Privacy-preserving Representation Learning by Disentanglement
Authors: Tassilo Klein
Moin Nabi
Venue:  (2020)

Abstract: Deep learning and latest machine learning technology heralded an era of success in data analysis. Accompanied by the ever increasing performance, reaching super-human performance in many areas, is the requirement of amassing more and more data to train these models. Often ignored or underestimated, the big data curation is associated with the risk of privacy leakages. The proposed approach seeks to mitigate these privacy issues. In order to sanitize data from sensitive content, we propose to learn a privacy-preserving data representation by disentangling into public and private part, with the public part being shareable without privacy infringement. The proposed approach deals with the setting where the private features are not explicit, and is estimated though the course of learning. This is particularly appealing, when the notion of sensitive attribute is ``fuzzy''. We showcase feasibility in terms of classification of facial attributes and identity on the CelebA dataset. The results suggest that private component can be removed in the cases where the the downstream task is known a priori (i.e., ``supervised''), and the case where it is not known a priori (i.e., ``weakly-supervised'').

Under review as a conference paper at ICLR 2020
PRIVACY-PRESERVING REPRESENTATION LEARNING BY DISENTANGLEMENT
Anonymous authors Paper under double-blind review
ABSTRACT
Deep learning and latest machine learning technology heralded an era of suc- cess in data analysis. Accompanied by the ever increasing performance, reaching super-human performance in many areas, is the requirement of amassing more and more data to train these models. Often ignored or underestimated, the big data cu- ration is associated with the risk of privacy leakages. The proposed approach seeks to mitigate these privacy issues. In order to sanitize data from sensitive content, propose to learn privacy-preserving data representation by disen- tangling into public and private part, with the public part being shareable without privacy infringement. The proposed approach deals with the setting where the pri- vate features are not explicit, and estimated though the course of learning. This is particularly appealing. when the notion of sensitive attribute "fuzzy". We showcase feasibility in terms of classification of facial attributes and identity on the CelebA dataset. The results suggest that private component can be removed in the cases where the the downstream task is known a priori (i.e., "supervised"), and the case where it is not known a priori (i.e., supkly-supervised")..
INTRODUCTION
In recent years, learning with DNNs has brought impressive advances the state-of-the-arr across a wide variety of machine-learning tasks and applications. Yet, these approaches are generally only capable of significant performance leaps when large amounts of training data are provided for training purposes. However, building and curating such large data corpora comes with many strings attached. Firstly, it is cumbersome, expensive as well as time consuming to amass sufficient and foremost clean data. Apart from that, amassing large amounts of data increases the risk of privacy creep, i.c. subtly encoding privacy related information Narayanan & Shmatikov (2006); [Backstrom et al. (2007). In this regard, many datasets have been released into the public domain that are unintentionally permeated with private information about individuals, raising serious concerns about data privacy. In Narayanan & Shmatikov (2006) anonymization could be reversed by making use of publicly available data, e.g. movie reviews. In Wachinger et al. (2015) showed, that the surface of magnet resonance images (MRT) of the brain can be used to identify people potentially allow for unintended disease progression. Growing privacy concerns will entails the risk of becoming major deterrent in the widespread adoption of machine learning and the attainment of their concomitant benefits. Therefore, reliable and accurate privacy-preserving methodologies are needed, which is why the topic lately has enjoyed increased attention in the research community.
Several efforts have been made in machine learning to develop algorithms that preserve user privacy while achieving reasonable predictive power. This is even more challenging in the client-server scenario. Therein, the clients are supposed to send information to the server, which in turn then performs operations such as training for the client. The crucial aspect this case is about the client's 's confidential data. As an example, consider a set of clients that aim at collaboratively learning an attribute classifier on face images, while preserving the identities of the individuals. Ideally the trained model, which classifies non-sensitive attributes (e.g.. having glasses not) with high accuracy, at the same time fails in classifying sensitive attributes them (e.g., gender).
A standard approach to address the privacy issue in the client-server setup is to anonymize the data of clients. This often achieved by directly obfuscating the private part(s) of the data and/or adding random noise to raw data. Consequently, is the noise level controlling the trade-off between

