLU6, Flatten, Unflatten, and Sigmoid represent a batch normalization, ReLU6, flatten, unflatten and Sigmoid
layers, respectively.
Name

Architecture

CNN-enc-1

Conv2D(3,5,5,2,1,0) - BatchNorm - RelU6 - Conv2D(5,50,5,2,0,0) BatchNorm - RelU6 - Flatten - Linear(100) - BatchNorm - ReLU Linear(2)Conv2D(3,5,5,0,2,0) - BatchNorm - RelU6 - Conv2D(3,5,5,0,2,0) BatchNorm - RelU6 - Conv2D(3,5,5,0,2,0)
Linear(100) - BatchNorm - ReLU6 - Linear(1250) - Unflatten BatchNorm - ReLU - ConvTrans2D(50,5,5,2,0,0) - BatchNorm - ReLU ConvTrans2D(5,3,5,2,1,1) - Sigmoid
Conv2D(3,5,5,0,2) - BatchNorm - RelU6 - Conv2D(5,50,5,0,2,0) BatchNorm - RelU6 - Conv2D(5,50,5,0,2,0) - BatchNorm - RelU6 Conv2D(5,50,5,0,2,0) - Sigmoid
Conv2D(3,5,5,1,1,0) - MaxPool2D(5,2,2) - RelU6 Conv2D(5,50,5,1,0,0) - MaxPool2D(5,2,2) - RelU6 - Flatten Linear(100) - ReLU6 - Linear(50) - ReLU6 - Linear(1)CNN-enc-2
CNN-dec-1

CNN-dec-2

CNN-mine

Decoders. In all the experiments performed for the fairness problem, the target task variable T was binary. Hence,
we modeled the inference density with a Bernoulli distribution4 ; i.e., qT |(S,X,φ) = Bernoulli(T ; ρdec (S, Y ; φ)),where ρdec is a neural network with a Sigmoid activation function in the output. In the privacy problem, if X
was a collection of random variables (X1 , X2 , ..., XC ),the generative density was modeled as the productof C categorical and isotropic Gaussians, depending
if the variables Q
were discrete or continuous. That is,C
I[Xj =Discrete]qX|(S,Y,φ) =j=1 Cat(Xj ; ρdec,j (S, Y ; φ))2
N (Xj ; µdec,j (S, Y ; φ), σφ,j)I[Xj =Continuous] , where the continuous random variables are 1-dimensional. In practice,
the densities were parametrized with a neural network withPC
I[Xj =Discrete] I[Xj =Continuous]
K =1
output neurons,
j=1 Kjwhere Kj are the number of classes of the categorical variable Xj and each group of output neurons defines each multiplying density; either as the logits of the Kj classes or theparameter (mean) of the Gaussian (the variances were also
optimized via gradient descent but were not calculated with
S nor Y as an input). If X was an image, the generative
density was modeled as a product of 3C Bernoulli densities, where C is the number of pixels of the image and the 3
comes from the RGB channels. The neural networks in eachexperiments were:• For the Adult dataset, the decoding neural network wasa multi-layer perceptron with a single hidden layer with
4
Note that the Bernoulli distribution is a categorical distribution
with two possible outcomes.

100 units and ReLU activations. For the fairness task,
the output was 1-dimensional with a Sigmoid activation function. For the privacy task, the output was 121dimensional. The input of the network was a concatenation of Y and S.
• For the Colored MNIST dataset and the fairness task, thedecoding neural network was also a multi-layer perceptron with a single hidden layer with 100 units, ReLU activations, and a 1-dimensional output with a Sigmoid activation function. For the privacy task, the decoding neuralnetwork was the CNN-dec-1 for the normal experiments
and the CNN-dec-2 for the example of Figure 5. The input linear layers took as an input a concatenation of Y and
S and in the convolutional layers S was introduced as abias.
• For the COMPAS dataset, the decoding neural network
also was a multi-layer perceptron with a single hidden
layer with 100 units and ReLU activations. For the fairness task, the output was 1-dimensional with a Sigmoid
activation function. For the privacy task, the output was
19-dimensional. The input of the network was a concatenation of Y and S.

