Generative Adversarial Models for Learning Private and Fair Representations

1 INTRODUCTION . The use of deep learning algorithms for data analytics has recently seen unprecedented success for a variety of problems such as image classification , natural language processing , and prediction of consumer behavior , electricity use , political preferences , to name a few . The success of these algorithms hinges on the availability of large datasets , that often contain sensitive information , and thus , may facilitate learning models that inherit societal biases leading to unintended algorithmic discrimination on legally protected groups such as race or gender . This , in turn , has led to privacy and fairness concerns and a growing body of research focused on developing representations of the dataset with fairness and/or privacy guarantees . These techniques predominantly involve designing randomizing schemes , and in recent years , distinct approaches with provable statistical privacy or fairness guarantees have emerged . In the context of privacy , preserving the utility of published datasets while simultaneously providing provable privacy guarantees is a well-known challenge . While context-free privacy solutions , such as differential privacy ( Dwork et al. , 2006b ; a ; Dwork , 2008 ; Dwork & Roth , 2014 ) , provide strong worst-case privacy guarantees , they often lead to a significant reduction in utility . In contrast , context-aware privacy solutions , e.g. , mutual information privacy ( Rebollo-Monedero et al. , 2010 ; Calmon & Fawaz , 2012 ; Sankar et al. , 2013 ; Salamatian et al. , 2015 ; Basciftci et al. , 2016 ) , achieve improved privacy-utility tradeoff , but assume that the data holder has access to dataset statistics . In the context of fairness , machine learning models seek to maximize predictive accuracy . Fairness concerns arise when models learned from datasets that include patterns of societal bias and discrimination inherit such biases . Thus , there is a need for actively decorrelating sensitive and non-sensitive data . In the context of publishing datasets or meaningful representations that can be “ universally ” used for a variety of learning tasks , modifying the training data is the most appropriate and is the focus of this work . Fairness can then be achieved by carefully designing objective functions which approximate a specific fairness definition while simultaneously ensuring maximal utility ( Zemel et al. , 2013 ; Calmon et al. , 2017 ; Ghassami et al. , 2018 ) . This , in turn , requires dataset statistics . Adversarial learning approaches for context-aware privacy and fairness have been studied extensively ( Edwards & Storkey , 2015 ; Abadi & Andersen , 2016 ; Raval et al. , 2017 ; Huang et al. , 2017 ; Tripathy et al. , 2017 ; Beutel et al. , 2017 ; Madras et al. , 2018 ; Zhang et al. , 2018 ) . They allow the data curator to cleverly decorrelate the sensitive attributes from the rest of the dataset . These approaches overcome the lack of statistical knowledge by taking a data-driven approach that leverages recent advancements in generative adversarial networks ( GANs ) ( Goodfellow et al. , 2014 ; Mirza & Osindero , 2014 ) . However , most existing efforts focus on extensive empirical studies without theoretical verification and focus predominantly on providing guarantees for a specific classification task . This work introduces a general framework for context-aware privacy and fairness that we call generative adversarial privacy and fairness ( GAPF ) ( see Figure 1 ) . We provide precise connections to information-theoretic privacy and fairness formulations and derive game-theoretically optimal decorrelation schemes to compare against those learned directly from the data . While our framework can be generalized to learn an arbitrary representation using an encoder-decoder structure , this paper primarily focuses on learning private/fair representations of the data ( of the same dimension ) . Our Contributions . We list our main contributions below . 1 . We introduce GAPF , a framework for creating private/fair representations of data using an adversarially trained conditional generative model . Unlike existing works , GAPF can create representations that are useful for a variety of classification tasks , without requiring the designer to model these tasks at training time . We validate this observation via experiments on the GENKI ( Whitehill & Movellan , 2012 ) and HAR ( Anguita et al. , 2013 ) datasets . 2 . We show that via the choice of the adversarial loss function , our framework can capture a rich class of statistical and information-theoretic adversaries . This allows us to compare data-driven approaches directly against strong inferential adversaries ( e.g. , a maximum a posteriori probability ( MAP ) adversary with access to dataset statistics ) . We also show that by carefully designing the loss functions in the GAPF framework , we can enforce demographic parity . 