Year: 2020

Abstract:
Previous studies have found that an adversary attacker can often infer unintended input information from intermediate-layer features. We study the possibility of preventing such adversarial inference, yet without too much accuracy degradation. We propose a generic method to revise the neural network to boost the challenge of inferring input attributes from features, while maintaining highly accurate outputs. In particular, the method transforms real-valued features into complex-valued ones, in which the input is hidden in a randomized phase of the transformed features. The knowledge of the phase acts like a key, with which any party can easily recover the output from the processing result, but without which the party can neither recover the output nor distinguish the original input. Preliminary experiments on various datasets and network structures have shown that our method significantly diminishes the adversary’s ability in inferring about the input while largely preserves the resulting accuracy.

heading: 1 INTRODUCTION
text: Deep neural networks (DNNs) have shown superb capabilities to process massive volume of data, and local devices such as mobile phones, medical equipment, Internet of Things (IoT) devices have become major data entry points in recent years. Although on-device machine learning has exhibited various advantages, it usually burdens thin devices with overwhelming computational overhead. Yet offloading data or processed features to a cloud operator would put the individual privacy at risk. For example, if a user has a virtual assistant at home, it should not worry about its private data being collected and processed by an untrusted cloud operator. The operator, on the other hand, should not be able to recover original signals or their interpretation.
However, as shown in the previous literature (Dosovitskiy & Brox (2016); Zeiler & Fergus (2014); Mahendran & Vedaldi (2015); Shokri et al. (2017); Ganju et al. (2018); Melis et al. (2019)), intermediatelayer features face many privacy threats, where the adversary either reconstructs the input or infers unintended properties about the input. Hence, on-device processing encounters a dilemma, i.e. while we expect intermediate-layer features to yield high accuracy, we certainly would not want sensitive information to be leaked.
Therefore, we propose a novel method which tweaks a conventional neural network into a complexvalued one, such that intermediate-layer features are released without sacrificing input privacy too much. More precisely, we turn the original real-valued features into complex-valued ones, rotate these features by a random angle, and feed them to the cloud for further processing.
We face two significant challenges in the design. First, the tweaked features have to be correctly handled by the DNN on the cloud. Although network structures vary depending on the input types, it is desired that the piecewise linearity of features to be preserved, so that the resulting accuracy does not degrade too much compared with the original features. Second, an adversary attacker who intercepts the features in the middle should not be able to recover the exact input, nor can it figure out the correct output. Most importantly, the neural network is supposed to be trained using the original data without additional human supervision, and is efficient to conduct inference.
∗Quanshi Zhang is the corresponding author with the John Hopcroft Center and MoE Key Lab of Artificial Intelligence AI Institute, Shanghai Jiao Tong University, China. zqs1022@sjtu.edu.cn
To overcome the first challenge, we tailor operations of DNN to make the succeeding computation at the cloud invariant to feature rotations, i.e., the DNN can correctly handle the feature and preserve the rotated angle in the output. For the second issue, we adopt generative adversarial networks (GAN) to generate synthesized features to hide the original ones. It guarantees k-anonymity such that, when an adversary tries to recover the original input from the complex-valued features, it would get at least k different inputs (Please see Appendix B for detailed discussion). Each of the k reconstructed inputs has equivalent probabilities of being the original input for the attacker. Apart from the GAN part, the training of the neural network adds little additional computation overhead and requires no extra denotations.
Contributions of this study can be summarized as follows. We propose to transform conventional DNNs into complex-valued ones, which hide input information into a randomly chosen phase. Only the party with the phase information can retrieve the correct output. Without it, any party can neither recover the input nor the output. Tested on various datasets and DNNs, our method has been shown to yield only moderate computational overhead and little accuracy degradation, while significantly diminishes the adversary’s ability of inferring about the input.

