Disentangling style and content for low resource video domain adaptation: a case study on keystroke inference attacks
Authors: John Lim
Fabian Monrose
Jan-Michael Frahm
Venue:  (2021)
Keywords: Applications
side channel attacks
supervised disentangled learning
video domain adaptation

Abstract: Keystroke inference attacks are a form of side-channels attacks in which an attacker leverages various techniques to recover a user’s keystrokes as she inputs information into some display (for example, while sending a text message or entering her pin). Typically, these attacks leverage machine learning approaches, but assessing the realism of the threat space has lagged behind the pace of machine learning advancements, due in-part, to the challenges in curating large real-life datasets. This paper aims to overcome the challenge of having limited number of real data by introducing a video domain adaptation technique that is able to leverage synthetic data through supervised disentangled learning. Specifically, for a given domain, we decompose the observed data into two factors of variation: Style and Content. Doing so provides four learned representations: real-life style, synthetic style, real-life content and synthetic content. Then, we combine them into feature representations from all combinations of style-content pairings across domains, and train a model on these combined representations to classify the content (i.e., labels) of a given datapoint in the style of another domain. We evaluate our method on real-life data using a variety of metrics to quantify the amount of information an attacker is able to recover. We show that our method prevents our model from overfitting to a small real-life training set, indicating that our method is an effective form of data augmentation. Code and data will be released after reviewal. 

Under review as a conference paper at ICLR 2021
DISENTANGLING STYLE AND CONTENT FOR LOW RESOURCE VIDEO DOMAIN ADAPTATION: A CASE STUDY ON KEYSTROKE INFERENCE ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Keystroke inference attacks are a form of side-channels attacks in which an at- tacker leverages various techniques to recover user's s keystrokes as she inputs information into some display (for example, while sending a text message or en- tering her pin). Typically, these attacks leverage machine learning approaches, but assessing the realism of the threat space has lagged behind the pace of machine learning advancements, due in-part, to the challenges in curating large real-life datasets. This paper aims to overcome the challenge of having limited number of real data by introducing video domain adaptation technique that is able leverage synthetic data through supervised disentangled learning. Specifically, for given domain, we decompose the observed data into factors of variation: Style and Content. Doing so provides four learned representations: real-life style, synthetic style, real-life content and synthetic content. Then, we combine them into feature representations from all combinations of style-content pairings across domains, and train a model on these combined representations to elassify the con- tent (i.e., labels) of a given datapoint in the style of another domain. We evaluate our method on real-life data using a variety of metrics to quantify the amount information attacker is able to recover. We show that our method prevents our model from overfitting to a small real-life training set, indicating that our method is effective form of data augmentation.
INTRODUCTION
We are exceedingly reliant on our mobile devices in our everyday lives. Numerous activities, such as banking, communications, and information retrieval, have gone from having separate channels to collapsing into one: through our mobile phones. While this has made many of our lives more convenient, this phenomena further incentivizes attackers seeking steal information from users. Therefore, studying different attack vectors and understanding the realistic threats that arise from attackers' abilities to recover user information is imperative formulating defenses. The argument for studying these attacks is not a new one. A rich literature of prior works studying both attacks and defenses has assessed a wide array of potential attack vectors. The majority of these attacks utilize various machine learning algorithms to predict the user's keystrokes, (Raguram et al., 2011 Cai & Chen 2012, Xu al. 2013) [Sun et al., 2016 Chen al.) 2018 Lim al.) 2020). but the ability to assess attackers leveraging deep learning methods has lagged due to the high costs of curating real-life datasets for this domain, and the lack publicly available datasets.
Despite all the recent attention to keystroke inference attacks, numerous questions have gone unan- swered. Which defenses work against adversaries who leverage deep learning systems? Which defenses are easily undermined? Are there weaknesses in deep learning systems that develop better defenses to thwart state-of state-of-the-ar the-art attacks? These questions capture the essence of the underlying principles for research into defenses for keystroke inference atttacks. Given the back- and-forth nature of researching attacks and defenses, these questions can not be addressed because of the current inability to assess attacks with deep learning methods.
use to
This paper aims to overcome the challenge of having limited number of labeled. real-life data by in- troducing video domain adaptation technique that is able to leverage abundantly labeled synthetic

---

Under review as a conference paper at ICLR 2021
Figure 1: An example highlight the discrepancies between the Synthetic Data (Rows and 3) and Real-Life Data (Rows 2 and 4). In rows and 2, we show sequences of the word order being typed with the same number of frames between keypresses sampled. The frames with green boxes indicate ones in which key was pressed, i.e, in the first frame for first two rows, the key o was pressed. While the content between the two sequences is the same, the style is different, e.g., the texture, and trajectory in between keypresses are different. To further highlight the temporal distribution shift, we show the thumb trajectory between w and for both synthetic and real sequences in rows 3 and 4. While the finger is linearly interpolated in the synthetic domain, the real-life one has a more complex one that is challenging to model with a simulator. We highlight the thumb tip in red and the trajectories in blue.
data. We show that by disentangling our data into separate style and content representations, we can subsequently create style-content pairs across both domains, and combine them into representations that contain the content in the style of its inputs, i.e., style transfer in the feature space. This is espe- cially attractive in the case of pairs of real-life style and synthetic content, as this an effective data augmentation scheme. Style representations need to be well separated between domains whereas content needs to be indistinguishable To do this, we introduce auxiliary losses on the latent spaces to enforce disentanglement. Through series of ablations, we show that doing improves perfor- mance. In our context, Content answers the question: What was typed?. For example, the sentence that user types. Style answers the question: How was it typed?. For example, the texting pattern.
The majority of visual domain adaptation methods do not work well in our problem setting because they mainly focus tasks in which the domain shift is limited to shift in texture, e.g., image clas- sification, semantic segmentation, etc. (Ganin & Lempitsky 2014 Shhivasttaa et al., 2016 Tzeng al., 2017 Hoffman al. 2017: Motiian et al. (017). When predicting keystroke sequences, addressing the domain shift with respect to texture is not sufficient. While there is a clear differ- ence in texture, we have to also address the temporal domain shift, e.g., different finger motions, speeds, etc. Notice the difference between the trajectories of thumbs in the two example videos displayed in Figure [ The synthetic thumb is linearly interpolated whereas the real one moves in more complex fashion. Our pairing mechanism is inspired by the one introduced by Motiian et al. (2017). They devise training regime that pairs the scarce data the target domaín with the data from the source domain. This strategy aims to augment the data in the target domain on the order of the source domain. In our work, we loosen the restriction of needing pairs with the same label to adapt our setting of not having paired sentences. This makes pairing mechanism eral and applicable to other settings. To summarize, our main contributions are: 1) A framework for low-resource video domain adaptation using supervised disentangled learning. 2) A novel method to assess the threat of keystroke inference attacks by an attacker using a deep learning system while having limited real-life data.
gen-
2 BACKGROUND
Keystroke Inference Attacks Some of the early works in (vision-based) keystroke inference attacks have focused on direct line of sight and reflective surfaces (i.e., teapots, sunglasses, eyes) (Backes et al. 2008: 2009; Raguram et al. 2011 Xu et al. 2013)] Yue al. 2014 Ye al. 2017 Lim al.) 2020 to inter sensitive data. The attackers train models that account for various capture angles by aligning the user's mobile phone to a template keyboard. Collectively, these works showed that
2