---

Under review as a conference paper at ICLR 2020
predictive quality and user privacy (e.g., Differential Privacy Dwork 2 Abadi et al. (016 These approaches, associate a privacy budget with all operations on the dataset. Complex training procedures run the risk of exhausting the budget before convergence.
Another widely adopted solution is rely on encoded data representation. Following this notion, instead of the client's data a feature representation is transferred to the server instead. Unfortunately, the extracted features may still contain rich information, which can breach user privacy (Osia et al. (017 2018). Specifically, in the example above, an attacker can exploit the eavesdropped features to reconstruct the raw image, and hence the person on the raw image can be re-identified from the reconstructed image Mahendran & Vedaldi (2015).In addition, the extracted features can also be exploited by an attacker to infer private attributes Salem et al. (2019).
A recent solution such a problem has been federated learning McMahan et al. (2016); Geyer al. (017)) which allows us to collaboratively train a centralized model while keeping the training data decentralized. The idea behind this strategy that the clients transfer the training gradients of data to the server instead of the data itself. While such an approach is appealing to train neural network with data hosted different clients, does not allow the use of centralized model for making prediction at test time. Furthermore, transferring the models between clients and server entails significant data transmission, which considerably prolongs training. What is more, averaging the gradients across the clients further slows the backpropagation.
Most importantly, all of the aforementioned methods are mainly applicable when the private at- tributes are known priori. That his, these approaches typically fail to prevent privacy attacks when the private information contained in the dataset not explicitly identified. Some scenarios also defy simple annotation of private content, e.g. imagery of military and civilian commodities. In such scenarios, it is highly desirable to automatically remove content that may be subject to sensitive information. This situation is further aggravated in domains such as low-shot learning with scarcity of training examples and associated privacy labels, entailing ambiguity w.r.t. sensitive features (i.e., sensitive features are the ones reveal privacy).
In this paper, we focus on the following fundamental questions: how can we learn representations of a dataset order to minimize the amount of information which could be revealed about the identity of each client? The main goal is to enable an analyst to learn relevant properties (e.g. regular labels non-privacy infringing) of a dataset as a whole, while protecting the privacy of the individual contributors (private labels, which can identify a client). This assumes the database is held by representations, i.c. by sanitizing the identity- trusted server that can learn a representation. Specifically, postulate the decomposition of related information from the latent the latent representation into two latent factors: style and content. In this regard, style captures the private aspects of the data, whereas content encodes the public part. Thus, it is the public part that should be used for training downstream tasks as it can be transferred without compromising privacy. Following this notion, style encodes patterns that are shared among the samples of each client. In contrast to that, the content encodes information about concepts, which is shared across clients. Ultimately, this implies a disentanglement in the feature space in. p features and public features.
Our proposed method is built on top of the popular Variational Autoencoders (VAE) Kingma & Welling 2013), where it used as core representation learning paradigm. VAE consists of two net- works, namely an encoder and a decoder. The former maps a data sample to a latent representation, while the latter maps this representation back to data space. VAE networks are trained by mini- mizing a cost function that encourages learning a latent representation, which leads to realistic data synthesis while simultaneously ensuring sufficient diversity in the synthesized data. This is achieved by minimizing the distance between input and reconstruction subject to distributional regularization on the latent space. In addition, to the VAE entailed cost functions, augment the loss space with additional terms namely "content classification loss" and "style confusion loss". In context of a su- pervised setup, the former is utilized to enforce for target predictability for downstream task, while the latter encourage preserving the privacy. We show that, this two additional terms can enforce dis- entanglement of the private and public parts of the representation, as well utilization in context of weakly supervised scenario, where the downstream attributes are not known a priori.
In summary, the main contributions of this paper are the three-fold. First, we pose the privacy- preserving representation learning problem as learning disentangled representations in a client-
2

