Trade-offs and Guarantees of Adversarial Representation
Learning for Information Obfuscation
§∗†∗

§

†

Jianfeng Chi Han Zhao , Yuan Tian , Geoffrey J. Gordon§†

University of Virginia, Carnegie Mellon University{jc6ub,yuant}@virginia.edu, {han.zhao,ggordon}@cs.cmu.edu∗
equal contribution

Overview

Theoretical Analysis

Empirical Results

Learning Representations that Obfuscate Sensitive Attributes:

Formal Guarantees against Attribute Inference(1) Income prediction on the UCI Adult dataset with sensitive attributes:
gender, age, and education; (2) Gender estimation on UTKFace datasetwith sensitive attributes: age and race.

XZ

min maxh∈H,f hA ∈HAc ◦ f ) − λ Pr(hA (f (X )) = 0 | A = 1)
Err(hS+ Pr(hA (f (X )) = 1 | A = 0)

(1)NORM-TRAIN
PCA

PPLS
PLDA

ALT-UP = 0.1
ALT-UP = 1.0

MAX-ENT = 0.1
MAX-ENT = 1.0

GRL = 1.0
GRL = 5.0

LDP = 1
LDP = 20DPSGD small
DPSGD large

1.0S0.8

min maxh∈H,f hA ∈HA

CEY (h ◦ f ) − λ · CEA (hA ◦ f )(2)Theorem:∗∗
Let f be the optimal feature map such that f = arg min H(Y | Z =f (X )) − λH(A | Z = f (X )) and define H ∗ := H(A | Z = f ∗ (X )). Thenb such that I(A;b A | Z ) = 0, we havefor any adversary A

Err0 + Err1

ObfuscatedRepresentation

Raw Data

Transformation

In practice, we have:

0.6
0.4
0.2
0.0
Adult-Genderb 6= A) ≥ H ∗ /2 lg(6/H ∗ ).
Pr∗ (ADf

Inherent trade-off between Accuracy Maximization and Attribute Obfuscation

PreliminariesACC(h) := 1 − ED |Y − h(X )|Attribute Inference Advantage:hA ∈HAALT-UP = 0.1
ALT-UP = 1.0

MAX-ENT = 0.1
MAX-ENT = 1.0

UTKFace-Race
GRL = 1.0
GRL = 5.0

UTKFace-Age
LDP = 1
LDP = 20DPSGD small
DPSGD large

0.5
0.4
0.3
0.2
0.1

Utility:

ADV(HA ) := max

Implication: If the obfuscated representation Z contains little information
on A, then the inference error made by any adversary has to be large.
A)

Can we prevent the information leakage of the sensitive attribute while still maximizing the task accuracy? Furthermore, what is the fundamental trade-off between attribute
obfuscation and accuracy maximization in the minimax problem?

PPLS
PLDA

Adult-Education

0.6

Pr(AQuestion:

NORM-TRAIN
PCA

Adult-Age

Pr(hA (X ) = 1 | A = 1) − Pr(hA (X ) = 1 | A = 0)
D

D

ADVA (h) = 0 iff I(h(X ); A) = 0 and ADVA (h) = 1 iff h(X ) = A
almost surely or h(X ) = 1 − A
ADV(HA ) + minhA ∈HA Pr(hA (X ) = 0 | A = 1) + Pr(hA (X ) = 1 |A = 0) = 1 if HA is symmetric: the larger the attribute inference
advantage of HA , the smaller the minimum sum of Type-I and TypeII error under attacks from HA .

Theorem: Let H ⊆ 2Z contains all the measurable functions from Z to{0, 1} and D0Y , D1Y be two distributions over Y conditioned on A = 0 andfh^ holds, If
A = 1 respectively. Assume the Markov chain X −→ Z −→ YADV(HA ◦ f ) ≤ DJS (D0Y , D1Y ), then ∀h ∈ H, we havep21YYErr0 (h ◦ f ) + Err1 (h ◦ f ) ≥ dJS (D0 , D1 ) − ADV(HA ◦ f ) .
2Implication: If the label and the sensitive attribute are highly correlated,
we cannot obfuscate the sensitive attribute while still maximizing the task
accuracy simultaneously.

0.0
Adult-Gender

Adult-Age

Adult-Education

UTKFace-RaceUTKFace-Age

The formal guarantees hold for all representation learning based
approaches;

Inherent trade-offs between accuracy maximization and attribute
obfuscation exist for all methods;

Compared to DP-related methods, adversarial representation
learning based approaches leads to better trade-offs;

Conclusion: The adversarial representation learning approaches achieve
the best trade-offs in terms of attribute obfuscation and accuracy maximization.