heading: 2 RELATED WORK
text: Complex-valued neural networks. Using complex-valued features or parameters in neural networks has always been an interesting topic. From the computational perspective, Trabelsi et al. (2018) showed that complex-valued neural networks have a competitive performance with their real-valued counterparts. By augmenting recurrent neural networks with associative memory based on complexvalued vectors, Danihelka et al. (2016) achieved faster learning on memorization tasks. Complexvalued features can contain information in both the phase and the magnitude. An example is that Reichert & Serre (2013) used the phase to indicate properties of spike timing in cortical information processing. Zhang et al. (2019) used the quaternion-valued neural network to learn 3D-rotationequivariant features for 3D point cloud processing. We take advantage of complex-valued features such that original features can be hidden in an unknown phase. Also, Yang et al. (2019) shared a similar transformation-based approach as ours while it performed transformation on inputs rather than features, and it aimed to improve the adversarial robustness of the model.
Privacy-preserving deep learning. Various privacy-preserving mechanisms have been proposed using different definitions of privacy: Osia et al. (2017) applied the Siamese architecture to separate the primary and private information so that the primary information was preserved in the feature. PrivyNet by Li et al. (2017) was proposed to decide the local DNN structure under the privacy constraint based on the peak signal-to-noise ratio or the pixel-wise Euclidean distance. Data nullification and random noise addition were introduced by Wang et al. (2018) to protect private information in the features, which guaranteed differential privacy.
Cryptographic tools have been used to learn from sensitive data. Zhang et al. (2016) adopted homomorphic encryption, in particular, BGV encryption, to encrypt the private data and perform the high-order back-propagation on the encrypted data; Mohassel & Zhang (2017) distributed the private data among two non-colluding servers who performed the secure two-party computation to train models on the joint data. Our scheme achieves k-anonymity privacy guarantee such that any adversary can at best reconstruct a number of synthetic inputs from the transformed features and thus it cannot distinguish the original input from others.

heading: 3 THREAT MODEL AND PRIVACY GUARANTEE
text: In this section, we briefly introduce the threat model and the privacy guarantee that our scheme aims to achieve.
Threat model. In our model, a user processes its raw data locally and transmits the neural network features to the cloud for further processing. An adversary would intercept the transferred features and perform either feature inversion attacks or property inference attacks on these features to either reconstruct inputs, or infer unintended information. Typical examples of the former attacks include feature inversion by Dosovitskiy & Brox (2016), gradient-based visualization by Zeiler & Fergus (2014); Mahendran & Vedaldi (2015), etc. And the latter ones include membership inference attack
by Shokri et al. (2017), passive property inference attack by Ganju et al. (2018) as well as feature leakage in collaborative learning by Melis et al. (2019).
k-anonymity. We aim to achieve the following privacy guarantee: when an adversary tries to reconstruct the original input from the transformed features, it can sythesize inputs belonging to k different prototypes with equivalent likelihoods, and only one of them corresponds to the original input.

heading: 4 APPROACH

heading: 4.1 OVERVIEW
text: To fight against the above threats, we propose to revise the conventional DNN. The new structure is shown in Fig. 1a, where the entire network is divided into the following three modules.
• Encoder is embedded inside a local device at the user end. The encoder extracts feature from the input, hides true feature by rotating the features by a randomized angle, and sends the encoded result to the cloud. • Processing module is located at the public cloud. This module receives and processes the
encoded features without knowing the rotation. At the end of processing, the cloud returns the output to the user. • Decoder resides at the user’s local device. The decoder receives and decodes results sent
from the cloud to obtain the final result.
The three modules are jointly trained. Once trained, the encoder and decoder are placed at the local device, whereas the processing module resides on the cloud for public use. We will illustrate the detail of each module in the following section.