3 . We make precise comparison between data-driven privacy/fairness methods and the minimax game-theoretic GAPF formulation . For Gaussian mixture data , we derive game-theoretically optimal decorrelation schemes and compare them with those that are directly learned in a datadriven fashion to show that the gap between theory and practice is negligible . Furthermore , we propose using mutual information estimators to verify that no adversary ( regardless of their computational power ) can reliably infer the sensitive attribute from the learned representation . Related work . In the context of publishing datasets with privacy and utility guarantees , a number of similar approaches have been recently considered . We briefly review them here . A detailed literature review is included in Appendix A. DP-based obfuscators for data publishing have been considered in ( Hamm , 2016 ; Liu et al. , 2017 ) . These novel approaches leverage non-generative minimax filters and deep auto-encoders to allow non-malicious entities to learn some public features from the filtered data , while preventing malicious entities from learning other sensitive features . However , DP can still incur a significant utility loss since it assumes worst-case dataset statistics . Our approach models a rich class of randomization-based schemes via a generative model that allows the generative decorrelator to tailor the noise to the dataset . Our work is closely related to adversarial neural cryptography ( Abadi & Andersen , 2016 ) , learning censored representations ( Edwards & Storkey , 2015 ) , privacy preserving image sharing ( Raval et al. , 2017 ) , privacy-preserving adversarial networks ( Tripathy et al. , 2017 ) , and adversarially learning fair representation ( Madras et al. , 2018 ) in which adversarial learning is used to learn how to protect communications by encryption or hide/remove sensitive information or generate fair representation of the data . Similar to these problems , our model includes a minimax formulation and uses adversarial neural networks to learn decorrelation schemes that prevent an adversary from inferring the sensitive variable . However , most of these papers use non-generative auto-encoders to remove sensitive information . Instead , we use a GANs-like approach to learn decorrelation schemes . We also go beyond in formulating a game-theoretic setting subject to a distortion constraint which allows us to learn private/fair representation for a variety of learning tasks . Enforcing the distortion constraint calls for a new training process that relies on the Penalty method or Augmented Lagrangian method presented in Appendix C. We show that our framework captures a rich class of statistical and information-theoretic adversaries by changing the loss function . We also compare the performance of data-driven privacy/fairness methods and the minimax game-theoretic GAPF . Fair representations using information-theoretic objective functions and constrained optimization have been proposed in ( Calmon et al. , 2017 ; Ghassami et al. , 2018 ) . However , both approaches require the knowledge of dataset statistics , which is very difficult to obtain for real datasets . We overcome the issue of statistical knowledge by taking a data-driven approach , i.e. , learning the representation from the data directly via adversarial models . In contrast to in-processing approaches that modify learning algorithms to ensure fair predictions ( e .. g , using linear programs in ( Dwork et al. , 2012 ; Fish et al. , 2016 ) or via adversarial learning approach in ( Zhang et al. , 2018 ) ) , we focus on a pre-processing approach to ensure fairness for a variety of learning tasks . Using GANs to generate synthetic non-sensitive attributes and labels which ensure fairness while preserving the utility of the data ( predicting the label ) has been studied in ( Xu et al. , 2018 ; Sattigeri et al. , 2018 ) . Rather than using a conditional-generative model to generate synthetic data , we focus on creating fair/private representations of the original data while preserving the utility of the representations for a variety of learning tasks by learning nonlinear compression and noise adding schemes via a generative adversarial model . 