---

Under review as a conference paper at ICLR 2021
attackers are able to successfully recover pins and full sentences. In this work, we advance the state- of-the-art under the direct line of sight model wherein the attacker uses a mobile camera to record a victim's 's mobile phone usage. None of these works adequately explore the capabilities of an attacker that leverages deep learning systems because of the costs to collect large scale datasets. [Lim et al. (2020) created simulator that generates synthetic data for keystroke inference attacks and showed that training with both synthetic and real data, in a supervised domain adaptation framework, yielded CNN that generalized to a real-life test set, despite having limited labels in the real domain. This work is limited due to the restricted threat scenario of inferring single keypresses. In our work, we assess the ability of an attacker to recover complete sequences. Predicting entire sequences from an input video is not only a more challenging task, but also it is more realistic threat scenario.
Style and Content Disentanglement in Videos TTeeenbum & Freeman 1997); Tenenbaum & Free- man (2000) observe that by learning to factor observations of data into two independent factors of variation, style and content, models learn separate representations that can extrapolate style into novel content, classify content in different styles, and translate new content into new styles. This framework has been extended to videos and has been explored in a variety of settings. Prior works have disentangled videos into time-dependent style representation and time-independent content with adversarial training (Denton & Birodkar 2017| Villegas et al.] (017)) or with variational au- toencoders (Li & Mandt 2018: Hsieh al. 2018). 8). In our setting, style and content are both time- dependent. Style encapsulated the trajectory of the finger in between keys or speed of the user typing. The difference in texture on a per-frame basis is also encapsulated by style. Content represents the entire trajectory as that determines the sentence that was typed. These methods are all unsupervised methods disentangle style and content. Since we have labels, we are able leverage the obser- vation made by Locatello et al. (2018) 2019), arguing that learning disentangled representations is impossible without supervision, and that the unsupervised methods leveraging temporal inductive biases do not lead to improved disentangled representations.
Low Resource Domain Adaptation We are operating in a low resource setting in which we have abundant labels in the source domain and have very few, albeit labeled, data points in the target domain. Aosseini-Asl et al. (2019) extend the CyCada (Hoffman et al. 2017) and CycleGAN (Zhu ct al. 2017) frameworks to the low resource domain adaptation setting by adding semantic consis- tency loss. Motiian et al. (0177) addresses this problem by learning a feature space that is domain invariant, but is semantically ly aligned across both domains by introducing a pairing process that pairs feature samples in the training set into four groups: 1) both samples from domain A with same la- bels; 2) sample from each domain with same labels; 3) both samples from domain A with different labels; 4) a sample from each domain with different labels. They use adversarial training to learn a feature representation such that discriminator can't 't distinguish samples from groups and and also from groups 3 and 4. We extend this pairing mechanism by relaxing the constraint of needing the same labels in both domains, i.e., pairs of synthetic and real sentences. Since we are effectively transferring different styles onto the content latent space, we do not need labels in the target domain so long as they are effectively disentangled.
3 METHODS
We first give a brief introduction to keystroke inference attacks and define the problem setup. Then, we describe our proposed framework to disentangle the style and content latent spaces train on all style-content pairs An overview of our method is in Figure 2 and in Algorithm T
3.1 KEYSTROKE INFERENCE, ATTACKS
We model the keystroke inference attack as a Seq2Seq (Sutskever et al. 2014) problem where the input X = { 22, J& characters. The videas are of users typing on their mobile phones that are cropped and aligned to a template image. The tokens are a sequence of characters of the sentence the user typed. We do not use any paired data (i.e. the synthetic and real-life datasets do not contain the same sentences), and do not have access to any auxiliary labels such as the exact frame in which a key was pressed. Our goal is to learn the parameters of a model that maximizes the conditional probability of Y given X. We use a Transformer (Vaswani et al. (017) encoder-decoder as our model. In our setting we have }) and dataset of real-life videos D, ((X), Y?).
video with l frames and Y = 131, U2..., ..., Vز
sequence of j
dataset of synthetic videos, D.
3

---

Under review as a conference paper at ICLR 2021
Lityle
hg
Legend
Dc
iyyte
h2
Content
Es
Disentanglement
Style Disentanglmnett
M
Zeontent
ht
Feature Agpregation
Nc Ecoptent
ky
Alignment
D5
DM
Train w/ Synthetic and
An overview of our training procedure. single training iteration takes pair of syn- thetic and real-life videos. We disentangle them into style and content representations, and create four combinations of feature representations. For example, real style paired with synthetic content. Style disentanglement, shown in Red, removes style information from the content space. Content disentanglement, shown in Blue, removes content information from the style space. The Green paths indicate the different ways in which we can combine the style and content representations from the two domains. Finally, we further apply a semantic alignment discriminator to the combined space, shown in Yellow, to ensure the content remains constant, regardless of style. (Best viewed in color)
Figure 2:
where the number of real-life videos is significantly less than the synthetic (Figure 3). While large synthetic dataset can be easily generated, there exists distribution shift between the two domains (Figure [T. When the amount labeled data is scarce, it becomes difficult to train neural networks that generalize samples out of the training set.
3.2 DISENTANGLING STYLE AND CONTENT
Our method to address the lack of real-life data is to train on combinations style and content representation pairs from the synthetic and real domains. We introduce auxiliary losses to enforce disentanglement of style and content, ensuring that the style latent space does not contain any in- formation about the content, and vice versa. Our training framework consists of Content Encoder, Ec, a Style Encoder Es, a Decoder G, a Feature Aggregation Module, M, a Style Discriminator Ds. Content Discriminator De, and Domain-Class Discriminator D
Pretraining Synthetic Model We first pretrain an Incoder-Decoder Transformer on only synthetic data. We train this network with multi-class cross entropy loss where the goal is to predict the correct sentence for a given video. Then Ec. Es. and De are initialized with the weights of the pretrained Encoder, and G is initialized with the weights of the pretrained Decoder.
Style Disentanglement Style disentanglement ensures that style information is removed from the content latent space. The content latent space is defined as = : where f E {s,t) f) where f and f represent the synthetic and real domains, respectively. Similar the setup of GANs (Goodfellow et al. 2014) the Style Discriminator, Ds is trained to classify whether 2 =oontent real synthetic. Next, Fi is trained spoof D. and generate content feature representation that is domain invariant. Ds is trained using Equation I Eg is trained using the same equation, but the labels are flipped and Ds is not updated.
:6Ec)
AdddD - Ellog(Ds
- log(1- - Ds(EE(X()))
(I)
Content Disentanglement Content disentanglement ensures that content information is removed from the style latent space. The style latent space is defined as = = (s ;Ee) where f e (). The Content Discriminator, Dc. is Transformer Decoder, and is trained to predict the correct sentence given the input style representation. Ess is trained to spoof De and generate a style feature representation, ='tyle> such that Dc can not predict the correct sentence. This is done by maximizing the entropy, H. of the predictions of Dc. Do is trained by minimizing Equation Es is trained by maximizing Equation 3 with the weights of De kept frozen.
LAdvpe
log log
4