Hyperparameters and random seed. The hyperparameters employed in the experiments to train the encoder anddecoder networks are displayed in Table 5, and the optimization algorithm used was Adam (Kingma and Ba 2014). All
random seeds were set to 2020.

0.25

6

0.20

I(S; Y)

H(X|S, Y)

5

7
8

0.15

0.10
0

25

50

I(X; Y)

75

100

0

125

2

(a)

ln( )

4

6

(b)
0.175
0.150

0.04

I(S; Y)

I(T; Y|S)

0.06

0.02

0.125
0.100
0.075

0.00

0.050
0.00

0.25

0.50

0.75

I(X; Y)

(c)

1.00

1.25

0

10

20

30

40

50

from the example on the Colored MNIST dataset, where the
CNN-mine from Table 4 was used. In all tasks the input wasa concatenation of S and Y , except from the example on the
Colored MNIST dataset, where in all convolutional layers
the private data S was added as a bias and in all linear layers
S was concatenated to the input. The hyperparameters used
to train the networks are displayed in Table 6.
Group fairness and utility indicators. The accuracy on
T and S, the discrimination, and the error and equalized odds gaps were calculated using both the input data
X and the generated representations Y . They were calculated with a Logistic regression (LR) classifier and a random forest (RF) classifier with the default settings fromscikit-learn (Pedregosa et al. 2011). The prior displayed on the accuracy on T and S figures is the accuracyof a classifier that only infers the majority class of T and S,
respectively, from the training dataset.

(d)Figure 7: Trade-off between (a) the private representations
compression I(X; Y ) and the non-private information retained I(X; Y |S) and (b) the Lagrange multiplier γ ∈[1, 500] and the private information I(S; Y ) kept by the representations. Since I(X; Y |S) = H(X|S) − H(X|S, Y )and H(X|S) does not depend on Y , the reported quantity is−H(X|S, Y ). Moreover, trade-off between (c) the fair representations compression I(X; Y ) and the non-sensitive information retained about the task I(T ; Y |S) and (d) the Lagrange multiplier β ∈ [1, 50] and the sensitive information
kept by the representations. All quantities are obtained for
the COMPAS dataset. The dots are the computed empiricalvalues and the lines are the moving average of the 1D linear
interpolations of such points.
Hardware and software. All experiments were run with
PyTorch (Paszke et al. 2019), NumPy (Harris et al. 2020),
and scikit-learn (Pedregosa et al. 2011) on a Nvidia Tesla
P100 PCIE GPU of 16Gb of RAM.
Preprocessing. The input data X for the Adult and the
COMPAS dataset was normalized to have 0 mean and unit
variance. The input data for the Colored MNIST dataset wasscaled to the range [0, 1].
Information measures. The mutual information I(X; Y )and the conditional entropy I(X; Y |S) and I(T ; Y |S)
were calculated with the bounds from (7), (8), and (9),respectively. Since H(X|S) was not directly obtainable,−H(X|S, Y ) was calculated and displayed instead. The
mutual information I(S; Y ) was calculated using the mutual
information neural estimator (MINE) with a moving averagebias corrector with a an exponential rate of 0.1 (Belghazi
et al. 2018); the resulting information was averaged overthe last 100 iterations. The neural networks employed werea 2-hidden layer multi-layer perceptron with 100 ReLU6
activation functions for all the datasets and tasks, except