2 GENERATIVE ADVERSARIAL MODEL FOR PRIVACY AND FAIRNESS . We consider a datasetD with n entries where each entry is denoted as ( S , X , Y ) where S ∈ S is the sensitive variable , X ∈ X is the public variable , and Y ∈ Y is the target ( non-sensitive ) variable ( for learning ) . Instances of X , S , and Y are denoted by x , s and y , respectively . We assume that each entry ( X , S , Y ) is independent and identically distributed according to P ( X , S , Y ) . Notice that we model ( X , S , Y ) jointly in the dataset . However , GAPF does not require the knowledge of Y . Privacy and fairness . Context-aware notions of privacy model how well an adversary , with access to the public dataX , can infer the sensitive features S from the data . Research on context-aware privacy focus on privacy that capture a range of adversarial capabilities ranging from a belief refining adversary using mutual information to quantify privacy to a guessing adversary using a hard-decision rule . On the other hand , recent results on fairness in learning applications guarantees that for a specific target variable Y , the prediction of a machine learning model is accurate with respect to ( w.r.t . ) Y but unbiased w.r.t . the sensitive variable S. The three oft-used fairness measures are demographic parity , equalized odds , and equal opportunity . Demographic parity imposes the strongest fairness requirement via complete independence of Ŷ and S , and thus , least favors ( for correlated Y and S ) utility ( Hardt et al. , 2016 ) . Equalized odds ensures this independence conditioned on the label Y thereby ensuring equal rates for true and false positives ( binary Y ) for all demographics . Equal opportunity ensures equalized odds for the true positive case alone ( Hardt et al. , 2016 ) . When publishing a useful representation of the data for multiple users with different learning tasks , it is difficult to identify a set of target variables ( labels ) a priori . Thus , our decorrelation scheme does not restrict itself to a specific Y . Formally , we define the decorrelation schemes as a randomized mapping given by X̂ = g ( X ) . We note that g ( · ) can more generally depend on both X and S but for the sake of simplicity , we restrict our attention to schemes that only depend on X . Let h be a decision rule used by the adversary to infer the sensitive variable S as Ŝ = h ( g ( X ) ) from the representation g ( X ) . We allow for hard decision rules under which h ( g ( X ) ) is a direct estimate of S and soft decision rules under which h ( g ( X ) ) = Ph ( ·|g ( X ) ) is a distribution over S. To quantify the adversary ’ s performance , we use a loss function ` ( h ( g ( X = x ) ) , S = s ) defined for every public-sensitive pair ( x , s ) . Thus , the adversary ’ s expected loss w.r.t . X and S is L ( h , g ) , E [ ` ( h ( g ( X ) ) , S ) ] , where the expectation is taken over P ( X , S ) and the randomness in g and h. Intuitively , the generative decorrelator would like to minimize the adversary ’ s ability to learn S reliably from the published representation . This can be trivially done by releasing an X̂ independent of X . However , such an approach provides no utility for data analysts who want to learn nonsensitive variables from X̂ . To overcome this issue , we capture the loss incurred by perturbing the original data via a distortion function d ( x̂ , x ) , which measures how far the original data X = x is from the processed data X̂ = x̂ . Ensuring statistical utility in turn requires constraining the average distortion E [ d ( g ( X ) , X ) ] where the expectation is taken over P ( X , S ) and the randomness in g. The data holder would like to find a decorrelation scheme g that is both privacy/fairness preserving ( in the sense that it is difficult for the adversary to learn S from X̂ ) and utility preserving ( in the sense that it does not distort the original data too much ) . In contrast , for a fixed decorrelation scheme g , the adversary would like to find a ( potentially randomized ) function h that minimizes its expected loss , which is equivalent to maximizing the negative of the expected loss . This leads to a constrained minimax game between the generative decorrelator and the adversary given by min g ( · ) max h ( · ) − L ( h , g ) , s.t . E [ d ( g ( X ) , X ) ] ≤ D , ( 1 ) where the constant D ≥ 0 determines the allowable distortion for the generative decorrelator and the expectation is taken over P ( X , S ) and the randomness in g and h. Our GAPF framework places no restrictions on the adversary . Indeed , different loss functions and decision rules lead to different adversarial models . In what follows , we consider a general α-loss function ` ( h ( g ( X ) ) , s ) = αα−1 ( 1− Ph ( s|g ( X ) ) 1− 1 α ) , α > 1 introduced in ( Liao et al. , 2018 ) . We show that α-loss can capture various information-theoretic adversaries ranging from a hard-decision adversary under the 0-1 loss function ` ( h ( g ( X ) ) , s ) = Ih ( g ( X ) ) 6=s to a soft-decision adversary under the log-loss function ` ( h ( g ( X ) ) , s ) = − logPh ( s|g ( X ) ) . Theorem 1 . Under α-loss , the optimal adversary decision rule is a ‘ α-tilted ’ conditional distribution P ∗h ( s|g ( X ) ) = P ( s|g ( X ) ) α∑ s∈S P ( s|g ( X ) ) α . The objective in equation 1 reduces to ming ( · ) Iaα ( g ( X ) ; S ) − Hα ( S ) , where Iaα is the Arimoto mutual information and Hα is the Rényi entropy . Under the hard-decision rules in which the adversary uses a 0-1 loss function , the optimal adversarial strategy simplifies to