---

Under review as a conference paper at ICLR 2021
Advvss =D(Y))Do(EsS(X
Feature Aggregation A Feature Aggregation Module, M, combines the disentangled representa- tions from the previous two steps. For any given pair of style and content representations we have:
M M(sttyle:
= #content) m(=style + =content)
In Equation m is the LayerNorm operation [Ba et al. 2016). f E {s, and f E {s,t]. There four different possible pairs that can be the imput our model, since there are two factors of variation (style and content) and two domains (synthetic and real-life). For any given input pair, the output feature representation of M can be thought the content in the style of the specified domain. We denote this as i where the style and ft is the content.
Prediction The Decoder, G, takes in the output of M, f and outputs the predicted sentence y and is trained with the cross-entropy loss using the labels y The objective is:
Cets log
Ex
(5)
At test time, the model outputs the most likely sentence given a real-life video:
max p P(Y*)G(M)))
(6)
Semantic Aligment We extend the framework of Motiian et al. 2017 create training pairs to compensate for limited data in one domain. Rather than train on pairs of feature samples, we train on the outputs of a feature aggregation module that takes in as input style- content pairs. Furthermore, we do not need to have the same labels for both domains, i.e., we do not need to have the same synthetic and real sentences. We create four pairs 9k, k E 21, 4]. 91 and G2 are outputs of M that share synthetic content: (Synthetic Style. Synthetic Content) and (Real Style, Synthetic Content), G3 and G4 share real content: (Synthetic Style. Real Content) and (Real Style, Real Content). A multi-class discriminator, DM. is trained using Equation to correctly identify which group every output of M belongs to. 4 is the corresponding label for a given GR- Ec. Es. and M updated with Equation & such that DMs can't 't distinguish outputs of M that are in G1 and G2 and outputs of M that are in G3 and Ga.
AddvDa = IE La (M
Laduy -E44 (M
log (Mrr(
(8)
The final loss function to train our model is show in Equation 9 are tuned using validation set. An overview of the training procedure is shown Algorithm A.9
where the weightings for each term
L. == Cass AaC Aa + XaL As As
>oLAdops
EXPERIMENTS
In this section, we detail the datasets, the motivation and interpretation of our evaluation metrics, and experimental results. Further details regarding data collection, network architectures, and training details are located in section Appendix [A]
Datasets Figure 3 shows different statistics for the synthetic and real datasets. We set aside 10% of the training set as a validation set. The real-life dataset was collected by recording participants typing sentences into a mobile phone. Threc different participants were asked to type conversational text messages into their mobile devices while we recorded them in both indoor and outdoor settings. We used mobile camera and captured from a distance of 3 meters. The details to preprocess and align the real data detailed in A.2 The synthetic data was generated using the simulator by Lim et al. (2020). It generates aligned videos of a synthetic thumb typing various sentences. We generated sentences from the "A Million News Headlines" dataset released by Kulkarni (2018). We add START and STOP token to the beginning and end of sentence, respectively. In total, there 30 tokens in which the decoder can predict: 26 letters and 4 special tokens (START, STOP, SPACE, PAD).
5

---

Under review as a conference paper at ICLR 2021
Distribution of Phrase Lengths
Distribution of Video Lengths
60
700
600
Phrase Length
Video Length
500
40
HI 8733791
I:
13108
400
47307
13108
300
20
Real Train
Real Test
Synthetic Trein Synthetic Test
Real Train
Real Test
Synthetic Train
Synthetic Test
Figure 3: Distribution of phrase and video lengths for our datasets. The number of real-life data-
points (229) is significantly less than synthetic (60,409).
Evaluation Metries We propose use variety of metrics quantify the amount of information
the attacker is able to recover from the user as there is no single, agreed-upon metric for keystroke
inference attacks. In the first scenario, postprocess the outputs of our model with a language
model, similar to the methodologies of Raguram et al. (2011); Xu et al. (2013); Sun et al. (2016);
Chen et al. (2118). Appropriate metrics for this scenario are Bleu-n (Papineni et al. 2002). ROUGE
[Lin| 2004). and METEOR (Banerjee & Lavie 2005). Bleu-n scores are scored on n-gram precision, l.e., the n-grams the predicted sentence that are also the ground truth sentence. For brevity, we do not report Bleu-2 and Bleu-3. ROUGE scores are scored on n-gram recall, i.e., the n-grams in the ground truth that are also in the predicted sentence. METEOR is metric that is scored on the harmonic mean of unigram precision and recall and was developed to address some of the drawbacks of ROUGE and Bleu-n. METEOR scores range from 0 to 1. Scores above 0.5 reflect understandable translations and scores above 0.7 reflect fluent ones (Lavie 2010).
While these scores have merit in the context of keystroke inference attacks, they are not without shortcomings. These scores especially harsh for predictions that contain slight typographical errors (e.g., "hello" vs. "hellp"), and there is no guarantee that the previously mentioned postpro- cessing steps will address every error. Also, there settings in which the applicability of these metrics does not make sense - e.g., recovering alphanumeric passwords. Thus, we also need eval- uation metrics for the raw outputs our model. Two appropriate metrics are Translation Edit Rate (TER) (Snover et al.) (006) and a E-EERT-Kkyboarrd the number of edits required for hypothesis sentence be translated to the ground truth. The latter is a form of the ations (i.e., insertions, deletions, substitutions, character swapping) conditioned on the QWERTY keyboard layout. For example, if "hello" was the ground truth word, "hellp" should be less penalized than "helly" as the former a more likely output than the latter given the assumed keyboard layout.
edit distance. Both metrics measure
(DL.) distance (Damerau) 1964) that penalizes the edit oper-
Synthetic Data Experiments Table shows the results for model trained and tested on synthetic data. The model performs very well on the synthetic test set across all proposed evaluation metrics. extract fixed 128ddimensional
To lessen the compute cost of processing over 45k raw videos, feature representation as preprocessing step by training CNN for single key press classification. We use the simulator generate single key press images and train CNN to predict the correct key.
Further details for this step are available in A.4
Method
Bleu- 1
Bleu 1
METEOR
ROUGE 1
TER
Qwerty D
Synthetic
0.79
0.91
0.03
L.87
Finetuning
0.15
0
0.06
0.13
0.81
45.6
ADDA (Tzene et 2017
0.15
0.16
0.78
46.1
CycleGANN [Ziu 2017
0.17
0.07
0.17
0.7
45.6
Outs (Basc)
0.73
0.52
0.74
0.73
0.12
7.4
(No L.M)
0.76
Ours
0.81
0.62
0.8
0.81
0,09
5.3
Table 1: We report various metrics quantify the attacker's ability recover information.