Comparison with PPVAE (Nan and Tao 2020). We implemented the algorithm as described in the original paper.
We used the same neural network architecture (i.e., multilayer perceptron with a single hidden layer with 100 units
and ReLU activations) and training hyperparameters thanin our method in order to provide a fair comparison. The
original method was not prepared to handle other data thatwas not continuous, so we expanded the method assuming
categorical, and Bernoulli output distributions for the noncontinuous data. We studied 30 linearly equiespaced valuesof the hyperparameter η −1 from (12) ranging from 1 to 50.
Comparison with VFAE (Louizos et al. 2016). We implemented the algorithm as described in the original paper.
We used the same neural network architecture (i.e., multilayer perceptron with a single hidden layer with 100 units
and ReLU activations) and training hyperparameters thanin our method in order to provide a fair comparison. We
studied 30 linearly equiespaced values of the hyperparameter δ multiplying the MMD term ranging from Nbatch to
Nbatch 1000. We calculated the MMD using random kitchensinks (Rahimi and Recht 2009) with D = 500 and γ = 1 asin the original paper.
Comparison with LFR (Zemel et al. 2013). We implemented the algorithm as described in the original paper. We
used 10 prototypes (K = 10) and adjusted the hyperparemeters Ax , Ay , and Az so that the L-BFGS found a feasible solution in 150, 000 iterations with a tolerance of 10−5 . We observed that different values of the hyperparameters (as notedby Zemel et al. (2013)) produced almost equivalent results,
so we only report here the results for Ax = 10−4 , Ay = 0.1,
and Az = 500.
Comparison with FFVAE (Creager et al. 2019). We implemented the algorithm as described in the original paper.
We used the same neural network architecture (i.e., multilayer perceptron with a single hidden layer with 100 units

0.60
0.55

Equalized Odds

Discrimination

Accuracy (T)

0.25

0.25

0.65

0.20
0.15
0.10
0.05

0

10

20

30

40

50

0

10

20

(a)

0.10
0.05

30

40

50

0

(b)

10

20

30

40

50

(c)

0.70
Accuracy (S)0.15
Error Gap

0.15

0.00

0.00

0.50

0.20

0.10

0.05

0.65

LR on
RF on
LR on
RF on
Prior

0.60
0.55
0.50

0.00
0

10

20

30

40

50

0

10

20

(d)

30

40

Y
Y
X
X

50

(e)

Figure 8: Behavior of (a) the accuracy on T , (b) the discrimination, (c) the equalized odds gap, (d) the error gap, and (e) the
accuracy on S of a logistic regression (LR, in black) and a random forest (RF, in gray) of the fair representations (dots anddotted line) and the original data (dashed line) learned with β ∈ [1, 50] on the COMPAS dataset. The dashed line in red is theaccuracy of a prior-based classifier.
Table 5: Hyperparameters employed to optimize the encoder and decoder networks of the experiments.
Dataset (task)
Adult (fairness)
Adult (privacy)
Colored MNIST (fairness)
Colored MNIST (privacy)
Colored MNIST (example)
COMPAS (fairness)
COMPAS (privacy)

EpochsLearning rate

Lagrange multiplier (β or γ)

Batch size

150
150
250
500
500
150
250

−3

1-50 (logarithmically spaced)
1-50 (logarithmically spaced)
1-50 (logarithmically spaced)
1-50 (logarithmically spaced)11-50 (linearly spaced)
1-500 (logarithmically spaced)

1024
1024
1024
1024
2048
64
64

10
10−3
10−3
10−3
10−3
10−4
10−4

Table 6: Hyperparameters employed to optimize the MINE networks of the experiments.
Dataset (task)
Adult (fairness)
Adult (privacy)
Colored MNIST (fairness)
Colored MNIST (privacy)
COMPAS (fairness)
COMPAS (privacy)

Iterations4

5 · 105 · 104
5 · 104
5 · 104
5 · 104
5 · 104

and ReLU activations) and training hyperparameters than in
our method in order to provide with a fair comparison. Since
the sensitive variable has dimension 1, there was no needfor an adversary discriminator and therefore the γ parameter
was not explored. We performed experiments with different
values of α ranging from 1 to 400 as in the original paper
and we observed that the value of the hyperparameter did
not modify much the results, as shown in Table 7. We selected α = 200 for the comparisons since the results for that