using a MAP decision rule that maximizes P ( s|g ( X ) ) . For a soft-decision adversary under log-loss , the optimal adversarial strategy h∗ is P ( s|g ( X ) ) and the GAPF minimax problem in equation 1 simplifies to ming ( · ) I ( g ( X ) ; S ) subject to E [ d ( g ( X ) , X ) ] ≤ D , where I ( g ( X ) ; S ) is the mutual information ( MI ) between g ( X ) and S. Corollary 1 . Using α-loss , we can obtain a continuous interpolation between a hard-decision adversary under 0-1 loss ( α→∞ ) and a soft-decision adversary under log-loss function ( α→ 1 ) . Proposition 1 . Under log-loss , GAPF enforces fairness subject to the distortion constraint . As the distortion increases , the ensuing fairness guarantee approaches ideal demographic parity . The proofs of Theorem 1 , Corollary 1 and Proposition 1 are presented in Appendix B . Many notions of fairness rely on computing probabilities to ensure independence of sensitive and target variables that are not easy to optimize in a data-driven fashion . In Proposition 1 , we propose log-loss ( modeled in practice via cross-entropy ) in GAPF as a proxy for enforcing fairness . Data-driven GAPF . Thus far , we have focused on a setting where the data holder has access to P ( X , S ) . When P ( X , S ) is known , the data holder can simply solve the constrained minimax optimization problem in equation 1 ( game-theoretic version of GAPF ) to obtain a decorrelation scheme that would perform best against a chosen type of adversary . In the absence of P ( X , S ) , we propose a data-driven version of GAPF that allows the data holder to learn decorrelation schemes directly from a dataset D = { ( x ( i ) , s ( i ) ) } ni=1 . Under the data-driven version of GAPF , we represent the decorrelation scheme via a generative model g ( X ; θp ) parameterized by θp . This generative model takes X as input and outputs X̂ . In the training phase , the data holder learns the optimal parameters θp by competing against a computational adversary : a classifier modeled by a neural network h ( g ( X ; θp ) ; θa ) parameterized by θa . In the evaluation phase , the performance of the learned decorrelation scheme can be tested under a strong adversary that is computationally unbounded and has access to dataset statistics . We follow this procedure in the next section . In theory , the functions h and g can be arbitrary . However , in practice , we need to restrict them to a rich hypothesis class . Figure 1 shows an example of the GAPF model in which the generative decorrelator and adversary are modeled as deep neural networks . For a fixed h and g , if S is binary , we can quantify the adversary ’ s empirical loss using cross entropy Ln ( θp , θa ) = − 1n n∑ i=1 s ( i ) log h ( g ( x ( i ) ; θp ) ; θa ) + ( 1 − s ( i ) ) log ( 1 − h ( g ( x ( i ) ; θp ) ; θa ) ) . It is easy to generalize cross entropy to the multi-class case using the softmax function . The optimal model parameters are the solutions to min θp max θa − Ln ( θp , θa ) , s.t . ED [ d ( g ( X ; θp ) , X ) ] ≤ D , ( 2 ) where the expectation is over D and the randomness in g. The minimax optimization in equation 2 is a two-player non-cooperative game between the generative decorrelator and the adversary with strategies θp and θa , respectively . In practice , we can learn the equilibrium of the game using an iterative algorithm ( see Algorithm 1 in Appendix C ) . We first maximize the negative of the adversary ’ s loss function in the inner loop to compute the parameters of h for a fixed g. Then , we minimize the decorrelator ’ s loss function , which is modeled as the negative of the adversary ’ s loss function , to compute the parameters of g for a fixed h. Observe that the distortion constraint in equation 2 makes our minimax problem different from what is extensively studied in previous works . To incorporate the distortion constraint , we use the penalty method ( Lillo et al. , 1993 ) to replace the constrained optimization problem by adding a penalty to the objective function . The penalty consists of a penalty parameter ρt multiplied by a measure of violation of the constraint at the tth iteration . The constrained optimization problem of the generative decorrelator can be approximated by a series of unconstrained optimization problems with the loss function Ln ( θp , θa ) + ρt ( max { 0 , E [ d ( g ( x ( i ) ; θp ) , x ( i ) ) ] −D } ) 2 , where ρt is a penalty coefficient increases with the number of iterations t. The algorithm and the penalty method are detailed in Appendix C .

Summary:     The paper authors provide a good overview of the related work to Private/Fair Representation Learning (PRL). Well written, The theoretical approach is extensively explained and the first sections of the paper are easy to follow. The authors demonstrate the model performance on or the GMM, the comparison between theoretical and data driven performance is a good case study to understand the PRL.