---

Under review as a conference paper at ICLR 2021
4.1 BASELINE RESULTS
We compare our work against finetuning, Adversarial Discriminative Domain Adaptation, ADDA, (Teng et al., 2017) and CycleGAN (Zhu et al.) 2017). All methods are evaluated on the real-life test set and use the model trained on synthetic data.
Finetuning. We finetune model trained only synthetic with the real-life training set. ADDA. Our goal with ADDA is to have the Encoder output feature representations that are do- main invariant to Discriminator, but also be discriminative for the Decoder.
CycleGAN. This method learns pixel-wise transformation that transforms data from one do- main another. We apply this transformation every real frame synthetic one. Then, finetune the synthetic model with the transformed real training set and test on the transformed real test set. Finetuning is needed because this method does not address the temporal shift as the transformations are conducted on a per-frame basis.
is important note that Lim al. (2020), the authors successful in applying ADDA the task of single key press classification when the number of labeled data is scarce. Simply applying ADDA our sequence prediction task leads severe overfitting due the limited real-life data, dicating that this task is more challenging than the single keypress classification task studied by Lim al. 2020). While these are common approaches used in domain adaptation, we found that these approaches are not suitable in our problem setting. We carried out extensive experiments to tune our baselines and maximize their performance; a full listing of these experiments and corresponding hyperparameters is available in Appendix A Despite extensive search of hyperparameters, still overfit. We report the best results in Table
4.2 ADAPTING TO REAL-LIFE VIDEOS
Our method, unlike the above baselines, does not overfit to the real-life training set. Our results show that training with our pairing mechanism with disentangled representations across domains is an effective form of data augmentation. We outperform the baselines in both raw output evaluations and post-procee post-processed evaluations as shown in Table T We found that our training was not sensitive to the hyperparameters and weightings of the loss terms in 9 and the same hyperparameters. for all experiments. Additional training details are in A.
While direct comparison to the state of the art in direct line of sight attacks is difficult due to the differences datasets, it is worth noting how our model performs relative to current methods. Ragu- ram al. (201) 1) achieve METEOR score of 0.89 whereas Xu al. (2013) achieve but recording from much farther distances. To measure an attacker's ability to recover passwords, Raguram al. (2011) report precision and recall for individual word units and characters. They achieve level precision and recall of 75% and 78%, respectively. and character-level scores of 94% and 98%. We achieve word-level precision and recall of 78% and 79%, respectively, and precision and recall of 96% and 95%, respectively, for characters. They do not report METEOR scores for this scenario; we do so in Table under "No LM"
of 0.71,
Method I- Base
Bleu-1
Bleu-4 1
METEOR
ROUGE
TER
Qwerly-D.
0.73
0.32
0.74
0.75
0.12
7.4
II Buse Style
0.77
0.56
0.76
0.77
0.1
6.3
Base Content
IV Base + Style + Content
0.76
0.57
0.75
0.76
0.12
7.0
Base + (Motiaan al. 2017
0.77
0.57
0.76
0.79
0.11
5.7
VI Full w/ LayerNorm
0.82
0.61
0.8
0.83
0.09
5.2
VII -ullFull
0.81
0.62
0.8
0.81
0.09
5.3
(100)
0.33
11 Base Style (100)
0.65
0.38
0.62
0.65
0.18
11.2
III - Base Content (100)
0.62
0.37
0.57
0.61
0.2
11.3
IV Base + Style Content (100)
0.69
0.4
0.65
0.69
0.15
9.3
Base + MMotiaa et al. 2017] (100)
0.65
0.34
0.6
0.65
0.18
11.3
VI- Full Layerron (T0))
0.67
0.42
0.64
0.68
0.18
10.8
VII Full (100)
0.65
0.42
0.63
0.67
0.21
13.2
Table We conduct ablation studies to evaluate the efféctivvnness of each loss component. We also evaluate performance when the number of real training videos is dropped to 100 instead of 175.

---

Under review as a conference paper at ICLR 2021
Baiels, Reconbent Sabile S-ceniant
Figure 4: t-sne plots for the outputs Es (Left), Ec (Center), and M (Right).
Feature Visualization The t-sne (Maaten Hinton 2008) plots, in Figure 4 for the feature repre- sentations Es, Ecc, and M on synthetic and real test data show that sentences with different styles have a noticeable separation, whereas the content representations are intertwined. The last figure on the right shows outputs of our feature aggregation module, M, and shows the transfer of styles in the feature space. There is a clear separation between styles, while the datapoints within one style cluster are mixed. To obtain inputs suitable for t-sne, we perform max pooling operation along the temporal dimension of the outputs of the networks.
Ablation Next, we conduct series ablation studies explore the effectiveness of our proposed framework. We introduce seven different models: I is our base method without the use of any adversarial losses, just the pairing mechanism. II uses style disentanglement, i.e., + style disen- tanglement. III uses content disentanglement, i.e., I content disentanglement. IV uses both style and content disentanglement. V is the base method with only the semantic alignment loss (Motian ett al. 2017). VI uses style and content disentanglement, along with the semantic alignment, but does not use LayerNorm M. VII uses style and content disentanglement, along with the semantic alignment. This is proposed method trained with Algorithm| [ i.e., IV semantic alignment.
Diimbet Ovartyditt
1:25
Cienrbutioo of
Destouttonn METTOSK
8.25
0.30
Figure 5: From left to right: the distribution of Qwerty-D, TER, and METEOR scores, respectively. "Full" our proposed framework. "Base" is our framework without any adversarial training. We also compare these two against a model trained and tested just synthetic data.
First, we find that our base model (I) achieves competitive results without any losses the latent spaces. This indicates that training on paired representations across domains is an effective method for data augmentation. Second, we find that adding auxiliary losses the latent spaces enforce style and content disentanglement improves performance. The performance for models II and III shows the base model benefiting from the added loss terms. The results for Model IV aligns with our hypothesis that explicitly disentangling style and content allows us to overcome the lack of train- ing data the target domain by training with all combinations of the factors of variation. Finally, we trained model V to apply the semantic alignment step our paired outputs without any additional adversarial losses. This is quite competitive with IV, but we find the greatest performance boost when training model VII using both semantic alignment and disentanglement. A closer look into the distribution of the scores in Figure 5 shows that the distribution of scores for Model VII (Full) indicates higher overall performance compared to Model I (Base). Our results show that explicitly disentangling style and content by adding the adversarial losses on the latent spaces, supplements the pairing mechanism to achieve the highest performance against evaluation metrics.
8