---

Under review as a conference paper at ICLR 2020
styla
contusion loss
ciasaftictton
reconsirucion loss
(a)
(b)
Figure 1: Our proposed method: (a) Schematic illustration of the general idea: Here we have two private information attributes (red and blue) and two public information attributes (circle and cross). The dashed line is classifier trained in public information only. Our method. in solid line, both learns to classify the public information and preserve private information. (b) Our proposed architecture: the architecture is based three sub-networks: one going from input representation, one from representation to predicted regular labels, and one from representation to predicted private labels.
server setup. Second, we propose to learn disentangled representations from the client-level su- pervision by adding two novel loss terms VAE. Third, demonstrate experimentally that our proposed method learns semantically meaningful privacy-preserving disentangled representation of client data.
2 RELATED WORKS
Our method is different from Dwork et al. (2017): Dwork (2006); Ryoo et al. (2017); ; Abadi et al. (2016), which focus on learning privacy-present preserving models by perturbing them to the server. A key difference compared to these methods is that they share the data directly the server, whereas our method proposes send representation instead. The advantages of representation sharing for client-server learning have been investigated recently in Osia et al. (2017) 2018 Nevertheless, such representation proven to contain some privacy revealing information of clients. The recent success of adversarial learning has led to the increased adoption of this technique for learning representation to preserve sensitive information in different type of data. For instance, Srivastava et al. (2019) proposed to learn privacy-preserving representations for automatic speech recognition (ASR). ). Yang et al. (2018) a representation learned on the raw student clickstream event data, captured as they watch lecture videos in massive open online courses. In Li et al.) (2019), the authors proposed an obfuscator that is designed to hide privacy related sensitive information from the features using adversarial training. Similarly, Kim et al. (019) is based adversarial learning. which encodes images to obfuscate the patient identity while preserving enough information for a medical segmentation task. |Pittaluga al. (2019) considered a formulation based on adversarial op- timization between the encoding function and estimators for the private tasks. In our work, however, completely different perspective on representation sharing is selected. We specifically propose representation learning method, which facilitates disentanglement of private and public features minimal additional training cost. This leads more privacy-prevs preeeccireeriiinggg representation, while maintaining the method complexity at manageable level.
data before sending
Most related to our paper the work by Feutry et al. (2018), which aims learning representations that preserve the relevant part of the information while dismissing information about the private la- bels corresponding to the clients' identity. A key difference compared to this method is that they require labels for the downstream task during representation learning. In contrast to that, our setting allows for testing on unseen downstream tasks see Sec. 3.2 Very recently, Chen et al. (2018) proposed complex method for edge, this is the first work proposing to disentangle private and public features using only the client level information.
representation learning. However, to knowl-
3

---

Under review as a conference paper at ICLR 2020
At last, note that our model is different from the federated learning methodology in McMahan iet al. (2016); Geyer et al. (2017). which focuses on learning a decentralized private model by sharing gradient updates instead of representations. While we do not consider their framework here, our method could also be extended to those settings, leading to interesting future research directions. Other related works include Bouchacourt al. (2018); Ganin & Lempitsky (2014); Creager et al. (2119)
PROPOSED METHOD
We want to learn representations that, beyond being private for variety of sensitive attributes, can be adapted simply and compositionally for predicting many test-time task labels. We consider a two- stage client-server learning, where the first stage we learn a private representation of the data, and in the second stage, the actual downstream task is performed. Our approach to this problem involves learning a disentangled representation that allows for easy sensitization of latent representation in terms of privacy. Specifically, we isolate information about sensitive and non-sensitive attribute to separate subspaces, while ensuring that the latent space factorizes these subspaces independently. Naturally, depending on the assumptions related to the downstream task condition (if it is known priori or not), we propose multiple variants. We consider the cases where the the downstream task is known priori (i.e., supervised disentanglementt, and the case where it is not know a priori (i.e., weakly-supervised disentanglement).
Ultimately, the goal is to learn a representation z E Rmmh of data R with f(x and << k which decomposes into two parts (z, E Rm 2. E IR") = z, where without loss generality we assume 12, representing the public and private information, respectively. Thereby, the public component should reveal as little as possible about sensitive information. That is we want to learn a function f that learns the representation s.t. Lz. Ideally, this representation has strong utility for a multitude of downstream tasks. To this end, we employ a Variational Auto-Eneer Encoder (VAE) Kingma & Welling (2013) in combination with regularization terms. The VAE serves the purpose that the input is compressed in meaningful fashion. However, VAE alone does not consider learning representation that is useful for downstream tasks puts restrictions in terms of privacy of attributes or latent factors. Attaching additional constraints on the latent representation is non-trivial. This becomes even more challenging, if the downstream task not known a priori Locatello et al. (2019).
The proposed approach makes use of a vanilla VAE architecture that assumes isotropic Gaussian as latent prior p (z) = .V (0, Optimization of VAE entails maximization of the Evidence Lower Bound (ELBO) criterion,
AE (p. 4) = Eg(=la) [logr (x]=)] - DK la (z/²) (x)],
where the first time is the reconstruction loss, and the second one the Kullback-Leibler divergence w.r.t. the prior distribution. Typically, the associated encoder q (z(zr) and decoder q (ær[=) functions are realized with Gaussians, whose parameters 0p. 0g are estimated using neural networks.
In order to facilitate disentanglement of the private and public component we utilize different multi- ple classification tasks. To this end we define mapping based on a deep feed-forward architecture that takes as input the latent representation and predicts label y Y, defined as y g (z, 0), which is parameterized by 0. Specifically, we distinguish between public and private attributes Y., Y., respectively. The first objective is predict the public and private labels based on their section of the latent representation. That is.
J. = 9+ (za: and U. = g. (z):0a),
with the associated loss terms Lg. (ya, J.), Lg. (y.. T.), which are typically realized with cross- entropy.
An obvious solution is to just optimize the functional comprising the VAE together the classification terms, pushing for classification based on each latent sub-vector yielding:
E. (Op, og Oz, 0.) AVAE TV + d Too, h T.
(3)
4