heading: 4.2 COMPLEX-VALUED NEURAL NETWORKS
text: Let (I, y) ∈ D denote an input and its label in the training dataset and g be the encoder at the local device. Given the input I , the intermediate-layer feature is computed as
a = g(I), (1)
but we do not directly submit a to the cloud. Instead, we introduce a fooling counterpart b to construct a complex-valued feature as follows:
x = exp(iθ) [ a+ bi ] , (2)
where θ and b are randomly chosen. b is the fooling counterpart which does not contain any private information of a, but its magnitude is comparable with a to cause obfuscation. The encoded feature is then sent to the processing module Φ, which produces the complex-valued feature h = Φ(x). Upon receiving h, the decoder makes prediction ŷ on I by inverting the complex-valued feature h back:
ŷ = d(<[h · exp(−iθ)]), (3) where d denotes the decoder module, which can be constructed as either a shallow network or just a softmax layer. <(·) denotes the operation of picking real parts of complex values.
Processing Module Φ. The core design of the processing module is to allow the complex-valued feature h = Φ(x) to be successfully decoded later by the decoder. I.e. if we rotate the complexvalued feature a + bi by an angle θ, all the features of the following layers are supposed to be rotated by the same angle. We represent the processing module as cascaded functions of multiple layers Φ(x) = Φn(Φn−1(· · ·Φ1(x))), where Φj(·) denotes the function of the j-th layer and fj = Φj(fj−1) represents the output of the j-th layer. Thus the processing module should have the following property:
Φ(f (θ)) = eiθΦ(f) s.t. f (θ) , eiθf, ∀θ ∈ [0, 2π). (4) In other words, the function of each intermediate layer in the processing module should satisfy
Φj(f (θ) j−1) = e iθΦj(fj−1) s.t. f (θ) j−1 , e iθfj−1, ∀j ∈ [2, . . . , n], ∀θ ∈ [0, 2π). (5) to recursively prove Eqn. (4).
Let us consider six most common types of network layers to construct the processing module, i.e. the convolutional layer, the ReLU layer, the batch-normalization layer, the average/max pooling layer, the dropout layer, and the skip-connection operation. For the convolutional layer, we remove the bias term and obtain Conv(f) = w ⊗ f , which satisfies Eqn. (5). Inspired by Trabelsi et al. (2018), we replace the ReLU with the following non-linear layer:
δ(fijk) = ‖fijk‖
max{‖fijk‖, c} · fijk (6)
where fijk denotes the neural activation at the location (i, j) in the k-th channel of the feature, and c is a positive constant.
Likewise, the batch-normalization operation is replaced by
norm(f lijk) = f lijk√
El[‖f lijk‖2] , (7)
where f l denotes the complex-valued tensor for the l-th sample in the batch.
For max-pooling layers, we modify the rule such that the feature with the maximum norm in the region is selected, which ensures that max-pooling does not change the phase of its input.
For the dropout layer, we randomly drops out both the real and imaginary parts of complex-valued features. Skip connections can be formulated as f + Φ(f), where the inner module Φ(f) recursively satisfies Eqn. (4).
All above six operations satisfy Eqn. (4). Please see supplementary materials for the proof.
GAN-based Encoder. The objective of the encoder is to hide the real feature a of the input I in a certain phase θ of the encoded feature x = exp(iθ) [ a + bi ] . Let a′ = <[x exp(−iθ′)] = <[(a+ bi) exp(iθ − iθ′)] = <[(a+ bi) exp(i∆θ)] denote a feature decoded using a random angle θ′ 6= θ, where ∆θ = θ − θ′. An ideal encoder requires (i) the decoded feature a′ contains sufficient information to cause obfuscation with the real feature a; (ii) a′ and a follow the same distribution so that it is hard to distinguish which one is the real one. Hence, we train the encoder g with a range of ∆θ’s and b’s, and adopt a GAN to distinguish different values of them. Letting D denote the discriminator, we train the encoder g over the WGAN (Arjovsky et al. (2017)) loss:
min g max D
L(g,D) = EI∼pI [ D(a)− E∆θ∼U(0,π),b 6=a [ D(a′) ]] = EI∼pI [ D(g(I))− E∆θ∼U(0,π),b 6=g(I) [ D ( <[(g(I) + bi)ei∆θ] )]] . (8)
g generates features to fool D. Upon convergence, the distribution of a′ approximates that of a. Note that the loss is the expectation over uniform-randomly distributed θ ∈ (0, 2π). Ideally, the expectation in Eqn. (8) should also be taken over all possible ∆θ 6= 0, and thus when an adversary tries to recover a by randomly rotating an angle, it will generate an infinite number of features following the same distribution as that of a. Empirically, we pick k − 1 such ∆θ’s uniformly over (0, π) and iterate through these k − 1 values as negative samples in the adversarial learning. The GAN-based encoder
is the key to our k-anonymity guarantee such that it ensures the real feature cannot be distinguished from at least k − 1 synthetic features. Please find the end of Appendix B to see the visualization effect of our privacy guarantee.
The overall loss of learning is formulated as follows, which contains the adversarial loss in Eqn. (8) and a loss for the target task:
min g,Φ,d max D Loss = min g,Φ,d [ max D L(g,D) + Ltask(ŷ, y) ] , (9)
where Ltask(ŷ, y) represents the loss for the target task.
Note that to simplify the implementation, we compute b = g(I ′) as the feature of a randomly chosen sample I ′ 6= I where ideally I ′ has little correlation with I . In sum, the entire neural network [g,Φ, d] is trained with randomized variables θ and b to minimize the loss in Eqn. (9). Once trained, the network [g,Φ, d] is fixed and publicly released. At the inference phase, the encoder secretly selects a fooling counterpart b and a rotation angle θ to encode its real feature a. The decoder receives the processed result h from the cloud, and make the final prediction based on Eqn. (3).