---

Under review as a conference paper at ICLR 2021
5 CONCLUSION
Our work provides the important initial step needed to formulate defenses for keystroke inference attacks in the age of deep learning. We provide the first assessment of attacker's ability to recover sentence level information using deep learning systems, demonstrating that this attack is plausible and significant threat users. Such a task has been challenging due the costs of curating a real- life dataset. We address this problem by introducing framework for low resource video domain adaptation, that disentangles the style and content across both domains, and creates representations from all pairs of style and content combinations. Our results indicate that training with these pairs, along with auxillarly losses explicitly disentangle style and content, serves as an effective form of data augmentation that prevents overfitting.
REFERENCES
Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E. Hinton. Layer normalization, 2016.
M. Backes, M. Dürmuth, and D. Unruh. Compromising reflections-or-how to read led monitors around the corner. 2008 IEEE Symposium on Security and Privacy (sp 2008), pp. 158-169, 2008.
M. Backes, T. Chen, M. Duermuth, P. A. Lensch, and M. Welk. Tempest in a teapot: Compromis- ing reflections revisited. In 2009 30th IEEE Symposium on Security and Privacy, pp. 315-327, 2009.
Satanjeev Banerjee and Alon Lavie. METEOR:
An automatic metric for MT evaluation with improved correlation with human judgments. In Proceedings of the ACL Workshop on In- trinsic and Extrinsic Evaluation Measures for Machine Translation and/or Summarization, pp. 65-72. Ann Arbor, Michigan, June 2005. Association for Computational Linguistics. URL https:/ www aclweb. http:///wwww/w////a///aae.aaaaaa wttp.///aaa.ooog///ooo------
Liang Cai and Hao Chen. On the practicality of motion based keystroke inference attack. pp- 273-290, 06 2012. doi: 10. 10110079978-3--2230021----11
Yimin Chen, Tao Li, Rui Zhang, Yanchao Zhang, and Terri Hedgpeth. Eyetell: Video-assisted touchscreen keystroke inference from eye movements. In 2018 IEEE Symposium on Security and Privacy (SP), pp. 144-160. IEEE, 2018.
Fred J. Damerau. A technique for computer detection and correction of spelling errors. Com- mun. ACM, 77)) March 1964. ISSN 0001-0782. doi: (0.114/363958..63999 URL https://doo www.doi..ogggg/ 11..1..1113333313 363994
Emily Denton and Vighnesh Birodkar. Unsupervised learning of disentangled representations from video, 2017.
Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation, 2014.
Ian J. Goodfellow, Jean Pouget-Abadic, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks, 2014.
Judy Hoffman, Eric Tzeng, Taesung Park, Jun- Yan Zhu, Phillip Isola, Kate Saenko, Alexei A. Efros, and Trevor Darrell. Cycada: Cycle-consistent adversarial domain adaptation, 2017.
Ehsan Hosseini-Asl, Yingbo Zhou, Caiming Xiong, and Richard Socher. Augmented cyclic ad- versarial learning for low resource domain adaptation. In International Conference on Learning Representations, 2019. URL https: httt::s:///perreeee
/tpp//prreeeee eew. net forum?in=d G9doA9F
Jun-Ting Hsieh, Bingbin Liu, De-An Huang, Li Fei-Fei, and Juan Carlos Niebles. Learning to decompose and disentangle representations for video prediction, 2018.
Rohit Kulkarni. A Million News SYBCZL
2018. URL
Alon Lavie. Evaluating the output of machine translation systems. 01 2010.

---

Under review as a conference paper at ICLR 2021
Yingzhen Li and Stephan Mandt. Disentangled sequential autoencoder, 2018.
John Lim, True Price, Fabian Monrose, and Jan-Michael Frahm. Revisiting the threat space for vision-based keystroke inference attacks, 2020.
Chin-Yew Lin. ROUGE: A package for automatic evaluation of summaries. In Text Summarization Branches Out, pp. 74-81, Barcelona, Spain, July 2004. Association for Computational Linguis- tics. URL https: www c web. org -
Francesco Locatello, Stefan Bauer, Mario Lucic, Gunnar Rätsch, Sylvain Gelly, Bernhard Schölkopf, and Olivier Bachem. Challenging common assumptions in the unsupervised learn- ing of disentangled representations, 2018.
Francesco Locatello, Stefan Bauer, Mario Lucic, Gunnar Rätsch, Sylvain Gelly, Bernhard Schölkopf, and Olivier Bachem. Challenging common assumptions in the unsupervised learn- ing of disentangled representations, 2019.
L. V. D. Maaten and Geoffrey E. Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 9:2579-2660 2605, 2008
Saeid Motiian, Quinn Jones, Seyed Iranmanesh, and Gianfranco Doretto. Few-shot adversarial domain adaptation. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach. R. Fergus. S. Vish- wanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems 30, pp. 6670-6680. Curran Associates, Inc., 2017. URL 7244 few--few-sht- addverrrara doma adaptation..ds
ni nips. cc cc/paper/
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: method for automatic
evaluation of machine translation. In Proceedings of the 40th Annual Meeting of the Associa- tion for Computational Linguistics, pp. 311-318, Philadelphia, Pennsylvania, USA. July 2002. Association for Computational Linguistics. doi: 10.3115/1073083.107133. URL https:
// www.b..lwb..oo www.eb.orgggnttttoeeeoeo wttp:///nnooolcy//2-111ggg
Rahul Raguram, Andrew M White, Dibyendusekhar Goswami, Fabian Monrose, and Jan-Michael Frahm. ispy: automatic reconstruction of typed input from compromising reflections. In Pro- ceedings of the I 18th ACM conference on Computer and communications security, pp. 527-536, 2011.
Ashish Shrivastava, Tomas Pfister, Oncel Tuzel, Josh Susskind, Wenda Wang, and Russ Webb. Learning from simulated and unsupervised images through adversarial training, 2016.
Matthew Snover, Bonnie Dorr, Richard Schwartz, Linnea Micciulla, and John Makhoul. A study of translation edit rate with targeted human annotation. In In Proceedings of Association for Machine Translation the Americas, pp. 223-231, 2006.
Jingchao Sun, Xiaocong Jin, Yimin Chen, Jinxue Zhang, Yanchao Zhang, and Rui Zhang. Visible: Video-assisted keystroke inference from tablet backside motion. In NDSS, 2016.
Ilya Sutskever, Oriol Vinyals, and Quoe V. Le. Sequence to sequence learning with neural networks, 2014.
J. B. Tenenbaum and W. T. Freeman, Separating style and content with bilinear models. Neural Computation, 12(6):1247-1288 2000.
Joshua B. Tenenbaum and William T. Freeman. Separating style and content. In M. C.
Mozer, M. I. Jordan, and T. Petsche (eds.), Advances in Neural Information Processing Systems 9, pp. 662-668. MIT Press, 1997. URL http://paper:: nips. cc/paper/ .ddf
1290 10:00--pprrating--. wtwpnnntstlllllllnnoeeeeeeeeeeee
Eric Tzeng, Judy Hoffman, Kate Saenko, and Trevor Darrell. Adversarial discriminative domain adaptation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017.
10

---

Under review as a conference paper at ICLR 2021
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Guyon, U. V. Luxburg, S. Bengio. H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Advances in Neu- ral Information Processing Systems 30, pp- 5998-69980 Curran Associates, Inc., 2017. URL. http:://pppers.nit
Ruben Villegas, Jimei Yang, Seunghoon Hong, Xunyu Lin, and Honglak Lee. Decomposing motion and content for natural video sequence prediction, 2017.
Yi Xu, Jared Heinly, Andrew M White, Fabian Monrose, and Jan-Michael Frahm. Seeing double: Reconstructing obscured typed input from repeated compromising reflections. In Proceedings of the 2013 ACM SIGSAC conference Computer & communications security, pp. 1063-1074, 2013.
Guixin Ye, Zhanyong Tang, Dingyi Fang, Xiaojiang Chen, Kwang In Kim, Ben Taylor, and Zheng Wang. Cracking android pattern lock in five attempts. 2017.
Qinggang Yue, Zhen Ling, Xinwen Fu, Benyuan Liu, Kui Ren, and Wei Zhao. Blind recognition of touched keys on mobile devices. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp. 1403-1414. ACM, 2014.
Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Computer Vision (ICCV), 2017 IEEE Interna- tional Conference on, 2017.