---

Under review as a conference paper at ICLR 2020
where A, I represents scaling parameter. However, following this notions leads to presentation that does not fulfill z, 2.. That is, there is information leakage between the terms, particularly when the attributes to be classified the disentangled latent code should capture no more than one semantically meaningful factors of variation in the data w.r.t. private and public attributes, respectively. This is in particular problematic, when there is excess information capacity in the bottleneck layer generating the latent representation.
not strictly semantically disentangled. Generally speaking,
Thus, in order to push for disentanglement, we employ adding label confusion terms. This entails adding, additional classification terms. The underlying notion is that sensitive attributes should be predictable from public ones. The follow-up step, depends on the boundary conditions for learning the downstream tasks. Therefore, we decompose the into two variants. The first variant, assumes that the downstream task a priori know. This allows, for an optimal disentanglement of public and private information, such that sensitive content is not compromised. The specifics of this scenario are discussed in 3.1] On the other hand, if the downstream task not a priori know, the objective is to learn representation that does not contain sensitive information in the public part, and yet is rich terms of expressive power for multitude tasks. This discussed Sec. 3.2
3.1 SUPERVISED DISENTANGLEEMENT LEARNING WITH TASK AND CLIENT INFORMATION
Consequently, define the domain confusion classifiers according to,
ÿー 9-+ (zo: 0-.) T g-a (z.; 0-.);
(4)
(5)
which essentially assesses how well the private attribute can be derived from public latent part =+ and vice versa. As we, want to punish classifiability in the confused sense, we backpropagate in the negative gradient direction w.r.t.f.. and 0_.-. This yields the following,
2
2 Σ 2g Lzj
E (0p. 0g. 0z, 0.) = AVAE LA + Σ
A
L
(6)
where we simplified the terms for the sake of economy in notation. The first sum captures from Eq. whereas the second one incorporates the confusion classifiers from Eq. 5 In case the information between public and private label are not perfectly uncorrelated, optimization of the Eq. allows for trading-off privacy vs. performance by adjusting A, parameters, accordingly.
3.2 WEAKIYY-SPPERVIST DISENTANGLEMENN. LEARNING WITH CLIENT INFORMATION
In this scenario, the downstream task is not known priori. Only. the client level information is given. Therefore, we propose to perform a counter-directional optimization. That is, while pro- moting the classifiability of the private content in the private latent variable, we penalize for the classifiability in the public latent variable. This boils down, to adding loss term w.r.t. following classification objective,
j.. = g- (zx; 0m.);
to the VAE loss of Eq.
Taken together, we yield following functional
E (0p. 0.) = AVAE LV + > TTp X
T.0
(8)
which maximizes the information w.r.t. the sensitive label in the private latent part, and minimizes the information the public latent part. This constraint considerably weaker compared to Eq. However, it provides a general representation in absence of knowledge about future tasks. Further- more, assumes that the private and public are perfectly disentangled.
3.3 OPTIMIZATION
Optimization of the joint cost function Eq. and Eq. 8 is non-trivial. On the one hand, the confusion terms have a strong destructiveness. Giving too much emphasis on confusion bears the risk elim- inating all information and maximizing entropy. On the hand, too much suppression of confusion
5