Learning rate

Batch size

−3

2048
2048
2048
2048
463
463

10
10−3
10−3
10−3
10−3
10−3

α were the ones with the better trade-off between accuracy
and fairness.
Comparison with CFAIR (Zhao et al. 2020). We implemented the algorithm as described in the original paper. For
the experiments in the Adult dataset, we used the same neural network architecture (i.e., multi-layer perceptron with asingle hidden layer with 100 units and ReLU activations)Table 7: Fairness metrics with different values of α for the FFVAE. Displayed as: Logistic regression / Random forest.
DatasetαAccuracy (T)Accuracy (S)Discrimination

Error gap

EO gap

Adult
Adult
Adult
Adult
Adult

1
100
200
300
400

0.76 / 0.74
0.77 / 0.75
0.77 / 0.75
0.78 / 0.75
0.78 / 0.75

0.66 / 0.64
0.67 / 0.61
0.67 / 0.61
0.67 / 0.62
0.67 / 0.61

0.07 / 0.10
0.00 / 0.01
0.00 / 0.01
0.01 / 0.01
0.01 / 0.01

0.18 / 0.16
0.17 / 0.11
0.17 / 0.12
0.16 / 0.12
0.16 / 0.12

0.10 / 0.12
0.07 / 0.02
0.04 / 0.04
0.06 / 0.03
0.05 / 0.05

COMPASCOMPASCOMPASCOMPASCOMPAS

1
100
200
300
400

0.54 / 0.50
0.54 / 0.49
0.54 / 0.51
0.54 / 0.52
0.54 / 0.50

0.50 / 0.50
0.52 / 0.50
0.50 / 0.50
0.52 / 0.49
0.52 / 0.50

0.00 / 0.03
0.00 / 0.02
0.00 / 0.01
0.00 / 0.05
0.00 / 0.03

0.12 / 0.04
0.12 / 0.05
0.12 / 0.05
0.12 / 0.01
0.12 / 0.05

0.00 / 0.05
0.00 / 0.05
0.00 / 0.04
0.00 / 0.06
0.00 / 0.06

Table 8: Fairness metrics with different values of λ for the CFAIR. Displayed as: Logistic regression / Random forest.
DatasetλAccuracy (T)Accuracy (S)Discrimination

Error gap

EO gap

Adult
Adult
Adult
Adult
Adult

0.1
1
10
100
1000

0.78 / 0.74
0.77 / 0.71
0.77 / 0.70
0.77 / 0.71
0.77 / 0.71

0.68 / 0.67
0.68 / 0.63
0.67 / 0.64
0.67 / 0.63
0.69 / 0.65

0.03 / 0.03
0.03 / 0.04
0.00 / 0.03
0.05 / 0.03
0.02 / 0.01

0.14 / 0.12
0.17 / 0.09
0.17 / 0.10
0.17 / 0.09
0.17 / 0.12

0.01 / 0.00
0.17 / 0.11
0.04 / 0.04
0.22 / 0.08
0.02 / 0.04

than in our method for the encoder, decoder, and the adversarial decoders, which are equipped with a gradient reversal
layer (Ganin et al. 2016). Also, we employed the same training hyperparameters to ensure a fair comparison between thetwo methods. We performed experiments with different values of λ ranging from 0.1 to 1000 as in the original paper.
However, for the experiments in the COMPAS dataset, we
could not obtain good results with our architecture and hyperparameters nor could we replicate their results with theirarchitecture and hyperparameters. Hence, for this dataset,
we report here the results displayed in the original paper.