---

Under review as a conference paper at ICLR 2021
A ADDITIONAL TRAINING DETAILS
A.1 SYNTHETIC DATASET COLLECTION
We use the synthetic dataset generator released by Lim et al. (0220) generate synthetic data. We take the headlines dataset released by Kulkarni (2018) ) for our sentences. To preprocess every sentence, change it lower case, remove any special characters, and punctuation marks. The thumb of only right-handed users. The simulator takes in parameters for the user's device and the attacker's camera. We the iPhone 6 the camera parameters and the iPhone XR the user's device.
A.2 REAL-LIFE DATASET COLLECTION
We preprocess the real-life capture data order to compensate for the various capturing angles and positions and adversary can take. More specifically, for every video: 1. We crop out the location of the mobile phone. 2. Manually label the corners of phone. Calculate homography H matrix between the labeled corners and corners of template image. 4. Warp the captured image to the template image using H. All aligned images are resized to 200 100 and then cropped to only display the keyboard. We capture from distances up to 3 meters where the attacker is using iPhone6 camera and the user is using an iPhone XR.
A.3 ALGORITIM BLOCK
Algorithm 1: Learning Algorithm for Disentangling Style and Content.
Input: Ec. Es, M, Ds. Dc. G, DM. Ds, Dr
Result: Well-trained Éc, Well-trained És, Well-trained M, and Well-trained & while Not Converged do sample mini-batch of b synthetic samples, {(X}, Yf), (Xg. Yty) from Ds sample mini-batch of real-life samples, {(X}. YI),..... (X,, Yt,) } from Dr
Style Disentanglement: Remove Style information from the Content Space update Ds and Eg with LAdeDs
Content Disentanglement. Remove Content information from the Style Space update De with LAdePo update Es with LAdvEg Sequence Prediction
10
update Ec, Es, G, M with Cats Semantic Alignment
11
12
update DM with LAdvDst
13
update M, Ec, andEs with LAduae
14 end
return EC = Ec.. Es = Es. M M.G-G
15
A.4 SYNTHETIC SINGLE KEY PRESS CLASSIFIER
We train CNN, <(-), for the task of single key press classification in order to learn a d' dimenssiia (d 128) feature extractor. Training with almost 50k synthetic videos where the average sequence length is 387 is computationally expensive. Once this network is fully trained for the task single key press classification,
extract the features of each video per-frame basis.
Data Preparation First, we use the simulator (Lim et al. 2020) to generate 70,000 single key press images. These images contain the synthetic thumb over one of 27 keys on the QWERTY keyboard (26 letters + the space bar). Once generated, these images are preprocessed in a similar fashion to the synthetic video dataset. We resize the images size 200 X 100 and crop the phone such that only the keyboard is showing. We use 50,000 images for training and 10,000 images for testing and validation, respectively.
12

---

Under review as a conference paper at ICLR 2021
Training Details and Results We use CNN where each layer consists of Convolution Layer, ReLU activation, and MaxPool operation. We use layers and 2 fully connected layers. We were able to train network to achieve 95% accuracy or architecture search, as this is a fairly simple 27-way classification task. We use this final model preprocess every frame in synthetic video dataset. Every video is d- dimensionnl feature representations. We use the Adam optimizer with a learning rate of 1e-3.
held out test set without much hyperparameter
sequence of these
A.5 REAL-LIFE SINGLE KEY PRESS CLASSIFIER
When extracting the visual features for the real-life videos, we can not use feature extractor that was trained only on synthetic data. There is distribution shift between the synthetic and real-life data, so the features we extract would be not be informative. Instead of using 6(-) that was trained for single keypress classification on just synthetic data, we train o(.) with a combination of synthetic and real-life data. Specifically, we adopt the ADDA (Tzeng et al. 2017) framework for unsupervised domain adaptation to train (--).
Data Preparation We treat the individual frames for all of the videos our real-life training set as unlabeled data. Even though we do not have labels for individual keypresses for real-life data, we can leverage the fact that we have abundant labels for synthetic data by adopting the unsupervised domain adaptation technique ADDA.
Training Details and Results We use the CNN for single key press classification on synthetic data as our pretrained network. The Discriminator followed by sigmoid. We follow the same guidelines to train ADDA as the original paper (Tzeng al., 2017), and refer the reader this work for the full description of their training process. We use the Adam optimizer and learning rate of 1e-3 for both the Discriminator and CNN.
1 layer, 128-dimensional fully connected layer
A.6 NETWORK ARCHITECTURES
For all experiments, the Encoders (Ec, Eg) and Decoders (Do, G) are both Transformers with 4 layers, 4 attention heads, an embedding size of 128 and a hidden size of 256. Da and Dg are both 1-layer fully connected layers. Since the output of the Encoder is sequence of continuous representations, where n. is the input sequence length, we do a max pooling operation along the temporal dimension so that have fixed vector representation. These fixed vector representations are the direct inputs to DM and Ds. The max sequence length is set at 300, and the max phrase length is set at 70. If an input sequence has more than 300 frames, we randomly sample 300 frames at each epoch. If a vidco in the testing or validation set has more than 300 frames, we fix the indices of the sampled frames remove any randomness for evaluation. For imput sequences that are shorter than 300 frames, we zero- pad the remaining sequence.
A.7 ADDITIONAL TRAINING DETAILS SYNTHETIC SEQ2SEQ
We dropout value of p 0.1 and the Adam optimizer with learning rate 1c-4. We train the network for 400 epochs.
A.8 ADDITIONAL TRAINING DETAILS- FINETUNING
We use the o(.) trained on a combination of real-life and synthetic data described in A.5 We do not fix extract fixed d-dimensional representation for every frame in the real-life video order to preprocess or reduce computational costs. Since we are dealing with such few real-life videos, handling raw videos is not as computationally expensive. Doing this lets us apply data augmenta- tion techniques on the image space versus the feature space. Also, we can continue to adjust the weights of d(-). Table shows the various configurations we experimented with for finetuning. We experimented with different combinations of freezing networks and tuning learning rates. We were unable to discover any combination that did not overfit to the training data. For all experiments, we the Adam optimizer.
13