---

Under review as a conference paper at ICLR 2020
undermines the privacy aspects and reduces to the naive solution e.g. Eq. 3 To this end, propose to employ an annealing scheme. Specifically, in order to align the objectives, we perform pre-training without confusion. This allows. to learn stable representation that allows for gen- tle modification, i.e. channeling of the information flow. Subsequently. we lower the scale factors Xe, Ao while the same time increasing À +, . Tapering off the classification objective scales w.r.t. the confusion avoids oscillations and facilitates stable learning behaviour.
4 EXPERIMENTS
We experimentally validate the proposed method using the MS-Celeb-Iee IM dataset of celebrity face images Guoo et al. (016)) This dataset contains large number of identities (people) with multiple observations of each. The "in-the-wild" nature of the celebrity face images offers a richer testbed for our method as both identities and contingent factors significant sources of variation.
MS-Celeb-1M dataset. From the aligned face images in the MS-Celeb- IM dataset, we select all celebrities that represented by at least 8 images. Individual images resized to 128 128 pixels. We split the celebrities into subsets of 80% (training). 10% (validation) and 10% (test). The split is created in such a way that all celebrities are present in all sets. This leads to dataset containing images from 8732 different actors and 40 facial attributes. We scale the pixel values to [1, 1]. performing no additional preppocessiig or data augmentation.
Implementation details. In order to learn the architecture, we employ Stochastic Gradient Descent (SGD) with momentum 0.9 and weight-decay of 1e-4 and batch size of 96. The learning rate ranges between [0.0001,0.1 0.1].
4.1 EVALUATION OF PRIVACY AND DOWNSTREAM TASKS
We validate two variations of our proposed method:
Supervised Disentanglement. In this experiments, we perform learning of the private representa- tion and the downstream task jointly, assuming the downsteam task is known a priori. To do so, the model is first trained without confusion loss term enabled. Upon convergence, the confusion loss is enabled, pushing for disentanglement between public and private attributes, respectively.
Superv--u Disentanglement. In this experiments, we first learn of the private represen- tation only using the client-level supervision, and later employ a classifier the downstream task, simulating the case where the downsteam task is unknown a priori. Similarly, to the supervised case, the model is initially trained without confusion loss. Upon convergence, the confusion loss is enabled to push the disentanglement w.r.t. the private attribute only.
In this regard, two aspects are evaluated. On the one hand, the classification accuracy of public and private attributes on their associated public and private section of the learned latent representation. On the other hand, the domain confusion classifier accuracy is assessed as a degree of disentangle- ment. Lower accuracy in terms of domain confusion accuracy that is predictability of private labels from public latent space and vice versa, is indicator for disentanglement.
As can be seen in Tab. 4.1 in the supervised setup explain in Sec. Bec. demonstrates best performance in almost all categories, that is high classification accuracy and low accuracy for domain confusion.
Method
ID
Att.
ID
Att.
VAE (Kingma & Welling (2013)
0.25
0.881
ML-VA (Bouchacourt et al. (2018)
0.155
0.884
0.153
0.882
Our Method
0.756
0.521
0.0
0.909
Our Method (Supervised)
0.770
0.913
0.001
0.202
Table 1:
Performance assessment for different methods on CelebA on the test split.

---

Under review as a conference paper at ICLR 2020
Cortu Nummee
40
Figure 2: Confusion accuracy of different approaches. Blue indicates supervised approach, red semi- supervised. Solid line is the accuracy on ID classification, dashed average accuracy on attributes.
4.2 ABLATION STUDY ON COMPONENTS OF THE METHOD
In order to assess the contribution of each component, we assessed the performance of each module separately, gradually adding components for both supervised (see Tab. 4.2) and weakly supervised scenario (see Tab. 4.2) respectively.
First, the results indicate that learning classifier directly the VAE representation works certain degree on ID, and well on public attributes. Next, adding the classification term for both su- pervised and weakly-supervised scenario boosts the attribute and ID accuracy as expected. Simulta- neously, high confusion accuracies in this configuration give clearly rise to missing disentanglement between the components. Subsequent adding the confusion team leads to a significant and desir- able drop in accuracy w.r.t. confused classifier. However, whereas this significant drop appears to both public and private attributes in the supervised case, it only applies the private attribute in the supervisu case as expected. At the same time, classification accuracy on public attributes barely affected by the confusion terms. What is more, although the classification accuracy drops on the the public (a priori unknown) attributes, it still performs at reasonable accuracy. See Fig. for an illustration of the change behaviour accuracy w.r.t. confused classifier.
Method
ID
Att.
DD
Att.
Ours (only reconstruction loss)
0.25
0.881
Ours (rec. loss classification loss)
0.696
0.916
0.538
0.914
Ours (rec. loss + cls. loss + confusion loss)
0.770
0.913
0.001
0.202
Table 2: Ablation analysis for our methods on CelebA on the test split in the supervised scenario.
Method
ID
Att.
-ID
Att.
Ours (only reconstruction loss)
0.25
0.881
Ours (rec. loss + classification loss)
0.752
0.555
0.311
0.909
Ours (rec. loss + cls. loss + confusion loss)
0.756
0.521
0.0
0.909
Table 3: Ablation analysis for our methods on CelebA on the test split in the weakly-supervised scenario.
5 CONCLUSION
The approach presented in this paper proposes an algorithm that yields a data representation that facilitates disentanglement into public and private components. The underlying notion is to make the public part shareable without privacy limitations. Subsequent, classification experiments con- firm particularly strong performance in the fully-supervised scenario, where public attributes