heading: 4.3 ATTACKS TO COMPLEX-VALUED DNNS
text: We will materialize the attacks described in the threat model in Sec. 3 and make them specific to our proposed complex-valued DNNs.
Feature inversion attacks: The adversary performs two types of attacks. In inversion attack 1, the adversary tries to find out the most likely rotated angle θ̂ to revert the feature x and obtain a∗. An adversary learns to use a∗ to reconstruct the input Î = dec(a∗). Here we define a∗ = <[x exp(−iθ̂)] as the most probable feature recovered by the adversary. The adversary, for instance, can build a new discriminator D′ to obtain θ̂ = maxθD′(<[x exp(−iθ)]). In inversion attack 2, the adversary learns to directly reconstruct the targeted input from the features, i.e., Î = dec(x). We show that our adversarial training strategy boosts the difficulty of learning such a decoder. Let g∗ and D∗ denote the learned encoder and discriminator, respectively. Based on g∗, let us construct the following discriminator D̂(a′) = −‖g∗(I) − g∗(dec(a′))‖. The larger D̂(a′) indicates the higher similarity with the real input. Because D∗ is learned via D∗ = arg maxD L(g∗, D), we have L(g∗, D∗) ≥ L(g∗, D̂). The adversarial loss in Eqn. (8) provides an upper bound of L(g∗, D̂), and thus restricts the capability of dec(·). Property inference attacks: By Ganju et al. (2018), ‘property’ refers to the input attribute, which can be any sensitive information to protect or any attribute not expected to be released with features. For example, given a facial image dataset and an age recognition task, the gender attribute is required to hide in features. By labeling features with properties of the corresponding inputs, the adversary is able to train classifiers on a dataset consisting all the feature-property pairs. Once trained, the classifiers can use intermediate-layer features to infer if the input possesses certain properties.
We consider four attacking strategies. Inference attack 1: the adversary uses raw images to train a classifier to predict hidden properties of the input. At the testing phase, the attacker feeds the reconstructed result dec(a∗) from inversion attack 1 to the classifier to predict hidden properties. Inference attack 2: the adversary first rotates x’s by their respective θ̂ to estimate the most likely feature a∗. The adversary trains and tests the classifier on a∗ to predict hidden properties. Inference attack 3: the adversary uses the result of inversion attack 1 dec(a∗) to train and test a classifier to predict hidden properties. Inference attack 4: different from the aforementioned classification approach, we let the adversary compares a∗ against features of each training example to find its k-nearest neighbors (k-NNs) in the training set and use them to infer the hidden properties.
If a∗ contains sufficient information to recover some property, aforementioned attackers would learn the relationship between a∗ (or dec(a∗)) and the hidden property. Otherwise, the model would fail.

heading: 5 EXPERIMENTS
text: We revised a variety of classical DNNs to complex-valued DNNs and tested them on different datasets to demonstrate the broad applicability of our method. Without loss of generality, tasks include object classification and face attribute estimation, but do not exclude other tasks on DNNs. We have applied a total of two inversion attacks and four inference attacks to the complex-valued DNNs for testing the privacy performance.