E

Group fairness and utility indicators

In this section of the appendix, we define and put into perspective a series of metrics, employed in this article, thatindicate the predicting and group fairness quality of a classifier.
Notation Let X ∈ X , S ∈ S, and T ∈ T be random variables denoting the input data, the sensitive data,
and the target task data, respectively. Let also X ⊆ RdX ,S = {0, 1}, and T = {0, 1}. Let w : X → T be a classifier; that is, w ∈ W is a function that receives as an input an instance of the input data x ∈ X and outputs aninference about the target task value t ∈ T for that input data. Let us also consider the setting where we have adataset that contains N samples of the random variables,i.e., D = {(x(i) , s(i) , t(i) )}N
i=1 . Finally, let P̂ denote theempirical probability distribution on the dataset D, P̂S=σ
the empirical probability distribution on the subset of thedataset D where s(i) = σ, i.e., {(x, s, t) ∈ D : s = σ},and P̂(S=σ,T =τ ) the empirical probability distribution on thesubset of the dataset D where s(i) = σ and t(i) = τ , i.e.,{(x, s, t) ∈ D : s = σ and t = τ }.
A common metric to evaluate the performance (utility) ofa classifier w on a dataset is its accuracy, which measures
the fraction of correct classifications of w on such a dataset.
Definition 1. The accuracy of a classifier w on a dataset D
isAccuracy(w, D) = P̂ (w(X) = T ).
(30)
An ideally fair classifier w would maintain demographic
parity (or statistical parity) and accuracy parity, which, respectively, mean that w(X) ⊥ S (or, equivalently if w isdeterministic, that P̂S=0 (w(X) = 1) = P̂S=1 (w(X) = 1))
and that P̂S=0 (w(X) 6= T ) = P̂S=1 (w(X) 6= T ) (Zhaoet al. 2020). In other words, if a classifier has demographic
parity, it means that it gives a positive outcome with equal
rate to the members of S = 0 and S = 1. However, demographic parity might damage the desired utility of the classifier (Hardt, Price, and Srebro 2016), (Zhao and Gordon
2019, Corollary 3.3). Accuracy parity, on the contrary, allows the existance of perfect classifiers (Zhao et al. 2020).
The metrics that assess the deviation of a classifier fromdemographic and accuracy parities are the discrimination
or demographic parity gap (Zemel et al. 2013; Zhao et al.
2020) and the error gap (Zhao et al. 2020).
Definition 2. The discrimination or demographic parity gapof a classifier w to the sensitive variable S on a dataset D is
Discrimination(w, D) =P̂S=0 (w(X) = 1) − P̂S=1 (w(X) = 1) . (31)Definition 3. The error gap of a classifier w with respect tothe sensitive variable S on a dataset D isError gap(w, D) =P̂S=0 (w(X) 6= T ) − P̂S=1 (w(X) 6= T ) .
(32)
Another advanced notion of fairness is that of equalized odds or positive rate parity, which means thatP̂(S=0,T =τ ) (w(X) = 1) = P̂(S=1,T =τ ) (w(X) = 1), forall τ ∈ {0, 1} or, equivalently, that w(X) ⊥ S | T (Hardt,
Price, and Srebro 2016). This notion of fairness requires thatthe true positive and false positive rates of the groups S = 0
and S = 1 are equal. The metric that assesses the deviationof a classifier from equalized odds is the equalized odds gap(Zhao et al. 2020).
Definition 4. The equalized odds gap of a classifier w withrespect to the sensitive variable S on a dataset D is
Equalized odds gap(w, D) =max P̂(S=0,T =τ ) (w(X) = 1) − P̂(S=1,T =τ ) (w(X) = 1) .

τ ∈{0,1}(33)
Remark 3. In the particular case of learning fair representations, the classifier w : X → T consists of two stages:
an encoder wenc : X → Y and a decoder wdec : Y → T ,where the intermediate variable Y = wenc (X) is the fair
representation of the data. Therefore:
1. Minimizing I(S; Y ) encourages demographic parity,since
I(S; Y ) = 0 ⇐⇒ Y ⊥ S =⇒ w(X) ⊥ S.