---

Under review as a conference paper at ICLR 2021
Frozen Layers
R-DDccdeer
LR-Encoder
IR-Ø(-)
Bleu-I
None
le-4
le-4
le-4
0.15
None
1e-4
le-5
le-5
0.12
None
le-5
le-5
le-5
0.12
((-)
le-4
le-4
0.12
((-)
le-5
le-5
0.15
Encoder
le-4
0
le-4
0.14
Encoder
le-5
le-5
0.14
Decoder
0
le-4
le-4
0.12
Decoder
le-4
le
5
0.08
Encoder, Decoder
le-4
Table The different hyperparameters we tuned maximize the performance for finetuning.
A.9 ADDITIONAL TRAINING DETAILS ADDA
ADDA (Tzeng al. 2017) is unsupervised domain adaptation method that learns feature repre- sentation that is domain invariant and discriminative. While this framework was originally proposed for UDA, it be easily extended
supervised domain adaptation scenario. To follow the ADDA framework, we initialize the weights of our Encoder and Decoder with the ones pretrained on synthetic data. Then, we train on mini-batches of both synthetic and real-life videos such that the Decoder can predict the input video's labels, but the Encoder produces representations that are invariant domain, i.e., synthetic vs. real. We train in adversarial fashion where the Discriminator is trained to successfully predict the domain of its input, and the Encoder is trained to spoof the Discriminator. The Discriminator used this experiment is the same one we use for our method, Ds. To get the input for Ds. we first perform a maxpool operation on the output of the Encoder. We also tried to use a layer LSTM with hidden size of 256 as our Discriminator, For the LSTM Discriminator, the imput is the entire sequence of the Transformer output for the last time step is used as input to linear layer followed by a sigmoid for binary classification. Table 4 highlights the different hyperparameters tried to maximize performance.
pooling. The output
A.10 ALGGORITH BLOCK
Algorithm 2: Learning Algorithm for ADDA.
Input: Ec, G, Ds, Ds, Dr
Result: Well-trained Encoder Eg and Well-trained Decoder Ess while Not Converged do
sample mini-batch synthetic samples, {(Xf, (f,Y .... (Xz, Y2") ) } from Ds sample mini-batch
real-life samples, {(X,, Yi). .... (Xf, Y2)) from Dr
Domain Invariance: Make Encoder outputs domain invariant update Ds and Eg with LAdEDs
Sequence Prediction: Make Encoder outputs discriminative update Ec and G with Coie
end
return Éc Ec. G=G
A.11 ADDITIONAL. TRAINING DETAILS- CYCLEGAN
CycleGAN (Zhu et al. 2017) learns pixel-wise transformation functions F - T and G T S that can transform data from the source domain to the target domain, and vice versa. We take 10,000 random frames from the synthetic and real-life video datasets and train F and G in an unpaired fashion. train using the default CycleGAN hyperparameters reported in Zhu et al. (2017) and train for 200 epochs. We take G and transform every frame in real-life dataset to the synthetic space. We found that images transformed under G (i.e, real to synthetic) yielded higher quality transformations (c.g., the thumb as opposed to the transformed images produced by F. Then, we finetune on the transformed real- life training set and test on the transformed real-life test set. Simply testing the transformed
not malformed, the thumb
placed on the correct key, etc.)
14

---

Under review as a conference paper at ICLR 2021
Frozen Layers
Architecture
LR-Decoder
LR-Encoder
[R-Ø(-)
Bleu-1
None
128-FC
le-4
le-4
le-4
0.13
None
Lstm
le-4
le-4
le-4
0.15
None
128-FC
le
le-5
le-5
0.14
None
Lstm
le
le-5
0.16
Encoder
128-FC
le-4
0
1e-4
0.13
Encoder
Lstm
le
le
0.17
Decoder
128-FC
le-
0.1
Decoder
Lstm
0
le-4
le-4
0.1
Decoder
128-FC
0
le-4
le
0.08
Decoder
Lstm
le-4
le-5
0.07
Encoder, Decoder
128-FC
0
0
1e-4
0
Encoder, Decoder
Lstm
0
1e-4
0
Table 4:
The different hyperparameters we tuned to maximize the performance for ADDA.
real-life test set is not sufficient as the CycleGAN approach does not address temporal domain shift as the transformations are performed independently to address this temporal shift. We use the Φ(-) from the synthetic key press classifier. Table 5 the different configurations of learning rates and weight freezing experimented on for finetuning. Despite finetuning on the transformed data, this method still overfits to the training set and is unable generalize.
per-frame basis. Thus,
finctuning
Frozen Layers
LR-Decoder
LR-Encoder
LR-Ø(-)
Blcu-I
None
le-4
le-4
le-4
0.17
None
le-4
le-5
le-5
0.17
None
le-5
le-5
le-5
0.13
66.)
le-4
le-4
0.13
(--)
le-5
le-5
0
0.15
Encoder
le-4
1e-4
0.15
Encoder
le-5
1e-5
0.16
Decoder
0
le-4
le-4
0.12
Decoder
0
1e-4
1e-5
0.14
Encoder, Decoder
le-4 4
0.13
Table The different hyperparameters we tuned maximize the performance for CycleGAN.
Figure 6: An example of the outputs of CycleGAN (Zhu et al. 2017). The top is the output of CycleGAN and the bottom is the original real-life image.
Figure deppccts an example the outputs of the CycleGAN network we train. We show the outputs of G: T S. The top row contains the output of G' where the bottom row is the real-life input. The thumb for the synthetic outputs is, for the most part, on the same location as the rea-life input. While the thumb being placed the correct location is important, it is not sufficient fully address the domain gap between the synthetic and real. This because this method does address the temporal shift. These transformations done a per-frame basis. The different thumb colors an artifact of this method displaying temporal inconsistency.
A.12 ADDITIONAL. TRAINING DETAILS OURS
We use the Adam optimizer with learning rate of le-4 for all of our networks. We train for 60k iterations with batch size of 8, and use dropout value of O. 15. We use the validation tune the
15

---

Under review as a conference paper at ICLR 2021
different weightings for our loss function. We set A1 1.0, A2 =0255, A3 = 1.0, 1.0, 1.0 and Ås = 1.0.
16