---

Under review as a conference paper at ICLR 2020
known beforehand. What is more, classification utility of public shareable representation is also demonstrated in the challenging privacy aware scenario, when the downstream task is not known a priori. At the same time, results suggest that disentanglement is successful between the components. Future work will entail to further close the performance gap between the these the fully supervised and the privacy aware scenarios.
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318. ACM, 2016.
Lars Backstrom, Cynthia Dwork, and Jon Kleinberg. Wherefore art thou r3579x?: anonymized social networks, hidden patterns, and structural steganography. In Proceedings of the 16th inter- national conference on World Wide Web, pp. 181-190. ACM, 2007.
Diane Bouchacourt, Ryota Tomioka, and Sebastian Nowozin. Multi-level variational autoencoder: Learning disentangled representations from grouped observations. In Thirty-Second AAAI Con- ference on Artificial Intelligence, 2018.
Jiawei Chen, Janusz Konrad, and Prakash Ishwar. Vgan-based image representation learning for facial expression recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 1570-1579, 2018.
Elliot Creager, David Madras, Jörn-Henrik Jacobsen, Marissa A Weis, Kevin Swersky, Toniann Pitassi, and Richard Zemel. Flexibly fair representation learning by disentanglement. arXiv preprint arXiv:1906.02530 2019.
Cynthia Dwork.
Differential privacy. In 33rd International Colloquium on Automata, Languages and Programming, part II (ICALP 2006), volume 4052 of Lecture Notes Computer Science, pp.
1-12. Springer Verlag, July 2006. ISBN 3-540-35907-9, URL http::ttpp:wwwt
wttp:wwwwwwwoo.....oo.ttot.ttto. itt.raatiiiiiiiieeeetttiiaaa-aaa -rivvay/
com/
Cynthia Dwork, Adam Smith, Thomas Steinke, and Jonathan Ullman. Exposed! a survey of attacks on private data. Annual Review of Statistics and Its Application, 4:61-84, 2017.
Clément Feutry, Pablo Piantanida, Yoshua Bengio, and Pierre Duhamel. Learning anonymized representations with adversarial neural networks. arXiv preprint arXiv:1802.0993 2018.
Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. arXiv preprint arXiv: /409 1409.749, 2014.
Robin Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client 2017.
level perspective. arXiv preprint
Yandong Guo, Lei Zhang, Yuxiao Hu, Xiaodong He, and Jianfeng Gao. Ms-celeb- Im: A dataset and benchmark for large-scale face recognition. In European Conference on Computer Vision, pp. 80- Springer, 2016.
Bach Ngoe Kim, Christian Desrosiers, Jose Dolz, and Pierre-Mare Jodoin. Privacy-net: An adver- sarial approach for identity-bfuucatted segmentation. arXiv preprint arXiv: 10XX::1909.0408,,222 2019.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes, 2013.
URL http://
arxiv.orgi abs///bs/111 /112. 6114 cite arxiv:1112.6114.
Ang Li, Jiayi Guo, Huanrui Yang, and Yiran Chen. Deepobfuscator: Adversarial training framework for eevacy-preservinge image classification. arXiv preprint arXiv: 1909. 0909004 2019.
Francesco Locatello, Stefan Bauer, Mario Lučic, Gunnar Rätsch, Sylvain Gelly, Bernhard Schölkopf, and Olivier Frederic Bachem. Challenging common assumptions in the unsuper- vised learning of disentangled representations. In International Conference on Machine Learn- ing, 2019. TRR/atttp:/pprcceeiiiii Paper Award.
mir. wtt.s/ppt//ss//eeesee/e.r
html Best
8