(34)

2. Minimizing I(S; Y |T ) encourages equalized odds, since
I(S; Y |T ) = 0 ⇐⇒ Y ⊥ S | T =⇒ w(X) ⊥ S | T.
(35)
Remark 4. Based on Remark 3, we note that the variational
approach to the CFB and the CPF for generating private
and/or fair representations encourages demographic parity,
since the minimization of the Lagrangians of such problems,
LCFB and LCPF , indeed minimizes I(S; Y ).
Remark 5. Contrary to Remark 4 concerning the minimization of the demographic parity gap, we cannot say that thevariational approach to the CFB and the CPF minimizes theequalized odds gap.
Even though I(S; Y ) = I(S; Y |T ) + I(S; Y ; T ), since
I(S; Y ; T ) can be negative (Yeung 1991), then I(S; Y ) is
not necessarily greater than I(S; Y |T ) and thus there is no
guarantee that minimizing I(S; Y ) will minimize I(S; Y |T )as well.
Therefore, the minimization of LCFB and LCPF , which minimizes I(S; Y ), also minimizes the equalized odds gap when
I(S; Y ; T ) ≥ 0 and therefore I(S; Y ) ≥ I(S; Y |T ). Thatis, the CFB and the CPF minimize the equalized odds gap
when there is no synergy between X and Y to learn about
S; i.e., I(S; Y ) + I(S; X) ≥ I(S; (X, Y )).

Continuing with the reflection on Remarks 3 and 5, a constrained optimization formulation a la CPF that leads to aminimization of the equalized odds gap is possible. Namely,arg inf {I(S; Y |T ) + I(X; Y |S, T )} s.t. I(T ; Y |S) ≥ r,
PY |X

(36)
which minimizes the dark and darker gray areas from Figure 1a, which correspond to the sensitive and irrelevant data,
respectively, except the intersection between the sensitive
data S, the representations Y , and the target T , which corresponds to I(S; Y ; T ). In this formulation, it is ensured thatthe representations Y also maintain a certain level of the information r of the target that is not shared in the sensitive
data I(T ; Y |S).

F

Motivation of mutual information as utility
and privacy/fairness metric

The main to choose mutual information (and conditional
mutual information) as the measure of utility and privacy
and/or fairness is the tractability of this metric and the factthat it allowed us to (i) draw connections between the privacy and fairness problems and (ii) derive an algorithm that
could be easily incorporated to current approaches to representation learning.
Other than that, even though there are some caveats of using mutual information as a measure of privacy (see (Issa,
Wagner, and Kamath 2019)) or fairness, this metric has several operational meanings. Namely:• Utility. The conditional mutual information I(X; Y |S)(or I(T ; Y |S)) is a measure of the relevance of the representation Y to explain X (or T ). This is in line with
the information bottleneck (Tishby, Pereira, and Bialek
2000; Alemi et al. 2016; Kolchinsky, Tracey, and Wolpert2019) and other common representation learning algorithms (Hjelm et al. 2018; Makhdoumi et al. 2014).
An intuition would be that if we want to keep the average distortion smaller than a certain quantity, and we consider the distortion to be the log-loss, then we want thatthe (conditional) mutual information is greater than a, different, certain quantity (see e.g. (Makhdoumi et al. 2014,
Section III-B)).
• Privacy. The mutual information I(S; Y ) is the average
cost gain by an adversary with the self-information or
log-loss cost function (Makhdoumi et al. 2014, Lemma
1). This has also been used in other works such as(Chatzikokolakis, Chothia, and Guha 2010; Zhu and Bettati 2005). Moreover, an upper bound on mutual information limits both the Bayesian and minimax risks that canbe achieved in any inference based on the data; see e.g.
(Wainwright 2019, Chapter 15.3 on Fano’s method).
• Fairness. As explained in Remark 3 minimizing
I(S; Y ) encourages demographic parity and minimizing
I(S; Y |T ) encourages equalized odds.