Reviews:
[{"review_id": "u6MXaiD89c9", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors introduce a video domain adaptation technique that learns to disentangle style and content of a video in order to generate as form of data augmentation. The main idea is to train a style and content encoder and enforce \n1)\tThe output of the style encoder cannot be used to determine keystrokes \n2)\tThe output distribution of the content encoder for real and synthetic data cannot be distinguished. \nThey motivate their problem by recognizing that deep learning-based keystroke inference attacks are trained with a small number of real data along with a larger number of synthetic data. This results in the need for data augmentation via domain adaptation.\n\nPros:\nThe proposed method of disentanglement and combination in the feature space for classification is novel and interesting. Figures are well done and informative. Multiple evaluation metrics were used, and it is clear that the framework is useful under the considered setting. \n\n\nCons/Comments:\nThe output of style encoder gives you a representation that maximizes the prediction loss in order to lose content information. The output of content encoder on the other hand, gives a domain invariant representations that presumably holds all the information needed for classification. The authors propose combining them with a decoder in various combination in order to do data augmentation. However, it is not clear to me how would style representation be useful in this data augmentation. In the case where style representation is totally ignored and decoder only looks at the content representation, it minimizes the prediction loss (Eq 5) and also the semantic alignment loss (Eq 8). While Table 2 shows it clearly improves the results, I am unsure of the exact reasoning on how the losses help the style encoder in encoding anything useful for the final classification. \n\nIn general, I find this paper well-written and well-motivated. The method is novel and produces good results over other baselines. I recommend this paper for acceptance.", "extra_scores": {}, "extra_text": {}}, {"review_id": "qPmbbxGNjdC", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors investigate video domain adaption for keystroke inference attacks on synthetic and real-life data. They propose a disentangle model to separate the representation of content and style. In their problem, style encapsulates the trajectory of the finger in between keys or speed of the user typing, while content represents the typed sentence. The model is naive by simply applying the adversarial domain adaptation into the keystroke inference attacks. Also, I suspect the paper is more suitable for the security conference, e.g., S&P. In addition, there still exists the following concerns.\n\n+ lack comparison to the state-of-the-art methods, such as:\n   John Lim et al, 'Revisiting the Threat Space for Vision-based Keystroke Inference Attacks', in arXiv preprint arXiv:2009.05796, 2020.\n\n+ lacks comparison to the state-of-the-art domain adaptation methods, such as:\n    Ehsan Hosseini-Asl et al, 'AUGMENTED CYCLIC ADVERSARIAL LEARNING FOR LOW RESOURCE DOMAIN ADAPTATION', in ICLR 2019.\n\n+ In addition to CycleGAN, video to video translation methods should be included: \n  Ting-Chun Wang et al, 'Video-to-Video Synthesis', in NeurIPS 2018.\n\n+ I notice that the generated results quality of CycleGAN (in Figure 6) is poor. The background is black and only a thumb is generated. Please explain the reason.\n\n+ The paper claims that the proposed method can separate the style () and content. The visualization or demonstration is needed to support their claims.", "extra_scores": {}, "extra_text": {}}, {"review_id": "_KcmoPlQNvp", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper is about keystroke inference attacks and proposes a method to assess the threat of deep learning based approaches\nwhen only limited real-life data are available. To this end, it is introduced a video domain adaptation technique\nthat is able to generate data into separate style and content representations. This data augmentation scheme is shown to be effective and prevents overfitting.\n\nThis is an interesting applicative approach, but I believe that the introduced novelty is probably limited for ICLR. Two claimed contributions are the assessment of deep learning methods for keystroke inference attacks when limited data are available and the domain adaptation approach to generate synthetic data. Now these contributions have been also introduced recently in Lim et al. (2020). One difference is that the threat scenario is based on single keypresses,  while in this submission complete sequences are tackled. In addition, in Lim et al. it is used the adversarial discriminative domain adaptation (ADDA) technique introduced by Tzeng et al. 2017, while in this submission a supervised disentangled learning based approach is proposed.\nGiven these similarities I would have expected more discussion in the related work about this paper and also some comparison between single keypresses results vs complete sequences. Furthermore, from Table 1 it appears that ADDA provides much worse results with respect to the proposed method. Then a discussion is needed since it has been used in Lim et al. achieving good performance in a similar context.\n\nFor what concern the supervised disentangled learning based approach, I think that the authors should make very clear which is the introduced novelty with respect to current state-of-the-art methods. In particular, which are the new components of the proposed method. In this respect it would be helpful to make comparisons with some baselines. This would help to assess the relevance of the proposal.\n\nAs a final minor comment I think it would be important to provide more information about the real life dataset used in the experiments, for example by indicating how many participants where involved.\n\n=============== Post rebuttal comments ===============\n\nFirst of all, I want to thank the authors for answering my questions.\nThe clarifications confirm my previous concern about the limited technical novelty.\nIn addition, they highlight that only three participants were involved to build the real life dataset used in the experiments.\nIn my opinion this is not sufficient to carry out a significant evaluation.\nFor these reasons I keep my original rating.", "extra_scores": {}, "extra_text": {}}, {"review_id": "BSs9lcKcNdJ", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors focus on keystroke inference attacks in which an attacker leverages machine learning approaches,  In particular, a new framework is proposed for low-resource video domain adaptation using supervised disentangled learning, and another method to assess the threat of keystroke inference attacks by an attacker using a deep learning system, given limited real-life data. The novelty of the approach and its theoretical foundation is appreciated. For a given domain, they decompose the data into real-life style, synthetic style, real-life content, and synthetic content, and then combine them into feature representations from all combinations of style-content pairings across domains to train a model, This allows classify the content of a sample in the style of another domain. Results indicate that training with these pairs to disentangle style and content prevents their model from overfitting to a small real-world training sets, and thereby provides an effective form of data augmentation that prevents overfitting.\n\nThe paper is clearly written and well organized, and all the key concepts and motivations are described in enough detail to understand the paper.  However, it is not clear from the outset the amount of limited real-world data should be collected from the target domain. It should also be clarified at the beginning why their data augmentation that prevents models overfitting, and why translated to better security against keystroke inference attacks.\n\nThe experimental validation should include an analysis of the impact on the performance of the amount of real-world target domain data, the class imbalance, and capture conditions. The supplementary material provides additional information on the training setup that should be useful to the reader. It however seems like their code is not made available, so there is a concern that the results in this paper would be very difficult for a reader to reproduce.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper focuses proposes a new framework for low-resource video domain adaptation leveraging synthetic data with supervised disentangled learning for tackling keystroke inference attacks.

The paper received contrasting reviews, 2 positive and 2 negative, and the overall confidence of the reviewers is not so high.
Overall, it is recognized that the work has some merit, but also some problems, which the rebuttal has not fully fixed, and I mainly refer to R2, R3 and R4 remarks. 

The first issue is the level of novelty, which is not much high as compared to the former work of (Moiitan et al. 2017). Besides, the questions raised by some reviewers, also discussed in the rebuttal, also denote a certain lack of clarity, despite the paper is considered well organised in general. 

The other main issue regards the experimental evaluation. To start with, the application addressed is very specific and it is not clear how this approach can be extended to other problems too, since no evidence is provided in this sense. The reported comparative analysis wrt baselines are in fact quite "simple" (e.g., ADDA is a work dated back to 2017, so as CycleGAN). Moreover, although the considered dataset is the only one in this scenario, its significance is a bit limited since only 3 subjects were considered, and this likely raised the comment of one reviewer questioning if this paper was not better suited to an application-oriented, security conference. A discussion for the setting of the lambda parameters is also missing.

Overall, given the above issues, I consider the paper not yet ready for publication in ICLR 2021.

Decision: Reject