---

Under review as a conference paper at ICLR 2020
Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 5188-5196, 2015.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, al. Communication-effiiieenn learning of deep networks from decentralized data. arXiv preprint arXiv: 2016.
Arvind Narayanan and Vitaly Shmatikov. How to break anonymity of the netflix prize dataset, 2006. URL http:://ww...... www.waseeeeeeee.cco.. org/ wwwpgg/bstaaaccc ratt Pid=oai: htt.:aarr...ooo.////111000
Seyed Ali Osia, Ali Shahin Shamsabadi, Ali Taheri, Kleomenis Katevas, Hamid R Rabice, Nicholas D Lane, and Hamed Haddadi. crivacy-preserving deep inference for rich user data on the cloud. arXiv preprint arXiv: 2017.
Seyed Ali Osia, Ali Taheri, Ali Shahin Shamsabadi, Minos Katevas, Hamed Haddadi, and Hamid RR Rabiee. Deep private-feature extraction. IEEE Transactions on Knowledge and Data Engineering, 2018.
Francesco Pittaluga, Sanjeev Koppal, and Ayan Chakrabarti. Learning privacy preserving encodings through adversarial training. In 20/9 IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 791-799. IEEE, 2019.
Michael S Ryoo, Brandon Rothrock, Charles Fleming, and Hyun Jong Yang. Krivacy-preserving human activity recognition from extreme low resolution. In Thirty-First AAAI Conference on Artificial Intelligence, 2017.
Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. Updates-leak: Data set inference and reconstruction attacks in online learning. arXiv preprint 1904: 00007, 2019.
Brij Mohan Lal Srivastava, Aurélien Bellet, Mare Tommasi, and Emmanuel Vincent. Privacy- preserving adversarial representation learning in asr: Reality illusion? Proc. Interspeech 2019, pp. 7700-3704, 2019.
Christian Wachinger, Polina Golland, William Kremen, Bruce Fischl, and Martin Reuter. Brain- print: discriminative characterization of brain morphology. Neuroimage, 109:232-248, 2015. doi: 10.1016/j mew.::rrrerrreee211.....00 neuroimage 2015. 03.032
URL
Tsung-Yes Yen Yang, Christopher Brinton, Prateek Mittal, Mung Chiang, and Andrew Lan. Learning informative and private representations via generative adversarial networks. In 2018 IEEE Inter- national Conference on Big Data (Big Data), pp. 1534 1543. IEEE, 2018.