heading: 5.1 IMPLEMENTATION DETAILS
text: Complex-valued DNNs: We constructed complex-valued DNNs based on 8 classical DNNs in total, which included the ResNet-20/32/44/56/110 (He et al. (2016)), the LeNet (LeCun et al. (1998)), the VGG-16 (Simonyan & Zisserman (2015)), and the AlexNet (Krizhevsky et al. (2012)). As shown in Fig. 1a, we divided each original DNN into three modules which were referred to as the encoder/processing module/decoder correspondingly. The structure is given by the top row of Fig. 1b. The bottom row of Fig. 1b gives the architecture of revised DNNs. Given the original DNNs, the encoder/processing/decoder modules were divided as follows. For the residual network, we tested two variants — ResNet-α and ResNet-β — in the α-variant, the output of the layer before the first 16× 16 feature map was fed to the aforementioned GAN, and layers following the first 8× 8 feature map constituted the decoder. The β-variant was the same with the α-variant except that the decoder was composed by the last residual block and the layers following it. The processing module of a residual network was modified such that c = 1 in δ(·) for all non-linear layers. The encoder of the LeNet consisted of the first convolutional layer and the GAN, whereas its decoder only contained the softmax layer. All layers before the last 56×56 feature map of VGG-16 comprised the encoder. The decoder consisted of fully-connected layers and the softmax layer. For the AlexNet, the output of the first three convolutional layers was fed into GAN, and the decoder contained fully-connected layers and the softmax layer. In the processing modules of these DNNs, we set ck = Eij‖x′ijk‖ for neural activations in the k-th channel.
Baselines: Beside the complex-valued DNN, we constructed three baseline networks for comparison.
Original DNNs (baseline 1): The original DNN without any revision was taken as the first baseline network. For ease of presentation, we also divided the original DNNs into the encoder, the processing module, and the decoder. The division of modules for original DNNs was the same as that for complex-valued DNNs.
Noisy DNNs (baseline 2): Based on the original DNNs, we injected noise right after the encoder module, which was given as a + γ · (we set γ = 0.5, 1.0, 2.0). The noisy feature was fed to the processing module instead of a, as shown in the second row of Fig. 1b. Here represents a high-dimensional random noise with the same average magnitude as a.
DNNs with additional layers (baseline 3): Since the encoder was based on GAN, additional layers needed to be added, when we revised the DNN. We chose a GAN which incorporated a generator consisting of a convolutional layer with 3 × 3 × K filters, and a discriminator composed by a convolutional layer as well as a fully-connected layer. We designed this baseline for fair comparison, because additional layers in GAN, although without adversarial loss, would incur model structure changes. Its structure is illustrated by the third row of Fig. 1b.
Attacks: Privacy attacking was implemented as follows. (1) Inversion attacks: we implemented the inversion attacker based on U-net (Ronneberger et al. (2015)). The original U-net consisted of 8 blocks, and we revised the U-net to construct the attacker. The input feature of the U-net was first up-sampled to the size of the input, which will be fed into the inversion model. There were four down-sampling blocks and four up-sample blocks. Each block contained six convolutional layers for better reconstruction performance. Each down-sample block reduced the size of the feature by half. Each up-sample block doubled the size of the feature map. Thus, the output of the inversion model was of the same size as the input image. (2) Inference attacks: we selected CelebA and CIFAR-100 datasets to test robustness against property inference attacks. For CelebA, we evaluated the accuracy performance on classifying 30 attributes and the privacy performance on the rest 10 attributes. Likewise, the accuracy of the DNN on CIFAR-100 was evaluated by the classification error of the major 20 superclasses, and the privacy was gauged by the classification error of the 100 minor classes.
CelebA and CIFAR-100 adopted the AlexNet and the ResNet-56, respectively, as prototype models. Their attacker nets were implemented as the ResNet-50 and the ResNet-56, respectively.
Dataset Average Error
ResNet-20-α CIFAR-10 0.7890 ResNet-20-β CIFAR-10 0.7859 ResNet-32-α CIFAR-10 0.7820 ResNet-32-β CIFAR-10 0.7843 ResNet-44-α CIFAR-10 0.8411 ResNet-44-β CIFAR-10 0.7853 ResNet-56-α CIFAR-10 0.8088 ResNet-56-β CIFAR-10 0.8283 ResNet-110-α CIFAR-10 0.8048 ResNet-110-β CIFAR-10 0.7818 LeNet CIFAR-10 0.7884 LeNet CIFAR-100 0.8046 ResNet-56-α CIFAR-100 0.7898 ResNet-110-α CIFAR-100 0.7878 VGG-16 CUB-200 1.5572 AlexNet CelebA 0.8500
Table 4: Average error (absolute value) of the estimated rotation angle θ in radian.

