Adversarial representation learning for synthetic replacement of private attributes

1 INTRODUCTION . Increasing capacity and performance of modern machine learning models lead to increasing amounts of data required for training them ( Goodfellow et al. , 2016 ) . However , collecting and using large datasets which may contain sensitive information about individuals is often impeded by increasingly strong privacy laws protecting individual rights , and the infeasibility of obtaining individual consent . Giving privacy guarantees on a dataset may let us share data , while protecting the rights of individuals , and thus unlocking the large benefits for individuals and for society that big datasets can provide . In this work , we propose a technique for selective obfuscation of image datasets . The aim is to provide the original data as detailed as possible while making it hard for an adversary to detect specific sensitive attributes . The proposed solution is agnostic to the downstream task , with the objective to make the data as private as possible given a distortion constraint . This issue has previously been addressed using adversarial representation learning with some success : a filter model is trained to obfuscate sensitive information while an adversary model is trained to recover the information ( Edwards & Storkey , 2016 ) . In the current work , we demonstrate that it is easier to hide sensitive information if you replace it with something else : a sample which is independent from the input data . Aside from the adversary module , our proposed solution includes two main components : one filter model that is trained to remove the sensitive attribute , and one generator model that inserts a synthetically generated new value for the sensitive attribute . The generated sensitive attribute is entirely independent from the sensitive attribute in the original input image . Following a body of work in privacy-related adversarial learning we evaluate the proposed model on faces from the CelebA dataset ( Liu et al. , 2015 ) , and consider , for example , the smile or gender of a person to be the sensitive attribute . The smile is an attribute that carries interesting aspects in the transformations of a human face . The obvious change reside close to the mouth when a person smiles , but also other subtle changes occur : eyelids tighten , dimples show and the skin wrinkles . The current work includes a thorough analysis of the dataset , including correlations of such features . These correlations make the task interesting and challenging , reflecting the real difficulty that may occur when anonymizing data . What is the right trade-off between preserving the utility as defined by allowing information about other attributes to remain , and removing the sensitive information ? In our setup , the adversary can make an arbitrary number of queries to the model . For each query another sample will be produced from the distribution of the sensitive data , while keeping as much as possible of the non-sensitive information about the requested data point . 2 RELATED WORK . Privacy-preserving machine learning has been studied from a number of different angles . Some work assumes access to a privacy-preserving mechanism , such as bounding boxes for faces , and studies how to hide people ’ s identity by blurring ( Oh et al. , 2016a ) , removing ( Orekondy et al. , 2018 ) or generating the face of other people ( Hukkelås et al. , 2019 ) in their place . Other work assumes access to the utility-preserving mechanism and proposes to obfuscate everything except what they want to retain ( Alharbi et al. , 2019 ) . This raises the question : how do we find the pixels in an image that need to be modified to preserve privacy with respect to some attribute ? Furthermore , Oh et al . ( 2016b ) showed that blurring or removing the head of a person has a limited effect on privacy . The finding is crucial ; we can not rely on modifications of an image such as blurring or overpainting to achieve privacy . An adversarial set-up instead captures the signals that the adversary uses , and can attain a stronger privacy . Adversarial learning is the process of training a model to fool an adversary ( Goodfellow et al. , 2014 ) . Both models are trained simultaneously , and become increasingly good at their respective task during training . This approach has been successfully used to learn image-to-image transformations ( Isola et al. , 2017 ; Choi et al. , 2018 ) , and synthesis of properties such as facial expressions ( Song et al. , 2017 ; Tang et al. , 2019 ) . Privacy-preserving adversarial representation learning utilize this paradigm to learn representations of data that hide sensitive information ( Edwards & Storkey , 2016 ; Zhang et al. , 2018 ; Xie et al. , 2017 ; Beutel et al. , 2017 ; Raval et al. , 2017 ) . Bertran et al . ( 2019 ) minimize the mutual information between the utility variable and the input image data conditioned on the learned representation . Roy & Boddeti ( 2019 ) maximize the entropy of the discriminator output rather than minimizing the log likelihood , which is beneficial for stronger privacy . Osia et al . ( 2020 ) approached the problem using an information-bottleneck . Wu et al . ( 2018 ) , Ren et al . ( 2018 ) , and Wang et al . ( 2019 ) learn transformations of video that respect a privacy budget while maintaining performance on a downstream task . Tran et al . ( 2018 ) proposed an approach for pose-invariant face recognition . Similar to our work , their approach used adversarial learning to disentangle specific attributes in the data . Oh et al . ( 2017 ) trained a model to add a small amount of noise to the input to hide the identity of a person . Xiao et al . ( 2020 ) learn a representation from which it is hard to reconstruct the original input , but from which it is possible