Reviews:
[{"review_id": "Hkg5Zu9Q5S", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper investigates the use of variational auto-encoders (VAEs) and disentanglement to create high quality data representations that hide sensitive attributes. The authors consider two settings: (1) a supervised setting where both the sensitive labels and the downstream machine learning task labels are available to the data holder, and (2) a weakly supervised setting where only sensitive attributes are available. For both settings, the authors propose creating data representations that have 2 components: component 1 captures any information in the data bout the sensitive attributes, and component 2 captures everything else (especially the information useful for a downstream machine learning task). The goal is to ensure that these two components are disentangled.  This is done by training classifiers on each component: 2 classifiers that try to reconstruct the sensitive attributes from each component separately (and in the supervised setting, 2 other classifiers that guess the downstream ML task from each component separately). The overall loss captures all components and ensures that one cannot reconstruct the sensitive attributes from component 2. \n\nOverall, the paper addresses an interesting and timely problem that is of great relevance to this community. However, despite being generally clear, the paper has many grammatical errors and typos. In its current shape, the paper cannot be published. \n\nMore importantly, the paper has a number of issues that need to be improved:\n\n1. The introduction makes a number of claims that are incorrect. For instance, the introduction claims that under differential privacy (and refers to Abadi et al.), machine learning models are learned from anonymized data and that complex training procedures run the risk of exhausting the budget before convergence. This is not true because under the classical setting of differential privacy, the models are trained on clean data BUT the process of learning is anonymized (see DP-SGD from Abadi et al.). More importantly, recent research and results in this space indicate that one can train high quality machine learning models with strong differential privacy guarantees (check McMahan et al. ICLR18: Learning Differentially Private Recurrent Language Models). Further, the authors claim that Federated Learning does not allow for the use of the trained model in a central setting. This is also not true because federated learning is an approach to train models on massively decentralized data -- in a way that is orchestrated by a service provider. The learned model can be used in a centralized or decentralized service. Moreover, the communication cost of training models under federated learning may be lower than communicating the data (several hundreds if not thousands of high resolution images) to a central service provider, so the claims about communication are not always correct. Finally, the authors claim that federated learning and differential privacy are useful when the private attributes are known a priori and these approaches fail to provide privacy protections when the private information contained in the dataset isn't identified. This is wrong. Both approaches do not require the knowledge of private information. They, however, require the knowledge of the downstream machine learning task -- something that may not always defined a priori.\n\n2. The privacy guarantees provided by the authors' approach are rather weak and unclear. (1) They assume that a trusted data holder already access to the dataset and wants to release private representations. In the supervised setting, why not just revealing the learned model? In the weakly supervised setting, where will the downstream machine labels come from? Are these representations released only for unsupervised learning tasks? This should be clarified -- and the experiments at the end should reflect this. (2) The privacy guarantees are with respect to (a) a computationally and statistically bounded adversary (i.e. there may very well be stronger adversaries with access to side information that can perfectly reconstruct the sensitive attributes),  and (b) pre-defined sensitive attributes (i.e. there may be other sensitive attributes that one can learn from the published representations that are not captured by this framework). \n\n3. The paper makes no attempt to properly survey the literature on learning representations under censorship and fairness constraints. For example, they do not reference and compare against: (a) Censoring Representations with an Adversary (https://arxiv.org/abs/1511.05897), (b) Learning Adversarially Fair and Transferable Representations (https://arxiv.org/abs/1802.06309), (c) Context-Aware Generative Adversarial Privacy (https://arxiv.org/abs/1710.09549), (d) Learning Generative Adversarial RePresentations (GAP) under Fairness and Censoring Constraints (https://arxiv.org/abs/1910.00411), and many others. Without a clear (empirical) comparison to these works, the benefits of the proposed approach are unclear.\n\n4. The proposed method for disentanglement does not scale to non-binary sensitive attributes (because of the blowup in the number of classifier pairs that would need to be trained to ensure disentanglement). Thus, this approach may be limited to cases with a few sensitive attributes. \n\n5. The authors are encouraged to show the learned representations (so that one could verify with the naked eye that the representations are indeed disentangling the sensitive attributes).\n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "HJxNUdZ6Fr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper brings to our attention the problem of privacy-preserving representation learning.\nThe assumption in this work is that the data feature can be split into two parts: private and non private.\n\nThe authors propose to use VAE with additional regularizer terms to learn hidden representations that would encode both private and non-private part as independent as possible.\nThere are two scenarios considered:\n1) supervised disentanglement, total of 4 terms (two for public part, two for private part) are added to the VAE loss.\n2) weakly-supervised disentanglement: in this setting, downstream task is unknown and only two terms are added tot he VAE loss: one to penalize the classifiability using private information in the public z space, and other to promote the classifiably using private information in the private z space.\n\nOverall, I think it is a well-stated problem and this work seems to get some positive results on CelebA dataset. However, a few questions must be clearly addressed:\n1. Eqn 6 is derived from Eqn 2 and Eqn 5. please clean up the notation on L terms. Currently they are not consistent and L_i and L_j are not defined.\n\n2. In section 3.3, the authors mention the optimization is nontrivial. Can you expand on that? current section 3.3 is too short for the readers to appreciate that non-triviality.\n\nOther comments:\nOn Page 1, \ngrowing privacy concerns will entails —> entail\nthe \"Glass / gender\" example doesn’t make sense to me. why glass is considered non-private while gender is private? maybe we should use another example here.\n\nOn Page 2,\n penultimate paragraph, where it used as —> where it is used as …\nWhile the latter encourage preserving —> encourages\nThis two additional terms —> these two additional terms\n\nPage 7, Figure 2 caption needs rewriting.\n\n\n", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HJl6GIKeFB", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "PRIVACY-PRESERVING REPRESENTATION LEARNING BY DISENTANGLEMENT\n\nSummary\nThis paper introduces a method to disentanglement the private and public attribute information in representation learning.\n\nStrength:\n1. The idea of introducing the confusion term to disentanglement private and public information seems novel. \n2. The problem studied in this paper is very important.\n\nComments:\n1. The existing results are not sufficient to validate the effectiveness of the method to prevent privacy leakage. More comparison with other previous methods should be conducted. For example, the previous work [1] has both theoretically and experimentally validated the effectiveness of DP based methods for preventing attribute attack. Recent work[2] also tries to reduce information leakage in representation learning.\n2. Some important related works are missing. The difference between the proposed method and previous works with the same purpose should be made more clearly. See comment1 for some concrete examples of previous works. \n3. The notation of $z$ is confusing. The author denotes $z=(z_{*}, z_{.})$, however, these three vectors' dimensions are the same, which really confuses me.\n4. Some details of $L_{VAE}$ are missing. According to Equation~1., the author uses $z$ to build the reconstruct loss. However, based on previous notations, $z$ comprises of both private and public representations. So, what's the strategy to combine these two representations (concat?)?\n5. Typos. For example, blue-> read in the caption of Figure 1. \n6. The threat model in this paper needs to be made more clearly. The method proposed in this paper can only be used in the context where the private attribute is well-defined. There are many other threat models in secure machine learning research, such as membership attack and adversarial attack, which are not covered by this paper (My suggestion is adding a specific sub-section of threat model and do not use  \"privacy-preserving\" in the original title ). \n[1] Privacy Risk in Machine Learning: Analyzing the Connection to Overﬁtting\n[2] Mitigating Information Leakage in Image Representations: A Maximum Entropy Approach", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper leverages variational auto-encoders (VAEs) and disentanglement to generate data representations that hide sensitive attributes. The reviewers have identified several issues with the paper, including its false claims or statements about differential privacy, unclear privacy guarantee, and lack of related work discussion. The authors have not directly addressed these issues.
Decision: Reject