heading: 5.2 EVALUATION METRICS
text: We evaluated three aspects of the revised DNNs’ performance: accuracy, privacy, and efficiency. Accuracy concerned the performance of the model on the task. Privacy was measured by the robustness of our DNNs against inversion attacks and inference attacks. More specifically, for inversion attacks, we had the following measures: (1) the average error of the estimation about the rotated angle θ∗, i.e. |θ∗ − θ̂|; (2) the pixel-level reconstruction error E[‖Î − I‖] where the value of each pixel was scaled to [0, 1]; (3) failure rate of human identification of the reconstructed images. For inference attacks, we measured the robustness of DNNs by the error rate of each attack model (see Sec. 4.3). As to efficiency, we measured the processing time compared with the baseline.

heading: 5.3 EXPERIMENTAL RESULTS AND ANALYSIS
text: Fig. 2 visualizes images reconstructed using features of different baseline networks. Due to space constraint, this figure only shows partial results. For a complete result, please refer to the supplementary file. Visual effects were significant as the reconstruction in the bottom two rows greatly shifted away from the original input. Obviously, other misleading input attributes were mixed up with the original ones. To further examine the effect, we compared classification error rates and reconstruction errors on a variety of datasets and DNNs in Table 1 and 2. Since the revised DNNs introduced additional layers to the original DNNs, we compared the performance of both the original DNNs as well as those with additional layers. Our complex-valued DNNs achieved similar utility performance, and exhibited significantly higher reconstruction error in almost all groups.
Further, we mimiced the adversary to recover the rotated angle θ∗ with the help of a discriminator model. Most errors fell into (π/4, π/2) according to Table 4, which indicates even the discriminator could not tell the original features. We also qualitatively tested the reconstructed result in Table 3.
Fig. 3 and Table 5 show the error rates in inferring hidden properties by attackers. We observed that in Fig. 3-(a),(c), the error rate of the inference attack 1 on the complex-valued DNNs (dec(a∗)) was significantly higher than on the baseline 1 (raw images) and baseline 3 (dec(a)), and was close to random selection (99%) on CIFAR-100. We further tested inference attack 2 and 3. In Fig. 3-(b),(d), the error rates of the attacker nets trained on a∗ and dec(a∗) were both significantly higher than that
of baseline 3, i.e. a∗ indicated little about the hidden properties. k-NN methods yielded similar results. Last but not least, we compared the running time of processing the images with different DNNs. Batch size of 128 and 100 are used respectively for CelebA and CIFAR-100. It is shown that the complex-valued DNNs had comparable performance with the baseline.

heading: 6 CONCLUSION AND DISCUSSIONS
text: We propose a novel method to preserve input privacy in the intermediate-layer features of deep neural networks. The method transforms a traditional DNN into a complex-valued one. Our method has been tested on a variety of datasets and models. The experimental results have shown the method effectively boosts the difficulty of inferring inputs for the adversary, while largely preserving accuracy for the user. Please also find in the appendices for supplemental experiments.
Theoretically, not only the encoder output but also all other intermediate-layer features in the processing module can preserve privacy. However, we only need to invert the encoder output to test the privacy performance, since all features in successive layers can be expressed as cascaded functions of the encoder output. Thus we may consider the privacy performance of the encoder output as the worst case for all features in the processing module.

heading: ACKNOWLEDGEMENTS
text: This work was partially supported by National Natural Science Foundation of China (U19B2043, 61906120, and 61902245), and the Science and Technology Innovation Program of Shanghai (Grant 19YF1424500).