to predict a predefined task . The method provides control over which attributes that is preserved , but no control over which attributes that are being censored . That is , it puts more emphasis on preserving utility than privacy , which is not always desired . All of these , with the exception of Edwards & Storkey ( 2016 ) ( see below ) , depend on knowing the downstream task labels . Our work has no such dependency : the data produced by our method is designed to be usable regardless of downstream task . In Edwards & Storkey ( 2016 ) , a limited experiment is included which does not depend on the downstream task . In this experiment , they remove sensitive text which was overlaid on images , a task which is much simpler than the real-world problem considered in the current work . The overlaid text is independent of the underlying image , and therefore the solution does not require a trade-off between utility and privacy which is the case in most real settings . Furthermore , we also replace the sensitive information with synthetic information which we show further strengthens the privacy . Like in the current work , Huang et al . ( 2017 , 2018 ) use adversarial learning to minimize the mutual information between the private attribute and the censored image under a distortion constraint . Our solution extends and improves upon these ideas with a modular design consisting of a filter that is trained to obfuscate the data , and a generator that further enhances the privacy by adding new independently sampled synthetic information for the sensitive attributes . 3 PRIVACY-PRESERVING ADVERSARIAL REPRESENTATION LEARNING . In the current work , we propose a novel solution for utility-preserving privacy-enhancing transformations of data : we use privacy-preserving representation learning to obfuscate information in the input data , and output results that retain the information and structure of the input . 3.1 PROBLEM SETTING . Generative adversarial privacy ( GAP ) ( Huang et al. , 2018 ) was proposed as a method to provide privacy in images under a distortion constraint , and will be used as the baseline in the current work . In GAP , one assumes a joint distribution P ( X , S ) of public data points X and sensitive private attributes S where S is typically correlated with X . The authors define a privacy mechanism X ′ = f ( X , Z1 ) where Z1 is the source of noise or randomness in f . Let hf ( X ′ ) be an adversary ’ s prediction of the sensitive attribute S from the privatized data X ′ according to a decision rule hf . The performance of the adversary is thus measured by a loss function ` f ( hf ( f ( x , z1 ) ) , s ) and the expected loss of the adversary with respect to X , S and Z1 is Lf ( hf , f ) = E x , s∼p ( x , s ) z1∼p ( z1 ) [ ` f ( hf ( f ( x , z1 ) , s ) ] , ( 1 ) where p ( z1 ) is the source of noise . The privacy mechanism f will be trained to be privacy-preserving and utility-preserving . That is , it should be hard for an analyst to infer S from X ′ , but X ′ should be minimally distorted with respect to X . Huang et al . ( 2018 ) formulate this as a constrained minimax problem min f max hf −Lf ( f , hf ) s.t . E x , s∼p ( x , s ) z1∼p ( z1 ) [ d ( f ( x , z1 ) , x ) ] ≤ 1 , ( 2 ) where the constant 1 ≥ 0 defines the allowed distortion for the privatizer and d ( · , · ) is some distortion measure . In the current work , f will be referred to as the filter since the purpose of it is to filter the sensitive information from x . A potential limitation with this formulation is that it only obfuscates the sensitive information in x which may make it obvious to the adversary that x′ is a censored version of x . Instead , we propose to replace the sensitive information with a new independent value s′ . 3.2 OUR CONTRIBUTION . We extend the filter with a generator module g , defined as X ′′ = g ( f ( X , Z1 ) , S′ , Z2 ) where S′ denotes the random variable of the new synthetic value for the sensitive attribute . Z1 and Z2 denote the sources of randomness in f and g respectively . The discriminator hg is trained to predict s when the input is a real image , and to predict the “ fake ” output when the input comes from g as in the learning setup in Salimans et al . ( 2016 ) . The objective of the generator g ( x′ , s′ , z2 ) is to generate a new synthetic ( independent ) sensitive attribute s′ in x′ , that will fool the discriminator hg . We define the loss of the discriminator hg as Lg ( hg , g ) = E x , s∼p ( x , s ) s′∼p ( s′ ) z1 , z2∼p ( z1 , z2 ) [ ` g ( hg ( g ( f ( x , z1 ) , s ′ , z2 ) ) , fake ) ] + E x , s∼p ( x , s ) [ ` g ( hg ( x ) , s ) ] , ( 3 ) where p ( z1 , z2 ) is the source of noise , p ( s′ ) is the assumed distribution of the synthetic sensitive attributes s′ , fake is the fake class , and ` g is the loss function . We formulate this as a constrained minimax problem min g max hg −Lg ( g , hg ) s.t . E x , s∼p ( x , s ) s′∼p ( s′ ) z1 , z2∼p ( z1 , z2 ) [ d ( g ( f ( x , z1 ) , s ′ , z2 ) , x ) ] ≤ 2 , ( 4 ) where the constant 2 ≥ 0 defines the allowed distortion for the generator . In Figure 1 we show the difference between ( a ) minimizing log-likelihood of the adversary , ( b ) maximizing entropy of the adversary , and ( c ) maximizing the entropy of the adversary and also synthetically replace the sensitive attribute with a random sample .

Summary: The paper introduces a framework to privatize sensitive attributes of data using adversarial representation learning. The proposed method consists of a “filter” that removes the sensitive attribute from the data representation, and a “generator” that replaces the removed sensitive attribute with a randomly sampled synthetic value. The authors argue that the second step done by the generator enhances privacy, and use experiments on real image data to verify their method and compare it with a baseline.