heading: A PROOF OF Φ(eiθx) = eiθΦ(x)
text: In this paper, we design the processing module to ensure features of all layers are rotated by the same angle, in order to enable the later decryption of the feature.
x(0) = a+ bi
x(θ) = eiθx(0)
} ⇒ ∀j, f (θ)j = eiθf (0) j
where f (θ)j and f (0) j represent the feature map computed using the input x (θ) and that computed using the input x(0), respectively.
In order to prove the above equation, we revise basic layers/operations in the processing module to ensure
Φ(eiθx) = eiθΦ(x)
where Φ(·) denotes the function of a certain layer/operation. x is given as the input of the specific layer/operation Φ(·). Based on this equation, we can recursively prove f (θ)j = eiθf (0) j .
Let us consider the following six most common types of layers/functions to construct the processing module, i.e. the conv-layer, the ReLU layer, the batch-normalization layer, the average/max pooling layer, the dropout layer, and the skip-connection operation.
1. We revise the conv-layer by omitting the bias term. Thus, we get
Φ(eiθx) = w ⊗ [eiθx] = eiθ[w ⊗ x] = eiθΦ(x)
2. We replace the ReLU layer with the non-linear activation function of φ(xijk) = ‖xijk‖ max{‖xijk‖,c} ·xijk. Thus, we can write the element-wise operation as follows.
φ(eiθxijk) = ‖eiθxijk‖
max{‖eiθxijk‖, c} · [eiθxijk] = eiθ [ ‖xijk‖ max{‖xijk‖, c} · xijk ] = eiθφ(xijk)
3. We replace the batch-normalization layer with the function of φ(xlijk) = xlijk√
Eijl[‖xlijk‖2] . Thus, we
can write the element-wise operation as follows.
φ(eiθxlijk) = eiθxlijk√
Eijl[‖eiθxlijk‖2] = eiθ [ xlijk√ Eijl[‖xlijk‖2] ] = eiθφ(xlijk)
4. For the the average/max pooling layer and the dropout layer, we can represent their functions in the form of Φ(x) = Ax, where x is given as a vectorized feature, and A denotes a matrix. For the average/max-pooling operation, A represents the selection of neural activations. For the dropout layer, A contains binary values that indicate the dropout state. In this way, we get
Φ(eiθx) = A(eiθx) = eiθ[Ax] = eiθΦ(x)
5. For the skip-connection operation, we get
Φ(eiθx) = eiθx+ Ψ(eiθx) = eiθ[x+ Ψ(x)] = eiθΦ(x)
where Ψ(·) denotes the function that is skipped by the connection. We can recursively ensure Ψ(eiθx) = eiθΨ(x).

heading: B ARCHITECTURE OF THE GAN
text: The architecture of GAN is based on the residual network. The generator consists of an input convolutional layer, a residual block from the residual network, and a convolutional layer for the output. The residual block contains two convolutional layers, and a skip connection. Thus, there are four convolutional layers in the generator. The output of the generator is of the same size as the input. The architecture of the discriminator is similar to that of the generator, but the output of the discriminator is a scalar instead of a tensor.

heading: C EXPERIMENTS: VISUALIZATION
text: Fig. 4, Fig. 5 and Fig. 6 respectively give the visualization effect on CIFAR-10, CUB200-2011, and CelebA, when reconstructing the inputs from features.
Fig. 7 shows the reconstructed input images when an adversary launches a feature inversion attack: it rotates x by an angle continuously drawn from (0, 2π) and then reconstruct the input on the rotated features. The first image of every two row is the original input image. We found that most meaningful reconstructed pictures are mostly drawn from (θ + π4 , θ − 3π4 ). Most reconstructed images have little
resemblance to the original input, and present meaningful interpolation of the original sample and the randomly chosen sample. The result is an illustration of our k-anonymity privacy guarantee.
Fig. 8 shows images reconstructed from correctly decoded features. The result demonstrates that, with the ‘key’ — θ, one can successfully recover original inputs from features.

Review summaries:
In this paper, the authors propose to hide information in phase of the input features. They proposed that if each layer of processing layer, sitting outside of the local unit, is phase preserving, then they can recover the phase back. They propose a modification to the most popular layers in DNN to satisfy that property.

This paper proposes a novel way to outsource a part of the information processing in a deep learning model to an untrusted remote location while revealing only little information about the input or final output of the computation. To this end the result of an on-chip encoder (e.g. the first N layers of a ConvNet) is encoded in a complex number with a random phase, which is then shipped to a remote location and gets processed (the next M layers of a ConvNet) in a way that is phase-equivariant. This result is shipped back to the device which extracts the desired information by inverting the phase randomisation. Additional distractor signals are encoded through a GAN-type approach.